==================================================================
BUG: KASAN: use-after-free in relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
Read of size 8 at addr ffff888092ee9cb8 by task syz-executor.4/11754

CPU: 1 PID: 11754 Comm: syz-executor.4 Not tainted 5.3.0-rc4+ #133
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351
 __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482
 kasan_report+0x12/0x17 mm/kasan/common.c:612
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
 relay_reserve include/linux/relay.h:261 [inline]
 trace_note.isra.0+0x5b8/0x6e0 kernel/trace/blktrace.c:93
 trace_note_tsk kernel/trace/blktrace.c:124 [inline]
 __blk_add_trace+0xb70/0xe10 kernel/trace/blktrace.c:264
 blk_add_trace_rq+0x185/0x1f0 kernel/trace/blktrace.c:813
 blk_add_trace_rq_complete+0x17a/0x1e0 kernel/trace/blktrace.c:842
 trace_block_rq_complete include/trace/events/block.h:116 [inline]
 blk_update_request+0x851/0xc10 block/blk-core.c:1403
 scsi_end_request+0x7f/0x840 drivers/scsi/scsi_lib.c:579
 scsi_io_completion+0x360/0x1420 drivers/scsi/scsi_lib.c:963
 scsi_finish_command+0x3b7/0x670 drivers/scsi/scsi.c:228
 scsi_softirq_done+0x326/0x3b0 drivers/scsi/scsi_lib.c:1465
 blk_done_softirq+0x2fe/0x4d0 block/blk-softirq.c:37
 __do_softirq+0x262/0x98c kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x19b/0x1e0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:537 [inline]
 do_IRQ+0x12c/0x200 arch/x86/kernel/irq.c:259
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:607
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x54/0x90 kernel/locking/spinlock.c:199
Code: c0 20 f3 d2 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 33 48 83 3d d5 57 95 01 00 74 20 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 12 24 11 fa 65 8b 05 a3 62 c4 78 85 c0 74 06 41
RSP: 0018:ffff88801fc17540 EFLAGS: 00000282 ORIG_RAX: ffffffffffffffdd
RAX: 1ffffffff11a5e64 RBX: ffff888090a403c0 RCX: 1ffffffff134b486
RDX: dffffc0000000000 RSI: ffffffff8177ed9e RDI: ffffffff873d9b28
RBP: ffff88801fc17548 R08: ffff888090a403c0 R09: ffffed1015d26ad1
R10: ffffed1015d26ad0 R11: ffff8880ae935683 R12: ffff8880ae935680
R13: ffff8880937d6680 R14: 0000000000000000 R15: 0000000000000002
 finish_lock_switch kernel/sched/core.c:3004 [inline]
 finish_task_switch+0x147/0x720 kernel/sched/core.c:3104
 context_switch kernel/sched/core.c:3257 [inline]
 __schedule+0x75d/0x1580 kernel/sched/core.c:3880
 preempt_schedule_common+0x4f/0xe0 kernel/sched/core.c:4025
 preempt_schedule+0x4b/0x60 kernel/sched/core.c:4051
 ___preempt_schedule+0x16/0x20 arch/x86/entry/thunk_64.S:50
 lru_add_drain+0x5c/0x70 mm/swap.c:649
 shrink_inactive_list+0x2a8/0xe30 mm/vmscan.c:1977
 shrink_list mm/vmscan.c:2231 [inline]
 shrink_node_memcg+0x621/0x1430 mm/vmscan.c:2496
 shrink_node+0x294/0x16b0 mm/vmscan.c:2711
 shrink_zones mm/vmscan.c:2942 [inline]
 do_try_to_free_pages+0x3cb/0x11f0 mm/vmscan.c:3000
 try_to_free_mem_cgroup_pages+0x314/0xa80 mm/vmscan.c:3299
 reclaim_high.constprop.0+0x12f/0x1a0 mm/memcontrol.c:2347
 mem_cgroup_handle_over_high+0x8e/0x130 mm/memcontrol.c:2372
 tracehook_notify_resume include/linux/tracehook.h:197 [inline]
 exit_to_usermode_loop+0x230/0x380 arch/x86/entry/common.c:163
 prepare_exit_to_usermode+0x2ff/0x370 arch/x86/entry/common.c:194
 retint_user+0x8/0x18
RIP: 0033:0x40e9c8
Code: 8b 34 c6 4a 8d 04 2e 48 3d ff ff ff 7e 0f 86 77 ff ff ff bf 35 ee 4b 00 31 c0 e8 63 33 ff ff 31 ff e8 ac 2f ff ff 0f 1f 40 00 <89> 3c b5 00 00 73 00 eb b6 31 ed 0f 1f 44 00 00 80 3d 9e 1a 66 00
RSP: 002b:0000000000a6fb30 EFLAGS: 00010246
RAX: 00000000d54a59fd RBX: 0000000024be68ba RCX: 0000001b32020000
RDX: 0000000000000000 RSI: 00000000000019fd RDI: ffffffffd54a59fd
RBP: 0000000000000024 R08: 00000000d54a59fd R09: 00000000d54a5a01
R10: 0000000000a6fcd0 R11: 0000000000000246 R12: 000000000075bfa8
R13: 0000000080000000 R14: 00007f91a2f0d008 R15: 0000000000000024

Allocated by task 6951:
 save_stack+0x23/0x90 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc mm/kasan/common.c:487 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:460
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:495
 slab_post_alloc_hook mm/slab.h:520 [inline]
 slab_alloc mm/slab.c:3319 [inline]
 kmem_cache_alloc+0x121/0x710 mm/slab.c:3483
 __d_alloc+0x2e/0x8c0 fs/dcache.c:1688
 d_alloc_pseudo+0x1e/0x70 fs/dcache.c:1817
 alloc_file_pseudo+0xe2/0x280 fs/file_table.c:225
 anon_inode_getfile fs/anon_inodes.c:91 [inline]
 anon_inode_getfile+0xda/0x200 fs/anon_inodes.c:74
 __do_sys_perf_event_open+0x10cc/0x2890 kernel/events/core.c:11009
 __se_sys_perf_event_open kernel/events/core.c:10783 [inline]
 __x64_sys_perf_event_open+0xbe/0x150 kernel/events/core.c:10783
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 6878:
 save_stack+0x23/0x90 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:449
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:457
 __cache_free mm/slab.c:3425 [inline]
 kmem_cache_free+0x86/0x320 mm/slab.c:3693
 __d_free fs/dcache.c:271 [inline]
 dentry_free+0xe9/0x160 fs/dcache.c:348
 __dentry_kill+0x457/0x600 fs/dcache.c:593
 dentry_kill fs/dcache.c:686 [inline]
 dput+0x819/0xde0 fs/dcache.c:859
 __fput+0x424/0x890 fs/file_table.c:293
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x316/0x380 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x5a9/0x6a0 arch/x86/entry/common.c:299
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff888092ee9c60
 which belongs to the cache dentry(33:syz3) of size 288
The buggy address is located 88 bytes inside of
 288-byte region [ffff888092ee9c60, ffff888092ee9d80)
The buggy address belongs to the page:
page:ffffea00024bba40 refcount:1 mapcount:0 mapping:ffff88805e3f5700 index:0xffff888092ee9420
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00008e0dc8 ffffea00024b1e48 ffff88805e3f5700
raw: ffff888092ee9420 ffff888092ee9000 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888092ee9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888092ee9c00: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb
>ffff888092ee9c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888092ee9d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888092ee9d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================