==================================================================
BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
BUG: KASAN: use-after-free in fuse_dev_do_read.isra.11.constprop.15+0x14b7/0x18b0 fs/fuse/dev.c:1314
Read of size 8 at addr ffff8801cc0b94b8 by task syz-executor3/9087

CPU: 0 PID: 9087 Comm: syz-executor3 Not tainted 4.9.132+ #51
 ffff8801a24e7958 ffffffff81b371b9 ffffea0007302e00 ffff8801cc0b94b8
 0000000000000000 ffff8801cc0b94b8 ffff8801c5b5fd08 ffff8801a24e7990
 ffffffff81500bad ffff8801cc0b94b8 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81b371b9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b371b9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81500bad>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81500fb7>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81500fb7>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814f31c4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff818659f7>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff818659f7>] fuse_dev_do_read.isra.11.constprop.15+0x14b7/0x18b0 fs/fuse/dev.c:1314
 [<ffffffff81865f46>] fuse_dev_read+0x156/0x1f0 fs/fuse/dev.c:1356
 [<ffffffff81507fd4>] new_sync_read fs/read_write.c:439 [inline]
 [<ffffffff81507fd4>] __vfs_read+0x3d4/0x560 fs/read_write.c:451
 [<ffffffff8150a994>] vfs_read+0x124/0x390 fs/read_write.c:472
 [<ffffffff8150e9f9>] SYSC_read fs/read_write.c:588 [inline]
 [<ffffffff8150e9f9>] SyS_read+0xd9/0x1c0 fs/read_write.c:581
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82803953>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 9085:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58
 fuse_request_alloc fs/fuse/dev.c:86 [inline]
 __fuse_get_req+0x19e/0x510 fs/fuse/dev.c:169
 fuse_get_req fs/fuse/dev.c:191 [inline]
 fuse_simple_request+0x28/0x660 fs/fuse/dev.c:546
 fuse_lookup_name+0x253/0x5d0 fs/fuse/dir.c:369
 fuse_lookup+0xf3/0x3b0 fs/fuse/dir.c:407
 lookup_slow+0x24a/0x470 fs/namei.c:1668
 walk_component+0x822/0xcf0 fs/namei.c:1784
 lookup_last fs/namei.c:2266 [inline]
 path_lookupat.isra.10+0x186/0x410 fs/namei.c:2283
 filename_lookup.part.18+0x177/0x370 fs/namei.c:2317
 filename_lookup fs/namei.c:2310 [inline]
 user_path_at_empty+0x53/0x70 fs/namei.c:2578
 user_path_at include/linux/namei.h:55 [inline]
 vfs_fstatat+0xc6/0x170 fs/stat.c:106
 vfs_lstat fs/stat.c:129 [inline]
 SYSC_newlstat fs/stat.c:283 [inline]
 SyS_newlstat+0x89/0x100 fs/stat.c:277
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 9085:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101
 fuse_put_request+0x261/0x310 fs/fuse/dev.c:298
 fuse_simple_request+0x3db/0x660 fs/fuse/dev.c:568
 fuse_lookup_name+0x253/0x5d0 fs/fuse/dir.c:369
 fuse_lookup+0xf3/0x3b0 fs/fuse/dir.c:407
 lookup_slow+0x24a/0x470 fs/namei.c:1668
 walk_component+0x822/0xcf0 fs/namei.c:1784
 lookup_last fs/namei.c:2266 [inline]
 path_lookupat.isra.10+0x186/0x410 fs/namei.c:2283
 filename_lookup.part.18+0x177/0x370 fs/namei.c:2317
 filename_lookup fs/namei.c:2310 [inline]
 user_path_at_empty+0x53/0x70 fs/namei.c:2578
 user_path_at include/linux/namei.h:55 [inline]
 vfs_fstatat+0xc6/0x170 fs/stat.c:106
 vfs_lstat fs/stat.c:129 [inline]
 SYSC_newlstat fs/stat.c:283 [inline]
 SyS_newlstat+0x89/0x100 fs/stat.c:277
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801cc0b9488
 which belongs to the cache fuse_request of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff8801cc0b9488, ffff8801cc0b9650)
The buggy address belongs to the page:
page:ffffea0007302e00 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801cc0b9380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801cc0b9400: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801cc0b9480: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff8801cc0b9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801cc0b9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================