==================================================================
BUG: KASAN: use-after-free in task_css include/linux/cgroup.h:455 [inline]
BUG: KASAN: use-after-free in task_ca kernel/sched/cpuacct.c:53 [inline]
BUG: KASAN: use-after-free in cpuacct_charge+0x328/0x360 kernel/sched/cpuacct.c:359
Read of size 8 at addr ffff8801d83e4060 by task syz-executor634/3842

CPU: 0 PID: 3842 Comm: syz-executor634 Not tainted 4.9.122-g54068d6 #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d8a279a0 ffffffff81eb8829 ffffea000760f900 ffff8801d83e4060
 0000000000000000 ffff8801d83e4060 0000000000000000 ffff8801d8a279d8
 ffffffff8156b6be ffff8801d83e4060 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81eb8829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb8829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8156b6be>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff8156bac8>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff8156bac8>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153f304>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff8122d848>] task_css include/linux/cgroup.h:455 [inline]
 [<ffffffff8122d848>] task_ca kernel/sched/cpuacct.c:53 [inline]
 [<ffffffff8122d848>] cpuacct_charge+0x328/0x360 kernel/sched/cpuacct.c:359
 [<ffffffff811e82ab>] update_curr+0x28b/0x680 kernel/sched/fair.c:874
 [<ffffffff811f57f3>] dequeue_entity kernel/sched/fair.c:3721 [inline]
 [<ffffffff811f57f3>] dequeue_task_fair+0xe3/0x1000 kernel/sched/fair.c:4903
 [<ffffffff811ccf0b>] dequeue_task kernel/sched/core.c:782 [inline]
 [<ffffffff811ccf0b>] deactivate_task+0xfb/0x2e0 kernel/sched/core.c:798
 [<ffffffff839f0101>] __schedule+0x981/0x1bd0 kernel/sched/core.c:3458
 [<ffffffff839f13cf>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
 [<ffffffff839fe325>] freezable_schedule include/linux/freezer.h:171 [inline]
 [<ffffffff839fe325>] do_nanosleep+0x1f5/0x4d0 kernel/time/hrtimer.c:1497
 [<ffffffff812a85a0>] hrtimer_nanosleep+0x210/0x540 kernel/time/hrtimer.c:1566
 [<ffffffff812fdd3e>] C_SYSC_nanosleep kernel/compat.c:254 [inline]
 [<ffffffff812fdd3e>] compat_SyS_nanosleep+0x27e/0x390 kernel/compat.c:239
 [<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 [<ffffffff83a023d0>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Allocated by task 7344:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kmem_cache_alloc_trace+0xfd/0x2b0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 find_css_set kernel/cgroup.c:1087 [inline]
 cgroup_migrate_prepare_dst+0x779/0x1810 kernel/cgroup.c:2723
 cgroup_update_dfl_csses kernel/cgroup.c:3103 [inline]
 cgroup_apply_control+0x35f/0x650 kernel/cgroup.c:3357
 cgroup_subtree_control_write+0x9d2/0xf40 kernel/cgroup.c:3490
 cgroup_file_write+0x10d/0x550 kernel/cgroup.c:3517
 kernfs_fop_write+0x2ae/0x460 fs/kernfs/file.c:316
 __vfs_write+0x115/0x580 fs/read_write.c:507
 vfs_write+0x187/0x530 fs/read_write.c:557
 SYSC_write fs/read_write.c:604 [inline]
 SyS_write+0xd9/0x1c0 fs/read_write.c:596
 do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Freed by task 0:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 __rcu_reclaim kernel/rcu/rcu.h:113 [inline]
 rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 rcu_process_callbacks+0x9d5/0x12b0 kernel/rcu/tree.c:3037
 __do_softirq+0x210/0x940 kernel/softirq.c:288

The buggy address belongs to the object at ffff8801d83e4000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 96 bytes inside of
 512-byte region [ffff8801d83e4000, ffff8801d83e4200)
The buggy address belongs to the page:
page:ffffea000760f900 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d83e3f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff8801d83e3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801d83e4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff8801d83e4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801d83e4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================