================================================================== BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0x1b8/0x1d0 Read of size 8 at addr ffff8801cc80f460 by task syz-executor1/4547 CPU: 0 PID: 4547 Comm: syz-executor1 Not tainted 4.14.0-rc5-next-20171017+ #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0x173/0x237 print_address_description+0x6e/0x250 kasan_report+0x251/0x340 deref_stack_reg+0x1b8/0x1d0 unwind_next_frame+0xebc/0x1df0 __save_stack_trace+0x6e/0xd0 save_stack+0x32/0xb0 kasan_slab_free+0x71/0xc0 kmem_cache_free+0x72/0x280 rcu_process_callbacks+0xcd4/0x1600 __do_softirq+0x2ba/0xafb irq_exit+0x1c7/0x200 smp_apic_timer_interrupt+0x154/0x6b0 apic_timer_interrupt+0x96/0xa0 RIP: 0010:lock_is_held_type+0x84/0x200 RSP: 0000:ffff8801cc80f1c0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff11 RAX: dffffc0000000000 RBX: ffff8801d29421c0 RCX: 0000000000000000 RDX: 1ffffffff0ad8f50 RSI: 00000000ffffffff RDI: ffffffff856c7a80 RBP: ffff8801d653b1c0 R08: 0000000000000003 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85737c60 R13: ffffffff81d9b466 R14: ffff8801d29421c0 R15: ffff8801d29421c0 jbd2_journal_stop+0x466/0x13c0 The buggy address belongs to the page: page:ffffea00073203c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() raw: 0200000000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801cc80f300: f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 00 f2 ffff8801cc80f380: f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 f2 f2 00 f2 >ffff8801cc80f400: f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f3 f3 f3 f3 00 00 ^ ffff8801cc80f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801cc80f500: 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 ==================================================================