==================================================================
BUG: KASAN: slab-out-of-bounds in predicate_parse kernel/trace/trace_events_filter.c:562 [inline]
BUG: KASAN: slab-out-of-bounds in process_preds+0x1905/0x19d0 kernel/trace/trace_events_filter.c:1509
Read of size 4 at addr ffff8801c39dfff0 by task syz-executor3/15453

CPU: 0 PID: 15453 Comm: syz-executor3 Not tainted 4.17.0+ #39
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 predicate_parse kernel/trace/trace_events_filter.c:562 [inline]
 process_preds+0x1905/0x19d0 kernel/trace/trace_events_filter.c:1509
 create_filter+0x155/0x270 kernel/trace/trace_events_filter.c:1717
 ftrace_profile_set_filter+0x130/0x2e0 kernel/trace/trace_events_filter.c:2042
 perf_event_set_filter+0x22e/0x1230 kernel/events/core.c:9078
 _perf_ioctl+0x84c/0x15e0 kernel/events/core.c:5059
 perf_ioctl+0x59/0x80 kernel/events/core.c:5110
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455b29
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007f21ab6bfc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f21ab6c06d4 RCX: 0000000000455b29
RDX: 0000000020000340 RSI: 0000000040082406 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004c4da8 R14: 00000000004cc250 R15: 0000000000000000

Allocated by task 2414:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
 kmem_cache_zalloc include/linux/slab.h:696 [inline]
 get_empty_filp+0x125/0x520 fs/file_table.c:122
 path_openat+0x116/0x4dc0 fs/namei.c:3487
 do_filp_open+0x249/0x350 fs/namei.c:3545
 do_sys_open+0x56f/0x740 fs/open.c:1101
 __do_sys_open fs/open.c:1119 [inline]
 __se_sys_open fs/open.c:1114 [inline]
 __x64_sys_open+0x7e/0xc0 fs/open.c:1114
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 13945:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
 file_free_rcu+0x6f/0x90 fs/file_table.c:49
 __rcu_reclaim kernel/rcu/rcu.h:178 [inline]
 rcu_do_batch kernel/rcu/tree.c:2558 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
 rcu_process_callbacks+0xe9d/0x1760 kernel/rcu/tree.c:2802
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:284

The buggy address belongs to the object at ffff8801c39dfd40
 which belongs to the cache filp of size 456
The buggy address is located 232 bytes to the right of
 456-byte region [ffff8801c39dfd40, ffff8801c39dff08)
The buggy address belongs to the page:
page:ffffea00070e77c0 count:1 mapcount:0 mapping:ffff8801da986940 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006c5cc88 ffffea00071e7308 ffff8801da986940
raw: 0000000000000000 ffff8801c39df0c0 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c39dfe80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c39dff00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801c39dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                             ^
 ffff8801c39e0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801c39e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================