==================================================================
BUG: KASAN: use-after-free in relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
Read of size 8 at addr ffff8880925d4358 by task kworker/0:1H/2639

CPU: 0 PID: 2639 Comm: kworker/0:1H Not tainted 5.5.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kblockd blk_mq_run_work_fn
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
 relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755
 relay_reserve include/linux/relay.h:261 [inline]
 trace_note.isra.0+0x5dc/0x760 kernel/trace/blktrace.c:92
 trace_note_tsk kernel/trace/blktrace.c:123 [inline]
 __blk_add_trace+0xcd8/0xf80 kernel/trace/blktrace.c:263
 blk_add_trace_rq+0x185/0x1f0 kernel/trace/blktrace.c:809
 blk_add_trace_rq_issue+0x82/0xb0 kernel/trace/blktrace.c:823
 trace_block_rq_issue include/trace/events/block.h:207 [inline]
 blk_mq_start_request+0x3dd/0x7a0 block/blk-mq.c:656
 loop_queue_rq+0x7e/0x590 drivers/block/loop.c:1911
 blk_mq_dispatch_rq_list+0x9f8/0x19e0 block/blk-mq.c:1246
 blk_mq_do_dispatch_sched+0x1a3/0x430 block/blk-mq-sched.c:115
 blk_mq_sched_dispatch_requests+0x3f4/0x6d0 block/blk-mq-sched.c:211
 __blk_mq_run_hw_queue+0x1cc/0x2e0 block/blk-mq.c:1382
 blk_mq_run_work_fn+0x5c/0x70 block/blk-mq.c:1641
 process_one_work+0xa05/0x17a0 kernel/workqueue.c:2264
 worker_thread+0x98/0xe40 kernel/workqueue.c:2410
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 7526:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc mm/kasan/common.c:515 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:488
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:523
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x121/0x710 mm/slab.c:3484
 __d_alloc+0x2e/0x8c0 fs/dcache.c:1690
 d_alloc_pseudo+0x1e/0x70 fs/dcache.c:1819
 alloc_file_pseudo+0xe2/0x280 fs/file_table.c:225
 sock_alloc_file+0x54/0x190 net/socket.c:411
 sock_map_fd net/socket.c:435 [inline]
 __sys_socket+0x150/0x220 net/socket.c:1530
 __do_sys_socket net/socket.c:1535 [inline]
 __se_sys_socket net/socket.c:1533 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1533
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 7521:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:337 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:476
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
 __cache_free mm/slab.c:3426 [inline]
 kmem_cache_free+0x86/0x320 mm/slab.c:3694
 __d_free fs/dcache.c:271 [inline]
 dentry_free fs/dcache.c:348 [inline]
 dentry_free+0xed/0x170 fs/dcache.c:336
 __dentry_kill+0x457/0x600 fs/dcache.c:593
 dentry_kill fs/dcache.c:686 [inline]
 dput+0x821/0xe10 fs/dcache.c:859
 __fput+0x424/0x890 fs/file_table.c:293
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xba9/0x2f50 kernel/exit.c:801
 do_group_exit+0x135/0x360 kernel/exit.c:899
 __do_sys_exit_group kernel/exit.c:910 [inline]
 __se_sys_exit_group kernel/exit.c:908 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:908
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880925d4300
 which belongs to the cache dentry(81:syz4) of size 288
The buggy address is located 88 bytes inside of
 288-byte region [ffff8880925d4300, ffff8880925d4420)
The buggy address belongs to the page:
page:ffffea0002497500 refcount:1 mapcount:0 mapping:ffff88809936b8c0 index:0xffff8880925d4ca0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea000249fc48 ffffea0002490388 ffff88809936b8c0
raw: ffff8880925d4ca0 ffff8880925d4040 0000000100000008 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880925d4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880925d4280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8880925d4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff8880925d4380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880925d4400: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
==================================================================