==================================================================
BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 block/genhd.c:1543
Read of size 8 at addr ffff8800b9ce2768 by task syz-executor0/2160

CPU: 0 PID: 2160 Comm: syz-executor0 Not tainted 4.4.169+ #7
 0000000000000000 7302ef7ca8839fd7 ffff8800b58076d0 ffffffff81aa635d
 ffffea0002e73800 ffff8800b9ce2768 0000000000000000 ffff8800b9ce2768
 0000000000000000 ffff8800b5807708 ffffffff8148b15b ffff8800b9ce2768
Call Trace:
 [<ffffffff81aa635d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa635d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8148b15b>] print_address_description+0x6c/0x217 mm/kasan/report.c:252
 [<ffffffff8148b47b>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8148b47b>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814801a4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff81a7b981>] disk_unblock_events+0x51/0x60 block/genhd.c:1543
 [<ffffffff8154912c>] __blkdev_get+0x70c/0xdf0 fs/block_dev.c:1297
 [<ffffffff8154ba9a>] blkdev_get+0x2da/0x920 fs/block_dev.c:1353
 [<ffffffff8154c2f5>] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508
 [<ffffffff8148c4fd>] do_dentry_open+0x38d/0xbd0 fs/open.c:749
 [<ffffffff8148fc6a>] vfs_open+0x12a/0x210 fs/open.c:862
 [<ffffffff814bff40>] do_last fs/namei.c:3269 [inline]
 [<ffffffff814bff40>] path_openat+0xc10/0x3f10 fs/namei.c:3406
 [<ffffffff814c6ed7>] do_filp_open+0x197/0x270 fs/namei.c:3440
 [<ffffffff8149058c>] do_sys_open+0x31c/0x610 fs/open.c:1038
 [<ffffffff814908ad>] SYSC_open fs/open.c:1056 [inline]
 [<ffffffff814908ad>] SyS_open+0x2d/0x40 fs/open.c:1051
 [<ffffffff827162e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 5334:
 [<ffffffff8102e3e6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147f1e2>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147f1e2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147f1e2>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff8147f45f>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
 [<ffffffff8147b417>] kmem_cache_alloc_trace+0x117/0x2d0 mm/slub.c:2642
 [<ffffffff81a7aba4>] kmem_cache_alloc_node_trace include/linux/slab.h:367 [inline]
 [<ffffffff81a7aba4>] kmalloc_node include/linux/slab.h:514 [inline]
 [<ffffffff81a7aba4>] kzalloc_node include/linux/slab.h:631 [inline]
 [<ffffffff81a7aba4>] alloc_disk_node+0x54/0x3a0 block/genhd.c:1282
 [<ffffffff81a7af08>] alloc_disk+0x18/0x20 block/genhd.c:1274
 [<ffffffff81d3c95b>] loop_add+0x36b/0x7c0 drivers/block/loop.c:1824
 [<ffffffff81d3d17f>] loop_probe+0x14f/0x180 drivers/block/loop.c:1931
 [<ffffffff81d08b43>] kobj_lookup+0x223/0x410 drivers/base/map.c:124
 [<ffffffff81a78ef9>] get_gendisk+0x39/0x2d0 block/genhd.c:689
 [<ffffffff8154b8b6>] bd_start_claiming fs/block_dev.c:851 [inline]
 [<ffffffff8154b8b6>] blkdev_get+0xf6/0x920 fs/block_dev.c:1346
 [<ffffffff8154c2f5>] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508
 [<ffffffff8148c4fd>] do_dentry_open+0x38d/0xbd0 fs/open.c:749
 [<ffffffff8148fc6a>] vfs_open+0x12a/0x210 fs/open.c:862
 [<ffffffff814bff40>] do_last fs/namei.c:3269 [inline]
 [<ffffffff814bff40>] path_openat+0xc10/0x3f10 fs/namei.c:3406
 [<ffffffff814c6ed7>] do_filp_open+0x197/0x270 fs/namei.c:3440
 [<ffffffff8149058c>] do_sys_open+0x31c/0x610 fs/open.c:1038
 [<ffffffff814908ad>] SYSC_open fs/open.c:1056 [inline]
 [<ffffffff814908ad>] SyS_open+0x2d/0x40 fs/open.c:1051
 [<ffffffff827162e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 2160:
 [<ffffffff8102e3e6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147fadc>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147fadc>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147fadc>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
 [<ffffffff8147ceb4>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8147ceb4>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8147ceb4>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8147ceb4>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff81a79429>] disk_release+0x259/0x330 block/genhd.c:1118
 [<ffffffff81cf138e>] device_release+0x7e/0x220 drivers/base/core.c:247
 [<ffffffff81aac154>] kobject_cleanup lib/kobject.c:643 [inline]
 [<ffffffff81aac154>] kobject_release lib/kobject.c:672 [inline]
 [<ffffffff81aac154>] kref_sub include/linux/kref.h:73 [inline]
 [<ffffffff81aac154>] kref_put include/linux/kref.h:98 [inline]
 [<ffffffff81aac154>] kobject_put+0x144/0x260 lib/kobject.c:689
 [<ffffffff81a77133>] put_disk+0x23/0x30 block/genhd.c:1346
 [<ffffffff8154908c>] __blkdev_get+0x66c/0xdf0 fs/block_dev.c:1290
 [<ffffffff8154ba9a>] blkdev_get+0x2da/0x920 fs/block_dev.c:1353
 [<ffffffff8154c2f5>] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508
 [<ffffffff8148c4fd>] do_dentry_open+0x38d/0xbd0 fs/open.c:749
 [<ffffffff8148fc6a>] vfs_open+0x12a/0x210 fs/open.c:862
 [<ffffffff814bff40>] do_last fs/namei.c:3269 [inline]
 [<ffffffff814bff40>] path_openat+0xc10/0x3f10 fs/namei.c:3406
 [<ffffffff814c6ed7>] do_filp_open+0x197/0x270 fs/namei.c:3440
 [<ffffffff8149058c>] do_sys_open+0x31c/0x610 fs/open.c:1038
 [<ffffffff814908ad>] SYSC_open fs/open.c:1056 [inline]
 [<ffffffff814908ad>] SyS_open+0x2d/0x40 fs/open.c:1051
 [<ffffffff827162e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8800b9ce2200
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1384 bytes inside of
 2048-byte region [ffff8800b9ce2200, ffff8800b9ce2a00)
The buggy address belongs to the page:
------------[ cut here ]------------
WARNING: CPU: 1 PID: -2104946528 at lib/debugobjects.c:263 debug_print_object+0x181/0x210 lib/debugobjects.c:260()
ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: 0xffff8800b9ce2200