==================================================================
BUG: KASAN: use-after-free in __bfs+0x154/0x394 kernel/locking/lockdep.c:1708
Read of size 8 at addr ffffaf800f70ff70 by task sshd/2027

CPU: 0 PID: 2027 Comm: sshd Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff8047479e>] print_address_description.constprop.0+0x2a/0x330 mm/kasan/report.c:255
[<ffffffff80474d4c>] __kasan_report mm/kasan/report.c:442 [inline]
[<ffffffff80474d4c>] kasan_report+0x184/0x1e0 mm/kasan/report.c:459
[<ffffffff80475b20>] check_region_inline mm/kasan/generic.c:183 [inline]
[<ffffffff80475b20>] __asan_load8+0x6e/0x96 mm/kasan/generic.c:256
[<ffffffff8010dd9a>] __bfs+0x154/0x394 kernel/locking/lockdep.c:1708
[<ffffffff8010e52a>] __bfs_forwards kernel/locking/lockdep.c:1803 [inline]
[<ffffffff8010e52a>] check_path.constprop.0+0x24/0x46 kernel/locking/lockdep.c:2104
[<ffffffff8010f95c>] check_noncircular+0x11a/0x1fe kernel/locking/lockdep.c:2131

The buggy address belongs to the page:
page:ffffaf807aaa0c38 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8f90f
flags: 0x8800000000(section=17|node=0|zone=0)
raw: 0000008800000000 0000000000000100 0000000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: 00000000000007ff
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500cc2(GFP_HIGHUSER|__GFP_ACCOUNT), pid 1990, ts 524452591700, free_ts 524633002300
 __set_page_owner+0x48/0x136 mm/page_owner.c:183
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0xd0/0x10a mm/page_alloc.c:2427
 prep_new_page mm/page_alloc.c:2434 [inline]
 get_page_from_freelist+0x8da/0x12d8 mm/page_alloc.c:4165
 __alloc_pages+0x150/0x3b6 mm/page_alloc.c:5389
 alloc_pages+0x132/0x2a6 mm/mempolicy.c:2271
 pipe_write+0xbd2/0x10d6 fs/pipe.c:495
 call_write_iter include/linux/fs.h:2074 [inline]
 new_sync_write+0x296/0x3aa fs/read_write.c:503
 vfs_write+0x2de/0x334 fs/read_write.c:590
 ksys_write+0x1c4/0x224 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 sys_write+0x28/0x36 fs/read_write.c:652
 ret_from_syscall+0x0/0x2
page last free stack trace:
 __reset_page_owner+0x4a/0xea mm/page_owner.c:142
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1352 [inline]
 free_pcp_prepare+0x29c/0x45e mm/page_alloc.c:1404
 free_unref_page_prepare mm/page_alloc.c:3325 [inline]
 free_unref_page+0x6a/0x31e mm/page_alloc.c:3404
 __put_single_page mm/swap.c:99 [inline]
 __put_page+0xf2/0x100 mm/swap.c:130
 folio_put include/linux/mm.h:1199 [inline]
 put_page include/linux/mm.h:1237 [inline]
 anon_pipe_buf_release+0x154/0x19a fs/pipe.c:138
 pipe_buf_release include/linux/pipe_fs_i.h:203 [inline]
 pipe_read+0x3f2/0xa4c fs/pipe.c:323
 call_read_iter include/linux/fs.h:2068 [inline]
 new_sync_read+0x3ae/0x3d8 fs/read_write.c:400
 vfs_read+0x2ce/0x324 fs/read_write.c:481
 ksys_read+0x1c4/0x224 fs/read_write.c:619
 __do_sys_read fs/read_write.c:629 [inline]
 sys_read+0x28/0x36 fs/read_write.c:627
 ret_from_syscall+0x0/0x2

Memory state around the buggy address:
 ffffaf800f70fe00: ff ff ff ff f1 f1 f1 f1 00 f3 f3 f3 ff ff ff ff
 ffffaf800f70fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffffaf800f70ff00: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 ff ff ff ff
                                                             ^
 ffffaf800f70ff80: 00 00 00 f3 f3 f3 f3 f3 ff ff ff ff ff ff ff ff
 ffffaf800f710000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================