==================================================================
BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
BUG: KASAN: use-after-free in fuse_dev_do_read.isra.11.constprop.15+0x10c7/0x1220 fs/fuse/dev.c:1314
Read of size 8 at addr ffff8801c5f67b90 by task syz-executor1/14503

CPU: 1 PID: 14503 Comm: syz-executor1 Not tainted 4.9.125+ #37
 ffff8801d9ddf968 ffffffff81af0ae9 ffffea000717d980 ffff8801c5f67b90
 0000000000000000 ffff8801c5f67b90 ffff8801c4c6cb40 ffff8801d9ddf9a0
 ffffffff814e0e1d ffff8801c5f67b90 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81af0ae9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81af0ae9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814e0e1d>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff814e1227>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff814e1227>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814d3664>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff818368b7>] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline]
 [<ffffffff818368b7>] fuse_dev_do_read.isra.11.constprop.15+0x10c7/0x1220 fs/fuse/dev.c:1314
 [<ffffffff81836b66>] fuse_dev_read+0x156/0x1f0 fs/fuse/dev.c:1356
 [<ffffffff814e8244>] new_sync_read fs/read_write.c:439 [inline]
 [<ffffffff814e8244>] __vfs_read+0x3d4/0x560 fs/read_write.c:451
 [<ffffffff814eac04>] vfs_read+0x124/0x390 fs/read_write.c:472
 [<ffffffff814eec69>] SYSC_read fs/read_write.c:588 [inline]
 [<ffffffff814eec69>] SyS_read+0xd9/0x1c0 fs/read_write.c:581
 [<ffffffff8100554f>] do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282
 [<ffffffff8278c193>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 14449:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58
 fuse_request_alloc+0x18/0x20 fs/fuse/dev.c:86
 fuse_fill_super+0xcd3/0x1550 fs/fuse/inode.c:1144
 mount_nodev+0x5b/0x100 fs/super.c:1146
 fuse_mount+0x2c/0x40 fs/fuse/inode.c:1201
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.8+0xd1/0x3d0 fs/namespace.c:1000
 vfs_kern_mount fs/namespace.c:982 [inline]
 do_new_mount fs/namespace.c:2537 [inline]
 do_mount+0x3c9/0x2790 fs/namespace.c:2859
 SYSC_mount fs/namespace.c:3075 [inline]
 SyS_mount+0xea/0x100 fs/namespace.c:3052
 do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 14504:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xbe/0x310 mm/slub.c:2980
 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101
 fuse_put_request+0x261/0x310 fs/fuse/dev.c:298
 request_end+0x30/0x600 fs/fuse/dev.c:409
 fuse_dev_do_write+0x107f/0x2090 fs/fuse/dev.c:1916
 fuse_dev_write+0x142/0x1d0 fs/fuse/dev.c:1940
 new_sync_write fs/read_write.c:496 [inline]
 __vfs_write+0x3d7/0x580 fs/read_write.c:509
 vfs_write+0x187/0x520 fs/read_write.c:557
 SYSC_write fs/read_write.c:604 [inline]
 SyS_write+0xd9/0x1c0 fs/read_write.c:596
 do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801c5f67b60
 which belongs to the cache fuse_request of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff8801c5f67b60, ffff8801c5f67d28)
The buggy address belongs to the page:
page:ffffea000717d980 count:1 mapcount:0 mapping:          (null) index:0xffff8801c5f67918 compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c5f67a80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff8801c5f67b00: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fb
>ffff8801c5f67b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801c5f67c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c5f67c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================