================================================================== BUG: KASAN: use-after-free in constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] BUG: KASAN: use-after-free in fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303 Read of size 8 at addr ffff8801d06e0278 by task syz-executor209/8903 CPU: 0 PID: 8903 Comm: syz-executor209 Not tainted 4.9.113-g47bbcd6 #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cf7e7968 ffffffff81eb32a9 ffffea000741b800 ffff8801d06e0278 0000000000000000 ffff8801d06e0278 ffff8801b84aab40 ffff8801cf7e79a0 ffffffff81567bd9 ffff8801d06e0278 0000000000000008 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [] kasan_report_error mm/kasan/report.c:355 [inline] [] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] [] fuse_dev_do_read.isra.29.constprop.34+0x10c7/0x1220 fs/fuse/dev.c:1303 [] fuse_dev_read+0x15e/0x1f0 fs/fuse/dev.c:1345 [] new_sync_read fs/read_write.c:439 [inline] [] __vfs_read+0x3dd/0x570 fs/read_write.c:451 [] vfs_read+0x120/0x380 fs/read_write.c:472 [] SYSC_read fs/read_write.c:588 [inline] [] SyS_read+0xd9/0x1c0 fs/read_write.c:581 [] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 8903: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547 slab_post_alloc_hook mm/slab.h:417 [inline] slab_alloc_node mm/slub.c:2715 [inline] slab_alloc mm/slub.c:2723 [inline] kmem_cache_alloc+0xbe/0x290 mm/slub.c:2728 __fuse_request_alloc+0x27/0xe0 fs/fuse/dev.c:58 fuse_request_alloc+0x18/0x20 fs/fuse/dev.c:86 fuse_fill_super+0xcd3/0x1550 fs/fuse/inode.c:1141 mount_nodev+0x5b/0x100 fs/super.c:1146 fuse_mount+0x2c/0x40 fs/fuse/inode.c:1198 mount_fs+0x28c/0x370 fs/super.c:1206 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991 vfs_kern_mount fs/namespace.c:973 [inline] do_new_mount fs/namespace.c:2513 [inline] do_mount+0x3c9/0x2740 fs/namespace.c:2835 SYSC_mount fs/namespace.c:3051 [inline] SyS_mount+0xfe/0x110 fs/namespace.c:3028 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 8918: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kmem_cache_free+0xbe/0x310 mm/slub.c:2980 fuse_request_free+0x8b/0xa0 fs/fuse/dev.c:101 fuse_put_request+0x259/0x300 fs/fuse/dev.c:288 request_end+0x183/0x610 fs/fuse/dev.c:398 fuse_dev_do_write+0x1099/0x20a0 fs/fuse/dev.c:1905 fuse_dev_write+0x14b/0x1e0 fs/fuse/dev.c:1929 new_sync_write fs/read_write.c:496 [inline] __vfs_write+0x3e0/0x580 fs/read_write.c:509 vfs_write+0x187/0x530 fs/read_write.c:557 SYSC_write fs/read_write.c:604 [inline] SyS_write+0xd9/0x1c0 fs/read_write.c:596 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb The buggy address belongs to the object at ffff8801d06e0248 which belongs to the cache fuse_request of size 456 The buggy address is located 48 bytes inside of 456-byte region [ffff8801d06e0248, ffff8801d06e0410) The buggy address belongs to the page: page:ffffea000741b800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x8000000000004080(slab|head) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d06e0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801d06e0180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc >ffff8801d06e0200: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb ^ ffff8801d06e0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801d06e0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================