==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x3743/0x4550 kernel/locking/lockdep.c:3828
Read of size 8 at addr ffff88808a177568 by task ksoftirqd/1/16

CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x96/0xe0 lib/dump_stack.c:118
 print_address_description.constprop.4.cold.6+0x9/0x373 mm/kasan/report.c:374
 __kasan_report.cold.7+0x7a/0x95 mm/kasan/report.c:506
 kasan_report+0xe/0x20 mm/kasan/common.c:634
 __lock_acquire+0x3743/0x4550 kernel/locking/lockdep.c:3828
 lock_acquire+0x12e/0x360 kernel/locking/lockdep.c:4487
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x33/0x50 kernel/locking/spinlock.c:159
 __wake_up_common_lock+0xa8/0x120 kernel/sched/wait.c:122
 req_bio_endio block/blk-core.c:242 [inline]
 blk_update_request+0x2ff/0x1130 block/blk-core.c:1462
 blk_mq_end_request+0x45/0x4c0 block/blk-mq.c:568
 blk_done_softirq+0x279/0x3d0 block/blk-softirq.c:37
 __do_softirq+0x24a/0xa97 kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:603 [inline]
 run_ksoftirqd+0x2b/0x50 kernel/softirq.c:595
 smpboot_thread_fn+0x51e/0x880 kernel/smpboot.c:165
 kthread+0x31d/0x3e0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 31626:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc mm/kasan/common.c:510 [inline]
 __kasan_kmalloc.constprop.11+0xc1/0xd0 mm/kasan/common.c:483
 kmalloc include/linux/slab.h:556 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1829 [inline]
 lmLogInit+0x3bf/0x1280 fs/jfs/jfs_logmgr.c:1278
 open_inline_log fs/jfs/jfs_logmgr.c:1183 [inline]
 lmLogOpen+0x84c/0x11b0 fs/jfs/jfs_logmgr.c:1077
 jfs_mount_rw+0x215/0x40e fs/jfs/jfs_mount.c:258
 jfs_fill_super+0x8d5/0xb20 fs/jfs/super.c:571
 mount_bdev+0x25e/0x320 fs/super.c:1415
 legacy_get_tree+0xfe/0x200 fs/fs_context.c:647
 vfs_get_tree+0x7e/0x330 fs/super.c:1545
 do_new_mount fs/namespace.c:2822 [inline]
 do_mount+0x103a/0x16c0 fs/namespace.c:3142
 ksys_mount+0xb1/0xd0 fs/namespace.c:3351
 __do_sys_mount fs/namespace.c:3365 [inline]
 __se_sys_mount fs/namespace.c:3362 [inline]
 __x64_sys_mount+0xb5/0x150 fs/namespace.c:3362
 do_syscall_64+0x8e/0x4e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 31626:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 kasan_set_free_info mm/kasan/common.c:332 [inline]
 __kasan_slab_free+0x124/0x170 mm/kasan/common.c:471
 slab_free_hook mm/slub.c:1424 [inline]
 slab_free_freelist_hook+0x53/0x140 mm/slub.c:1457
 slab_free mm/slub.c:3004 [inline]
 kfree+0xd6/0x3b0 mm/slub.c:3956
 lbmLogShutdown+0x71/0x90 fs/jfs/jfs_logmgr.c:1872
 lmLogInit fs/jfs/jfs_logmgr.c:1423 [inline]
 lmLogInit+0x7c5/0x1280 fs/jfs/jfs_logmgr.c:1248
 open_inline_log fs/jfs/jfs_logmgr.c:1183 [inline]
 lmLogOpen+0x84c/0x11b0 fs/jfs/jfs_logmgr.c:1077
 jfs_mount_rw+0x215/0x40e fs/jfs/jfs_mount.c:258
 jfs_fill_super+0x8d5/0xb20 fs/jfs/super.c:571
 mount_bdev+0x25e/0x320 fs/super.c:1415
 legacy_get_tree+0xfe/0x200 fs/fs_context.c:647
 vfs_get_tree+0x7e/0x330 fs/super.c:1545
 do_new_mount fs/namespace.c:2822 [inline]
 do_mount+0x103a/0x16c0 fs/namespace.c:3142
 ksys_mount+0xb1/0xd0 fs/namespace.c:3351
 __do_sys_mount fs/namespace.c:3365 [inline]
 __se_sys_mount fs/namespace.c:3362 [inline]
 __x64_sys_mount+0xb5/0x150 fs/namespace.c:3362
 do_syscall_64+0x8e/0x4e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88808a177500
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of
 192-byte region [ffff88808a177500, ffff88808a1775c0)
The buggy address belongs to the page:
page:ffffea0002285dc0 refcount:1 mapcount:0 mapping:ffff8880b5802a00 index:0x0
raw: 00fff00000000200 ffffea0002cee0c0 0000000300000002 ffff8880b5802a00
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88808a177400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88808a177480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88808a177500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff88808a177580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88808a177600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================