BTRFS info (device loop0): clearing free space tree
BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
==================================================================
BUG: KFENCE: out-of-bounds read in strlen+0x3d/0x70 lib/string.c:487

Out-of-bounds read at 0xffff8881f605d000 (4096B right of kfence-#45):
 strlen+0x3d/0x70 lib/string.c:487
 getname_kernel+0x16/0x270 fs/namei.c:225
 kern_path+0x18/0x140 fs/namei.c:2611
 lookup_bdev block/bdev.c:982 [inline]
 blkdev_get_by_path+0xba/0x340 block/bdev.c:884
 btrfs_init_dev_replace_tgtdev fs/btrfs/dev-replace.c:259 [inline]
 btrfs_dev_replace_start fs/btrfs/dev-replace.c:655 [inline]
 btrfs_dev_replace_by_ioctl+0x2e6/0x1c00 fs/btrfs/dev-replace.c:764
 btrfs_ioctl_dev_replace+0x235/0x2d0 fs/btrfs/ioctl.c:4163
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xa7/0xf0 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x42/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

kfence-#45: 0xffff8881f605c000-0xffff8881f605ca27, size=2600, cache=kmalloc-4k

allocated by task 2586 on cpu 1 at 85.713066s:
 memdup_user+0x21/0x80 mm/util.c:174
 btrfs_ioctl_dev_replace+0xa1/0x2d0 fs/btrfs/ioctl.c:4150
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xa7/0xf0 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x42/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

CPU: 1 PID: 2586 Comm: syz-executor.0 Not tainted 5.19.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:strlen+0x3d/0x70 lib/string.c:487
Code: ff ff 49 bf 00 00 00 00 00 fc ff df 48 89 fb 49 89 c4 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 12 48 ff c3 49 8d 44 24 01 <43> 80 7c 26 01 00 75 dd eb 13 89 d9 80 e1 07 38 c1 7c e5 48 89 df
RSP: 0018:ffffc9000565fb88 EFLAGS: 00010282
RAX: 0000000000000bdf RBX: ffff8881f605d001 RCX: 0000000000000000
RDX: ffffc9000565fc60 RSI: 0000000000000001 RDI: ffff8881f605c421
RBP: ffffc9000565fc60 R08: dffffc0000000000 R09: ffffc9000565fc60
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000bde
R13: ffffc9000565fc60 R14: ffff8881f605c421 R15: dffffc0000000000
FS:  00007faa926396c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8881f605d000 CR3: 000000016d205000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 getname_kernel+0x16/0x270 fs/namei.c:225
 kern_path+0x18/0x140 fs/namei.c:2611
 lookup_bdev block/bdev.c:982 [inline]
 blkdev_get_by_path+0xba/0x340 block/bdev.c:884
 btrfs_init_dev_replace_tgtdev fs/btrfs/dev-replace.c:259 [inline]
 btrfs_dev_replace_start fs/btrfs/dev-replace.c:655 [inline]
 btrfs_dev_replace_by_ioctl+0x2e6/0x1c00 fs/btrfs/dev-replace.c:764
 btrfs_ioctl_dev_replace+0x235/0x2d0 fs/btrfs/ioctl.c:4163
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xa7/0xf0 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x42/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7faa9187cba9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa926390c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007faa9199bf80 RCX: 00007faa9187cba9
RDX: 0000000020000540 RSI: 00000000ca289435 RDI: 0000000000000005
RBP: 00007faa918c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000016 R14: 00007faa9199bf80 R15: 00007fff4ebd7178
 </TASK>
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
   7:	fc ff df
   a:	48 89 fb             	mov    %rdi,%rbx
   d:	49 89 c4             	mov    %rax,%r12
  10:	48 89 d8             	mov    %rbx,%rax
  13:	48 c1 e8 03          	shr    $0x3,%rax
  17:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax
  1c:	84 c0                	test   %al,%al
  1e:	75 12                	jne    0x32
  20:	48 ff c3             	inc    %rbx
  23:	49 8d 44 24 01       	lea    0x1(%r12),%rax
* 28:	43 80 7c 26 01 00    	cmpb   $0x0,0x1(%r14,%r12,1) <-- trapping instruction
  2e:	75 dd                	jne    0xd
  30:	eb 13                	jmp    0x45
  32:	89 d9                	mov    %ebx,%ecx
  34:	80 e1 07             	and    $0x7,%cl
  37:	38 c1                	cmp    %al,%cl
  39:	7c e5                	jl     0x20
  3b:	48 89 df             	mov    %rbx,%rdi