==================================================================
BUG: KASAN: use-after-free in selinux_inode_permission+0x59d/0x6a0 security/selinux/hooks.c:3134
Read of size 4 at addr ffff8881ed39b824 by task syz-executor.1/4247

CPU: 0 PID: 4247 Comm: syz-executor.1 Not tainted 5.4.265-syzkaller-04832-g4d7b888b5774 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 selinux_inode_permission+0x59d/0x6a0 security/selinux/hooks.c:3134
 security_inode_permission+0x9d/0xf0 security/security.c:1223
 may_lookup fs/namei.c:1773 [inline]
 link_path_walk+0x1d1/0x1040 fs/namei.c:2159
 path_openat+0x1a3/0x3480 fs/namei.c:3633
 do_filp_open+0x20b/0x450 fs/namei.c:3664
 do_sys_open+0x39c/0x810 fs/open.c:1113
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Allocated by task 4247:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 alloc_inode+0x43/0x70 fs/incfs/vfs.c:1569
 alloc_inode fs/inode.c:231 [inline]
 iget5_locked+0x9c/0x260 fs/inode.c:1189
 fetch_regular_inode+0x256/0x320 fs/incfs/vfs.c:377
 incfs_mount_fs+0x5c3/0xa00 fs/incfs/vfs.c:1864
 legacy_get_tree+0xdf/0x170 fs/fs_context.c:648
 vfs_get_tree+0x85/0x260 fs/super.c:1556
 do_new_mount+0x292/0x570 fs/namespace.c:2843
 do_mount+0x688/0xe10 fs/namespace.c:3163
 ksys_mount+0xc2/0xf0 fs/namespace.c:3372
 __do_sys_mount fs/namespace.c:3386 [inline]
 __se_sys_mount fs/namespace.c:3383 [inline]
 __x64_sys_mount+0xb1/0xc0 fs/namespace.c:3383
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Freed by task 4234:
 save_stack mm/kasan/common.c:70 [inline]
 set_track mm/kasan/common.c:78 [inline]
 kasan_set_free_info mm/kasan/common.c:345 [inline]
 __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
 slab_free_hook mm/slub.c:1455 [inline]
 slab_free_freelist_hook mm/slub.c:1494 [inline]
 slab_free mm/slub.c:3080 [inline]
 kfree+0x123/0x370 mm/slub.c:4071
 destroy_inode fs/inode.c:281 [inline]
 evict+0x59d/0x6a0 fs/inode.c:592
 dispose_list fs/inode.c:610 [inline]
 evict_inodes+0x5e1/0x660 fs/inode.c:660
 generic_shutdown_super+0x94/0x2a0 fs/super.c:454
 kill_anon_super+0x37/0x60 fs/super.c:1117
 incfs_kill_sb+0x4c/0x200 fs/incfs/vfs.c:1936
 deactivate_locked_super+0xa8/0x110 fs/super.c:335
 deactivate_super+0x1e2/0x2a0 fs/super.c:366
 cleanup_mnt+0x44e/0x500 fs/namespace.c:1102
 task_work_run+0x140/0x170 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

The buggy address belongs to the object at ffff8881ed39b800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 36 bytes inside of
 1024-byte region [ffff8881ed39b800, ffff8881ed39bc00)
The buggy address belongs to the page:
page:ffffea0007b4e600 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0007b42e00 0000000200000002 ffff8881f5c02280
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891
 alloc_slab_page+0x39/0x3c0 mm/slub.c:343
 allocate_slab mm/slub.c:1683 [inline]
 new_slab+0x97/0x440 mm/slub.c:1749
 new_slab_objects mm/slub.c:2505 [inline]
 ___slab_alloc+0x2fe/0x490 mm/slub.c:2667
 __slab_alloc+0x62/0xa0 mm/slub.c:2707
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc_track_caller+0x16d/0x2b0 mm/slub.c:4449
 __kmalloc_reserve net/core/skbuff.c:142 [inline]
 __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210
 alloc_skb include/linux/skbuff.h:1080 [inline]
 nlmsg_new include/net/netlink.h:888 [inline]
 rtmsg_fib+0x54c/0x970 net/ipv4/fib_semantics.c:518
 fib_table_insert+0xb61/0x19b0 net/ipv4/fib_trie.c:1283
 fib_magic net/ipv4/fib_frontend.c:1103 [inline]
 fib_add_ifaddr+0xb5a/0x1a40 net/ipv4/fib_frontend.c:1140
 fib_netdev_event+0x1f0/0x550 net/ipv4/fib_frontend.c:1487
 notifier_call_chain kernel/notifier.c:98 [inline]
 __raw_notifier_call_chain kernel/notifier.c:399 [inline]
 raw_notifier_call_chain+0x95/0x110 kernel/notifier.c:406
 __dev_notify_flags+0x26e/0x510 net/core/dev.c:1670
 dev_change_flags+0xe7/0x190 net/core/dev.c:8007
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438
 free_the_page mm/page_alloc.c:4953 [inline]
 __free_pages+0x91/0x140 mm/page_alloc.c:4959
 __free_slab+0x221/0x2e0 mm/slub.c:1774
 free_slab mm/slub.c:1789 [inline]
 discard_slab mm/slub.c:1795 [inline]
 unfreeze_partials+0x14e/0x180 mm/slub.c:2288
 put_cpu_partial+0x44/0x180 mm/slub.c:2324
 __slab_free+0x297/0x360 mm/slub.c:2971
 qlist_free_all+0x43/0xb0 mm/kasan/quarantine.c:167
 quarantine_reduce+0x1d9/0x210 mm/kasan/quarantine.c:260
 __kasan_kmalloc+0x41/0x210 mm/kasan/common.c:507
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc_node mm/slub.c:2829 [inline]
 slab_alloc mm/slub.c:2837 [inline]
 __kmalloc+0x105/0x2e0 mm/slub.c:3909
 kmalloc include/linux/slab.h:561 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 fib_create_info+0x8fb/0x1fc0 net/ipv4/fib_semantics.c:1465
 fib_table_insert+0x1cc/0x19b0 net/ipv4/fib_trie.c:1142
 fib_magic net/ipv4/fib_frontend.c:1103 [inline]
 fib_add_ifaddr+0x10ae/0x1a40 net/ipv4/fib_frontend.c:1149
 fib_netdev_event+0x1f0/0x550 net/ipv4/fib_frontend.c:1487
 notifier_call_chain kernel/notifier.c:98 [inline]
 __raw_notifier_call_chain kernel/notifier.c:399 [inline]
 raw_notifier_call_chain+0x95/0x110 kernel/notifier.c:406
 __dev_notify_flags+0x26e/0x510 net/core/dev.c:1670

Memory state around the buggy address:
 ffff8881ed39b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881ed39b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881ed39b800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff8881ed39b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881ed39b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================