TITLE: KASAN: use-after-free Read in shmem_disband_hugehead
ALT: bad-access in shmem_disband_hugehead
TYPE: KASAN-USE-AFTER-FREE-READ

[  176.379525] ==================================================================
[  176.386974] BUG: KASAN: use-after-free in __lock_acquire+0x462f/0x49f0 at addr ffff8800b5a9f8c0
[  176.395804] Read of size 8 by task syz-executor7/20709
[  176.401162] CPU: 0 PID: 20709 Comm: syz-executor7 Not tainted 4.3.5+ #11
[  176.407993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  176.417350]  0000000000000000 ffff8800b9e4b778 ffffffff81d985d2 ffff8801d8df6d00
[  176.425400]  ffff8800b5a9f590 ffff8800b5a9fa20 0000000000000001 ffff8800b5a9f8c0
[  176.433465]  ffff8800b9e4b7a0 ffffffff817c20a1 ffff8800b9e4b828 ffff8800b5a9f590
[  176.441544] Call Trace:
[  176.444128]  [<ffffffff81d985d2>] dump_stack+0xf6/0x184
[  176.449487]  [<ffffffff817c20a1>] kasan_object_err+0x21/0x70
[  176.455278]  [<ffffffff817c2317>] kasan_report_error+0x1b7/0x490
[  176.461418]  [<ffffffff817c2723>] __asan_report_load8_noabort+0x43/0x50
[  176.468167]  [<ffffffff8143418f>] ? __lock_acquire+0x462f/0x49f0
[  176.474295]  [<ffffffff8143418f>] __lock_acquire+0x462f/0x49f0
[  176.480246]  [<ffffffff813cd9ec>] ? set_next_entity+0x27c/0xc50
[  176.486293]  [<ffffffff8142fb60>] ? debug_check_no_locks_freed+0x370/0x370
[  176.493293]  [<ffffffff8138b0b5>] ? finish_task_switch+0x485/0x620
[  176.499588]  [<ffffffff8138b0a5>] ? finish_task_switch+0x475/0x620
[  176.505972]  [<ffffffff8138b0b5>] ? finish_task_switch+0x485/0x620
[  176.512266]  [<ffffffff8138b0a5>] ? finish_task_switch+0x475/0x620
[  176.518566]  [<ffffffff8138b0b5>] ? finish_task_switch+0x485/0x620
[  176.524861]  [<ffffffff8138b0a5>] ? finish_task_switch+0x475/0x620
[  176.531156]  [<ffffffff8138b0b5>] ? finish_task_switch+0x485/0x620
[  176.537449]  [<ffffffff8138b0a5>] ? finish_task_switch+0x475/0x620
[  176.543750]  [<ffffffff8138b0b5>] ? finish_task_switch+0x485/0x620
[  176.550241]  [<ffffffff8138b0a5>] ? finish_task_switch+0x475/0x620
[  176.556543]  [<ffffffff8138ad24>] ? finish_task_switch+0xf4/0x620
[  176.562758]  [<ffffffff813928ea>] ? context_switch+0x54a/0xe60
[  176.568710]  [<ffffffff81392950>] ? context_switch+0x5b0/0xe60
[  176.574660]  [<ffffffff81435e1d>] lock_acquire+0x13d/0x300
[  176.580258]  [<ffffffff816e7d3d>] ? shmem_disband_hugehead+0x1ed/0x610
[  176.586919]  [<ffffffff81011456>] _raw_spin_lock_irqsave+0x56/0x70
[  176.593213]  [<ffffffff816e7d3d>] ? shmem_disband_hugehead+0x1ed/0x610
[  176.599862]  [<ffffffff816e7d3d>] shmem_disband_hugehead+0x1ed/0x610
[  176.606337]  [<ffffffff816e7b50>] ? shmem_clear_tag_hugehole+0x130/0x130
[  176.613148]  [<ffffffff816e3140>] ? shmem_put_recovery_page+0x20/0x20
[  176.619701]  [<ffffffff816f13c4>] shmem_disband_hugeteam+0x1b4/0x360
[  176.626171]  [<ffffffff816f1210>] ? shmem_huge_mapping+0xf0/0xf0
[  176.632293]  [<ffffffff8138ed45>] ? __might_sleep+0x95/0x1a0
[  176.638066]  [<ffffffff816f7ac5>] shmem_recovery_finalize_team+0x305/0x4b0
[  176.645072]  [<ffffffff816fdf0b>] shmem_huge_migrate_pages+0x65b/0x11e0
[  176.651812]  [<ffffffff817b205a>] do_mbind+0x49a/0xd10
[  176.657069]  [<ffffffff8154e0fb>] ? kcov_ioctl+0x5b/0x1a0
[  176.662596]  [<ffffffff81824575>] ? fput+0x25/0x150
[  176.667595]  [<ffffffff816e45c0>] ? shmem_mmap+0xa0/0xa0
[  176.673033]  [<ffffffff817b1bc0>] ? __mpol_equal+0x2c0/0x2c0
[  176.678816]  [<ffffffff81735d99>] ? __might_fault+0x119/0x1d0
[  176.684681]  [<ffffffff817c1354>] ? kasan_check_write+0x14/0x20
[  176.690714]  [<ffffffff817aa1f7>] ? get_nodes+0x177/0x1e0
[  176.696232]  [<ffffffff817b2c50>] SyS_mbind+0x140/0x150
[  176.701569]  [<ffffffff817b2b10>] ? compat_SyS_mbind+0x240/0x240
[  176.707691]  [<ffffffff81016017>] ? trace_hardirqs_on_thunk+0x17/0x19
[  176.714247]  [<ffffffff82dff840>] sysenter_dispatch+0xf/0x32
[  176.720019] Object at ffff8800b5a9f590, in cache shmem_inode_cache size: 1168
[  176.727269] Allocated:
[  176.729734] PID = 20706
[  176.732286]  [<ffffffff8124895b>] save_stack_trace+0x2b/0x50
[  176.738179]  [<ffffffff817c13e3>] save_stack+0x43/0xd0
[  176.743575]  [<ffffffff817c165d>] kasan_kmalloc+0xad/0xe0
[  176.749218]  [<ffffffff817c1c02>] kasan_slab_alloc+0x12/0x20
[  176.755122]  [<ffffffff817ba0eb>] kmem_cache_alloc+0x14b/0x7a0
[  176.761202]  [<ffffffff816e5470>] shmem_alloc_inode+0x20/0x50
[  176.767185]  [<ffffffff81872efa>] alloc_inode+0x6a/0x190
[  176.772733]  [<ffffffff81878a4c>] new_inode_pseudo+0x1c/0xe0
[  176.778644]  [<ffffffff81878b31>] new_inode+0x21/0x50
[  176.783947]  [<ffffffff816e5734>] shmem_get_inode+0x134/0xb50
[  176.789937]  [<ffffffff816eacf2>] __shmem_file_setup.part.40+0x302/0x430
[  176.796883]  [<ffffffff817001e8>] SyS_memfd_create+0x178/0x3b0
[  176.802981]  [<ffffffff82dff840>] sysenter_dispatch+0xf/0x32
[  176.808882] Freed:
[  176.811003] PID = 20702
[  176.813556]  [<ffffffff8124895b>] save_stack_trace+0x2b/0x50
[  176.819447]  [<ffffffff817c13e3>] save_stack+0x43/0xd0
[  176.824822]  [<ffffffff817c1c82>] kasan_slab_free+0x72/0xc0
[  176.830647]  [<ffffffff817bebf8>] kmem_cache_free+0xe8/0x2d0
[  176.837315]  [<ffffffff816e543f>] shmem_destroy_callback+0x4f/0x60
[  176.843733]  [<ffffffff81475dac>] rcu_process_callbacks+0x7bc/0x16e0
[  176.850320]  [<ffffffff81013053>] __do_softirq+0x243/0x8c4
[  176.856045] Memory state around the buggy address:
[  176.860948]  ffff8800b5a9f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  176.868279]  ffff8800b5a9f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  176.875621] >ffff8800b5a9f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  176.882964]                                            ^
[  176.888387]  ffff8800b5a9f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  176.895717]  ffff8800b5a9f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  176.903055] ==================================================================
