KASAN: use-after-free Read in lbmIODone

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14c689ab900000
kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=9ab7fed86898172b0402
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ab7fe...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
Read of size 8 at addr ffff888090ab5968 by task loop5/1593

CPU: 1 PID: 1593 Comm: loop5 Not tainted 4.14.198-syzkaller #0
attempt to access beyond end of device
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
attempt to access beyond end of device
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
loop2: rw=0, want=30736, limit=640
__lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369
loop1: rw=0, want=30736, limit=640
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
__wake_up_common_lock+0x9d/0x140 kernel/sched/wait.c:124
lbmIODone+0x3c6/0xe00 fs/jfs/jfs_logmgr.c:2307
bio_endio+0x27a/0x680 block/bio.c:1918
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2d0/0xa30 block/blk-core.c:2765
blk_mq_end_request+0x4c/0x1e0 block/blk-mq.c:530
__blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571
blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591
loop_handle_cmd drivers/block/loop.c:1784 [inline]
loop_queue_work+0x227/0x1e80 drivers/block/loop.c:1793
kthread_worker_fn+0x271/0x6c0 kernel/kthread.c:642
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Allocated by task 1590:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline]
lmLogInit+0x2f1/0x12f0 fs/jfs/jfs_logmgr.c:1292
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

Freed by task 1590:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
lbmLogShutdown fs/jfs/jfs_logmgr.c:1885 [inline]
lmLogInit+0xeaf/0x12f0 fs/jfs/jfs_logmgr.c:1437
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

The buggy address belongs to the object at ffff888090ab5900
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of
192-byte region [ffff888090ab5900, ffff888090ab59c0)
The buggy address belongs to the page:
page:ffffea000242ad40 count:1 mapcount:0 mapping:ffff888090ab5000 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff888090ab5000 0000000000000000 0000000100000010
raw: ffffea0002962f60 ffffea00027b9320 ffff88812fe50040 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff888090ab5800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888090ab5880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888090ab5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888090ab5980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888090ab5a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1748b837900000

kernel config: https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link: https://syzkaller.appspot.com/bug?extid=9ab7fed86898172b0402
compiler: gcc (GCC) 10.1.0-syz 20200507

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165b8437900000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=144ab864500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ab7fe...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369

Read of size 8 at addr ffff8880a17de568 by task loop0/13421

CPU: 1 PID: 13421 Comm: loop0 Not tainted 4.14.198-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351

kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430

__lock_acquire+0x2c57/0x3f20 kernel/locking/lockdep.c:3369

lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160
__wake_up_common_lock+0x9d/0x140 kernel/sched/wait.c:124
lbmIODone+0x3c6/0xe00 fs/jfs/jfs_logmgr.c:2307
bio_endio+0x27a/0x680 block/bio.c:1918
req_bio_endio block/blk-core.c:204 [inline]
blk_update_request+0x2d0/0xa30 block/blk-core.c:2765
blk_mq_end_request+0x4c/0x1e0 block/blk-mq.c:530
__blk_mq_complete_request+0x30b/0x6c0 block/blk-mq.c:571
blk_mq_complete_request+0x52/0x60 block/blk-mq.c:591
loop_handle_cmd drivers/block/loop.c:1784 [inline]
loop_queue_work+0x227/0x1e80 drivers/block/loop.c:1793
kthread_worker_fn+0x271/0x6c0 kernel/kthread.c:642
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Allocated by task 13420:

save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline]
lmLogInit+0x2f1/0x12f0 fs/jfs/jfs_logmgr.c:1292
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

Freed by task 13420:

save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
lbmLogShutdown fs/jfs/jfs_logmgr.c:1885 [inline]
lmLogInit+0xeaf/0x12f0 fs/jfs/jfs_logmgr.c:1437
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x6b1/0x10e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x236/0x430 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x78a/0xab0 fs/jfs/super.c:598
mount_bdev+0x2b3/0x360 fs/super.c:1134
mount_fs+0x92/0x2a0 fs/super.c:1237
vfs_kern_mount.part.0+0x5b/0x470 fs/namespace.c:1046
vfs_kern_mount fs/namespace.c:1036 [inline]
do_new_mount fs/namespace.c:2549 [inline]
do_mount+0xe53/0x2a00 fs/namespace.c:2879
SYSC_mount fs/namespace.c:3095 [inline]
SyS_mount+0xa8/0x120 fs/namespace.c:3072
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

The buggy address belongs to the object at ffff8880a17de500

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of

192-byte region [ffff8880a17de500, ffff8880a17de5c0)

The buggy address belongs to the page:

page:ffffea000285f780 count:1 mapcount:0 mapping:ffff8880a17de000 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffff8880a17de000 0000000000000000 0000000100000010
raw: ffffea00023af820 ffffea00022c2820 ffff88812fe50040 0000000000000000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff8880a17de400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a17de480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8880a17de500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a17de580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880a17de600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ad326970 Linux 4.19.152
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12e36b2c500000
kernel config: https://syzkaller.appspot.com/x/.config?x=1ec7667b405157e
dashboard link: https://syzkaller.appspot.com/bug?extid=cfa912bfb9eb92d57487

compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+cfa912...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in look_up_lock_class kernel/locking/lockdep.c:670 [inline]
BUG: KASAN: use-after-free in register_lock_class+0xe14/0x11c0 kernel/locking/lockdep.c:748
Read of size 8 at addr ffff88809bb36068 by task loop2/421

CPU: 0 PID: 421 Comm: loop2 Not tainted 4.19.152-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433
look_up_lock_class kernel/locking/lockdep.c:670 [inline]
register_lock_class+0xe14/0x11c0 kernel/locking/lockdep.c:748
__lock_acquire+0x17d/0x3ff0 kernel/locking/lockdep.c:3303
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
__wake_up_common_lock+0xb0/0x170 kernel/sched/wait.c:120
lbmIODone+0x44b/0xf40 fs/jfs/jfs_logmgr.c:2307
bio_endio+0x471/0x810 block/bio.c:1780
req_bio_endio block/blk-core.c:278 [inline]
blk_update_request+0x30f/0xaf0 block/blk-core.c:3111
blk_mq_end_request+0x4a/0x340 block/blk-mq.c:544
lo_complete_rq+0x201/0x2d0 drivers/block/loop.c:487
__blk_mq_complete_request block/blk-mq.c:583 [inline]
blk_mq_complete_request+0x472/0x660 block/blk-mq.c:620
loop_handle_cmd drivers/block/loop.c:1931 [inline]
loop_queue_work+0x274/0x20c0 drivers/block/loop.c:1940
kthread_worker_fn+0x292/0x730 kernel/kthread.c:675
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Allocated by task 415:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline]
lmLogInit+0x301/0x13d0 fs/jfs/jfs_logmgr.c:1292
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x718/0x11e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x286/0x4b0 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x814/0xb50 fs/jfs/super.c:598
mount_bdev+0x2fc/0x3b0 fs/super.c:1158
mount_fs+0xa3/0x30c fs/super.c:1261
vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x113c/0x2f10 fs/namespace.c:2799
ksys_mount+0xcf/0x130 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xba/0x150 fs/namespace.c:3026
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 415:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
lbmLogShutdown fs/jfs/jfs_logmgr.c:1885 [inline]
lmLogInit+0xf85/0x13d0 fs/jfs/jfs_logmgr.c:1437
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x718/0x11e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x286/0x4b0 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x814/0xb50 fs/jfs/super.c:598
mount_bdev+0x2fc/0x3b0 fs/super.c:1158
mount_fs+0xa3/0x30c fs/super.c:1261
vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x113c/0x2f10 fs/namespace.c:2799
ksys_mount+0xcf/0x130 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xba/0x150 fs/namespace.c:3026
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88809bb36000

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of

192-byte region [ffff88809bb36000, ffff88809bb360c0)

The buggy address belongs to the page:

page:ffffea00026ecd80 count:1 mapcount:0 mapping:ffff88813bff0040 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002881a88 ffffea0002b1b248 ffff88813bff0040
raw: 0000000000000000 ffff88809bb36000 0000000100000010 0000000000000000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff88809bb35f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809bb35f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88809bb36000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809bb36080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809bb36100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: b94de4d1 Linux 4.19.155
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1523bdc6500000
kernel config: https://syzkaller.appspot.com/x/.config?x=252047157acf1cb1

dashboard link: https://syzkaller.appspot.com/bug?extid=cfa912bfb9eb92d57487
compiler: gcc (GCC) 10.1.0-syz 20200507

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15d1a3a8500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1780dfa8500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cfa912...@syzkaller.appspotmail.com

==================================================================

BUG: KASAN: use-after-free in __lock_acquire+0x2cb4/0x3ff0 kernel/locking/lockdep.c:3294
Read of size 8 at addr ffff8880a32d8768 by task loop4/13650

CPU: 0 PID: 13650 Comm: loop4 Not tainted 4.19.155-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1c7 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433

__lock_acquire+0x2cb4/0x3ff0 kernel/locking/lockdep.c:3294

lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:152
__wake_up_common_lock+0xb0/0x170 kernel/sched/wait.c:120
lbmIODone+0x44b/0xf40 fs/jfs/jfs_logmgr.c:2307
bio_endio+0x471/0x810 block/bio.c:1780
req_bio_endio block/blk-core.c:278 [inline]
blk_update_request+0x30f/0xaf0 block/blk-core.c:3111
blk_mq_end_request+0x4a/0x340 block/blk-mq.c:544
lo_complete_rq+0x201/0x2d0 drivers/block/loop.c:487
__blk_mq_complete_request block/blk-mq.c:583 [inline]
blk_mq_complete_request+0x472/0x660 block/blk-mq.c:620
loop_handle_cmd drivers/block/loop.c:1931 [inline]
loop_queue_work+0x274/0x20c0 drivers/block/loop.c:1940
kthread_worker_fn+0x292/0x730 kernel/kthread.c:675
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

Allocated by task 13638:

kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
lbmLogInit fs/jfs/jfs_logmgr.c:1842 [inline]
lmLogInit+0x301/0x13d0 fs/jfs/jfs_logmgr.c:1292
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x718/0x11e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x286/0x4b0 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x814/0xb50 fs/jfs/super.c:598
mount_bdev+0x2fc/0x3b0 fs/super.c:1158
mount_fs+0xa3/0x30c fs/super.c:1261
vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x113c/0x2f10 fs/namespace.c:2799
ksys_mount+0xcf/0x130 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xba/0x150 fs/namespace.c:3026
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 13638:

__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
lbmLogShutdown fs/jfs/jfs_logmgr.c:1885 [inline]
lmLogInit+0xf85/0x13d0 fs/jfs/jfs_logmgr.c:1437
open_inline_log fs/jfs/jfs_logmgr.c:1197 [inline]
lmLogOpen+0x718/0x11e0 fs/jfs/jfs_logmgr.c:1090
jfs_mount_rw+0x286/0x4b0 fs/jfs/jfs_mount.c:271
jfs_fill_super+0x814/0xb50 fs/jfs/super.c:598
mount_bdev+0x2fc/0x3b0 fs/super.c:1158
mount_fs+0xa3/0x30c fs/super.c:1261
vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
vfs_kern_mount fs/namespace.c:951 [inline]
do_new_mount fs/namespace.c:2469 [inline]
do_mount+0x113c/0x2f10 fs/namespace.c:2799
ksys_mount+0xcf/0x130 fs/namespace.c:3015
__do_sys_mount fs/namespace.c:3029 [inline]
__se_sys_mount fs/namespace.c:3026 [inline]
__x64_sys_mount+0xba/0x150 fs/namespace.c:3026
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880a32d8700

which belongs to the cache kmalloc-192 of size 192
The buggy address is located 104 bytes inside of

192-byte region [ffff8880a32d8700, ffff8880a32d87c0)

The buggy address belongs to the page:

page:ffffea00028cb600 count:1 mapcount:0 mapping:ffff88813bff0040 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea00026b9a08 ffffea0002993608 ffff88813bff0040
raw: 0000000000000000 ffff8880a32d8000 0000000100000010 0000000000000000

page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff8880a32d8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a32d8680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8880a32d8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a32d8780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880a32d8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================