==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
Read of size 1 at addr ffff8880790f9450 by task syz.7.2913/18809

CPU: 0 UID: 0 PID: 18809 Comm: syz.7.2913 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 __kasan_check_byte+0x36/0x50 mm/kasan/common.c:585
 kasan_check_byte include/linux/kasan.h:402 [inline]
 lock_acquire kernel/locking/lockdep.c:5916 [inline]
 lock_acquire+0x132/0x380 kernel/locking/lockdep.c:5899
 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
 spin_lock include/linux/spinlock.h:347 [inline]
 lockref_get+0x15/0x50 lib/lockref.c:50
 dget include/linux/dcache.h:370 [inline]
 __simple_recursive_removal+0x3d/0x5c0 fs/libfs.c:601
 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:784
 ieee80211_sta_debugfs_remove+0x38/0x80 net/mac80211/debugfs_sta.c:1277
 __sta_info_destroy_part2+0x318/0x510 net/mac80211/sta_info.c:1613
 __sta_info_flush+0x4f6/0x720 net/mac80211/sta_info.c:1746
 sta_info_flush net/mac80211/sta_info.h:984 [inline]
 ieee80211_ibss_disconnect+0x195/0xbc0 net/mac80211/ibss.c:672
 ieee80211_ibss_leave+0x4a/0x160 net/mac80211/ibss.c:1789
 rdev_leave_ibss net/wireless/rdev-ops.h:577 [inline]
 cfg80211_leave_ibss+0x1ab/0x490 net/wireless/ibss.c:207
 cfg80211_leave_locked+0x1ad/0x470 net/wireless/core.c:1544
 cfg80211_leave+0x5d/0x90 net/wireless/core.c:1605
 cfg80211_netdev_notifier_call+0x30c/0x1140 net/wireless/core.c:1776
 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 __dev_close_many+0xff/0x710 net/core/dev.c:1769
 netif_close_many+0x243/0x810 net/core/dev.c:1824
 netif_close net/core/dev.c:1842 [inline]
 netif_close+0x17f/0x230 net/core/dev.c:1836
 dev_close+0xaa/0x240 net/core/dev_api.c:221
 cfg80211_shutdown_all_interfaces+0xb4/0x250 net/wireless/core.c:387
 cfg80211_rfkill_set_block net/wireless/core.c:420 [inline]
 cfg80211_rfkill_set_block+0x35/0x50 net/wireless/core.c:412
 rfkill_set_block+0x205/0x510 net/rfkill/core.c:360
 rfkill_fop_write+0x2c0/0x580 net/rfkill/core.c:1316
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x1f8/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5a7ad9f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5a7bcc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5a7b025fa0 RCX: 00007f5a7ad9f559
RDX: 0000000000000008 RSI: 0000200000000a40 RDI: 0000000000000006
RBP: 00007f5a7ae36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a7b026038 R14: 00007f5a7b025fa0 R15: 00007ffda70766d8
 </TASK>

Allocated by task 18398:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:351 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:377
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_lru_noprof+0x265/0x6a0 mm/slub.c:5029
 __d_alloc+0x34/0xad0 fs/dcache.c:1923
 d_alloc_pseudo+0x1c/0xc0 fs/dcache.c:2114
 alloc_path_pseudo fs/file_table.c:407 [inline]
 alloc_file_pseudo+0x118/0x290 fs/file_table.c:423
 create_pipe_files+0x360/0x970 fs/pipe.c:1027
 __do_pipe_flags fs/pipe.c:1073 [inline]
 do_pipe2+0xbd/0x1e0 fs/pipe.c:1121
 __do_sys_pipe2 fs/pipe.c:1139 [inline]
 __se_sys_pipe2 fs/pipe.c:1137 [inline]
 __x64_sys_pipe2+0x54/0x80 fs/pipe.c:1137
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 18398:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kmem_cache_free+0x127/0x6c0 mm/slub.c:6636
 __d_free fs/dcache.c:347 [inline]
 dentry_free+0x177/0x2c0 fs/dcache.c:449
 dentry_kill+0x653/0xca0 fs/dcache.c:859
 finish_dput fs/dcache.c:1015 [inline]
 dput.part.0+0xd7/0x240 fs/dcache.c:1056
 dput+0x1f/0x30 fs/dcache.c:1051
 __fput+0x51a/0xb60 fs/file_table.c:520
 fput_close_sync+0x118/0x250 fs/file_table.c:618
 filp_close_sync+0x75/0xa0 fs/open.c:1573
 __do_sys_close fs/open.c:1596 [inline]
 __se_sys_close fs/open.c:1583 [inline]
 __x64_sys_close+0x81/0x110 fs/open.c:1583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880790f9380
 which belongs to the cache dentry of size 352
The buggy address is located 208 bytes inside of
 freed 352-byte region [ffff8880790f9380, ffff8880790f94e0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880790f9860 pfn:0x790f8
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88802e1ae201
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801eab13c0 ffffea0001e43f10 ffffea0001e41090
raw: ffff8880790f9860 0000000200130005 00000000f5000000 ffff88802e1ae201
head: 00fff00000000240 ffff88801eab13c0 ffffea0001e43f10 ffffea0001e41090
head: ffff8880790f9860 0000000200130005 00000000f5000000 ffff88802e1ae201
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4989, tgid 4989 (udevadm), ts 20646425729
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7418
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 kmem_cache_alloc_lru_noprof+0x4c0/0x6a0 mm/slub.c:5029
 __d_alloc+0x34/0xad0 fs/dcache.c:1923
 __d_alloc_parallel+0x105/0x15e0 fs/dcache.c:2865
 __lookup_slow+0x98/0x320 fs/namei.c:1904
 lookup_slow+0x54/0x80 fs/namei.c:1936
 walk_component fs/namei.c:2282 [inline]
 lookup_last fs/namei.c:2789 [inline]
 path_lookupat+0x5e8/0xc40 fs/namei.c:2813
 filename_lookup+0x202/0x590 fs/namei.c:2842
 vfs_statx+0xff/0x3f0 fs/stat.c:353
 vfs_fstatat+0x77/0xe0 fs/stat.c:373
 __do_sys_newfstatat+0x9d/0x120 fs/stat.c:538
page last free pid 1 tgid 1 ts 15191396611 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 free_pages_prepare+0x586/0xe00 mm/page_alloc.c:1463
 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:7072
 debug_vm_pgtable_free_huge_page mm/debug_vm_pgtable.c:980 [inline]
 destroy_args+0xa8/0x7a0 mm/debug_vm_pgtable.c:993
 debug_vm_pgtable+0x1d69/0x3490 mm/debug_vm_pgtable.c:1368
 do_one_initcall+0x11c/0x6f0 init/main.c:1362
 do_initcall_level init/main.c:1424 [inline]
 do_initcalls init/main.c:1440 [inline]
 do_basic_setup init/main.c:1460 [inline]
 kernel_init_freeable+0x6ea/0x7b0 init/main.c:1675
 kernel_init+0x21/0x1e0 init/main.c:1565
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff8880790f9300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8880790f9380: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880790f9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8880790f9480: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff8880790f9500: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
==================================================================