syzbot

INFO: task kworker/0:4:10000 blocked for more than 433 seconds.
      Not tainted 6.16.0-rc1-syzkaller-gfda589c28604 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:0     pid:10000 tgid:10000 ppid:2      task_flags:0x4208060 flags:0x00000000
Workqueue: wg-kex-wg1 wg_packet_handshake_receive_worker
Call Trace:
[<ffffffff8632f9f0>] context_switch kernel/sched/core.c:5396 [inline]
[<ffffffff8632f9f0>] __schedule+0x1022/0x4094 kernel/sched/core.c:6785
[<ffffffff86332b26>] __schedule_loop kernel/sched/core.c:6863 [inline]
[<ffffffff86332b26>] schedule+0xc4/0x35e kernel/sched/core.c:6878
[<ffffffff863334a8>] schedule_preempt_disabled+0x16/0x28 kernel/sched/core.c:6935
[<ffffffff863276ea>] debug_smp_processor_id+0x1c/0x26 lib/smp_processor_id.c:60
[<ffffffff8632f96c>] switch_to_should_flush_icache arch/riscv/include/asm/switch_to.h:99 [inline]
[<ffffffff8632f96c>] context_switch kernel/sched/core.c:5396 [inline]
[<ffffffff8632f96c>] __schedule+0xf9e/0x4094 kernel/sched/core.c:6785
==================================================================
BUG: KASAN: stack-out-of-bounds in walk_stackframe+0x3e0/0x44e arch/riscv/kernel/stacktrace.c:67
Read of size 8 at addr ffff8f8003667598 by task khungtaskd/37

CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-gfda589c28604 #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff80078bbe>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff8000327a>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff8006103e>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff8006103e>] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120
[<ffffffff8000ef70>] print_address_description mm/kasan/report.c:408 [inline]
[<ffffffff8000ef70>] print_report+0x28e/0x5fe mm/kasan/report.c:521
[<ffffffff80af393a>] kasan_report+0xf0/0x214 mm/kasan/report.c:634
[<ffffffff80af59d2>] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381
[<ffffffff8007878e>] walk_stackframe+0x3e0/0x44e arch/riscv/kernel/stacktrace.c:67
[<ffffffff80078bbe>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff8000327a>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff8020f46a>] sched_show_task kernel/sched/core.c:7753 [inline]
[<ffffffff8020f46a>] sched_show_task+0x460/0x61c kernel/sched/core.c:7728
[<ffffffff804eddc4>] check_hung_task kernel/hung_task.c:224 [inline]
[<ffffffff804eddc4>] check_hung_uninterruptible_tasks kernel/hung_task.c:298 [inline]
[<ffffffff804eddc4>] watchdog+0xf36/0x11de kernel/hung_task.c:470
[<ffffffff801ddcbc>] kthread+0x39c/0x7d4 kernel/kthread.c:464
[<ffffffff8006977a>] ret_from_fork_kernel+0x2a/0xbb2 arch/riscv/kernel/process.c:214
[<ffffffff8634d4ba>] ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:327

The buggy address belongs to the virtual mapping at
 [ffff8f8003660000, ffff8f8003669000) created by:
 kernel_clone+0x128/0xc9e kernel/fork.c:2599

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9f13e
flags: 0xffe000000000000(node=0|zone=0|lastcpupid=0x7ff)
raw: 0ffe000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 7726, tgid 7726 (kworker/u10:2), ts 5553342091100, free_ts 5397657037400
 __set_page_owner+0x94/0x4a8 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xdc/0x1ba mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0x880/0x3660 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x22e/0x2124 mm/page_alloc.c:4959
 alloc_pages_mpol+0x1fa/0x5ba mm/mempolicy.c:2419
 alloc_frozen_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2490
 alloc_pages_noprof+0x20/0x48 mm/mempolicy.c:2510
 vm_area_alloc_pages mm/vmalloc.c:3634 [inline]
 __vmalloc_area_node mm/vmalloc.c:3712 [inline]
 __vmalloc_node_range_noprof+0x624/0x11b0 mm/vmalloc.c:3885
 __vmalloc_node_noprof+0x104/0x136 mm/vmalloc.c:3948
 alloc_thread_stack_node kernel/fork.c:317 [inline]
 dup_task_struct kernel/fork.c:877 [inline]
 copy_process+0x32ec/0x716a kernel/fork.c:1999
 kernel_clone+0x128/0xc9e kernel/fork.c:2599
 user_mode_thread+0xd4/0x110 kernel/fork.c:2677
 call_usermodehelper_exec_sync kernel/umh.c:132 [inline]
 call_usermodehelper_exec_work+0x6c/0x1ac kernel/umh.c:163
 process_one_work+0x96a/0x1f32 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x5ce/0xde8 kernel/workqueue.c:3402
 kthread+0x39c/0x7d4 kernel/kthread.c:464
page last free pid 7319 tgid 7319 stack trace:
 __reset_page_owner+0x78/0x1ba mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x998/0x1580 mm/page_alloc.c:2706
 ___free_pages+0x148/0x1ca mm/page_alloc.c:5061
 __free_pages mm/page_alloc.c:5071 [inline]
 free_pages.part.0+0x274/0x4d4 mm/page_alloc.c:5088
 free_pages+0xe/0x18 mm/page_alloc.c:5085
 kasan_depopulate_vmalloc_pte+0x4a/0x70 mm/kasan/shadow.c:472
 apply_to_pte_range mm/memory.c:3032 [inline]
 apply_to_pmd_range mm/memory.c:3076 [inline]
 apply_to_pud_range mm/memory.c:3112 [inline]
 apply_to_p4d_range mm/memory.c:3148 [inline]
 __apply_to_page_range+0x698/0x11fe mm/memory.c:3184
 apply_to_existing_page_range+0x34/0x46 mm/memory.c:3217
 kasan_release_vmalloc+0xc0/0xc6 mm/kasan/shadow.c:593
 kasan_release_vmalloc_node mm/vmalloc.c:2241 [inline]
 purge_vmap_node+0x21e/0xa32 mm/vmalloc.c:2258
 __purge_vmap_area_lazy+0x9ca/0xfa4 mm/vmalloc.c:2348
 drain_vmap_area_work+0x30/0x44 mm/vmalloc.c:2382
 process_one_work+0x96a/0x1f32 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x5ce/0xde8 kernel/workqueue.c:3402
 kthread+0x39c/0x7d4 kernel/kthread.c:464
 ret_from_fork_kernel+0x2a/0xbb2 arch/riscv/kernel/process.c:214

Memory state around the buggy address:
 ffff8f8003667480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f8003667500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8f8003667580: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
                            ^
 ffff8f8003667600: 00 00 00 f2 f2 f2 f2 f2 00 04 f2 f2 00 00 00 00
 ffff8f8003667680: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
==================================================================