==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy_to_page include/linux/highmem.h:403 [inline]
BUG: KASAN: slab-out-of-bounds in z_erofs_transform_plain+0x3a4/0x490 fs/erofs/decompressor.c:346
Read of size 4096 at addr ffff0000cd750000 by task syz.4.88/4784

CPU: 1 PID: 4784 Comm: syz.4.88 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x258/0x290 mm/kasan/generic.c:189
 memcpy+0x48/0x90 mm/kasan/shadow.c:65
 memcpy_to_page include/linux/highmem.h:403 [inline]
 z_erofs_transform_plain+0x3a4/0x490 fs/erofs/decompressor.c:346
 z_erofs_decompress+0x9c/0xd4 fs/erofs/decompressor.c:434
 z_erofs_decompress_pcluster fs/erofs/zdata.c:1159 [inline]
 z_erofs_decompress_queue+0x100c/0x1b40 fs/erofs/zdata.c:1240
 z_erofs_runqueue+0x14d4/0x1694 fs/erofs/zdata.c:1597
 z_erofs_read_folio+0x2d8/0x5c8 fs/erofs/zdata.c:1687
 filemap_read_folio+0x134/0x384 mm/filemap.c:2490
 filemap_update_page mm/filemap.c:2575 [inline]
 filemap_get_pages mm/filemap.c:2689 [inline]
 filemap_read+0x12cc/0x2104 mm/filemap.c:2759
 generic_file_read_iter+0xf8/0x5c4 mm/filemap.c:2941
 __kernel_read+0x268/0x600 fs/read_write.c:428
 kernel_read+0xd8/0x1d4 fs/read_write.c:446
 kernel_read_file+0x448/0x620 fs/kernel_read_file.c:93
 kernel_read_file_from_fd+0xc0/0x130 fs/kernel_read_file.c:184
 __do_sys_finit_module kernel/module/main.c:2965 [inline]
 __se_sys_finit_module kernel/module/main.c:2947 [inline]
 __arm64_sys_finit_module+0x1bc/0x230 kernel/module/main.c:2947
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4321:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 __kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x430 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x22c/0x308 mm/slub.c:3383
 kmem_cache_zalloc include/linux/slab.h:689 [inline]
 fill_pool lib/debugobjects.c:169 [inline]
 debug_objects_fill_pool+0x438/0x5d8 lib/debugobjects.c:607
 debug_object_activate+0x4c/0x4b8 lib/debugobjects.c:694
 debug_rcu_head_queue kernel/rcu/rcu.h:190 [inline]
 call_rcu+0x54/0x94c kernel/rcu/tree.c:2834
 security_inode_free+0xbc/0xd8 security/security.c:1072
 __destroy_inode+0x2f0/0x7ac fs/inode.c:286
 destroy_inode fs/inode.c:309 [inline]
 evict+0x6c8/0x828 fs/inode.c:720
 iput_final fs/inode.c:1834 [inline]
 iput+0x754/0x7e4 fs/inode.c:1860
 dentry_unlink_inode+0x360/0x438 fs/dcache.c:405
 __dentry_kill+0x320/0x598 fs/dcache.c:611
 dentry_kill+0xc8/0x248 fs/dcache.c:-1
 dput+0x238/0x454 fs/dcache.c:918
 __fput+0x480/0x7b8 fs/file_table.c:328
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1ec/0x278 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x1fa0/0x2aa4 arch/arm64/kernel/signal.c:1137
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000cd750000
 which belongs to the cache debug_objects_cache of size 40
The buggy address is located 0 bytes inside of
 40-byte region [ffff0000cd750000, ffff0000cd750028)

The buggy address belongs to the physical page:
page:0000000002efede1 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d750
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc00032f3740 dead000000000002 ffff0000c000cf00
raw: 0000000000000000 0000000000490049 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000cd74ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff0000cd74ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000cd750000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00
                                  ^
 ffff0000cd750080: 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 00 00
 ffff0000cd750100: 00 fc fc 00 00 00 00 00 fc fc 00 00 00 00 00 fc
==================================================================
syz.4.88: attempt to access beyond end of device
loop4: rw=0, sector=16, nr_sectors = 8 limit=16
syz.4.88: attempt to access beyond end of device
loop4: rw=0, sector=16, nr_sectors = 8 limit=16