==================================================================
BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline]
BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:320 [inline]
BUG: KASAN: out-of-bounds in end_buffer_read_sync+0xbf/0xd0 fs/buffer.c:160
Write of size 4 at addr ffffc90004156640 by task ksoftirqd/1/21

CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 6.1.136-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x220 mm/kasan/report.c:427
 kasan_report+0x10b/0x140 mm/kasan/report.c:531
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x27b/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:257 [inline]
 put_bh include/linux/buffer_head.h:320 [inline]
 end_buffer_read_sync+0xbf/0xd0 fs/buffer.c:160
 end_bio_bh_io_sync+0xb3/0x110 fs/buffer.c:2655
 req_bio_endio block/blk-mq.c:780 [inline]
 blk_update_request+0x593/0xe30 block/blk-mq.c:925
 blk_mq_end_request+0x3a/0x70 block/blk-mq.c:1050
 blk_complete_reqs block/blk-mq.c:1130 [inline]
 blk_done_softirq+0x100/0x150 block/blk-mq.c:1135
 handle_softirqs+0x2a1/0x920 kernel/softirq.c:578
 run_ksoftirqd+0x98/0xf0 kernel/softirq.c:945
 smpboot_thread_fn+0x64a/0xa40 kernel/smpboot.c:164
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

The buggy address belongs to the virtual mapping at
 [ffffc90004150000, ffffc90004159000) created by:
 copy_process+0x5b1/0x4060 kernel/fork.c:2096

The buggy address belongs to the physical page:
page:ffffea000149dd40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52775
memcg:ffff88801f791702
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88801f791702
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 14983, tgid 14983 (syz.5.3218), ts 1208027550125, free_ts 1201681633389
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2532
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x1a26/0x1ac0 mm/page_alloc.c:4328
 __alloc_pages+0x1df/0x4e0 mm/page_alloc.c:5606
 vm_area_alloc_pages mm/vmalloc.c:2994 [inline]
 __vmalloc_area_node mm/vmalloc.c:3063 [inline]
 __vmalloc_node_range+0x959/0x1390 mm/vmalloc.c:3235
 alloc_thread_stack_node kernel/fork.c:312 [inline]
 dup_task_struct+0x3d3/0x6b0 kernel/fork.c:989
 copy_process+0x5b1/0x4060 kernel/fork.c:2096
 kernel_clone+0x225/0x8b0 kernel/fork.c:2681
 __do_sys_clone3 kernel/fork.c:2980 [inline]
 __se_sys_clone3+0x2dc/0x360 kernel/fork.c:2964
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare mm/page_alloc.c:1509 [inline]
 free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3479
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 kmem_cache_alloc_node+0x14d/0x320 mm/slub.c:3443
 __alloc_skb+0xfc/0x7e0 net/core/skbuff.c:505
 alloc_skb include/linux/skbuff.h:1271 [inline]
 nlmsg_new include/net/netlink.h:991 [inline]
 genlmsg_new include/net/genetlink.h:431 [inline]
 reset_per_cpu_data+0x31/0x1e0 net/core/drop_monitor.c:143
 send_dm_alert+0x1b/0xe0 net/core/drop_monitor.c:194
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Memory state around the buggy address:
 ffffc90004156500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90004156580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004156600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                              ^
 ffffc90004156680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90004156700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================