[<ffffffff8624d1e2>] context_switch kernel/sched/core.c:5377 [inline]
[<ffffffff8624d1e2>] __schedule+0xe4c/0x3d70 kernel/sched/core.c:6764
[<ffffffff862501ca>] __schedule_loop kernel/sched/core.c:6841 [inline]
[<ffffffff862501ca>] schedule+0xc4/0x324 kernel/sched/core.c:6856
[<ffffffff86263e7a>] do_nanosleep+0x1c8/0x46e kernel/time/hrtimer.c:2078
==================================================================
BUG: KASAN: out-of-bounds in walk_stackframe+0x406/0x474 arch/riscv/kernel/stacktrace.c:67
Read of size 8 at addr ffff8f8000567c18 by task ksoftirqd/0/16

CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.14.0-rc1-syzkaller-g245aece3750d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff80074518>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff80003206>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff8005fa4c>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff8005fa4c>] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120
[<ffffffff8000eac8>] print_address_description mm/kasan/report.c:378 [inline]
[<ffffffff8000eac8>] print_report+0x28e/0x5aa mm/kasan/report.c:489
[<ffffffff80a6e636>] kasan_report+0xf0/0x214 mm/kasan/report.c:602
[<ffffffff80a70472>] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381
[<ffffffff800740e8>] walk_stackframe+0x406/0x474 arch/riscv/kernel/stacktrace.c:67
[<ffffffff80074518>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff80003206>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff80201a02>] sched_show_task kernel/sched/core.c:7719 [inline]
[<ffffffff80201a02>] sched_show_task+0x460/0x61c kernel/sched/core.c:7694
[<ffffffff8020ffac>] show_state_filter+0xcc/0x28e kernel/sched/core.c:7764
[<ffffffff81d5ce30>] show_state include/linux/sched/debug.h:21 [inline]
[<ffffffff81d5ce30>] fn_show_state+0x1a/0x22 drivers/tty/vt/keyboard.c:614
[<ffffffff81d5d426>] k_spec drivers/tty/vt/keyboard.c:667 [inline]
[<ffffffff81d5d426>] k_spec+0x102/0x16c drivers/tty/vt/keyboard.c:656
[<ffffffff81d60112>] kbd_keycode drivers/tty/vt/keyboard.c:1522 [inline]
[<ffffffff81d60112>] kbd_event+0x8ac/0x1056 drivers/tty/vt/keyboard.c:1541
[<ffffffff83e1e088>] input_handle_events_default+0xfe/0x174 drivers/input/input.c:2575
[<ffffffff83e2671a>] input_pass_values+0x660/0x7f8 drivers/input/input.c:127
[<ffffffff83e2856a>] input_event_dispose drivers/input/input.c:352 [inline]
[<ffffffff83e2856a>] input_handle_event+0x536/0x13e6 drivers/input/input.c:369
[<ffffffff83e294b0>] input_event drivers/input/input.c:395 [inline]
[<ffffffff83e294b0>] input_event+0x96/0xd2 drivers/input/input.c:390
[<ffffffff847355e0>] hidinput_hid_event+0x722/0x2402 drivers/hid/hid-input.c:1716
[<ffffffff8471cd1a>] hid_process_event+0x48a/0x59e drivers/hid/hid-core.c:1548
[<ffffffff8471d2cc>] hid_input_array_field+0x49e/0x66e drivers/hid/hid-core.c:1660
[<ffffffff8471e688>] hid_process_report drivers/hid/hid-core.c:1702 [inline]
[<ffffffff8471e688>] hid_report_raw_event+0xa24/0x1146 drivers/hid/hid-core.c:2048
[<ffffffff8471f0a0>] __hid_input_report.constprop.0+0x2f6/0x3fa drivers/hid/hid-core.c:2118
[<ffffffff8471f1d6>] hid_input_report+0x32/0x44 drivers/hid/hid-core.c:2140
[<ffffffff848b3c12>] hid_irq_in+0x2f6/0x732 drivers/hid/usbhid/hid-core.c:285
[<ffffffff83672daa>] __usb_hcd_giveback_urb+0x362/0x6f4 drivers/usb/core/hcd.c:1650
[<ffffffff836734a0>] usb_hcd_giveback_urb+0x364/0x3fe drivers/usb/core/hcd.c:1734
[<ffffffff83bbb754>] dummy_timer+0x134a/0x3458 drivers/usb/gadget/udc/dummy_hcd.c:1994
[<ffffffff803de4d2>] __run_hrtimer kernel/time/hrtimer.c:1738 [inline]
[<ffffffff803de4d2>] __hrtimer_run_queues+0x1ac/0xe32 kernel/time/hrtimer.c:1802
[<ffffffff803df298>] hrtimer_run_softirq+0x140/0x2e6 kernel/time/hrtimer.c:1819
[<ffffffff80156a7a>] handle_softirqs+0x4b2/0x132e kernel/softirq.c:561
[<ffffffff801579c4>] run_ksoftirqd kernel/softirq.c:950 [inline]
[<ffffffff801579c4>] run_ksoftirqd+0xce/0x144 kernel/softirq.c:942
[<ffffffff801e9fda>] smpboot_thread_fn+0x654/0xb96 kernel/smpboot.c:164
[<ffffffff801d3b2e>] kthread+0x37e/0x7b6 kernel/kthread.c:464
[<ffffffff8626888e>] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:327

The buggy address belongs to the virtual mapping at
 [ffff8f8000560000, ffff8f8000569000) created by:
 kernel_clone+0x11e/0xc3c kernel/fork.c:2815

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9372d
flags: 0xffe000000000000(node=0|zone=0|lastcpupid=0x7ff)
raw: 0ffe000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 29, tgid 29 (kworker/u9:1), ts 14721463900, free_ts 0
 __set_page_owner+0xa2/0x710 mm/page_owner.c:320
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xea/0x1e2 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xf78/0x2bd6 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x1e8/0x20fc mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fa/0x5b8 mm/mempolicy.c:2270
 alloc_frozen_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2341
 alloc_pages_noprof+0x20/0x48 mm/mempolicy.c:2361
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x640/0x120a mm/vmalloc.c:3846
 alloc_thread_stack_node kernel/fork.c:314 [inline]
 dup_task_struct kernel/fork.c:1127 [inline]
 copy_process+0x2c08/0x6c9a kernel/fork.c:2233
 kernel_clone+0x11e/0xc3c kernel/fork.c:2815
 user_mode_thread+0xea/0x11a kernel/fork.c:2893
 call_usermodehelper_exec_work kernel/umh.c:171 [inline]
 call_usermodehelper_exec_work+0xd4/0x1ac kernel/umh.c:157
 process_one_work+0x96a/0x1f3a kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x5be/0xdc6 kernel/workqueue.c:3398
 kthread+0x37e/0x7b6 kernel/kthread.c:464
 ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:327
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8f8000567b00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3
 ffff8f8000567b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8f8000567c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00
                               ^
 ffff8f8000567c80: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
 ffff8f8000567d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================