==================================================================
BUG: KASAN: slab-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:131 [inline]
BUG: KASAN: slab-out-of-bounds in trace_page_fault_entries arch/x86/mm/fault.c:1516 [inline]
BUG: KASAN: slab-out-of-bounds in do_page_fault+0x6d/0x320 arch/x86/mm/fault.c:1528
Read of size 8 at addr ffff8881e712ff00 by task syz.7.716/2930

CPU: 0 PID: 2930 Comm: syz.7.716 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:

Allocated by task 12476928:
================================================================================
UBSAN: array-index-out-of-bounds in lib/stackdepot.c:205:15
index 367964 is out of range for type 'void *[8192]'
CPU: 0 PID: 2930 Comm: syz.7.716 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
================================================================================
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-512' (offset 672, size 2)!
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-512' (offset 992, size 2)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:99!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2930 Comm: syz.7.716 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e712f6d0 EFLAGS: 00010092
RAX: 0000000000000065 RBX: 00000000000003e0 RCX: 43059d5c00be6200
RDX: ffffc90008d5f000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffff8881e712f6e0 R08: dffffc0000000000 R09: ffffed103edc5262
R10: ffffed103edc5262 R11: 1ffff1103edc5261 R12: ffff8881f5c02500
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 00000000000003e0
FS:  00007ff2df16e6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffc146b8 CR3: 00000001f5c2a000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
Modules linked in:
---[ end trace 04370a5b7ab8a325 ]---
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e712f6d0 EFLAGS: 00010092
RAX: 0000000000000065 RBX: 00000000000003e0 RCX: 43059d5c00be6200
RDX: ffffc90008d5f000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffff8881e712f6e0 R08: dffffc0000000000 R09: ffffed103edc5262
R10: ffffed103edc5262 R11: 1ffff1103edc5261 R12: ffff8881f5c02500
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 00000000000003e0
FS:  00007ff2df16e6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffc146b8 CR3: 00000001f5c2a000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600