task:syslogd         state:R  running task     stack:0     pid:2989  tgid:2989  ppid:1      task_flags:0x400000 flags:0x00000000
Call Trace:
[<ffffffff8624d1e2>] context_switch kernel/sched/core.c:5377 [inline]
[<ffffffff8624d1e2>] __schedule+0xe4c/0x3d70 kernel/sched/core.c:6764
==================================================================
BUG: KASAN: stack-out-of-bounds in walk_stackframe+0x406/0x474 arch/riscv/kernel/stacktrace.c:67
Read of size 8 at addr ffff8f80072e78f8 by task kworker/1:2/919

CPU: 1 UID: 0 PID: 919 Comm: kworker/1:2 Not tainted 6.14.0-rc1-syzkaller-g245aece3750d #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue:  0x0 (events)
Call Trace:
[<ffffffff80074518>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff80003206>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff8005fa4c>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff8005fa4c>] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120
[<ffffffff8000eac8>] print_address_description mm/kasan/report.c:378 [inline]
[<ffffffff8000eac8>] print_report+0x28e/0x5aa mm/kasan/report.c:489
[<ffffffff80a6e636>] kasan_report+0xf0/0x214 mm/kasan/report.c:602
[<ffffffff80a70472>] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381
[<ffffffff800740e8>] walk_stackframe+0x406/0x474 arch/riscv/kernel/stacktrace.c:67
[<ffffffff80074518>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff80003206>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff80201a02>] sched_show_task kernel/sched/core.c:7719 [inline]
[<ffffffff80201a02>] sched_show_task+0x460/0x61c kernel/sched/core.c:7694
[<ffffffff8020ffac>] show_state_filter+0xcc/0x28e kernel/sched/core.c:7764
[<ffffffff81d5ce30>] show_state include/linux/sched/debug.h:21 [inline]
[<ffffffff81d5ce30>] fn_show_state+0x1a/0x22 drivers/tty/vt/keyboard.c:614
[<ffffffff81d5d426>] k_spec drivers/tty/vt/keyboard.c:667 [inline]
[<ffffffff81d5d426>] k_spec+0x102/0x16c drivers/tty/vt/keyboard.c:656
[<ffffffff81d60112>] kbd_keycode drivers/tty/vt/keyboard.c:1522 [inline]
[<ffffffff81d60112>] kbd_event+0x8ac/0x1056 drivers/tty/vt/keyboard.c:1541
[<ffffffff83e1e088>] input_handle_events_default+0xfe/0x174 drivers/input/input.c:2575
[<ffffffff83e2671a>] input_pass_values+0x660/0x7f8 drivers/input/input.c:127
[<ffffffff83e2856a>] input_event_dispose drivers/input/input.c:352 [inline]
[<ffffffff83e2856a>] input_handle_event+0x536/0x13e6 drivers/input/input.c:369
[<ffffffff83e294b0>] input_event drivers/input/input.c:395 [inline]
[<ffffffff83e294b0>] input_event+0x96/0xd2 drivers/input/input.c:390
[<ffffffff847355e0>] hidinput_hid_event+0x722/0x2402 drivers/hid/hid-input.c:1716
[<ffffffff8471cd1a>] hid_process_event+0x48a/0x59e drivers/hid/hid-core.c:1548
[<ffffffff8471d2cc>] hid_input_array_field+0x49e/0x66e drivers/hid/hid-core.c:1660
[<ffffffff8471e688>] hid_process_report drivers/hid/hid-core.c:1702 [inline]
[<ffffffff8471e688>] hid_report_raw_event+0xa24/0x1146 drivers/hid/hid-core.c:2048
[<ffffffff8471f0a0>] __hid_input_report.constprop.0+0x2f6/0x3fa drivers/hid/hid-core.c:2118
[<ffffffff8471f1d6>] hid_input_report+0x32/0x44 drivers/hid/hid-core.c:2140
[<ffffffff848b3c12>] hid_irq_in+0x2f6/0x732 drivers/hid/usbhid/hid-core.c:285
[<ffffffff83672daa>] __usb_hcd_giveback_urb+0x362/0x6f4 drivers/usb/core/hcd.c:1650
[<ffffffff836734a0>] usb_hcd_giveback_urb+0x364/0x3fe drivers/usb/core/hcd.c:1734
[<ffffffff83bbb754>] dummy_timer+0x134a/0x3458 drivers/usb/gadget/udc/dummy_hcd.c:1994
[<ffffffff803de4d2>] __run_hrtimer kernel/time/hrtimer.c:1738 [inline]
[<ffffffff803de4d2>] __hrtimer_run_queues+0x1ac/0xe32 kernel/time/hrtimer.c:1802
[<ffffffff803df298>] hrtimer_run_softirq+0x140/0x2e6 kernel/time/hrtimer.c:1819
[<ffffffff80156a7a>] handle_softirqs+0x4b2/0x132e kernel/softirq.c:561
[<ffffffff80157bc6>] __do_softirq kernel/softirq.c:595 [inline]
[<ffffffff80157bc6>] invoke_softirq kernel/softirq.c:435 [inline]
[<ffffffff80157bc6>] __irq_exit_rcu+0x18c/0x550 kernel/softirq.c:662
[<ffffffff801595cc>] irq_exit_rcu+0x10/0xf8 kernel/softirq.c:678
[<ffffffff86242304>] handle_riscv_irq+0x40/0x4c arch/riscv/kernel/traps.c:378
[<ffffffff862688ca>] call_on_irq_stack+0x32/0x40 arch/riscv/kernel/entry.S:356

The buggy address belongs to the virtual mapping at
 [ffff8f80072e0000, ffff8f80072e9000) created by:
 kernel_clone+0x11e/0xc3c kernel/fork.c:2815

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9d30f
flags: 0xffe000000000000(node=0|zone=0|lastcpupid=0x7ff)
raw: 0ffe000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 2988, tgid 2988 (start-stop-daem), ts 98152260900, free_ts 72155087700
 __set_page_owner+0xa2/0x710 mm/page_owner.c:320
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xea/0x1e2 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xf78/0x2bd6 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x1e8/0x20fc mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fa/0x5b8 mm/mempolicy.c:2270
 alloc_frozen_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2341
 alloc_pages_noprof+0x20/0x48 mm/mempolicy.c:2361
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x640/0x120a mm/vmalloc.c:3846
 alloc_thread_stack_node kernel/fork.c:314 [inline]
 dup_task_struct kernel/fork.c:1127 [inline]
 copy_process+0x2c08/0x6c9a kernel/fork.c:2233
 kernel_clone+0x11e/0xc3c kernel/fork.c:2815
 __do_sys_clone+0xe4/0x118 kernel/fork.c:2958
 __se_sys_clone kernel/fork.c:2926 [inline]
 __riscv_sys_clone+0xa0/0x10e kernel/fork.c:2926
 syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:90
 do_trap_ecall_u+0x1aa/0x216 arch/riscv/kernel/traps.c:331
 handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197
page last free pid 868 tgid 868 stack trace:
 __reset_page_owner+0x8c/0x400 mm/page_owner.c:297
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x96a/0x155c mm/page_alloc.c:2660
 __free_pages+0x13a/0x1ba mm/page_alloc.c:4838
 vfree+0x1ac/0xd1a mm/vmalloc.c:3383
 delayed_vfree_work+0x58/0x7a mm/vmalloc.c:3303
 process_one_work+0x96a/0x1f3a kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x5be/0xdc6 kernel/workqueue.c:3398
 kthread+0x37e/0x7b6 kernel/kthread.c:464
 ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:327

Memory state around the buggy address:
 ffff8f80072e7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f80072e7800: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
>ffff8f80072e7880: f1 f1 04 f2 04 f2 04 f2 00 f2 f2 f2 00 f2 f2 f2
                                                                ^
 ffff8f80072e7900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f80072e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================