usb 6-1: USB disconnect, device number 7
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in fb_read_offset drivers/video/fbdev/core/sysmem.h:38 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_bitblit drivers/video/fbdev/core/fb_imageblit.h:137 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_bitmap1x_imageblit drivers/video/fbdev/core/fb_imageblit.h:275 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_bitmap_imageblit drivers/video/fbdev/core/fb_imageblit.h:477 [inline]
BUG: KASAN: vmalloc-out-of-bounds in fb_imageblit drivers/video/fbdev/core/fb_imageblit.h:492 [inline]
BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1deb/0x1e60 drivers/video/fbdev/core/sysimgblt.c:24
Read of size 8 at addr ffffc90004511000 by task kworker/0:3/6089

CPU: 0 UID: 0 PID: 6089 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_power_efficient fb_flashcursor
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xcd/0x630 mm/kasan/report.c:482
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 fb_read_offset drivers/video/fbdev/core/sysmem.h:38 [inline]
 fb_bitblit drivers/video/fbdev/core/fb_imageblit.h:137 [inline]
 fb_bitmap1x_imageblit drivers/video/fbdev/core/fb_imageblit.h:275 [inline]
 fb_bitmap_imageblit drivers/video/fbdev/core/fb_imageblit.h:477 [inline]
 fb_imageblit drivers/video/fbdev/core/fb_imageblit.h:492 [inline]
 sys_imageblit+0x1deb/0x1e60 drivers/video/fbdev/core/sysimgblt.c:24
 drm_fbdev_shmem_defio_imageblit+0x20/0x130 drivers/gpu/drm/drm_fbdev_shmem.c:38
 soft_cursor+0x521/0xa10 drivers/video/fbdev/core/softcursor.c:74
 bit_cursor+0xe8c/0x17e0 drivers/video/fbdev/core/bitblit.c:370
 fb_flashcursor drivers/video/fbdev/core/fbcon.c:408 [inline]
 fb_flashcursor+0x30d/0x400 drivers/video/fbdev/core/fbcon.c:377
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 0-page vmalloc region starting at 0xffffc90004211000 allocated at drm_gem_shmem_vmap_locked+0x561/0x7e0 drivers/gpu/drm/drm_gem_shmem_helper.c:371
Memory state around the buggy address:
 ffffc90004510f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90004510f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004511000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                   ^
 ffffc90004511080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90004511100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================