==================================================================
BUG: KASAN: slab-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:131 [inline]
BUG: KASAN: slab-out-of-bounds in trace_page_fault_entries arch/x86/mm/fault.c:1516 [inline]
BUG: KASAN: slab-out-of-bounds in do_page_fault+0x6d/0x320 arch/x86/mm/fault.c:1528
Read of size 8 at addr ffff8881e1fc7ec0 by task syz.4.1269/4951

CPU: 1 PID: 4951 Comm: syz.4.1269 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:

Allocated by task 696465408:
================================================================================
UBSAN: array-index-out-of-bounds in lib/stackdepot.c:205:15
index 2066561 is out of range for type 'void *[8192]'
CPU: 1 PID: 4951 Comm: syz.4.1269 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
================================================================================
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-2k' (offset 2656, size 2)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:99!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4951 Comm: syz.4.1269 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e1fc7950 EFLAGS: 00010096
RAX: 0000000000000065 RBX: 0000000000000a60 RCX: b8117e8129833800
RDX: 0000000000000000 RSI: 000000008000003e RDI: 0000000000000000
RBP: ffff8881e1fc7960 R08: dffffc0000000000 R09: ffffed103ede5262
R10: ffffed103ede5262 R11: 1ffff1103ede5261 R12: ffff8881f5c0c000
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 0000000000000a60
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffd252b0 CR3: 00000001f5c2a000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
Modules linked in:
---[ end trace 58a58eb48c12dc64 ]---
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e1fc7950 EFLAGS: 00010096
RAX: 0000000000000065 RBX: 0000000000000a60 RCX: b8117e8129833800
RDX: 0000000000000000 RSI: 000000008000003e RDI: 0000000000000000
RBP: ffff8881e1fc7960 R08: dffffc0000000000 R09: ffffed103ede5262
R10: ffffed103ede5262 R11: 1ffff1103ede5261 R12: ffff8881f5c0c000
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 0000000000000a60
FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffd252b0 CR3: 00000001f5c2a000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600