==================================================================
BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:308 [inline]
BUG: KASAN: out-of-bounds in end_buffer_read_sync+0xc3/0xd0 fs/buffer.c:161
Write of size 4 at addr ffffc90005827740 by task syz.5.781/9772

CPU: 0 PID: 9772 Comm: syz.5.781 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <IRQ>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xac/0x220 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x288/0x290 mm/kasan/generic.c:187
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
 put_bh include/linux/buffer_head.h:308 [inline]
 end_buffer_read_sync+0xc3/0xd0 fs/buffer.c:161
 end_bio_bh_io_sync+0xb7/0x110 fs/buffer.c:2784
 req_bio_endio block/blk-mq.c:784 [inline]
 blk_update_request+0x597/0xe40 block/blk-mq.c:929
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1056
 blk_complete_reqs block/blk-mq.c:1136 [inline]
 blk_done_softirq+0x10b/0x160 block/blk-mq.c:1141
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:262 [inline]
 sysvec_call_function_single+0xa1/0xc0 arch/x86/kernel/smp.c:262
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:694
RIP: 0010:finish_task_switch+0x26a/0x920 kernel/sched/core.c:5254
Code: 0f 84 37 01 00 00 48 85 db 0f 85 56 01 00 00 e9 f6 04 00 00 4c 8b 75 d0 4c 89 e7 e8 c0 a3 1a 09 e8 ab a2 2f 00 fb 4c 8b 65 c0 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0
RSP: 0018:ffffc900058679b8 EFLAGS: 00000286
RAX: 3ef96599b07ac300 RBX: 0000000000000000 RCX: 3ef96599b07ac300
RDX: dffffc0000000000 RSI: ffffffff8aaab9c0 RDI: ffffffff8afc66c0
RBP: ffffc90005867a10 R08: ffffffff8e4a882f R09: 1ffffffff1c95105
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: ffff888026c18000
R13: dffffc0000000000 R14: ffff88802caf3c00 R15: ffff8880b8e3cf08
 context_switch kernel/sched/core.c:5383 [inline]
 __schedule+0x14da/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 do_nanosleep+0x1ad/0x5f0 kernel/time/hrtimer.c:2114
 hrtimer_nanosleep+0x15f/0x350 kernel/time/hrtimer.c:2162
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1397 [inline]
 __se_sys_clock_nanosleep+0x2ea/0x370 kernel/time/posix-timers.c:1374
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8a4f5c14a5
Code: 24 0c 89 3c 24 48 89 4c 24 18 e8 f6 54 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 <44> 89 c7 48 89 04 24 e8 4f 55 ff ff 48 8b 04 24 48 83 c4 28 f7 d8
RSP: 002b:00007fff3f0dc5e0 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6
RAX: ffffffffffffffda RBX: 00007f8a4f7b5fa0 RCX: 00007f8a4f5c14a5
RDX: 00007fff3f0dc620 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f8a4f7b7da0 R08: 0000000000000000 R09: 0000000000745a32
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000059b2a
R13: 00007f8a4f7b6090 R14: ffffffffffffffff R15: 00007fff3f0dc760
 </TASK>

The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90005820000 allocated at copy_process+0x549/0x3d70 kernel/fork.c:2331
The buggy address belongs to the physical page:
page:ffffea00016eb940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bae5
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 6300, tgid 6300 (syz-executor), ts 365379092147, free_ts 365345247669
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 vm_area_alloc_pages mm/vmalloc.c:3089 [inline]
 __vmalloc_area_node mm/vmalloc.c:3158 [inline]
 __vmalloc_node_range+0x96b/0x1320 mm/vmalloc.c:3339
 alloc_thread_stack_node kernel/fork.c:310 [inline]
 dup_task_struct+0x3d0/0x7c0 kernel/fork.c:1124
 copy_process+0x549/0x3d70 kernel/fork.c:2331
 kernel_clone+0x21b/0x840 kernel/fork.c:2914
 __do_sys_clone kernel/fork.c:3057 [inline]
 __se_sys_clone kernel/fork.c:3041 [inline]
 __x64_sys_clone+0x18c/0x1e0 kernel/fork.c:3041
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2475
 release_pages+0x1fa0/0x2220 mm/swap.c:1022
 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
 tlb_flush_mmu+0x368/0x4f0 mm/mmu_gather.c:300
 tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:392
 exit_mmap+0x3f0/0xb50 mm/mmap.c:3311
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffffc90005827600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90005827680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90005827700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                              ^
 ffffc90005827780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90005827800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
   0:	0f 84 37 01 00 00    	je     0x13d
   6:	48 85 db             	test   %rbx,%rbx
   9:	0f 85 56 01 00 00    	jne    0x165
   f:	e9 f6 04 00 00       	jmp    0x50a
  14:	4c 8b 75 d0          	mov    -0x30(%rbp),%r14
  18:	4c 89 e7             	mov    %r12,%rdi
  1b:	e8 c0 a3 1a 09       	call   0x91aa3e0
  20:	e8 ab a2 2f 00       	call   0x2fa2d0
  25:	fb                   	sti
  26:	4c 8b 65 c0          	mov    -0x40(%rbp),%r12
* 2a:	49 8d bc 24 f8 15 00 	lea    0x15f8(%r12),%rdi <-- trapping instruction
  31:	00
  32:	48 89 f8             	mov    %rdi,%rax
  35:	48 c1 e8 03          	shr    $0x3,%rax
  39:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax
  3e:	84 c0                	test   %al,%al