==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
Read of size 2 at addr ffffc90028887d40 by task iou-wrk-6343/6344

CPU: 2 UID: 0 PID: 6344 Comm: iou-wrk-6343 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 user_mode arch/x86/include/asm/ptrace.h:214 [inline]
 unwind_next_frame+0xb87/0x2090 arch/x86/kernel/unwind_orc.c:498
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save_tsk+0x16d/0x210 kernel/stacktrace.c:150
 proc_pid_stack+0x16e/0x2b0 fs/proc/base.c:490
 proc_single_show+0x124/0x1f0 fs/proc/base.c:793
 seq_read_iter+0x32f/0x1270 fs/seq_file.c:231
 seq_read+0x344/0x4d0 fs/seq_file.c:163
 loop_rw_iter+0x305/0x6a0 io_uring/rw.c:721
 io_iter_do_read io_uring/rw.c:828 [inline]
 io_iter_do_read io_uring/rw.c:821 [inline]
 __io_read+0x1084/0x1470 io_uring/rw.c:943
 io_read+0x8d/0x230 io_uring/rw.c:1022
 __io_issue_sqe+0xe8/0x7a0 io_uring/io_uring.c:1386
 io_issue_sqe+0x88/0x1540 io_uring/io_uring.c:1409
 io_wq_submit_work+0x3b6/0xf70 io_uring/io_uring.c:1525
 io_worker_handle_work+0x60a/0x15e0 io_uring/io-wq.c:659
 io_wq_worker+0x33e/0xe60 io_uring/io-wq.c:714
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90028880000 allocated at kernel_clone+0x176/0x9d0 kernel/fork.c:2766
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61117
memcg:ffff88806cc1ca02
flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88806cc1ca02
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5737, tgid 5737 (syz-executor), ts 59364112368
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_pages_mpol+0x201/0x550 mm/mempolicy.c:2486
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2577
 vm_area_alloc_pages mm/vmalloc.c:3689 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x833/0x1420 mm/vmalloc.c:4104
 __vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct kernel/fork.c:930 [inline]
 copy_process+0x803/0x8370 kernel/fork.c:2133
 kernel_clone+0x176/0x9d0 kernel/fork.c:2766
 __do_compat_sys_ia32_clone+0xd4/0x120 arch/x86/kernel/sys_ia32.c:255
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
page last free pid 5812 tgid 5812 ts 59353126332 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 __folio_put+0x3b4/0x5f0 mm/folio.c:105
 folio_put include/linux/mm.h:2160 [inline]
 put_page include/linux/mm.h:2229 [inline]
 put_netmem include/net/netmem.h:394 [inline]
 skb_page_unref include/linux/skbuff_ref.h:43 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
 skb_release_data+0x649/0x8e0 net/core/skbuff.c:1116
 skb_release_all net/core/skbuff.c:1197 [inline]
 __kfree_skb net/core/skbuff.c:1211 [inline]
 napi_consume_skb+0x2c0/0x320 net/core/skbuff.c:1545
 skb_defer_free_flush+0x1f1/0x290 net/core/dev.c:6920
 net_rx_action+0x3ca/0xf20 net/core/dev.c:7988
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 do_softirq kernel/softirq.c:546 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:533
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0xa27/0x4970 net/core/dev.c:4961
 dev_queue_xmit include/linux/netdevice.h:3461 [inline]
 batadv_send_skb_packet+0x53a/0x6e0 net/batman-adv/send.c:100
 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:466 [inline]
 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:491 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x6a2/0x7d0 net/batman-adv/bat_iv_ogm.c:1912
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158

Memory state around the buggy address:
 ffffc90028887c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90028887c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90028887d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                           ^
 ffffc90028887d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90028887e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================