==================================================================
BUG: KASAN: stack-out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: stack-out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:244 [inline]
BUG: KASAN: stack-out-of-bounds in put_bh include/linux/buffer_head.h:319 [inline]
BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0x24/0x30 fs/buffer.c:160
Write of size 4 at addr ffffc90002077920 by task ksoftirqd/0/14

CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.15.178-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_dec include/linux/atomic/atomic-instrumented.h:244 [inline]
 put_bh include/linux/buffer_head.h:319 [inline]
 end_buffer_read_sync+0x24/0x30 fs/buffer.c:160
 end_bio_bh_io_sync+0xb3/0x110 fs/buffer.c:3007
 req_bio_endio block/blk-core.c:261 [inline]
 blk_update_request+0x87c/0x1470 block/blk-core.c:1441
 blk_mq_end_request+0x3a/0x70 block/blk-mq.c:575
 blk_complete_reqs block/blk-mq.c:587 [inline]
 blk_done_softirq+0xf2/0x130 block/blk-mq.c:592
 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
 sysvec_call_function_single+0x9d/0xc0 arch/x86/kernel/smp.c:243
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:smpboot_thread_fn+0x274/0x9d0 kernel/smpboot.c:137
Code: 04 34 84 c0 0f 85 f0 04 00 00 48 8b 04 24 c7 00 02 00 00 00 e8 fd 8d fe ff e9 4e fe ff ff 4d 89 ef 49 c1 ef 03 43 0f b6 04 37 <84> c0 0f 85 85 03 00 00 41 8b 6d 00 e8 8b d4 e8 08 89 c3 89 ef 89
RSP: 0018:ffffc90000d37e70 EFLAGS: 00000a02
RAX: 0000000000000000 RBX: ffff88813ff21dd8 RCX: ffff88813ff21dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88813ff23540 R08: ffffffff8155172b R09: ffffed1027fe3c81
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11002eba898
R13: ffff8880175d44c0 R14: dffffc0000000000 R15: 1ffff11002eba898
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>


Memory state around the buggy address:
 ffffc90002077800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90002077880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90002077900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 f2
                                  ^
 ffffc90002077980: f2 f2 f2 f2 00 f3 f3 f3 00 00 00 00 00 00 00 00
 ffffc90002077a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	04 34                	add    $0x34,%al
   2:	84 c0                	test   %al,%al
   4:	0f 85 f0 04 00 00    	jne    0x4fa
   a:	48 8b 04 24          	mov    (%rsp),%rax
   e:	c7 00 02 00 00 00    	movl   $0x2,(%rax)
  14:	e8 fd 8d fe ff       	call   0xfffe8e16
  19:	e9 4e fe ff ff       	jmp    0xfffffe6c
  1e:	4d 89 ef             	mov    %r13,%r15
  21:	49 c1 ef 03          	shr    $0x3,%r15
  25:	43 0f b6 04 37       	movzbl (%r15,%r14,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	0f 85 85 03 00 00    	jne    0x3b7
  32:	41 8b 6d 00          	mov    0x0(%r13),%ebp
  36:	e8 8b d4 e8 08       	call   0x8e8d4c6
  3b:	89 c3                	mov    %eax,%ebx
  3d:	89 ef                	mov    %ebp,%edi
  3f:	89                   	.byte 0x89