syzbot

==================================================================
BUG: KASAN: invalid-access in __to_kthread kernel/kthread.c:94 [inline]
BUG: KASAN: invalid-access in kthread_is_per_cpu+0x1c/0x3c kernel/kthread.c:607
Read at addr f7ff00000970df00 by task swapper/1/0
Pointer tag: [f7], memory tag: [fe]

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc4-syzkaller-00055-g80d47f5de5e3 #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace.part.0+0xd0/0xe0 arch/arm64/kernel/stacktrace.c:184
 dump_backtrace arch/arm64/kernel/stacktrace.c:190 [inline]
 show_stack+0x18/0x6c arch/arm64/kernel/stacktrace.c:191
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106
 print_address_description+0x7c/0x2d4 mm/kasan/report.c:255
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report+0x134/0x380 mm/kasan/report.c:459
 __do_kernel_fault+0x104/0x1c0 arch/arm64/mm/fault.c:319
 do_bad_area arch/arm64/mm/fault.c:468 [inline]
 do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:737
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:813
 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:346
 el1h_64_sync_handler+0xb0/0xd0 arch/arm64/kernel/entry-common.c:397
 el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:567
 __to_kthread kernel/kthread.c:94 [inline]
 kthread_is_per_cpu+0x1c/0x3c kernel/kthread.c:607
 detach_tasks kernel/sched/fair.c:7918 [inline]
 load_balance+0x3bc/0xba0 kernel/sched/fair.c:9906
 rebalance_domains+0x264/0x380 kernel/sched/fair.c:10303
 run_rebalance_domains+0x4c/0x80 kernel/sched/fair.c:10992
 _stext+0x124/0x2a0
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:439 [inline]
 __irq_exit_rcu+0xe4/0x100 kernel/softirq.c:637
 irq_exit_rcu+0x10/0x1c kernel/softirq.c:649
 __el1_irq arch/arm64/kernel/entry-common.c:439 [inline]
 el1_interrupt+0x38/0x80 arch/arm64/kernel/entry-common.c:460
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:465
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:568
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline]
 raw_spin_rq_unlock_irq kernel/sched/sched.h:1330 [inline]
 finish_lock_switch kernel/sched/core.c:4747 [inline]
 finish_task_switch.isra.0+0x9c/0x260 kernel/sched/core.c:4865
 context_switch kernel/sched/core.c:4990 [inline]
 __schedule+0x2e4/0x7e4 kernel/sched/core.c:6296
 schedule_idle+0x28/0x50 kernel/sched/core.c:6397
 do_idle+0x190/0x29c kernel/sched/idle.c:334
 cpu_startup_entry+0x28/0x80 kernel/sched/idle.c:403
 secondary_start_kernel+0x144/0x16c arch/arm64/kernel/smp.c:265
 __secondary_switched+0x94/0x98 arch/arm64/kernel/head.S:661

Allocated by task 2556:
 kasan_save_stack+0x2c/0x5c mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:436 [inline]
 ____kasan_kmalloc mm/kasan/common.c:515 [inline]
 ____kasan_kmalloc mm/kasan/common.c:474 [inline]
 __kasan_kmalloc+0xb0/0xd0 mm/kasan/common.c:524
 kasan_kmalloc include/linux/kasan.h:270 [inline]
 kmem_cache_alloc_trace include/linux/slab.h:479 [inline]
 kmalloc include/linux/slab.h:581 [inline]
 kzalloc include/linux/slab.h:715 [inline]
 set_kthread_struct+0x58/0xf0 kernel/kthread.c:118
 copy_process+0xab0/0x1534 kernel/fork.c:2091
 kernel_clone+0x5c/0x3bc kernel/fork.c:2555
 kernel_thread+0x68/0x90 kernel/fork.c:2607
 call_usermodehelper_exec_sync kernel/umh.c:135 [inline]
 call_usermodehelper_exec_work+0x3c/0xb0 kernel/umh.c:166
 process_one_work+0x1dc/0x370 kernel/workqueue.c:2307
 worker_thread+0x70/0x430 kernel/workqueue.c:2454
 kthread+0x108/0x10c kernel/kthread.c:377
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:756

Freed by task 7298:
 kasan_save_stack+0x2c/0x5c mm/kasan/common.c:38
 kasan_set_track+0x2c/0x40 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/tags.c:36
 ____kasan_slab_free.constprop.0+0x190/0x1e4 mm/kasan/common.c:366
 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:374
 kasan_slab_free include/linux/kasan.h:236 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc4/0x230 mm/slub.c:1754
 slab_free mm/slub.c:3509 [inline]
 kfree+0xa8/0x360 mm/slub.c:4562
 free_kthread_struct+0x3c/0x60 kernel/kthread.c:146
 begin_new_exec+0x8b8/0x9c0 fs/exec.c:1313
 load_elf_binary+0x6e8/0x1660 fs/binfmt_elf.c:1001
 search_binary_handler fs/exec.c:1727 [inline]
 exec_binprm fs/exec.c:1768 [inline]
 bprm_execve fs/exec.c:1837 [inline]
 bprm_execve+0x224/0x57c fs/exec.c:1799
 kernel_execve+0x124/0x1a0 fs/exec.c:1980
 call_usermodehelper_exec_async+0xd0/0x140 kernel/umh.c:112
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:756

The buggy address belongs to the object at ffff00000970df00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 0 bytes inside of
 128-byte region [ffff00000970df00, ffff00000970df80)
The buggy address belongs to the page:
page:00000000f6f2444c refcount:1 mapcount:0 mapping:0000000000000000 index:0xf7ff00000970df00 pfn:0x4970d
flags: 0x1ffc00000000200(slab|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc00000000200 fffffc00001d8d00 dead000000000003 f6ff000002801200
raw: f7ff00000970df00 000000008010000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00000970dd00: f7 f7 f7 f7 f7 f7 f7 f7 fe fe fe fe fe fe fe fe
 ffff00000970de00: f2 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff00000970df00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                   ^
 ffff00000970e000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 ffff00000970e100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
==================================================================