syzbot

==================================================================
BUG: KASAN: slab-out-of-bounds in blk_mq_rq_ctx_init+0xe14/0xe90 block/blk-mq.c:281
Read of size 8 at addr ffff88801dd968d8 by task khugepaged/1658

CPU: 1 PID: 1658 Comm: khugepaged Not tainted 5.12.0-rc8-next-20210423-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436
 blk_mq_rq_ctx_init+0xe14/0xe90 block/blk-mq.c:281
 __blk_mq_alloc_request+0x387/0x580 block/blk-mq.c:399
 blk_mq_submit_bio+0x461/0x17d0 block/blk-mq.c:2219
 __submit_bio_noacct_mq block/blk-core.c:1046 [inline]
 submit_bio_noacct block/blk-core.c:1079 [inline]
 submit_bio_noacct+0xad2/0xf20 block/blk-core.c:1062
 submit_bio+0x263/0x5e0 block/blk-core.c:1150
 ext4_io_submit+0x181/0x210 fs/ext4/page-io.c:379
 ext4_writepages+0x1452/0x3ba0 fs/ext4/inode.c:2820
 do_writepages+0xec/0x290 mm/page-writeback.c:2352
 __filemap_fdatawrite_range+0x2a5/0x390 mm/filemap.c:413
 collapse_file+0x30db/0x39d0 mm/khugepaged.c:1764
 khugepaged_scan_file mm/khugepaged.c:2039 [inline]
 khugepaged_scan_mm_slot mm/khugepaged.c:2134 [inline]
 khugepaged_do_scan mm/khugepaged.c:2218 [inline]
 khugepaged+0x2caa/0x5320 mm/khugepaged.c:2263
 kthread+0x3b1/0x4a0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Allocated by task 1:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 ____kasan_kmalloc mm/kasan/common.c:507 [inline]
 ____kasan_kmalloc mm/kasan/common.c:466 [inline]
 __kasan_kmalloc+0x9b/0xd0 mm/kasan/common.c:516
 kmalloc include/linux/slab.h:558 [inline]
 kzalloc include/linux/slab.h:688 [inline]
 device_create_groups_vargs+0x8a/0x280 drivers/base/core.c:3960
 device_create+0xdf/0x120 drivers/base/core.c:4020
 mon_bin_add+0xb7/0x160 drivers/usb/mon/mon_bin.c:1359
 mon_bus_init+0x18e/0x320 drivers/usb/mon/mon_main.c:302
 mon_bus_add drivers/usb/mon/mon_main.c:199 [inline]
 mon_notify+0x32c/0x490 drivers/usb/mon/mon_main.c:230
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 blocking_notifier_call_chain kernel/notifier.c:337 [inline]
 blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:325
 usb_register_bus drivers/usb/core/hcd.c:928 [inline]
 usb_add_hcd.cold+0x3ad/0x1816 drivers/usb/core/hcd.c:2708
 vhci_hcd_probe+0x150/0x3a0 drivers/usb/usbip/vhci_hcd.c:1360
 platform_probe+0xfc/0x1f0 drivers/base/platform.c:1447
 really_probe+0x291/0xf60 drivers/base/dd.c:576
 driver_probe_device+0x298/0x410 drivers/base/dd.c:763
 __device_attach_driver+0x203/0x2c0 drivers/base/dd.c:870
 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
 __device_attach+0x228/0x4b0 drivers/base/dd.c:938
 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
 device_add+0xbe0/0x2100 drivers/base/core.c:3319
 platform_device_add+0x363/0x820 drivers/base/platform.c:748
 vhci_hcd_init+0x341/0x485 drivers/usb/usbip/vhci_hcd.c:1544
 do_one_initcall+0x103/0x650 init/main.c:1251
 do_initcall_level init/main.c:1324 [inline]
 do_initcalls init/main.c:1340 [inline]
 do_basic_setup init/main.c:1360 [inline]
 kernel_init_freeable+0x63e/0x6c7 init/main.c:1562
 kernel_init+0xd/0x1c0 init/main.c:1449
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

The buggy address belongs to the object at ffff88801dd96000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 216 bytes to the right of
 2048-byte region [ffff88801dd96000, ffff88801dd96800)
The buggy address belongs to the page:
page:ffffea0000776400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dd90
head:ffffea0000776400 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011042000
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801dd96780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88801dd96800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801dd96880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                    ^
 ffff88801dd96900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88801dd96980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================