syzbot

floppy driver state
-------------------
now=4295135608 last interrupt=4295135608 diff=0 last called handler=reset_interrupt
==================================================================
BUG: KASAN: stack-out-of-bounds in string_nocheck lib/vsprintf.c:638 [inline]
BUG: KASAN: stack-out-of-bounds in string+0x39c/0x3d0 lib/vsprintf.c:720
Read of size 1 at addr ffffc900003cfc70 by task swapper/3/0

CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.15.0-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xf/0x320 mm/kasan/report.c:247
 __kasan_report mm/kasan/report.c:433 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
 string_nocheck lib/vsprintf.c:638 [inline]
 string+0x39c/0x3d0 lib/vsprintf.c:720
 vsnprintf+0x71d/0x14f0 lib/vsprintf.c:2805
 vprintk_store+0x34e/0xac0 kernel/printk/printk.c:2135
 vprintk_emit+0x12b/0x4f0 kernel/printk/printk.c:2229
 vprintk+0x80/0x90 kernel/printk/printk_safe.c:50
 _printk+0xba/0xed kernel/printk/printk.c:2266
 show_floppy+0xb1/0x45f drivers/block/floppy.c:1838
 result.cold+0x2b/0x30 drivers/block/floppy.c:1183
 floppy_interrupt+0x191/0x340 drivers/block/floppy.c:1755
 floppy_hardint+0x1a7/0x200 arch/x86/include/asm/floppy.h:66
 __handle_irq_event_percpu+0x303/0x8f0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:198 [inline]
 handle_irq_event+0x102/0x280 kernel/irq/handle.c:215
 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:822
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq arch/x86/kernel/irq.c:231 [inline]
 __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250
 common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:734
Code: ff ff e8 48 bf 80 f8 e9 24 fe ff ff e8 5e 2d fd ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc eb 07 0f 00 2d a7 79 48 00 fb f4 <c3> 0f 1f 40 00 41 54 be 08 00 00 00 53 65 48 8b 1c 25 40 70 02 00
RSP: 0018:ffffc9000045fdf8 EFLAGS: 00000206
RAX: 00000000008c4771 RBX: ffff8880114bd700 RCX: ffffffff893af4ef
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000001 R09: ffff88802cd3aa53
R10: ffffed10059a754a R11: 0000000000000000 R12: ffffed1002297ae0
R13: 0000000000000003 R14: ffffffff8d70eb50 R15: 0000000000000000
 default_idle_call+0x87/0xd0 kernel/sched/idle.c:112
 cpuidle_idle_call kernel/sched/idle.c:194 [inline]
 do_idle+0x401/0x590 kernel/sched/idle.c:306
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
 start_secondary+0x265/0x340 arch/x86/kernel/smpboot.c:272
 secondary_startup_64_no_verify+0xb0/0xbb
 </TASK>


Memory state around the buggy address:
 ffffc900003cfb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900003cfb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900003cfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                             ^
 ffffc900003cfc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900003cfd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	e8 48 bf 80 f8       	callq  0xf880bf4d
   5:	e9 24 fe ff ff       	jmpq   0xfffffe2e
   a:	e8 5e 2d fd ff       	callq  0xfffd2d6d
   f:	cc                   	int3
  10:	cc                   	int3
  11:	cc                   	int3
  12:	cc                   	int3
  13:	cc                   	int3
  14:	cc                   	int3
  15:	cc                   	int3
  16:	cc                   	int3
  17:	cc                   	int3
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	cc                   	int3
  1b:	cc                   	int3
  1c:	cc                   	int3
  1d:	eb 07                	jmp    0x26
  1f:	0f 00 2d a7 79 48 00 	verw   0x4879a7(%rip)        # 0x4879cd
  26:	fb                   	sti
  27:	f4                   	hlt
* 28:	c3                   	retq <-- trapping instruction
  29:	0f 1f 40 00          	nopl   0x0(%rax)
  2d:	41 54                	push   %r12
  2f:	be 08 00 00 00       	mov    $0x8,%esi
  34:	53                   	push   %rbx
  35:	65 48 8b 1c 25 40 70 	mov    %gs:0x27040,%rbx
  3c:	02 00