syzbot

==================================================================
BUG: KASAN: stack-out-of-bounds in sock_write_iter+0x1d0/0x272 net/socket.c:1062
Write of size 40 at addr ffffaf800c48bc70 by task syz-fuzzer/2045

CPU: 1 PID: 2045 Comm: syz-fuzzer Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff8047479e>] print_address_description.constprop.0+0x2a/0x330 mm/kasan/report.c:255
[<ffffffff80474d4c>] __kasan_report mm/kasan/report.c:442 [inline]
[<ffffffff80474d4c>] kasan_report+0x184/0x1e0 mm/kasan/report.c:459
[<ffffffff80475ea2>] check_region_inline mm/kasan/generic.c:173 [inline]
[<ffffffff80475ea2>] kasan_check_range+0x2a/0x136 mm/kasan/generic.c:189
[<ffffffff80475fd6>] __asan_storeN+0x10/0x18 mm/kasan/generic.c:271
[<ffffffff826d2842>] sock_write_iter+0x1d0/0x272 net/socket.c:1062

The buggy address belongs to the page:
page:ffffaf807a9bd718 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8c68b
flags: 0x8800000000(section=17|node=0|zone=0)
raw: 0000008800000000 0000000000000000 ffffaf807a9bd720 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: 00000000000007ff
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 2018, ts 798570984100, free_ts 652408134600
 __set_page_owner+0x48/0x136 mm/page_owner.c:183
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0xd0/0x10a mm/page_alloc.c:2427
 prep_new_page mm/page_alloc.c:2434 [inline]
 get_page_from_freelist+0x8da/0x12d8 mm/page_alloc.c:4165
 __alloc_pages+0x150/0x3b6 mm/page_alloc.c:5389
 __alloc_pages_node include/linux/gfp.h:572 [inline]
 alloc_pages_node include/linux/gfp.h:595 [inline]
 alloc_thread_stack_node kernel/fork.c:262 [inline]
 dup_task_struct kernel/fork.c:887 [inline]
 copy_process+0x482/0x3c34 kernel/fork.c:1998
 kernel_clone+0xee/0x920 kernel/fork.c:2555
 __do_sys_clone+0xf2/0x12e kernel/fork.c:2672
 sys_clone+0x32/0x44 kernel/fork.c:2640
 ret_from_syscall+0x0/0x2
page last free stack trace:
 __reset_page_owner+0x4a/0xea mm/page_owner.c:142
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1352 [inline]
 free_pcp_prepare+0x29c/0x45e mm/page_alloc.c:1404
 free_unref_page_prepare mm/page_alloc.c:3325 [inline]
 free_unref_page+0x6a/0x31e mm/page_alloc.c:3404
 free_the_page mm/page_alloc.c:706 [inline]
 free_compound_page+0x70/0x8a mm/page_alloc.c:729
 destroy_compound_page include/linux/mm.h:889 [inline]
 __put_compound_page+0x7c/0xb0 mm/swap.c:112
 __put_page+0x48/0x100 mm/swap.c:128
 folio_put include/linux/mm.h:1199 [inline]
 put_page include/linux/mm.h:1237 [inline]
 __skb_frag_unref include/linux/skbuff.h:3178 [inline]
 skb_release_data+0x2f8/0x3c4 net/core/skbuff.c:672
 skb_release_all net/core/skbuff.c:742 [inline]
 __kfree_skb+0x38/0x50 net/core/skbuff.c:756
 __sk_defer_free_flush net/ipv4/tcp.c:1592 [inline]
 sk_defer_free_flush include/net/tcp.h:1378 [inline]
 tcp_recvmsg+0x1f2/0x414 net/ipv4/tcp.c:2566
 inet_recvmsg+0x10a/0x4ba net/ipv4/af_inet.c:850
 sock_recvmsg_nosec net/socket.c:948 [inline]
 sock_recvmsg net/socket.c:966 [inline]
 sock_recvmsg net/socket.c:962 [inline]
 sock_read_iter+0x26c/0x2ba net/socket.c:1039
 call_read_iter include/linux/fs.h:2068 [inline]
 new_sync_read+0x3ae/0x3d8 fs/read_write.c:400
 vfs_read+0x2ce/0x324 fs/read_write.c:481
 ksys_read+0x1c4/0x224 fs/read_write.c:619
 __do_sys_read fs/read_write.c:629 [inline]
 sys_read+0x28/0x36 fs/read_write.c:627
 ret_from_syscall+0x0/0x2
KASAN internal error: frame info validation failed; invalid marker: 18446655563249421272

Memory state around the buggy address:
 ffffaf800c48bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffaf800c48bc00: 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 00 00 00 00
>ffffaf800c48bc80: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 f3 f3 f3 f3
                      ^
 ffffaf800c48bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffaf800c48bd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Unable to handle kernel paging request at virtual address 8dfb0bf20049bb00
Oops [#1]
Modules linked in:
CPU: 1 PID: 2045 Comm: syz-fuzzer Tainted: G    B             5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
epc : 0x8dfb0bf20049bb00
 ra : 0x8dfb0bf20049bb00
epc : 8dfb0bf20049bb00 ra : 8dfb0bf20049bb00 sp : ffffaf800c48bc00
 gp : ffffffff85863ac0 tp : ffffaf8007460000 t0 : ffffffff86bcb657
 t1 : fffff5ef0b53c90c t2 : 0000000000000000 s0 : ffffaf800c48bd80
 s1 : ffffaf800c48bd20 a0 : 0000000000000004 a1 : 00000000000f0000
 a2 : 0000000000000002 a3 : ffffffff826d2872 a4 : 8dfb0bf20049bb00
 a5 : 8dfb0bf20049bb00 a6 : 0000000000f00000 a7 : ffffaf805a9e4863
 s2 : ffffffff8403fc00 s3 : ffffaf800c48bc60 s4 : 1ffff5f001891784
 s5 : 0000000000000000 s6 : ffffffff85889780 s7 : 0000000000000000
 s8 : 0000000000000004 s9 : 0000000000000000 s10: 0000000000001000
 s11: 000000c0000001a0 t3 : 0000000061736944 t4 : fffff5ef0b53c90c
 t5 : fffff5ef0b53c90d t6 : ffffaf800c48b4f8
status: 0000000000000120 badaddr: 8dfb0bf20049bb00 cause: 000000000000000c
---[ end trace 0000000000000000 ]---