==================================================================
BUG: KASAN: vmalloc-out-of-bounds in get_unaligned_le16 include/asm-generic/unaligned.h:27 [inline]
BUG: KASAN: vmalloc-out-of-bounds in LZ4_readLE16 lib/lz4/lz4defs.h:134 [inline]
BUG: KASAN: vmalloc-out-of-bounds in LZ4_decompress_generic lib/lz4/lz4_decompress.c:285 [inline]
BUG: KASAN: vmalloc-out-of-bounds in LZ4_decompress_safe_partial+0x102a/0x11a0 lib/lz4/lz4_decompress.c:469
Read of size 2 at addr ffffc90000acf000 by task kworker/u5:0/47

CPU: 0 PID: 47 Comm: kworker/u5:0 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: erofs_unzipd z_erofs_decompressqueue_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xf/0x495 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 get_unaligned_le16 include/asm-generic/unaligned.h:27 [inline]
 LZ4_readLE16 lib/lz4/lz4defs.h:134 [inline]
 LZ4_decompress_generic lib/lz4/lz4_decompress.c:285 [inline]
 LZ4_decompress_safe_partial+0x102a/0x11a0 lib/lz4/lz4_decompress.c:469
 z_erofs_lz4_decompress_mem fs/erofs/decompressor.c:239 [inline]
 z_erofs_lz4_decompress+0xda6/0x14a0 fs/erofs/decompressor.c:310
 z_erofs_decompress_pcluster.isra.0+0x1eac/0x3160 fs/erofs/zdata.c:961
 z_erofs_decompress_queue fs/erofs/zdata.c:1045 [inline]
 z_erofs_decompressqueue_work+0xe1/0x170 fs/erofs/zdata.c:1056
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>

The buggy address belongs to the virtual mapping at
 [ffffc90000ace000, ffffc90000ad0000) created by:
 erofs_pcpubuf_growsize+0x2d5/0x590 fs/erofs/pcpubuf.c:81

------------[ cut here ]------------
kernel BUG at mm/vmalloc.c:660!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 47 Comm: kworker/u5:0 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: erofs_unzipd z_erofs_decompressqueue_work
RIP: 0010:vmalloc_to_page+0x46e/0x4f0 mm/vmalloc.c:660
Code: c1 ff 4d 31 fc 4d 21 f4 49 c1 ec 0c 4c 01 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 e3 06 49 01 dc e9 35 ff ff ff e8 92 75 c1 ff <0f> 0b e8 8b 75 c1 ff 0f 0b 45 31 e4 e9 1f ff ff ff e8 7c 75 c1 ff
RSP: 0018:ffffc90000b87518 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880184e8000 RSI: ffffffff81b7278e RDI: 0000000000000003
RBP: ffffffff8ba8e000 R08: 00001ffffffffffe R09: 0000000000000000
R10: ffffffff81b723a6 R11: 0000000000000000 R12: 0000370000000000
R13: 0000000000000000 R14: ffff8880184e8000 R15: 0000000000000282
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c8d14eab60 CR3: 000000002323b000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 print_address_description.constprop.0.cold+0x2fc/0x495 mm/kasan/report.c:350
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 get_unaligned_le16 include/asm-generic/unaligned.h:27 [inline]
 LZ4_readLE16 lib/lz4/lz4defs.h:134 [inline]
 LZ4_decompress_generic lib/lz4/lz4_decompress.c:285 [inline]
 LZ4_decompress_safe_partial+0x102a/0x11a0 lib/lz4/lz4_decompress.c:469
 z_erofs_lz4_decompress_mem fs/erofs/decompressor.c:239 [inline]
 z_erofs_lz4_decompress+0xda6/0x14a0 fs/erofs/decompressor.c:310
 z_erofs_decompress_pcluster.isra.0+0x1eac/0x3160 fs/erofs/zdata.c:961
 z_erofs_decompress_queue fs/erofs/zdata.c:1045 [inline]
 z_erofs_decompressqueue_work+0xe1/0x170 fs/erofs/zdata.c:1056
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vmalloc_to_page+0x46e/0x4f0 mm/vmalloc.c:660
Code: c1 ff 4d 31 fc 4d 21 f4 49 c1 ec 0c 4c 01 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 e3 06 49 01 dc e9 35 ff ff ff e8 92 75 c1 ff <0f> 0b e8 8b 75 c1 ff 0f 0b 45 31 e4 e9 1f ff ff ff e8 7c 75 c1 ff
RSP: 0018:ffffc90000b87518 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880184e8000 RSI: ffffffff81b7278e RDI: 0000000000000003
RBP: ffffffff8ba8e000 R08: 00001ffffffffffe R09: 0000000000000000
R10: ffffffff81b723a6 R11: 0000000000000000 R12: 0000370000000000
R13: 0000000000000000 R14: ffff8880184e8000 R15: 0000000000000282
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c8d14eab60 CR3: 000000002323b000 CR4: 0000000000350ef0