Free memory is -12720kB above reserved
lowmemorykiller: Killing 'syz-executor1' (9189) (tgid 9189), adj 1000,
   to free 18072kB on behalf of 'syz-executor0' (11048) because
   cache -29520kB is below limit 6144kB for oom_score_adj 0
   Free memory is -12720kB above reserved
INFO: rcu_preempt detected stalls on CPUs/tasks:
	Tasks blocked on level-0 rcu_node (CPUs 0-1): P33
	(detected by 0, t=10502 jiffies, g=2187, c=2186, q=95041)
kswapd0         R  running task    27968    33      2 0x80000008
 0000012882a59d40 ffffffff841cc2c0 1ffff1003b083ead 0000000100000005
 0000000041b58ab3 ffffffff82e5fae0 ffffffff81d63460 ffffffff81b62410
 0000000000000020 ffff880100000020 ffff8801d841f628 ffff8801d841f5d0
Call Trace:
==================================================================
BUG: KASAN: out-of-bounds in get_frame_pointer arch/x86/include/asm/stacktrace.h:64 [inline]
BUG: KASAN: out-of-bounds in __unwind_start+0x368/0x3b0 arch/x86/kernel/unwind_frame.c:76
Read of size 8 at addr ffff8801d841f570 by task syz-executor5/11090

CPU: 0 PID: 11090 Comm: syz-executor5 Not tainted 4.9.135+ #61
 ffff8801db607a00 ffffffff81b36bf9 ffffea00076107c0 ffff8801d841f570
 0000000000000000 ffff8801d841f578 ffff8801d8410000 ffff8801db607a38
 ffffffff815009ad ffff8801d841f570 0000000000000008 0000000000000000
Call Trace:
 <IRQ> 
 [<ffffffff81b36bf9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b36bf9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815009ad>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81500db7>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81500db7>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814f2fc4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff810acc68>] get_frame_pointer arch/x86/include/asm/stacktrace.h:64 [inline]
 [<ffffffff810acc68>] __unwind_start+0x368/0x3b0 arch/x86/kernel/unwind_frame.c:76
 [<ffffffff810caaf1>] unwind_start arch/x86/include/asm/unwind.h:39 [inline]
 [<ffffffff810caaf1>] show_trace_log_lvl+0x92/0x1c8 arch/x86/kernel/dumpstack.c:70
 [<ffffffff810ca883>] show_stack_log_lvl.cold.1+0x22/0xbe arch/x86/kernel/dumpstack_64.c:188
 [<ffffffff8105a6bd>] show_stack+0x4d/0x50 arch/x86/kernel/dumpstack.c:168
 [<ffffffff813fa3c5>] sched_show_task.cold.35+0x279/0x31f kernel/sched/core.c:5317
 [<ffffffff81404dc1>] rcu_print_detail_task_stall_rnp+0xc2/0xfe kernel/rcu/tree_plugin.h:530
 [<ffffffff81405ee7>] rcu_print_detail_task_stall kernel/rcu/tree_plugin.h:543 [inline]
 [<ffffffff81405ee7>] print_other_cpu_stall kernel/rcu/tree.c:1408 [inline]
 [<ffffffff81405ee7>] check_cpu_stall kernel/rcu/tree.c:1520 [inline]
 [<ffffffff81405ee7>] __rcu_pending kernel/rcu/tree.c:3487 [inline]
 [<ffffffff81405ee7>] rcu_pending kernel/rcu/tree.c:3551 [inline]
 [<ffffffff81405ee7>] rcu_check_callbacks.cold.69+0x757/0xd27 kernel/rcu/tree.c:2880
 [<ffffffff81266ec0>] update_process_times+0x30/0x70 kernel/time/timer.c:1629
 [<ffffffff81295eda>] tick_sched_handle.isra.5+0x4a/0xf0 kernel/time/tick-sched.c:151
 [<ffffffff81295ff6>] tick_sched_timer+0x76/0x130 kernel/time/tick-sched.c:1190
 [<ffffffff81269be7>] __run_hrtimer kernel/time/hrtimer.c:1255 [inline]
 [<ffffffff81269be7>] __hrtimer_run_queues+0x357/0xe30 kernel/time/hrtimer.c:1319
 [<ffffffff8126c0d1>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1353
 [<ffffffff81091254>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:937
 [<ffffffff8280eadc>] smp_apic_timer_interrupt+0x7c/0xa0 arch/x86/kernel/apic/apic.c:961
 [<ffffffff8280c3ad>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> 
 [<ffffffff8143dfec>] spin_unlock_irq include/linux/spinlock.h:357 [inline]
 [<ffffffff8143dfec>] add_page_to_unevictable_list+0x1fc/0x2b0 mm/swap.c:457
 [<ffffffff8143e209>] lru_cache_add_active_or_unevictable+0x169/0x210 mm/swap.c:491
 [<ffffffff814a4018>] do_anonymous_page mm/memory.c:2795 [inline]
 [<ffffffff814a4018>] handle_pte_fault mm/memory.c:3514 [inline]
 [<ffffffff814a4018>] __handle_mm_fault mm/memory.c:3603 [inline]
 [<ffffffff814a4018>] handle_mm_fault+0x1d28/0x2350 mm/memory.c:3640
 [<ffffffff81490356>] faultin_page mm/gup.c:386 [inline]
 [<ffffffff81490356>] __get_user_pages+0x446/0xf80 mm/gup.c:588
 [<ffffffff81491cba>] populate_vma_page_range+0x19a/0x230 mm/gup.c:1106
 [<ffffffff81491f5b>] __mm_populate+0x20b/0x350 mm/gup.c:1156
 [<ffffffff814a8d03>] mm_populate include/linux/mm.h:2041 [inline]
 [<ffffffff814a8d03>] SYSC_mlockall mm/mlock.c:817 [inline]
 [<ffffffff814a8d03>] SyS_mlockall+0x403/0x530 mm/mlock.c:791
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff8280ac13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the page:
page:ffffea00076107c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d841f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d841f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d841f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                ^
 ffff8801d841f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d841f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================