==================================================================
BUG: KASAN: stack-out-of-bounds in i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:595 [inline]
BUG: KASAN: stack-out-of-bounds in i801_isr drivers/i2c/busses/i2c-i801.c:666 [inline]
BUG: KASAN: stack-out-of-bounds in i801_isr+0xcfe/0xd60 drivers/i2c/busses/i2c-i801.c:647
Write of size 1 at addr ffffc900010d7d59 by task syz-executor.0/18377

CPU: 2 PID: 18377 Comm: syz-executor.0 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x4c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:595 [inline]
 i801_isr drivers/i2c/busses/i2c-i801.c:666 [inline]
 i801_isr+0xcfe/0xd60 drivers/i2c/busses/i2c-i801.c:647
 __handle_irq_event_percpu+0x303/0x8f0 kernel/irq/handle.c:156
 handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
 handle_irq_event+0x102/0x290 kernel/irq/handle.c:213
 handle_fasteoi_irq+0x22f/0x9f0 kernel/irq/chip.c:714
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_irq_on_irqstack arch/x86/include/asm/irq_stack.h:48 [inline]
 run_irq_on_irqstack_cond arch/x86/include/asm/irq_stack.h:101 [inline]
 handle_irq arch/x86/kernel/irq.c:230 [inline]
 __common_interrupt arch/x86/kernel/irq.c:249 [inline]
 common_interrupt+0x120/0x200 arch/x86/kernel/irq.c:239
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:622
RIP: 0010:PageHuge+0x11c/0x170 mm/hugetlb.c:1555
Code: 48 c1 ea 03 80 3c 02 00 75 41 4c 8b 63 08 31 ff 41 83 e4 01 44 89 e6 e8 62 4e c3 ff 45 85 e4 0f 85 3d ff ff ff e8 04 56 c3 ff <44> 89 e0 5b 5d 41 5c c3 e8 f7 55 c3 ff 49 8d 5c 24 ff e9 5e ff ff
RSP: 0018:ffffc90000c976f8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffffea00015d88c0 RCX: ffffffff81acd9ce
RDX: ffff88807478c300 RSI: ffffffff81acd9dc RDI: 0000000000000005
RBP: ffffea00015d88c8 R08: 0000000000000000 R09: ffffea00015d88c7
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: dead000000000100
 page_remove_file_rmap mm/rmap.c:1241 [inline]
 page_remove_rmap+0x8c3/0x1c00 mm/rmap.c:1331
 zap_pte_range mm/memory.c:1253 [inline]
 zap_pmd_range mm/memory.c:1357 [inline]
 zap_pud_range mm/memory.c:1386 [inline]
 zap_p4d_range mm/memory.c:1407 [inline]
 unmap_page_range+0xe30/0x2640 mm/memory.c:1428
 unmap_single_vma+0x198/0x300 mm/memory.c:1473
 unmap_vmas+0x168/0x2e0 mm/memory.c:1505
 exit_mmap+0x2b1/0x530 mm/mmap.c:3222
 __mmput+0x122/0x470 kernel/fork.c:1079
 mmput+0x53/0x60 kernel/fork.c:1100
 exit_mm kernel/exit.c:486 [inline]
 do_exit+0xa72/0x29b0 kernel/exit.c:796
 do_group_exit+0x125/0x310 kernel/exit.c:906
 get_signal+0x428/0x1f00 kernel/signal.c:2758
 arch_do_signal+0x82/0x2390 arch/x86/kernel/signal.c:811
 exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0x100/0x1a0 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x38/0x260 kernel/entry/common.c:266
 __do_fast_syscall_32+0x62/0x80 arch/x86/entry/common.c:138
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:160
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7f22549
Code: Unable to access opcode bytes at RIP 0xf7f2251f.
RSP: 002b:00000000f551c11c EFLAGS: 00000292 ORIG_RAX: 00000000000000f0
RAX: fffffffffffffe00 RBX: 000000000818af68 RCX: 0000000000000080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000804c9b6
RBP: 000000000815e000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000


Memory state around the buggy address:
 ffffc900010d7c00: f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 00
 ffffc900010d7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900010d7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                    ^
 ffffc900010d7d80: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
 ffffc900010d7e00: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 f3 f3
==================================================================