fuse: Bad value for 'fd'
==================================================================
BUG: KASAN: global-out-of-bounds in record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
Write of size 1 at addr ffffffff8f08cfb6 by task syz-executor.4/14455

CPU: 1 PID: 14455 Comm: syz-executor.4 Not tainted 5.11.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5/0x2c6 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413
 record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
 console_unlock+0x318/0xbb0 kernel/printk/printk.c:2555
 vprintk_emit+0x189/0x490 kernel/printk/printk.c:2092
 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
 printk+0xba/0xed kernel/printk/printk.c:2140
 logfc.cold+0x8e/0xe0 fs/fs_context.c:375
 fs_param_bad_value fs/fs_parser.c:194 [inline]
 fs_param_is_u32+0x13e/0x1c0 fs/fs_parser.c:217
 __fs_parse+0x226/0x810 fs/fs_parser.c:128
 fs_parse include/linux/fs_parser.h:73 [inline]
 fuse_parse_param+0x186/0xb40 fs/fuse/inode.c:554
 vfs_parse_fs_param fs/fs_context.c:117 [inline]
 vfs_parse_fs_param+0x203/0x550 fs/fs_context.c:98
 vfs_parse_fs_string+0xe6/0x150 fs/fs_context.c:161
 generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:201
 do_new_mount fs/namespace.c:2877 [inline]
 path_mount+0x1365/0x20c0 fs/namespace.c:3211
 do_mount fs/namespace.c:3224 [inline]
 __do_sys_mount fs/namespace.c:3432 [inline]
 __se_sys_mount fs/namespace.c:3409 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3409
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2ddac17c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e219
RDX: 0000000020002000 RSI: 00000000200042c0 RDI: 0000000000000000
RBP: 000000000119bfd0 R08: 0000000020002640 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffe1c86049f R14: 00007f2ddac189c0 R15: 000000000119bf8c

The buggy address belongs to the variable:
 early_console+0x16/0x40

Memory state around the buggy address:
 ffffffff8f08ce80: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 f9 f9
 ffffffff8f08cf00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
>ffffffff8f08cf80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
                                     ^
 ffffffff8f08d000: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
 ffffffff8f08d080: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 f9 f9
==================================================================