==================================================================
BUG: KASAN: slab-out-of-bounds in pdu_read net/9p/protocol.c:59 [inline]
BUG: KASAN: slab-out-of-bounds in p9pdu_vreadf net/9p/protocol.c:162 [inline]
BUG: KASAN: slab-out-of-bounds in p9pdu_readf+0x535/0x1d50 net/9p/protocol.c:535
Read of size 23147 at addr ffff8801c8db002d by task syz-executor1/6540

CPU: 0 PID: 6540 Comm: syz-executor1 Not tainted 4.9.111-g03c70fe #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801b722f570 ffffffff81eb2729 ffffea0007236c00 ffff8801c8db002d
 0000000000000000 ffff8801c8db2025 0000000036f6bff3 ffff8801b722f5a8
 ffffffff81567b59 ffff8801c8db002d 0000000000005a6b 0000000000000000
Call Trace:
 [<ffffffff81eb2729>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb2729>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81567b59>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567f63>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567f63>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153aa1f>] check_memory_region_inline mm/kasan/kasan.c:318 [inline]
 [<ffffffff8153aa1f>] check_memory_region+0x14f/0x1b0 mm/kasan/kasan.c:325
 [<ffffffff8153b063>] memcpy+0x23/0x50 mm/kasan/kasan.c:360
 [<ffffffff839bec95>] pdu_read net/9p/protocol.c:59 [inline]
 [<ffffffff839bec95>] p9pdu_vreadf net/9p/protocol.c:162 [inline]
 [<ffffffff839bec95>] p9pdu_readf+0x535/0x1d50 net/9p/protocol.c:535
 [<ffffffff839b35df>] p9_client_version net/9p/client.c:960 [inline]
 [<ffffffff839b35df>] p9_client_create+0xa3f/0x10a0 net/9p/client.c:1043
 [<ffffffff8195ab03>] v9fs_session_init+0x333/0x13a0 fs/9p/v9fs.c:343
 [<ffffffff8194c3fd>] v9fs_mount+0x7d/0x810 fs/9p/vfs_super.c:130
 [<ffffffff8157e22c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815dd9f1>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:991
 [<ffffffff815e5319>] vfs_kern_mount fs/namespace.c:973 [inline]
 [<ffffffff815e5319>] do_new_mount fs/namespace.c:2513 [inline]
 [<ffffffff815e5319>] do_mount+0x3c9/0x2740 fs/namespace.c:2835
 [<ffffffff8168c3ec>] C_SYSC_mount fs/compat.c:810 [inline]
 [<ffffffff8168c3ec>] compat_SyS_mount+0x4fc/0xff0 fs/compat.c:775
 [<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 [<ffffffff839fa3d0>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the page:
page:ffffea0007236c00 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004000(head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c8db1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801c8db1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801c8db2000: 00 00 00 00 fe fe fe fe fe fe fe fe fe fe fe fe
                               ^
 ffff8801c8db2080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 ffff8801c8db2100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================