==================================================================
BUG: KASAN: stack-out-of-bounds in switch_mm_irqs_off+0x13db/0x16c0 arch/x86/mm/tlb.c:275
------------[ cut here ]------------
Read of size 8 at addr ffff8801cf4bb3b0 by task swapper/1/0
do_IRQ(): syz-executor1 has overflown the kernel stack (cur:ffff8801cf6a0000,sp:ffff8801ce26d308,irq stk top-bottom:ffff8801dae00080-ffff8801dae08000,exception stk top-bottom:fffffe0000007080-fffffe0000011000,ip:lock_acquire+0x25f/0x540)

WARNING: CPU: 0 PID: 18597 at arch/x86/kernel/irq_64.c:63 stack_overflow_check arch/x86/kernel/irq_64.c:60 [inline]
WARNING: CPU: 0 PID: 18597 at arch/x86/kernel/irq_64.c:63 handle_irq+0x1fb/0x2e7 arch/x86/kernel/irq_64.c:72
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.18.0-rc3+ #51
Kernel panic - not syncing: panic_on_warn set ...

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 switch_mm_irqs_off+0x13db/0x16c0 arch/x86/mm/tlb.c:275
 context_switch kernel/sched/core.c:2850 [inline]
 __schedule+0x79c/0x1ed0 kernel/sched/core.c:3504
 schedule_idle+0x45/0x80 kernel/sched/core.c:3575
 do_idle+0x17f/0x570 kernel/sched/idle.c:286
 cpu_startup_entry+0x10c/0x120 kernel/sched/idle.c:368
 start_secondary+0x433/0x5d0 arch/x86/kernel/smpboot.c:265
 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242

CPU: 0 PID: 18597 Comm: syz-executor1 Not tainted 4.18.0-rc3+ #51
Allocated by task 4542:
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
Call Trace:
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 <IRQ>
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
 dup_mm kernel/fork.c:1234 [inline]
 copy_mm kernel/fork.c:1297 [inline]
 copy_process.part.40+0x235f/0x7220 kernel/fork.c:1803
 copy_process kernel/fork.c:1616 [inline]
 _do_fork+0x291/0x12a0 kernel/fork.c:2099
 panic+0x238/0x4e7 kernel/panic.c:184
 __do_sys_clone kernel/fork.c:2206 [inline]
 __se_sys_clone kernel/fork.c:2200 [inline]
 __x64_sys_clone+0xbf/0x150 kernel/fork.c:2200
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 0:
 __warn.cold.8+0x163/0x1ba kernel/panic.c:536
(stack is not available)

The buggy address belongs to the object at ffff8801cf4bb000
 which belongs to the cache mm_struct(113:syz0) of size 1496
 report_bug+0x252/0x2d0 lib/bug.c:186
The buggy address is located 944 bytes inside of
 1496-byte region [ffff8801cf4bb000, ffff8801cf4bb5d8)
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
The buggy address belongs to the page:
page:ffffea00073d2e80 count:1 mapcount:0 mapping:ffff8801b64b1c40 index:0x0
 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea00071f6108 ffff8801cb25a348 ffff8801b64b1c40
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
raw: 0000000000000000 ffff8801cf4ba300 0000000100000004 ffff8801aa344240
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
page dumped because: kasan: bad access detected
RIP: 0010:stack_overflow_check arch/x86/kernel/irq_64.c:60 [inline]
RIP: 0010:handle_irq+0x1fb/0x2e7 arch/x86/kernel/irq_64.c:72
page->mem_cgroup:ffff8801aa344240
Code: 

00 
Memory state around the buggy address:
00 
 ffff8801cf4bb280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ff 
 ffff8801cf4bb300: 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00
b6 
>ffff8801cf4bb380: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8
80 
                                     ^
00 
 ffff8801cf4bb400: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00
00 
 ffff8801cf4bb480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 
==================================================================
48 
BUG: unable to handle kernel paging request at ffff8801a8f1fcf0
c7 
PGD b4e1067 
c7 80 bc e4 
P4D b4e1067 
87 
PUD 1bdf4e063 
41 
PMD 1cf4e0063 
54 
PTE 0
41 55 
65 
Oops: 0000 [#1] SMP KASAN
48 8b 
CPU: 1 PID: 18641 Comm: syz-executor0 Tainted: G    B             4.18.0-rc3+ #51
04 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
25 
RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:139 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:186 [inline]
RIP: 0010:rb_erase+0xba1/0x3550 lib/rbtree.c:459
40 
Code: 
ee 
fc 
01 
0f 
00 
84 
48 
e4 
05 
01 
68 
00 
06 
00 
00 
48 
00 
8d 4b 
48 
10 
89 
49 
c6 
89 
e8 
dd 
85 
48 
b3 
bf 
1c 
00 
00 
00 
<0f> 
00 
0b 
00 
48 
00 
83 
fc 
c4 
ff 
18 
df 
e9 
49 
3f 
89 
ff 
c8 49 
ff 
c1 
ff 
e8 
48 
03 
89 
41 
75 
80 
e0 
3c 
e8 
38 
a1 
00 
69 
0f 85 
8f 00 
fa 
48 
28 
8b 
00 
00 
RSP: 0018:ffff8801dae07f58 EFLAGS: 00010082
<48> 
RAX: 0000000000000000 RBX: ffff8801ce20e000 RCX: 0000000000000000
3b 
RDX: 0000000000010000 RSI: ffffffff81631851 RDI: 0000000000000001
53 10 
RBP: ffff8801dae07fb0 R08: ffff8801d0220400 R09: ffffed003b5c3ec2
0f 
R10: ffffed003b5c3ec2 R11: ffff8801dae1f617 R12: fffffe0000011000
84 
R13: fffffe0000007080 R14: 000000000000002a R15: 0000000000000000
64 
04 
00 
00 49 
8d 
 do_IRQ+0x78/0x190 arch/x86/kernel/irq.c:245
97 00 
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:642
fb 
 </IRQ>
ff ff 48 b9 00 00 00 
RSP: 0018:ffff8801daf070d8 EFLAGS: 00010046
RAX: ffff8801a1b4fce0 RBX: ffff8801a8f1fce0 RCX: ffff8801a8f1fcf0
RDX: ffff8801a080fce0 RSI: ffff8801daf25d40 RDI: dffffc0000000000
RBP: ffff8801daf07ae0 R08: 1ffff100351e3f9e R09: ffff8801a080fcf0
R10: fffffbfff1569a09 R11: ffffffff8ab4d04b R12: 1ffff1003b5e0e23
R13: ffff8801a8f1fce0 R14: ffff8801a8f1fce1 R15: ffff8801daf07ab8
FS:  00007f22e070a700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801a8f1fcf0 CR3: 00000001d76e6000 CR4: 00000000001406e0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 timerqueue_del+0x86/0x150 lib/timerqueue.c:87
 __remove_hrtimer+0xa8/0x1b0 kernel/time/hrtimer.c:984
 __run_hrtimer kernel/time/hrtimer.c:1380 [inline]
 __hrtimer_run_queues+0x369/0x10c0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x165/0x730 arch/x86/kernel/apic/apic.c:1050
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:793 [inline]
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:192
Code: f1 88 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 1d 48 83 3d 1b c0 5b 01 00 74 11 fb 66 0f 1f 44 00 00 <65> ff 0d 63 fd 6b 78 5b 5d c3 0f 0b e8 69 f4 23 fa eb dc 0f 1f 80 
RSP: 0018:ffff8801b66170f8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff8801daf2c9c0 RCX: ffffffff81601b77
RDX: 1ffffffff11e360f RSI: 0000000000000004 RDI: ffffffff88f1b078
RBP: ffff8801b6617100 R08: ffffed003b5e5939 R09: ffffed003b5e5938
R10: ffffed003b5e5938 R11: ffff8801daf2c9c3 R12: ffff8801bf232680
R13: ffff8801d9ae8380 R14: ffff8801a8890840 R15: dffffc0000000000
 finish_lock_switch kernel/sched/core.c:2606 [inline]
 finish_task_switch+0x1d3/0x890 kernel/sched/core.c:2706
 context_switch kernel/sched/core.c:2865 [inline]
 __schedule+0x884/0x1ed0 kernel/sched/core.c:3504
 schedule+0xfb/0x450 kernel/sched/core.c:3548
 schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3606
 __mutex_lock_common kernel/locking/mutex.c:834 [inline]
 __mutex_lock+0xede/0x1820 kernel/locking/mutex.c:894
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:909
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 __tun_chr_ioctl+0x504/0x4570 drivers/net/tun.c:2904
 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:3178
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 __do_sys_ioctl fs/ioctl.c:708 [inline]
 __se_sys_ioctl fs/ioctl.c:706 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455a79
Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007f22e0709c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f22e070a6d4 RCX: 0000000000455a79
RDX: 0000000000000336 RSI: 00000000400454cd RDI: 0000000000000013
RBP: 000000000072bf48 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004bec0a R14: 00000000004ce100 R15: 0000000000000001
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: ffff8801a8f1fcf0
---[ end trace b7fe5eecf96e7e9b ]---
RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:139 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:186 [inline]
RIP: 0010:rb_erase+0xba1/0x3550 lib/rbtree.c:459
Code: fc 0f 84 e4 01 00 00 48 8d 4b 10 49 89 dd 48 bf 00 00 00 00 00 fc ff df 49 89 c8 49 c1 e8 03 41 80 3c 38 00 0f 85 fa 28 00 00 <48> 3b 53 10 0f 84 64 04 00 00 49 8d 97 00 fb ff ff 48 b9 00 00 00 
RSP: 0018:ffff8801daf070d8 EFLAGS: 00010046
RAX: ffff8801a1b4fce0 RBX: ffff8801a8f1fce0 RCX: ffff8801a8f1fcf0
RDX: ffff8801a080fce0 RSI: ffff8801daf25d40 RDI: dffffc0000000000
RBP: ffff8801daf07ae0 R08: 1ffff100351e3f9e R09: ffff8801a080fcf0
R10: fffffbfff1569a09 R11: ffffffff8ab4d04b R12: 1ffff1003b5e0e23
R13: ffff8801a8f1fce0 R14: ffff8801a8f1fce1 R15: ffff8801daf07ab8
FS:  00007f22e070a700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801a8f1fcf0 CR3: 00000001d76e6000 CR4: 00000000001406e0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Shutting down cpus with NMI
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..