12   ip6gretap0      1     0     3333ffaaaa15
13   bridge0         1     0     333300000001
13   bridge0         1     0     3333ff00000c
13   bridge0         1    ./file0'
==================================================================
BUG: KASAN: global-out-of-bounds in record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
Write of size 1 at addr ffffffff8f09f028 by task syz-executor.0/13571

CPU: 1 PID: 13571 Comm: syz-executor.0 Not tainted 5.11.0-rc4-next-20210121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5/0x2f8 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:397 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:414
 record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
 console_unlock+0x318/0xbb0 kernel/printk/printk.c:2555
 vprintk_emit+0x189/0x490 kernel/printk/printk.c:2092
 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
 printk+0xba/0xed kernel/printk/printk.c:2140
 logfc.cold+0x8e/0xe0 fs/fs_context.c:375
 vfs_parse_fs_param fs/fs_context.c:135 [inline]
 vfs_parse_fs_param+0x4b3/0x550 fs/fs_context.c:98
 vfs_parse_fs_string+0xe6/0x150 fs/fs_context.c:161
 shmem_parse_options+0x15f/0x240 mm/shmem.c:3500
 do_new_mount fs/namespace.c:2885 [inline]
 path_mount+0x1266/0x1e70 fs/namespace.c:3220
 do_mount fs/namespace.c:3233 [inline]
 __do_sys_mount fs/namespace.c:3441 [inline]
 __se_sys_mount fs/namespace.c:3418 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3418
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f362d2edc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e219
RDX: 0000000020000000 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 000000000119c078 R08: 0000000020000240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119c034
R13: 00007fffcdc77c8f R14: 00007f362d2ee9c0 R15: 000000000119c034

The buggy address belongs to the variable:
 always_kmsg_dump+0x8/0x40

Memory state around the buggy address:
 ffffffff8f09ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8f09ef80: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff8f09f000: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
                                  ^
 ffffffff8f09f080: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff8f09f100: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
==================================================================