==================================================================
BUG: KASAN: slab-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:131 [inline]
BUG: KASAN: slab-out-of-bounds in trace_page_fault_entries arch/x86/mm/fault.c:1516 [inline]
BUG: KASAN: slab-out-of-bounds in do_page_fault+0x6d/0x320 arch/x86/mm/fault.c:1528
Read of size 8 at addr ffff8881e8467f40 by task syz.2.51/536

CPU: 1 PID: 536 Comm: syz.2.51 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:

Allocated by task 3896931512:
================================================================================
UBSAN: array-index-out-of-bounds in lib/stackdepot.c:205:15
index 2066561 is out of range for type 'void *[8192]'
CPU: 1 PID: 536 Comm: syz.2.51 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
================================================================================
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-4k' (offset 6880, size 2)!
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-4k' (offset 6176, size 2)!
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-4k' (offset 5472, size 2)!
usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-4k' (offset 4768, size 2)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:99!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 536 Comm: syz.2.51 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e8467190 EFLAGS: 00010096
RAX: 0000000000000065 RBX: 00000000000012a0 RCX: 85b42e338bb98900
RDX: 0000000000000000 RSI: 0000000080000040 RDI: 0000000000000000
RBP: ffff8881e84671a0 R08: dffffc0000000000 R09: ffffed103ede5262
R10: ffffed103ede5262 R11: 1ffff1103ede5261 R12: ffff8881f5c0c280
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 00000000000012a0
FS:  000055555ee9a500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffd1fd68 CR3: 00000001f5c2a000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace e0099706f4394828 ]---
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:87
Code: 89 cb 49 c7 c6 40 7a c3 84 4c 0f 44 f6 48 c7 c7 80 7a c3 84 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 7f c1 ff ff 48 83 c4 18 <0f> 0b 00 00 90 90 00 00 90 90 00 55 48 89 e5 53 48 89 fb e8 d3 1e
RSP: 0018:ffff8881e8467190 EFLAGS: 00010096
RAX: 0000000000000065 RBX: 00000000000012a0 RCX: 85b42e338bb98900
RDX: 0000000000000000 RSI: 0000000080000040 RDI: 0000000000000000
RBP: ffff8881e84671a0 R08: dffffc0000000000 R09: ffffed103ede5262
R10: ffffed103ede5262 R11: 1ffff1103ede5261 R12: ffff8881f5c0c280
R13: 0000000000000200 R14: ffffffff84c37a40 R15: 00000000000012a0
FS:  000055555ee9a500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffffd1fd68 CR3: 00000001f5c2a000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400