pts pts2: tty_release: tty->count(2) != #fd's(1)
pts pts3: tty_release: tty->count(2) != #fd's(1)
pts pts4: tty_release: tty->count(2) != #fd's(1)
pts pts5: tty_release: tty->count(2) != #fd's(1)
==================================================================
BUG: KASAN: user-memory-access in bitmap_zero include/linux/bitmap.h:197 [inline]
BUG: KASAN: user-memory-access in n_tty_set_termios+0xf6/0xd30 drivers/tty/n_tty.c:1786
Write of size 512 at addr 0000000000001060 by task syz-executor4/4690

CPU: 1 PID: 4690 Comm: syz-executor4 Not tainted 4.9.128+ #41
 ffff8801c420f708 ffffffff81af2469 0000000000001060 0000000000000200
 0000000000000001 000000000000005d ffff8801c420f848 ffff8801c420f750
 ffffffff814e1600 ffffffff81cd72c6 0000000000000286 1ea2fdbc9100f710
Call Trace:
 [<ffffffff81af2469>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81af2469>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814e1600>] kasan_report_error mm/kasan/report.c:353 [inline]
 [<ffffffff814e1600>] kasan_report.cold.6+0x6d/0x2fe mm/kasan/report.c:412
 [<ffffffff814d299d>] check_memory_region_inline mm/kasan/kasan.c:318 [inline]
 [<ffffffff814d299d>] check_memory_region+0x14d/0x1b0 mm/kasan/kasan.c:325
 [<ffffffff814d2f53>] memset+0x23/0x40 mm/kasan/kasan.c:343
 [<ffffffff81cd72c6>] bitmap_zero include/linux/bitmap.h:197 [inline]
 [<ffffffff81cd72c6>] n_tty_set_termios+0xf6/0xd30 drivers/tty/n_tty.c:1786
 [<ffffffff81ce20b6>] tty_set_termios+0x626/0x8a0 drivers/tty/tty_ioctl.c:562
 [<ffffffff81ce309f>] set_termios+0x38f/0x620 drivers/tty/tty_ioctl.c:635
 [<ffffffff81ce38a9>] tty_mode_ioctl+0x4f9/0x980 drivers/tty/tty_ioctl.c:968
 [<ffffffff81ce3dd4>] n_tty_ioctl_helper+0x44/0x370 drivers/tty/tty_ioctl.c:1161
 [<ffffffff81cde7c6>] n_tty_ioctl+0x46/0x2e0 drivers/tty/n_tty.c:2452
 [<ffffffff81cd01c0>] tty_ioctl+0x440/0x2190 drivers/tty/tty_io.c:3009
 [<ffffffff8152768c>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff8152768c>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff8152768c>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff8152870f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff8152870f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff8100554f>] do_syscall_64+0x19f/0x480 arch/x86/entry/common.c:282
 [<ffffffff8278df13>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
==================================================================