audit: type=1400 audit(1536894773.746:80217): avc:  denied  { dac_override } for  pid=31512 comm="syz-executor4" capability=1  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
audit: type=1400 audit(1536894773.746:80218): avc:  denied  { sys_admin } for  pid=2097 comm="syz-executor0" capability=21  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
==================================================================
BUG: KASAN: stack-out-of-bounds in get_frame_pointer arch/x86/include/asm/stacktrace.h:64 [inline]
BUG: KASAN: stack-out-of-bounds in __unwind_start+0x368/0x3b0 arch/x86/kernel/unwind_frame.c:76
Read of size 8 at addr ffff88018cc1f1a0 by task syz-executor4/31517

CPU: 1 PID: 31517 Comm: syz-executor4 Not tainted 4.9.126+ #42
 ffff88018da6f778 ffffffff81af1049 ffffea00063307c0 ffff88018cc1f1a0
 0000000000000000 ffff88018cc1f1a0 ffff88018cc10000 ffff88018da6f7b0
 ffffffff814e136d ffff88018cc1f1a0 0000000000000008 0000000000000000
Call Trace:
 [<ffffffff81af1049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81af1049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814e136d>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff814e1777>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff814e1777>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814d3bb4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff810aae98>] get_frame_pointer arch/x86/include/asm/stacktrace.h:64 [inline]
 [<ffffffff810aae98>] __unwind_start+0x368/0x3b0 arch/x86/kernel/unwind_frame.c:76
 [<ffffffff81075f89>] unwind_start arch/x86/include/asm/unwind.h:39 [inline]
 [<ffffffff81075f89>] __save_stack_trace+0x59/0xf0 arch/x86/kernel/stacktrace.c:41
 [<ffffffff81076088>] save_stack_trace_tsk+0x48/0x70 arch/x86/kernel/stacktrace.c:71
 [<ffffffff8163e228>] proc_pid_stack+0x148/0x220 fs/proc/base.c:469
 [<ffffffff816367ad>] proc_single_show+0xfd/0x170 fs/proc/base.c:771
 [<ffffffff8155ee46>] seq_read+0x4b6/0x12d0 fs/seq_file.c:240
 [<ffffffff814ea7a5>] do_loop_readv_writev.part.1+0xd5/0x280 fs/read_write.c:718
 [<ffffffff814ed0c0>] do_loop_readv_writev fs/read_write.c:707 [inline]
 [<ffffffff814ed0c0>] compat_do_readv_writev+0x570/0x7b0 fs/read_write.c:1091
 [<ffffffff814ed3e2>] compat_readv+0xe2/0x150 fs/read_write.c:1120
 [<ffffffff814ed772>] do_compat_preadv64+0x152/0x180 fs/read_write.c:1169
 [<ffffffff814efcfb>] C_SYSC_preadv fs/read_write.c:1189 [inline]
 [<ffffffff814efcfb>] compat_SyS_preadv+0x3b/0x50 fs/read_write.c:1183
 [<ffffffff81005fd1>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81005fd1>] do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
 [<ffffffff8278dfa0>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the page:
page:ffffea00063307c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88018cc1f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88018cc1f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88018cc1f180: 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 00
                               ^
 ffff88018cc1f200: 00 00 00 00 04 f2 f2 00 00 00 00 00 00 00 00 00
 ffff88018cc1f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================