==================================================================
BUG: KASAN: vmalloc-out-of-bounds in i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:593 [inline]
BUG: KASAN: vmalloc-out-of-bounds in i801_isr drivers/i2c/busses/i2c-i801.c:664 [inline]
BUG: KASAN: vmalloc-out-of-bounds in i801_isr+0xb2d/0xbf0 drivers/i2c/busses/i2c-i801.c:645
Write of size 1 at addr ffffc90002d17d70 by task syz-executor.2/8940

CPU: 1 PID: 8940 Comm: syz-executor.2 Not tainted 5.9.0-rc3-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:593 [inline]
 i801_isr drivers/i2c/busses/i2c-i801.c:664 [inline]
 i801_isr+0xb2d/0xbf0 drivers/i2c/busses/i2c-i801.c:645
 __handle_irq_event_percpu+0x223/0xaa0 kernel/irq/handle.c:156
 handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
 handle_irq_event+0x102/0x285 kernel/irq/handle.c:213
 handle_fasteoi_irq+0x22f/0x9f0 kernel/irq/chip.c:714
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline]
 handle_irq arch/x86/kernel/irq.c:230 [inline]
 __common_interrupt arch/x86/kernel/irq.c:249 [inline]
 common_interrupt+0x96/0x1f0 arch/x86/kernel/irq.c:239
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:572
RIP: 0010:__do_softirq+0x1ba/0xa91 kernel/softirq.c:284
Code: c7 c0 58 3c b6 89 48 c1 e8 03 42 80 3c 30 00 0f 85 ea 07 00 00 48 83 3d ab 3a 96 01 00 0f 84 b7 06 00 00 fb 66 0f 1f 44 00 00 <48> c7 44 24 08 c0 90 a0 89 b8 ff ff ff ff 0f bc 04 24 83 c0 01 89
RSP: 0018:ffffc900004e8f70 EFLAGS: 00000282
RAX: 1ffffffff136c78b RBX: ffff88802c1b0140 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffc90001817330 R08: 0000000000000001 R09: ffffffff8c5f19f7
R10: fffffbfff18be33e R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x9d/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x235/0x280 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x51/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581
RIP: 0010:arch_stack_walk+0x13/0xf0 arch/x86/kernel/stacktrace.c:17
Code: f1 e6 87 eb ed e6 83 eb e9 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 56 49 89 d6 41 55 49 89 cd 41 54 49 89 f4 <53> 48 89 fb 48 83 ec 68 65 48 8b 04 25 28 00 00 00 48 89 45 d8 31
RSP: 0018:ffffc90001817430 EFLAGS: 00000246
RAX: 0000000000000000 RBX: fffff52000302e8b RCX: 0000000000000000
RDX: ffff88802c1b0140 RSI: ffffc90001817478 RDI: ffffffff81634100
RBP: ffffc90001817448 R08: ffffed100540a5d6 R09: ffffed100540a5ef
R10: fffffbfff18be33e R11: 0000000000000001 R12: ffffc90001817478
R13: 0000000000000000 R14: ffff88802c1b0140 R15: 00000000000000c8
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 slab_post_alloc_hook mm/slab.h:518 [inline]
 slab_alloc mm/slab.c:3312 [inline]
 kmem_cache_alloc+0x13a/0x3a0 mm/slab.c:3482
 vm_area_dup+0x88/0x2b0 kernel/fork.c:355
 dup_mmap kernel/fork.c:531 [inline]
 dup_mm+0x508/0x1300 kernel/fork.c:1354
 copy_mm kernel/fork.c:1410 [inline]
 copy_process+0x28e4/0x6920 kernel/fork.c:2069
 _do_fork+0xe8/0xb10 kernel/fork.c:2428
 __do_compat_sys_ia32_clone+0xac/0xe0 arch/x86/kernel/sys_ia32.c:254
 do_syscall_32_irqs_on arch/x86/entry/common.c:84 [inline]
 __do_fast_syscall_32+0x57/0x80 arch/x86/entry/common.c:126
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:149
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7fde549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000ffb7a2b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000078
RAX: ffffffffffffffda RBX: 0000000001200011 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000a987968
RBP: 00000000ffb7a308 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000


Memory state around the buggy address:
 ffffc90002d17c00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90002d17c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90002d17d00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                                             ^
 ffffc90002d17d80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90002d17e00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================