==================================================================
BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: wild-memory-access in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: wild-memory-access in __lock_acquire+0xc8b/0x2050 kernel/locking/lockdep.c:5169
Read of size 8 at addr 1fffffff91a91ce8 by task syz.2.139/6085

CPU: 1 UID: 0 PID: 6085 Comm: syz.2.139 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 __lock_acquire+0xc8b/0x2050 kernel/locking/lockdep.c:5169
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822
 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
 raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:601
 raw_spin_rq_lock kernel/sched/sched.h:1505 [inline]
 rq_lock kernel/sched/sched.h:1804 [inline]
 __schedule+0x357/0x4b30 kernel/sched/core.c:6575
 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:6997
 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:get_current arch/x86/include/asm/current.h:49 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x8/0x90 kernel/kcov.c:314
Code: 44 0a 20 e9 85 89 5b 0a 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 4c 8b 04 24 <65> 48 8b 14 25 c0 d7 03 00 65 8b 05 10 20 6f 7e 25 00 01 ff 00 74
RSP: 0018:ffffc9000364ea78 EFLAGS: 00000246
RAX: ffffffff82090801 RBX: 0000000000000e5c RCX: ffffffff820908e0
RDX: 0000000000000001 RSI: 0000000000000e5c RDI: 0000000000000000
RBP: ffffc9000364eb68 R08: ffffffff820908f1 R09: 1ffff1100f53571d
R10: dffffc0000000000 R11: ffffed100f53571e R12: ffff88807a9ab8d0
R13: 0000000000000001 R14: 1ffff920006c9d5c R15: ffff88807a9ab8ec
 __refcount_add include/linux/refcount.h:189 [inline]
 refcount_add include/linux/refcount.h:213 [inline]
 inc_stack_record_count mm/page_owner.c:216 [inline]
 __set_page_owner+0x651/0x800 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537
 prep_new_page mm/page_alloc.c:1545 [inline]
 get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457
 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4733
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
 folio_alloc_mpol_noprof+0x36/0x50 mm/mempolicy.c:2283
 shmem_alloc_folio mm/shmem.c:1774 [inline]
 shmem_alloc_and_add_folio+0x49b/0x13d0 mm/shmem.c:1813
 shmem_get_folio_gfp+0x5a9/0x20a0 mm/shmem.c:2335
 shmem_fault+0x253/0x6f0 mm/shmem.c:2536
 __do_fault+0x137/0x460 mm/memory.c:4876
 do_read_fault mm/memory.c:5282 [inline]
 do_fault mm/memory.c:5416 [inline]
 do_pte_missing mm/memory.c:3965 [inline]
 handle_pte_fault+0x2d1c/0x6800 mm/memory.c:5751
 __handle_mm_fault mm/memory.c:5894 [inline]
 handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6062
 faultin_page mm/gup.c:1187 [inline]
 __get_user_pages+0x1b16/0x48d0 mm/gup.c:1485
 populate_vma_page_range+0x264/0x330 mm/gup.c:1923
 __mm_populate+0x27a/0x460 mm/gup.c:2026
 mm_populate include/linux/mm.h:3371 [inline]
 vm_mmap_pgoff+0x2c3/0x3d0 mm/util.c:593
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdd7f77dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdd80592038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fdd7f935f80 RCX: 00007fdd7f77dff9
RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007fdd7f7f0296 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fdd7f935f80 R15: 00007ffc7e1cf8e8
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	44 0a 20             	or     (%rax),%r12b
   3:	e9 85 89 5b 0a       	jmp    0xa5b898d
   8:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
   f:	00 00 00
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	f3 0f 1e fa          	endbr64
  26:	4c 8b 04 24          	mov    (%rsp),%r8
* 2a:	65 48 8b 14 25 c0 d7 	mov    %gs:0x3d7c0,%rdx <-- trapping instruction
  31:	03 00
  33:	65 8b 05 10 20 6f 7e 	mov    %gs:0x7e6f2010(%rip),%eax        # 0x7e6f204a
  3a:	25 00 01 ff 00       	and    $0xff0100,%eax
  3f:	74                   	.byte 0x74