==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:214 [inline]
BUG: KASAN: stack-out-of-bounds in page_fault_oops+0xad4/0xb90 arch/x86/mm/fault.c:649
Read of size 2 at addr ffffc9000db7fa00 by task syz.2.828/9216

CPU: 0 UID: 0 PID: 9216 Comm: syz.2.828 Not tainted 6.14.0-rc4-syzkaller-gac9c34d1e45a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:

The buggy address belongs to the virtual mapping at
 [ffffc9000db78000, ffffc9000db81000) created by:
 kernel_clone+0xfd/0x960 kernel/fork.c:2815

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x31aad
memcg:ffff888024fb0c82
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888000000000 0000000000000000 00000001ffffffff ffff888024fb0c82
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 9207, tgid 9207 (syz.2.826), ts 125817566275, free_ts 125774356078
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
 prep_new_page mm/page_alloc.c:1559 [inline]
 get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3477
 __alloc_frozen_pages_noprof+0x221/0x2470 mm/page_alloc.c:4739
 alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
 alloc_pages_noprof+0x131/0x390 mm/mempolicy.c:2361
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x721/0x1530 mm/vmalloc.c:3846
 alloc_thread_stack_node kernel/fork.c:314 [inline]
 dup_task_struct kernel/fork.c:1127 [inline]
 copy_process+0x2ef2/0x8c50 kernel/fork.c:2233
 kernel_clone+0xfd/0x960 kernel/fork.c:2815
 __do_sys_clone3+0x214/0x290 kernel/fork.c:3119
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 0 tgid 0 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1127 [inline]
 free_frozen_pages+0x6db/0xfb0 mm/page_alloc.c:2660
 pagetable_free include/linux/mm.h:2917 [inline]
 pagetable_dtor_free include/linux/mm.h:3015 [inline]
 __tlb_remove_table include/asm-generic/tlb.h:216 [inline]
 __tlb_remove_table_free mm/mmu_gather.c:227 [inline]
 tlb_remove_table_rcu+0x116/0x1a0 mm/mmu_gather.c:282
 rcu_do_batch kernel/rcu/tree.c:2546 [inline]
 rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2802
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702

Memory state around the buggy address:
 ffffc9000db7f900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9000db7f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
>ffffc9000db7fa00: f1 f1 f1 f1 04 f2 00 00 f2 f2 00 00 00 f3 f3 f3
                   ^
 ffffc9000db7fa80: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9000db7fb00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
==================================================================