[<ffffffff863ed4b0>] handle_exception+0x124/0x152 arch/riscv/kernel/entry.S:186
[<ffffffff863c2904>] __memcpy+0x0/0xf8
[<ffffffff817a7582>] curve25519_generic+0x2e8/0x4964 lib/crypto/curve25519-hacl64.c:779
==================================================================
BUG: KASAN: out-of-bounds in walk_stackframe+0x3e0/0x44e arch/riscv/kernel/stacktrace.c:67
Read of size 8 at addr ffff8f8007897498 by task kworker/u10:1/4376

CPU: 1 UID: 0 PID: 4376 Comm: kworker/u10:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: riscv-virtio,qemu (DT)
Workqueue: events_unbound nsim_dev_trap_report_work
Call Trace:
[<ffffffff8007949a>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff8000329a>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff80060b76>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff80060b76>] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120
[<ffffffff8000ee40>] print_address_description mm/kasan/report.c:378 [inline]
[<ffffffff8000ee40>] print_report+0x28e/0x5a2 mm/kasan/report.c:482
[<ffffffff80b1ec72>] kasan_report+0xf0/0x214 mm/kasan/report.c:595
[<ffffffff80b20d0a>] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381
[<ffffffff80078f3e>] walk_stackframe+0x3e0/0x44e arch/riscv/kernel/stacktrace.c:67
[<ffffffff8007949a>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:132
[<ffffffff8000329a>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:138
[<ffffffff802190f0>] sched_show_task kernel/sched/core.c:7933 [inline]
[<ffffffff802190f0>] sched_show_task+0x460/0x61c kernel/sched/core.c:7908
[<ffffffff802282e4>] show_state_filter+0xcc/0x302 kernel/sched/core.c:7978
[<ffffffff81eb5838>] show_state include/linux/sched/debug.h:21 [inline]
[<ffffffff81eb5838>] fn_show_state+0x1a/0x22 drivers/tty/vt/keyboard.c:613
[<ffffffff81eb5e2e>] k_spec drivers/tty/vt/keyboard.c:666 [inline]
[<ffffffff81eb5e2e>] k_spec+0x102/0x16c drivers/tty/vt/keyboard.c:655
[<ffffffff81eb84a8>] kbd_keycode drivers/tty/vt/keyboard.c:1515 [inline]
[<ffffffff81eb84a8>] kbd_event+0x8ac/0x10b6 drivers/tty/vt/keyboard.c:1534
[<ffffffff83fd5d84>] input_handle_events_default+0xfe/0x174 drivers/input/input.c:2575
[<ffffffff83fdceae>] input_pass_values+0x6f4/0x7f6 drivers/input/input.c:127
[<ffffffff83fe0162>] input_event_dispose drivers/input/input.c:341 [inline]
[<ffffffff83fe0162>] input_handle_event+0x232/0x13e6 drivers/input/input.c:369
[<ffffffff83fe13b2>] input_event drivers/input/input.c:395 [inline]
[<ffffffff83fe13b2>] input_event+0x9c/0xe6 drivers/input/input.c:390
[<ffffffff848fe7da>] input_sync include/linux/input.h:464 [inline]
[<ffffffff848fe7da>] hidinput_report_event+0xc0/0x114 drivers/hid/hid-input.c:1733
[<ffffffff848f3d36>] hid_report_raw_event+0x26e/0x1146 drivers/hid/hid-core.c:2072
[<ffffffff848f4f04>] __hid_input_report.constprop.0+0x2f6/0x3fa drivers/hid/hid-core.c:2135
[<ffffffff848f503a>] hid_input_report+0x32/0x44 drivers/hid/hid-core.c:2157
[<ffffffff84a8d5ba>] hid_irq_in+0x2f6/0x732 drivers/hid/usbhid/hid-core.c:286
[<ffffffff83846610>] __usb_hcd_giveback_urb+0x362/0x6f4 drivers/usb/core/hcd.c:1663
[<ffffffff83846d06>] usb_hcd_giveback_urb+0x364/0x3fe drivers/usb/core/hcd.c:1747
[<ffffffff83d9c110>] dummy_timer+0x134a/0x3458 drivers/usb/gadget/udc/dummy_hcd.c:1995
[<ffffffff803f6682>] __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
[<ffffffff803f6682>] __hrtimer_run_queues+0x1bc/0xf9e kernel/time/hrtimer.c:1825
[<ffffffff803f75a8>] hrtimer_run_softirq+0x144/0x2f6 kernel/time/hrtimer.c:1842
[<ffffffff8016778e>] handle_softirqs+0x4b2/0x132e kernel/softirq.c:579
[<ffffffff863ed6ec>] __do_softirq+0x12/0x1a kernel/softirq.c:613
[<ffffffff8006845c>] ___do_softirq+0x18/0x20 arch/riscv/kernel/irq.c:119
[<ffffffff863ed63a>] call_on_irq_stack+0x32/0x40 arch/riscv/kernel/entry.S:360

The buggy address belongs to a 8-page vmalloc region starting at 0xffff8f8007890000 allocated at kernel_clone+0x128/0xd9e kernel/fork.c:2605
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffaf801afc8770 pfn:0x9afc8
flags: 0xffe000000000000(node=0|zone=0|lastcpupid=0x7ff)
raw: 0ffe000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffffaf801afc8770 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 2, tgid 2 (kthreadd), ts 717618247000, free_ts 597368008100
 __set_page_owner+0x94/0x4a8 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xdc/0x1ba mm/page_alloc.c:1851
 prep_new_page mm/page_alloc.c:1859 [inline]
 get_page_from_freelist+0x7fa/0x359a mm/page_alloc.c:3858
 __alloc_frozen_pages_noprof+0x22e/0x2120 mm/page_alloc.c:5148
 __alloc_pages_noprof+0xe/0x22 mm/page_alloc.c:5182
 __alloc_pages_node_noprof include/linux/gfp.h:284 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:311 [inline]
 vm_area_alloc_pages mm/vmalloc.c:3644 [inline]
 __vmalloc_area_node mm/vmalloc.c:3720 [inline]
 __vmalloc_node_range_noprof+0x556/0x11b0 mm/vmalloc.c:3893
 __vmalloc_node_noprof+0x104/0x136 mm/vmalloc.c:3956
 alloc_thread_stack_node kernel/fork.c:311 [inline]
 dup_task_struct kernel/fork.c:882 [inline]
 copy_process+0x32ec/0x72da kernel/fork.c:2004
 kernel_clone+0x128/0xd9e kernel/fork.c:2605
 kernel_thread+0xe2/0x120 kernel/fork.c:2667
 create_kthread kernel/kthread.c:486 [inline]
 kthreadd+0x49a/0x73c kernel/kthread.c:846
 ret_from_fork_kernel+0x2a/0xbb4 arch/riscv/kernel/process.c:214
 ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:327
page last free pid 3194 tgid 3194 stack trace:
 __reset_page_owner+0x78/0x1ba mm/page_owner.c:308
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0x836/0x145e mm/page_alloc.c:2895
 free_frozen_pages+0xe/0x16 mm/page_alloc.c:2933
 __folio_put+0x296/0x378 mm/swap.c:112
 folio_put include/linux/mm.h:1360 [inline]
 put_page+0x20a/0x25e include/linux/mm.h:1429
 anon_pipe_put_page fs/pipe.c:139 [inline]
 anon_pipe_buf_release+0x138/0x28e fs/pipe.c:147
 pipe_buf_release include/linux/pipe_fs_i.h:282 [inline]
 pipe_update_tail fs/pipe.c:242 [inline]
 anon_pipe_read+0x5b2/0x10fe fs/pipe.c:361
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x97c/0xbba fs/read_write.c:572
 ksys_read+0x1f2/0x234 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __riscv_sys_read+0x6e/0xa0 fs/read_write.c:722
 syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112
 do_trap_ecall_u+0x396/0x530 arch/riscv/kernel/traps.c:343
 handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197

Memory state around the buggy address:
 ffff8f8007897380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f8007897400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8f8007897480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                               ^
 ffff8f8007897500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8f8007897580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================