------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9
index 16382 is out of range for type 'long unsigned int [8]'
CPU: 0 UID: 0 PID: 5733 Comm: syz.3.125 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 decode_tail kernel/locking/qspinlock.h:68 [inline]
 __pv_queued_spin_lock_slowpath+0xbd7/0xc00 kernel/locking/qspinlock.c:285
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:35 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:66 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x1e0/0x260 kernel/locking/spinlock_debug.c:116
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock_irqsave+0x42/0x60 kernel/locking/spinlock.c:166
 complete_with_flags kernel/sched/completion.c:25 [inline]
 complete+0x1d/0x200 kernel/sched/completion.c:52
 transfer drivers/usb/gadget/udc/dummy_hcd.c:1527 [inline]
 dummy_timer+0x121c/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:1989
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:unwind_next_frame+0x151e/0x2090 arch/x86/kernel/unwind_orc.c:677
Code: 49 89 c0 49 c1 e8 03 41 0f b6 14 10 49 89 f8 41 83 e0 07 44 38 c6 41 0f 9e c0 40 84 f6 40 0f 95 c6 41 84 f0 0f 85 a7 07 00 00 <83> e0 07 38 c2 40 0f 9e c6 84 d2 0f 95 c0 40 84 c6 0f 85 90 07 00
RSP: 0018:ffffc90007aaf238 EFLAGS: 00000246
RAX: ffffffff8b63a091 RBX: 0000000000000001 RCX: ffffffff8b63a08e
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8b63a090
RBP: ffffc90007aaf2f0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffc90007aaf2a8 R11: 0000000000010a8b R12: ffffc90007aaf2f8
R13: ffffc90007aaf2a8 R14: ffffc90007aafcb0 R15: ffffc90007aaf2dc
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6e/0x70 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_noprof+0x2e2/0x640 mm/slub.c:4959
 vm_area_dup+0x25/0x6e0 mm/vma_init.c:123
 __split_vma+0x18c/0xd70 mm/vma.c:516
 split_vma mm/vma.c:599 [inline]
 vma_modify+0x1a2c/0x2290 mm/vma.c:1691
 vma_modify_flags+0x1f2/0x360 mm/vma.c:1719
 mprotect_fixup+0x27a/0xe30 mm/mprotect.c:789
 do_mprotect_pkey+0xa4b/0xef0 mm/mprotect.c:967
 __do_sys_mprotect mm/mprotect.c:988 [inline]
 __se_sys_mprotect mm/mprotect.c:985 [inline]
 __x64_sys_mprotect+0x78/0xc0 mm/mprotect.c:985
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdc1b6cc57
Code: 89 38 eb 84 0f 1f 80 00 00 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 7a ff ff ff b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9b222428 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007fcdc05856c0 RCX: 00007fcdc1b6cc57
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007fcdc0566000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007fff9b222580
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
---[ end trace ]---
----------------
Code disassembly (best guess):
   0:	49 89 c0             	mov    %rax,%r8
   3:	49 c1 e8 03          	shr    $0x3,%r8
   7:	41 0f b6 14 10       	movzbl (%r8,%rdx,1),%edx
   c:	49 89 f8             	mov    %rdi,%r8
   f:	41 83 e0 07          	and    $0x7,%r8d
  13:	44 38 c6             	cmp    %r8b,%sil
  16:	41 0f 9e c0          	setle  %r8b
  1a:	40 84 f6             	test   %sil,%sil
  1d:	40 0f 95 c6          	setne  %sil
  21:	41 84 f0             	test   %sil,%r8b
  24:	0f 85 a7 07 00 00    	jne    0x7d1
* 2a:	83 e0 07             	and    $0x7,%eax <-- trapping instruction
  2d:	38 c2                	cmp    %al,%dl
  2f:	40 0f 9e c6          	setle  %sil
  33:	84 d2                	test   %dl,%dl
  35:	0f 95 c0             	setne  %al
  38:	40 84 c6             	test   %al,%sil
  3b:	0f                   	.byte 0xf
  3c:	85                   	.byte 0x85
  3d:	90                   	nop
  3e:	07                   	(bad)