BUG: stack guard page was hit in corrupted (13)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9a559b886861 Merge branch 'android12-5.10' into `android12..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=11ff7ef9700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c75d1e9921386ae5
dashboard link: https://syzkaller.appspot.com/bug?extid=7657b4d5d50aa5af6dd1
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f88ddb700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=109c7675700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7657b4...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000c1ffd8 (stack is ffffc90000c20000..ffffc90000c27fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 382 Comm: syz-executor259 Not tainted 5.10.107-syzkaller-00620-g9a559b886861 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000c1ffe0 EFLAGS: 00010282
RAX: 751d04b293ae2600 RBX: 1ffff9200018401a RCX: 0000000000000000
RDX: ffff888106f9e2c0 RSI: ffffc90000c200c0 RDI: ffffffff815bf690
RBP: ffffc90000c20070 R08: dffffc0000000000 R09: ffffc90000c200c0
R10: fffff5200018401b R11: 0000000000000000 R12: ffff888106f9e2c0
R13: ffffffff815bf690 R14: ffffc90000c200c0 R15: 0000000000000000
FS: 00007fa96eef1700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000c1ffd8 CR3: 00000001079f9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 314ba220ccb3407a ]---
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000c1ffe0 EFLAGS: 00010282
RAX: 751d04b293ae2600 RBX: 1ffff9200018401a RCX: 0000000000000000
RDX: ffff888106f9e2c0 RSI: ffffc90000c200c0 RDI: ffffffff815bf690
RBP: ffffc90000c20070 R08: dffffc0000000000 R09: ffffc90000c200c0
R10: fffff5200018401b R11: 0000000000000000 R12: ffff888106f9e2c0
R13: ffffffff815bf690 R14: ffffc90000c200c0 R15: 0000000000000000
FS: 00007fa96eef1700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000c1ffd8 CR3: 00000001079f9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 c7 45 b0 00 00 00 movq $0x0,-0x50(%rbp)
9: 00
a: 48 c7 45 a8 00 00 00 movq $0x0,-0x58(%rbp)
11: 00
12: 48 c7 45 a0 00 00 00 movq $0x0,-0x60(%rbp)
19: 00
1a: 48 c7 45 98 00 00 00 movq $0x0,-0x68(%rbp)
21: 00
22: 48 c7 45 90 00 00 00 movq $0x0,-0x70(%rbp)
29: 00
* 2a: 48 c7 45 88 00 00 00 movq $0x0,-0x78(%rbp) <-- trapping instruction
31: 00
32: 48 c7 45 80 00 00 00 movq $0x0,-0x80(%rbp)
39: 00
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 85 78 ff test %edi,-0x1(%rax)
3f: ff .byte 0xff


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz dup: BUG: stack guard page was hit in file_open

--
Thanks,
Tadeusz