KASAN: stack-out-of-bounds Read in unwind_get_return_address

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fe0eb27a Merge 4.9.153 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=11a86f18c00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7ce88e237ade06f0
dashboard link: https://syzkaller.appspot.com/bug?extid=f2e5d42cf37627b85bed
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=152e9d17400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17675b90c00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+f2e5d4...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x96/0xa0
arch/x86/kernel/unwind_frame.c:17
Read of size 8 at addr ffff8801ce32fa68 by task syz-executor602/2411

CPU: 1 PID: 2411 Comm: syz-executor602 Not tainted 4.9.153+ #18
ffff8801cda177e8 ffffffff81b47491 0000000000000000 ffffea000738cbc0
ffff8801ce32fa68 0000000000000008 ffffffff810ab576 ffff8801cda17820
ffffffff81502615 0000000000000000 ffff8801ce32fa68 ffff8801ce32fa68
Call Trace:
[<ffffffff81b47491>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81b47491>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81502615>] print_address_description+0x6f/0x238
mm/kasan/report.c:256
[<ffffffff8150286a>] kasan_report_error mm/kasan/report.c:355 [inline]
[<ffffffff8150286a>] kasan_report mm/kasan/report.c:412 [inline]
[<ffffffff8150286a>] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:397
[<ffffffff814f4a64>] __asan_report_load8_noabort+0x14/0x20
mm/kasan/report.c:433
[<ffffffff810ab576>] unwind_get_return_address+0x96/0xa0
arch/x86/kernel/unwind_frame.c:17
[<ffffffff8107732a>] __save_stack_trace+0x8a/0xf0
arch/x86/kernel/stacktrace.c:43
[<ffffffff810773f2>] save_stack_trace_tsk arch/x86/kernel/stacktrace.c:71
[inline]
[<ffffffff810773f2>] save_stack_trace_tsk+0x42/0x60
arch/x86/kernel/stacktrace.c:66
[<ffffffff8166a962>] proc_pid_stack+0x1a2/0x290 fs/proc/base.c:483
[<ffffffff81662f16>] proc_single_show+0xf6/0x160 fs/proc/base.c:785
[<ffffffff81582edd>] seq_read+0x4cd/0x1250 fs/seq_file.c:240
[<ffffffff8150bbcc>] do_loop_readv_writev.part.0+0xcc/0x2c0
fs/read_write.c:718
[<ffffffff8150d2d6>] do_loop_readv_writev fs/read_write.c:707 [inline]
[<ffffffff8150d2d6>] do_readv_writev+0x556/0x7a0 fs/read_write.c:873
[<ffffffff8150d5a6>] vfs_readv+0x86/0xc0 fs/read_write.c:897
[<ffffffff8150d9db>] do_preadv+0x19b/0x240 fs/read_write.c:974
[<ffffffff81510ec1>] SYSC_preadv fs/read_write.c:1024 [inline]
[<ffffffff81510ec1>] SyS_preadv+0x31/0x40 fs/read_write.c:1019
[<ffffffff810056bd>] do_syscall_64+0x1ad/0x570 arch/x86/entry/common.c:285
[<ffffffff82816293>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the page:
page:ffffea000738cbc0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801ce32f900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801ce32f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8801ce32fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8801ce32fa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801ce32fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches