BUG: stack guard page was hit in corrupted (7)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e1b86e7f5cbb Merge branch 'android12-5.10' into `android12..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=16001ee5700000
kernel config: https://syzkaller.appspot.com/x/.config?x=35d59e0f6d92b6d1
dashboard link: https://syzkaller.appspot.com/bug?extid=22c6c55d598e5b0b86ee
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f6da61700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10842729700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+22c6c5...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000bdffd8 (stack is ffffc90000be0000..ffffc90000be7fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 365 Comm: syz-executor274 Not tainted 5.10.102-syzkaller-00171-ge1b86e7f5cbb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000bdffe0 EFLAGS: 00010282
RAX: 88e760bda6027000 RBX: 1ffff9200017c01a RCX: 0000000000000000
RDX: ffff88811d724f00 RSI: ffffc90000be00c0 RDI: ffffffff815bee70
RBP: ffffc90000be0070 R08: dffffc0000000000 R09: ffffc90000be00c0
R10: fffff5200017c01b R11: 0000000000000000 R12: ffff88811d724f00
R13: ffffffff815bee70 R14: ffffc90000be00c0 R15: 0000000000000000
FS: 00005555556ab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bdffd8 CR3: 000000011d2f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace c86b945a58c40e64 ]---
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000bdffe0 EFLAGS: 00010282
RAX: 88e760bda6027000 RBX: 1ffff9200017c01a RCX: 0000000000000000
RDX: ffff88811d724f00 RSI: ffffc90000be00c0 RDI: ffffffff815bee70
RBP: ffffc90000be0070 R08: dffffc0000000000 R09: ffffc90000be00c0
R10: fffff5200017c01b R11: 0000000000000000 R12: ffff88811d724f00
R13: ffffffff815bee70 R14: ffffc90000be00c0 R15: 0000000000000000
FS: 00005555556ab300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bdffd8 CR3: 000000011d2f8000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 c7 45 b0 00 00 00 movq $0x0,-0x50(%rbp)
9: 00
a: 48 c7 45 a8 00 00 00 movq $0x0,-0x58(%rbp)
11: 00
12: 48 c7 45 a0 00 00 00 movq $0x0,-0x60(%rbp)
19: 00
1a: 48 c7 45 98 00 00 00 movq $0x0,-0x68(%rbp)
21: 00
22: 48 c7 45 90 00 00 00 movq $0x0,-0x70(%rbp)
29: 00
* 2a: 48 c7 45 88 00 00 00 movq $0x0,-0x78(%rbp) <-- trapping instruction
31: 00
32: 48 c7 45 80 00 00 00 movq $0x0,-0x80(%rbp)
39: 00
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 85 78 ff test %edi,-0x1(%rax)
3f: ff .byte 0xff


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz dup: BUG: stack guard page was hit in file_open

--
Thanks,
Tadeusz