BUG: stack guard page was hit in corrupted (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e1b86e7f5cbb Merge branch 'android12-5.10' into `android12..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=15d96e55700000
kernel config: https://syzkaller.appspot.com/x/.config?x=35d59e0f6d92b6d1
dashboard link: https://syzkaller.appspot.com/bug?extid=1c1229d92224b6466681
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110b08de700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126e0695700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1c1229...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000c0ffd8 (stack is ffffc90000c10000..ffffc90000c17fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 378 Comm: syz-executor156 Not tainted 5.10.102-syzkaller-00171-ge1b86e7f5cbb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000c0ffe0 EFLAGS: 00010282
RAX: 11b8775d7cc49700 RBX: 1ffff9200018201a RCX: 0000000000000000
RDX: ffff8881067d93c0 RSI: ffffc90000c100c0 RDI: ffffffff815bee70
RBP: ffffc90000c10070 R08: dffffc0000000000 R09: ffffc90000c100c0
R10: fffff5200018201b R11: 0000000000000000 R12: ffff8881067d93c0
R13: ffffffff815bee70 R14: ffffc90000c100c0 R15: 0000000000000000
FS: 00007f9ddbaed700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000c0ffd8 CR3: 000000011d382000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 1d3e9d042063b74a ]---
RIP: 0010:arch_stack_walk+0x6a/0x140 arch/x86/kernel/stacktrace.c:18
Code: 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 a8 00 00 00 00 48 c7 45 a0 00 00 00 00 48 c7 45 98 00 00 00 00 48 c7 45 90 00 00 00 00 <48> c7 45 88 00 00 00 00 48 c7 45 80 00 00 00 00 48 c7 85 78 ff ff
RSP: 0018:ffffc90000c0ffe0 EFLAGS: 00010282
RAX: 11b8775d7cc49700 RBX: 1ffff9200018201a RCX: 0000000000000000
RDX: ffff8881067d93c0 RSI: ffffc90000c100c0 RDI: ffffffff815bee70
RBP: ffffc90000c10070 R08: dffffc0000000000 R09: ffffc90000c100c0
R10: fffff5200018201b R11: 0000000000000000 R12: ffff8881067d93c0
R13: ffffffff815bee70 R14: ffffc90000c100c0 R15: 0000000000000000
FS: 00007f9ddbaed700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000c0ffd8 CR3: 000000011d382000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 48 c7 45 b0 00 00 00 movq $0x0,-0x50(%rbp)
9: 00
a: 48 c7 45 a8 00 00 00 movq $0x0,-0x58(%rbp)
11: 00
12: 48 c7 45 a0 00 00 00 movq $0x0,-0x60(%rbp)
19: 00
1a: 48 c7 45 98 00 00 00 movq $0x0,-0x68(%rbp)
21: 00
22: 48 c7 45 90 00 00 00 movq $0x0,-0x70(%rbp)
29: 00
* 2a: 48 c7 45 88 00 00 00 movq $0x0,-0x78(%rbp) <-- trapping instruction
31: 00
32: 48 c7 45 80 00 00 00 movq $0x0,-0x80(%rbp)
39: 00
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 85 78 ff test %edi,-0x1(%rax)
3f: ff .byte 0xff


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz dup: BUG: stack guard page was hit in file_open

--
Thanks,
Tadeusz