BUG: stack guard page was hit in corrupted (20)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 414e6c8e941c ANDROID: fix up abi issue with struct snd_pcm..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1428e2df700000
kernel config: https://syzkaller.appspot.com/x/.config?x=19b81eb0d2d939d9
dashboard link: https://syzkaller.appspot.com/bug?extid=fb5a8762dfbd438901e1
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1159d3e4f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103383e4f00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fb5a87...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90004d97f78 (stack is ffffc90004d98000..ffffc90004d9ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 1991 Comm: syz-executor381 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:_raw_spin_lock_irqsave+0x3b/0x210 kernel/locking/spinlock.c:158
Code: 48 81 ec a0 00 00 00 49 89 fd 65 48 8b 04 25 28 00 00 00 48 89 84 24 80 00 00 00 49 bf 00 00 00 00 00 fc ff df 4c 8d 64 24 50 <48> c7 44 24 20 b3 8a b5 41 48 c7 44 24 28 fe 57 b9 85 48 c7 44 24
RSP: 0018:ffffc90004d97f80 EFLAGS: 00010082
RAX: c614d962a2783f00 RBX: ffff8881067e93c0 RCX: ffffffff86c33803
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff8881067e9bfc
RBP: ffffc90004d98050 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520009b301d R11: 1ffff920009b301c R12: ffffc90004d97fd0
R13: ffff8881067e9bfc R14: dffffc0000000000 R15: dffffc0000000000
FS: 00007f16425f4700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90004d97f78 CR3: 000000011b19b000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 534550b850635050 ]---
RIP: 0010:_raw_spin_lock_irqsave+0x3b/0x210 kernel/locking/spinlock.c:158
Code: 48 81 ec a0 00 00 00 49 89 fd 65 48 8b 04 25 28 00 00 00 48 89 84 24 80 00 00 00 49 bf 00 00 00 00 00 fc ff df 4c 8d 64 24 50 <48> c7 44 24 20 b3 8a b5 41 48 c7 44 24 28 fe 57 b9 85 48 c7 44 24
RSP: 0018:ffffc90004d97f80 EFLAGS: 00010082
RAX: c614d962a2783f00 RBX: ffff8881067e93c0 RCX: ffffffff86c33803
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff8881067e9bfc
RBP: ffffc90004d98050 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520009b301d R11: 1ffff920009b301c R12: ffffc90004d97fd0
R13: ffff8881067e9bfc R14: dffffc0000000000 R15: dffffc0000000000
FS: 00007f16425f4700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90004d97f78 CR3: 000000011b19b000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 81 ec a0 00 00 00 sub $0xa0,%rsp
7: 49 89 fd mov %rdi,%r13
a: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
11: 00 00
13: 48 89 84 24 80 00 00 mov %rax,0x80(%rsp)
1a: 00
1b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
22: fc ff df
25: 4c 8d 64 24 50 lea 0x50(%rsp),%r12
* 2a: 48 c7 44 24 20 b3 8a movq $0x41b58ab3,0x20(%rsp) <-- trapping instruction
31: b5 41
33: 48 c7 44 24 28 fe 57 movq $0xffffffff85b957fe,0x28(%rsp)
3a: b9 85
3c: 48 rex.W
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 24 .byte 0x24


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz dup: BUG: stack guard page was hit in file_open

--
Thanks,
Tadeusz