[v5.15] BUG: unable to handle kernel paging request in stack_depot_save

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 68efe5a6c16a Linux 5.15.197
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=106c059a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e6ed99963d6ee1d
dashboard link: https://syzkaller.appspot.com/bug?extid=2a2352a9ea0fe7c43525
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/900f9b9bd850/disk-68efe5a6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1e089a5019a6/vmlinux-68efe5a6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b319f477b907/bzImage-68efe5a6.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2a2352...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: 000000502444c750
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4199 Comm: kworker/u5:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: hci1 hci_power_on
RIP: 0010:find_stack lib/stackdepot.c:208 [inline]
RIP: 0010:stack_depot_save+0x164/0x440 lib/stackdepot.c:280
Code: 18 29 cd 4c 8b 2d 74 56 41 12 41 89 ee 41 81 e6 ff ff 0f 00 4f 8b 7c f5 00 4d 85 ff 74 58 89 d9 eb 08 4d 8b 3f 4d 85 ff 74 4c <41> 39 6f 08 75 f2 41 39 5f 0c 75 ec 31 f6 4c 8b 04 f7 4d 3b 44 f7
RSP: 0018:ffffc9000335f5f0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000000b
RDX: 0000000000000a20 RSI: 00000000a7c09adf RDI: ffffc9000335f650
RBP: 0000000088bb068c R08: 000000008fe9394b R09: 0000000000000001
R10: 0000000061e6f96c R11: 00000000161db7c9 R12: ffff88806007a228
R13: ffff88823b000000 R14: 00000000000b068c R15: 000000502444c748
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000502444c750 CR3: 0000000054905000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kasan_save_stack mm/kasan/common.c:40 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0xb3/0xd0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:254 [inline]
slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
slab_alloc_node mm/slub.c:3225 [inline]
kmem_cache_alloc_node+0x12d/0x2d0 mm/slub.c:3261
__alloc_skb+0xf4/0x750 net/core/skbuff.c:415
alloc_skb include/linux/skbuff.h:1162 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:392 [inline]
hci_si_event net/bluetooth/hci_sock.c:726 [inline]
hci_sock_dev_event+0xf5/0x560 net/bluetooth/hci_sock.c:768
hci_dev_do_open+0xea1/0x1270 net/bluetooth/hci_core.c:1606
hci_power_on+0x1c1/0x610 net/bluetooth/hci_core.c:2265
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
CR2: 000000502444c750
---[ end trace 7211b2f8442b7d8d ]---
RIP: 0010:find_stack lib/stackdepot.c:208 [inline]
RIP: 0010:stack_depot_save+0x164/0x440 lib/stackdepot.c:280
Code: 18 29 cd 4c 8b 2d 74 56 41 12 41 89 ee 41 81 e6 ff ff 0f 00 4f 8b 7c f5 00 4d 85 ff 74 58 89 d9 eb 08 4d 8b 3f 4d 85 ff 74 4c <41> 39 6f 08 75 f2 41 39 5f 0c 75 ec 31 f6 4c 8b 04 f7 4d 3b 44 f7
RSP: 0018:ffffc9000335f5f0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 000000000000000b RCX: 000000000000000b
RDX: 0000000000000a20 RSI: 00000000a7c09adf RDI: ffffc9000335f650
RBP: 0000000088bb068c R08: 000000008fe9394b R09: 0000000000000001
R10: 0000000061e6f96c R11: 00000000161db7c9 R12: ffff88806007a228
R13: ffff88823b000000 R14: 00000000000b068c R15: 000000502444c748
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000502444c750 CR3: 0000000054905000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 18 29 sbb %ch,(%rcx)
2: cd 4c int $0x4c
4: 8b 2d 74 56 41 12 mov 0x12415674(%rip),%ebp # 0x1241567e
a: 41 89 ee mov %ebp,%r14d
d: 41 81 e6 ff ff 0f 00 and $0xfffff,%r14d
14: 4f 8b 7c f5 00 mov 0x0(%r13,%r14,8),%r15
19: 4d 85 ff test %r15,%r15
1c: 74 58 je 0x76
1e: 89 d9 mov %ebx,%ecx
20: eb 08 jmp 0x2a
22: 4d 8b 3f mov (%r15),%r15
25: 4d 85 ff test %r15,%r15
28: 74 4c je 0x76
* 2a: 41 39 6f 08 cmp %ebp,0x8(%r15) <-- trapping instruction
2e: 75 f2 jne 0x22
30: 41 39 5f 0c cmp %ebx,0xc(%r15)
34: 75 ec jne 0x22
36: 31 f6 xor %esi,%esi
38: 4c 8b 04 f7 mov (%rdi,%rsi,8),%r8
3c: 4d rex.WRB
3d: 3b .byte 0x3b
3e: 44 rex.R
3f: f7 .byte 0xf7


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup