BUG: stack guard page was hit in corrupted (19)

Status: closed as dup on 2022/04/08 17:06
Reported-by: syzbot+67a4553d622787cb9f53@syzkaller.appspotmail.com
First crash: 1590d, last: 1590d
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
BUG: stack guard page was hit in file_open -1 syz, C error 25 1624d 1703d
▶ ▼ Similar bugs (23)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: stack guard page was hit in corrupted (14) -1 syz, C error 2 1606d 1606d 0/2 closed as dup on 2022/03/24 14:58
android-5-10 BUG: stack guard page was hit in corrupted (16) -1 syz, C error 2 1600d 1602d 0/2 closed as dup on 2022/03/30 17:23
android-5-10 BUG: stack guard page was hit in corrupted (9) -1 syz, C error 1 1614d 1614d 0/2 closed as dup on 2022/03/16 16:28
android-5-10 BUG: stack guard page was hit in corrupted (13) -1 syz, C error 1 1608d 1608d 0/2 closed as dup on 2022/03/22 16:23
android-5-10 BUG: stack guard page was hit in corrupted (17) -1 syz, C error 3 1597d 1597d 0/2 closed as dup on 2022/04/04 16:48
android-6-1 BUG: stack guard page was hit in corrupted origin:lts -1 syz, C 2 443d 738d 0/2 auto-obsoleted due to no activity on 2025/09/07 08:00
android-5-10 BUG: stack guard page was hit in corrupted (5) -1 syz, C error 3 1619d 1619d 0/2 closed as dup on 2022/03/11 15:58
android-5-10 BUG: stack guard page was hit in corrupted (6) -1 syz, C error 1 1618d 1618d 0/2 closed as dup on 2022/03/11 22:51
android-5-10 BUG: stack guard page was hit in corrupted (20) -1 syz, C error 1 1588d 1588d 0/2 closed as dup on 2022/04/11 14:20
android-5-10 BUG: stack guard page was hit in corrupted (21) -1 syz, C error 3 1574d 1575d 0/2 closed as dup on 2022/05/04 16:12
android-5-10 BUG: stack guard page was hit in corrupted (8) -1 syz, C 1 1615d 1615d 0/2 closed as dup on 2022/03/14 15:44
android-5-10 BUG: stack guard page was hit in corrupted (4) -1 syz, C error 1 1620d 1620d 0/2 closed as dup on 2022/03/09 18:22
android-5-10 BUG: stack guard page was hit in corrupted (7) -1 syz, C error 1 1618d 1618d 0/2 closed as dup on 2022/03/13 15:49
android-5-10 BUG: stack guard page was hit in corrupted (18) -1 syz, C error 1 1593d 1593d 0/2 closed as dup on 2022/04/05 20:24
android-5-10 BUG: stack guard page was hit in corrupted -1 syz, C error 3 1649d 1685d 0/2 closed as invalid on 2022/02/28 16:10
android-5-10 BUG: stack guard page was hit in corrupted (10) -1 syz, C error 1 1612d 1612d 0/2 closed as dup on 2022/03/17 16:45
android-5-10 BUG: stack guard page was hit in corrupted (15) -1 syz, C error 1 1605d 1605d 0/2 closed as dup on 2022/03/25 16:30
android-5-10 BUG: stack guard page was hit in corrupted (12) -1 syz, C done 2 1609d 1611d 0/2 closed as dup on 2022/03/21 14:57
android-5-10 BUG: stack guard page was hit in corrupted (2) -1 syz, C error 2 1626d 1628d 0/2 closed as dup on 2022/03/02 15:48
android-5-10 BUG: stack guard page was hit in corrupted (3) -1 syz, C error 1 1621d 1621d 0/2 closed as dup on 2022/03/09 15:36
android-5-10 BUG: stack guard page was hit in corrupted (11) -1 syz, C error 2 1611d 1611d 0/2 closed as dup on 2022/03/18 21:48
android-5-10 BUG: stack guard page was hit in corrupted (22) -1 syz done done 1 1559d 1559d 0/2 auto-closed as invalid on 2022/08/31 02:51
android-5-10 BUG: stack guard page was hit in corrupted (23) -1 syz error error 1 1160d 1160d 0/2 auto-obsoleted due to no activity on 2023/09/30 03:13

Sample crash report:
BUG: stack guard page was hit at ffffc90003187f98 (stack is ffffc90003188000..ffffc9000318ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 796 Comm: syz-executor304 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__update_load_avg_se+0x40/0xb90 kernel/sched/pelt.c:372
Code: f7 49 89 fe 48 be 00 00 00 00 00 fc ff df 48 8d 7a 38 48 89 f8 48 c1 e8 03 8a 04 30 84 c0 0f 85 38 08 00 00 8b 43 38 45 31 ed <89> 45 a8 85 c0 41 0f 95 c4 48 89 5d b0 48 81 c3 58 01 00 00 48 89
RSP: 0018:ffffc90003187fa0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810c856340 RCX: dffffc0000000000
RDX: ffff88810c856340 RSI: dffffc0000000000 RDI: ffff88810c856378
RBP: ffffc90003188030 R08: 00000000000001c3 R09: fffffbfff0c5ebeb
R10: fffffbfff0c5ebeb R11: 1ffffffff0c5ebea R12: dffffc0000000000
R13: 0000000000000000 R14: 0000001122634f2b R15: ffff8881f7156000
FS:  0000555555cee3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003187f98 CR3: 000000010eae9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 7f3e83c1acb3b509 ]---
RIP: 0010:__update_load_avg_se+0x40/0xb90 kernel/sched/pelt.c:372
Code: f7 49 89 fe 48 be 00 00 00 00 00 fc ff df 48 8d 7a 38 48 89 f8 48 c1 e8 03 8a 04 30 84 c0 0f 85 38 08 00 00 8b 43 38 45 31 ed <89> 45 a8 85 c0 41 0f 95 c4 48 89 5d b0 48 81 c3 58 01 00 00 48 89
RSP: 0018:ffffc90003187fa0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810c856340 RCX: dffffc0000000000
RDX: ffff88810c856340 RSI: dffffc0000000000 RDI: ffff88810c856378
RBP: ffffc90003188030 R08: 00000000000001c3 R09: fffffbfff0c5ebeb
R10: fffffbfff0c5ebeb R11: 1ffffffff0c5ebea R12: dffffc0000000000
R13: 0000000000000000 R14: 0000001122634f2b R15: ffff8881f7156000
FS:  0000555555cee3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003187f98 CR3: 000000010eae9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	49 89 fe             	mov    %rdi,%r14
   3:	48 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%rsi
   a:	fc ff df
   d:	48 8d 7a 38          	lea    0x38(%rdx),%rdi
  11:	48 89 f8             	mov    %rdi,%rax
  14:	48 c1 e8 03          	shr    $0x3,%rax
  18:	8a 04 30             	mov    (%rax,%rsi,1),%al
  1b:	84 c0                	test   %al,%al
  1d:	0f 85 38 08 00 00    	jne    0x85b
  23:	8b 43 38             	mov    0x38(%rbx),%eax
  26:	45 31 ed             	xor    %r13d,%r13d
* 29:	89 45 a8             	mov    %eax,-0x58(%rbp) <-- trapping instruction
  2c:	85 c0                	test   %eax,%eax
  2e:	41 0f 95 c4          	setne  %r12b
  32:	48 89 5d b0          	mov    %rbx,-0x50(%rbp)
  36:	48 81 c3 58 01 00 00 	add    $0x158,%rbx
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/08 16:37 android12-5.10-lts 414e6c8e941c c6ff3e05 .config console log report syz C ci2-android-5-10 BUG: stack guard page was hit in corrupted
* Struck through repros no longer work on HEAD.