BUG: stack guard page was hit in corrupted (19)

Status: closed as dup on 2022/04/08 17:06
Reported-by: syzbot+67a4553d622787cb9f53@syzkaller.appspotmail.com
First crash: 1643d, last: 1643d
▶ ▼ Duplicate of
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported
BUG: stack guard page was hit in file_open -1 syz, C error 25 1678d 1756d
▶ ▼ Similar bugs (24)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: stack guard page was hit in corrupted (14) -1 syz, C error 2 1659d 1659d 0/2 closed as dup on 2022/03/24 14:58
android-5-10 BUG: stack guard page was hit in corrupted (16) -1 syz, C error 2 1653d 1656d 0/2 closed as dup on 2022/03/30 17:23
android-5-10 BUG: stack guard page was hit in corrupted (9) -1 syz, C error 1 1667d 1667d 0/2 closed as dup on 2022/03/16 16:28
android-5-10 BUG: stack guard page was hit in corrupted (13) -1 syz, C error 1 1661d 1661d 0/2 closed as dup on 2022/03/22 16:23
android-5-10 BUG: stack guard page was hit in corrupted (17) -1 syz, C error 3 1650d 1650d 0/2 closed as dup on 2022/04/04 16:48
android-6-1 BUG: stack guard page was hit in corrupted origin:lts -1 syz, C 2 496d 791d 0/2 auto-obsoleted due to no activity on 2025/09/07 08:00
android-5-10 BUG: stack guard page was hit in corrupted (5) -1 syz, C error 3 1672d 1672d 0/2 closed as dup on 2022/03/11 15:58
android-5-10 BUG: stack guard page was hit in corrupted (6) -1 syz, C error 1 1671d 1671d 0/2 closed as dup on 2022/03/11 22:51
android-5-10 BUG: stack guard page was hit in corrupted (20) -1 syz, C error 1 1641d 1641d 0/2 closed as dup on 2022/04/11 14:20
android-5-10 BUG: stack guard page was hit in corrupted (21) -1 syz, C error 3 1627d 1628d 0/2 closed as dup on 2022/05/04 16:12
upstream BUG: stack guard page was hit in corrupted prio:normal -1 C 1 39d 39d 0/29 closed as invalid on 2026/10/06 02:14
android-5-10 BUG: stack guard page was hit in corrupted (8) -1 syz, C 1 1669d 1669d 0/2 closed as dup on 2022/03/14 15:44
android-5-10 BUG: stack guard page was hit in corrupted (4) -1 syz, C error 1 1674d 1674d 0/2 closed as dup on 2022/03/09 18:22
android-5-10 BUG: stack guard page was hit in corrupted (7) -1 syz, C error 1 1671d 1671d 0/2 closed as dup on 2022/03/13 15:49
android-5-10 BUG: stack guard page was hit in corrupted (18) -1 syz, C error 1 1646d 1646d 0/2 closed as dup on 2022/04/05 20:24
android-5-10 BUG: stack guard page was hit in corrupted -1 syz, C error 3 1702d 1738d 0/2 closed as invalid on 2022/02/28 16:10
android-5-10 BUG: stack guard page was hit in corrupted (10) -1 syz, C error 1 1666d 1666d 0/2 closed as dup on 2022/03/17 16:45
android-5-10 BUG: stack guard page was hit in corrupted (15) -1 syz, C error 1 1658d 1658d 0/2 closed as dup on 2022/03/25 16:30
android-5-10 BUG: stack guard page was hit in corrupted (12) -1 syz, C done 2 1662d 1664d 0/2 closed as dup on 2022/03/21 14:57
android-5-10 BUG: stack guard page was hit in corrupted (2) -1 syz, C error 2 1679d 1681d 0/2 closed as dup on 2022/03/02 15:48
android-5-10 BUG: stack guard page was hit in corrupted (3) -1 syz, C error 1 1674d 1674d 0/2 closed as dup on 2022/03/09 15:36
android-5-10 BUG: stack guard page was hit in corrupted (11) -1 syz, C error 2 1664d 1664d 0/2 closed as dup on 2022/03/18 21:48
android-5-10 BUG: stack guard page was hit in corrupted (22) -1 syz done done 1 1612d 1612d 0/2 auto-closed as invalid on 2022/08/31 02:51
android-5-10 BUG: stack guard page was hit in corrupted (23) -1 syz error error 1 1213d 1213d 0/2 auto-obsoleted due to no activity on 2023/09/30 03:13

Sample crash report:
BUG: stack guard page was hit at ffffc90003187f98 (stack is ffffc90003188000..ffffc9000318ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 796 Comm: syz-executor304 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__update_load_avg_se+0x40/0xb90 kernel/sched/pelt.c:372
Code: f7 49 89 fe 48 be 00 00 00 00 00 fc ff df 48 8d 7a 38 48 89 f8 48 c1 e8 03 8a 04 30 84 c0 0f 85 38 08 00 00 8b 43 38 45 31 ed <89> 45 a8 85 c0 41 0f 95 c4 48 89 5d b0 48 81 c3 58 01 00 00 48 89
RSP: 0018:ffffc90003187fa0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810c856340 RCX: dffffc0000000000
RDX: ffff88810c856340 RSI: dffffc0000000000 RDI: ffff88810c856378
RBP: ffffc90003188030 R08: 00000000000001c3 R09: fffffbfff0c5ebeb
R10: fffffbfff0c5ebeb R11: 1ffffffff0c5ebea R12: dffffc0000000000
R13: 0000000000000000 R14: 0000001122634f2b R15: ffff8881f7156000
FS:  0000555555cee3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003187f98 CR3: 000000010eae9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 7f3e83c1acb3b509 ]---
RIP: 0010:__update_load_avg_se+0x40/0xb90 kernel/sched/pelt.c:372
Code: f7 49 89 fe 48 be 00 00 00 00 00 fc ff df 48 8d 7a 38 48 89 f8 48 c1 e8 03 8a 04 30 84 c0 0f 85 38 08 00 00 8b 43 38 45 31 ed <89> 45 a8 85 c0 41 0f 95 c4 48 89 5d b0 48 81 c3 58 01 00 00 48 89
RSP: 0018:ffffc90003187fa0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810c856340 RCX: dffffc0000000000
RDX: ffff88810c856340 RSI: dffffc0000000000 RDI: ffff88810c856378
RBP: ffffc90003188030 R08: 00000000000001c3 R09: fffffbfff0c5ebeb
R10: fffffbfff0c5ebeb R11: 1ffffffff0c5ebea R12: dffffc0000000000
R13: 0000000000000000 R14: 0000001122634f2b R15: ffff8881f7156000
FS:  0000555555cee3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003187f98 CR3: 000000010eae9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	49 89 fe             	mov    %rdi,%r14
   3:	48 be 00 00 00 00 00 	movabs $0xdffffc0000000000,%rsi
   a:	fc ff df
   d:	48 8d 7a 38          	lea    0x38(%rdx),%rdi
  11:	48 89 f8             	mov    %rdi,%rax
  14:	48 c1 e8 03          	shr    $0x3,%rax
  18:	8a 04 30             	mov    (%rax,%rsi,1),%al
  1b:	84 c0                	test   %al,%al
  1d:	0f 85 38 08 00 00    	jne    0x85b
  23:	8b 43 38             	mov    0x38(%rbx),%eax
  26:	45 31 ed             	xor    %r13d,%r13d
* 29:	89 45 a8             	mov    %eax,-0x58(%rbp) <-- trapping instruction
  2c:	85 c0                	test   %eax,%eax
  2e:	41 0f 95 c4          	setne  %r12b
  32:	48 89 5d b0          	mov    %rbx,-0x50(%rbp)
  36:	48 81 c3 58 01 00 00 	add    $0x158,%rbx
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/08 16:37 android12-5.10-lts 414e6c8e941c c6ff3e05 .config console log report syz C ci2-android-5-10 BUG: stack guard page was hit in corrupted
* Struck through repros no longer work on HEAD.