BUG: stack guard page was hit in corrupted

Status: closed as invalid on 2022/02/28 16:10
Reported-by: syzbot+09d4683476b4adca2035@syzkaller.appspotmail.com
Fix commit: 6f915dd2af92 ANDROID: incremental-fs: remove index and incomplete dir on umount
First crash: 1693d, last: 1658d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (23)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: stack guard page was hit in corrupted (14) -1 syz, C error 2 1615d 1615d 0/2 closed as dup on 2022/03/24 14:58
android-5-10 BUG: stack guard page was hit in corrupted (16) -1 syz, C error 2 1609d 1611d 0/2 closed as dup on 2022/03/30 17:23
android-5-10 BUG: stack guard page was hit in corrupted (9) -1 syz, C error 1 1623d 1623d 0/2 closed as dup on 2022/03/16 16:28
android-5-10 BUG: stack guard page was hit in corrupted (13) -1 syz, C error 1 1616d 1616d 0/2 closed as dup on 2022/03/22 16:23
android-5-10 BUG: stack guard page was hit in corrupted (17) -1 syz, C error 3 1605d 1606d 0/2 closed as dup on 2022/04/04 16:48
android-6-1 BUG: stack guard page was hit in corrupted origin:lts -1 syz, C 2 451d 747d 0/2 auto-obsoleted due to no activity on 2025/09/07 08:00
android-5-10 BUG: stack guard page was hit in corrupted (5) -1 syz, C error 3 1627d 1627d 0/2 closed as dup on 2022/03/11 15:58
android-5-10 BUG: stack guard page was hit in corrupted (19) -1 syz, C 1 1599d 1599d 0/2 closed as dup on 2022/04/08 17:06
android-5-10 BUG: stack guard page was hit in corrupted (6) -1 syz, C error 1 1627d 1627d 0/2 closed as dup on 2022/03/11 22:51
android-5-10 BUG: stack guard page was hit in corrupted (20) -1 syz, C error 1 1596d 1596d 0/2 closed as dup on 2022/04/11 14:20
android-5-10 BUG: stack guard page was hit in corrupted (21) -1 syz, C error 3 1582d 1583d 0/2 closed as dup on 2022/05/04 16:12
android-5-10 BUG: stack guard page was hit in corrupted (8) -1 syz, C 1 1624d 1624d 0/2 closed as dup on 2022/03/14 15:44
android-5-10 BUG: stack guard page was hit in corrupted (4) -1 syz, C error 1 1629d 1629d 0/2 closed as dup on 2022/03/09 18:22
android-5-10 BUG: stack guard page was hit in corrupted (7) -1 syz, C error 1 1626d 1626d 0/2 closed as dup on 2022/03/13 15:49
android-5-10 BUG: stack guard page was hit in corrupted (18) -1 syz, C error 1 1602d 1602d 0/2 closed as dup on 2022/04/05 20:24
android-5-10 BUG: stack guard page was hit in corrupted (10) -1 syz, C error 1 1621d 1621d 0/2 closed as dup on 2022/03/17 16:45
android-5-10 BUG: stack guard page was hit in corrupted (15) -1 syz, C error 1 1614d 1614d 0/2 closed as dup on 2022/03/25 16:30
android-5-10 BUG: stack guard page was hit in corrupted (12) -1 syz, C done 2 1618d 1619d 0/2 closed as dup on 2022/03/21 14:57
android-5-10 BUG: stack guard page was hit in corrupted (2) -1 syz, C error 2 1635d 1636d 0/2 closed as dup on 2022/03/02 15:48
android-5-10 BUG: stack guard page was hit in corrupted (3) -1 syz, C error 1 1629d 1629d 0/2 closed as dup on 2022/03/09 15:36
android-5-10 BUG: stack guard page was hit in corrupted (11) -1 syz, C error 2 1620d 1620d 0/2 closed as dup on 2022/03/18 21:48
android-5-10 BUG: stack guard page was hit in corrupted (22) -1 syz done done 1 1568d 1568d 0/2 auto-closed as invalid on 2022/08/31 02:51
android-5-10 BUG: stack guard page was hit in corrupted (23) -1 syz error error 1 1169d 1169d 0/2 auto-obsoleted due to no activity on 2023/09/30 03:13
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2022/01/26 18:49 10m tadeusz.struk@linaro.org https://android.googlesource.com/kernel/common fd4c6594f5ce no crash
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2022/02/03 12:07 22m bisect fix android12-5.10-lts OK (0) job log log

Sample crash report:
BUG: stack guard page was hit at ffffc900009a7f18 (stack is ffffc900009a8000..ffffc900009affff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 369 Comm: syz-executor455 Not tainted 5.10.96-syzkaller-00678-ge33a5b611c98 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:rmqueue+0x1b/0x2480 mm/page_alloc.c:3571
Code: d2 e8 49 0f ff ff b0 01 e9 f9 fe ff ff 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 01 00 00 45 89 cc <44> 89 44 24 3c 89 d3 49 89 f7 65 48 8b 04 25 28 00 00 00 48 89 84
RSP: 0018:ffffc900009a7f20 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffff86bc53c0 RCX: 0000000000012cd0
RDX: 0000000000000000 RSI: ffffffff86bc53c0 RDI: ffffffff86bc53c0
RBP: ffffc900009a80e8 R08: 0000000000000901 R09: 0000000000000002
R10: fffffbfff0d78b3c R11: 0000000000000000 R12: 0000000000000002
R13: dffffc0000000000 R14: ffffffff86bc53c0 R15: ffffc900009a825c
FS:  00007fd6764c0700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7f18 CR3: 000000011c766000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
Modules linked in:
---[ end trace 3adc8cc4f6efa096 ]---
RIP: 0010:rmqueue+0x1b/0x2480 mm/page_alloc.c:3571
Code: d2 e8 49 0f ff ff b0 01 e9 f9 fe ff ff 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 01 00 00 45 89 cc <44> 89 44 24 3c 89 d3 49 89 f7 65 48 8b 04 25 28 00 00 00 48 89 84
RSP: 0018:ffffc900009a7f20 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffff86bc53c0 RCX: 0000000000012cd0
RDX: 0000000000000000 RSI: ffffffff86bc53c0 RDI: ffffffff86bc53c0
RBP: ffffc900009a80e8 R08: 0000000000000901 R09: 0000000000000002
R10: fffffbfff0d78b3c R11: 0000000000000000 R12: 0000000000000002
R13: dffffc0000000000 R14: ffffffff86bc53c0 R15: ffffc900009a825c
FS:  00007fd6764c0700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009a7f18 CR3: 000000011c766000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	d2 e8                	shr    %cl,%al
   2:	49 0f ff ff          	ud0    %r15,%rdi
   6:	b0 01                	mov    $0x1,%al
   8:	e9 f9 fe ff ff       	jmpq   0xffffff06
   d:	66 90                	xchg   %ax,%ax
   f:	55                   	push   %rbp
  10:	48 89 e5             	mov    %rsp,%rbp
  13:	41 57                	push   %r15
  15:	41 56                	push   %r14
  17:	41 55                	push   %r13
  19:	41 54                	push   %r12
  1b:	53                   	push   %rbx
  1c:	48 83 e4 e0          	and    $0xffffffffffffffe0,%rsp
  20:	48 81 ec a0 01 00 00 	sub    $0x1a0,%rsp
  27:	45 89 cc             	mov    %r9d,%r12d
* 2a:	44 89 44 24 3c       	mov    %r8d,0x3c(%rsp) <-- trapping instruction
  2f:	89 d3                	mov    %edx,%ebx
  31:	49 89 f7             	mov    %rsi,%r15
  34:	65 48 8b 04 25 28 00 	mov    %gs:0x28,%rax
  3b:	00 00
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89
  3f:	84                   	.byte 0x84

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/02/08 18:01 android12-5.10-lts e33a5b611c98 0b33604d .config console log report syz C ci2-android-5-10 BUG: stack guard page was hit in corrupted
2022/02/08 04:52 android12-5.10-lts a9839858b556 a7dab638 .config console log report syz C ci2-android-5-10 BUG: stack guard page was hit in corrupted
2022/01/04 12:07 android12-5.10-lts 9b28b48fb343 7f723fbe .config console log report syz C ci2-android-5-10 BUG: stack guard page was hit in corrupted
* Struck through repros no longer work on HEAD.