BUG: TASK stack guard page was hit at ffffc9001039fff8 (stack is ffffc900103a0000..ffffc900103a8000)
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 2206 Comm: syz.1.575 Not tainted syzkaller #0 471281939cd7bfdfff4c6b6074d5d68627c837ba
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:pvclock_read_begin arch/x86/kernel/pvclock.c:119 [inline]
RIP: 0010:__pvclock_clocksource_read arch/x86/kernel/pvclock.c:76 [inline]
RIP: 0010:pvclock_clocksource_read_nowd+0xc/0x100 arch/x86/kernel/pvclock.c:120
Code: f4 5d c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 55 48 89 e5 41 57 41 56 <41> 55 41 54 53 50 44 8b 3f eb 31 41 89 de 80 fb 40 73 59 44 89 f1
RSP: 0018:ffffc900103a0000 EFLAGS: 00010007
RAX: ffffffff813c5640 RBX: dffffc0000000000 RCX: 0000000000080000
RDX: ffffc90001601000 RSI: 0000000000006e8b RDI: ffffffff88bbc040
RBP: ffffc900103a0010 R08: ffffffff87ed4687 R09: 1ffffffff0fda8d0
R10: dffffc0000000000 R11: fffffbfff0fda8d1 R12: ffff8881f6f50720
R13: dffffc0000000000 R14: ffffc900103a00c0 R15: 1ffff92002074014
FS:  00007f6d344b86c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9001039fff8 CR3: 0000000113a30000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 kvm_sched_clock_read+0x15/0x30 arch/x86/kernel/kvmclock.c:91
 paravirt_sched_clock arch/x86/include/asm/paravirt.h:35 [inline]
 sched_clock_noinstr+0xd/0x30 arch/x86/kernel/tsc.c:267
 sched_clock+0x1c/0x60 arch/x86/kernel/tsc.c:284
 sched_clock_cpu+0x75/0x400 kernel/sched/clock.c:394
 update_tg_load_avg kernel/sched/fair.c:4294 [inline]
 update_load_avg+0x10f5/0x1990 kernel/sched/fair.c:4956
 dequeue_entity+0x4dd/0x1380 kernel/sched/fair.c:5692
 dequeue_entities+0x1d7/0x1400 kernel/sched/fair.c:7313
 pick_next_entity kernel/sched/fair.c:5796 [inline]
 pick_task_fair+0x2ea/0x4e0 kernel/sched/fair.c:9141
 pick_next_task_fair+0xb1/0x770 kernel/sched/fair.c:9163
 __pick_next_task kernel/sched/core.c:6687 [inline]
 pick_next_task kernel/sched/core.c:7207 [inline]
 __schedule+0x753/0x2100 kernel/sched/core.c:7820
 preempt_schedule_irq+0xab/0x110 kernel/sched/core.c:8220
 raw_irqentry_exit_cond_resched+0x32/0x40 kernel/entry/common.c:311
 irqentry_exit+0x4a/0x60 kernel/entry/common.c:354
 sysvec_apic_timer_interrupt+0x50/0x90 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:is_last_frame arch/x86/kernel/unwind_frame.c:-1 [inline]
RIP: 0010:is_last_task_frame arch/x86/kernel/unwind_frame.c:156 [inline]
RIP: 0010:unwind_next_frame+0xc4/0x750 arch/x86/kernel/unwind_frame.c:276
Code: 89 f8 48 c1 e8 03 48 89 45 b0 80 3c 10 00 74 12 4c 89 ff e8 1e af 9b 00 48 ba 00 00 00 00 00 fc ff df 4c 89 6d c0 4c 89 7d b8 <4c> 89 75 d0 4c 8b 7b 38 4c 8d 73 28 4c 89 f0 48 c1 e8 03 48 89 45
RSP: 0018:ffffc900103a0848 EFLAGS: 00000246
RAX: 1ffff92002074120 RBX: ffffc900103a08c8 RCX: 00000000103a0900
RDX: dffffc0000000000 RSI: ffffffff844a3cd0 RDI: ffffc900103a08c8
RBP: ffffc900103a08b8 R08: ffffc900103a0990 R09: ffffc900103a0988
R10: 0000000000000006 R11: ffffffff8175ee80 R12: 0000000000000000
R13: 1ffff92002074124 R14: ffffc900103a0920 R15: ffffc900103a0900
 arch_stack_walk+0x138/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:49 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
 kasan_save_free_info+0x4a/0x60 mm/kasan/generic.c:579
 poison_slab_object mm/kasan/common.c:249 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2445 [inline]
 slab_free mm/slub.c:4714 [inline]
 kfree+0x158/0x440 mm/slub.c:4875
 krealloc_noprof+0xfa/0x130 mm/slab_common.c:-1
 <kernel::alloc::allocator::ReallocFunc>::call rust/kernel/alloc/allocator.rs:102 [inline]
 <kernel::alloc::allocator::Kmalloc as kernel::alloc::Allocator>::realloc rust/kernel/alloc/allocator.rs:141 [inline]
 <kernel::alloc::allocator::Kmalloc as kernel::alloc::Allocator>::free rust/kernel/alloc.rs:214 [inline]
 <kernel::alloc::kbox::Box<core::mem::maybe_uninit::MaybeUninit<kernel::rbtree::Node<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>, kernel::alloc::allocator::Kmalloc> as core::ops::drop::Drop>::drop rust/kernel/alloc/kbox.rs:492 [inline]
 core::ptr::drop_in_place::<kernel::alloc::kbox::Box<core::mem::maybe_uninit::MaybeUninit<kernel::rbtree::Node<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>, kernel::alloc::allocator::Kmalloc>>+0x114/0x360 usr/local/rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:804
 <kernel::alloc::kbox::Box<kernel::rbtree::Node<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>, kernel::alloc::allocator::Kmalloc>>::into_inner rust/kernel/alloc/kbox.rs:321 [inline]
 <kernel::rbtree::OccupiedEntry<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>::remove rust/kernel/rbtree.rs:1251 [inline]
 <<kernel::rbtree::OccupiedEntry<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>::remove as core::ops::function::FnOnce<(kernel::rbtree::OccupiedEntry<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>,)>>::call_once usr/local/rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250 [inline]
 <core::option::Option<kernel::rbtree::OccupiedEntry<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>>::map::<kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>, <kernel::rbtree::OccupiedEntry<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>::remove> usr/local/rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/option.rs:1159 [inline]
 <kernel::rbtree::RBTree<u32, kernel::list::arc::ListArc<rust_binder::process::NodeRefInfo, 15493408726748792400>>>::remove rust/kernel/rbtree.rs:410 [inline]
 <rust_binder::process::Process>::update_ref+0x16c0/0x2660 drivers/android/binder/process.rs:975
 <rust_binder::allocation::AllocationView>::cleanup_object drivers/android/binder/allocation.rs:453 [inline]
 <rust_binder::allocation::Allocation as core::ops::drop::Drop>::drop+0x1715/0x5dd0 drivers/android/binder/allocation.rs:263
 core::ptr::drop_in_place::<rust_binder::allocation::Allocation>+0x1a/0xf0 usr/local/rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:804
 core::ptr::drop_in_place::<rust_binder::allocation::NewAllocation> usr/local/rustup/toolchains/1.91.1-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:804 [inline]
 <rust_binder::thread::Thread>::copy_transaction_data+0x7c54/0x9460 drivers/android/binder/thread.rs:1240
 <rust_binder::transaction::Transaction>::new+0x3f8/0x29c0 drivers/android/binder/transaction.rs:150
 <rust_binder::thread::Thread>::transaction_inner drivers/android/binder/thread.rs:1440 [inline]
 <rust_binder::thread::Thread>::transaction+0x18f8/0x4380 drivers/android/binder/thread.rs:1393
 <rust_binder::thread::Thread>::write+0x1271/0xa690 drivers/android/binder/thread.rs:1568
 <rust_binder::thread::Thread>::write_read drivers/android/binder/thread.rs:1704 [inline]
 <rust_binder::process::Process>::ioctl_write_read drivers/android/binder/process.rs:1620 [inline]
 <rust_binder::process::Process>::ioctl drivers/android/binder/process.rs:1685 [inline]
 rust_binder::rust_binder_ioctl+0x1231/0x5d80 drivers/android/binder/rust_binder_main.rs:468
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x132/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f6d3359ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6d344b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6d33815fa0 RCX: 00007f6d3359ce59
RDX: 00002000000001c0 RSI: 00000000c0306201 RDI: 0000000000000004
RBP: 00007f6d33632e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6d33816038 R14: 00007f6d33815fa0 R15: 00007fffa54f5e38
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pvclock_read_begin arch/x86/kernel/pvclock.c:119 [inline]
RIP: 0010:__pvclock_clocksource_read arch/x86/kernel/pvclock.c:76 [inline]
RIP: 0010:pvclock_clocksource_read_nowd+0xc/0x100 arch/x86/kernel/pvclock.c:120
Code: f4 5d c3 cc cc cc cc cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 55 48 89 e5 41 57 41 56 <41> 55 41 54 53 50 44 8b 3f eb 31 41 89 de 80 fb 40 73 59 44 89 f1
RSP: 0018:ffffc900103a0000 EFLAGS: 00010007
RAX: ffffffff813c5640 RBX: dffffc0000000000 RCX: 0000000000080000
RDX: ffffc90001601000 RSI: 0000000000006e8b RDI: ffffffff88bbc040
RBP: ffffc900103a0010 R08: ffffffff87ed4687 R09: 1ffffffff0fda8d0
R10: dffffc0000000000 R11: fffffbfff0fda8d1 R12: ffff8881f6f50720
R13: dffffc0000000000 R14: ffffc900103a00c0 R15: 1ffff92002074014
FS:  00007f6d344b86c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9001039fff8 CR3: 0000000113a30000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	f4                   	hlt
   1:	5d                   	pop    %rbp
   2:	c3                   	ret
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	cc                   	int3
   a:	cc                   	int3
   b:	cc                   	int3
   c:	cc                   	int3
   d:	cc                   	int3
   e:	b8 00 00 00 00       	mov    $0x0,%eax
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	66 0f 1f 00          	nopw   (%rax)
  22:	55                   	push   %rbp
  23:	48 89 e5             	mov    %rsp,%rbp
  26:	41 57                	push   %r15
  28:	41 56                	push   %r14
* 2a:	41 55                	push   %r13 <-- trapping instruction
  2c:	41 54                	push   %r12
  2e:	53                   	push   %rbx
  2f:	50                   	push   %rax
  30:	44 8b 3f             	mov    (%rdi),%r15d
  33:	eb 31                	jmp    0x66
  35:	41 89 de             	mov    %ebx,%r14d
  38:	80 fb 40             	cmp    $0x40,%bl
  3b:	73 59                	jae    0x96
  3d:	44 89 f1             	mov    %r14d,%ecx