BUG: TASK stack guard page was hit at ffffc9000b687ff8 (stack is ffffc9000b688000..ffffc9000b690000) Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 1670 Comm: syz.4.389 Not tainted syzkaller #0 471281939cd7bfdfff4c6b6074d5d68627c837ba Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:check_region_inline mm/kasan/generic.c:171 [inline] RIP: 0010:kasan_check_range+0x1b/0x2b0 mm/kasan/generic.c:189 Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 b0 01 48 85 f6 0f 84 c0 01 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 <53> 4c 8d 04 37 49 39 f8 0f 82 29 02 00 00 49 89 f9 49 c1 e9 2f 41 RSP: 0018:ffffc9000b688000 EFLAGS: 00010002 RAX: 1ffffffff0fc9a01 RBX: ffffffff87e4dad0 RCX: ffffffff81d99d24 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff87e4dad0 RBP: ffffc9000b688020 R08: 0000000000000901 R09: 00000000000ba2e6 R10: 0000000000000002 R11: fffffbfff0fc9b51 R12: 000000000000260b R13: 0000000000000002 R14: 0000000000000003 R15: ffffffff87e4d480 FS: 00007f63c96226c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000b687ff8 CR3: 000000011c442000 CR4: 00000000003526b0 Call Trace: __kasan_check_read+0x15/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] atomic_long_read include/linux/atomic/atomic-instrumented.h:3188 [inline] zone_page_state include/linux/vmstat.h:214 [inline] __zone_watermark_unusable_free mm/page_alloc.c:3542 [inline] __zone_watermark_ok+0x134/0x630 mm/page_alloc.c:3569 zone_watermark_fast+0x1f7/0x3d0 mm/page_alloc.c:3684 get_page_from_freelist+0x429/0x4a20 mm/page_alloc.c:3891 __alloc_pages_noprof+0x35f/0x7e0 mm/page_alloc.c:5315 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_pages_noprof include/linux/gfp.h:313 [inline] stack_depot_save_flags+0x672/0x800 lib/stackdepot.c:627 stack_depot_save+0x12/0x20 lib/stackdepot.c:686 save_stack+0x133/0x240 mm/page_owner.c:175 __set_page_owner+0x8e/0x600 mm/page_owner.c:338 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1863 prep_new_page+0x2d/0x190 mm/page_alloc.c:1871 get_page_from_freelist+0x496e/0x4a20 mm/page_alloc.c:3948 __alloc_pages_noprof+0x35f/0x7e0 mm/page_alloc.c:5315 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_pages_noprof include/linux/gfp.h:313 [inline] stack_depot_save_flags+0x672/0x800 lib/stackdepot.c:627 kasan_save_stack mm/kasan/common.c:50 [inline] kasan_save_track+0x4f/0x80 mm/kasan/common.c:70 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565 poison_kmalloc_redzone mm/kasan/common.c:379 [inline] __kasan_kmalloc+0x96/0xb0 mm/kasan/common.c:396 kasan_kmalloc include/linux/kasan.h:261 [inline] __kmalloc_cache_noprof+0x23c/0x470 mm/slub.c:4426 kmalloc_noprof include/linux/slab.h:881 [inline] kzalloc_noprof include/linux/slab.h:1017 [inline] percpu_ref_init+0xde/0x4d0 lib/percpu-refcount.c:76 blkg_alloc+0xfe/0x930 block/blk-cgroup.c:308 blkg_create+0x257/0x1330 block/blk-cgroup.c:391 blkg_lookup_create block/blk-cgroup.c:508 [inline] blkg_tryget_closest block/blk-cgroup.c:2044 [inline] bio_associate_blkg_from_css+0x7cc/0xb10 block/blk-cgroup.c:2078 bio_associate_blkg+0x11e/0x150 block/blk-cgroup.c:2109 bio_init block/bio.c:265 [inline] bio_alloc_bioset+0xd6d/0x12c0 block/bio.c:581 bio_alloc include/linux/bio.h:375 [inline] do_mpage_readpage+0x12b2/0x1650 fs/mpage.c:297 mpage_readahead+0x2e5/0x560 fs/mpage.c:381 blkdev_readahead+0x20/0x30 block/fops.c:447 read_pages+0x19e/0x6b0 mm/readahead.c:173 page_cache_ra_unbounded+0xce6/0xf40 mm/readahead.c:330 do_page_cache_ra mm/readahead.c:360 [inline] page_cache_ra_order+0xe34/0x12d0 mm/readahead.c:581 do_sync_mmap_readahead+0x96a/0xf90 mm/filemap.c:3395 filemap_fault+0x687/0x1b40 mm/filemap.c:3546 __do_fault mm/memory.c:5009 [inline] do_read_fault mm/memory.c:5461 [inline] do_fault mm/memory.c:5595 [inline] do_pte_missing+0x360d/0x4410 mm/memory.c:4069 handle_pte_fault mm/memory.c:5940 [inline] __handle_mm_fault mm/memory.c:6083 [inline] handle_mm_fault+0x11b8/0x1bf0 mm/memory.c:6251 do_user_addr_fault+0x4c9/0x11e0 arch/x86/mm/fault.c:1387 handle_page_fault arch/x86/mm/fault.c:1479 [inline] exc_page_fault+0x58/0xc0 arch/x86/mm/fault.c:1534 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:rep_movs_alternative+0x30/0xa0 arch/x86/lib/copy_user_64.S:57 Code: f9 40 73 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 19 6b 03 00 66 0f 1f 84 00 00 00 00 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 RSP: 0018:ffffc9000b68a530 EFLAGS: 00050246 RAX: 00007ffffffff001 RBX: 0000000000000008 RCX: 0000000000000008 RDX: 0000000000000001 RSI: 0000200000000200 RDI: ffffc9000b68b070 RBP: ffffc9000b68a550 R08: ffffc9000b68b077 R09: 1ffff920016d160e R10: dffffc0000000000 R11: fffff520016d160f R12: 1ffff920016d1524 R13: 0000000000000001 R14: ffffc9000b68b070 R15: 0000200000000200 ::read:: rust/kernel/uaccess.rs:265 [inline] ::copy_transaction_data+0x3138/0x9460 drivers/android/binder/thread.rs:1176 ::new+0x3f8/0x29c0 drivers/android/binder/transaction.rs:150 ::oneway_transaction_inner drivers/android/binder/thread.rs:1516 [inline] ::transaction+0xa3e/0x4380 drivers/android/binder/thread.rs:1391 ::write+0x1271/0xa690 drivers/android/binder/thread.rs:1568 ::write_read drivers/android/binder/thread.rs:1704 [inline] ::ioctl_write_read drivers/android/binder/process.rs:1620 [inline] ::ioctl drivers/android/binder/process.rs:1685 [inline] rust_binder::rust_binder_ioctl+0x1231/0x5d80 drivers/android/binder/rust_binder_main.rs:468 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0x132/0x1b0 fs/ioctl.c:893 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f63c879ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f63c9622028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f63c8a15fa0 RCX: 00007f63c879ce59 RDX: 00002000000001c0 RSI: 00000000c0306201 RDI: 0000000000000004 RBP: 00007f63c8832d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f63c8a16038 R14: 00007f63c8a15fa0 R15: 00007ffd69239eb8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:check_region_inline mm/kasan/generic.c:171 [inline] RIP: 0010:kasan_check_range+0x1b/0x2b0 mm/kasan/generic.c:189 Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 b0 01 48 85 f6 0f 84 c0 01 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 <53> 4c 8d 04 37 49 39 f8 0f 82 29 02 00 00 49 89 f9 49 c1 e9 2f 41 RSP: 0018:ffffc9000b688000 EFLAGS: 00010002 RAX: 1ffffffff0fc9a01 RBX: ffffffff87e4dad0 RCX: ffffffff81d99d24 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff87e4dad0 RBP: ffffc9000b688020 R08: 0000000000000901 R09: 00000000000ba2e6 R10: 0000000000000002 R11: fffffbfff0fc9b51 R12: 000000000000260b R13: 0000000000000002 R14: 0000000000000003 R15: ffffffff87e4d480 FS: 00007f63c96226c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000b687ff8 CR3: 000000011c442000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 66 0f 1f 00 nopw (%rax) 13: b0 01 mov $0x1,%al 15: 48 85 f6 test %rsi,%rsi 18: 0f 84 c0 01 00 00 je 0x1de 1e: 55 push %rbp 1f: 48 89 e5 mov %rsp,%rbp 22: 41 57 push %r15 24: 41 56 push %r14 26: 41 55 push %r13 28: 41 54 push %r12 * 2a: 53 push %rbx <-- trapping instruction 2b: 4c 8d 04 37 lea (%rdi,%rsi,1),%r8 2f: 49 39 f8 cmp %rdi,%r8 32: 0f 82 29 02 00 00 jb 0x261 38: 49 89 f9 mov %rdi,%r9 3b: 49 c1 e9 2f shr $0x2f,%r9 3f: 41 rex.B