bisecting fixing commit since c1141b3aab36eb0d9b2bcae4aff69e77d0554386
building syzkaller on 3de7aabbb79a6c2267f5d7ee8a8aaa83f63305b7
testing commit c1141b3aab36eb0d9b2bcae4aff69e77d0554386 with gcc (GCC) 8.1.0
kernel signature: 159d050f8491c01db4747484661f646c075ff02975f49c3dd25cb165b9e66fb0
all runs: crashed: KASAN: stack-out-of-bounds Read in update_stack_state
testing current HEAD b850307b279cbd12ab8c654d1a3dfe55319cc475
testing commit b850307b279cbd12ab8c654d1a3dfe55319cc475 with gcc (GCC) 8.1.0
kernel signature: 52790821fdcd8f4c4cebf33c009873feb7259fcdfe6d4b89d22b9ef34046cc99
all runs: crashed: KASAN: stack-out-of-bounds Read in update_stack_state
revisions tested: 2, total time: 24m25.163853786s (build: 17m22.656195089s, test: 6m10.339921872s)
the crash still happens on HEAD
commit msg: Linux 4.14.184
crash: KASAN: stack-out-of-bounds Read in update_stack_state
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
8021q: adding VLAN 0 to HW filter on device batadv0
==================================================================
BUG: KASAN: stack-out-of-bounds in __read_once_size include/linux/compiler.h:183 [inline]
BUG: KASAN: stack-out-of-bounds in update_stack_state+0x561/0x5d0 arch/x86/kernel/unwind_frame.c:270
Read of size 8 at addr ffff8880829f71b8 by task syz-executor.0/7564

CPU: 0 PID: 7564 Comm: syz-executor.0 Not tainted 4.14.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xf7/0x13b lib/dump_stack.c:58
 print_address_description.cold.7+0x9/0x1c9 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report.cold.8+0x11a/0x2d3 mm/kasan/report.c:409
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 __read_once_size include/linux/compiler.h:183 [inline]
 update_stack_state+0x561/0x5d0 arch/x86/kernel/unwind_frame.c:270
 __unwind_start+0x189/0x410 arch/x86/kernel/unwind_frame.c:423
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 perf_callchain_kernel+0x23d/0x540 arch/x86/events/core.c:2342
 get_perf_callchain+0x2c8/0x7d0 kernel/events/callchain.c:217
 perf_callchain+0x125/0x170 kernel/events/callchain.c:190
 perf_prepare_sample+0xd1a/0x13c0 kernel/events/core.c:6157
 __perf_event_output kernel/events/core.c:6273 [inline]
 perf_event_output_forward+0xdd/0x1d0 kernel/events/core.c:6291
 __perf_event_overflow+0x107/0x300 kernel/events/core.c:7536
 perf_swevent_overflow+0x165/0x210 kernel/events/core.c:7612
 perf_swevent_event+0x1f5/0x2f0 kernel/events/core.c:7645
 do_perf_sw_event kernel/events/core.c:7753 [inline]
 ___perf_sw_event+0x26b/0x3f0 kernel/events/core.c:7784
 perf_sw_event_sched include/linux/perf_event.h:1063 [inline]
 perf_event_task_sched_out include/linux/perf_event.h:1101 [inline]
 prepare_task_switch kernel/sched/core.c:2601 [inline]
 context_switch kernel/sched/core.c:2773 [inline]
 __schedule+0xf9c/0x1d20 kernel/sched/core.c:3384
 schedule+0x7f/0x1b0 kernel/sched/core.c:3428
 freezable_schedule include/linux/freezer.h:172 [inline]
 futex_wait_queue_me+0x2d5/0x580 kernel/futex.c:2722
 futex_wait+0x253/0x520 kernel/futex.c:2837
 do_futex+0x591/0x17f0 kernel/futex.c:3920
 SYSC_futex kernel/futex.c:3980 [inline]
 SyS_futex+0xf1/0x250 kernel/futex.c:3948
 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45aff9
RSP: 002b:00007f9ffc67ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 000000000075bf28 RCX: 000000000045aff9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c
R13: 00007ffe19e2c66f R14: 00007f9ffc67f9c0 R15: 000000000075bf2c

The buggy address belongs to the page:
page:ffffea00020a7dc0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0xfffe0000000000()
raw: 00fffe0000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880829f7080: f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3
 ffff8880829f7100: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880829f7180: f1 f1 f1 f1 00 00 00 f2 f3 f3 f3 f3 00 00 00 00
                                        ^
 ffff8880829f7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880829f7280: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f3 f3 f3 f3
==================================================================