WARNING: refcount bug in css_task_iter

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	WARNING: refcount bug in css_task_iter_next cgroups				11	1774d	1778d	12/26	fixed on 2019/07/10 21:40
new mount options do not match the existing superblock, will be ignored
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 27929 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 27929 Comm: syz-executor.5 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:231
 __warn.cold+0x20/0x45 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:235
 exc_invalid_op+0x13/0x40 arch/x86/kernel/traps.c:255
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:542
RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Code: 07 31 ff 89 de e8 17 26 dc fd 84 db 0f 85 36 ff ff ff e8 ca 29 dc fd 48 c7 c7 a0 52 93 88 c6 05 03 5b 12 07 01 e8 19 6a ad fd <0f> 0b e9 17 ff ff ff e8 ab 29 dc fd 0f b6 1d e8 5a 12 07 31 ff 89
RSP: 0018:ffffc90019e178f0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815d4f87 RDI: fffff520033c2f10
RBP: 0000000000000002 R08: 0000000000000001 R09: ffff8880ae720fcb
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90019e179e0
R13: ffff8880001014b8 R14: ffff8880001003a0 R15: ffffc90019e17990
 refcount_add include/linux/refcount.h:204 [inline]
 refcount_inc include/linux/refcount.h:241 [inline]
 get_task_struct include/linux/sched/task.h:117 [inline]
 css_task_iter_next+0x24c/0x2d0 kernel/cgroup/cgroup.c:4561
 pidlist_array_load+0x175/0xa10 kernel/cgroup/cgroup-v1.c:349
 cgroup_pidlist_start+0x374/0x4b0 kernel/cgroup/cgroup-v1.c:418
 kernfs_seq_start+0xd7/0x260 fs/kernfs/file.c:117
 traverse.part.0+0x76/0x590 fs/seq_file.c:102
 traverse fs/seq_file.c:97 [inline]
 seq_read+0x824/0x1070 fs/seq_file.c:168
 kernfs_fop_read+0xe9/0x590 fs/kernfs/file.c:251
 do_loop_readv_writev fs/read_write.c:734 [inline]
 do_loop_readv_writev fs/read_write.c:721 [inline]
 do_iter_read+0x48e/0x650 fs/read_write.c:955
 vfs_readv+0xe5/0x150 fs/read_write.c:1073
 do_preadv fs/read_write.c:1165 [inline]
 __do_sys_preadv fs/read_write.c:1215 [inline]
 __se_sys_preadv fs/read_write.c:1210 [inline]
 __x64_sys_preadv+0x231/0x310 fs/read_write.c:1210
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45cba9
Code: Bad RIP value.
RSP: 002b:00007f9896aaac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00000000004fc3c0 RCX: 000000000045cba9
RDX: 0000000000000001 RSI: 00000000200009c0 RDI: 0000000000000006
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000000d4 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000089b R14: 00000000004cb8cc R15: 00007f9896aab6d4
Kernel Offset: disabled
Rebooting in 86400 seconds..