BUG: corrupted list in event_sched

BUG: corrupted list in event_sched_out
Status: moderation: reported on 2020/08/29 17:48
Reported-by: syzbot+d0eb1c22917d46d65d55@syzkaller.appspotmail.com
First crash: 34d, last: 34d

Sample crash report:

list_del corruption. next->prev should be ffff8880a1628020, but was 0000000000000000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:54!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1 Comm: systemd Not tainted 5.9.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid.cold+0x48/0x55 lib/list_debug.c:54
Code: e8 41 8b be fd 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 20 1b 94 88 e8 2d 8b be fd 0f 0b 48 89 ee 48 c7 c7 e0 1b 94 88 e8 1c 8b be fd <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55
RSP: 0000:ffffc90000c7fd00 EFLAGS: 00010082
RAX: 0000000000000054 RBX: ffff8880a1628000 RCX: 0000000000000000
RDX: ffff8880a95d6040 RSI: ffffffff815dafc7 RDI: fffff5200018ff92
RBP: ffff8880a1628020 R08: 0000000000000054 R09: ffff8880ae6318e7
R10: 0000000000000000 R11: 1ffffffff184265c R12: ffff8880ae63b0e8
R13: ffff888000110020 R14: ffff8880a16280a8 R15: ffff8880a1628020
FS:  00007fe53f0be500(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cfec CR3: 000000009cd02000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:132 [inline]
 list_del_init include/linux/list.h:204 [inline]
 event_sched_out+0x132/0xef0 kernel/events/core.c:2249
 group_sched_out.part.0+0x110/0x3f0 kernel/events/core.c:2287
 group_sched_out kernel/events/core.c:2282 [inline]
 ctx_sched_out+0x915/0xc20 kernel/events/core.c:3237
 cpu_ctx_sched_out kernel/events/core.c:3538 [inline]
 ctx_resched+0x2f2/0x390 kernel/events/core.c:2722
 __perf_install_in_context+0x285/0xa10 kernel/events/core.c:2794
 remote_function kernel/events/core.c:88 [inline]
 remote_function+0x115/0x1a0 kernel/events/core.c:68
 flush_smp_call_function_queue+0x1da/0x600 kernel/smp.c:271
 __sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline]
 sysvec_call_function_single+0x4c/0xf0 arch/x86/kernel/smp.c:243
 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:589
RIP: 0033:0x7fe53ed8e9f4
Code: 0f 45 c6 52 50 ff 74 24 10 41 55 e9 c2 fd ff ff e8 51 65 f3 ff 90 48 89 f8 48 8d 3d 9f aa 03 00 b9 05 00 00 00 48 89 c6 f3 a6 <75> 0b 48 89 c2 48 83 c2 05 48 0f 45 c2 48 8d 3d 98 c6 05 00 48 89
RSP: 002b:00007fff879386d8 EFLAGS: 00000206
RAX: 000055b641b60070 RBX: 000055b641b5cea0 RCX: 0000000000000004
RDX: 00007fe53edc3fa0 RSI: 000055b641b60071 RDI: 00007fe53edc948a
RBP: 00007fff87938750 R08: 000055b641b63945 R09: 0000000000000000
R10: 00007fe53d6cec40 R11: 0000000000000007 R12: 00007fff87938700
R13: 00007fff879386f8 R14: 0000000000000000 R15: 000055b641b508c0
Modules linked in:
---[ end trace 16ae5a4e80ebfb85 ]---
RIP: 0010:__list_del_entry_valid.cold+0x48/0x55 lib/list_debug.c:54
Code: e8 41 8b be fd 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 20 1b 94 88 e8 2d 8b be fd 0f 0b 48 89 ee 48 c7 c7 e0 1b 94 88 e8 1c 8b be fd <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55
RSP: 0000:ffffc90000c7fd00 EFLAGS: 00010082
RAX: 0000000000000054 RBX: ffff8880a1628000 RCX: 0000000000000000
RDX: ffff8880a95d6040 RSI: ffffffff815dafc7 RDI: fffff5200018ff92
RBP: ffff8880a1628020 R08: 0000000000000054 R09: ffff8880ae6318e7
R10: 0000000000000000 R11: 1ffffffff184265c R12: ffff8880ae63b0e8
R13: ffff888000110020 R14: ffff8880a16280a8 R15: ffff8880a1628020
FS:  00007fe53f0be500(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cfec CR3: 000000009cd02000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Maintainers
ci-upstream-kasan-gce-selinux-root	2020/08/25 17:44	upstream	6a9dc5fd	344da168	.config	log	report				acme@kernel.org, alexander.shishkin@linux.intel.com, andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, jolsa@redhat.com, kafai@fb.com, kpsingh@chromium.org, linux-kernel@vger.kernel.org, mark.rutland@arm.com, mingo@redhat.com, namhyung@kernel.org, netdev@vger.kernel.org, peterz@infradead.org, songliubraving@fb.com, yhs@fb.com