list_del corruption. prev->next should be 00000000b881531b, but was           (null)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] SMP
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 30328 Comm: syz-executor3 Not tainted 4.15.0-rc3-next-20171214+ #67
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid+0x78/0x90 lib/list_debug.c:51
RSP: 0018:ffff88021fc03d78 EFLAGS: 00010096
RAX: 0000000000000054 RBX: ffff8801faf5e000 RCX: ffffffff8123dede
RDX: 0000000000000100 RSI: ffff88021fc136f8 RDI: ffff88021fc136f8
RBP: ffff88021fc03d78 R08: 0000000000000001 R09: 000000000000000c
R10: ffff88021fc03d10 R11: 000000000000000c R12: ffff880215105d80
R13: 0000000000000010 R14: ffff88021511cc50 R15: 0000000000000286
FS:  0000000000000000(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b9bc21000 CR3: 000000000301e004 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __list_del_entry include/linux/list.h:117 [inline]
 list_del_init include/linux/list.h:159 [inline]
 blk_queue_end_tag+0x4e/0x170 block/blk-tag.c:272
 blk_finish_request+0x168/0x210 block/blk-core.c:3045
 scsi_end_request+0x156/0x250 drivers/scsi/scsi_lib.c:702
 scsi_io_completion+0x306/0x7b0 drivers/scsi/scsi_lib.c:865
 scsi_finish_command+0x10c/0x130 drivers/scsi/scsi.c:248
 scsi_softirq_done+0x17a/0x190 drivers/scsi/scsi_lib.c:1649
 blk_done_softirq+0xcd/0x100 block/blk-softirq.c:37
 __do_softirq+0xcb/0x4f3 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0xd4/0xe0 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:540 [inline]
 do_IRQ+0x89/0x100 arch/x86/kernel/irq.c:241
 common_interrupt+0xa9/0xa9 arch/x86/entry/entry_64.S:695
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:lock_acquire+0xea/0x220 kernel/locking/lockdep.c:3917
RSP: 0018:ffffc90000daf9f8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffda
RAX: ffff8802156427c0 RBX: 0000000000000000 RCX: 000000003e58df22
RDX: 00000000270ef433 RSI: 0000000091a24ef6 RDI: 0000000000000286
RBP: ffffc90000dafa38 R08: 0000000000000001 R09: 0000000000000002
R10: ffffc90000daf9d8 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:244 [inline]
 rcu_read_lock include/linux/rcupdate.h:630 [inline]
 lock_page_memcg+0x33/0xf0 mm/memcontrol.c:1620
 page_remove_file_rmap mm/rmap.c:1213 [inline]
 page_remove_rmap+0x12e/0x4b0 mm/rmap.c:1298
 zap_pte_range mm/memory.c:1337 [inline]
 zap_pmd_range mm/memory.c:1441 [inline]
 zap_pud_range mm/memory.c:1470 [inline]
 zap_p4d_range mm/memory.c:1491 [inline]
 unmap_page_range+0x86f/0xed0 mm/memory.c:1512
 unmap_single_vma+0xbb/0x140 mm/memory.c:1557
 unmap_vmas+0x65/0xd0 mm/memory.c:1587
 exit_mmap+0xb0/0x1e0 mm/mmap.c:3020
 __mmput kernel/fork.c:966 [inline]
 mmput+0x82/0x190 kernel/fork.c:987
 exit_mm kernel/exit.c:544 [inline]
 do_exit+0x356/0x1050 kernel/exit.c:856
 do_group_exit+0x60/0x100 kernel/exit.c:972
 get_signal+0x36c/0xad0 kernel/signal.c:2337
 do_signal+0x23/0x670 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x13c/0x160 arch/x86/entry/common.c:161
 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
 syscall_return_slowpath+0x1b4/0x1e0 arch/x86/entry/common.c:264
 entry_SYSCALL_64_fastpath+0x94/0x96
RIP: 0033:0x452a09
RSP: 002b:00007fc44dd28ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000071bf80 RCX: 0000000000452a09
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000071bf80
RBP: 000000000071bf80 R08: 00000000000002ab R09: 000000000071bf58
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000a2f7ff R14: 00007fc44dd299c0 R15: 0000000000000002
Code: 82 e8 85 dd ae ff 0f 0b 48 89 fe 48 c7 c7 08 34 e8 82 e8 74 dd ae ff 0f 0b 48 89 f2 48 89 fe 48 c7 c7 40 34 e8 82 e8 60 dd ae ff <0f> 0b 48 c7 c7 80 34 e8 82 e8 52 dd ae ff 0f 0b 90 90 90 90 90 
RIP: __list_del_entry_valid+0x78/0x90 lib/list_debug.c:51 RSP: ffff88021fc03d78
---[ end trace cfa251eeab40bfc5 ]---