general protection fault in remove_waiter

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: bc1cf222 ANDROID: sdcardfs: Add option to not link obb
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=174d11a3400000
kernel config: https://syzkaller.appspot.com/x/.config?x=e9e5117807e1d57d
dashboard link: https://syzkaller.appspot.com/bug?extid=3f086a8f0653901d7221
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1617b08b400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3f086a...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2766 Comm: syz-executor0 Not tainted 4.4.165+ #2
task: ffff8801d043c740 task.stack: ffff8801d0448000
RIP: 0010:[<ffffffff8120a2df>] [<ffffffff8120a2df>] rt_mutex_top_waiter
kernel/locking/rtmutex_common.h:53 [inline]
RIP: 0010:[<ffffffff8120a2df>] [<ffffffff8120a2df>]
remove_waiter+0x4f/0x2e0 kernel/locking/rtmutex.c:1082
RSP: 0018:ffff8801d044f940 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801d8579410 RCX: 0000000000000001
RDX: 0000000000000007 RSI: ffff8801d040f9e0 RDI: 0000000000000038
RBP: ffff8801d044f978 R08: ffff8801d043d078 R09: ffffffff839fa120
R10: 0000000000015920 R11: ffffffff831a2db8 R12: 00000000ffffffdd
R13: ffff8801d040f9e0 R14: ffff8801d8579450 R15: 0000000000000000
FS: 00007f8f45feb700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8f45feadb8 CR3: 00000001d1985000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8801d040fa98 ffff8801d040f9e0 ffff8801d8579410 00000000ffffffdd
ffff8801d8579458 ffff8801d040f9e0 dffffc0000000000 ffff8801d044f9a8
ffffffff8120abdd ffff8801d040fa60 ffff8801cd867a60 ffff8801d040fa98
Call Trace:
[<ffffffff8120abdd>] rt_mutex_start_proxy_lock+0xbd/0x120
kernel/locking/rtmutex.c:1685
[<ffffffff81290aa2>] futex_requeue+0xbb2/0x16b0 kernel/futex.c:1944
[<ffffffff812933e4>] do_futex+0x204/0x1a00 kernel/futex.c:3248
[<ffffffff81294e22>] SYSC_futex kernel/futex.c:3286 [inline]
[<ffffffff81294e22>] SyS_futex+0x242/0x360 kernel/futex.c:3254
[<ffffffff827140e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 53 48 89 fb 48 83 ec 10 80 3c 02 00 0f 85 2d 02 00 00 48 b8 00 00 00
00 00 fc ff df 4c 8b 7b 40 49 8d 7f 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00
0f 85 17 02 00 00 49 3b 5f 38 0f 85 f0 01 00 00 48
RIP [<ffffffff8120a2df>] rt_mutex_top_waiter
kernel/locking/rtmutex_common.h:53 [inline]
RIP [<ffffffff8120a2df>] remove_waiter+0x4f/0x2e0
kernel/locking/rtmutex.c:1082
RSP <ffff8801d044f940>
---[ end trace ed510e7d65b825b7 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches