[Android 5.4] BUG: corrupted list in __dentry_kill

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0e0b8c9892c8 UPSTREAM: hid: bigben_probe(): validate repor..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=136d697dc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=89d7298c04c40d1f
dashboard link: https://syzkaller.appspot.com/bug?extid=dd261f7b8f5879d63ea2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a84a4c0bff8d/disk-0e0b8c98.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6ef0fb4e4c84/vmlinux-0e0b8c98.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0ff30c6f72d0/bzImage-0e0b8c98.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dd261f...@syzkaller.appspotmail.com

do_sys_open+0x39c/0x810 fs/open.c:1113
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
---[ end trace 7481dcc65bdc2e04 ]---
list_del corruption. prev->next should be ffff8881a134cf70, but was ffff8881a6111f80
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 17294 Comm: syz-executor.4 Tainted: G W 5.4.233-syzkaller-00029-g0e0b8c9892c8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 4c 89 f6 e8 2c 5c 0f 02 0f 0b 48 c7 c7 60 bd d9 84 4c 89 f6 e8 1b 5c 0f 02 0f 0b 48 c7 c7 c0 bd d9 84 4c 89 f6 e8 0a 5c 0f 02 <0f> 0b 48 c7 c7 20 be d9 84 4c 89 f6 e8 f9 5b 0f 02 0f 0b 66 0f 1f
RSP: 0018:ffff88819ad97748 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881a6111f80 RCX: 6a49f2a823ab1f00
RDX: ffffc90004767000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffff8881a134cef0 R08: ffffffff814ca4f6 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881a134cf38 R14: ffff8881a134cf70 R15: ffff8881a6111f80
FS: 00007fd594f8b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff25000 CR3: 00000001eb553000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:131 [inline]
dentry_unlist fs/dcache.c:522 [inline]
__dentry_kill+0x242/0x630 fs/dcache.c:575
dentry_kill+0xb8/0x280 fs/dcache.c:673
dput+0x154/0x2f0 fs/dcache.c:859
ovl_destroy_inode+0x3c/0xe0 fs/overlayfs/super.c:211
destroy_inode fs/inode.c:281 [inline]
evict+0x59d/0x6a0 fs/inode.c:592
ovl_create_object+0x256/0x2f0 fs/overlayfs/dir.c:634
lookup_open fs/namei.c:3309 [inline]
do_last fs/namei.c:3401 [inline]
path_openat+0x181b/0x3480 fs/namei.c:3614
do_filp_open+0x20b/0x450 fs/namei.c:3644
do_sys_open+0x39c/0x810 fs/open.c:1113
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Modules linked in:
---[ end trace 7481dcc65bdc2e05 ]---
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 4c 89 f6 e8 2c 5c 0f 02 0f 0b 48 c7 c7 60 bd d9 84 4c 89 f6 e8 1b 5c 0f 02 0f 0b 48 c7 c7 c0 bd d9 84 4c 89 f6 e8 0a 5c 0f 02 <0f> 0b 48 c7 c7 20 be d9 84 4c 89 f6 e8 f9 5b 0f 02 0f 0b 66 0f 1f
RSP: 0018:ffff88819ad97748 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff8881a6111f80 RCX: 6a49f2a823ab1f00
RDX: ffffc90004767000 RSI: 000000000003ffff RDI: 0000000000040000
RBP: ffff8881a134cef0 R08: ffffffff814ca4f6 R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881a134cf38 R14: ffff8881a134cf70 R15: ffff8881a6111f80
FS: 00007fd594f8b700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff25000 CR3: 00000001eb553000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.