general protection fault in aio_run_iocb

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: b95a8c04 ANDROID: uid_sys_stats: Copy task_struct comm fie..
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=11376085400000
kernel config: https://syzkaller.appspot.com/x/.config?x=5a797996000a8421
dashboard link: https://syzkaller.appspot.com/bug?extid=6ee37f162e8b8c846483
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6ee37f...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 28024 Comm: syz-executor1 Not tainted 4.4.167+ #4
task: ffff8801c1090000 task.stack: ffff8801a9388000
RIP: 0010:[<ffffffff81579404>] [<ffffffff81579404>] file_end_write
include/linux/fs.h:2555 [inline]
RIP: 0010:[<ffffffff81579404>] [<ffffffff81579404>]
aio_run_iocb+0x544/0x700 fs/aio.c:1478
RSP: 0018:ffff8801a938fba0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 1ffff10035271f7a RCX: ffffc900027c8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8801c1091060
RBP: ffff8801a938fd78 R08: ffffea0002dadae0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800b6bb6c80
R13: fffffffffffffdef R14: 0000000000000000 R15: ffff8800ba9a8c20
FS: 00007f4b73ff5700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000930000 CR3: 00000001d4c90000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
00000002c10908c8 ffffffff81549e20 0000000100000000 ffff8801a938fc90
00000000ffffff47 0000000020000000 0000000041b58ab3 ffffffff82c529c0
ffffffff81578ec0 ffff880100000001 0000000000000000 ffffffff82c4bd48
Call Trace:
[<ffffffff8157d817>] io_submit_one fs/aio.c:1577 [inline]
[<ffffffff8157d817>] do_io_submit+0x5b7/0xe50 fs/aio.c:1635
[<ffffffff8157e0d7>] SYSC_io_submit fs/aio.c:1660 [inline]
[<ffffffff8157e0d7>] SyS_io_submit+0x27/0x30 fs/aio.c:1657
[<ffffffff82715ee1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: ea 03 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 7d 01 00 00 48
b8 00 00 00 00 00 fc ff df 4d 8b 76 20 4c 89 f2 48 c1 ea 03 <0f> b6 04 02
84 c0 74 08 3c 01 0f 8e 4b 01 00 00 41 0f b7 06 66
RIP [<ffffffff81579404>] file_end_write include/linux/fs.h:2555 [inline]
RIP [<ffffffff81579404>] aio_run_iocb+0x544/0x700 fs/aio.c:1478
RSP <ffff8801a938fba0>
---[ end trace a0bbd2814b922eab ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.