general protection fault in perf_tp_event

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fde6e0c6 Merge 5.4.11 into android-5.4
git tree: android-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=154d5a59e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c023850fbc26c909
dashboard link: https://syzkaller.appspot.com/bug?extid=a3cde546a49502261be7
compiler: Android (6032204 based on r370808) clang version 10.0.1
(https://android.googlesource.com/toolchain/llvm-project
6e765c10313d15c02ab29977a82938f66742c3a9)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a3cde5...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W
5.4.11-syzkaller-00384-gfde6e0c654c4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:perf_tp_event_match kernel/events/core.c:8689 [inline]
RIP: 0010:perf_tp_event+0x21f/0x990 kernel/events/core.c:8740
Code: 84 51 02 00 00 4c 89 3c 24 48 8b 44 24 18 4c 8d b0 88 00 00 00 66 0f
1f 44 00 00 49 8d 9c 24 d0 01 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 0f 85 c8 01 00 00 8b 1b 89 de 83 e6 01 31 ff
RSP: 0018:ffff8881dba096c0 EFLAGS: 00010007
RAX: 0000000000a5a039 RBX: 00000000052d01cd RCX: ffffffff81451e2b
RDX: ffffffff84614940 RSI: 00000000052d005d RDI: 0000000000000000
RBP: ffff8881dba099e0 R08: ffffffff81592647 R09: fffffbfff08c2929
R10: fffffbfff08c2929 R11: 0000000000000000 R12: 00000000052cfffd
R13: dffffc0000000000 R14: ffff8881dba2f0b8 R15: ffff8881dba09748
FS: 0000000000000000(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000b2a978 CR3: 00000001c79f7005 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
perf_trace_run_bpf_submit+0x117/0x1a0 kernel/events/core.c:8715
perf_trace_sched_wakeup_template+0x2b3/0x410
include/trace/events/sched.h:57
trace_sched_wakeup include/trace/events/sched.h:96 [inline]
ttwu_do_wakeup+0x272/0x5d0 kernel/sched/core.c:2222
ttwu_do_activate kernel/sched/core.c:2266 [inline]
ttwu_queue kernel/sched/core.c:2410 [inline]
try_to_wake_up+0x135e/0x2190 kernel/sched/core.c:2644
wake_up_process+0x10/0x20 kernel/sched/core.c:2668
hrtimer_wakeup+0x64/0x80 kernel/time/hrtimer.c:1769
__run_hrtimer kernel/time/hrtimer.c:1517 [inline]
__hrtimer_run_queues+0x691/0xbc0 kernel/time/hrtimer.c:1579
hrtimer_interrupt+0x358/0xd50 kernel/time/hrtimer.c:1641
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
smp_apic_timer_interrupt+0x1c8/0x4c0 arch/x86/kernel/apic/apic.c:1135
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
RIP: 0010:default_idle+0x55/0xa0 arch/x86/kernel/process.c:581
Code: 2f ea fd 48 c1 eb 03 48 b8 00 00 00 00 00 fc ff df 8a 04 03 84 c0 75
26 83 3d be 00 10 01 00 7e 07 0f 00 2d f5 50 5a 00 fb f4 <65> 8b 35 2c 69
7b 7c bf ff ff ff ff e8 0a 22 82 fd 5b 5d c3 48 c7
RSP: 0018:ffffffff84607c98 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 1ffffffff092c557 RCX: ffffffff838629de
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff84962ab8
RBP: ffffffff84607ca0 R08: dffffc0000000000 R09: fffffbfff092c558
R10: fffffbfff092c558 R11: 0000000000000000 R12: ffffffff84750ee0
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffffffff08c2928
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:571
default_idle_call kernel/sched/idle.c:94 [inline]
cpuidle_idle_call kernel/sched/idle.c:154 [inline]
do_idle+0x209/0x5c0 kernel/sched/idle.c:263
cpu_startup_entry+0x25/0x30 kernel/sched/idle.c:355
rest_init+0xe5/0xf0 init/main.c:451
arch_call_rest_init+0xe/0x10
start_kernel+0x739/0x806 init/main.c:784
x86_64_start_reservations+0x18/0x2e arch/x86/kernel/head64.c:490
x86_64_start_kernel+0x7a/0x7d arch/x86/kernel/head64.c:471
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
---[ end trace c9050becf05eb994 ]---
RIP: 0010:perf_tp_event_match kernel/events/core.c:8689 [inline]
RIP: 0010:perf_tp_event+0x21f/0x990 kernel/events/core.c:8740
Code: 84 51 02 00 00 4c 89 3c 24 48 8b 44 24 18 4c 8d b0 88 00 00 00 66 0f
1f 44 00 00 49 8d 9c 24 d0 01 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28
84 c0 0f 85 c8 01 00 00 8b 1b 89 de 83 e6 01 31 ff
RSP: 0018:ffff8881dba096c0 EFLAGS: 00010007
RAX: 0000000000a5a039 RBX: 00000000052d01cd RCX: ffffffff81451e2b
RDX: ffffffff84614940 RSI: 00000000052d005d RDI: 0000000000000000
RBP: ffff8881dba099e0 R08: ffffffff81592647 R09: fffffbfff08c2929
R10: fffffbfff08c2929 R11: 0000000000000000 R12: 00000000052cfffd
R13: dffffc0000000000 R14: ffff8881dba2f0b8 R15: ffff8881dba09748
FS: 0000000000000000(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000b2a978 CR3: 00000001c79f7005 CR4: 00000000001606f0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.