kernel BUG at fs/notify/dnotify/dnotify.c:LINE!

[syzbot]

Hello,

syzkaller hit the following crash on
4ed590271a65b0fbe3eb1cf828ad5af16603c8ce
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.




R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
------------[ cut here ]------------
kernel BUG at fs/notify/dnotify/dnotify.c:131!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 10214 Comm: syz-executor3 Not tainted 4.14.0-rc6+ #58
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff8801c6b283c0 task.stack: ffff8801d5308000
RIP: 0010:dnotify_free_mark+0x4b/0x60 fs/notify/dnotify/dnotify.c:131
RSP: 0018:ffff8801d530f910 EFLAGS: 00010216
RAX: 0000000000010000 RBX: ffff8801c9c3a240 RCX: ffffc9000132d000
RDX: 000000000000d33d RSI: ffffffff81bc50ab RDI: ffff8801c9c3a2b8
RBP: ffff8801d530f918 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff87080a60 R11: 0000000000000000 R12: ffff8801c9c3a240
R13: ffffffff84f23e20 R14: ffff8801d530fa50 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f77a3b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020b5afd8 CR3: 00000001d2f3a000 CR4: 00000000001426f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000020000000
DR3: 0000000000000008 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
fsnotify_final_mark_destroy+0x7d/0xc0 fs/notify/mark.c:202
fsnotify_put_mark+0x469/0x730 fs/notify/mark.c:215
fcntl_dirnotify+0xa12/0xb90 fs/notify/dnotify/dnotify.c:371
do_fcntl+0x9e0/0x1050 fs/fcntl.c:412
C_SYSC_fcntl64 fs/fcntl.c:668 [inline]
compat_SyS_fcntl64+0x3fc/0x4b0 fs/fcntl.c:606
do_syscall_32_irqs_on arch/x86/entry/common.c:329 [inline]
do_fast_syscall_32+0x3f2/0xf05 arch/x86/entry/common.c:391
entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
RIP: 0023:0xf7fa7c79
RSP: 002b:00000000f77a301c EFLAGS: 00000296 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000402
RDX: 0000000080000030 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: ea 03 80 3c 02 00 75 25 48 83 7b 78 00 75 17 e8 ac 70 b1 ff 48 8b 3d
75 a4 5e 04 48 89 de e8 bd fa e5 ff 5b 5d c3 e8 95 70 b1 ff <0f> 0b e8 2e
36 e6 ff eb d4 66 90 66 2e 0f 1f 84 00 00 00 00 00
RIP: dnotify_free_mark+0x4b/0x60 fs/notify/dnotify/dnotify.c:131 RSP:
ffff8801d530f910
---[ end trace 55a45a979f403c5e ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.