kernel BUG at include/linux/mm.h:LINE!

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 4b0e041c Linux 4.19.35
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11d7726b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb1bcac868b1655e
dashboard link: https://syzkaller.appspot.com/bug?extid=2346ff55f747e04b424e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1522e66b200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17196e67200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2346ff...@syzkaller.appspotmail.com

flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea000220fc08 ffffea0002994808 0000000000000000
raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:519!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7759 Comm: syz-executor372 Not tainted 4.19.35 #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:put_page include/linux/mm.h:942 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2795 [inline]
RIP: 0010:skb_release_data+0x5ab/0x7c0 net/core/skbuff.c:568
Code: f6 fe ff e9 b6 fb ff ff e8 b2 83 09 fc 4c 8d 63 ff e9 c8 fc ff ff e8
a4 83 09 fc 48 c7 c6 00 b2 dc 87 4c 89 e7 e8 b5 86 31 fc <0f> 0b e8 8e 83
09 fc 4d 8d 66 0e 48 b8 00 00 00 00 00 fc ff df 4c
RSP: 0018:ffff8880a4a9f8a8 EFLAGS: 00010293
RAX: ffff88808cbd0640 RBX: ffffea0002999234 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81934797 RDI: ffffea0002999238
RBP: ffff8880a4a9f910 R08: 000000000000003e R09: ffff88808cbd0f80
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0002999200
R13: ffff8880932ee2f0 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020014000 CR3: 000000000866d000 CR4: 00000000001406e0
Call Trace:
skb_release_all+0x4d/0x60 net/core/skbuff.c:631
__kfree_skb+0x16/0x30 net/core/skbuff.c:645
sk_wmem_free_skb include/net/sock.h:1457 [inline]
tcp_write_queue_purge+0x253/0x7d0 net/ipv4/tcp.c:2520
tcp_v4_destroy_sock+0xe7/0x7e0 net/ipv4/tcp_ipv4.c:1977
inet_csk_destroy_sock+0x1a7/0x450 net/ipv4/inet_connection_sock.c:838
tcp_close+0xa5e/0x10c0 net/ipv4/tcp.c:2476
tls_sk_proto_close+0x6b1/0xaa0 net/tls/tls_main.c:313
inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
__sock_release+0x1fe/0x2b0 net/socket.c:579
sock_release+0x18/0x20 net/socket.c:599
smc_release+0x2c7/0x810 net/smc/af_smc.c:156
__sock_release+0xd3/0x2b0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x933/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
__do_sys_exit_group kernel/exit.c:990 [inline]
__se_sys_exit_group kernel/exit.c:988 [inline]
__x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43eeb8
Code: Bad RIP value.
RSP: 002b:00007ffc5471c228 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043eeb8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004be6c8 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000028 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d0180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace b8f1210f0d732120 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:put_page include/linux/mm.h:942 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2795 [inline]
RIP: 0010:skb_release_data+0x5ab/0x7c0 net/core/skbuff.c:568
Code: f6 fe ff e9 b6 fb ff ff e8 b2 83 09 fc 4c 8d 63 ff e9 c8 fc ff ff e8
a4 83 09 fc 48 c7 c6 00 b2 dc 87 4c 89 e7 e8 b5 86 31 fc <0f> 0b e8 8e 83
09 fc 4d 8d 66 0e 48 b8 00 00 00 00 00 fc ff df 4c
RSP: 0018:ffff8880a4a9f8a8 EFLAGS: 00010293
RAX: ffff88808cbd0640 RBX: ffffea0002999234 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81934797 RDI: ffffea0002999238
RBP: ffff8880a4a9f910 R08: 000000000000003e R09: ffff88808cbd0f80
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0002999200
R13: ffff8880932ee2f0 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043ee8e CR3: 000000000866d000 CR4: 00000000001406e0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches