general protection fault in perf_tp_event

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 4f68020f Linux 4.14.182
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12ff8aee100000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7045c57a90d1ddc
dashboard link: https://syzkaller.appspot.com/bug?extid=27238284000277cb5930
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+272382...@syzkaller.appspotmail.com

RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 000000000000009e R14: 00000000004c3524 R15: 00007fc6547b06d4
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 8828 Comm: syz-executor.2 Not tainted 4.14.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff88808b994100 task.stack: ffff88804da60000
RIP: 0010:perf_tp_event_match kernel/events/core.c:8016 [inline]
RIP: 0010:perf_tp_event+0x580/0x7d0 kernel/events/core.c:8073
RSP: 0000:ffff88804da67780 EFLAGS: 00010002
RAX: 0000044f8060204a RBX: 0000227c03010090 RCX: ffffc9000671c000
RDX: 0000000000040000 RSI: ffffffff816b28f2 RDI: 0000227c03010250
RBP: ffff88804da67a30 R08: ffff8880aec27ac0 R09: ffff8880aec00000
R10: ffff88804da67a48 R11: ffff8880aec0002b R12: dffffc0000000000
R13: ffff8880aec00000 R14: 0000000000000000 R15: ffff88804b8b2200
FS: 00007fc6547b0700(0000) GS:ffff8880aec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c433498004 CR3: 000000008e44e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
perf_trace_run_bpf_submit kernel/events/core.c:8044 [inline]
perf_trace_run_bpf_submit+0x113/0x170 kernel/events/core.c:8030
perf_trace_sched_wakeup_template+0x3fc/0x520 include/trace/events/sched.h:57
trace_sched_wakeup include/trace/events/sched.h:96 [inline]
ttwu_do_wakeup.isra.0+0x331/0x570 kernel/sched/core.c:1686
ttwu_queue kernel/sched/core.c:1874 [inline]
try_to_wake_up+0x93b/0x1110 kernel/sched/core.c:2087
wake_up_process kernel/sched/core.c:2160 [inline]
wake_up_q+0x90/0xe0 kernel/sched/core.c:468
__mutex_unlock_slowpath+0x268/0x780 kernel/locking/mutex.c:1070
_free_event+0x328/0xe50 kernel/events/core.c:4238
put_event+0x20/0x30 kernel/events/core.c:4324
perf_event_release_kernel+0x383/0x870 kernel/events/core.c:4425
perf_release+0x33/0x40 kernel/events/core.c:4435
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x113/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1ad/0x200 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45ca29
RSP: 002b:00007fc6547afc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000124
RAX: 0000000000000003 RBX: 00000000004db5c0 RCX: 000000000045ca29
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 000000000000009e R14: 00000000004c3524 R15: 00007fc6547b06d4
Code: 48 85 db 0f 84 7c fc ff ff e8 2d 79 ef ff 48 83 eb 40 0f 84 6d fc ff ff e8 1e 79 ef ff 48 8d bb c0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e a7 01 00 00 f6 83 c0 01
RIP: perf_tp_event_match kernel/events/core.c:8016 [inline] RSP: ffff88804da67780
RIP: perf_tp_event+0x580/0x7d0 kernel/events/core.c:8073 RSP: ffff88804da67780

======================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.