WARNING in __vunmap

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 5ee93551 Linux 4.19.82
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1092ee4ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c62a146039e23bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=fecd2fc4870085b92cda
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fecd2f...@syzkaller.appspotmail.com

Trying to vfree() nonexistent vm area (000000002377bf29)
WARNING: CPU: 1 PID: 8439 at mm/vmalloc.c:1514 __vunmap+0x350/0x400
mm/vmalloc.c:1514
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8439 Comm: syz-executor.0 Not tainted 4.19.82 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:__vunmap+0x350/0x400 mm/vmalloc.c:1514
Code: 2b d1 ff 4c 89 ee 48 c7 c7 40 ed 53 87 e8 06 a1 a4 ff 0f 0b eb b2 e8
1f 2b d1 ff 4c 89 ee 48 c7 c7 a0 ed 53 87 e8 ee a0 a4 ff <0f> 0b eb 9a 4c
89 ff e8 b4 c2 07 00 e9 3d ff ff ff 48 8b 7d c0 e8
RSP: 0018:ffff888057c3f4b0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 000000000001014c RSI: ffffffff81553f06 RDI: ffffed100af87e88
RBP: ffff888057c3f4f0 R08: ffff8880554c4600 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: 0000000000000000
R13: ffffc90005c64000 R14: ffffe8ffffc76a98 R15: 0000607f51476a98
vfree+0x6a/0x100 mm/vmalloc.c:1597
ipcomp_free_scratches+0xc0/0x150 net/xfrm/xfrm_ipcomp.c:216
ipcomp_free_data net/xfrm/xfrm_ipcomp.c:325 [inline]
ipcomp_init_state+0x76d/0xa10 net/xfrm/xfrm_ipcomp.c:377
ipcomp6_init_state+0xc9/0x880 net/ipv6/ipcomp6.c:165
__xfrm_init_state+0x54f/0xef0 net/xfrm/xfrm_state.c:2312
xfrm_init_state+0x1e/0x80 net/xfrm/xfrm_state.c:2338
pfkey_msg2xfrm_state net/key/af_key.c:1297 [inline]
pfkey_add+0x1da7/0x2fe0 net/key/af_key.c:1514
pfkey_process+0x6d5/0x810 net/key/af_key.c:2840
pfkey_sendmsg+0x411/0xbf0 net/key/af_key.c:3679
sock_sendmsg_nosec net/socket.c:622 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:632
___sys_sendmsg+0x3e2/0x920 net/socket.c:2115
__sys_sendmmsg+0x1bf/0x4e0 net/socket.c:2210
__do_sys_sendmmsg net/socket.c:2239 [inline]
__se_sys_sendmmsg net/socket.c:2236 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2236
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a219
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fe231a1ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045a219
RDX: 040000000000002b RSI: 0000000020000180 RDI: 0000000000000003
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe231a1b6d4
R13: 00000000004c7f9d R14: 00000000004de3c8 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.