BUG: Bad rss-counter state

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: dda0e292 Linux 4.19.114
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=130649b7e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f32ac7e5b2d5c341
dashboard link: https://syzkaller.appspot.com/bug?extid=11fad2b9698fd0f05ce9
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+11fad2...@syzkaller.appspotmail.com

BUG: Bad rss-counter state mm:0000000076814c57 idx:0 val:1040
netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 033c4ea4 Linux 4.19.122
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=163fc714100000
kernel config: https://syzkaller.appspot.com/x/.config?x=7f9e43a505369285

dashboard link: https://syzkaller.appspot.com/bug?extid=11fad2b9698fd0f05ce9
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10adfda2100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=179b9248100000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+11fad2...@syzkaller.appspotmail.com

audit: type=1400 audit(1589163255.838:8): avc: denied { execmem } for pid=6457 comm="syz-executor406" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
BUG: Bad rss-counter state mm:0000000021e6a3a6 idx:1 val:1
BUG: Bad rss-counter state mm:00000000fb081f2f idx:1 val:1
BUG: Bad rss-counter state mm:00000000536bae93 idx:1 val:1
BUG: Bad rss-counter state mm:00000000cc15052e idx:1 val:1
BUG: Bad rss-counter state mm:000000002f3ed9ac idx:1 val:1
BUG: Bad rss-counter state mm:000000003822b856 idx:1 val:1
BUG: Bad rss-counter state mm:0000000077bbdcf3 idx:1 val:1
BUG: Bad rss-counter state mm:0000000074d13905 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a4c91481 idx:1 val:1
BUG: Bad rss-counter state mm:00000000400521a8 idx:1 val:1
BUG: Bad rss-counter state mm:0000000031c32532 idx:1 val:1
BUG: Bad rss-counter state mm:000000002cf4f21b idx:1 val:1
BUG: Bad rss-counter state mm:0000000085310f1a idx:1 val:1
BUG: Bad rss-counter state mm:0000000079ba0715 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b8f05523 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d635fec4 idx:1 val:1
BUG: Bad rss-counter state mm:00000000dd1a774a idx:1 val:1
BUG: Bad rss-counter state mm:0000000029120994 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d3f979c5 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c15ba972 idx:1 val:1
BUG: Bad rss-counter state mm:000000008c17cdc6 idx:1 val:1
BUG: Bad rss-counter state mm:0000000020510470 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e44827a7 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e8abc9b5 idx:1 val:1
BUG: Bad rss-counter state mm:000000009fdd1f0b idx:1 val:1
BUG: Bad rss-counter state mm:00000000aedf53d3 idx:1 val:1
BUG: Bad rss-counter state mm:0000000000ac9d50 idx:1 val:1
BUG: Bad rss-counter state mm:000000007bfe25c6 idx:1 val:1
BUG: Bad rss-counter state mm:000000004ff622d5 idx:1 val:1
BUG: Bad rss-counter state mm:0000000078ddb666 idx:1 val:1
BUG: Bad rss-counter state mm:00000000ffa9930d idx:1 val:1
BUG: Bad rss-counter state mm:0000000024c11ede idx:1 val:1
BUG: Bad rss-counter state mm:0000000074d4f43c idx:1 val:1
BUG: Bad rss-counter state mm:000000003b9d7c4c idx:1 val:1
BUG: Bad rss-counter state mm:000000008cc16188 idx:1 val:1
BUG: Bad rss-counter state mm:000000005c617863 idx:1 val:1
BUG: Bad rss-counter state mm:0000000057168902 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a2c8bb6e idx:1 val:1
BUG: Bad rss-counter state mm:00000000a73a01eb idx:1 val:1
BUG: Bad rss-counter state mm:00000000014a00e6 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b0b499b0 idx:1 val:1
BUG: Bad rss-counter state mm:000000009ec211e8 idx:1 val:1
BUG: Bad rss-counter state mm:000000008d8c7607 idx:1 val:1
BUG: Bad rss-counter state mm:00000000bd81cedf idx:1 val:1
BUG: Bad rss-counter state mm:0000000097336fd2 idx:1 val:1
BUG: Bad rss-counter state mm:000000004c134d2e idx:1 val:1
BUG: Bad rss-counter state mm:000000004354e41b idx:1 val:1
BUG: Bad rss-counter state mm:000000003dea385e idx:1 val:1
BUG: Bad rss-counter state mm:00000000138996e8 idx:1 val:1
BUG: Bad rss-counter state mm:0000000053141abf idx:1 val:1
BUG: Bad rss-counter state mm:00000000dfbbe827 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c8462dd1 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c1c21e9f idx:1 val:1
BUG: Bad rss-counter state mm:00000000cc3372ab idx:1 val:1
BUG: Bad rss-counter state mm:00000000f487d0b8 idx:1 val:1
BUG: Bad rss-counter state mm:000000007b30c4ae idx:1 val:1
BUG: Bad rss-counter state mm:00000000603b92ca idx:1 val:1
BUG: Bad rss-counter state mm:000000008aedb408 idx:1 val:1
BUG: Bad rss-counter state mm:000000009fffd9df idx:1 val:1
BUG: Bad rss-counter state mm:000000008a1b2ab2 idx:1 val:1
BUG: Bad rss-counter state mm:0000000039ef489b idx:1 val:1
BUG: Bad rss-counter state mm:00000000c30a1859 idx:1 val:1
BUG: Bad rss-counter state mm:000000002839e6fb idx:1 val:1
BUG: Bad rss-counter state mm:00000000a5772bd2 idx:1 val:1
BUG: Bad rss-counter state mm:000000000f6622f1 idx:1 val:1
BUG: Bad rss-counter state mm:0000000077a112f1 idx:1 val:1
BUG: Bad rss-counter state mm:0000000004eb57dc idx:1 val:1
BUG: Bad rss-counter state mm:000000009ecfa286 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d4cb4f4f idx:1 val:1
BUG: Bad rss-counter state mm:00000000abdf76f7 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e49eb5f9 idx:1 val:1
BUG: Bad rss-counter state mm:00000000312b411e idx:1 val:1
BUG: Bad rss-counter state mm:000000000be34453 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b6e6f84a idx:1 val:1
BUG: Bad rss-counter state mm:00000000b3eb2640 idx:1 val:1
BUG: Bad rss-counter state mm:0000000027139ef6 idx:1 val:1
BUG: Bad rss-counter state mm:000000003ebd7cb8 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e3a91ba9 idx:1 val:1
BUG: Bad rss-counter state mm:00000000527da4e6 idx:1 val:1
BUG: Bad rss-counter state mm:000000008b3241c7 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a9083342 idx:1 val:1
BUG: Bad rss-counter state mm:000000005fbd579c idx:1 val:1
BUG: Bad rss-counter state mm:0000000013524a4f idx:1 val:1
BUG: Bad rss-counter state mm:00000000f4bdb9b6 idx:1 val:1
BUG: Bad rss-counter state mm:000000002bacde36 idx:1 val:1
BUG: Bad rss-counter state mm:000000003c1aaf97 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b7d31afd idx:1 val:1
BUG: Bad rss-counter state mm:00000000143ac363 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b09b6a5d idx:1 val:1
BUG: Bad rss-counter state mm:0000000025bbfa71 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a1eaf2a5 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d011d4f1 idx:1 val:1
BUG: Bad rss-counter state mm:000000007c10a4f9 idx:1 val:1
BUG: Bad rss-counter state mm:0000000065769f1f idx:1 val:1
BUG: Bad rss-counter state mm:00000000ef2069cc idx:1 val:1
BUG: Bad rss-counter state mm:00000000cedccccc idx:1 val:1
BUG: Bad rss-counter state mm:00000000dcf89452 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b6599ec1 idx:1 val:1
BUG: Bad rss-counter state mm:000000000527511f idx:1 val:1
BUG: Bad rss-counter state mm:000000009fcc333d idx:1 val:1
BUG: Bad rss-counter state mm:0000000008de20ff idx:1 val:1
BUG: Bad rss-counter state mm:0000000000aa8383 idx:1 val:1
BUG: Bad rss-counter state mm:000000002f2d7018 idx:1 val:1
BUG: Bad rss-counter state mm:0000000025d65c7b idx:1 val:1
BUG: Bad rss-counter state mm:00000000cf25de66 idx:1 val:1
BUG: Bad rss-counter state mm:00000000f3bd3934 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e87ecf1e idx:1 val:1
BUG: Bad rss-counter state mm:00000000b8cbd843 idx:1 val:1
BUG: Bad rss-counter state mm:000000001bf3c7a2 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c22e3bff idx:1 val:1
BUG: Bad rss-counter state mm:00000000a2b50680 idx:1 val:1
BUG: Bad rss-counter state mm:000000005a5302c8 idx:1 val:1
BUG: Bad rss-counter state mm:000000008532ed8e idx:1 val:1
BUG: Bad rss-counter state mm:00000000fb0e08ee idx:1 val:1
BUG: Bad rss-counter state mm:000000002dc63676 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a106f466 idx:1 val:1
BUG: Bad rss-counter state mm:00000000e927b605 idx:1 val:1
BUG: Bad rss-counter state mm:000000006fdf3ff5 idx:1 val:1
BUG: Bad rss-counter state mm:0000000087dbe441 idx:1 val:1
BUG: Bad rss-counter state mm:00000000efe6d045 idx:1 val:1
BUG: Bad rss-counter state mm:00000000070a2ccc idx:1 val:1
BUG: Bad rss-counter state mm:00000000c9b32766 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c7e3a9c8 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d6ba1b8c idx:1 val:1
BUG: Bad rss-counter state mm:00000000e053c269 idx:1 val:1
BUG: Bad rss-counter state mm:0000000064d7678c idx:1 val:1
BUG: Bad rss-counter state mm:0000000048249c15 idx:1 val:1
BUG: Bad rss-counter state mm:0000000091cd9d39 idx:1 val:1
BUG: Bad rss-counter state mm:00000000fe874385 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d5a05fd4 idx:1 val:1
BUG: Bad rss-counter state mm:000000007cd8c1cc idx:1 val:1
BUG: Bad rss-counter state mm:0000000033de23d3 idx:1 val:1
BUG: Bad rss-counter state mm:00000000d2080475 idx:1 val:1
BUG: Bad rss-counter state mm:0000000088e5c094 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b21cdf6b idx:1 val:1
BUG: Bad rss-counter state mm:000000002e52e624 idx:1 val:1
BUG: Bad rss-counter state mm:00000000304e720a idx:1 val:1
BUG: Bad rss-counter state mm:00000000b68defb0 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b19b3466 idx:1 val:1
BUG: Bad rss-counter state mm:00000000b9e048db idx:1 val:1
BUG: Bad rss-counter state mm:00000000788b8584 idx:1 val:1
BUG: Bad rss-counter state mm:0000000096c968ec idx:1 val:1
BUG: Bad rss-counter state mm:000000005532812c idx:1 val:1
BUG: Bad rss-counter state mm:000000002d0bb6c5 idx:1 val:1
BUG: Bad rss-counter state mm:000000002150f633 idx:1 val:1
BUG: Bad rss-counter state mm:00000000c59f1f20 idx:1 val:1
BUG: Bad rss-counter state mm:00000000dd35fa2e idx:1 val:1
BUG: Bad rss-counter state mm:0000000005db0bac idx:1 val:1
BUG: Bad rss-counter state mm:0000000022c738ba idx:1 val:1
BUG: Bad rss-counter state mm:00000000164288da idx:1 val:1
BUG: Bad rss-counter state mm:00000000c10b0609 idx:1 val:1
BUG: Bad rss-counter state mm:00000000108e8c7f idx:1 val:1
BUG: Bad rss-counter state mm:0000000015155f49 idx:1 val:1
BUG: Bad rss-counter state mm:0000000034405bc5 idx:1 val:1
BUG: Bad rss-counter state mm:00000000dec53609 idx:1 val:1
BUG: Bad rss-counter state mm:00000000643a5603 idx:1 val:1
BUG: Bad rss-counter state mm:0000000052525789 idx:1 val:1
BUG: Bad rss-counter state mm:000000009177f7f8 idx:1 val:1
BUG: Bad rss-counter state mm:00000000f2013075 idx:1 val:1
BUG: Bad rss-counter state mm:000000008b83a536 idx:1 val:1
BUG: Bad rss-counter state mm:0000000008631d09 idx:1 val:1
BUG: Bad rss-counter state mm:00000000dacc30a6 idx:1 val:1
BUG: Bad rss-counter state mm:00000000a25eccc2 idx:1 val:1
BUG: Bad rss-counter state mm:000000008c9c964c idx:1 val:1
BUG: Bad rss-counter state mm:000000009abff807 idx:1 val:1
BUG: Bad rss-counter state mm:00000000964a4990 idx:1 val:1