BUG: corrupted list in event_sched_out

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6a9dc5fd lib: Revert use of fallthrough pseudo-keyword in ..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12d88241900000
kernel config: https://syzkaller.appspot.com/x/.config?x=978db74cb30aa994
dashboard link: https://syzkaller.appspot.com/bug?extid=d0eb1c22917d46d65d55
compiler: gcc (GCC) 10.1.0-syz 20200507
CC: [ac...@kernel.org alexander...@linux.intel.com and...@fb.com a...@kernel.org b...@vger.kernel.org dan...@iogearbox.net john.fa...@gmail.com jo...@redhat.com ka...@fb.com kps...@chromium.org linux-...@vger.kernel.org mark.r...@arm.com mi...@redhat.com namh...@kernel.org net...@vger.kernel.org pet...@infradead.org songliu...@fb.com y...@fb.com]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d0eb1c...@syzkaller.appspotmail.com

list_del corruption. next->prev should be ffff8880a1628020, but was 0000000000000000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:54!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1 Comm: systemd Not tainted 5.9.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_del_entry_valid.cold+0x48/0x55 lib/list_debug.c:54
Code: e8 41 8b be fd 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 20 1b 94 88 e8 2d 8b be fd 0f 0b 48 89 ee 48 c7 c7 e0 1b 94 88 e8 1c 8b be fd <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55
RSP: 0000:ffffc90000c7fd00 EFLAGS: 00010082
RAX: 0000000000000054 RBX: ffff8880a1628000 RCX: 0000000000000000
RDX: ffff8880a95d6040 RSI: ffffffff815dafc7 RDI: fffff5200018ff92
RBP: ffff8880a1628020 R08: 0000000000000054 R09: ffff8880ae6318e7
R10: 0000000000000000 R11: 1ffffffff184265c R12: ffff8880ae63b0e8
R13: ffff888000110020 R14: ffff8880a16280a8 R15: ffff8880a1628020
FS: 00007fe53f0be500(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cfec CR3: 000000009cd02000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:132 [inline]
list_del_init include/linux/list.h:204 [inline]
event_sched_out+0x132/0xef0 kernel/events/core.c:2249
group_sched_out.part.0+0x110/0x3f0 kernel/events/core.c:2287
group_sched_out kernel/events/core.c:2282 [inline]
ctx_sched_out+0x915/0xc20 kernel/events/core.c:3237
cpu_ctx_sched_out kernel/events/core.c:3538 [inline]
ctx_resched+0x2f2/0x390 kernel/events/core.c:2722
__perf_install_in_context+0x285/0xa10 kernel/events/core.c:2794
remote_function kernel/events/core.c:88 [inline]
remote_function+0x115/0x1a0 kernel/events/core.c:68
flush_smp_call_function_queue+0x1da/0x600 kernel/smp.c:271
__sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:50 [inline]
sysvec_call_function_single+0x4c/0xf0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:589
RIP: 0033:0x7fe53ed8e9f4
Code: 0f 45 c6 52 50 ff 74 24 10 41 55 e9 c2 fd ff ff e8 51 65 f3 ff 90 48 89 f8 48 8d 3d 9f aa 03 00 b9 05 00 00 00 48 89 c6 f3 a6 <75> 0b 48 89 c2 48 83 c2 05 48 0f 45 c2 48 8d 3d 98 c6 05 00 48 89
RSP: 002b:00007fff879386d8 EFLAGS: 00000206
RAX: 000055b641b60070 RBX: 000055b641b5cea0 RCX: 0000000000000004
RDX: 00007fe53edc3fa0 RSI: 000055b641b60071 RDI: 00007fe53edc948a
RBP: 00007fff87938750 R08: 000055b641b63945 R09: 0000000000000000
R10: 00007fe53d6cec40 R11: 0000000000000007 R12: 00007fff87938700
R13: 00007fff879386f8 R14: 0000000000000000 R15: 000055b641b508c0
Modules linked in:
---[ end trace 16ae5a4e80ebfb85 ]---
RIP: 0010:__list_del_entry_valid.cold+0x48/0x55 lib/list_debug.c:54
Code: e8 41 8b be fd 0f 0b 4c 89 e2 48 89 ee 48 c7 c7 20 1b 94 88 e8 2d 8b be fd 0f 0b 48 89 ee 48 c7 c7 e0 1b 94 88 e8 1c 8b be fd <0f> 0b cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 55 41 54 55
RSP: 0000:ffffc90000c7fd00 EFLAGS: 00010082
RAX: 0000000000000054 RBX: ffff8880a1628000 RCX: 0000000000000000
RDX: ffff8880a95d6040 RSI: ffffffff815dafc7 RDI: fffff5200018ff92
RBP: ffff8880a1628020 R08: 0000000000000054 R09: ffff8880ae6318e7
R10: 0000000000000000 R11: 1ffffffff184265c R12: ffff8880ae63b0e8
R13: ffff888000110020 R14: ffff8880a16280a8 R15: ffff8880a1628020
FS: 00007fe53f0be500(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000118cfec CR3: 000000009cd02000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.