general protection fault in cpuacct_charge (3)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: ed6e8103 Merge branch 'qed-Enhancements'
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1593f432600000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bbf70b6300045af
dashboard link: https://syzkaller.appspot.com/bug?extid=99ec2b8b9983a62f125b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [aarc...@redhat.com ak...@linux-foundation.org
chri...@brauner.io elena.r...@intel.com gu...@fb.com
jo...@joelfernandes.org kees...@chromium.org l...@altlinux.org
linux-...@vger.kernel.org lu...@amacapital.net mho...@suse.com
mi...@kernel.org na...@vmware.com pet...@infradead.org
vi...@zeniv.linux.org.uk w...@chromium.org net...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+99ec2b...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8677 Comm: udevd Not tainted 5.3.0-rc6+ #152
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:task_css include/linux/cgroup.h:486 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_charge+0x113/0x360 kernel/sched/cpuacct.c:349
Code: 10 08 00 85 c0 74 0d 80 3d 47 cb 6a 08 00 0f 84 65 01 00 00 49 8d 7c
24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 10 02 00 00 4d 8b 64 24 10 4d 85 e4 0f 84 9e 00
RSP: 0018:ffff8880668afac0 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff8880a98a4240 RCX: 1ffffffff138bb26
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010
RBP: ffff8880668afaf0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff138b4e7 R11: ffff888088bbc000 R12: 0000000000000000
R13: 00000000001bc74c R14: ffff8880a98a4240 R15: 0000000000000001
FS: 00007fe03a51a7a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe03a521000 CR3: 00000000a0ca8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cgroup_account_cputime include/linux/cgroup.h:777 [inline]
update_curr+0x2f3/0x8d0 kernel/sched/fair.c:862
enqueue_entity+0x31b/0x17b0 kernel/sched/fair.c:3975
enqueue_task_fair+0x161/0x1210 kernel/sched/fair.c:5278
enqueue_task kernel/sched/core.c:1181 [inline]
activate_task+0x110/0x490 kernel/sched/core.c:1203
wake_up_new_task+0x538/0xbd0 kernel/sched/core.c:2847
_do_fork+0x26c/0xfa0 kernel/fork.c:2393
__do_sys_clone kernel/fork.c:2524 [inline]
__se_sys_clone kernel/fork.c:2505 [inline]
__x64_sys_clone+0x18d/0x250 kernel/fork.c:2505
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fe039bfdf46
Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 14 25 10 00 00 00 31 d2 49 81
c2 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 0f 87 31 01 00 00 85 c0 41 89 c4 0f 85 3b 01 00
RSP: 002b:00007fffb85798c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fffb85798c0 RCX: 00007fe039bfdf46
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007fffb8579920 R08: 00000000000021e5 R09: 00000000000021e5
R10: 00007fe03a51aa70 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffb85798e0 R14: 0000000000000005 R15: 0000000000000005
Modules linked in:
---[ end trace 39e7400eeda3fd1b ]---
RIP: 0010:task_css include/linux/cgroup.h:486 [inline]
RIP: 0010:task_ca kernel/sched/cpuacct.c:43 [inline]
RIP: 0010:cpuacct_charge+0x113/0x360 kernel/sched/cpuacct.c:349
Code: 10 08 00 85 c0 74 0d 80 3d 47 cb 6a 08 00 0f 84 65 01 00 00 49 8d 7c
24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f
85 10 02 00 00 4d 8b 64 24 10 4d 85 e4 0f 84 9e 00
RSP: 0018:ffff8880668afac0 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: ffff8880a98a4240 RCX: 1ffffffff138bb26
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010
RBP: ffff8880668afaf0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff138b4e7 R11: ffff888088bbc000 R12: 0000000000000000
R13: 00000000001bc74c R14: ffff8880a98a4240 R15: 0000000000000001
FS: 00007fe03a51a7a0(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe03a521000 CR3: 00000000a0ca8000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.