BUG: unable to handle kernel paging request in __free_object

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 9e8312f5 Merge tag 'nfs-for-5.3-3' of git://git.linux-nfs...
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=13f960da600000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a6a2b9826fdadf9
dashboard link: https://syzkaller.appspot.com/bug?extid=987033db39aea1cf54d7
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org
vi...@zeniv.linux.org.uk net...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+987033...@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: ffff888060bbf4d8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD b601067 P4D b601067 PUD 943b0063 PMD 65888063 PTE ffff888065888e30
Thread overran stack, or stack corrupted
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 22654 Comm: syz-executor.3 Not tainted 5.3.0-rc6+ #179
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:hlist_add_head include/linux/list.h:787 [inline]
RIP: 0010:__free_object+0x899/0x1030 lib/debugobjects.c:354
Code: 89 18 74 2a 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
ea 03 80 3c 02 00 0f 85 cc 06 00 00 48 8b 85 f0 fe ff ff <48> 89 43 08 48
b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80
RSP: 0018:ffff8880ae809bb8 EFLAGS: 00010046
RAX: ffff88808894f0a8 RBX: ffff888060bbf4d0 RCX: 1ffff11015d063db
RDX: 1ffff1100c177e9b RSI: ffffffff833e208c RDI: ffff888060bbf4d8
RBP: ffff8880ae809d08 R08: 1ffffffff1139028 R09: ffff8880882cdac0
R10: ffffed1015d0138f R11: 0000000000000003 R12: dffffc0000000000
R13: ffffffff8a9a06c8 R14: ffff8880ae831ed0 R15: ffff88808894f0a8
FS: 0000555555839940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888060bbf4d8 CR3: 000000008f1ce000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__debug_check_no_obj_freed lib/debugobjects.c:969 [inline]
debug_check_no_obj_freed+0x1e8/0x43f lib/debugobjects.c:994
kmem_cache_free+0x18f/0x320 mm/slab.c:3692
file_free_rcu+0x98/0xe0 fs/file_table.c:50
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch kernel/rcu/tree.c:2114 [inline]
rcu_core+0x67f/0x1580 kernel/rcu/tree.c:2314
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2323
__do_softirq+0x262/0x98c kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x19b/0x1e0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:537 [inline]
smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1133
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
</IRQ>
Modules linked in:
CR2: ffff888060bbf4d8
---[ end trace 4eed2d4ac1c9c2b6 ]---
RIP: 0010:hlist_add_head include/linux/list.h:787 [inline]
RIP: 0010:__free_object+0x899/0x1030 lib/debugobjects.c:354
Code: 89 18 74 2a 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
ea 03 80 3c 02 00 0f 85 cc 06 00 00 48 8b 85 f0 fe ff ff <48> 89 43 08 48
b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80
RSP: 0018:ffff8880ae809bb8 EFLAGS: 00010046
RAX: ffff88808894f0a8 RBX: ffff888060bbf4d0 RCX: 1ffff11015d063db
RDX: 1ffff1100c177e9b RSI: ffffffff833e208c RDI: ffff888060bbf4d8
RBP: ffff8880ae809d08 R08: 1ffffffff1139028 R09: ffff8880882cdac0
R10: ffffed1015d0138f R11: 0000000000000003 R12: dffffc0000000000
R13: ffffffff8a9a06c8 R14: ffff8880ae831ed0 R15: ffff88808894f0a8
FS: 0000555555839940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888060bbf4d8 CR3: 000000008f1ce000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.