audit: type=1400 audit(1756502066.859:10): avc: denied { write } for pid=4043 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
------------[ cut here ]------------
percpu ref (free_ioctx_users) <= 0 (0) after switching to atomic
WARNING: lib/percpu-refcount.c:197 at percpu_ref_switch_to_atomic_rcu+0x3cc/0x480, CPU#0: syz-executor.6/4046
loop7: detected capacity change from 0 to 64
Modules linked in:
CPU: 0 UID: 0 PID: 4046 Comm: syz-executor.6 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x3cc/0x480
Code: 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 9e 00 00 00 49 8b 75 e8 48 c7 c7 80 97 e2 84 e8 75 c5 e9 fe 90 <0f> 0b 90 90 e9 2b ff ff ff e8 f6 de 5f ff e9 9e fe ff ff e8 7c df
RSP: 0018:ffff88806ce08e20 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8139de70
RDX: ffff888019108000 RSI: ffffffff8139de7e RDI: 0000000000000001
RBP: 7fffffffffffffff R08: 0000000000000001 R09: ffffed100d9c4801
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888009bb9900
R13: ffff888009bb9920 R14: 0000000000000002 R15: 0000000000000003
FS: 00007f6343fdc700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d325000 CR3: 000000000e418000 CR4: 0000000000350ef0
Call Trace:
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:unwind_next_frame+0x6f/0x2540
Code: 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f e9 5a 83 88 03 48 b8 00 00 00 00 00 fc ff df 49 8d 6f 58 48 89 ea 48 c1 ea 03 80 3c 02 00 <0f> 85 a6 1a 00 00 49 8b 47 58 4d 8d 6f 48 4c 89 ea 48 89 04 24 48
RSP: 0018:ffff888017c37768 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffff888017c3772c
RDX: 1ffff11002f86f06 RSI: ffffffff84bb26df RDI: ffff888017c377d8
RBP: ffff888017c37830 R08: 0000000000000001 R09: ffff888017c37818
R10: 000000000003be53 R11: 000000000003dc35 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888019108000 R15: ffff888017c377d8
arch_stack_walk+0x86/0xf0
stack_trace_save+0x8e/0xc0
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x3f/0x50
kfree+0x281/0x550
x509_cert_parse+0x6c1/0x920
x509_key_preparse+0x65/0x960
asymmetric_key_preparse+0xb9/0x120
__key_create_or_update+0x3f6/0xcd0
key_create_or_update+0x42/0x60
__do_sys_add_key+0x214/0x440
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6346a66b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6343fdc188 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
RAX: ffffffffffffffda RBX: 00007f6346b79f60 RCX: 00007f6346a66b19
RDX: 0000000020000200 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00007f6346ac0f6d R08: 0000000013dd3bd4 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffefd3f82af R14: 00007f6343fdc300 R15: 0000000000022000
irq event stamp: 1616
hardirqs last enabled at (1626): [] __up_console_sem+0x78/0x80
hardirqs last disabled at (1635): [] __up_console_sem+0x5d/0x80
softirqs last enabled at (358): [] handle_softirqs+0x50c/0x770
softirqs last disabled at (571): [] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff888009bb9900 pointer offset 0 size 64
FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
kmemleak: Found object by alias at 0x607f1a63821c
CPU: 1 UID: 0 PID: 286 Comm: syz-executor.1 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
__lookup_object+0x94/0xb0
delete_object_full+0x27/0x70
free_percpu+0x30/0x1160
delayed_free_vfsmnt+0x7e/0xb0
rcu_core+0x7c8/0x1800
handle_softirqs+0x1b1/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80
Code: 5d 41 5c 41 5d e9 a0 1f 4a 03 48 c7 c0 f4 ff ff ff eb 92 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 34 24 65 48 8b 15 88 48 10 06 65 8b 05 99 48 10
RSP: 0018:ffff888016b5f6b8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff819e4a97
RDX: ffff88800a7f0000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: ffffea0000fea540 R08: 0000000000000000 R09: fffff940001fd4a8
R10: 0000000000000000 R11: 0000000000000001 R12: 800000003fa95007
R13: ffffea0000fea540 R14: ffffea0000fea540 R15: dffffc0000000000
copy_page_range+0xe66/0x5140
dup_mmap+0xd2f/0x1d10
copy_process+0x3ad5/0x73c0
kernel_clone+0xea/0x7f0
__do_sys_clone+0xce/0x120
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7344a7010b
Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00
RSP: 002b:00007ffdd41fa8e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7344a7010b
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000555568e3a400
R10: 0000555568e3a6d0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffdd41fa9c0
kmemleak: Object (percpu) 0x607f1a638218 (size 8):
kmemleak: comm "syz-executor.4", pid 4045, jiffies 4294825887
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x21
kmemleak: checksum = 0
kmemleak: backtrace:
pcpu_alloc_noprof+0x87a/0x1170
perf_trace_event_init+0x366/0xa10
perf_trace_init+0x1a4/0x2f0
perf_tp_event_init+0xa6/0x120
perf_try_init_event+0x140/0x9f0
perf_event_alloc.part.0+0x118e/0x45f0
__do_sys_perf_event_open+0x719/0x2c20
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
loop5: detected capacity change from 0 to 64
FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
loop7: detected capacity change from 0 to 64
Oops: general protection fault, probably for non-canonical address 0xf0fffc0000000032: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x8800000000000190-0x8800000000000197]
CPU: 0 UID: 0 PID: 4047 Comm: syz-executor.0 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff888047c37780 EFLAGS: 00010012
RAX: 1100000000000032 RBX: 87ffffffffffffa0 RCX: ffffc900058b6000
RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 8800000000000190
FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
RBP: ffff888047c379f0 R08: ffff88806ce31340 R09: ffffe8ffffc16888
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
FS: 00007fd0785d5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d222000 CR3: 000000000edd8000 CR4: 0000000000350ef0
Call Trace:
perf_trace_run_bpf_submit+0xef/0x180
perf_trace_preemptirq_template+0x259/0x430
trace_irq_enable.constprop.0+0xa6/0x100
trace_hardirqs_on+0x26/0x40
_raw_spin_unlock_irqrestore+0x2c/0x50
try_to_wake_up+0x8ae/0x11d0
wake_up_q+0xa1/0x130
futex_wake+0x47e/0x540
do_futex+0x26d/0x370
__x64_sys_futex+0x1c9/0x4d0
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd07b05fb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd0785d5218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007fd07b172f68 RCX: 00007fd07b05fb19
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd07b172f6c
RBP: 00007fd07b172f60 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 00007fd07b172f6c
R13: 00007ffc065fb24f R14: 00007fd0785d5300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff888047c37780 EFLAGS: 00010012
RAX: 1100000000000032 RBX: 87ffffffffffffa0 RCX: ffffc900058b6000
RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 8800000000000190
RBP: ffff888047c379f0 R08: ffff88806ce31340 R09: ffffe8ffffc16888
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
FS: 00007fd0785d5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d222000 CR3: 000000000edd8000 CR4: 0000000000350ef0
note: syz-executor.0[4047] exited with irqs disabled
Oops: general protection fault, probably for non-canonical address 0xf0fffc0000000032: 0000 [#2] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x8800000000000190-0x8800000000000197]
CPU: 0 UID: 0 PID: 4047 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012
RAX: 1100000000000032 RBX: 87ffffffffffffa0 RCX: ffffffff81898973
RDX: ffff88801619d280 RSI: ffffffff818995b7 RDI: 8800000000000190
RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc16888
R10: 0000000000000000 R11: ffff88801e147c98 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88806ce313e8 R15: dffffc0000000000
FS: 00007fd0785d5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d222000 CR3: 000000000edd8000 CR4: 0000000000350ef0
Call Trace:
perf_trace_run_bpf_submit+0xef/0x180
perf_trace_preemptirq_template+0x259/0x430
trace_irq_enable.constprop.0+0xa6/0x100
trace_hardirqs_on+0x26/0x40
handle_softirqs+0x16e/0x770
__irq_exit_rcu+0xc4/0x100
irq_exit_rcu+0x9/0x20
sysvec_apic_timer_interrupt+0x70/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:make_task_dead+0xa2/0x3b0
Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de
RSP: 0018:ffff888047c37f28 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88801619d280 RCX: ffffffff817c2b86
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234
RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8643ac57 R11: 0000000000000001 R12: ffff88801619d280
R13: 0000000000000000 R14: f0fffc0000000032 R15: 0000000000000000
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7fd07b05fb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd0785d5218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007fd07b172f68 RCX: 00007fd07b05fb19
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd07b172f6c
RBP: 00007fd07b172f60 R08: 000000000000000e R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 00007fd07b172f6c
R13: 00007ffc065fb24f R14: 00007fd0785d5300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_tp_event+0x175/0xe70
Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
RSP: 0018:ffff888047c37780 EFLAGS: 00010012
RAX: 1100000000000032 RBX: 87ffffffffffffa0 RCX: ffffc900058b6000
RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 8800000000000190
RBP: ffff888047c379f0 R08: ffff88806ce31340 R09: ffffe8ffffc16888
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
FS: 00007fd0785d5700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d222000 CR3: 000000000edd8000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 89 e0 mov %esp,%eax
2: 5b pop %rbx
3: 5d pop %rbp
4: 41 5c pop %r12
6: 41 5d pop %r13
8: 41 5e pop %r14
a: 41 5f pop %r15
c: e9 5a 83 88 03 jmpq 0x388836b
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 49 8d 6f 58 lea 0x58(%r15),%rbp
1f: 48 89 ea mov %rbp,%rdx
22: 48 c1 ea 03 shr $0x3,%rdx
26: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
* 2a: 0f 85 a6 1a 00 00 jne 0x1ad6 <-- trapping instruction
30: 49 8b 47 58 mov 0x58(%r15),%rax
34: 4d 8d 6f 48 lea 0x48(%r15),%r13
38: 4c 89 ea mov %r13,%rdx
3b: 48 89 04 24 mov %rax,(%rsp)
3f: 48 rex.W