Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
tmpfs: Unknown parameter 'uid>00000000000000000000'
CPU: 0 UID: 0 PID: 3979 Comm: syz-executor.5 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff88801764ee30 EFLAGS: 00010012
RAX: dffffc0000000000 RBX: ffff888009648640 RCX: ffffffff817e33ce
RDX: 0000000000000001 RSI: ffffffff817e34a6 RDI: 0000000000000009
RBP: ffffe8ffffc16778 R08: ffffffff85ca3e40 R09: ffffed1002ec9e0d
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8880096486a0 R15: ffff8880096486d8
FS:  00007fe84df15700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000001c5ff000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 event_sched_in+0x446/0xb60
 merge_sched_in+0xb4d/0x1810
 visit_groups_merge.constprop.0.isra.0+0x8d1/0x1150
 ctx_sched_in+0x579/0x9b0
 perf_event_sched_in+0x5d/0x90
 __perf_event_task_sched_in+0x2ec/0x5e0
 finish_task_switch.isra.0+0x410/0x840
 __schedule+0xe86/0x3590
 __cond_resched+0x4c/0x80
 down_write+0x72/0x1f0
 ext4_xattr_set_handle+0x153/0x14c0
 ext4_initxattrs+0xb9/0x120
 security_inode_init_security+0x26d/0x390
 __ext4_new_inode+0x3452/0x4d70
 ext4_create+0x2e2/0x4e0
 lookup_open.isra.0+0x10f8/0x1530
 path_openat+0xc26/0x2880
 do_filp_open+0x1e8/0x450
 do_sys_openat2+0x104/0x1b0
 __x64_sys_creat+0xcc/0x120
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe85099fb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe84df15188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007fe850ab2f60 RCX: 00007fe85099fb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200003c0
RBP: 00007fe8509f9f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffaefec93f R14: 00007fe84df15300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff88801764ee30 EFLAGS: 00010012
RAX: dffffc0000000000 RBX: ffff888009648640 RCX: ffffffff817e33ce
RDX: 0000000000000001 RSI: ffffffff817e34a6 RDI: 0000000000000009
RBP: ffffe8ffffc16778 R08: ffffffff85ca3e40 R09: ffffed1002ec9e0d
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8880096486a0 R15: ffff8880096486d8
FS:  00007fe84df15700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000001c5ff000 CR4: 0000000000350ef0
note: syz-executor.5[3979] exited with irqs disabled
tmpfs: Unknown parameter 'uid>00000000000000000000'
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 3a                	test   %edi,(%rdx)
   4:	01 00                	add    %eax,(%rax)
   6:	00 4c 89 75          	add    %cl,0x75(%rcx,%rcx,4)
   a:	00 4d 85             	add    %cl,-0x7b(%rbp)
   d:	ed                   	in     (%dx),%eax
   e:	74 2a                	je     0x3a
  10:	e8 da b2 f5 ff       	callq  0xfff5b2ef
  15:	49 8d 7d 08          	lea    0x8(%r13),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 df 00 00 00    	jne    0x113
  34:	4d 89 75 08          	mov    %r14,0x8(%r13)
  38:	eb 03                	jmp    0x3d
  3a:	45 31 e4             	xor    %r12d,%r12d
  3d:	e8                   	.byte 0xe8
  3e:	ad                   	lods   %ds:(%rsi),%eax
  3f:	b2                   	.byte 0xb2