general protection fault in percpu_ref_get

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	BUG: unable to handle kernel paging request in percpu_ref_get_many (2) cgroups mm	8				16	12d	49d	0/29	upstream: reported on 2025/05/25 00:43
upstream	BUG: unable to handle kernel paging request in percpu_ref_get_many cgroups mm	8				3	918d	990d	0/29	auto-obsoleted due to no activity on 2023/04/06 05:44
EXT4-fs error (device loop0): ext4_lookup:1813: inode #13: comm syz.0.0: iget: bad extended attribute block 7177
Oops: general protection fault, probably for non-canonical address 0xec2c282c2c2c2c2c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x6161616161616160-0x6161616161616167]
CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.14.0-rc5-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many+0x8e/0x140 include/linux/percpu-refcount.h:204
Code: 01 48 c7 c7 00 bf 37 8c be 53 03 00 00 48 c7 c2 40 bf 37 8c e8 13 37 6b ff 49 bc 00 00 00 00 00 fc ff df 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 13 18 f7 ff 48 8b 03 a8 03 75 62
RSP: 0018:ffffc9000d177678 EFLAGS: 00010002
RAX: 0c2c2c2c2c2c2c2c RBX: 6161616161616161 RCX: ffff88800079a440
RDX: dffffc0000000000 RSI: ffffffff8c80efc0 RDI: ffffffff8c80ef80
RBP: ffffc9000d177798 R08: ffffffff94549847 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffff8231e1d9
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000045e2c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
 obj_cgroup_get include/linux/memcontrol.h:764 [inline]
 refill_obj_stock+0x232/0x650 mm/memcontrol.c:2870
 obj_cgroup_uncharge mm/memcontrol.c:2936 [inline]
 __memcg_slab_free_hook+0x1df/0x310 mm/memcontrol.c:3023
 memcg_slab_free_hook mm/slub.c:2178 [inline]
 slab_free mm/slub.c:4606 [inline]
 kmem_cache_free+0x222/0x410 mm/slub.c:4711
 sk_prot_free net/core/sock.c:2215 [inline]
 __sk_destruct+0x4fd/0x690 net/core/sock.c:2312
 sock_put include/net/sock.h:1914 [inline]
 smc_release+0x410/0x540 net/smc/af_smc.c:352
 __sock_release net/socket.c:647 [inline]
 sock_close+0xbc/0x240 net/socket.c:1398
 __fput+0x3e9/0x9f0 fs/file_table.c:464
 task_work_run+0x24f/0x310 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xa2a/0x28e0 kernel/exit.c:938
 do_group_exit+0x207/0x2c0 kernel/exit.c:1087
 get_signal+0x168c/0x1720 kernel/signal.c:3036
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6ba4b8d169
Code: Unable to access opcode bytes at 0x7f6ba4b8d13f.
RSP: 002b:00007f6ba5a1e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000050
RAX: ffffffffffffff8b RBX: 00007f6ba4da6080 RCX: 00007f6ba4b8d169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000400000000140
RBP: 00007f6ba4c0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f6ba4da6080 R15: 00007ffebebb2d88
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many+0x8e/0x140 include/linux/percpu-refcount.h:204
Code: 01 48 c7 c7 00 bf 37 8c be 53 03 00 00 48 c7 c2 40 bf 37 8c e8 13 37 6b ff 49 bc 00 00 00 00 00 fc ff df 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 13 18 f7 ff 48 8b 03 a8 03 75 62
RSP: 0018:ffffc9000d177678 EFLAGS: 00010002
RAX: 0c2c2c2c2c2c2c2c RBX: 6161616161616161 RCX: ffff88800079a440
RDX: dffffc0000000000 RSI: ffffffff8c80efc0 RDI: ffffffff8c80ef80
RBP: ffffc9000d177798 R08: ffffffff94549847 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffff8231e1d9
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000045e2c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 c7 c7 00 bf 37 8c 	mov    $0xffffffff8c37bf00,%rdi
   7:	be 53 03 00 00       	mov    $0x353,%esi
   c:	48 c7 c2 40 bf 37 8c 	mov    $0xffffffff8c37bf40,%rdx
  13:	e8 13 37 6b ff       	call   0xff6b372b
  18:	49 bc 00 00 00 00 00 	movabs $0xdffffc0000000000,%r12
  1f:	fc ff df
  22:	48 89 d8             	mov    %rbx,%rax
  25:	48 c1 e8 03          	shr    $0x3,%rax
* 29:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	48 89 df             	mov    %rbx,%rdi
  33:	e8 13 18 f7 ff       	call   0xfff7184b
  38:	48 8b 03             	mov    (%rbx),%rax
  3b:	a8 03                	test   $0x3,%al
  3d:	75 62                	jne    0xa1