------------[ cut here ]------------ AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): WARNING: security/apparmor/lib.c:508 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:508, CPU#1: syz.0.17/6101 Modules linked in: CPU: 1 UID: 0 PID: 6101 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:508 Code: 85 ed 7e 4d e8 a6 e2 33 fd 5b 41 5c 41 5e 41 5f 5d e9 c9 0d 5d 07 cc e8 93 e2 33 fd 48 8d 3d fc 3a 12 0c 48 c7 c6 c1 b6 6b 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 76 e2 33 fd 48 8d 3d ef 3a 12 0c RSP: 0018:ffffc90003256a00 EFLAGS: 00010293 RAX: ffffffff8493fddd RBX: ffff88802c7e6400 RCX: ffff8880263a1f40 RDX: 0000000000000000 RSI: ffffffff8e6bb6c1 RDI: ffffffff90a638e0 RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1e15c67 R12: dead000000000122 R13: ffff88802c7e6400 R14: ffff88802c7e6428 R15: dffffc0000000000 FS: 0000555571106500(0000) GS:ffff88812498a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555711067d0 CR3: 0000000070304000 CR4: 00000000003526f0 Call Trace: aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:335 aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:417 unpack_profile security/apparmor/policy_unpack.c:1154 [inline] aa_unpack+0x17e8/0x7500 security/apparmor/policy_unpack.c:1751 aa_replace_profiles+0x24a/0x2ab0 security/apparmor/policy.c:1199 policy_update+0x3a9/0x640 security/apparmor/apparmorfs.c:673 profile_replace+0x1cb/0x320 security/apparmor/apparmorfs.c:709 vfs_write+0x296/0xba0 fs/read_write.c:685 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb8e919e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffce1e938c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fb8e9425fa0 RCX: 00007fb8e919e0d9 RDX: 0000000000000052 RSI: 0000200000000300 RDI: 0000000000000003 RBP: 00007ffce1e93930 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fb8e9425fac R14: 00007fb8e9425fa0 R15: 00007fb8e9425fa0 ---------------- Code disassembly (best guess): 0: 85 ed test %ebp,%ebp 2: 7e 4d jle 0x51 4: e8 a6 e2 33 fd call 0xfd33e2af 9: 5b pop %rbx a: 41 5c pop %r12 c: 41 5e pop %r14 e: 41 5f pop %r15 10: 5d pop %rbp 11: e9 c9 0d 5d 07 jmp 0x75d0ddf 16: cc int3 17: e8 93 e2 33 fd call 0xfd33e2af 1c: 48 8d 3d fc 3a 12 0c lea 0xc123afc(%rip),%rdi # 0xc123b1f 23: 48 c7 c6 c1 b6 6b 8e mov $0xffffffff8e6bb6c1,%rsi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e9 04 ff ff ff jmp 0xffffff38 34: e8 76 e2 33 fd call 0xfd33e2af 39: 48 8d 3d ef 3a 12 0c lea 0xc123aef(%rip),%rdi # 0xc123b2f