------------[ cut here ]------------ AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x78/0x1f0 security/apparmor/lib.c:509, CPU#0: syz.3.584/8672 Modules linked in: CPU: 0 UID: 0 PID: 8672 Comm: syz.3.584 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:aa_policy_destroy+0x7f/0x1f0 security/apparmor/lib.c:509 Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 ef 1d 2d fd 48 8d 3d 28 66 71 0c 48 c7 c6 c0 8d 57 8c <67> 48 0f b9 3a e8 d7 1d 2d fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc RSP: 0018:ffffc90006d4f678 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8880729b1800 RCX: 0000000000000000 RDX: ffff88802a2c8000 RSI: ffffffff8c578dc0 RDI: ffffffff914f6890 RBP: ffff8880729b1820 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0 FS: 0000000000000000(0000) GS:ffff888096976000(0063) knlGS:00000000f5426b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f5444ff4 CR3: 00000000536e8000 CR4: 0000000000352ef0 Call Trace: aa_free_profile security/apparmor/policy.c:334 [inline] aa_free_profile+0x82/0xca0 security/apparmor/policy.c:324 aa_alloc_profile+0x3ae/0x520 security/apparmor/policy.c:416 unpack_profile+0x3ed/0x4510 security/apparmor/policy_unpack.c:1153 aa_unpack+0x39e/0x1240 security/apparmor/policy_unpack.c:1748 aa_replace_profiles+0x176/0x31c0 security/apparmor/policy.c:1183 policy_update+0x20b/0x340 security/apparmor/apparmorfs.c:505 profile_replace+0xaa/0x1a0 security/apparmor/apparmorfs.c:540 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f62fec Code: Unable to access opcode bytes at 0xf7f62fc2. RSP: 002b:00000000f542650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---------------- Code disassembly (best guess): 0: 00 0f add %cl,(%rdi) 2: 85 88 01 00 00 48 test %ecx,0x48000001(%rax) 8: b8 22 01 00 00 mov $0x122,%eax d: 00 00 add %al,(%rax) f: ad lods %ds:(%rsi),%eax 10: de 48 39 fimuls 0x39(%rax) 13: 43 28 74 18 e8 sub %sil,-0x18(%r8,%r11,1) 18: ef out %eax,(%dx) 19: 1d 2d fd 48 8d sbb $0x8d48fd2d,%eax 1e: 3d 28 66 71 0c cmp $0xc716628,%eax 23: 48 c7 c6 c0 8d 57 8c mov $0xffffffff8c578dc0,%rsi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e8 d7 1d 2d fd call 0xfd2d1e0b 34: 48 8d 6b 10 lea 0x10(%rbx),%rbp 38: 48 rex.W 39: b8 00 00 00 00 mov $0x0,%eax 3e: 00 fc add %bh,%ah