------------[ cut here ]------------
AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): 
WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x78/0x1f0 security/apparmor/lib.c:509, CPU#0: syz.1.566/8250
Modules linked in:

CPU: 0 UID: 0 PID: 8250 Comm: syz.1.566 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:aa_policy_destroy+0x7f/0x1f0 security/apparmor/lib.c:509
Code: 00 0f 85 88 01 00 00 48 b8 22 01 00 00 00 00 ad de 48 39 43 28 74 18 e8 df b4 31 fd 48 8d 3d e8 f6 74 0c 48 c7 c6 c0 12 57 8c <67> 48 0f b9 3a e8 c7 b4 31 fd 48 8d 6b 10 48 b8 00 00 00 00 00 fc
RSP: 0018:ffffc900035df678 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888051414c00 RCX: 0000000000000000
RDX: ffff8880248bcb00 RSI: ffffffff8c5712c0 RDI: ffffffff914d7da0
RBP: ffff888051414c20 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000dc0
FS:  0000000000000000(0000) GS:ffff8880969bd000(0063) knlGS:00000000f53e6b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7f24000 CR3: 000000006ebf5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 aa_free_profile security/apparmor/policy.c:334 [inline]
 aa_free_profile+0x82/0xca0 security/apparmor/policy.c:324
 aa_alloc_profile+0x3ae/0x520 security/apparmor/policy.c:416
 unpack_profile+0x3ed/0x4510 security/apparmor/policy_unpack.c:1153
 aa_unpack+0x39e/0x1240 security/apparmor/policy_unpack.c:1748
 aa_replace_profiles+0x176/0x31c0 security/apparmor/policy.c:1183
 policy_update+0x20b/0x340 security/apparmor/apparmorfs.c:505
 profile_load+0xaa/0x1a0 security/apparmor/apparmorfs.c:522
 vfs_write+0x2aa/0x1050 fs/read_write.c:685
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f23fec
Code: Unable to access opcode bytes at 0xf7f23fc2.
RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400
RDX: 000000000000003a RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 88 01 00 00 48    	test   %ecx,0x48000001(%rax)
   8:	b8 22 01 00 00       	mov    $0x122,%eax
   d:	00 00                	add    %al,(%rax)
   f:	ad                   	lods   %ds:(%rsi),%eax
  10:	de 48 39             	fimuls 0x39(%rax)
  13:	43 28 74 18 e8       	sub    %sil,-0x18(%r8,%r11,1)
  18:	df b4 31 fd 48 8d 3d 	fbstp  0x3d8d48fd(%rcx,%rsi,1)
  1f:	e8 f6 74 0c 48       	call   0x480c751a
  24:	c7 c6 c0 12 57 8c    	mov    $0x8c5712c0,%esi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e8 c7 b4 31 fd       	call   0xfd31b4fb
  34:	48 8d 6b 10          	lea    0x10(%rbx),%rbp
  38:	48                   	rex.W
  39:	b8 00 00 00 00       	mov    $0x0,%eax
  3e:	00 fc                	add    %bh,%ah