Oops: general protection fault, probably for non-canonical address 0xdffffc001fffe000: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x00000000ffff0000-0x00000000ffff0007] CPU: 0 UID: 0 PID: 13538 Comm: dhcpcd-run-hook Not tainted 6.15.0-rc4-syzkaller-00163-ge8716b5b0dff #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline] RIP: 0010:percpu_ref_get_many+0x8d/0x140 include/linux/percpu-refcount.h:204 Code: 01 48 c7 c7 40 10 78 8b be 4b 03 00 00 48 c7 c2 80 10 78 8b e8 c4 0e 74 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 74 8b f7 ff 49 8b 07 a8 03 75 62 RSP: 0018:ffffc900045ef318 EFLAGS: 00010006 RAX: 000000001fffe000 RBX: ffffffff822a2959 RCX: 027e029601ed9300 RDX: 0000000000000000 RSI: ffffffff8bc1cdc0 RDI: ffffffff8bc1cd80 RBP: ffffc900045ef438 R08: 0000000000000000 R09: 0000000000080000 R10: 0000000000000000 R11: ffffffff822a2959 R12: dffffc0000000000 R13: 00000000ffff0000 R14: 0000000000000001 R15: 00000000ffff0000 FS: 0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564c95fd0950 CR3: 000000006bc4e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: percpu_ref_get include/linux/percpu-refcount.h:222 [inline] obj_cgroup_get include/linux/memcontrol.h:760 [inline] replace_stock_objcg mm/memcontrol.c:2774 [inline] refill_obj_stock+0x265/0x790 mm/memcontrol.c:2952 obj_cgroup_uncharge mm/memcontrol.c:3015 [inline] __memcg_slab_free_hook+0x1ff/0x330 mm/memcontrol.c:3102 memcg_slab_free_hook mm/slub.c:2223 [inline] slab_free mm/slub.c:4653 [inline] kmem_cache_free+0x21b/0x3f0 mm/slub.c:4758 anon_vma_chain_free mm/rmap.c:147 [inline] unlink_anon_vmas+0x614/0x670 mm/rmap.c:447 free_pgtables+0x45d/0x710 mm/memory.c:391 exit_mmap+0x46c/0xba0 mm/mmap.c:1295 __mmput+0x118/0x420 kernel/fork.c:1379 exec_mmap+0x6ac/0x7d0 fs/exec.c:1009 begin_new_exec+0x129c/0x2120 fs/exec.c:1264 load_elf_binary+0x973/0x27b0 fs/binfmt_elf.c:1001 search_binary_handler fs/exec.c:1778 [inline] exec_binprm fs/exec.c:1810 [inline] bprm_execve+0x999/0x1440 fs/exec.c:1862 do_execveat_common+0x510/0x6a0 fs/exec.c:1968 do_execve fs/exec.c:2042 [inline] __do_sys_execve fs/exec.c:2118 [inline] __se_sys_execve fs/exec.c:2113 [inline] __x64_sys_execve+0x94/0xb0 fs/exec.c:2113 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9ec0a0fef7 Code: Unable to access opcode bytes at 0x7f9ec0a0fecd. RSP: 002b:00007ffe636d3958 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 0000564c95fe1e28 RCX: 00007f9ec0a0fef7 RDX: 0000564c95fe1e48 RSI: 0000564c95fe1e28 RDI: 0000564c95fe1ed0 RBP: 0000564c95fe1ed0 R08: 0000564c95fe1ed5 R09: 00007ffe636d5e87 R10: 0000000000000008 R11: 0000000000000246 R12: 0000564c95fe1e48 R13: 00007f9ec0bbd904 R14: 0000564c95fe1e48 R15: 0000000000000000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline] RIP: 0010:percpu_ref_get_many+0x8d/0x140 include/linux/percpu-refcount.h:204 Code: 01 48 c7 c7 40 10 78 8b be 4b 03 00 00 48 c7 c2 80 10 78 8b e8 c4 0e 74 ff 49 bc 00 00 00 00 00 fc ff df 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 74 8b f7 ff 49 8b 07 a8 03 75 62 RSP: 0018:ffffc900045ef318 EFLAGS: 00010006 RAX: 000000001fffe000 RBX: ffffffff822a2959 RCX: 027e029601ed9300 RDX: 0000000000000000 RSI: ffffffff8bc1cdc0 RDI: ffffffff8bc1cd80 RBP: ffffc900045ef438 R08: 0000000000000000 R09: 0000000000080000 R10: 0000000000000000 R11: ffffffff822a2959 R12: dffffc0000000000 R13: 00000000ffff0000 R14: 0000000000000001 R15: 00000000ffff0000 FS: 0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ec0a0fecd CR3: 000000006bc4e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 01 48 c7 add %ecx,-0x39(%rax) 3: c7 40 10 78 8b be 4b movl $0x4bbe8b78,0x10(%rax) a: 03 00 add (%rax),%eax c: 00 48 c7 add %cl,-0x39(%rax) f: c2 80 10 ret $0x1080 12: 78 8b js 0xffffff9f 14: e8 c4 0e 74 ff call 0xff740edd 19: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 20: fc ff df 23: 4c 89 f8 mov %r15,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 ff mov %r15,%rdi 34: e8 74 8b f7 ff call 0xfff78bad 39: 49 8b 07 mov (%r15),%rax 3c: a8 03 test $0x3,%al 3e: 75 62 jne 0xa2