TITLE: general protection fault in __aa_lookupn_ns
ALT: bad-access in __aa_lookupn_ns
TYPE: DoS

[  234.220213] kasan: GPF could be caused by NULL-ptr deref or user memory access
[  234.245620] general protection fault: 0000 [#1] PREEMPT SMP KASAN
[  234.251890] CPU: 0 PID: 10175 Comm: syz-executor1 Not tainted 4.19.0-rc5+ #251
[  234.259274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
22:45:50 executing program 5:
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff)
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000200))
futex(&(0x7f00000001c0)=0x100000000000000, 0xc, 0x0, &(0x7f0000000040), &(0x7f0000004000), 0x0)
ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, &(0x7f0000000100))
ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, &(0x7f0000000080))
ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f0000000300)={0x0, 0x1})

[  234.268662] RIP: 0010:memcmp+0x28/0x160
[  234.272658] Code: 00 00 48 85 d2 0f 84 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 f9 48 89 e5 48 c1 e9 03 41 54 53 48 89 fb 48 83 ec 18 <0f> b6 04 01 48 89 f9 83 e1 07 38 c8 7f 08 84 c0 0f 85 98 00 00 00
[  234.291571] RSP: 0018:ffff88019a51ef98 EFLAGS: 00010292
[  234.296960] RAX: dffffc0000000000 RBX: 1ffff100334a3e4f RCX: 03fffe20066947c9
[  234.302554] kobject: 'loop5' (00000000d5f15f89): kobject_uevent_env
[  234.304236] RDX: 0000000000000002 RSI: ffffffff883f7980 RDI: 1ffff100334a3e4f
[  234.304247] RBP: ffff88019a51efc0 R08: ffff8801b9432640 R09: ffffed003b5a4732
[  234.304256] R10: ffffed003b5a4732 R11: ffff8801dad23993 R12: 0000000000000002
[  234.304267] R13: ffffffff883f7980 R14: 1fff7901cd9c319f R15: dffffc0000000000
[  234.304284] FS:  00007f3dde3f8700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
[  234.310800] kobject: 'loop5' (00000000d5f15f89): fill_kobj_path: path = '/devices/virtual/block/loop5'
[  234.317944] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  234.317955] CR2: 0000000000413720 CR3: 00000001bcd8e000 CR4: 00000000001406f0
22:45:50 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff)
ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000000))
sched_setscheduler(0x0, 0x5, &(0x7f0000000200))
getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4, "39fe0cf1"}, &(0x7f00000000c0)=0x28)

[  234.317967] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  234.317977] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  234.317982] Call Trace:
[  234.318005]  ? _raw_spin_unlock_irq+0x27/0x80
[  234.318022]  strnstr+0x4b/0x70
[  234.382961] kobject: 'loop3' (00000000a906aecd): kobject_uevent_env
[  234.385162]  __aa_lookupn_ns+0xc1/0x570
[  234.385197]  ? compat_start_thread+0x80/0x80
[  234.387895] kobject: 'loop3' (00000000a906aecd): fill_kobj_path: path = '/devices/virtual/block/loop3'
[  234.392265]  ? aa_find_ns+0x30/0x30
[  234.392323]  ? lock_acquire+0x1ed/0x520
[  234.392343]  ? __aa_lookupn_ns+0x570/0x570
[  234.412577] kobject: 'loop4' (00000000324e1a6e): kobject_uevent_env
[  234.419700]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  234.419716]  ? check_preemption_disabled+0x48/0x200
[  234.419734]  ? kasan_check_read+0x11/0x20
[  234.419757]  ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160
[  234.438733] kobject: 'loop4' (00000000324e1a6e): fill_kobj_path: path = '/devices/virtual/block/loop4'
[  234.443494]  ? __switch_to_asm+0x34/0x70
[  234.443512]  ? rcu_bh_qs+0xc0/0xc0
[  234.443534]  ? print_usage_bug+0xc0/0xc0
[  234.479004]  ? __switch_to_asm+0x34/0x70
[  234.483070]  ? __switch_to_asm+0x40/0x70
[  234.487144]  aa_lookupn_ns+0x88/0x1e0
[  234.490954]  aa_fqlookupn_profile+0x1b9/0x1010
[  234.495549]  ? aa_lookup_profile+0x30/0x30
[  234.499275] kobject: 'loop5' (00000000d5f15f89): kobject_uevent_env
[  234.499836]  ? __lock_acquire+0x7ec/0x4ec0
[  234.499861]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  234.499883]  ? refcount_inc_not_zero_checked+0x1e5/0x2f0
[  234.508993] kobject: 'loop5' (00000000d5f15f89): fill_kobj_path: path = '/devices/virtual/block/loop5'
[  234.510517]  ? refcount_add_not_zero_checked+0x330/0x330
[  234.510534]  ? mark_held_locks+0x130/0x130
[  234.510575]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  234.546123]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  234.551653]  fqlookupn_profile+0x80/0xc0
[  234.555728]  aa_label_strn_parse+0xa3a/0x1230
[  234.560226]  ? aa_label_printk+0x850/0x850
[  234.564447]  ? zap_class+0x640/0x640
[  234.568165]  ? __might_sleep+0x95/0x190
[  234.572125]  ? graph_lock+0x170/0x170
[  234.575923]  ? __lock_acquire+0x7ec/0x4ec0
[  234.580153]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  234.585691]  ? refcount_inc_not_zero_checked+0x1e5/0x2f0
[  234.591127]  ? refcount_add_not_zero_checked+0x330/0x330
[  234.596565]  ? graph_lock+0x170/0x170
[  234.600358]  ? find_held_lock+0x36/0x1c0
[  234.604409]  aa_label_parse+0x42/0x50
[  234.608195]  aa_change_profile+0x513/0x3510
[  234.612517]  ? lock_acquire+0x1ed/0x520
[  234.616509]  ? aa_change_hat+0x1a20/0x1a20
[  234.620750]  ? is_bpf_text_address+0xd3/0x170
[  234.625236]  ? __mutex_lock+0x85e/0x1700
[  234.629291]  ? debug_smp_processor_id+0x1c/0x20
[  234.633980]  ? perf_trace_lock+0x14d/0x7a0
[  234.638224]  ? proc_pid_attr_write+0x28a/0x540
[  234.642798]  ? mutex_trylock+0x2b0/0x2b0
[  234.646843]  ? save_stack+0xa9/0xd0
[  234.650464]  ? save_stack+0x43/0xd0
[  234.654088]  ? kasan_kmalloc+0xc7/0xe0
[  234.657958]  ? __kmalloc_track_caller+0x14a/0x750
[  234.662787]  ? memdup_user+0x2c/0xa0
[  234.666486]  ? proc_pid_attr_write+0x198/0x540
[  234.671050]  ? graph_lock+0x170/0x170
[  234.674838]  ? __x64_sys_write+0x73/0xb0
[  234.678883]  ? graph_lock+0x170/0x170
[  234.682667]  ? mark_held_locks+0x130/0x130
[  234.686905]  apparmor_setprocattr+0xaa4/0x1150
[  234.691492]  ? apparmor_task_kill+0xcb0/0xcb0
[  234.695972]  ? lock_downgrade+0x900/0x900
[  234.700106]  ? arch_local_save_flags+0x40/0x40
[  234.704686]  security_setprocattr+0x66/0xc0
[  234.708994]  proc_pid_attr_write+0x301/0x540
[  234.713390]  __vfs_write+0x119/0x9f0
[  234.717092]  ? check_preemption_disabled+0x48/0x200
[  234.722091]  ? proc_loginuid_write+0x4f0/0x4f0
[  234.726659]  ? kernel_read+0x120/0x120
[  234.730541]  ? __lock_is_held+0xb5/0x140
[  234.734597]  ? rcu_read_lock_sched_held+0x108/0x120
[  234.739604]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  234.745137]  ? __sb_start_write+0x1b2/0x370
[  234.749448]  vfs_write+0x1fc/0x560
[  234.753002]  ksys_write+0x101/0x260
[  234.756631]  ? __ia32_sys_read+0xb0/0xb0
[  234.760687]  ? __bpf_trace_preemptirq_template+0x30/0x30
[  234.766134]  __x64_sys_write+0x73/0xb0
[  234.770007]  do_syscall_64+0x1b9/0x820
[  234.773880]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  234.779228]  ? syscall_return_slowpath+0x5e0/0x5e0
[  234.784155]  ? trace_hardirqs_on_caller+0x310/0x310
[  234.789167]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  234.794202]  ? recalc_sigpending_tsk+0x180/0x180
[  234.798958]  ? kasan_check_write+0x14/0x20
[  234.803189]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  234.808025]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  234.813215] RIP: 0033:0x457679
[  234.816413] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  234.835326] RSP: 002b:00007f3dde3f7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  234.843043] RAX: ffffffffffffffda RBX: 00007f3dde3f86d4 RCX: 0000000000457679
[  234.850327] RDX: 0000000000000009 RSI: 0000000020000040 RDI: 0000000000000003
[  234.857591] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  234.864851] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[  234.872119] R13: 00000000004d8f38 R14: 00000000004c55ed R15: 0000000000000000
[  234.879409] Modules linked in:
[  234.886076] ---[ end trace 1246d7b16c2c67d7 ]---
[  234.891053] RIP: 0010:memcmp+0x28/0x160
[  234.895200] Code: 00 00 48 85 d2 0f 84 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 f9 48 89 e5 48 c1 e9 03 41 54 53 48 89 fb 48 83 ec 18 <0f> b6 04 01 48 89 f9 83 e1 07 38 c8 7f 08 84 c0 0f 85 98 00 00 00
[  234.914432] RSP: 0018:ffff88019a51ef98 EFLAGS: 00010292
[  234.921713] RAX: dffffc0000000000 RBX: 1ffff100334a3e4f RCX: 03fffe20066947c9
[  234.930241] RDX: 0000000000000002 RSI: ffffffff883f7980 RDI: 1ffff100334a3e4f
[  234.938244] RBP: ffff88019a51efc0 R08: ffff8801b9432640 R09: ffffed003b5a4732
[  234.945594] R10: ffffed003b5a4732 R11: ffff8801dad23993 R12: 0000000000000002
[  234.952867] R13: ffffffff883f7980 R14: 1fff7901cd9c319f R15: dffffc0000000000
[  234.960188] FS:  00007f3dde3f8700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
