[syzbot] [fs?] upstream test error: BUG: unable to handle kernel paging request in put_links

[syzbot <syzbot+be35ef678b99e18dae51@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    05dbaf8dd8bf Merge tag 'x86-urgent-2025-01-28' of git://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=168d3918580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ccb9b8c423893ece
dashboard link: https://syzkaller.appspot.com/bug?extid=be35ef678b99e18dae51
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/05c0efec0249/disk-05dbaf8d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fcabe68eb297/vmlinux-05dbaf8d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/15bb26e810d5/bzImage-05dbaf8d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+be35ef678b99e18dae51@syzkaller.appspotmail.com

BUG: unable to handle page fault for address: 00006c656e72656b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.13.0-syzkaller-09338-g05dbaf8dd8bf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: events free_ipc
RIP: 0010:strlen+0x38/0x90 lib/string.c:413
Code: 41 54 53 48 89 fb 49 c7 c6 ff ff ff ff e8 d0 68 5c f2 49 89 c7 41 b4 01 eb 0b 48 ff c3 49 ff c6 45 84 ed 74 31 45 84 e4 74 23 <44> 0f b6 2b 48 89 df e8 6c 5a 5c f2 0f b6 00 84 c0 74 dd f6 d0 44
RSP: 0018:ffff888100273858 EFLAGS: 00010202
RAX: ffff88810025ac08 RBX: 00006c656e72656b RCX: 0000000000000000
RDX: ffff88801d513538 RSI: ffff88813fffaaf0 RDI: 00006c656e72656b
RBP: ffff888100273880 R08: ffffea000000000f R09: ffffffff82d145f0
R10: 0000000000000002 R11: ffff88810025a0c0 R12: 0000000000000001
R13: 0000000000000000 R14: ffffffffffffffff R15: ffff88810025ac08
FS:  0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00006c656e72656b CR3: 00000000134c8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 put_links+0x226/0x9d0 fs/proc/proc_sysctl.c:1490
 drop_sysctl_table+0x10d/0x4f0 fs/proc/proc_sysctl.c:1512
 drop_sysctl_table+0x4b6/0x4f0 fs/proc/proc_sysctl.c:1520
 unregister_sysctl_table+0x48/0x70 fs/proc/proc_sysctl.c:1538
 retire_ipc_sysctls+0x67/0xc0 ipc/ipc_sysctl.c:310
 free_ipc_ns ipc/namespace.c:160 [inline]
 free_ipc+0x1d6/0x4c0 ipc/namespace.c:181
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3317
 worker_thread+0xea7/0x14f0 kernel/workqueue.c:3398
 kthread+0x6b9/0xef0 kernel/kthread.c:464
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
CR2: 00006c656e72656b
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x38/0x90 lib/string.c:413
Code: 41 54 53 48 89 fb 49 c7 c6 ff ff ff ff e8 d0 68 5c f2 49 89 c7 41 b4 01 eb 0b 48 ff c3 49 ff c6 45 84 ed 74 31 45 84 e4 74 23 <44> 0f b6 2b 48 89 df e8 6c 5a 5c f2 0f b6 00 84 c0 74 dd f6 d0 44
RSP: 0018:ffff888100273858 EFLAGS: 00010202
RAX: ffff88810025ac08 RBX: 00006c656e72656b RCX: 0000000000000000
RDX: ffff88801d513538 RSI: ffff88813fffaaf0 RDI: 00006c656e72656b
RBP: ffff888100273880 R08: ffffea000000000f R09: ffffffff82d145f0
R10: 0000000000000002 R11: ffff88810025a0c0 R12: 0000000000000001
R13: 0000000000000000 R14: ffffffffffffffff R15: ffff88810025ac08
FS:  0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00006c656e72656b CR3: 00000000134c8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	41 54                	push   %r12
   2:	53                   	push   %rbx
   3:	48 89 fb             	mov    %rdi,%rbx
   6:	49 c7 c6 ff ff ff ff 	mov    $0xffffffffffffffff,%r14
   d:	e8 d0 68 5c f2       	call   0xf25c68e2
  12:	49 89 c7             	mov    %rax,%r15
  15:	41 b4 01             	mov    $0x1,%r12b
  18:	eb 0b                	jmp    0x25
  1a:	48 ff c3             	inc    %rbx
  1d:	49 ff c6             	inc    %r14
  20:	45 84 ed             	test   %r13b,%r13b
  23:	74 31                	je     0x56
  25:	45 84 e4             	test   %r12b,%r12b
  28:	74 23                	je     0x4d
* 2a:	44 0f b6 2b          	movzbl (%rbx),%r13d <-- trapping instruction
  2e:	48 89 df             	mov    %rbx,%rdi
  31:	e8 6c 5a 5c f2       	call   0xf25c5aa2
  36:	0f b6 00             	movzbl (%rax),%eax
  39:	84 c0                	test   %al,%al
  3b:	74 dd                	je     0x1a
  3d:	f6 d0                	not    %al
  3f:	44                   	rex.R


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup