------------[ cut here ]------------
WARNING: CPU: 0 PID: 6038 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 6038 Comm: syz.3.11752 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 4d 97 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 d0 93 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000007900 EFLAGS: 00010006
RAX: ffffffff81a068e0 RBX: 0000000000000008 RCX: ffff8880187cd940
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff8880187cd947 R09: 1ffff110030f9b28
R10: dffffc0000000000 R11: ffffed10030f9b29 R12: ffff8880187cf0c8
R13: 00007ffffffff000 R14: ffffc90000007970 R15: 0000000020000000
FS: 00007f35492a56c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7ec78dd7c0 CR3: 00000000228f4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_0cbb63436c8cf2ed_F+0x2c/0xf80
bpf_prog_b39d892d470ad88b+0x18/0xd38
bpf_dispatcher_nop_func include/linux/bpf.h:889 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
bpf_overflow_handler+0x1c2/0x4a0 kernel/events/core.c:10297
__perf_event_overflow+0x35f/0x550 kernel/events/core.c:9515
perf_swevent_hrtimer+0x3c2/0x550 kernel/events/core.c:10934
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x4b0/0xb60 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:finish_lock_switch+0x12f/0x290 kernel/sched/core.c:4804
Code: 83 c7 18 be ff ff ff ff e8 6e cb 6b 08 85 c0 74 46 4d 85 ff 75 62 0f 1f 44 00 00 48 89 df e8 98 3a 75 08 e8 43 d7 2a 00 fb 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 48 89 df e8 2f 0e fe ff 43 80 3c 2c
RSP: 0018:ffffc9000318f318 EFLAGS: 00000282
RAX: 8f4322d979160600 RBX: ffff8880298a0000 RCX: 8f4322d979160600
RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: ffffffff8a7a4200
RBP: 1ffff11017207613 R08: ffffffff901ee0cf R09: 1ffffffff203dc19
R10: dffffc0000000000 R11: fffffbfff203dc1a R12: 1ffff110172075c1
R13: dffffc0000000000 R14: ffff8880b903ae08 R15: 0000000000000000
finish_task_switch+0x12f/0x650 kernel/sched/core.c:4921
context_switch kernel/sched/core.c:5052 [inline]
__schedule+0x11cb/0x4350 kernel/sched/core.c:6395
preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6799
irqentry_exit+0x63/0x70 kernel/entry/common.c:432
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:slab_alloc_node mm/slub.c:3180 [inline]
RIP: 0010:slab_alloc mm/slub.c:3233 [inline]
RIP: 0010:__kmalloc+0x87/0x340 mm/slub.c:4408
Code: 01 00 00 00 4c 89 ff 89 e9 e8 f5 e3 ff ff 48 85 c0 0f 84 dc 00 00 00 49 89 c5 49 8b 45 00 65 48 03 05 cd 94 44 7e 48 8b 50 08 <4c> 8b 20 48 83 78 10 00 0f 95 c0 4d 85 e4 74 43 84 c0 74 45 49 8b
RSP: 0018:ffffc9000318f6e8 EFLAGS: 00000286
RAX: ffff8880b903df90 RBX: ffff888054ba5000 RCX: 0000000000000000
RDX: 000000000014e598 RSI: 0000000000000800 RDI: ffffffff8c3f3820
RBP: 0000000000000dc0 R08: ffffffff8d8b0def R09: 1ffffffff1b161bd
R10: dffffc0000000000 R11: fffffbfff1b161be R12: 0000000000000800
R13: ffff888016c42000 R14: 0000000000000800 R15: ffff888016c42000
kmalloc_array include/linux/slab.h:647 [inline]
kcalloc include/linux/slab.h:676 [inline]
cache_create_net+0x8e/0x250 net/sunrpc/cache.c:1748
nfsd_export_init+0x55/0x1e0 fs/nfsd/export.c:1355
nfsd_init_net+0x29/0x1e0 fs/nfsd/nfsctl.c:1454
ops_init+0x360/0x5f0 net/core/net_namespace.c:138
setup_net+0x39e/0xa10 net/core/net_namespace.c:333
copy_net_ns+0x33e/0x5b0 net/core/net_namespace.c:503
create_new_namespaces+0x3ce/0x700 kernel/nsproxy.c:110
copy_namespaces+0x378/0x3d0 kernel/nsproxy.c:178
copy_process+0x1844/0x3ec0 kernel/fork.c:2294
kernel_clone+0x23f/0x990 kernel/fork.c:2681
__do_sys_clone kernel/fork.c:2798 [inline]
__se_sys_clone kernel/fork.c:2782 [inline]
__x64_sys_clone+0x19a/0x210 kernel/fork.c:2782
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f354b04d0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f35492a4fd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f354b2d4fa0 RCX: 00007f354b04d0d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c0126080
RBP: 00007f354b0e4024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f354b2d5038 R14: 00007f354b2d4fa0 R15: 00007fff0acf2298
----------------
Code disassembly (best guess):
0: 83 c7 18 add $0x18,%edi
3: be ff ff ff ff mov $0xffffffff,%esi
8: e8 6e cb 6b 08 call 0x86bcb7b
d: 85 c0 test %eax,%eax
f: 74 46 je 0x57
11: 4d 85 ff test %r15,%r15
14: 75 62 jne 0x78
16: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1b: 48 89 df mov %rbx,%rdi
1e: e8 98 3a 75 08 call 0x8753abb
23: e8 43 d7 2a 00 call 0x2ad76b
28: fb sti
29: 5b pop %rbx
* 2a: 41 5c pop %r12 <-- trapping instruction
2c: 41 5d pop %r13
2e: 41 5e pop %r14
30: 41 5f pop %r15
32: 5d pop %rbp
33: c3 ret
34: 48 89 df mov %rbx,%rdi
37: e8 2f 0e fe ff call 0xfffe0e6b
3c: 43 rex.XB
3d: 80 .byte 0x80
3e: 3c 2c cmp $0x2c,%al