__get_vm_area_node+0x200/0x2f0 mm/vmalloc.c:3288 __vmalloc_node_range_noprof+0x36e/0x16f0 mm/vmalloc.c:4119 __vmalloc_node_noprof mm/vmalloc.c:4220 [inline] vzalloc_noprof+0xb2/0xe0 mm/vmalloc.c:4298 alloc_counters+0x63/0x5c0 net/ipv4/netfilter/ip_tables.c:799 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:821 [inline] get_entries net/ipv4/netfilter/ip_tables.c:1020 [inline] do_ipt_get_ctl+0xb3c/0x1300 net/ipv4/netfilter/ip_tables.c:1669 nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x19e/0x230 net/ipv4/ip_sockglue.c:1785 do_sock_getsockopt+0x4aa/0x640 net/socket.c:2505 __sys_getsockopt net/socket.c:2536 [inline] __do_sys_getsockopt net/socket.c:2543 [inline] __se_sys_getsockopt net/socket.c:2540 [inline] __x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2540 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f ------------[ cut here ]------------ kernel BUG at mm/filemap.c:859! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 14057 Comm: syz.0.1524 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:__filemap_add_folio+0x1236/0x13c0 mm/filemap.c:858 Code: 32 be ff 4c 89 ef 48 c7 c6 c0 46 19 8c e8 c2 ce 1d ff 90 0f 0b e8 ba 32 be ff 4c 89 ef 48 c7 c6 80 3b 19 8c e8 ab ce 1d ff 90 <0f> 0b e8 a3 32 be ff 4c 89 ef 48 c7 c6 c0 46 19 8c e8 94 ce 1d ff RSP: 0018:ffffc90003e7f200 EFLAGS: 00010246 RAX: da6b98a3ebb78700 RBX: 0000000000000000 RCX: 0000000000000046 RDX: ffffc90005dc2000 RSI: ffffffff8e6c2900 RDI: ffff8880314a0000 RBP: ffffc90003e7f378 R08: ffffffff8ed4c7cb R09: 1ffffffff1da98f9 R10: dffffc0000000000 R11: fffffbfff1da98fa R12: ffff88802395c358 R13: ffffea000177e9c0 R14: 0000000000000003 R15: dffffc0000000000 FS: 00007f487ba6d6c0(0000) GS:ffff888124cbd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f17bd9f1000 CR3: 000000005a9da000 CR4: 00000000003526f0 Call Trace: filemap_add_folio+0x251/0x4e0 mm/filemap.c:971 ra_alloc_folio mm/readahead.c:470 [inline] page_cache_ra_order+0x6d1/0xee0 mm/readahead.c:535 do_sync_mmap_readahead+0x74b/0x960 mm/filemap.c:3461 filemap_fault+0x7ef/0x13b0 mm/filemap.c:3615 __do_fault+0x138/0x2a0 mm/memory.c:5595 do_read_fault mm/memory.c:6030 [inline] do_fault mm/memory.c:6164 [inline] do_pte_missing+0x21d2/0x3570 mm/memory.c:4724 handle_pte_fault mm/memory.c:6588 [inline] __handle_mm_fault mm/memory.c:6737 [inline] handle_mm_fault+0x1a53/0x3750 mm/memory.c:6904 do_user_addr_fault+0x7f6/0x1480 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:rep_movs_alternative+0x30/0xa0 arch/x86/lib/copy_user_64.S:60 Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 81 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 RSP: 0018:ffffc90003e7fc18 EFLAGS: 00050202 RAX: 00007ffffffff001 RBX: 0000000000000028 RCX: 0000000000000028 RDX: 0000000000000001 RSI: 0000200000000380 RDI: ffffc90003e7fd50 RBP: ffffc90003e7fea0 R08: ffffc90003e7fd77 R09: 1ffff920007cffae R10: dffffc0000000000 R11: fffff520007cffaf R12: ffffc90003e7fd50 R13: 0000000000000028 R14: ffffc90003e7fd50 R15: 0000200000000380 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] raw_copy_from_user arch/x86/include/asm/uaccess_64.h:141 [inline] _inline_copy_from_user include/linux/uaccess.h:185 [inline] _copy_from_user+0x7a/0xb0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:222 [inline] copy_from_bpfptr_offset include/linux/bpfptr.h:53 [inline] copy_from_bpfptr include/linux/bpfptr.h:59 [inline] __sys_bpf+0x2e7/0xe00 kernel/bpf/syscall.c:6385 __do_sys_bpf kernel/bpf/syscall.c:6555 [inline] __se_sys_bpf kernel/bpf/syscall.c:6552 [inline] __x64_sys_bpf+0xba/0xd0 kernel/bpf/syscall.c:6552 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f487ab9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f487ba6d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f487ae26090 RCX: 00007f487ab9e159 RDX: 0000000000000028 RSI: 0000200000000380 RDI: 0000000000000012 RBP: 00007f487ac3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f487ae26128 R14: 00007f487ae26090 R15: 00007fff72433d68 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__filemap_add_folio+0x1236/0x13c0 mm/filemap.c:858 Code: 32 be ff 4c 89 ef 48 c7 c6 c0 46 19 8c e8 c2 ce 1d ff 90 0f 0b e8 ba 32 be ff 4c 89 ef 48 c7 c6 80 3b 19 8c e8 ab ce 1d ff 90 <0f> 0b e8 a3 32 be ff 4c 89 ef 48 c7 c6 c0 46 19 8c e8 94 ce 1d ff RSP: 0018:ffffc90003e7f200 EFLAGS: 00010246 RAX: da6b98a3ebb78700 RBX: 0000000000000000 RCX: 0000000000000046 RDX: ffffc90005dc2000 RSI: ffffffff8e6c2900 RDI: ffff8880314a0000 RBP: ffffc90003e7f378 R08: ffffffff8ed4c7cb R09: 1ffffffff1da98f9 R10: dffffc0000000000 R11: fffffbfff1da98fa R12: ffff88802395c358 R13: ffffea000177e9c0 R14: 0000000000000003 R15: dffffc0000000000 FS: 00007f487ba6d6c0(0000) GS:ffff888124cbd000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3133bbcfeb CR3: 000000005a9da000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 83 f9 08 cmp $0x8,%ecx 3: 73 25 jae 0x2a 5: 85 c9 test %ecx,%ecx 7: 74 0f je 0x18 9: 8a 06 mov (%rsi),%al b: 88 07 mov %al,(%rdi) d: 48 ff c7 inc %rdi 10: 48 ff c6 inc %rsi 13: 48 ff c9 dec %rcx 16: 75 f1 jne 0x9 18: e9 3d 81 04 00 jmp 0x4815a 1d: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 24: 00 00 00 27: 0f 1f 00 nopl (%rax) * 2a: 48 8b 06 mov (%rsi),%rax <-- trapping instruction 2d: 48 89 07 mov %rax,(%rdi) 30: 48 83 c6 08 add $0x8,%rsi 34: 48 83 c7 08 add $0x8,%rdi 38: 83 e9 08 sub $0x8,%ecx 3b: 74 db je 0x18 3d: 83 f9 08 cmp $0x8,%ecx