kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffea0007629440 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0011) - permissions violation PGD 237ff3067 P4D 237ff3067 PUD 237ff2067 PMD 800000023e6001e3 Oops: 0011 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1179 Comm: syz.6.218 Not tainted 5.4.290-syzkaller-00017-g6b07fcd94a6a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:0xffffea0007629440 Code: ad de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 <02> 00 00 00 00 00 00 80 00 01 00 00 00 00 ad de 22 01 00 00 00 00 RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010002 RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881de9bcec0 RDX: 0000000080000101 RSI: ffffea0007629440 RDI: ffff8881c8f8b1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154e50e R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffff9c70 R13: dffffc0000000000 R14: ffffea0007629440 R15: ffff8881c8f8b1c0 FS: 00007f5e5e0fb6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffea0007629440 CR3: 00000001e321a000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x195/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:539 [inline] smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:radix_tree_is_internal_node include/linux/radix-tree.h:45 [inline] RIP: 0010:__radix_tree_lookup lib/radix-tree.c:771 [inline] RIP: 0010:radix_tree_delete_item+0x11d/0x340 lib/radix-tree.c:1428 Code: 00 41 0f b6 f7 31 ff e8 21 ee 12 fd 49 81 fc 02 04 00 00 74 09 45 84 ff 0f 84 88 00 00 00 49 81 fc 02 04 00 00 74 2f 44 89 e0 <83> e0 03 83 f8 02 0f 85 a7 00 00 00 e8 e2 eb 12 fd e9 7b ff ff ff RSP: 0018:ffff8881dea3f8a8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 00000000f5868002 RBX: ffff8881dd0c0580 RCX: 0000000000000002 RDX: ffffc90007557000 RSI: 0000000000000006 RDI: 0000000000000000 RBP: ffff8881dd0c0650 R08: ffffffff84515eef R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff8881f5868002 R13: dffffc0000000000 R14: 000000000001357e R15: 0000000000000006 kernfs_put+0x2e7/0x4b0 fs/kernfs/dir.c:547 kernfs_remove_by_name_ns+0x99/0x100 fs/kernfs/dir.c:1533 kernfs_remove_by_name include/linux/kernfs.h:583 [inline] remove_files fs/sysfs/group.c:27 [inline] sysfs_remove_group+0xfa/0x2a0 fs/sysfs/group.c:288 sysfs_remove_groups+0x50/0xa0 fs/sysfs/group.c:312 device_del+0x652/0xfa0 drivers/base/core.c:3087 rollback_registered_many+0xed6/0x1330 net/core/dev.c:8674 rollback_registered net/core/dev.c:8692 [inline] unregister_netdevice_queue+0x333/0x500 net/core/dev.c:9786 unregister_netdevice include/linux/netdevice.h:2726 [inline] ppp_release+0xe9/0x1e0 drivers/net/ppp/ppp_generic.c:408 __fput+0x262/0x680 fs/file_table.c:281 task_work_run+0x140/0x170 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f5e5fab2169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5e5e0fb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffff2 RBX: 00007f5e5fccb080 RCX: 00007f5e5fab2169 RDX: 000000110c230041 RSI: 00000000c004743e RDI: 0000000000000005 RBP: 00007f5e5fb332a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f5e5fccb080 R15: 00007fffcfd4bfe8 Modules linked in: CR2: ffffea0007629440 ---[ end trace 187e30b27910746a ]--- RIP: 0010:0xffffea0007629440 Code: ad de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 <02> 00 00 00 00 00 00 80 00 01 00 00 00 00 ad de 22 01 00 00 00 00 RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010002 RAX: ffffffff8154e8ca RBX: 0000000000000101 RCX: ffff8881de9bcec0 RDX: 0000000080000101 RSI: ffffea0007629440 RDI: ffff8881c8f8b1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154e50e R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffff9c70 R13: dffffc0000000000 R14: ffffea0007629440 R15: ffff8881c8f8b1c0 FS: 00007f5e5e0fb6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffea0007629440 CR3: 00000001e321a000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess), 2 bytes skipped: 1c: 02 00 add (%rax),%al 26: 00 00 add %al,(%rax) * 28: 02 00 add (%rax),%al <-- trapping instruction 2a: 00 00 add %al,(%rax) 2c: 00 00 add %al,(%rax) 2e: 00 80 00 01 00 00 add %al,0x100(%rax) 34: 00 00 add %al,(%rax) 36: ad lods %ds:(%rsi),%eax 37: de 22 fisubs (%rdx) 39: 01 00 add %eax,(%rax) 3b: 00 00 add %al,(%rax)