------------[ cut here ]------------ WARNING: CPU: 0 PID: 4670 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226 Modules linked in: CPU: 0 PID: 4670 Comm: syz.0.153 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226 Code: 24 45 31 f6 31 ff 89 de e8 ed f6 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 70 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe RSP: 0000:ffffc9000359f420 EFLAGS: 00010246 RAX: ffffffff819ed740 RBX: 0000000000000000 RCX: ffff88802bbc0000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff7619 R10: fffffbfff1ff7619 R11: 1ffffffff1ff7618 R12: ffff88802bbc1788 R13: dffffc0000000000 R14: ffffc9000359f448 R15: 0000000000000000 FS: 0000555586068500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f617fac12f8 CR3: 00000000588a4000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline] ____bpf_probe_read_user kernel/trace/bpf_trace.c:166 [inline] bpf_probe_read_user+0x26/0x70 kernel/trace/bpf_trace.c:163 bpf_prog_2903cf4cc3d681d2+0x3a/0x678 bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline] bpf_trace_run4+0x188/0x330 kernel/trace/bpf_trace.c:1917 __bpf_trace_mm_page_alloc+0xbf/0xf0 include/trace/events/kmem.h:201 trace_mm_page_alloc include/trace/events/kmem.h:201 [inline] __alloc_pages+0x449/0x470 mm/page_alloc.c:5509 alloc_slab_page mm/slub.c:1775 [inline] allocate_slab mm/slub.c:1912 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1975 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3008 __slab_alloc mm/slub.c:3095 [inline] slab_alloc_node mm/slub.c:3186 [inline] kmem_cache_alloc_node+0x1c3/0x2d0 mm/slub.c:3256 __alloc_skb+0xf4/0x750 net/core/skbuff.c:415 skb_copy+0x139/0x790 net/core/skbuff.c:1595 mac80211_hwsim_tx_frame_no_nl+0xcc7/0x15d0 drivers/net/wireless/mac80211_hwsim.c:1569 mac80211_hwsim_tx_frame+0x1b5/0x200 drivers/net/wireless/mac80211_hwsim.c:1788 mac80211_hwsim_beacon_tx+0x4f3/0x920 drivers/net/wireless/mac80211_hwsim.c:1842 __iterate_interfaces+0x243/0x500 net/mac80211/util.c:793 ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 net/mac80211/util.c:829 mac80211_hwsim_beacon+0x9b/0x180 drivers/net/wireless/mac80211_hwsim.c:1865 __run_hrtimer kernel/time/hrtimer.c:1690 [inline] __hrtimer_run_queues+0x53d/0xc40 kernel/time/hrtimer.c:1754 hrtimer_run_softirq+0x176/0x240 kernel/time/hrtimer.c:1771 handle_softirqs+0x328/0x820 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0033:0x7f55fdc09bc1 Code: 45 31 f6 44 0f b6 e6 85 c0 0f 84 9e 00 00 00 44 89 f9 49 8b 50 40 4c 89 f0 49 03 14 ca 80 3d ed 91 35 00 00 49 89 d6 48 89 d5 <74> 28 25 ff 0f 00 00 83 f0 3d 8d 04 c0 89 c5 c1 ed 04 31 c5 69 ed RSP: 002b:00007ffc6e428df0 EFLAGS: 00000202 RAX: ffffffff83fddbab RBX: 00007f55fea90720 RCX: 000000000005916d RDX: ffffffff83fdde0f RSI: ffffffff83fdded9 RDI: 0000000000000006 RBP: ffffffff83fdde0f R08: 00007f55fdf61038 R09: 00007f55fdf4d000 R10: 00007f55fd79a008 R11: 0000000000000006 R12: 0000000000000006 R13: 0000000000000000 R14: ffffffff83fdde0f R15: 000000000005916d