------------[ cut here ]------------
WARNING: CPU: 1 PID: 4315 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 1 PID: 4315 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 8d f6 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 10 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000dcf9c8 EFLAGS: 00010246
RAX: ffffffff819ed900 RBX: 0000000000000000 RCX: ffff88802001d940
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff7c19
R10: fffffbfff1ff7c19 R11: 1ffffffff1ff7c18 R12: ffff88802001f0c8
R13: dffffc0000000000 R14: ffffc90000dcfa28 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f77e032d6c0 CR3: 000000001f051000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
 ____bpf_probe_read_user kernel/trace/bpf_trace.c:166 [inline]
 bpf_probe_read_user+0x26/0x70 kernel/trace/bpf_trace.c:163
 bpf_prog_690f12e098ef46de+0x32/0xb8
 bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
 bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
 __bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118
 trace_kfree include/trace/events/kmem.h:118 [inline]
 kfree+0x25f/0x2a0 mm/slub.c:4554
 skb_free_head net/core/skbuff.c:655 [inline]
 skb_release_data+0x6fe/0x850 net/core/skbuff.c:677
 skb_release_all net/core/skbuff.c:742 [inline]
 __kfree_skb+0x4c/0x60 net/core/skbuff.c:756
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3407 [inline]
 tcp_ack+0x2086/0x6260 net/ipv4/tcp_input.c:3964
 tcp_rcv_established+0xea6/0x1cb0 net/ipv4/tcp_input.c:5981
 tcp_v4_do_rcv+0x44b/0x9b0 net/ipv4/tcp_ipv4.c:1731
 tcp_v4_rcv+0x268f/0x2cb0 net/ipv4/tcp_ipv4.c:2143
 ip_protocol_deliver_rcu+0x3ad/0x770 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1d5/0x320 net/ipv4/ip_input.c:231
 NF_HOOK+0x2d6/0x360 include/linux/netfilter.h:302
 dst_input include/net/dst.h:462 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
 ip_sublist_rcv+0xa1f/0xce0 net/ipv4/ip_input.c:636
 ip_list_rcv+0x3df/0x430 net/ipv4/ip_input.c:671
 __netif_receive_skb_list_ptype net/core/dev.c:5568 [inline]
 __netif_receive_skb_list_core+0x574/0x740 net/core/dev.c:5616
 __netif_receive_skb_list net/core/dev.c:5668 [inline]
 netif_receive_skb_list_internal+0x871/0xb90 net/core/dev.c:5759
 gro_normal_list net/core/dev.c:5913 [inline]
 napi_complete_done+0x37d/0x830 net/core/dev.c:6651
 virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
 virtnet_poll+0x912/0xef0 drivers/net/virtio_net.c:1624
 __napi_poll+0xc0/0x430 net/core/dev.c:7075
 napi_poll net/core/dev.c:7142 [inline]
 net_rx_action+0x4a8/0x9c0 net/core/dev.c:7232
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
 </IRQ>
 <TASK>
 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:667
RIP: 0010:rcu_read_lock include/linux/rcupdate.h:741 [inline]
RIP: 0010:batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
RIP: 0010:batadv_nc_worker+0xc9/0x5c0 net/batman-adv/network-coding.c:723
Code: 10 48 8b 44 24 10 80 3c 18 00 74 08 48 89 ef e8 fd 98 3d f8 4e 8d 2c e5 00 00 00 00 4c 03 6d 00 e8 fc c0 e5 f7 e8 67 7c 00 00 <e8> 42 d8 2a 00 89 c5 31 ff 89 c6 e8 17 34 f9 f7 85 ed 74 10 e8 ce
RSP: 0018:ffffc900033efbe0 EFLAGS: 00000286
RAX: 6893b683e9059500 RBX: dffffc0000000000 RCX: 6893b683e9059500
RDX: 0000000000000000 RSI: ffffffff8a0b2f00 RDI: ffffffff8a59e580
RBP: ffff888025302580 R08: dffffc0000000000 R09: fffffbfff1ff7c19
R10: fffffbfff1ff7c19 R11: 1ffffffff1ff7c18 R12: 0000000000000204
R13: ffff8880743a9020 R14: ffff888061e70c80 R15: ffff888025302590
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess):
   0:	10 48 8b             	adc    %cl,-0x75(%rax)
   3:	44 24 10             	rex.R and $0x10,%al
   6:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1)
   a:	74 08                	je     0x14
   c:	48 89 ef             	mov    %rbp,%rdi
   f:	e8 fd 98 3d f8       	call   0xf83d9911
  14:	4e 8d 2c e5 00 00 00 	lea    0x0(,%r12,8),%r13
  1b:	00
  1c:	4c 03 6d 00          	add    0x0(%rbp),%r13
  20:	e8 fc c0 e5 f7       	call   0xf7e5c121
  25:	e8 67 7c 00 00       	call   0x7c91
* 2a:	e8 42 d8 2a 00       	call   0x2ad871 <-- trapping instruction
  2f:	89 c5                	mov    %eax,%ebp
  31:	31 ff                	xor    %edi,%edi
  33:	89 c6                	mov    %eax,%esi
  35:	e8 17 34 f9 f7       	call   0xf7f93451
  3a:	85 ed                	test   %ebp,%ebp
  3c:	74 10                	je     0x4e
  3e:	e8                   	.byte 0xe8
  3f:	ce                   	(bad)