R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f752dfd6038 R14: 00007f752dfd5fa0 R15: 00007ffcc13e0818 CFI failure at __traceiter_tlb_flush+0x80/0xd0 include/trace/events/tlb.h:38 (target: tp_stub_func+0x0/0x10; expected type: 0x205553a5) invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 12552 Comm: syz.8.4190 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:__traceiter_tlb_flush+0x80/0xd0 include/trace/events/tlb.h:38 Code: 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 a8 63 07 00 49 8b 7c 24 08 44 89 f6 48 8b 55 d0 41 ba 5b ac aa df 44 03 53 fc 74 02 <0f> 0b ff d3 49 83 c7 18 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 RSP: 0018:ffffc9000249fbe8 EFLAGS: 00010093 RAX: 1ffff1102015ef53 RBX: ffffffff817125b0 RCX: ffff888148dfa880 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffffc900008cc000 RBP: ffffc9000249fc18 R08: dffffc0000000000 R09: fffffbfff0ee4c06 R10: 0000000084eb1367 R11: 1ffffffff0ee4c05 R12: ffff888100af7a90 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888100af7a90 FS: 00007f752c7f76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3411cff8 CR3: 000000019dab5000 CR4: 00000000003506b0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: trace_tlb_flush include/trace/events/tlb.h:38 [inline] switch_mm_irqs_off+0x61f/0x980 arch/x86/mm/tlb.c:634 context_switch kernel/sched/core.c:5405 [inline] __schedule+0x9eb/0x14e0 kernel/sched/core.c:6750 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396 irqentry_exit+0x37/0x40 kernel/entry/common.c:439 sysvec_reschedule_ipi+0x78/0x80 arch/x86/kernel/smp.c:244 asm_sysvec_reschedule_ipi+0x1b/0x20 arch/x86/include/asm/idtentry.h:696 RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:97 [inline] RIP: 0010:syscall_enter_from_user_mode+0xc/0x30 kernel/entry/common.c:118 Code: 89 e5 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 5c cc d4 e6 48 89 f0 fb 65 48 8b 0d 04 70 15 7b <48> 8b 71 08 40 f6 c6 3f 74 0a 55 48 89 e5 e8 e1 dc 71 fc 5d c3 66 RSP: 0018:ffffc9000249ff18 EFLAGS: 00000282 RAX: 0000000000000000 RBX: ffffc9000249ff20 RCX: ffff888148dfa880 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000249ff58 RBP: ffffc9000249ff48 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffffc9000249ff58 R15: 0000000000000000 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f752dd8d5bc Code: Unable to access opcode bytes at 0x7f752dd8d592. RSP: 002b:00007f752c7f7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f752dfd5fa0 RCX: 00007f752dd8d5bc RDX: 000000000000000f RSI: 00007f752c7f70a0 RDI: 0000000000000007 RBP: 00007f752c7f7090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f752dfd6038 R14: 00007f752dfd5fa0 R15: 00007ffcc13e0818 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__traceiter_tlb_flush+0x80/0xd0 include/trace/events/tlb.h:38 Code: 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 a8 63 07 00 49 8b 7c 24 08 44 89 f6 48 8b 55 d0 41 ba 5b ac aa df 44 03 53 fc 74 02 <0f> 0b ff d3 49 83 c7 18 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 RSP: 0018:ffffc9000249fbe8 EFLAGS: 00010093 RAX: 1ffff1102015ef53 RBX: ffffffff817125b0 RCX: ffff888148dfa880 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: ffffc900008cc000 RBP: ffffc9000249fc18 R08: dffffc0000000000 R09: fffffbfff0ee4c06 R10: 0000000084eb1367 R11: 1ffffffff0ee4c05 R12: ffff888100af7a90 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888100af7a90 FS: 00007f752c7f76c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3411cff8 CR3: 000000019dab5000 CR4: 00000000003506b0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 89 e5 mov %esp,%ebp 2: 5d pop %rbp 3: c3 ret 4: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) b: 00 00 00 e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: b8 5c cc d4 e6 mov $0xe6d4cc5c,%eax 1e: 48 89 f0 mov %rsi,%rax 21: fb sti 22: 65 48 8b 0d 04 70 15 mov %gs:0x7b157004(%rip),%rcx # 0x7b15702e 29: 7b * 2a: 48 8b 71 08 mov 0x8(%rcx),%rsi <-- trapping instruction 2e: 40 f6 c6 3f test $0x3f,%sil 32: 74 0a je 0x3e 34: 55 push %rbp 35: 48 89 e5 mov %rsp,%rbp 38: e8 e1 dc 71 fc call 0xfc71dd1e 3d: 5d pop %rbp 3e: c3 ret 3f: 66 data16