------------[ cut here ]------------
WARNING: CPU: 0 PID: 4358 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 4358 Comm: kworker/u4:11 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: xfs_iwalk-4329 xfs_pwork_work
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 ed f7 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 70 f4 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000007c68 EFLAGS: 00010006
RAX: ffffffff819ecfb0 RBX: 0000000000000008 RCX: ffff8880210abb80
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff6e19
R10: fffffbfff1ff6e19 R11: 1ffffffff1ff6e18 R12: ffff8880210ad308
R13: dffffc0000000000 R14: ffffc90000007cc8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000be8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_user kernel/trace/bpf_trace.c:166 [inline]
bpf_probe_read_user+0x26/0x70 kernel/trace/bpf_trace.c:163
bpf_prog_56907bf5a05a58a2+0x3a/0x620
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
trace_tlb_flush+0xe6/0x110 include/trace/events/tlb.h:38
switch_mm_irqs_off+0x6e3/0x9a0 arch/x86/mm/tlb.c:-1
flush_tlb_func+0x1bc/0x510 arch/x86/mm/tlb.c:773
flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:wq_worker_sleeping+0x3f/0x1f0 kernel/workqueue.c:906
Code: e8 26 c1 2a 00 48 89 df e8 2e 26 02 00 49 89 c6 48 8d 58 68 48 89 d8 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 59 01 00 00 8b 1b <89> de 81 e6 c8 01 00 00 31 ff e8 52 c4 2a 00 81 e3 c8 01 00 00 74
RSP: 0018:ffffc900033ce6a0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000080 RCX: ffff8880210abb80
RDX: 0000000000000000 RSI: 0000000000200000 RDI: 0000000000000000
RBP: 0000000004248060 R08: dffffc0000000000 R09: fffffbfff1ff6e3e
R10: fffffbfff1ff6e3e R11: 1ffffffff1ff6e3d R12: dffffc0000000000
R13: ffff8880210abb80 R14: ffff88801e590c00 R15: dffffc0000000000
sched_submit_work kernel/sched/core.c:6421 [inline]
schedule+0x7c/0x1e0 kernel/sched/core.c:6456
schedule_timeout+0x97/0x280 kernel/time/timer.c:1890
do_wait_for_common+0x29a/0x440 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
xfs_buf_iowait+0xae/0x3d0 fs/xfs/xfs_buf.c:1573
__xfs_buf_submit+0x3d2/0x7c0 fs/xfs/xfs_buf.c:1638
xfs_buf_submit fs/xfs/xfs_buf.c:58 [inline]
_xfs_buf_read fs/xfs/xfs_buf.c:722 [inline]
xfs_buf_read_map+0x368/0x950 fs/xfs/xfs_buf.c:786
xfs_trans_read_buf_map+0x1d4/0x8a0 fs/xfs/xfs_trans_buf.c:289
xfs_trans_read_buf fs/xfs/xfs_trans.h:210 [inline]
xfs_alloc_read_agfl+0x1b9/0x350 fs/xfs/libxfs/xfs_alloc.c:699
xfs_alloc_fix_freelist+0xa9d/0x1210 fs/xfs/libxfs/xfs_alloc.c:2643
xfs_alloc_vextent+0x9b9/0x1a90 fs/xfs/libxfs/xfs_alloc.c:3203
xfs_bmap_btalloc+0xfaf/0x1ec0 fs/xfs/libxfs/xfs_bmap.c:3718
xfs_bmapi_allocate+0x49b/0xe40 fs/xfs/libxfs/xfs_bmap.c:-1
xfs_bmapi_write+0x6b7/0xfc0 fs/xfs/libxfs/xfs_bmap.c:4484
xfs_dquot_disk_alloc+0x412/0xa40 fs/xfs/xfs_dquot.c:325
xfs_qm_dqread_alloc fs/xfs/xfs_dquot.c:647 [inline]
xfs_qm_dqread+0x319/0x650 fs/xfs/xfs_dquot.c:692
xfs_qm_dqget+0x1d2/0x460 fs/xfs/xfs_dquot.c:897
xfs_qm_quotacheck_dqadjust+0xc6/0x4c0 fs/xfs/xfs_qm.c:1085
xfs_qm_dqusage_adjust+0x339/0x4a0 fs/xfs/xfs_qm.c:1190
xfs_iwalk_ag_recs+0x51a/0x870 fs/xfs/xfs_iwalk.c:220
xfs_iwalk_run_callbacks+0x223/0x450 fs/xfs/xfs_iwalk.c:376
xfs_iwalk_ag+0x90b/0x9e0 fs/xfs/xfs_iwalk.c:482
xfs_iwalk_ag_work+0xf1/0x1a0 fs/xfs/xfs_iwalk.c:624
xfs_pwork_work+0x77/0x180 fs/xfs/xfs_pwork.c:47
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: e8 26 c1 2a 00 call 0x2ac12b
5: 48 89 df mov %rbx,%rdi
8: e8 2e 26 02 00 call 0x2263b
d: 49 89 c6 mov %rax,%r14
10: 48 8d 58 68 lea 0x68(%rax),%rbx
14: 48 89 d8 mov %rbx,%rax
17: 48 c1 e8 03 shr $0x3,%rax
1b: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax
20: 84 c0 test %al,%al
22: 0f 85 59 01 00 00 jne 0x181
28: 8b 1b mov (%rbx),%ebx
* 2a: 89 de mov %ebx,%esi <-- trapping instruction
2c: 81 e6 c8 01 00 00 and $0x1c8,%esi
32: 31 ff xor %edi,%edi
34: e8 52 c4 2a 00 call 0x2ac48b
39: 81 e3 c8 01 00 00 and $0x1c8,%ebx
3f: 74 .byte 0x74