------------[ cut here ]------------
WARNING: CPU: 0 PID: 14620 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 14620 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 7d 94 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 00 91 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc900000079e0 EFLAGS: 00010246
RAX: ffffffff81a08ea0 RBX: 0000000000000008 RCX: ffff888027ebbb80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: 1ffffffff203a218
R10: dffffc0000000000 R11: fffffbfff203a219 R12: ffff888027ebd308
R13: dffffc0000000000 R14: ffffc90000007a48 R15: 0000000000000000
FS: 00005555777a2500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000060f07000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_user kernel/trace/bpf_trace.c:166 [inline]
bpf_probe_read_user+0x26/0x70 kernel/trace/bpf_trace.c:163
bpf_prog_02073d59a3c0f06f+0x3d/0x340
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x163/0x2e0 kernel/trace/bpf_trace.c:1915
__bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118
trace_kfree include/trace/events/kmem.h:118 [inline]
kfree+0x25f/0x2a0 mm/slub.c:4554
shmem_free_in_core_inode+0x6f/0xb0 mm/shmem.c:3798
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0x9d2/0x1670 kernel/rcu/tree.c:2763
handle_softirqs+0x339/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:in_lock_functions+0x11/0x20 kernel/locking/spinlock.c:404
Code: 38 c1 0f 8c 77 ff ff ff 48 c7 c7 40 16 21 92 e8 e5 ef 5f 00 e9 66 ff ff ff 48 81 ff 50 53 c5 89 0f 93 c0 48 81 ff 9e 63 c5 89 <0f> 92 c1 20 c1 0f b6 c1 c3 00 00 cc cc 00 00 55 41 57 41 56 41 55
RSP: 0018:ffffc900031aee60 EFLAGS: 00000297
RAX: 0000000000000000 RBX: ffffffff81350d2c RCX: ffffffff962d7f03
RDX: ffffc900031af038 RSI: dffffc0000000000 RDI: ffffffff81350d2c
RBP: ffffc900031aeff0 R08: ffffc900031af001 R09: ffffc900031aefa8
R10: dffffc0000000000 R11: fffff52000635e01 R12: ffffffff81352c1e
R13: ffffc900031aef48 R14: dffffc0000000000 R15: dffffc0000000000
get_lock_parent_ip include/linux/ftrace.h:857 [inline]
preempt_latency_start kernel/sched/core.c:5490 [inline]
preempt_count_add+0x8d/0x190 kernel/sched/core.c:5515
unwind_next_frame+0xac/0x1d90 arch/x86/kernel/unwind_orc.c:433
__unwind_start+0x5bb/0x740 arch/x86/kernel/unwind_orc.c:704
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xda/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
save_stack+0x121/0x230 mm/page_owner.c:119
__set_page_owner+0x41/0x2d0 mm/page_owner.c:181
prep_new_page mm/page_alloc.c:2426 [inline]
get_page_from_freelist+0x1bbd/0x1ca0 mm/page_alloc.c:4192
__alloc_pages+0x1ee/0x480 mm/page_alloc.c:5487
__pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
pte_alloc_one+0x7b/0x310 arch/x86/mm/pgtable.c:33
__pte_alloc+0x21/0x150 mm/memory.c:439
copy_pte_range mm/memory.c:1032 [inline]
copy_pmd_range mm/memory.c:1167 [inline]
copy_pud_range mm/memory.c:1204 [inline]
copy_p4d_range mm/memory.c:1228 [inline]
copy_page_range+0x29c2/0x3230 mm/memory.c:1301
dup_mmap kernel/fork.c:615 [inline]
dup_mm kernel/fork.c:1466 [inline]
copy_mm+0xc86/0x13f0 kernel/fork.c:1518
copy_process+0x17eb/0x3e20 kernel/fork.c:2290
kernel_clone+0x23f/0x990 kernel/fork.c:2679
__do_sys_clone kernel/fork.c:2796 [inline]
__se_sys_clone kernel/fork.c:2780 [inline]
__x64_sys_clone+0x19a/0x210 kernel/fork.c:2780
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fea6d07b752
Code: 89 e7 e8 f1 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007fff30a72520 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fff30a72520 RCX: 00007fea6d07b752
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007fff30a726ac R08: 0000000000000000 R09: 0000000000000001
R10: 00005555777a27d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 00000000000a5c34 R15: 00007fff30a72700
----------------
Code disassembly (best guess):
0: 38 c1 cmp %al,%cl
2: 0f 8c 77 ff ff ff jl 0xffffff7f
8: 48 c7 c7 40 16 21 92 mov $0xffffffff92211640,%rdi
f: e8 e5 ef 5f 00 call 0x5feff9
14: e9 66 ff ff ff jmp 0xffffff7f
19: 48 81 ff 50 53 c5 89 cmp $0xffffffff89c55350,%rdi
20: 0f 93 c0 setae %al
23: 48 81 ff 9e 63 c5 89 cmp $0xffffffff89c5639e,%rdi
* 2a: 0f 92 c1 setb %cl <-- trapping instruction
2d: 20 c1 and %al,%cl
2f: 0f b6 c1 movzbl %cl,%eax
32: c3 ret
33: 00 00 add %al,(%rax)
35: cc int3
36: cc int3
37: 00 00 add %al,(%rax)
39: 55 push %rbp
3a: 41 57 push %r15
3c: 41 56 push %r14
3e: 41 55 push %r13