------------[ cut here ]------------
WARNING: CPU: 0 PID: 4281 at kernel/trace/bpf_trace.c:1411 get_bpf_raw_tp_regs kernel/trace/bpf_trace.c:1411 [inline]
WARNING: CPU: 0 PID: 4281 at kernel/trace/bpf_trace.c:1411 ____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1457 [inline]
WARNING: CPU: 0 PID: 4281 at kernel/trace/bpf_trace.c:1411 bpf_get_stackid_raw_tp+0x182/0x1b0 kernel/trace/bpf_trace.c:1454
Modules linked in:
CPU: 0 PID: 4281 Comm: syz.4.5 Not tainted 5.15.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:get_bpf_raw_tp_regs kernel/trace/bpf_trace.c:1411 [inline]
RIP: 0010:____bpf_get_stackid_raw_tp kernel/trace/bpf_trace.c:1457 [inline]
RIP: 0010:bpf_get_stackid_raw_tp+0x182/0x1b0 kernel/trace/bpf_trace.c:1454
Code: c9 45 31 c0 e8 6f ca 13 00 65 ff 0d 70 f4 81 7e 4c 63 f8 4c 89 f8 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 6e 78 f6 ff <0f> 0b 65 ff 0d 4d f4 81 7e 49 c7 c7 f0 ff ff ff eb d7 e8 57 78 f6
RSP: 0000:ffffc900000079b0 EFLAGS: 00010246
RAX: ffffffff818148d2 RBX: 0000000000000004 RCX: ffff8880235bd940
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 00000000fffffffc
RBP: ffffc900000079e0 R08: dffffc0000000000 R09: fffffbfff1ff3619
R10: fffffbfff1ff3619 R11: 1ffffffff1ff3618 R12: dffffc0000000000
R13: ffff8880b9000000 R14: ffff88807e236800 R15: 0000000000000001
FS: 00005555804d7500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30a13ff8 CR3: 00000000187e7000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_prog_b724608cae728045+0x1e/0x76c
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
__bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118
trace_kfree include/trace/events/kmem.h:118 [inline]
kfree+0x25f/0x2a0 mm/slub.c:4549
ip_dst_metrics_put include/net/ip.h:516 [inline]
ip6_dst_destroy+0x96/0x240 net/ipv6/route.c:360
dst_destroy+0xc0/0x2e0 net/core/dst.c:112
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0x962/0x15d0 kernel/rcu/tree.c:2763
handle_softirqs+0x328/0x820 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xd90/0x1200 kernel/printk/printk.c:2749
Code: 00 48 83 7c 24 28 00 75 19 e8 dc 9e 18 00 eb 18 e8 d5 9e 18 00 e8 50 0a 42 08 48 83 7c 24 28 00 74 e7 e8 c3 9e 18 00 fb 31 ff <89> de e8 19 a2 18 00 85 db 0f 94 c0 22 44 24 17 3c 01 75 1f e8 a7
RSP: 0000:ffffc9000322e700 EFLAGS: 00000246
RAX: ffffffff815f227d RBX: 0000000000000000 RCX: ffff8880235bd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000322e970 R08: dffffc0000000000 R09: fffffbfff1ff3619
R10: fffffbfff1ff3619 R11: 1ffffffff1ff3618 R12: 1ffffffff194c731
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffffffff194c72a
vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274
_printk+0xcc/0x110 kernel/printk/printk.c:2299
report_bug+0x1e5/0x2e0 lib/bug.c:195
handle_bug+0x3a/0x70 arch/x86/kernel/traps.c:239
exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:259
asm_exc_invalid_op+0x16/0x20 arch/x86/include/asm/idtentry.h:604
RIP: 0010:get_bpf_raw_tp_regs kernel/trace/bpf_trace.c:1411 [inline]
RIP: 0010:____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1483 [inline]
RIP: 0010:bpf_get_stack_raw_tp+0x196/0x1d0 kernel/trace/bpf_trace.c:1480
Code: c8 45 31 c0 e8 6b ce 13 00 65 ff 0d ac f2 81 7e 4c 63 e0 4c 89 e0 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 aa 76 f6 ff <0f> 0b 65 ff 0d 89 f2 81 7e 49 c7 c4 f0 ff ff ff eb d7 e8 93 76 f6
RSP: 0000:ffffc9000322ebf8 EFLAGS: 00010293
RAX: ffffffff81814a96 RBX: ffff8880b9000000 RCX: ffff8880235bd940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000fffffffc
RBP: ffffc9000322ec30 R08: dffffc0000000000 R09: fffffbfff1ff3619
R10: fffffbfff1ff3619 R11: 1ffffffff1ff3618 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000
bpf_prog_ec3b2eefa702d8d3+0x3a/0x8a8
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run4+0x188/0x330 kernel/trace/bpf_trace.c:1917
trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline]
__mmap_lock_do_trace_acquire_returned+0x231/0x290 mm/mmap_lock.c:102
__mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
mmap_read_trylock include/linux/mmap_lock.h:137 [inline]
stack_map_get_build_id_offset+0x83d/0x860 kernel/bpf/stackmap.c:185
__bpf_get_stack+0x44a/0x4f0 kernel/bpf/stackmap.c:496
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline]
bpf_get_stack_raw_tp+0x175/0x1d0 kernel/trace/bpf_trace.c:1480
bpf_prog_ec3b2eefa702d8d3+0x3a/0x8a8
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run4+0x188/0x330 kernel/trace/bpf_trace.c:1917
trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline]
__mmap_lock_do_trace_acquire_returned+0x231/0x290 mm/mmap_lock.c:102
__mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
mmap_read_trylock include/linux/mmap_lock.h:137 [inline]
stack_map_get_build_id_offset+0x83d/0x860 kernel/bpf/stackmap.c:185
__bpf_get_stack+0x44a/0x4f0 kernel/bpf/stackmap.c:496
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline]
bpf_get_stack_raw_tp+0x175/0x1d0 kernel/trace/bpf_trace.c:1480
bpf_prog_ec3b2eefa702d8d3+0x3a/0x8a8
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run4+0x188/0x330 kernel/trace/bpf_trace.c:1917
trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline]
__mmap_lock_do_trace_acquire_returned+0x231/0x290 mm/mmap_lock.c:102
__mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
mmap_read_trylock include/linux/mmap_lock.h:137 [inline]
stack_map_get_build_id_offset+0x83d/0x860 kernel/bpf/stackmap.c:185
__bpf_get_stack+0x44a/0x4f0 kernel/bpf/stackmap.c:496
____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline]
bpf_get_stack_raw_tp+0x175/0x1d0 kernel/trace/bpf_trace.c:1480
bpf_prog_ec3b2eefa702d8d3+0x3a/0x8a8
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run4+0x188/0x330 kernel/trace/bpf_trace.c:1917
trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline]
__mmap_lock_do_trace_acquire_returned+0x231/0x290 mm/mmap_lock.c:102
__mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]
mmap_read_trylock include/linux/mmap_lock.h:137 [inline]
do_user_addr_fault+0xbbb/0xc80 arch/x86/mm/fault.c:1298
handle_page_fault arch/x86/mm/fault.c:1445 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1501
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7f9f6c6e1282
Code: 0f 1f 84 00 00 00 00 00 be 08 00 00 00 48 89 df e8 c3 75 fe ff 48 8b 53 38 48 8d 42 f8 48 89 43 38 8b 43 28 83 c0 08 89 43 28 <4c> 89 62 f8 41 8d 56 01 41 39 ee 0f 83 8d 00 00 00 41 89 d6 48 8b
RSP: 002b:00007fffe117cde0 EFLAGS: 00010202
RAX: 000000000000c008 RBX: 00007f9f6d557720 RCX: 0000000000000000
RDX: 0000001b30a14000 RSI: 0000000000000008 RDI: 00007f9f6d557720
RBP: 0000000000000180 R08: 00007f9f6be71050 R09: 00007f9f6ca14000
R10: 00007f9f6be71008 R11: 0000000000000004 R12: ffffffff84014b27
R13: 00007f9f6ca28038 R14: 0000000000000016 R15: ffffffffffff4000
----------------
Code disassembly (best guess):
0: 00 48 83 add %cl,-0x7d(%rax)
3: 7c 24 jl 0x29
5: 28 00 sub %al,(%rax)
7: 75 19 jne 0x22
9: e8 dc 9e 18 00 call 0x189eea
e: eb 18 jmp 0x28
10: e8 d5 9e 18 00 call 0x189eea
15: e8 50 0a 42 08 call 0x8420a6a
1a: 48 83 7c 24 28 00 cmpq $0x0,0x28(%rsp)
20: 74 e7 je 0x9
22: e8 c3 9e 18 00 call 0x189eea
27: fb sti
28: 31 ff xor %edi,%edi
* 2a: 89 de mov %ebx,%esi <-- trapping instruction
2c: e8 19 a2 18 00 call 0x18a24a
31: 85 db test %ebx,%ebx
33: 0f 94 c0 sete %al
36: 22 44 24 17 and 0x17(%rsp),%al
3a: 3c 01 cmp $0x1,%al
3c: 75 1f jne 0x5d
3e: e8 .byte 0xe8
3f: a7 cmpsl %es:(%rdi),%ds:(%rsi)