------------[ cut here ]------------
WARNING: CPU: 1 PID: 5487 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 1 PID: 5487 Comm: syz.4.1101 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 3d f7 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 c0 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000dd0d38 EFLAGS: 00010006
RAX: ffffffff819ed760 RBX: 0000000000000008 RCX: ffff8880295a0000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffffbfff1ff7819
R10: fffffbfff1ff7819 R11: 1ffffffff1ff7818 R12: ffff8880295a1788
R13: dffffc0000000000 R14: ffffc90000dd0da8 R15: 0000000000000000
FS:  000055558b4a8500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000005e8d4000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
 ____bpf_probe_read_user kernel/trace/bpf_trace.c:166 [inline]
 bpf_probe_read_user+0x26/0x70 kernel/trace/bpf_trace.c:163
 bpf_prog_9a85f3c013040bfe+0x5b/0x478
 bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
 bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
 trace_tlb_flush+0xe6/0x110 include/trace/events/tlb.h:38
 flush_tlb_func+0x43f/0x510 arch/x86/mm/tlb.c:855
 flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
 __sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
 sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:__get_user_8+0x1b/0x30 arch/x86/lib/getuser.S:101
Code: 01 ca c3 90 90 90 90 90 90 90 90 90 90 90 90 48 ba f9 ef ff ff ff 7f 00 00 48 39 d0 73 64 48 19 d2 48 21 d0 0f 01 cb 48 8b 10 <31> c0 0f 01 ca c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f
RSP: 0018:ffffc9000303fbd0 EFLAGS: 00040202
RAX: 000055558b4a87e0 RBX: ffff8880295a0000 RCX: 40a11a2ba5a87500
RDX: 000055558b4a87e0 RSI: ffffffff8a0b2ac0 RDI: ffffffff8a59a480
RBP: 1ffff110052b4286 R08: dffffc0000000000 R09: fffffbfff1ad323e
R10: fffffbfff1ad323e R11: 1ffffffff1ad323d R12: 1ffff110052b426f
R13: dffffc0000000000 R14: 000055558b4a87e0 R15: ffff8880295a0000
 fetch_robust_entry kernel/futex/core.c:3762 [inline]
 exit_robust_list+0x61/0x300 kernel/futex/core.c:3793
 futex_cleanup kernel/futex/core.c:3845 [inline]
 futex_exit_release+0x12e/0x1c0 kernel/futex/core.c:3946
 exit_mm_release+0x16/0x30 kernel/fork.c:1431
 exit_mm+0xae/0x6c0 kernel/exit.c:488
 do_exit+0x5a1/0x20a0 kernel/exit.c:870
 do_group_exit+0x12e/0x300 kernel/exit.c:997
 __do_sys_exit_group kernel/exit.c:1008 [inline]
 __se_sys_exit_group kernel/exit.c:1006 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1006
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f73f89eaba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe7bdbcaa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f73f89eaba9
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffe7bdbcb0c R08: 000000047bdbcb9f R09: 00000000000927c0
R10: 0000000000000001 R11: 0000000000000246 R12: 00000000000000ab
R13: 00000000000927c0 R14: 0000000000014fcc R15: 00007ffe7bdbcb60
 </TASK>
----------------
Code disassembly (best guess):
   0:	01 ca                	add    %ecx,%edx
   2:	c3                   	ret
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	48 ba f9 ef ff ff ff 	movabs $0x7fffffffeff9,%rdx
  16:	7f 00 00
  19:	48 39 d0             	cmp    %rdx,%rax
  1c:	73 64                	jae    0x82
  1e:	48 19 d2             	sbb    %rdx,%rdx
  21:	48 21 d0             	and    %rdx,%rax
  24:	0f 01 cb             	stac
  27:	48 8b 10             	mov    (%rax),%rdx
* 2a:	31 c0                	xor    %eax,%eax <-- trapping instruction
  2c:	0f 01 ca             	clac
  2f:	c3                   	ret
  30:	90                   	nop
  31:	90                   	nop
  32:	90                   	nop
  33:	90                   	nop
  34:	90                   	nop
  35:	90                   	nop
  36:	90                   	nop
  37:	90                   	nop
  38:	90                   	nop
  39:	90                   	nop
  3a:	90                   	nop
  3b:	90                   	nop
  3c:	90                   	nop
  3d:	90                   	nop
  3e:	90                   	nop
  3f:	0f                   	.byte 0xf