8<--- cut here --- Unable to handle kernel paging request at virtual address ffffffe9 when write [ffffffe9] *pgd=80000080007003, *pmd=deffd003, *pte=00000000 Internal error: Oops: a07 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 18738 Comm: syz-executor.1 Not tainted 6.9.0-rc1-syzkaller #0 Hardware name: ARM-Versatile Express PC is at copy_from_kernel_nofault mm/maccess.c:38 [inline] PC is at copy_from_kernel_nofault+0xb8/0x12c mm/maccess.c:24 LR is at copy_from_kernel_nofault+0x24/0x12c mm/maccess.c:31 pc : [<804361f0>] lr : [<8043615c>] psr: a0000013 sp : dfcf9c90 ip : dfcf9c90 fp : dfcf9cac r10: 00000000 r9 : dfcf9d40 r8 : ffffffe9 r7 : 8553bc00 r6 : 00000005 r5 : ffffffe9 r4 : ffffffe9 r3 : fffffff2 r2 : 00000000 r1 : 00000005 r0 : 00000001 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 84436840 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: non-paged memory Register r6 information: non-paged memory Register r7 information: slab task_struct start 8553bc00 pointer offset 0 size 3072 Register r8 information: non-paged memory Register r9 information: 2-page vmalloc region starting at 0xdfcf8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdfcf8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdfcf8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.1 (pid: 18738, stack limit = 0xdfcf8000) Stack: (0xdfcf9c90 to 0xdfcfa000) 9c80: dfcf9db8 ffffffe9 00000005 ffffffff 9ca0: dfcf9ccc dfcf9cb0 8037c428 80436144 dfcf9db8 00000000 8037c40c ffffffff 9cc0: dfcf9d64 dfcf9cd0 7f02989c 8037c418 ffffffe9 dfcf9d40 802ff648 81182b54 9ce0: dfcf9d64 dfcf9d30 35702575 00000000 828dbd1c 40000013 00000000 00000000 9d00: dfcf9cf0 00000000 dfcf9d74 dfcf9d18 dfcf9d2c dfcf9d20 81182b64 81898a78 9d20: dfcf9d64 dfcf9d30 802ff648 81182b54 ffffffe9 dfcf9d40 00000005 00000000 9d40: dfcf9db8 00000000 dfaa5000 840fcf00 dfaa5030 dfcf9e30 dfcf9dfc dfcf9d68 9d60: 8149c734 7f0297fc 804d0184 8089c164 00000000 8553bc00 804b4cdc 804d0124 9d80: 8260ca3c dfcf9e30 00000001 dfcf9e2c 80468494 00000000 dfcf9db8 00000000 9da0: 00000001 00000000 63524f80 0000013f 00000000 00000000 dfaa5000 00000000 9dc0: 00000000 00000000 85b7fc00 c01f4d75 dfcf9dfc 840fcf00 00000000 dfcf9ec0 9de0: 84d4fc00 85b7fc00 00000000 0000000e dfcf9e64 dfcf9e00 8149d6a0 8149c5d0 9e00: dfcf9e30 00000000 00000000 dfcf9e98 20000080 00000000 dfaa5000 00000000 9e20: 84515940 858f9800 8051cdd4 00000000 00000000 c01f4d75 803951d4 dfaa5000 9e40: 00000028 dfcf9e98 0000000a 20000080 00000028 00000000 dfcf9f8c dfcf9e68 9e60: 8039c858 8149d388 00000000 ffffffff 00000000 00000000 20000013 8553bc00 9e80: dfcf9ee0 dfcf9fb0 dfcf9ea4 dfcf9e98 8089c348 dfcf9ee0 20000080 00000000 9ea0: 8553bc00 dfcf9ed0 00000008 00000000 00000008 80426e10 00000000 00000000 9ec0: 00000003 02000000 0000000e 00000055 20000140 00000000 20000380 00000000 9ee0: 00000000 04000000 00000000 00000000 00000000 00000000 00000000 00000000 9f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9f40: 00000000 00000000 00000000 00000000 00000000 00000000 8020316c c01f4d75 9f60: 8261ca0c 00000000 00000000 0014c2c8 00000182 80200288 8553bc00 00000182 9f80: dfcf9fa4 dfcf9f90 8039dd98 8039b934 20000080 00000000 00000000 dfcf9fa8 9fa0: 80200060 8039dd78 00000000 00000000 0000000a 20000080 00000028 00000000 9fc0: 00000000 00000000 0014c2c8 00000182 7ec8632e 7ec8632f 003d0f00 76bfd0fc 9fe0: 76bfcf08 76bfcef8 000167f8 00050bc0 60000010 0000000a 00000000 00000000 Call trace: [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel_common include/linux/bpf.h:2909 [inline]) [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (____bpf_probe_read_kernel kernel/trace/bpf_trace.c:240 [inline]) [<80436138>] (copy_from_kernel_nofault) from [<8037c428>] (bpf_probe_read_kernel+0x1c/0x44 kernel/trace/bpf_trace.c:237) r7:ffffffff r6:00000005 r5:ffffffe9 r4:dfcf9db8 [<8037c40c>] (bpf_probe_read_kernel) from [<7f02989c>] (bpf_prog_244768d4818575ac+0xac/0xc0) r7:ffffffff r6:8037c40c r5:00000000 r4:dfcf9db8 [<7f0297f0>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]) [<7f0297f0>] (bpf_prog_244768d4818575ac) from [<8149c734>] (__bpf_prog_run include/linux/filter.h:657 [inline]) [<7f0297f0>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_prog_run include/linux/filter.h:664 [inline]) [<7f0297f0>] (bpf_prog_244768d4818575ac) from [<8149c734>] (bpf_test_run+0x170/0x388 net/bpf/test_run.c:425) r9:dfcf9e30 r8:dfaa5030 r7:840fcf00 r6:dfaa5000 r5:00000000 r4:dfcf9db8 [<8149c5c4>] (bpf_test_run) from [<8149d6a0>] (bpf_prog_test_run_skb+0x324/0x6cc net/bpf/test_run.c:1058) r10:0000000e r9:00000000 r8:85b7fc00 r7:84d4fc00 r6:dfcf9ec0 r5:00000000 r4:840fcf00 [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (bpf_prog_test_run kernel/bpf/syscall.c:4240 [inline]) [<8149d37c>] (bpf_prog_test_run_skb) from [<8039c858>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5649) r10:00000000 r9:00000028 r8:20000080 r7:0000000a r6:dfcf9e98 r5:00000028 r4:dfaa5000 [<8039b928>] (__sys_bpf) from [<8039dd98>] (__do_sys_bpf kernel/bpf/syscall.c:5738 [inline]) [<8039b928>] (__sys_bpf) from [<8039dd98>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5736) r10:00000182 r9:8553bc00 r8:80200288 r7:00000182 r6:0014c2c8 r5:00000000 r4:00000000 [<8039dd6c>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdfcf9fa8 to 0xdfcf9ff0) 9fa0: 00000000 00000000 0000000a 20000080 00000028 00000000 9fc0: 00000000 00000000 0014c2c8 00000182 7ec8632e 7ec8632f 003d0f00 76bfd0fc 9fe0: 76bfcf08 76bfcef8 000167f8 00050bc0 Code: 9a000007 e3a03000 e4942000 e3530000 (e5852000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9a000007 bls 0x24 4: e3a03000 mov r3, #0 8: e4942000 ldr r2, [r4], #0 c: e3530000 cmp r3, #0 * 10: e5852000 str r2, [r5] <-- trapping instruction