------------[ cut here ]------------
WARNING: CPU: 0 PID: 4370 at mm/maccess.c:226 copy_from_user_nofault+0x15c/0x1c0
Modules linked in:
CPU: 0 PID: 4370 Comm: syz.1.56 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:copy_from_user_nofault+0x15c/0x1c0 mm/maccess.c:226
Code: db 48 c7 c0 f2 ff ff ff 48 0f 44 c5 eb 0c e8 cb c6 d5 ff 48 c7 c0 f2 ff ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 b4 c6 d5 ff <0f> 0b e9 1e ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c ef fe ff
RSP: 0000:ffffc90000007d28 EFLAGS: 00010006
RAX: ffffffff81aaacec RBX: 0000000000000000 RCX: ffff888025d98000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff81aaabfd R09: ffffed1004bb3001
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90000007da8
FS: 00007fbbfbf6d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbbfe08c1b0 CR3: 00000000762fe000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xe4/0x180 kernel/trace/bpf_trace.c:277
bpf_prog_f3c4d654356a1293+0x34/0xf08
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1915
trace_tlb_flush+0xed/0x110 include/trace/events/tlb.h:38
flush_tlb_func+0x480/0x590 arch/x86/mm/tlb.c:851
flush_smp_call_function_queue+0x2b5/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x9a/0x250 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:71 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
RIP: 0010:lock_page_memcg+0x2cc/0x4d0 mm/memcontrol.c:2059
Code: 01 00 74 0a 48 8d 7c 24 60 e8 b0 3f fb ff f6 44 24 61 02 0f 85 f9 00 00 00 41 f7 c4 00 02 00 00 74 01 fb 49 8d 9e 80 10 00 00 <48> 89 df be 04 00 00 00 e8 17 41 fb ff 48 89 d8 48 c1 e8 03 48 b9
RSP: 0000:ffffc900031f7860 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: ffff888017285080 RCX: 1ffff9200063ef18
RDX: dffffc0000000000 RSI: ffffffff8a8b2a80 RDI: ffffffff8ad90540
RBP: ffffc900031f7948 R08: dffffc0000000000 R09: fffffbfff20ec821
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000246
R13: ffffea0001d9e378 R14: ffff888017284000 R15: ffff888017284670
page_add_file_rmap+0x18c/0x980 mm/rmap.c:1219
do_set_pte+0x45b/0x660 mm/memory.c:4067
filemap_map_pages+0xf5e/0x15c0 mm/filemap.c:3344
do_fault_around mm/memory.c:4241 [inline]
do_read_fault mm/memory.c:4256 [inline]
do_fault mm/memory.c:4390 [inline]
handle_pte_fault mm/memory.c:4648 [inline]
__handle_mm_fault mm/memory.c:4783 [inline]
handle_mm_fault+0x341b/0x5960 mm/memory.c:4881
do_user_addr_fault arch/x86/mm/fault.c:1357 [inline]
handle_page_fault arch/x86/mm/fault.c:1445 [inline]
exc_page_fault+0x271/0x700 arch/x86/mm/fault.c:1501
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7fbbfe08c1b0
Code: Unable to access opcode bytes at RIP 0x7fbbfe08c186.
RSP: 002b:00007fbbfbf6d118 EFLAGS: 00010246
RAX: fffffffffffffeb8 RBX: 00007fbbfbf6d6c0 RCX: 00007fbbfe129879
RDX: 00007fbbfbf6dd78 RSI: 0000000000000058 RDI: 00007fbbfbf6d6c0
RBP: 0000000000000000 R08: 00007fbbfbf6d6c0 R09: 00007fffff562827
R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffa8
R13: 000000000000000b R14: 00007fffff562740 R15: 00007fffff562828
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 74 0a je 0xe
4: 48 8d 7c 24 60 lea 0x60(%rsp),%rdi
9: e8 b0 3f fb ff call 0xfffb3fbe
e: f6 44 24 61 02 testb $0x2,0x61(%rsp)
13: 0f 85 f9 00 00 00 jne 0x112
19: 41 f7 c4 00 02 00 00 test $0x200,%r12d
20: 74 01 je 0x23
22: fb sti
23: 49 8d 9e 80 10 00 00 lea 0x1080(%r14),%rbx
* 2a: 48 89 df mov %rbx,%rdi <-- trapping instruction
2d: be 04 00 00 00 mov $0x4,%esi
32: e8 17 41 fb ff call 0xfffb414e
37: 48 89 d8 mov %rbx,%rax
3a: 48 c1 e8 03 shr $0x3,%rax
3e: 48 rex.W
3f: b9 .byte 0xb9