CFI failure at __traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 (target: tp_stub_func+0x0/0x10; expected type: 0xee1f7a69) invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 27132 Comm: syz.6.6907 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 04 74 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc900014f7730 EFLAGS: 00010096 RAX: 1ffff110232656a6 RBX: ffff88811932b528 RCX: ffff888109146540 RDX: ffff88810cb66540 RSI: 0000000000000001 RDI: ffffc90000204000 RBP: ffffc900014f7770 R08: 0000000000000000 R09: fffffbfff0ee4dce R10: 00000000b720eca3 R11: 1ffffffff0ee4dcd R12: 0000000000000001 R13: ffff88811932b528 R14: dffffc0000000000 R15: ffffffff81713a50 FS: 00007fde1b1876c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f73fbbbcd58 CR3: 000000010caeb000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1263/0x14e0 kernel/sched/core.c:6747 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396 irqentry_exit+0x37/0x40 kernel/entry/common.c:439 sysvec_reschedule_ipi+0x78/0x80 arch/x86/kernel/smp.c:244 asm_sysvec_reschedule_ipi+0x1b/0x20 arch/x86/include/asm/idtentry.h:696 RIP: 0010:check_kcov_mode kernel/kcov.c:182 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x17/0x60 kernel/kcov.c:216 Code: 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 48 8b 45 08 65 48 8b 0d b0 4f 92 7e 65 8b 15 b1 4f 92 7e <81> e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 6c 0b 00 00 RSP: 0018:ffffc900014f7a20 EFLAGS: 00000206 RAX: ffffffff8263a1fe RBX: 0000000000000038 RCX: ffff88810cb66540 RDX: 0000000080000000 RSI: 0000200000670640 RDI: 00007fffffffefc8 RBP: ffffc900014f7a20 R08: dffffc0000000000 R09: ffffc900014f7ac0 R10: fffff5200029ef5f R11: 1ffff9200029ef58 R12: 00007fffffffefc8 R13: dffffc0000000000 R14: ffffc900014f7ac0 R15: 0000200000670640 _copy_from_user+0x5e/0xc0 lib/usercopy.c:21 copy_from_user include/linux/uaccess.h:161 [inline] copy_msghdr_from_user net/socket.c:2439 [inline] recvmsg_copy_msghdr net/socket.c:2694 [inline] ___sys_recvmsg+0x12b/0x510 net/socket.c:2766 do_recvmmsg+0x359/0x7a0 net/socket.c:2864 __sys_recvmmsg net/socket.c:2943 [inline] __do_sys_recvmmsg net/socket.c:2966 [inline] __se_sys_recvmmsg net/socket.c:2959 [inline] __x64_sys_recvmmsg+0x18d/0x240 net/socket.c:2959 x64_sys_call+0x3e7/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fde1a38eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fde1b187038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fde1a5e6090 RCX: 00007fde1a38eec9 RDX: 03fffffffffffeda RSI: 00002000000000c0 RDI: 0000000000000006 RBP: 00007fde1a411f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fde1a5e6128 R14: 00007fde1a5e6090 R15: 00007ffce18ddb08 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 04 74 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc900014f7730 EFLAGS: 00010096 RAX: 1ffff110232656a6 RBX: ffff88811932b528 RCX: ffff888109146540 RDX: ffff88810cb66540 RSI: 0000000000000001 RDI: ffffc90000204000 RBP: ffffc900014f7770 R08: 0000000000000000 R09: fffffbfff0ee4dce R10: 00000000b720eca3 R11: 1ffffffff0ee4dcd R12: 0000000000000001 R13: ffff88811932b528 R14: dffffc0000000000 R15: ffffffff81713a50 FS: 00007fde1b1876c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f73fbbbcd58 CR3: 000000010caeb000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 5d pop %rbp 1: c3 ret 2: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax) 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: b8 0c 67 40 a5 mov $0xa540670c,%eax 13: 55 push %rbp 14: 48 89 e5 mov %rsp,%rbp 17: 48 8b 45 08 mov 0x8(%rbp),%rax 1b: 65 48 8b 0d b0 4f 92 mov %gs:0x7e924fb0(%rip),%rcx # 0x7e924fd3 22: 7e 23: 65 8b 15 b1 4f 92 7e mov %gs:0x7e924fb1(%rip),%edx # 0x7e924fdb * 2a: 81 e2 00 01 ff 00 and $0xff0100,%edx <-- trapping instruction 30: 74 11 je 0x43 32: 81 fa 00 01 00 00 cmp $0x100,%edx 38: 75 35 jne 0x6f 3a: 83 .byte 0x83 3b: b9 6c 0b 00 00 mov $0xb6c,%ecx