CFI failure at __traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 (target: tp_stub_func+0x0/0x10; expected type: 0xee1f7a69) invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 4171 Comm: kworker/u4:12 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: netns cleanup_net RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 84 75 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc9000fb1f3d0 EFLAGS: 00010096 RAX: 1ffff11021255ac9 RBX: ffff8881092ad640 RCX: ffff88810fc51440 RDX: ffff888118761440 RSI: 0000000000000001 RDI: ffffc900001c3000 RBP: ffffc9000fb1f410 R08: 0000000000000000 R09: fffffbfff0ee4dde R10: 00000000b720eca3 R11: 1ffffffff0ee4ddd R12: 0000000000000001 R13: ffff8881092ad640 R14: dffffc0000000000 R15: ffffffff81713a70 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2ea41f CR3: 000000010ff07000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1263/0x14e0 kernel/sched/core.c:6747 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396 irqentry_exit+0x37/0x40 kernel/entry/common.c:439 sysvec_reschedule_ipi+0x78/0x80 arch/x86/kernel/smp.c:244 asm_sysvec_reschedule_ipi+0x1b/0x20 arch/x86/include/asm/idtentry.h:696 RIP: 0010:__sanitizer_cov_trace_pc+0x1/0x60 kernel/kcov.c:209 Code: fb e8 23 00 00 00 48 8b 3d 1c 53 02 06 48 89 de e8 b4 b6 43 00 5b 5d c3 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 <48> 89 e5 48 8b 45 08 65 48 8b 0d 90 4f 92 7e 65 8b 15 91 4f 92 7e RSP: 0018:ffffc9000fb1f6b8 EFLAGS: 00000202 RAX: ffffffff844fab5d RBX: ffff88812e5f4400 RCX: 0000000000000000 RDX: ffff888118761440 RSI: 0000000000000007 RDI: 0000000000000001 RBP: ffffc9000fb1f6f0 R08: dffffc0000000000 R09: ffffed10236f2e70 R10: ffffed10236f2e70 R11: 1ffff110236f2e6f R12: 0000000000000007 R13: dffffc0000000000 R14: ffff88811b797378 R15: ffff88811b797000 in6_ifa_put include/net/addrconf.h:459 [inline] addrconf_ifdown+0x1225/0x1910 net/ipv6/addrconf.c:3960 addrconf_notify+0x39f/0xe40 net/ipv6/addrconf.c:-1 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xa1/0x110 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2009 [inline] call_netdevice_notifiers_extack net/core/dev.c:2047 [inline] call_netdevice_notifiers net/core/dev.c:2061 [inline] dev_close_many+0x32d/0x4d0 net/core/dev.c:1609 unregister_netdevice_many+0x439/0x1820 net/core/dev.c:10941 ip_tunnel_delete_nets+0x346/0x390 net/ipv4/ip_tunnel.c:1153 erspan_exit_batch_net+0x22/0x30 net/ipv4/ip_gre.c:1723 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x62d/0xb00 net/core/net_namespace.c:604 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 84 75 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc9000fb1f3d0 EFLAGS: 00010096 RAX: 1ffff11021255ac9 RBX: ffff8881092ad640 RCX: ffff88810fc51440 RDX: ffff888118761440 RSI: 0000000000000001 RDI: ffffc900001c3000 RBP: ffffc9000fb1f410 R08: 0000000000000000 R09: fffffbfff0ee4dde R10: 00000000b720eca3 R11: 1ffffffff0ee4ddd R12: 0000000000000001 R13: ffff8881092ad640 R14: dffffc0000000000 R15: ffffffff81713a70 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2ea41f CR3: 000000010ff07000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: fb sti 1: e8 23 00 00 00 call 0x29 6: 48 8b 3d 1c 53 02 06 mov 0x602531c(%rip),%rdi # 0x6025329 d: 48 89 de mov %rbx,%rsi 10: e8 b4 b6 43 00 call 0x43b6c9 15: 5b pop %rbx 16: 5d pop %rbp 17: c3 ret 18: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax) 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: b8 0c 67 40 a5 mov $0xa540670c,%eax 29: 55 push %rbp * 2a: 48 89 e5 mov %rsp,%rbp <-- trapping instruction 2d: 48 8b 45 08 mov 0x8(%rbp),%rax 31: 65 48 8b 0d 90 4f 92 mov %gs:0x7e924f90(%rip),%rcx # 0x7e924fc9 38: 7e 39: 65 8b 15 91 4f 92 7e mov %gs:0x7e924f91(%rip),%edx # 0x7e924fd1