CFI failure at __traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 (target: tp_stub_func+0x0/0x10; expected type: 0xee1f7a69) invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8430 Comm: syz.8.2371 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 64 75 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc90000e978b0 EFLAGS: 00010096 RAX: 1ffff11025b5d336 RBX: ffff88812dae99a8 RCX: ffff888146af6540 RDX: ffff8881096ee540 RSI: 0000000000000001 RDI: ffffc9000003d000 RBP: ffffc90000e978f0 R08: 0000000000000000 R09: fffffbfff0ee4dde R10: 00000000b720eca3 R11: 1ffffffff0ee4ddd R12: 0000000000000001 R13: ffff88812dae99a8 R14: dffffc0000000000 R15: ffffffff81713a50 FS: 00007fb2c201a6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000015000 CR3: 00000001165fb000 CR4: 00000000003506b0 DR0: 0010000010000000 DR1: 0000000000000006 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x1263/0x14e0 kernel/sched/core.c:6747 preempt_schedule_irq+0x9b/0x110 kernel/sched/core.c:7062 raw_irqentry_exit_cond_resched+0x29/0x30 kernel/entry/common.c:396 irqentry_exit+0x37/0x40 kernel/entry/common.c:439 sysvec_apic_timer_interrupt+0x64/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:check_stack_object+0x0/0x140 mm/usercopy.c:37 Code: e1 80 e1 07 38 c1 0f 8c 5e fd ff ff 4c 89 e7 e8 66 f8 f8 ff e9 51 fd ff ff e8 9c 89 b4 ff e9 61 fe ff ff 0f 1f 80 00 00 00 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 50 49 89 f6 48 89 fb 49 bc RSP: 0018:ffffc90000e97b90 EFLAGS: 00000286 RAX: ffffffff81bb8eb3 RBX: 0000000000000000 RCX: ffff8881096ee540 RDX: 0000000000000002 RSI: 0000000000000002 RDI: ffff88814da46460 RBP: ffffc90000e97bd0 R08: dffffc0000000000 R09: ffffed10227d6366 R10: ffffed10227d6366 R11: 1ffff110227d635e R12: fffffffffffffffe R13: 0000000000000002 R14: ffff88814da46460 R15: 0000000000000002 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_from_user include/linux/uaccess.h:160 [inline] generic_map_update_batch+0x44a/0x780 kernel/bpf/syscall.c:1677 bpf_map_do_batch+0x48c/0x620 kernel/bpf/syscall.c:-1 __sys_bpf+0x624/0x780 kernel/bpf/syscall.c:-1 __do_sys_bpf kernel/bpf/syscall.c:5106 [inline] __se_sys_bpf kernel/bpf/syscall.c:5104 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5104 x64_sys_call+0x488/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fb2c118eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb2c201a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fb2c13e5fa0 RCX: 00007fb2c118eec9 RDX: 0000000000000038 RSI: 0000200000000080 RDI: 000000000000001a RBP: 00007fb2c1211f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb2c13e6038 R14: 00007fb2c13e5fa0 R15: 00007fff2e5dd478 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__traceiter_sched_switch+0x9b/0xd0 include/trace/events/sched.h:222 Code: 80 3c 30 00 74 05 e8 64 75 69 00 49 8b 7d 08 44 89 e6 48 8b 55 c8 48 8b 4d c0 44 8b 45 d4 41 ba 97 85 e0 11 45 03 57 fc 74 02 <0f> 0b 41 ff d7 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 RSP: 0018:ffffc90000e978b0 EFLAGS: 00010096 RAX: 1ffff11025b5d336 RBX: ffff88812dae99a8 RCX: ffff888146af6540 RDX: ffff8881096ee540 RSI: 0000000000000001 RDI: ffffc9000003d000 RBP: ffffc90000e978f0 R08: 0000000000000000 R09: fffffbfff0ee4dde R10: 00000000b720eca3 R11: 1ffffffff0ee4ddd R12: 0000000000000001 R13: ffff88812dae99a8 R14: dffffc0000000000 R15: ffffffff81713a50 FS: 00007fb2c201a6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000015000 CR3: 00000001165fb000 CR4: 00000000003506b0 DR0: 0010000010000000 DR1: 0000000000000006 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: e1 80 loope 0xffffff82 2: e1 07 loope 0xb 4: 38 c1 cmp %al,%cl 6: 0f 8c 5e fd ff ff jl 0xfffffd6a c: 4c 89 e7 mov %r12,%rdi f: e8 66 f8 f8 ff call 0xfff8f87a 14: e9 51 fd ff ff jmp 0xfffffd6a 19: e8 9c 89 b4 ff call 0xffb489ba 1e: e9 61 fe ff ff jmp 0xfffffe84 23: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) * 2a: 55 push %rbp <-- trapping instruction 2b: 48 89 e5 mov %rsp,%rbp 2e: 41 57 push %r15 30: 41 56 push %r14 32: 41 55 push %r13 34: 41 54 push %r12 36: 53 push %rbx 37: 50 push %rax 38: 49 89 f6 mov %rsi,%r14 3b: 48 89 fb mov %rdi,%rbx 3e: 49 rex.WB 3f: bc .byte 0xbc