------------[ cut here ]------------
WARNING: CPU: 0 PID: 9 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: netns cleanup_net
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 7d 90 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 00 8d d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000007e38 EFLAGS: 00010006
RAX: ffffffff81a0a790 RBX: 0000000000000000 RCX: ffff88813fe90000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88813fe90007 R09: 1ffff11027fd2000
R10: dffffc0000000000 R11: ffffed1027fd2001 R12: ffff88813fe91788
R13: 00007ffffffff000 R14: ffffc90000007ea8 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f47db375dac CR3: 000000002b159000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
 ____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
 bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
 bpf_prog_3d2613b5dfc7747f+0x32/0xee8
 bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_prog_test_run_raw_tp+0x1cd/0x3f0 net/bpf/test_run.c:335
 flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
 __sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
 sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:inet_twsk_purge+0x1aa/0x840 net/ipv4/inet_timewait_sock.c:270
Code: 29 8b be e6 02 00 00 48 c7 c2 20 3a 29 8b e8 dd 14 4e 01 48 8b 44 24 68 42 80 3c 28 00 74 08 4c 89 f7 e8 f9 70 5a f9 4d 8b 26 <4c> 89 e6 48 83 e6 01 31 ff e8 f8 55 15 f9 4c 89 e0 48 83 e0 01 0f
RSP: 0018:ffffc90000ce7a40 EFLAGS: 00000246
RAX: 1ffff110058963b8 RBX: 0000000000000001 RCX: ffff88813fe90000
RDX: 0000000000000000 RSI: ffffffff8a79fde0 RDI: ffffffff8a79fda0
RBP: ffffc90000ce7b50 R08: dffffc0000000000 R09: 1ffffffff203aa18
R10: dffffc0000000000 R11: fffffbfff203aa19 R12: 000000000002c771
R13: dffffc0000000000 R14: ffff88802c4b1dc0 R15: ffffffff8d619240
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x791/0xba0 net/core/net_namespace.c:635
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess):
   0:	29 8b be e6 02 00    	sub    %ecx,0x2e6be(%rbx)
   6:	00 48 c7             	add    %cl,-0x39(%rax)
   9:	c2 20 3a             	ret    $0x3a20
   c:	29 8b e8 dd 14 4e    	sub    %ecx,0x4e14dde8(%rbx)
  12:	01 48 8b             	add    %ecx,-0x75(%rax)
  15:	44 24 68             	rex.R and $0x68,%al
  18:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  1d:	74 08                	je     0x27
  1f:	4c 89 f7             	mov    %r14,%rdi
  22:	e8 f9 70 5a f9       	call   0xf95a7120
  27:	4d 8b 26             	mov    (%r14),%r12
* 2a:	4c 89 e6             	mov    %r12,%rsi <-- trapping instruction
  2d:	48 83 e6 01          	and    $0x1,%rsi
  31:	31 ff                	xor    %edi,%edi
  33:	e8 f8 55 15 f9       	call   0xf9155630
  38:	4c 89 e0             	mov    %r12,%rax
  3b:	48 83 e0 01          	and    $0x1,%rax
  3f:	0f                   	.byte 0xf