FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc3-syzkaller-00306-gaaf724ed6926 #0 Not tainted ------------------------------------------------------ syz.4.1034/12530 is trying to acquire lock: ffffffff8e133080 (console_owner){-.-.}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:336 [inline] ffffffff8e133080 (console_owner){-.-.}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:346 [inline] ffffffff8e133080 (console_owner){-.-.}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:288 [inline] ffffffff8e133080 (console_owner){-.-.}-{0:0}, at: console_flush_all+0x13a/0xc40 kernel/printk/printk.c:3203 but task is already holding lock: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 kernel/sched/core.c:614 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&rq->__lock){-.-.}-{2:2}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 _raw_spin_lock_nested+0x32/0x50 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:606 raw_spin_rq_lock kernel/sched/sched.h:1532 [inline] task_rq_lock+0xbc/0x470 kernel/sched/core.c:708 cgroup_move_task+0x9a/0x590 kernel/sched/psi.c:1161 css_set_move_task+0x658/0x9e0 kernel/cgroup/cgroup.c:918 cgroup_post_fork+0x1ef/0x790 kernel/cgroup/cgroup.c:6754 copy_process+0x3862/0x3c00 kernel/fork.c:2413 kernel_clone+0x21e/0x870 kernel/fork.c:2599 user_mode_thread+0xdd/0x140 kernel/fork.c:2677 rest_init+0x23/0x300 init/main.c:710 start_kernel+0x47d/0x500 init/main.c:1102 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:307 x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:288 common_startup_64+0x13e/0x147 -> #3 (&p->pi_lock){-.-.}-{2:2}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:557 [inline] try_to_wake_up+0x6e/0x1290 kernel/sched/core.c:4226 __wake_up_common kernel/sched/wait.c:89 [inline] __wake_up_common_lock+0x137/0x1f0 kernel/sched/wait.c:106 tty_port_default_wakeup+0xa2/0xf0 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x72e/0x970 drivers/tty/serial/8250/8250_port.c:1838 serial8250_handle_irq+0x633/0xbb0 drivers/tty/serial/8250/8250_port.c:1946 serial8250_default_handle_irq+0xbf/0x1b0 drivers/tty/serial/8250/8250_port.c:1966 serial8250_interrupt+0xa5/0x1d0 drivers/tty/serial/8250/8250_core.c:86 __handle_irq_event_percpu+0x28c/0x980 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x267/0x9c0 kernel/irq/chip.c:797 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:254 [inline] call_irq_handler arch/x86/kernel/irq.c:266 [inline] __common_interrupt+0x143/0x250 arch/x86/kernel/irq.c:292 common_interrupt+0xb6/0xe0 arch/x86/kernel/irq.c:285 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 lock_acquire+0x175/0x360 kernel/locking/lockdep.c:5875 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:841 [inline] class_rcu_constructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4328 [inline] __kmalloc_node_track_caller_noprof+0x271/0x4e0 mm/slub.c:4347 kmalloc_reserve+0x136/0x290 net/core/skbuff.c:601 __alloc_skb+0x142/0x2d0 net/core/skbuff.c:670 alloc_skb include/linux/skbuff.h:1336 [inline] alloc_skb_with_frags+0xca/0x890 net/core/skbuff.c:6665 sock_alloc_send_pskb+0x857/0x990 net/core/sock.c:2999 unix_dgram_sendmsg+0x4f6/0x1870 net/unix/af_unix.c:2083 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:727 sock_write_iter+0x258/0x330 net/socket.c:1131 do_iter_readv_writev+0x56e/0x7f0 fs/read_write.c:-1 vfs_writev+0x31a/0x960 fs/read_write.c:1057 do_writev+0x14d/0x2d0 fs/read_write.c:1103 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #2 (&tty->write_wait){-.-.}-{3:3}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 __wake_up_common_lock+0x2f/0x1f0 kernel/sched/wait.c:105 tty_port_default_wakeup+0xa2/0xf0 drivers/tty/tty_port.c:69 serial8250_tx_chars+0x72e/0x970 drivers/tty/serial/8250/8250_port.c:1838 serial8250_handle_irq+0x633/0xbb0 drivers/tty/serial/8250/8250_port.c:1946 serial8250_default_handle_irq+0xbf/0x1b0 drivers/tty/serial/8250/8250_port.c:1966 serial8250_interrupt+0xa5/0x1d0 drivers/tty/serial/8250/8250_core.c:86 __handle_irq_event_percpu+0x28c/0x980 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] handle_irq_event+0x8b/0x1e0 kernel/irq/handle.c:210 handle_edge_irq+0x267/0x9c0 kernel/irq/chip.c:797 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline] handle_irq arch/x86/kernel/irq.c:254 [inline] call_irq_handler arch/x86/kernel/irq.c:266 [inline] __common_interrupt+0x143/0x250 arch/x86/kernel/irq.c:292 common_interrupt+0xb6/0xe0 arch/x86/kernel/irq.c:285 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] uart_port_unlock_irqrestore include/linux/serial_core.h:788 [inline] uart_port_unlock_deref+0x111/0x2f0 drivers/tty/serial/serial_core.c:91 uart_write+0xe8/0x130 drivers/tty/serial/serial_core.c:637 process_output_block drivers/tty/n_tty.c:561 [inline] n_tty_write+0xd35/0x11d0 drivers/tty/n_tty.c:2377 iterate_tty_write drivers/tty/tty_io.c:1006 [inline] file_tty_write+0x503/0x990 drivers/tty/tty_io.c:1081 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x54b/0xa90 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&port_lock_key){-.-.}-{3:3}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 uart_port_lock_irqsave include/linux/serial_core.h:717 [inline] serial8250_console_write+0x17e/0x1ba0 drivers/tty/serial/8250/8250_port.c:3415 console_emit_next_record kernel/printk/printk.c:3138 [inline] console_flush_all+0x728/0xc40 kernel/printk/printk.c:3226 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline] console_unlock+0xc4/0x270 kernel/printk/printk.c:3325 vprintk_emit+0x5b7/0x7a0 kernel/printk/printk.c:2450 _printk+0xcf/0x120 kernel/printk/printk.c:2475 register_console+0xa8b/0xf90 kernel/printk/printk.c:4125 univ8250_console_init+0x52/0x90 drivers/tty/serial/8250/8250_core.c:513 console_init+0x1a1/0x670 kernel/printk/printk.c:4323 start_kernel+0x2cc/0x500 init/main.c:1036 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:307 x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:288 common_startup_64+0x13e/0x147 -> #0 (console_owner){-.-.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3911 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 console_lock_spinning_enable kernel/printk/printk.c:1924 [inline] console_emit_next_record kernel/printk/printk.c:3132 [inline] console_flush_all+0x6d2/0xc40 kernel/printk/printk.c:3226 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline] console_unlock+0xc4/0x270 kernel/printk/printk.c:3325 vprintk_emit+0x5b7/0x7a0 kernel/printk/printk.c:2450 _printk+0xcf/0x120 kernel/printk/printk.c:2475 fail_dump lib/fault-inject.c:66 [inline] should_fail_ex+0x3f5/0x560 lib/fault-inject.c:174 strncpy_from_user+0x36/0x290 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x72/0x150 mm/maccess.c:193 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xe2/0x180 kernel/trace/bpf_trace.c:306 bpf_prog_1ccb8ba97563bf77+0x41/0x68 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline] bpf_trace_run2+0x284/0x4b0 kernel/trace/bpf_trace.c:2299 __bpf_trace_tlb_flush+0xf5/0x150 include/trace/events/tlb.h:38 __do_trace_tlb_flush include/trace/events/tlb.h:38 [inline] trace_tlb_flush+0x115/0x140 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x53e/0x7a0 arch/x86/mm/tlb.c:-1 context_switch kernel/sched/core.c:5380 [inline] __schedule+0x106c/0x4d00 kernel/sched/core.c:6785 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7108 irqentry_exit+0x6f/0x90 kernel/entry/common.c:307 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707 __orc_find arch/x86/kernel/unwind_orc.c:100 [inline] orc_find arch/x86/kernel/unwind_orc.c:227 [inline] unwind_next_frame+0x12f9/0x2390 arch/x86/kernel/unwind_orc.c:494 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4148 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4204 lsm_inode_alloc security/security.c:755 [inline] security_inode_alloc+0x39/0x330 security/security.c:1697 inode_init_always_gfp+0x9ed/0xdc0 fs/inode.c:306 inode_init_always include/linux/fs.h:3281 [inline] alloc_inode+0x82/0x1b0 fs/inode.c:353 new_inode+0x22/0x170 fs/inode.c:1145 __shmem_get_inode mm/shmem.c:3049 [inline] shmem_get_inode+0x346/0xe90 mm/shmem.c:3123 __shmem_file_setup+0x163/0x300 mm/shmem.c:5821 alloc_file mm/memfd.c:433 [inline] __do_sys_memfd_create mm/memfd.c:481 [inline] __se_sys_memfd_create+0x308/0x780 mm/memfd.c:459 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: console_owner --> &p->pi_lock --> &rq->__lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->__lock); lock(&p->pi_lock); lock(&rq->__lock); lock(console_owner); *** DEADLOCK *** 5 locks held by syz.4.1034/12530: #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1155 [inline] #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa5/0x2390 arch/x86/kernel/unwind_orc.c:479 #1: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 kernel/sched/core.c:614 #2: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #2: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2257 [inline] #2: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run2+0x186/0x4b0 kernel/trace/bpf_trace.c:2299 #3: ffffffff8e1330e0 (console_lock){+.+.}-{0:0}, at: _printk+0xcf/0x120 kernel/printk/printk.c:2475 #4: ffffffff8e01a9b0 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:336 [inline] #4: ffffffff8e01a9b0 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:346 [inline] #4: ffffffff8e01a9b0 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:288 [inline] #4: ffffffff8e01a9b0 (console_srcu){....}-{0:0}, at: console_flush_all+0x13a/0xc40 kernel/printk/printk.c:3203 stack backtrace: CPU: 0 UID: 0 PID: 12530 Comm: syz.4.1034 Not tainted 6.16.0-rc3-syzkaller-00306-gaaf724ed6926 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2046 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3911 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 console_lock_spinning_enable kernel/printk/printk.c:1924 [inline] console_emit_next_record kernel/printk/printk.c:3132 [inline] console_flush_all+0x6d2/0xc40 kernel/printk/printk.c:3226 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline] console_unlock+0xc4/0x270 kernel/printk/printk.c:3325 vprintk_emit+0x5b7/0x7a0 kernel/printk/printk.c:2450 _printk+0xcf/0x120 kernel/printk/printk.c:2475 fail_dump lib/fault-inject.c:66 [inline] should_fail_ex+0x3f5/0x560 lib/fault-inject.c:174 strncpy_from_user+0x36/0x290 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x72/0x150 mm/maccess.c:193 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xe2/0x180 kernel/trace/bpf_trace.c:306 bpf_prog_1ccb8ba97563bf77+0x41/0x68 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline] bpf_trace_run2+0x284/0x4b0 kernel/trace/bpf_trace.c:2299 __bpf_trace_tlb_flush+0xf5/0x150 include/trace/events/tlb.h:38 __do_trace_tlb_flush include/trace/events/tlb.h:38 [inline] trace_tlb_flush+0x115/0x140 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x53e/0x7a0 arch/x86/mm/tlb.c:-1 context_switch kernel/sched/core.c:5380 [inline] __schedule+0x106c/0x4d00 kernel/sched/core.c:6785 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7108 irqentry_exit+0x6f/0x90 kernel/entry/common.c:307 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline] RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline] RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline] RIP: 0010:unwind_next_frame+0x12f9/0x2390 arch/x86/kernel/unwind_orc.c:494 Code: 00 49 89 d5 48 89 d5 48 89 d8 48 29 e8 48 89 c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 3c 45 00 00 00 00 49 01 ef <4c> 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 RSP: 0018:ffffc900030e7818 EFLAGS: 00000282 RAX: 0000000000000020 RBX: ffffffff8faee9ac RCX: 0000000000000021 RDX: ffffffff8faee928 RSI: ffffffff90275f7a RDI: ffffffff8be28ce0 RBP: ffffffff8faee928 R08: 0000000000000022 R09: ffffffff81728af5 R10: dffffc0000000000 R11: ffffffff81ace6a0 R12: ffffffff8100012f R13: ffffffff8faee928 R14: ffffc900030e78e8 R15: ffffffff8faee968 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4148 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4204 lsm_inode_alloc security/security.c:755 [inline] security_inode_alloc+0x39/0x330 security/security.c:1697 inode_init_always_gfp+0x9ed/0xdc0 fs/inode.c:306 inode_init_always include/linux/fs.h:3281 [inline] alloc_inode+0x82/0x1b0 fs/inode.c:353 new_inode+0x22/0x170 fs/inode.c:1145 __shmem_get_inode mm/shmem.c:3049 [inline] shmem_get_inode+0x346/0xe90 mm/shmem.c:3123 __shmem_file_setup+0x163/0x300 mm/shmem.c:5821 alloc_file mm/memfd.c:433 [inline] __do_sys_memfd_create mm/memfd.c:481 [inline] __se_sys_memfd_create+0x308/0x780 mm/memfd.c:459 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6cd9b8e929 Code: Unable to access opcode bytes at 0x7f6cd9b8e8ff. RSP: 002b:00007f6cda922e18 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000021136 RCX: 00007f6cd9b8e929 RDX: 00007f6cda922ef0 RSI: 0000000000000000 RDI: 00007f6cd9c114cc RBP: 0000200000021200 R08: 00007f6cda922bb7 R09: 00007f6cda922e40 R10: 000000000000000a R11: 0000000000000202 R12: 0000200000021180 R13: 00007f6cda922ef0 R14: 00007f6cda922eb0 R15: 00002000000211c0 CPU: 0 UID: 0 PID: 12530 Comm: syz.4.1034 Not tainted 6.16.0-rc3-syzkaller-00306-gaaf724ed6926 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 fail_dump lib/fault-inject.c:73 [inline] should_fail_ex+0x414/0x560 lib/fault-inject.c:174 strncpy_from_user+0x36/0x290 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x72/0x150 mm/maccess.c:193 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:215 [inline] ____bpf_probe_read_compat_str kernel/trace/bpf_trace.c:310 [inline] bpf_probe_read_compat_str+0xe2/0x180 kernel/trace/bpf_trace.c:306 bpf_prog_1ccb8ba97563bf77+0x41/0x68 bpf_dispatcher_nop_func include/linux/bpf.h:1322 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2258 [inline] bpf_trace_run2+0x284/0x4b0 kernel/trace/bpf_trace.c:2299 __bpf_trace_tlb_flush+0xf5/0x150 include/trace/events/tlb.h:38 __do_trace_tlb_flush include/trace/events/tlb.h:38 [inline] trace_tlb_flush+0x115/0x140 include/trace/events/tlb.h:38 switch_mm_irqs_off+0x53e/0x7a0 arch/x86/mm/tlb.c:-1 context_switch kernel/sched/core.c:5380 [inline] __schedule+0x106c/0x4d00 kernel/sched/core.c:6785 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7108 irqentry_exit+0x6f/0x90 kernel/entry/common.c:307 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline] RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline] RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline] RIP: 0010:unwind_next_frame+0x12f9/0x2390 arch/x86/kernel/unwind_orc.c:494 Code: 00 49 89 d5 48 89 d5 48 89 d8 48 29 e8 48 89 c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 3c 45 00 00 00 00 49 01 ef <4c> 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 RSP: 0018:ffffc900030e7818 EFLAGS: 00000282 RAX: 0000000000000020 RBX: ffffffff8faee9ac RCX: 0000000000000021 RDX: ffffffff8faee928 RSI: ffffffff90275f7a RDI: ffffffff8be28ce0 RBP: ffffffff8faee928 R08: 0000000000000022 R09: ffffffff81728af5 R10: dffffc0000000000 R11: ffffffff81ace6a0 R12: ffffffff8100012f R13: ffffffff8faee928 R14: ffffc900030e78e8 R15: ffffffff8faee968 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4148 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4204 lsm_inode_alloc security/security.c:755 [inline] security_inode_alloc+0x39/0x330 security/security.c:1697 inode_init_always_gfp+0x9ed/0xdc0 fs/inode.c:306 inode_init_always include/linux/fs.h:3281 [inline] alloc_inode+0x82/0x1b0 fs/inode.c:353 new_inode+0x22/0x170 fs/inode.c:1145 __shmem_get_inode mm/shmem.c:3049 [inline] shmem_get_inode+0x346/0xe90 mm/shmem.c:3123 __shmem_file_setup+0x163/0x300 mm/shmem.c:5821 alloc_file mm/memfd.c:433 [inline] __do_sys_memfd_create mm/memfd.c:481 [inline] __se_sys_memfd_create+0x308/0x780 mm/memfd.c:459 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6cd9b8e929 Code: Unable to access opcode bytes at 0x7f6cd9b8e8ff. RSP: 002b:00007f6cda922e18 EFLAGS: 00000202 ORIG_RAX: 000000000000013f RAX: ffffffffffffffda RBX: 0000000000021136 RCX: 00007f6cd9b8e929 RDX: 00007f6cda922ef0 RSI: 0000000000000000 RDI: 00007f6cd9c114cc RBP: 0000200000021200 R08: 00007f6cda922bb7 R09: 00007f6cda922e40 R10: 000000000000000a R11: 0000000000000202 R12: 0000200000021180 R13: 00007f6cda922ef0 R14: 00007f6cda922eb0 R15: 00002000000211c0 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 49 89 d5 mov %rdx,%r13 3: 48 89 d5 mov %rdx,%rbp 6: 48 89 d8 mov %rbx,%rax 9: 48 29 e8 sub %rbp,%rax c: 48 89 c1 mov %rax,%rcx f: 48 c1 f9 02 sar $0x2,%rcx 13: 48 c1 e8 3f shr $0x3f,%rax 17: 48 01 c8 add %rcx,%rax 1a: 48 83 e0 fe and $0xfffffffffffffffe,%rax 1e: 4c 8d 3c 45 00 00 00 lea 0x0(,%rax,2),%r15 25: 00 26: 49 01 ef add %rbp,%r15 * 29: 4c 89 f8 mov %r15,%rax <-- trapping instruction 2c: 48 c1 e8 03 shr $0x3,%rax 30: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 37: fc ff df 3a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax 3e: 84 .byte 0x84