------------[ cut here ]------------ WARNING: CPU: 0 PID: 3570 at kernel/trace/bpf_trace.c:1411 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1483 [inline] WARNING: CPU: 0 PID: 3570 at kernel/trace/bpf_trace.c:1411 bpf_get_stack_raw_tp+0x1d3/0x220 kernel/trace/bpf_trace.c:1480 Modules linked in: CPU: 0 PID: 3570 Comm: syz-executor Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:get_bpf_raw_tp_regs kernel/trace/bpf_trace.c:1411 [inline] RIP: 0010:____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1483 [inline] RIP: 0010:bpf_get_stack_raw_tp+0x1d3/0x220 kernel/trace/bpf_trace.c:1480 Code: f1 45 31 c0 e8 4e 96 14 00 65 ff 0d 7f e5 78 7e 4c 63 e8 4c 89 e8 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 ad 02 f6 ff <0f> 0b 65 ff 0d 5c e5 78 7e 49 c7 c5 f0 ff ff ff eb d7 e8 96 02 f6 RSP: 0018:ffffc90002cf6590 EFLAGS: 00010293 RAX: ffffffff818a57c3 RBX: 0000000000000003 RCX: ffff8880189cd940 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000fffffffc RBP: ffffc90002cf65d0 R08: ffffffff818a5683 R09: fffffbfff20e2419 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90002cf65e8 R13: 0000000000000000 R14: 0000000000000900 R15: ffff8880b9033b30 FS: 0000555556857500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe3b1a2dc0 CR3: 0000000064de8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: bpf_prog_ec3b2eefa702d8d3+0x3a/0x48c bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run4+0x1ea/0x390 kernel/trace/bpf_trace.c:1919 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline] __mmap_lock_do_trace_acquire_returned+0x24d/0x2c0 mm/mmap_lock.c:102 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] stack_map_get_build_id_offset+0x612/0x930 kernel/bpf/stackmap.c:185 __bpf_get_stack+0x495/0x570 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline] bpf_get_stack_raw_tp+0x1b2/0x220 kernel/trace/bpf_trace.c:1480 bpf_prog_ec3b2eefa702d8d3+0x3a/0x48c bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run4+0x1ea/0x390 kernel/trace/bpf_trace.c:1919 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline] __mmap_lock_do_trace_acquire_returned+0x24d/0x2c0 mm/mmap_lock.c:102 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] stack_map_get_build_id_offset+0x612/0x930 kernel/bpf/stackmap.c:185 __bpf_get_stack+0x495/0x570 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline] bpf_get_stack_raw_tp+0x1b2/0x220 kernel/trace/bpf_trace.c:1480 bpf_prog_ec3b2eefa702d8d3+0x3a/0x48c bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run4+0x1ea/0x390 kernel/trace/bpf_trace.c:1919 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline] __mmap_lock_do_trace_acquire_returned+0x24d/0x2c0 mm/mmap_lock.c:102 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] stack_map_get_build_id_offset+0x612/0x930 kernel/bpf/stackmap.c:185 __bpf_get_stack+0x495/0x570 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1490 [inline] bpf_get_stack_raw_tp+0x1b2/0x220 kernel/trace/bpf_trace.c:1480 bpf_prog_ec3b2eefa702d8d3+0x3a/0x48c bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run4+0x1ea/0x390 kernel/trace/bpf_trace.c:1919 trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:44 [inline] __mmap_lock_do_trace_acquire_returned+0x24d/0x2c0 mm/mmap_lock.c:102 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:137 [inline] do_user_addr_fault arch/x86/mm/fault.c:1298 [inline] handle_page_fault arch/x86/mm/fault.c:1445 [inline] exc_page_fault+0x564/0x700 arch/x86/mm/fault.c:1501 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:568 RIP: 0010:__put_user_nocheck_1+0x3/0x11 Code: e8 f3 5e 4e fd 89 d8 5b 41 5e 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 bb 00 f0 ff ff ff 7f 00 00 48 39 d9 73 74 0f 01 cb <88> 01 31 c9 0f 01 ca c3 66 0f 1f 44 00 00 48 bb ff ef ff ff ff 7f RSP: 0018:ffffc90002cf79a0 EFLAGS: 00050246 RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 00007ffe3b1a2dc0 RDX: 0000000000000000 RSI: 0000000000000dc0 RDI: 0000000000000000 RBP: ffffc90002cf7b70 R08: ffffffff81b726b9 R09: ffffed1003139b29 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11003139e19 R13: 0000000000000340 R14: 0000000000000340 R15: 00007ffe3b1a2dc0 fault_in_writeable+0x4e/0x140 mm/gup.c:1713 copy_fpstate_to_sigframe+0x49e/0xb40 arch/x86/kernel/fpu/signal.c:208 get_sigframe+0x378/0x4b0 arch/x86/kernel/signal.c:295 __setup_rt_frame arch/x86/kernel/signal.c:471 [inline] setup_rt_frame arch/x86/kernel/signal.c:780 [inline] handle_signal arch/x86/kernel/signal.c:824 [inline] arch_do_signal_or_restart+0x4ac/0x1890 arch/x86/kernel/signal.c:869 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff7ec5d0fe5 Code: 24 0c 89 3c 24 48 89 4c 24 18 e8 c6 57 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 <44> 89 c7 48 89 04 24 e8 1f 58 ff ff 48 8b 04 24 48 83 c4 28 f7 d8 RSP: 002b:00007ffe3b1a31c0 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: fffffffffffffffc RBX: 00000000000002fd RCX: 00007ff7ec5d0fe5 RDX: 00007ffe3b1a3200 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007ffe3b1a325c R08: 0000000000000000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032 R13: 000000000002eee1 R14: 000000000002ee90 R15: 00007ffe3b1a32b0 ---------------- Code disassembly (best guess): 0: e8 f3 5e 4e fd call 0xfd4e5ef8 5: 89 d8 mov %ebx,%eax 7: 5b pop %rbx 8: 41 5e pop %r14 a: 5d pop %rbp b: c3 ret c: cc int3 d: cc int3 e: cc int3 f: cc int3 10: cc int3 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: cc int3 16: cc int3 17: cc int3 18: 48 bb 00 f0 ff ff ff movabs $0x7ffffffff000,%rbx 1f: 7f 00 00 22: 48 39 d9 cmp %rbx,%rcx 25: 73 74 jae 0x9b 27: 0f 01 cb stac * 2a: 88 01 mov %al,(%rcx) <-- trapping instruction 2c: 31 c9 xor %ecx,%ecx 2e: 0f 01 ca clac 31: c3 ret 32: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 38: 48 rex.W 39: bb ff ef ff ff mov $0xffffefff,%ebx 3e: ff (bad) 3f: 7f .byte 0x7f