------------[ cut here ]------------
WARNING: CPU: 1 PID: 4187 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 1 PID: 4187 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 3d f7 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 c0 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000dcf9b8 EFLAGS: 00010246
RAX: ffffffff819ed760 RBX: 0000000000000008 RCX: ffff88801ff85940
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed1003ff0b29
R10: ffffed1003ff0b29 R11: 1ffff11003ff0b28 R12: ffff88801ff870c8
R13: 00007ffffffff000 R14: ffffc90000dcfa28 R15: 0000000020000000
FS: 000055555a07e500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 0000000063ba4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_63d51858d7cca270+0x3d/0x108
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
__bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118
trace_kfree include/trace/events/kmem.h:118 [inline]
kfree+0x25f/0x2a0 mm/slub.c:4554
skb_free_head net/core/skbuff.c:655 [inline]
skb_release_data+0x6fe/0x850 net/core/skbuff.c:677
skb_release_all net/core/skbuff.c:742 [inline]
__kfree_skb+0x4c/0x60 net/core/skbuff.c:756
tcp_clean_rtx_queue net/ipv4/tcp_input.c:3407 [inline]
tcp_ack+0x2086/0x6260 net/ipv4/tcp_input.c:3964
tcp_rcv_established+0xea6/0x1cb0 net/ipv4/tcp_input.c:5981
tcp_v4_do_rcv+0x44b/0x9b0 net/ipv4/tcp_ipv4.c:1731
tcp_v4_rcv+0x268f/0x2cb0 net/ipv4/tcp_ipv4.c:2143
ip_protocol_deliver_rcu+0x3ad/0x770 net/ipv4/ip_input.c:204
ip_local_deliver_finish+0x1d5/0x320 net/ipv4/ip_input.c:231
NF_HOOK+0x2d6/0x360 include/linux/netfilter.h:302
dst_input include/net/dst.h:462 [inline]
ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
ip_sublist_rcv+0xa1f/0xce0 net/ipv4/ip_input.c:636
ip_list_rcv+0x3df/0x430 net/ipv4/ip_input.c:671
__netif_receive_skb_list_ptype net/core/dev.c:5568 [inline]
__netif_receive_skb_list_core+0x574/0x740 net/core/dev.c:5616
__netif_receive_skb_list net/core/dev.c:5668 [inline]
netif_receive_skb_list_internal+0x871/0xb90 net/core/dev.c:5759
gro_normal_list net/core/dev.c:5913 [inline]
napi_complete_done+0x37d/0x830 net/core/dev.c:6651
virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
virtnet_poll+0x912/0xef0 drivers/net/virtio_net.c:1624
__napi_poll+0xc0/0x430 net/core/dev.c:7075
napi_poll net/core/dev.c:7142 [inline]
net_rx_action+0x4a8/0x9c0 net/core/dev.c:7232
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:667
RIP: 0010:finish_lock_switch+0x134/0x280 kernel/sched/core.c:4804
Code: be ff ff ff ff e8 4c 7d 55 08 85 c0 74 4a 4d 85 ff 75 66 0f 1f 44 00 00 48 89 df e8 a6 e7 5e 08 e8 c1 75 2a 00 fb 48 83 c4 08 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 48 89 df e8 d9 0f fe ff 43 80 3c
RSP: 0018:ffffc90002e8ea68 EFLAGS: 00000282
RAX: 9bee71fe6a71b400 RBX: ffff8880b913a340 RCX: 9bee71fe6a71b400
RDX: dffffc0000000000 RSI: ffffffff8a0b1820 RDI: ffffffff8a59a480
RBP: 1ffff11017227613 R08: dffffc0000000000 R09: fffffbfff1ff782b
R10: fffffbfff1ff782b R11: 1ffffffff1ff782a R12: 1ffff110172275c1
R13: dffffc0000000000 R14: ffff8880b913ae08 R15: 0000000000000000
finish_task_switch+0x12f/0x640 kernel/sched/core.c:4921
context_switch kernel/sched/core.c:5052 [inline]
__schedule+0x11c3/0x4390 kernel/sched/core.c:6395
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6571
preempt_schedule+0xa7/0xb0 kernel/sched/core.c:6596
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
unwind_next_frame+0x12ac/0x1d90 arch/x86/kernel/unwind_orc.c:616
__unwind_start+0x5bb/0x740 arch/x86/kernel/unwind_orc.c:704
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xda/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522
kmalloc_node include/linux/slab.h:622 [inline]
kzalloc_node include/linux/slab.h:746 [inline]
__get_vm_area_node+0x119/0x2d0 mm/vmalloc.c:2423
__vmalloc_node_range+0xef/0x8b0 mm/vmalloc.c:3027
__vmalloc_node mm/vmalloc.c:3087 [inline]
vzalloc+0x75/0x80 mm/vmalloc.c:3157
alloc_counters+0xd0/0x730 net/ipv4/netfilter/ip_tables.c:800
copy_entries_to_user net/ipv4/netfilter/ip_tables.c:822 [inline]
get_entries net/ipv4/netfilter/ip_tables.c:1023 [inline]
do_ipt_get_ctl+0x9f7/0x1070 net/ipv4/netfilter/ip_tables.c:1669
nf_getsockopt+0x25e/0x280 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x115a/0x1590 net/ipv4/ip_sockglue.c:1797
tcp_getsockopt+0x1e3/0x2390 net/ipv4/tcp.c:4313
__sys_getsockopt+0x1b0/0x230 net/socket.c:2247
__do_sys_getsockopt net/socket.c:2262 [inline]
__se_sys_getsockopt net/socket.c:2259 [inline]
__x64_sys_getsockopt+0xb1/0xc0 net/socket.c:2259
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff0bb806c0a
Code: ff c3 66 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb b8 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7
RSP: 002b:00007ffd793c7fd8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007ffd793c8060 RCX: 00007ff0bb806c0a
RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000003 R08: 00007ffd793c7ffc R09: 00007ffd793c8417
R10: 00007ffd793c8060 R11: 0000000000000212 R12: 00007ff0bba2bbe0
R13: 00007ffd793c7ffc R14: 0000000000000000 R15: 00007ff0bba2d020
----------------
Code disassembly (best guess):
0: be ff ff ff ff mov $0xffffffff,%esi
5: e8 4c 7d 55 08 call 0x8557d56
a: 85 c0 test %eax,%eax
c: 74 4a je 0x58
e: 4d 85 ff test %r15,%r15
11: 75 66 jne 0x79
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 48 89 df mov %rbx,%rdi
1b: e8 a6 e7 5e 08 call 0x85ee7c6
20: e8 c1 75 2a 00 call 0x2a75e6
25: fb sti
26: 48 83 c4 08 add $0x8,%rsp
* 2a: 5b pop %rbx <-- trapping instruction
2b: 41 5c pop %r12
2d: 41 5d pop %r13
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: 5d pop %rbp
34: c3 ret
35: 48 89 df mov %rbx,%rdi
38: e8 d9 0f fe ff call 0xfffe1016
3d: 43 rex.XB
3e: 80 .byte 0x80
3f: 3c .byte 0x3c