BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 6c12067 P4D 6c12067 PUD 6c14067 PMD 6c16067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 6592 Comm: syz-executor.1 Not tainted 6.1.75-syzkaller-00037-gdcb09569bbff #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:copy_from_kernel_nofault+0x86/0x2d0 mm/maccess.c:36 Code: 48 89 55 d0 0f 85 de 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 bb 3a d2 ff 49 83 fd 07 76 58 4d 89 fe 49 83 c7 08 49 83 c5 f8 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 RSP: 0000:ffffc90000a078d0 EFLAGS: 00010257 RAX: 0000000080000101 RBX: 00007ffffffff000 RCX: ffff88811c8cbcc0 RDX: ffff88811c8cc860 RSI: 0000000000000008 RDI: 0000000000000007 RBP: ffffc90000a07908 R08: ffffffff81a327a5 R09: ffffed1023919799 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 R13: 0000000000000000 R14: ffffc90000a07968 R15: ffffc90000a07970 FS: 000055555685c480(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 00000001b9ac8000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: bpf_probe_read_kernel_common kernel/trace/bpf_trace.c:230 [inline] ____bpf_probe_read_compat kernel/trace/bpf_trace.c:294 [inline] bpf_probe_read_compat+0x112/0x180 kernel/trace/bpf_trace.c:287 bpf_prog_baa065642a502c00+0x64/0x68 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline] __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run include/linux/filter.h:607 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2275 [inline] bpf_trace_run3+0x177/0x2e0 kernel/trace/bpf_trace.c:2315 __bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:114 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline] kmem_cache_free+0x4e7/0x510 mm/slub.c:3705 dst_destroy+0x223/0x320 net/core/dst.c:127 dst_destroy_rcu+0x19/0x20 net/core/dst.c:140 rcu_do_batch+0x518/0xb70 kernel/rcu/tree.c:2264 rcu_core+0x4ee/0xf10 kernel/rcu/tree.c:2524 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2541 __do_softirq+0x1d8/0x661 kernel/softirq.c:617 invoke_softirq kernel/softirq.c:472 [inline] __irq_exit_rcu+0x50/0xf0 kernel/softirq.c:700 irq_exit_rcu+0x9/0x10 kernel/softirq.c:712 sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:653 RIP: 0033:0x7f6188439bc1 Code: f8 c1 e8 04 31 f8 69 c0 2d eb d4 27 89 c7 c1 ef 0f 31 f8 48 31 d0 25 ff 0f 00 00 09 c5 80 3d f6 ba c9 00 00 0f 85 6f ff ff ff <44> 0f b6 6c 24 0f 44 8d 55 04 89 e8 41 89 c1 41 81 e1 ff 1f 00 00 RSP: 002b:00007ffd4b4c41d0 EFLAGS: 00000246 RAX: 000000000000086d RBX: 00007f61885ac018 RCX: 000000000002e735 RDX: ffffffff81b57cad RSI: 0000000080000000 RDI: 000000000001e053 RBP: 0000000081b5786d R08: 0000001b33920000 R09: 0000000000001bd7 R10: 0000000081c35bdb R11: 000000000000006f R12: 000000000002e735 R13: 0000000000000001 R14: 00007f61885a0000 R15: ffffffff81b57cad Modules linked in: CR2: ffffffffff600000 ---[ end trace 0000000000000000 ]--- RIP: 0010:copy_from_kernel_nofault+0x86/0x2d0 mm/maccess.c:36 Code: 48 89 55 d0 0f 85 de 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 bb 3a d2 ff 49 83 fd 07 76 58 4d 89 fe 49 83 c7 08 49 83 c5 f8 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 RSP: 0000:ffffc90000a078d0 EFLAGS: 00010257 RAX: 0000000080000101 RBX: 00007ffffffff000 RCX: ffff88811c8cbcc0 RDX: ffff88811c8cc860 RSI: 0000000000000008 RDI: 0000000000000007 RBP: ffffc90000a07908 R08: ffffffff81a327a5 R09: ffffed1023919799 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 R13: 0000000000000000 R14: ffffc90000a07968 R15: ffffc90000a07970 FS: 000055555685c480(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600000 CR3: 00000001b9ac8000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 48 89 55 d0 mov %rdx,-0x30(%rbp) 4: 0f 85 de 01 00 00 jne 0x1e8 a: ff 02 incl (%rdx) c: bf 07 00 00 00 mov $0x7,%edi 11: 4c 89 ee mov %r13,%rsi 14: e8 bb 3a d2 ff call 0xffd23ad4 19: 49 83 fd 07 cmp $0x7,%r13 1d: 76 58 jbe 0x77 1f: 4d 89 fe mov %r15,%r14 22: 49 83 c7 08 add $0x8,%r15 26: 49 83 c5 f8 add $0xfffffffffffffff8,%r13 * 2a: 49 8b 1c 24 mov (%r12),%rbx <-- trapping instruction 2e: 4c 89 f0 mov %r14,%rax 31: 48 c1 e8 03 shr $0x3,%rax 35: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 3c: fc ff df 3f: 80 .byte 0x80