------------[ cut here ]------------ WARNING: CPU: 1 PID: 3500 at kernel/softirq.c:363 __local_bh_enable_ip+0x1b3/0x1f0 Modules linked in: CPU: 1 PID: 3500 Comm: syz-executor107 Not tainted 5.15.153-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__local_bh_enable_ip+0x1b3/0x1f0 kernel/softirq.c:363 Code: 04 25 28 00 00 00 48 3b 44 24 60 75 4a 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b e9 d0 fe ff ff e8 3f 00 00 00 eb a2 <0f> 0b e9 02 ff ff ff 48 c7 c1 c4 c8 e3 8d 80 e1 07 80 c1 03 38 c1 RSP: 0018:ffffc90002fb6e00 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 1ffff920005f6dc4 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff884eb75b RBP: ffffc90002fb6eb8 R08: dffffc0000000000 R09: ffffed100f37cfb6 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: ffff88801dba9280 R14: ffffc90002fb6e40 R15: 0000000000000201 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4121d36110 CR3: 000000000c68e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __sock_map_delete net/core/sock_map.c:426 [inline] sock_map_delete_elem+0xcb/0x130 net/core/sock_map.c:448 bpf_prog_8c0e092b1e199972+0x5b/0x7ac bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline] __bpf_prog_run include/linux/filter.h:628 [inline] bpf_prog_run include/linux/filter.h:635 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline] bpf_trace_run3+0x1d1/0x380 kernel/trace/bpf_trace.c:1918 __traceiter_sched_switch+0x7d/0xb0 include/trace/events/sched.h:220 trace_sched_switch include/trace/events/sched.h:220 [inline] __schedule+0x1e8d/0x45b0 kernel/sched/core.c:6373 preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6780 irqentry_exit+0x53/0x80 kernel/entry/common.c:426 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:preempt_count_add+0x12/0x180 kernel/sched/core.c:5485 Code: e8 33 b8 72 00 eb 8c e9 f2 fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 57 41 56 53 89 fb 48 c7 c0 c0 7f 3c 91 48 c1 e8 03 <49> bf 00 00 00 00 00 fc ff df 42 0f b6 04 38 84 c0 0f 85 e2 00 00 RSP: 0018:ffffc90002fb73a8 EFLAGS: 00000a02 RAX: 1ffffffff2278ff8 RBX: 0000000000000001 RCX: 1ffff920005f6e97 RDX: dffffc0000000000 RSI: ffffffff81bf4967 RDI: 0000000000000001 RBP: ffffc90002fb74b8 R08: 0000000000000001 R09: ffffc90002fb7570 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90002fb7800 R13: ffffffff816dd330 R14: ffffffff81bf4967 R15: ffffc90002fb7480 unwind_next_frame+0xbb/0x1fa0 arch/x86/kernel/unwind_orc.c:433 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122 save_stack+0xf6/0x1e0 mm/page_owner.c:119 __reset_page_owner+0x52/0x180 mm/page_owner.c:140 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317 free_unref_page_list+0x1f7/0x8e0 mm/page_alloc.c:3433 release_pages+0x1bb9/0x1f40 mm/swap.c:963 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:240 [inline] tlb_flush_mmu mm/mmu_gather.c:247 [inline] tlb_finish_mmu+0x177/0x320 mm/mmu_gather.c:338 exit_mmap+0x3cd/0x670 mm/mmap.c:3188 __mmput+0x112/0x3b0 kernel/fork.c:1126 exit_mm+0x688/0x7f0 kernel/exit.c:548 do_exit+0x626/0x2480 kernel/exit.c:859 do_group_exit+0x144/0x310 kernel/exit.c:994 __do_sys_exit_group kernel/exit.c:1005 [inline] __se_sys_exit_group kernel/exit.c:1003 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1003 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f4121cbad49 Code: Unable to access opcode bytes at RIP 0x7f4121cbad1f. RSP: 002b:00007ffdf8515658 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4121cbad49 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f4121d352b0 R08: ffffffffffffffb8 R09: 0000000000000006 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4121d352b0 R13: 0000000000000000 R14: 00007f4121d35d00 R15: 00007f4121c8bfb0 </TASK> ---------------- Code disassembly (best guess): 0: e8 33 b8 72 00 call 0x72b838 5: eb 8c jmp 0xffffff93 7: e9 f2 fe ff ff jmp 0xfffffefe c: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 13: 00 00 00 16: 66 90 xchg %ax,%ax 18: 41 57 push %r15 1a: 41 56 push %r14 1c: 53 push %rbx 1d: 89 fb mov %edi,%ebx 1f: 48 c7 c0 c0 7f 3c 91 mov $0xffffffff913c7fc0,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15 <-- trapping instruction 31: fc ff df 34: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax 39: 84 c0 test %al,%al 3b: 0f .byte 0xf 3c: 85 e2 test %esp,%edx