bridge0: port 1(bridge_slave_0) entered forwarding state
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4841 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 4841 Comm: kworker/u4:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 3d f7 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 c0 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000006a58 EFLAGS: 00010246
RAX: ffffffff819ed760 RBX: 0000000000000000 RCX: ffff8880296ebb80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed10052dd771
R10: ffffed10052dd771 R11: 1ffff110052dd770 R12: ffff8880296ed308
R13: 00007ffffffff000 R14: ffffc90000006ac8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc868fca6c0 CR3: 000000007390d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_3d2613b5dfc7747f+0x32/0xde0
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x17e/0x320 kernel/trace/bpf_trace.c:1916
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1e7/0x210 mm/slub.c:3521
tcp_clean_rtx_queue net/ipv4/tcp_input.c:3407 [inline]
tcp_ack+0x2086/0x6260 net/ipv4/tcp_input.c:3964
tcp_rcv_established+0xea6/0x1cb0 net/ipv4/tcp_input.c:5981
tcp_v4_do_rcv+0x44b/0x9b0 net/ipv4/tcp_ipv4.c:1731
tcp_v4_rcv+0x268f/0x2cb0 net/ipv4/tcp_ipv4.c:2143
ip_protocol_deliver_rcu+0x3ad/0x770 net/ipv4/ip_input.c:204
ip_local_deliver_finish+0x1d5/0x320 net/ipv4/ip_input.c:231
NF_HOOK+0x2d6/0x360 include/linux/netfilter.h:302
dst_input include/net/dst.h:462 [inline]
ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
ip_sublist_rcv+0xa1f/0xce0 net/ipv4/ip_input.c:636
ip_list_rcv+0x3df/0x430 net/ipv4/ip_input.c:671
__netif_receive_skb_list_ptype net/core/dev.c:5568 [inline]
__netif_receive_skb_list_core+0x574/0x740 net/core/dev.c:5616
__netif_receive_skb_list net/core/dev.c:5668 [inline]
netif_receive_skb_list_internal+0x871/0xb90 net/core/dev.c:5759
gro_normal_list net/core/dev.c:5913 [inline]
napi_complete_done+0x37d/0x830 net/core/dev.c:6651
virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
virtnet_poll+0x912/0xef0 drivers/net/virtio_net.c:1624
__napi_poll+0xc0/0x430 net/core/dev.c:7075
napi_poll net/core/dev.c:7142 [inline]
net_rx_action+0x4a8/0x9c0 net/core/dev.c:7232
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:667
RIP: 0010:get_vfs_caps_from_disk+0x0/0x680 security/commoncap.c:652
Code: 0a ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 1d ff ff ff 4c 89 f7 e8 9d a4 23 fe 48 8b 34 24 e9 0c ff ff ff 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 00
RSP: 0018:ffffc9000349f948 EFLAGS: 00000246
RAX: 1ffff11003575543 RBX: ffff888060d26848 RCX: ffff8880296ebb80
RDX: ffffc9000349fa08 RSI: ffff888076f16178 RDI: ffffffff8bfca3c0
RBP: ffff88802acd6a00 R08: dffffc0000000000 R09: ffffed10052dd822
R10: ffffed10052dd822 R11: 1ffff110052dd821 R12: ffffffff8bfca3c0
R13: 1ffff11003575542 R14: dffffc0000000000 R15: ffff88801abaaa10
get_file_caps security/commoncap.c:753 [inline]
cap_bprm_creds_from_file+0x2dc/0x1820 security/commoncap.c:905
security_bprm_creds_from_file+0x67/0x90 security/security.c:861
bprm_creds_from_file fs/exec.c:1658 [inline]
begin_new_exec+0x3ff/0x1160 fs/exec.c:1249
load_elf_binary+0x98e/0x2890 fs/binfmt_elf.c:1001
search_binary_handler fs/exec.c:1742 [inline]
exec_binprm fs/exec.c:1783 [inline]
bprm_execve+0xa92/0x17d0 fs/exec.c:1852
kernel_execve+0x82a/0x900 fs/exec.c:2013
call_usermodehelper_exec_async+0x207/0x350 kernel/umh.c:112
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess), 3 bytes skipped:
0: ff 44 89 f1 incl -0xf(%rcx,%rcx,4)
4: 80 e1 07 and $0x7,%cl
7: 80 c1 03 add $0x3,%cl
a: 38 c1 cmp %al,%cl
c: 0f 8c 1d ff ff ff jl 0xffffff2f
12: 4c 89 f7 mov %r14,%rdi
15: e8 9d a4 23 fe call 0xfe23a4b7
1a: 48 8b 34 24 mov (%rsp),%rsi
1e: e9 0c ff ff ff jmp 0xffffff2f
23: 0f 1f 40 00 nopl 0x0(%rax)
* 27: 55 push %rbp <-- trapping instruction
28: 48 89 e5 mov %rsp,%rbp
2b: 41 57 push %r15
2d: 41 56 push %r14
2f: 41 55 push %r13
31: 41 54 push %r12
33: 53 push %rbx
34: 48 83 e4 e0 and $0xffffffffffffffe0,%rsp
38: 48 rex.W
39: 81 .byte 0x81
3a: ec in (%dx),%al
3b: a0 .byte 0xa0