CFI failure at __traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:94 (target: tp_stub_func+0x0/0x10; expected type: 0x8682d211)
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7276 Comm: kworker/1:10 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:__traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:94
Code: 8b 3d 20 5f ca 05 4d 85 ff 74 2e 48 89 d3 49 89 f6 49 8b 07 49 8b 7f 08 4c 89 f6 48 89 da 41 ba ef 2d 7d 79 44 03 50 fc 74 02 <0f> 0b ff d0 49 83 7f 18 00 4d 8d 7f 18 75 d8 31 c0 5b 41 5e 41 5f
RSP: 0018:ffffc900001b0b98 EFLAGS: 00010213
RAX: ffffffff817123b0 RBX: 0000000000000000 RCX: ffff88810eaba880
RDX: 0000000000000000 RSI: ffffffff81a37545 RDI: ffffc9000ebe9000
RBP: ffffc900001b0bb0 R08: 0000000000000004 R09: 0000000000000003
R10: 000000001ebd94fb R11: 1ffff92000036140 R12: ffffffff817fdf50
R13: ffff888119425418 R14: ffffffff81a37545 R15: ffff88812160eba8
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faef2837000 CR3: 0000000119ce2000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 trace_kfree include/trace/events/kmem.h:94 [inline]
 kfree+0xc9/0xf0 mm/slab_common.c:977
 kvfree+0x35/0x40 mm/util.c:639
 __bpf_prog_put_rcu+0x3b/0xc0 kernel/bpf/syscall.c:2038
 rcu_do_batch+0x515/0xb90 kernel/rcu/tree.c:2297
 rcu_core+0x5a5/0xe70 kernel/rcu/tree.c:2557
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:262 [inline]
 sysvec_call_function_single+0xa6/0xc0 arch/x86/kernel/smp.c:262
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1b/0x20 arch/x86/include/asm/idtentry.h:699
RIP: 0010:console_emit_next_record+0x9e3/0xbc0 kernel/printk/printk.c:2797
Code: de 48 81 e6 00 02 00 00 31 ff e8 f8 49 19 00 48 81 e3 00 02 00 00 75 07 e8 2a 45 19 00 eb 06 e8 23 45 19 00 fb 0f b6 5c 24 07 <48> c7 84 24 80 00 00 00 0e 36 e0 45 4b c7 04 2e 00 00 00 00 4b c7
RSP: 0018:ffffc9000df9f1a0 EFLAGS: 00000287
RAX: ffffffff8156c23d RBX: 0000000000000001 RCX: 0000000000100000
RDX: ffffc9000e375000 RSI: 0000000000002d8d RDI: 0000000000002d8e
RBP: ffffc9000df9f3b0 R08: 0000000000000004 R09: 0000000000000003
R10: fffff52001bf3e24 R11: 1ffff92001bf3e24 R12: ffffc9000df9f3ff
R13: dffffc0000000000 R14: 1ffff92001bf3e44 R15: 0000000000000054
 console_flush_all kernel/printk/printk.c:-1 [inline]
 console_unlock+0x23d/0x550 kernel/printk/printk.c:2917
 vprintk_emit+0x14d/0x410 kernel/printk/printk.c:2308
 dev_vprintk_emit+0x330/0x3d8 drivers/base/core.c:4934
 dev_printk_emit+0xdd/0x120 drivers/base/core.c:4945
 __dev_printk+0x17f/0x1b0 drivers/base/core.c:4957
 _dev_info+0x107/0x150 drivers/base/core.c:5003
 hub_port_init+0x1995/0x2880 drivers/usb/core/hub.c:4988
 hub_port_connect drivers/usb/core/hub.c:5495 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5706 [inline]
 port_event drivers/usb/core/hub.c:5866 [inline]
 hub_event+0x2643/0x4680 drivers/usb/core/hub.c:5948
 process_one_work+0x71f/0xc40 kernel/workqueue.c:2302
 worker_thread+0xa29/0x11f0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:94
Code: 8b 3d 20 5f ca 05 4d 85 ff 74 2e 48 89 d3 49 89 f6 49 8b 07 49 8b 7f 08 4c 89 f6 48 89 da 41 ba ef 2d 7d 79 44 03 50 fc 74 02 <0f> 0b ff d0 49 83 7f 18 00 4d 8d 7f 18 75 d8 31 c0 5b 41 5e 41 5f
RSP: 0018:ffffc900001b0b98 EFLAGS: 00010213
RAX: ffffffff817123b0 RBX: 0000000000000000 RCX: ffff88810eaba880
RDX: 0000000000000000 RSI: ffffffff81a37545 RDI: ffffc9000ebe9000
RBP: ffffc900001b0bb0 R08: 0000000000000004 R09: 0000000000000003
R10: 000000001ebd94fb R11: 1ffff92000036140 R12: ffffffff817fdf50
R13: ffff888119425418 R14: ffffffff81a37545 R15: ffff88812160eba8
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faef2837000 CR3: 0000000119ce2000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 81 e6 00 02 00 00 	and    $0x200,%rsi
   7:	31 ff                	xor    %edi,%edi
   9:	e8 f8 49 19 00       	call   0x194a06
   e:	48 81 e3 00 02 00 00 	and    $0x200,%rbx
  15:	75 07                	jne    0x1e
  17:	e8 2a 45 19 00       	call   0x194546
  1c:	eb 06                	jmp    0x24
  1e:	e8 23 45 19 00       	call   0x194546
  23:	fb                   	sti
  24:	0f b6 5c 24 07       	movzbl 0x7(%rsp),%ebx
* 29:	48 c7 84 24 80 00 00 	movq   $0x45e0360e,0x80(%rsp) <-- trapping instruction
  30:	00 0e 36 e0 45
  35:	4b c7 04 2e 00 00 00 	movq   $0x0,(%r14,%r13,1)
  3c:	00
  3d:	4b                   	rex.WXB
  3e:	c7                   	.byte 0xc7