------------[ cut here ]------------
WARNING: CPU: 1 PID: 4175 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 1 PID: 4175 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 7d 94 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 00 91 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000dd0bb8 EFLAGS: 00010006
RAX: ffffffff81a08ea0 RBX: 0000000000000008 RCX: ffff88807a5c8000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88807a5c8007 R09: 1ffff1100f4b9000
R10: dffffc0000000000 R11: ffffed100f4b9001 R12: ffff88807a5c9788
R13: 00007ffffffff000 R14: ffffc90000dd0c28 R15: 0000000020000000
FS: 00007fc129a23880(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbc60d64dac CR3: 0000000027d24000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_63d51858d7cca270+0x3d/0x9d0
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x163/0x2e0 kernel/trace/bpf_trace.c:1915
trace_hrtimer_start include/trace/events/timer.h:199 [inline]
debug_activate kernel/time/hrtimer.c:466 [inline]
enqueue_hrtimer+0x314/0x370 kernel/time/hrtimer.c:1069
__run_hrtimer kernel/time/hrtimer.c:1702 [inline]
__hrtimer_run_queues+0x5f3/0xb70 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x3bb/0x8d0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:raw_spin_rq_unlock_irq+0x13/0x90 kernel/sched/sched.h:1339
Code: c0 48 8b 3c 24 e8 6d b7 69 00 eb b5 66 2e 0f 1f 84 00 00 00 00 00 90 41 57 41 56 53 66 90 e8 54 ea 70 08 e8 df de 2a 00 fb 5b <41> 5e 41 5f c3 49 be 00 00 00 00 00 fc ff df 49 89 ff 48 8d 9f 58
RSP: 0018:ffffc900011df168 EFLAGS: 00000286
RAX: fc5cfffd29172900 RBX: ffff8880b913a340 RCX: fc5cfffd29172900
RDX: dffffc0000000000 RSI: ffffffff8a2b2780 RDI: ffffffff8a79f780
RBP: ffffc900011df350 R08: ffffffff901d117f R09: 1ffffffff203a22f
R10: dffffc0000000000 R11: fffffbfff203a230 R12: 1ffff110172275ab
R13: dffffc0000000000 R14: ffff88807a5c8000 R15: ffff88807a5c8000
__schedule+0x1497/0x43c0 kernel/sched/core.c:6401
preempt_schedule_notrace+0xd9/0x120 kernel/sched/core.c:6650
preempt_schedule_notrace_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
rcu_is_watching+0x72/0xa0 kernel/rcu/tree.c:1124
trace_lock_release include/trace/events/lock.h:58 [inline]
lock_release+0xb5/0x8a0 kernel/locking/lockdep.c:5634
up_write+0x29/0x420 kernel/locking/rwsem.c:1603
inode_unlock include/linux/fs.h:792 [inline]
process_measurement+0x6f6/0x1ba0 security/integrity/ima/ima_main.c:254
ima_file_check+0xc7/0x110 security/integrity/ima/ima_main.c:533
do_open fs/namei.c:3618 [inline]
path_openat+0x27a8/0x2fa0 fs/namei.c:3750
do_filp_open+0x1e2/0x410 fs/namei.c:3777
do_sys_openat2+0x150/0x4b0 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc129b11407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff32650380 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc129a23880 RCX: 00007fc129b11407
RDX: 0000000000080000 RSI: 00007fff32650500 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000562188bdc7f5
R13: 0000562188bdc7f5 R14: 0000000000000001 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: c0 48 8b 3c rorb $0x3c,-0x75(%rax)
4: 24 e8 and $0xe8,%al
6: 6d insl (%dx),%es:(%rdi)
7: b7 69 mov $0x69,%bh
9: 00 eb add %ch,%bl
b: b5 66 mov $0x66,%ch
d: 2e 0f 1f 84 00 00 00 cs nopl 0x0(%rax,%rax,1)
14: 00 00
16: 90 nop
17: 41 57 push %r15
19: 41 56 push %r14
1b: 53 push %rbx
1c: 66 90 xchg %ax,%ax
1e: e8 54 ea 70 08 call 0x870ea77
23: e8 df de 2a 00 call 0x2adf07
28: fb sti
29: 5b pop %rbx
* 2a: 41 5e pop %r14 <-- trapping instruction
2c: 41 5f pop %r15
2e: c3 ret
2f: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14
36: fc ff df
39: 49 89 ff mov %rdi,%r15
3c: 48 rex.W
3d: 8d .byte 0x8d
3e: 9f lahf
3f: 58 pop %rax