Extracting prog: 2m30.357279112s
Minimizing prog: 10m8.505268711s
Simplifying prog options: 0s
Extracting C: 46.212809798s
Simplifying C: 9m23.982774675s
extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10)
program crashed: WARNING in bpf_probe_read_compat
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
program did not crash
testing program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r0}, 0x18)
program did not crash
extracting C reproducer
testing compiled C program (duration=45.788489889s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
simplifying C reproducer
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program did not crash
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
testing compiled C program (duration=45.788489889s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN
program crashed: WARNING in bpf_probe_read_compat
reproducing took 22m49.058153767s
repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4171 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 4171 Comm: syz-executor256 Not tainted 5.15.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 dd e3 d7 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 60 e0 d7 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000006d78 EFLAGS: 00010246
RAX: ffffffff819fe0e0 RBX: 0000000000000008 RCX: ffff88807726d940
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed100ee4db29
R10: ffffed100ee4db29 R11: 1ffff1100ee4db28 R12: ffff88807726f0c8
R13: 00007ffffffff000 R14: ffffc90000006de8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000075e0e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_dafeb42eb5660805+0x5e/0xbf4
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x17e/0x320 kernel/trace/bpf_trace.c:1916
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1e7/0x210 mm/slub.c:3516
packet_rcv+0x16a/0x1210 net/packet/af_packet.c:2243
dev_queue_xmit_nit+0xa69/0xb00 net/core/dev.c:2373
xmit_one net/core/dev.c:3644 [inline]
dev_hard_start_xmit+0x13e/0x7e0 net/core/dev.c:3665
sch_direct_xmit+0x24e/0x4a0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3884 [inline]
__dev_queue_xmit+0x170e/0x2ed0 net/core/dev.c:4253
NF_HOOK+0x2d4/0x360 include/linux/netfilter.h:302
arp_xmit+0x142/0x230 net/ipv4/arp.c:642
arp_process+0x1563/0x1a30 net/ipv4/arp.c:832
NF_HOOK+0x2d4/0x360 include/linux/netfilter.h:302
__netif_receive_skb_list_ptype net/core/dev.c:5573 [inline]
__netif_receive_skb_list_core+0x6db/0x740 net/core/dev.c:5616
__netif_receive_skb_list net/core/dev.c:5668 [inline]
netif_receive_skb_list_internal+0x871/0xb90 net/core/dev.c:5759
gro_normal_list net/core/dev.c:5913 [inline]
napi_complete_done+0x37d/0x830 net/core/dev.c:6651
virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
virtnet_poll+0x912/0xef0 drivers/net/virtio_net.c:1592
__napi_poll+0xc0/0x430 net/core/dev.c:7075
napi_poll net/core/dev.c:7142 [inline]
net_rx_action+0x4a8/0x9c0 net/core/dev.c:7232
handle_softirqs+0x328/0x820 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:667
RIP: 0010:unwind_next_frame+0x14/0x1d90 arch/x86/kernel/unwind_orc.c:423
Code: 97 48 89 df e8 ad ce 88 00 eb 8d 66 2e 0f 1f 84 00 00 00 00 00 90 55 41 57 41 56 41 55 41 54 53 48 81 ec 88 00 00 00 48 89 fb <49> be 00 00 00 00 00 fc ff df 48 8d 6f 48 48 89 e8 48 c1 e8 03 48
RSP: 0018:ffffc90002daf3a8 EFLAGS: 00000292
RAX: 0000000000000001 RBX: ffffc90002daf468 RCX: 0000000080000001
RDX: dffffc0000000000 RSI: ffffffff8147ca99 RDI: ffffc90002daf468
RBP: ffffc90002daf4f0 R08: ffffc90002daf530 R09: 000000000000000b
R10: fffff520005b5e99 R11: 1ffff920005b5e97 R12: ffff88807726d940
R13: ffff888029ba5d80 R14: ffffffff816663e0 R15: ffffc90002daf468
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0x8f/0x210 mm/slub.c:3515
pgtable_pte_page_dtor include/linux/mm.h:2266 [inline]
___pte_free_tlb+0x88/0x2a0 arch/x86/mm/pgtable.c:55
__pte_free_tlb arch/x86/include/asm/pgalloc.h:61 [inline]
free_pte_range mm/memory.c:231 [inline]
free_pmd_range mm/memory.c:249 [inline]
free_pud_range mm/memory.c:283 [inline]
free_p4d_range mm/memory.c:317 [inline]
free_pgd_range+0x622/0xb00 mm/memory.c:397
free_pgtables+0x271/0x2a0 mm/memory.c:-1
exit_mmap+0x39e/0x5f0 mm/mmap.c:3205
__mmput+0x115/0x3b0 kernel/fork.c:1127
exit_mm+0x567/0x6c0 kernel/exit.c:550
do_exit+0x599/0x20a0 kernel/exit.c:861
do_group_exit+0x12e/0x300 kernel/exit.c:996
__do_sys_exit_group kernel/exit.c:1007 [inline]
__se_sys_exit_group kernel/exit.c:1005 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1005
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f23d983cc89
Code: Unable to access opcode bytes at RIP 0x7f23d983cc5f.
RSP: 002b:00007ffd36ebe778 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f23d983cc89
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f23d98b7290 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f23d98b7290
R13: 0000000000000000 R14: 00007f23d98b7ce0 R15: 00007f23d980dec0
----------------
Code disassembly (best guess):
0: 97 xchg %eax,%edi
1: 48 89 df mov %rbx,%rdi
4: e8 ad ce 88 00 call 0x88ceb6
9: eb 8d jmp 0xffffff98
b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
12: 00 00 00
15: 90 nop
16: 55 push %rbp
17: 41 57 push %r15
19: 41 56 push %r14
1b: 41 55 push %r13
1d: 41 54 push %r12
1f: 53 push %rbx
20: 48 81 ec 88 00 00 00 sub $0x88,%rsp
27: 48 89 fb mov %rdi,%rbx
* 2a: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 <-- trapping instruction
31: fc ff df
34: 48 8d 6f 48 lea 0x48(%rdi),%rbp
38: 48 89 e8 mov %rbp,%rax
3b: 48 c1 e8 03 shr $0x3,%rax
3f: 48 rex.W
final repro crashed as (corrupted=false):
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4171 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 4171 Comm: syz-executor256 Not tainted 5.15.184-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 dd e3 d7 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 60 e0 d7 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000006d78 EFLAGS: 00010246
RAX: ffffffff819fe0e0 RBX: 0000000000000008 RCX: ffff88807726d940
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed100ee4db29
R10: ffffed100ee4db29 R11: 1ffff1100ee4db28 R12: ffff88807726f0c8
R13: 00007ffffffff000 R14: ffffc90000006de8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000075e0e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_dafeb42eb5660805+0x5e/0xbf4
bpf_dispatcher_nop_func include/linux/bpf.h:790 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run3+0x17e/0x320 kernel/trace/bpf_trace.c:1916
__bpf_trace_kmem_cache_free+0x99/0xc0 include/trace/events/kmem.h:138
trace_kmem_cache_free include/trace/events/kmem.h:138 [inline]
kmem_cache_free+0x1e7/0x210 mm/slub.c:3516
packet_rcv+0x16a/0x1210 net/packet/af_packet.c:2243
dev_queue_xmit_nit+0xa69/0xb00 net/core/dev.c:2373
xmit_one net/core/dev.c:3644 [inline]
dev_hard_start_xmit+0x13e/0x7e0 net/core/dev.c:3665
sch_direct_xmit+0x24e/0x4a0 net/sched/sch_generic.c:342
__dev_xmit_skb net/core/dev.c:3884 [inline]
__dev_queue_xmit+0x170e/0x2ed0 net/core/dev.c:4253
NF_HOOK+0x2d4/0x360 include/linux/netfilter.h:302
arp_xmit+0x142/0x230 net/ipv4/arp.c:642
arp_process+0x1563/0x1a30 net/ipv4/arp.c:832
NF_HOOK+0x2d4/0x360 include/linux/netfilter.h:302
__netif_receive_skb_list_ptype net/core/dev.c:5573 [inline]
__netif_receive_skb_list_core+0x6db/0x740 net/core/dev.c:5616
__netif_receive_skb_list net/core/dev.c:5668 [inline]
netif_receive_skb_list_internal+0x871/0xb90 net/core/dev.c:5759
gro_normal_list net/core/dev.c:5913 [inline]
napi_complete_done+0x37d/0x830 net/core/dev.c:6651
virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
virtnet_poll+0x912/0xef0 drivers/net/virtio_net.c:1592
__napi_poll+0xc0/0x430 net/core/dev.c:7075
napi_poll net/core/dev.c:7142 [inline]
net_rx_action+0x4a8/0x9c0 net/core/dev.c:7232
handle_softirqs+0x328/0x820 kernel/softirq.c:558
__do_softirq kernel/softirq.c:592 [inline]
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:641
irq_exit_rcu+0x5/0x20 kernel/softirq.c:653
common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:667
RIP: 0010:unwind_next_frame+0x14/0x1d90 arch/x86/kernel/unwind_orc.c:423
Code: 97 48 89 df e8 ad ce 88 00 eb 8d 66 2e 0f 1f 84 00 00 00 00 00 90 55 41 57 41 56 41 55 41 54 53 48 81 ec 88 00 00 00 48 89 fb <49> be 00 00 00 00 00 fc ff df 48 8d 6f 48 48 89 e8 48 c1 e8 03 48
RSP: 0018:ffffc90002daf3a8 EFLAGS: 00000292
RAX: 0000000000000001 RBX: ffffc90002daf468 RCX: 0000000080000001
RDX: dffffc0000000000 RSI: ffffffff8147ca99 RDI: ffffc90002daf468
RBP: ffffc90002daf4f0 R08: ffffc90002daf530 R09: 000000000000000b
R10: fffff520005b5e99 R11: 1ffff920005b5e97 R12: ffff88807726d940
R13: ffff888029ba5d80 R14: ffffffff816663e0 R15: ffffc90002daf468
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0xea/0x170 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kmem_cache_free+0x8f/0x210 mm/slub.c:3515
pgtable_pte_page_dtor include/linux/mm.h:2266 [inline]
___pte_free_tlb+0x88/0x2a0 arch/x86/mm/pgtable.c:55
__pte_free_tlb arch/x86/include/asm/pgalloc.h:61 [inline]
free_pte_range mm/memory.c:231 [inline]
free_pmd_range mm/memory.c:249 [inline]
free_pud_range mm/memory.c:283 [inline]
free_p4d_range mm/memory.c:317 [inline]
free_pgd_range+0x622/0xb00 mm/memory.c:397
free_pgtables+0x271/0x2a0 mm/memory.c:-1
exit_mmap+0x39e/0x5f0 mm/mmap.c:3205
__mmput+0x115/0x3b0 kernel/fork.c:1127
exit_mm+0x567/0x6c0 kernel/exit.c:550
do_exit+0x599/0x20a0 kernel/exit.c:861
do_group_exit+0x12e/0x300 kernel/exit.c:996
__do_sys_exit_group kernel/exit.c:1007 [inline]
__se_sys_exit_group kernel/exit.c:1005 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1005
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f23d983cc89
Code: Unable to access opcode bytes at RIP 0x7f23d983cc5f.
RSP: 002b:00007ffd36ebe778 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f23d983cc89
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f23d98b7290 R08: ffffffffffffffb8 R09: 0000000000000006
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f23d98b7290
R13: 0000000000000000 R14: 00007f23d98b7ce0 R15: 00007f23d980dec0
----------------
Code disassembly (best guess):
0: 97 xchg %eax,%edi
1: 48 89 df mov %rbx,%rdi
4: e8 ad ce 88 00 call 0x88ceb6
9: eb 8d jmp 0xffffff98
b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
12: 00 00 00
15: 90 nop
16: 55 push %rbp
17: 41 57 push %r15
19: 41 56 push %r14
1b: 41 55 push %r13
1d: 41 54 push %r12
1f: 53 push %rbx
20: 48 81 ec 88 00 00 00 sub $0x88,%rsp
27: 48 89 fb mov %rdi,%rbx
* 2a: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 <-- trapping instruction
31: fc ff df
34: 48 8d 6f 48 lea 0x48(%rdi),%rbp
38: 48 89 e8 mov %rbp,%rax
3b: 48 c1 e8 03 shr $0x3,%rax
3f: 48 rex.W