8<--- cut here --- Unable to handle kernel paging request at virtual address ffffffe9 when write [ffffffe9] *pgd=80000080007003, *pmd=deffd003, *pte=00000000 Internal error: Oops: a07 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 3940 Comm: syz-executor.0 Not tainted 6.9.0-rc3-syzkaller #0 Hardware name: ARM-Versatile Express PC is at copy_from_kernel_nofault mm/maccess.c:38 [inline] PC is at copy_from_kernel_nofault+0xb8/0x12c mm/maccess.c:24 LR is at copy_from_kernel_nofault+0x24/0x12c mm/maccess.c:31 pc : [<80436328>] lr : [<80436294>] psr: a0000013 sp : df9e5c90 ip : df9e5c90 fp : df9e5cac r10: 00000000 r9 : df9e5d40 r8 : ffffffe9 r7 : 83ee4800 r6 : 00000005 r5 : ffffffe9 r4 : ffffffe9 r3 : fffffff2 r2 : 00000000 r1 : 00000005 r0 : 00000001 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8452e280 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: non-paged memory Register r6 information: non-paged memory Register r7 information: slab task_struct start 83ee4800 pointer offset 0 size 3072 Register r8 information: non-paged memory Register r9 information: 2-page vmalloc region starting at 0xdf9e4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdf9e4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdf9e4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.0 (pid: 3940, stack limit = 0xdf9e4000) Stack: (0xdf9e5c90 to 0xdf9e6000) 5c80: df9e5db8 ffffffe9 00000005 ffffffff 5ca0: df9e5ccc df9e5cb0 8037c490 8043627c df9e5db8 00000000 8037c474 ffffffff 5cc0: df9e5d64 df9e5cd0 7f037ca4 8037c480 ffffffe9 df9e5d40 802ff678 81182ba4 5ce0: df9e5d64 df9e5d30 35702575 00000000 828cb23c 40000013 00000000 00000000 5d00: df9e5cf0 00000000 df9e5d74 df9e5d18 df9e5d2c df9e5d20 81182bb4 818c0d20 5d20: df9e5d64 df9e5d30 802ff678 81182ba4 ffffffe9 df9e5d40 00000005 00000000 5d40: df9e5db8 00000000 df9fd000 82f2a6c0 df9fd030 df9e5e30 df9e5dfc df9e5d68 5d60: 814c4814 7f037c04 804d0364 8089a854 00000000 83ee4800 804b4ebc 804d0304 5d80: 8260ca3c df9e5e30 00000001 df9e5e2c 804685cc 00000000 df9e5db8 00000000 5da0: 00000001 00000000 027634c0 00000021 00000000 00000000 df9fd000 00000000 5dc0: 00000000 00000000 84d80800 3f405cbe df9e5dfc 82f2a6c0 00000000 df9e5ec0 5de0: 8453f600 84d80800 00000000 0000000e df9e5e64 df9e5e00 814c5780 814c46b0 5e00: df9e5e30 00000000 00000000 df9e5e98 20000080 00000000 df9fd000 00000000 5e20: 84cf0000 845c6800 8051ceac 00000000 00000000 3f405cbe 803952e0 df9fd000 5e40: 00000028 df9e5e98 0000000a 20000080 00000028 00000000 df9e5f8c df9e5e68 5e60: 8039c964 814c5468 00000000 ffffffff 00000000 00000000 20000013 83ee4800 5e80: df9e5ee0 df9e5fb0 df9e5ea4 df9e5e98 8089aa38 df9e5ee0 20000080 00000000 5ea0: 83ee4800 df9e5ed0 00000008 00000000 00000008 80426f48 00000000 00000000 5ec0: 00000003 02000000 0000000e 00000055 20000140 00000000 20000380 00000000 5ee0: 00000000 04000000 00000000 00000000 00000000 00000000 00000000 00000000 5f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f40: 00000000 00000000 00000000 00000000 00000000 00000000 8020316c 3f405cbe 5f60: 8261ca0c 00000000 00000000 0014c2c8 00000182 80200288 83ee4800 00000182 5f80: df9e5fa4 df9e5f90 8039dea4 8039ba40 20000080 00000000 00000000 df9e5fa8 5fa0: 80200060 8039de84 00000000 00000000 0000000a 20000080 00000028 00000000 5fc0: 00000000 00000000 0014c2c8 00000182 7eb7c32e 7eb7c32f 003d0f00 76bce0fc 5fe0: 76bcdf08 76bcdef8 000167f8 00050bc0 60000010 0000000a 00000000 00000000 Call trace: [<80436270>] (copy_from_kernel_nofault) from [<8037c490>] (bpf_probe_read_kernel_common include/linux/bpf.h:2923 [inline]) [<80436270>] (copy_from_kernel_nofault) from [<8037c490>] (____bpf_probe_read_kernel kernel/trace/bpf_trace.c:240 [inline]) [<80436270>] (copy_from_kernel_nofault) from [<8037c490>] (bpf_probe_read_kernel+0x1c/0x44 kernel/trace/bpf_trace.c:237) r7:ffffffff r6:00000005 r5:ffffffe9 r4:df9e5db8 [<8037c474>] (bpf_probe_read_kernel) from [<7f037ca4>] (bpf_prog_244768d4818575ac+0xac/0xc0) r7:ffffffff r6:8037c474 r5:00000000 r4:df9e5db8 [<7f037bf8>] (bpf_prog_244768d4818575ac) from [<814c4814>] (bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]) [<7f037bf8>] (bpf_prog_244768d4818575ac) from [<814c4814>] (__bpf_prog_run include/linux/filter.h:657 [inline]) [<7f037bf8>] (bpf_prog_244768d4818575ac) from [<814c4814>] (bpf_prog_run include/linux/filter.h:664 [inline]) [<7f037bf8>] (bpf_prog_244768d4818575ac) from [<814c4814>] (bpf_test_run+0x170/0x388 net/bpf/test_run.c:425) r9:df9e5e30 r8:df9fd030 r7:82f2a6c0 r6:df9fd000 r5:00000000 r4:df9e5db8 [<814c46a4>] (bpf_test_run) from [<814c5780>] (bpf_prog_test_run_skb+0x324/0x6cc net/bpf/test_run.c:1058) r10:0000000e r9:00000000 r8:84d80800 r7:8453f600 r6:df9e5ec0 r5:00000000 r4:82f2a6c0 [<814c545c>] (bpf_prog_test_run_skb) from [<8039c964>] (bpf_prog_test_run kernel/bpf/syscall.c:4269 [inline]) [<814c545c>] (bpf_prog_test_run_skb) from [<8039c964>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5678) r10:00000000 r9:00000028 r8:20000080 r7:0000000a r6:df9e5e98 r5:00000028 r4:df9fd000 [<8039ba34>] (__sys_bpf) from [<8039dea4>] (__do_sys_bpf kernel/bpf/syscall.c:5767 [inline]) [<8039ba34>] (__sys_bpf) from [<8039dea4>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5765) r10:00000182 r9:83ee4800 r8:80200288 r7:00000182 r6:0014c2c8 r5:00000000 r4:00000000 [<8039de78>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdf9e5fa8 to 0xdf9e5ff0) 5fa0: 00000000 00000000 0000000a 20000080 00000028 00000000 5fc0: 00000000 00000000 0014c2c8 00000182 7eb7c32e 7eb7c32f 003d0f00 76bce0fc 5fe0: 76bcdf08 76bcdef8 000167f8 00050bc0 Code: 9a000007 e3a03000 e4942000 e3530000 (e5852000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 9a000007 bls 0x24 4: e3a03000 mov r3, #0 8: e4942000 ldr r2, [r4], #0 c: e3530000 cmp r3, #0 * 10: e5852000 str r2, [r5] <-- trapping instruction