------------[ cut here ]------------
WARNING: CPU: 0 PID: 154 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 154 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 8d f6 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 10 f3 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000007b98 EFLAGS: 00010006
RAX: ffffffff819ed900 RBX: 0000000000000008 RCX: ffff88801bbb8000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed1003777001
R10: ffffed1003777001 R11: 1ffff11003777000 R12: ffff88801bbb9788
R13: 00007ffffffff000 R14: ffffc90000007c08 R15: 0000000020a50000
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557286e67950 CR3: 0000000058eb3000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_2dbf287f85779254+0x3d/0x7d0
bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
__bpf_prog_run include/linux/filter.h:628 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
bpf_trace_run2+0x15b/0x2d0 kernel/trace/bpf_trace.c:1915
trace_hrtimer_start include/trace/events/timer.h:199 [inline]
debug_activate kernel/time/hrtimer.c:466 [inline]
enqueue_hrtimer+0x314/0x370 kernel/time/hrtimer.c:1069
__run_hrtimer kernel/time/hrtimer.c:1702 [inline]
__hrtimer_run_queues+0x65a/0xc40 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x3bb/0x8d0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60 kernel/kcov.c:206
Code: a4 a3 8a 7e 65 8b 15 a5 a3 8a 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 34 16 00 00 00 74 2c 8b 91 10 16 00 00 <83> fa 02 75 21 48 8b 91 18 16 00 00 48 8b 32 48 8d 7e 01 8b 89 14
RSP: 0018:ffffc90001fd7b68 EFLAGS: 00000246
RAX: ffffffff897f17ba RBX: ffffffff897f1040 RCX: ffff88801bbb8000
RDX: 0000000000000000 RSI: ffffffff8a0b2f00 RDI: ffffffff8a59e580
RBP: 0000000000000001 R08: dffffc0000000000 R09: fffffbfff1ad33a6
R10: fffffbfff1ad33a6 R11: 1ffffffff1ad33a5 R12: ffff888022321190
R13: ffff88801ef690a8 R14: ffff888022321180 R15: ffff888059f8cc80
rcu_lock_acquire+0xa/0x30 include/linux/rcupdate.h:313
rcu_read_lock include/linux/rcupdate.h:740 [inline]
batadv_nc_process_nc_paths+0xb2/0x350 net/batman-adv/network-coding.c:691
batadv_nc_worker+0x3e5/0x5c0 net/batman-adv/network-coding.c:732
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
irq event stamp: 629312
hardirqs last enabled at (629311): [] __local_bh_enable_ip+0x12a/0x1b0 kernel/softirq.c:406
hardirqs last disabled at (629312): [] sysvec_apic_timer_interrupt+0xa/0xc0 arch/x86/kernel/apic/apic.c:1108
softirqs last enabled at (629310): [] spin_unlock_bh include/linux/spinlock.h:409 [inline]
softirqs last enabled at (629310): [] batadv_nc_purge_paths+0x316/0x3b0 net/batman-adv/network-coding.c:475
softirqs last disabled at (629308): [] spin_lock_bh include/linux/spinlock.h:369 [inline]
softirqs last disabled at (629308): [] batadv_nc_purge_paths+0xe7/0x3b0 net/batman-adv/network-coding.c:446
---[ end trace 23e4c822d89cde14 ]---
----------------
Code disassembly (best guess):
0: a4 movsb %ds:(%rsi),%es:(%rdi)
1: a3 8a 7e 65 8b 15 a5 movabs %eax,0x8aa3a5158b657e8a
8: a3 8a
a: 7e 81 jle 0xffffff8d
c: e2 00 loop 0xe
e: 01 ff add %edi,%edi
10: 00 74 11 81 add %dh,-0x7f(%rcx,%rdx,1)
14: fa cli
15: 00 01 add %al,(%rcx)
17: 00 00 add %al,(%rax)
19: 75 35 jne 0x50
1b: 83 b9 34 16 00 00 00 cmpl $0x0,0x1634(%rcx)
22: 74 2c je 0x50
24: 8b 91 10 16 00 00 mov 0x1610(%rcx),%edx
* 2a: 83 fa 02 cmp $0x2,%edx <-- trapping instruction
2d: 75 21 jne 0x50
2f: 48 8b 91 18 16 00 00 mov 0x1618(%rcx),%rdx
36: 48 8b 32 mov (%rdx),%rsi
39: 48 8d 7e 01 lea 0x1(%rsi),%rdi
3d: 8b .byte 0x8b
3e: 89 .byte 0x89
3f: 14 .byte 0x14