------------[ cut here ]------------
WARNING: CPU: 0 PID: 4098 at mm/maccess.c:226 copy_from_user_nofault+0x5d/0x170 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 4098 Comm: modprobe Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:copy_from_user_nofault+0x5d/0x170 mm/maccess.c:226
Code: 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e fc 00 00 00 41 8b 85 80 16 00 00 85 c0 75 02 <0f> 0b 4c 89 e0 48 01 e8 0f 82 b8 00 00 00 48 ba 00 f0 ff ff ff 7f
RSP: 0018:ffffc90000007b98 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffffc90000007c50 RCX: ffffffff81461eb5
RDX: 1ffff1102349ad98 RSI: 0000000020000000 RDI: ffff88811a4d6cc0
RBP: 0000000020000000 R08: 0000000000000000 R09: ffff88811a4d5647
R10: ffffed102349aac8 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88811a4d5640 R14: ffffc90000007cb8 R15: ffffffff81461e90
FS:  0000000000000000(0000) GS:ffff8881f6200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2eb5588e9c CR3: 0000000118722000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
 ____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
 bpf_probe_read_compat+0xc3/0x100 kernel/trace/bpf_trace.c:277
 ___bpf_prog_run+0x2fd0/0x74f0 kernel/bpf/core.c:1568
 __bpf_prog_run32+0x79/0xb0 kernel/bpf/core.c:1788
 bpf_dispatcher_nop_func include/linux/bpf.h:888 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1878 [inline]
 bpf_trace_run2+0xe9/0x280 kernel/trace/bpf_trace.c:1915
 __traceiter_hrtimer_start+0x56/0x90 include/trace/events/timer.h:199
 trace_hrtimer_start include/trace/events/timer.h:199 [inline]
 debug_activate kernel/time/hrtimer.c:466 [inline]
 enqueue_hrtimer+0x209/0x2a0 kernel/time/hrtimer.c:1069
 __run_hrtimer kernel/time/hrtimer.c:1702 [inline]
 __hrtimer_run_queues+0x7d1/0x940 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x2c1/0x730 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0xf5/0x340 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x65/0x90 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:vma_pages include/linux/mm.h:2771 [inline]
RIP: 0010:vma_last_pgoff mm/interval_tree.c:20 [inline]
RIP: 0010:vma_interval_tree_augment_compute_max mm/interval_tree.c:23 [inline]
RIP: 0010:vma_interval_tree_augment_propagate mm/interval_tree.c:23 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:295 [inline]
RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline]
RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline]
RIP: 0010:vma_interval_tree_remove+0x4b7/0x10f0 mm/interval_tree.c:23
Code: 28 00 0f 85 6c 05 00 00 49 8b 44 24 08 48 8d 7b 40 48 89 fa 48 c1 ea 03 80 3c 2a 00 0f 85 1a 05 00 00 48 8d 7b b0 48 8b 53 40 <48> 89 f9 48 c1 e9 03 80 3c 29 00 0f 85 13 05 00 00 48 8d 7b a8 4c
RSP: 0018:ffffc90001277bd8 EFLAGS: 00000246
RAX: ffff888115d07688 RBX: ffff888115d07160 RCX: ffff888130c7d268
RDX: 0000000000000004 RSI: 1ffff1102618fa4d RDI: ffff888115d07110
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff88810adda33f
R10: ffffed10215bb467 R11: 0000000000000001 R12: ffff88810adda330
R13: 0000000000000000 R14: ffff88810adda320 R15: ffff88811db5b268
 __remove_shared_vm_struct mm/mmap.c:156 [inline]
 unlink_file_vma+0xa4/0xf0 mm/mmap.c:171
 free_pgtables+0x139/0x2b0 mm/memory.c:427
 exit_mmap+0x1ac/0x540 mm/mmap.c:3217
 __mmput kernel/fork.c:1127 [inline]
 mmput+0xa3/0x3a0 kernel/fork.c:1148
 exit_mm kernel/exit.c:550 [inline]
 do_exit+0x922/0x22e0 kernel/exit.c:870
 do_group_exit+0xe7/0x290 kernel/exit.c:997
 __do_sys_exit_group kernel/exit.c:1008 [inline]
 __se_sys_exit_group kernel/exit.c:1006 [inline]
 __x64_sys_exit_group+0x35/0x40 kernel/exit.c:1006
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x33/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f2eb56e76c5
Code: Unable to access opcode bytes at RIP 0x7f2eb56e769b.
RSP: 002b:00007fff7056dd18 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f2eb57e8fe8 RCX: 00007f2eb56e76c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007fff7056dca8 R09: 0000000000000000
R10: 00007fff7056db40 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f2eb57e7680 R15: 00007f2eb57e9000
 </TASK>
----------------
Code disassembly (best guess):
   0:	28 00                	sub    %al,(%rax)
   2:	0f 85 6c 05 00 00    	jne    0x574
   8:	49 8b 44 24 08       	mov    0x8(%r12),%rax
   d:	48 8d 7b 40          	lea    0x40(%rbx),%rdi
  11:	48 89 fa             	mov    %rdi,%rdx
  14:	48 c1 ea 03          	shr    $0x3,%rdx
  18:	80 3c 2a 00          	cmpb   $0x0,(%rdx,%rbp,1)
  1c:	0f 85 1a 05 00 00    	jne    0x53c
  22:	48 8d 7b b0          	lea    -0x50(%rbx),%rdi
  26:	48 8b 53 40          	mov    0x40(%rbx),%rdx
* 2a:	48 89 f9             	mov    %rdi,%rcx <-- trapping instruction
  2d:	48 c1 e9 03          	shr    $0x3,%rcx
  31:	80 3c 29 00          	cmpb   $0x0,(%rcx,%rbp,1)
  35:	0f 85 13 05 00 00    	jne    0x54e
  3b:	48 8d 7b a8          	lea    -0x58(%rbx),%rdi
  3f:	4c                   	rex.WR