------------[ cut here ]------------
WARNING: CPU: 0 PID: 5466 at mm/maccess.c:226 copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Modules linked in:
CPU: 0 PID: 5466 Comm: syz.2.277 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:copy_from_user_nofault+0x160/0x1c0 mm/maccess.c:226
Code: 24 45 31 f6 31 ff 89 de e8 ad 89 d8 ff 85 db 48 c7 c0 f2 ff ff ff 49 0f 44 c6 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 30 86 d8 ff <0f> 0b e9 1c ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c ea fe
RSP: 0018:ffffc90000007e30 EFLAGS: 00010006
RAX: ffffffff81a08e70 RBX: 0000000000000000 RCX: ffff888079215940
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888079215947 R09: 1ffff1100f242b28
R10: dffffc0000000000 R11: ffffed100f242b29 R12: ffff8880792170e8
R13: 00007ffffffff000 R14: ffffc90000007ea8 R15: 0000000000000000
FS: 00007fe2eb0666c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9ecc7e9d58 CR3: 0000000026690000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 00002000000002c0
DR3: 00002000000002c0 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
bpf_probe_read_user_common kernel/trace/bpf_trace.c:157 [inline]
____bpf_probe_read_compat kernel/trace/bpf_trace.c:281 [inline]
bpf_probe_read_compat+0xdd/0x170 kernel/trace/bpf_trace.c:277
bpf_prog_03eebc38237b138e+0x34/0xef0
bpf_dispatcher_nop_func include/linux/bpf.h:890 [inline]
__bpf_prog_run include/linux/filter.h:621 [inline]
bpf_prog_run include/linux/filter.h:635 [inline]
__bpf_prog_test_run_raw_tp+0x33f/0x3f0 net/bpf/test_run.c:335
flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:212 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:156 [inline]
RIP: 0010:wrmsrl arch/x86/include/asm/msr.h:271 [inline]
RIP: 0010:native_x2apic_icr_write arch/x86/include/asm/apic.h:241 [inline]
RIP: 0010:__x2apic_send_IPI_dest arch/x86/kernel/apic/x2apic_phys.c:126 [inline]
RIP: 0010:x2apic_send_IPI+0x70/0xc0 arch/x86/kernel/apic/x2apic_phys.c:48
Code: f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 37 41 0f b7 16 0f ae f0 0f ae e8 83 fb 02 b8 00 04 00 00 0f 45 c3 b9 30 08 00 00 0f 30 <66> 90 5b 41 5c 41 5e 41 5f c3 48 c7 c7 a0 ee 18 8c 4c 89 f6 e8 f7
RSP: 0018:ffffc900032ff538 EFLAGS: 00000206
RAX: 00000000000000fb RBX: 00000000000000fb RCX: 0000000000000830
RDX: 0000000000000001 RSI: 00000000000000fb RDI: 0000000000000001
RBP: ffffc900032ff6a0 R08: ffff8880b903b3d7 R09: 1ffff1101720767a
R10: dffffc0000000000 R11: ffffed101720767b R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8880b9121568 R15: ffffffff8be3f828
smp_call_function_many_cond+0x821/0xd80 kernel/smp.c:949
on_each_cpu_cond_mask+0x3b/0x80 kernel/smp.c:1134
on_each_cpu include/linux/smp.h:71 [inline]
text_poke_sync arch/x86/kernel/alternative.c:1442 [inline]
text_poke_bp_batch+0x5a0/0x830 arch/x86/kernel/alternative.c:1704
text_poke_bp+0xd9/0x160 arch/x86/kernel/alternative.c:1879
__static_call_transform+0x2f2/0x510 arch/x86/kernel/static_call.c:111
arch_static_call_transform+0xa0/0x250 arch/x86/kernel/static_call.c:157
__static_call_update+0xeb/0x5c0 kernel/static_call_inline.c:136
tracepoint_update_call kernel/tracepoint.c:317 [inline]
tracepoint_add_func+0x946/0xa10 kernel/tracepoint.c:360
tracepoint_probe_register_prio kernel/tracepoint.c:513 [inline]
tracepoint_probe_register+0x5a/0x90 kernel/tracepoint.c:533
perf_trace_event_reg kernel/trace/trace_event_perf.c:129 [inline]
perf_trace_event_init+0x492/0x950 kernel/trace/trace_event_perf.c:202
perf_trace_init+0x234/0x2d0 kernel/trace/trace_event_perf.c:226
perf_tp_event_init+0x89/0x110 kernel/events/core.c:10112
perf_try_init_event+0x12b/0x3d0 kernel/events/core.c:11611
perf_init_event kernel/events/core.c:11675 [inline]
perf_event_alloc+0xf78/0x21d0 kernel/events/core.c:11967
__do_sys_perf_event_open kernel/events/core.c:12505 [inline]
__se_sys_perf_event_open+0x6f5/0x1bb0 kernel/events/core.c:12397
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fe2ece0e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe2eb066028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007fe2ed095fa0 RCX: 00007fe2ece0e159
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000d00
RBP: 00007fe2ecea506b R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe2ed096038 R14: 00007fe2ed095fa0 R15: 00007ffcd7226fb8
----------------
Code disassembly (best guess):
0: f0 48 c1 e8 03 lock shr $0x3,%rax
5: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax
a: 84 c0 test %al,%al
c: 75 37 jne 0x45
e: 41 0f b7 16 movzwl (%r14),%edx
12: 0f ae f0 mfence
15: 0f ae e8 lfence
18: 83 fb 02 cmp $0x2,%ebx
1b: b8 00 04 00 00 mov $0x400,%eax
20: 0f 45 c3 cmovne %ebx,%eax
23: b9 30 08 00 00 mov $0x830,%ecx
28: 0f 30 wrmsr
* 2a: 66 90 xchg %ax,%ax <-- trapping instruction
2c: 5b pop %rbx
2d: 41 5c pop %r12
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: c3 ret
34: 48 c7 c7 a0 ee 18 8c mov $0xffffffff8c18eea0,%rdi
3b: 4c 89 f6 mov %r14,%rsi
3e: e8 .byte 0xe8
3f: f7 .byte 0xf7