====================================== | [ 43.563917][ T694] ================================================================== | [ 43.564281][ T694] BUG: KASAN: slab-use-after-free in fib_table_flush (net/ipv4/fib_trie.c:2038) | [ 43.564558][ T694] Read of size 1 at addr ffff888001932745 by task ip/694 | [ 43.564782][ T694] [ 43.564880][ T694] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 43.564882][ T694] Call Trace: [ 43.564884][ T694] [ 43.564885][ T694] dump_stack_lvl (lib/dump_stack.c:123) [ 43.564892][ T694] print_address_description.constprop.0 (mm/kasan/report.c:409) [ 43.564900][ T694] ? fib_table_flush (net/ipv4/fib_trie.c:2038) [ 43.564904][ T694] print_report (mm/kasan/report.c:522) [ 43.564908][ T694] ? fib_table_flush (net/ipv4/fib_trie.c:2038) [ 43.564911][ T694] ? kasan_addr_to_slab (./include/linux/mm.h:1178 mm/kasan/../slab.h:211 mm/kasan/common.c:38) [ 43.564915][ T694] ? fib_table_flush (net/ipv4/fib_trie.c:2038) [ 43.564918][ T694] kasan_report (mm/kasan/report.c:636) [ 43.564922][ T694] ? fib_table_flush (net/ipv4/fib_trie.c:2038) [ 43.564928][ T694] fib_table_flush (net/ipv4/fib_trie.c:2038) [ 43.564934][ T694] ? __pfx_fib_table_flush (net/ipv4/fib_trie.c:2001) [ 43.564938][ T694] ? __pfx_fib_sync_down_dev (net/ipv4/fib_semantics.c:1937) [ 43.564944][ T694] fib_flush (net/ipv4/fib_frontend.c:195 (discriminator 11)) [ 43.564950][ T694] fib_netdev_event (net/ipv4/fib_frontend.c:1458 net/ipv4/fib_frontend.c:1545) [ 43.564953][ T694] notifier_call_chain (kernel/notifier.c:87 (discriminator 2)) [ 43.564961][ T694] dev_close_many (net/core/dev.c:1786) [ 43.564966][ T694] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6944) [ 43.564969][ T694] ? netlink_rcv_skb (net/netlink/af_netlink.c:2541) [ 43.564973][ T694] ? netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339) [ 43.564976][ T694] ? netlink_sendmsg (net/netlink/af_netlink.c:1886) [ 43.564979][ T694] ? __pfx_dev_close_many (net/core/dev.c:1773) [ 43.564981][ T694] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 43.564985][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.564992][ T694] unregister_netdevice_many_notify (net/core/dev.c:12090) [ 43.564999][ T694] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:12045) [ 43.565003][ T694] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:953 ./include/linux/mmzone.h:2168 arch/x86/mm/physaddr.c:65) [ 43.565007][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.565014][ T694] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3115) [ 43.565019][ T694] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4475) [ 43.565024][ T694] rtnl_dellink (net/core/rtnetlink.c:3513 net/core/rtnetlink.c:3553) [ 43.565030][ T694] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3519) [ 43.565048][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.565053][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.565059][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.565062][ T694] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/core/rtnetlink.c:6942) [ 43.565065][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.565069][ T694] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3519) [ 43.565072][ T694] rtnetlink_rcv_msg (net/core/rtnetlink.c:6944) [ 43.565076][ T694] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6847) [ 43.565080][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.565085][ T694] netlink_rcv_skb (net/netlink/af_netlink.c:2541) [ 43.565088][ T694] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6847) [ 43.565092][ T694] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2518) [ 43.565099][ T694] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/netlink/af_netlink.c:340) [ 43.565101][ T694] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 43.565105][ T694] netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339) [ 43.565110][ T694] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1324) [ 43.565113][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.565117][ T694] netlink_sendmsg (net/netlink/af_netlink.c:1886) [ 43.565122][ T694] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1805) [ 43.565126][ T694] ? __import_iovec (lib/iov_iter.c:1441 lib/iov_iter.c:1456) [ 43.565132][ T694] ____sys_sendmsg (net/socket.c:712 net/socket.c:727 net/socket.c:2612) [ 43.565138][ T694] ? __pfx_____sys_sendmsg (net/socket.c:2558) [ 43.565141][ T694] ? __pfx_copy_msghdr_from_user (net/socket.c:2538) [ 43.565148][ T694] ___sys_sendmsg (net/socket.c:2668) [ 43.565151][ T694] ? kasan_record_aux_stack (mm/kasan/generic.c:548) [ 43.565154][ T694] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3092) [ 43.565157][ T694] ? __pfx____sys_sendmsg (net/socket.c:2655) [ 43.565162][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.565166][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.565171][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.565175][ T694] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:953 ./include/linux/mmzone.h:2168 arch/x86/mm/physaddr.c:65) [ 43.565178][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.565183][ T694] __sys_sendmsg (net/socket.c:2698) [ 43.565186][ T694] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3115) [ 43.565189][ T694] ? __pfx___sys_sendmsg (net/socket.c:2683) [ 43.565196][ T694] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:745) [ 43.565201][ T694] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 43.565204][ T694] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 43.565208][ T694] RIP: 0033:0x7f88709dc9a7 [ 43.565212][ T694] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 43.565214][ T694] RSP: 002b:00007ffd153efb68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 43.565218][ T694] RAX: ffffffffffffffda RBX: 00007ffd153f0290 RCX: 00007f88709dc9a7 [ 43.565221][ T694] RDX: 0000000000000000 RSI: 00007ffd153efbd0 RDI: 0000000000000005 [ 43.565222][ T694] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 43.565224][ T694] R10: 00007f887089aef8 R11: 0000000000000246 R12: 0000000000000002 [ 43.565226][ T694] R13: 000000006854984d R14: 0000000000499600 R15: 0000000000000000 | [ 43.592992][ T694] Disabling lock debugging due to kernel taint | [ 43.593229][ T694] Oops: general protection fault, probably for non-canonical address 0xe0005c00400001ff: 0000 [#1] SMP KASAN NOPTI | [ 43.593610][ T694] KASAN: maybe wild-memory-access in range [0x0003000200000ff8-0x0003000200000fff] | [ 43.594259][ T694] Tainted: [B]=BAD_PAGE [ 43.594389][ T694] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 43.594602][ T694] RIP: 0010:fib_table_flush (net/ipv4/fib_trie.c:2046) [ 43.594793][ T694] Code: 0f 85 ac 06 00 00 49 8b 6e 08 48 85 ed 0f 84 38 03 00 00 4c 89 64 24 40 49 89 ec 44 89 dd 4c 89 e0 4c 89 6c 24 48 48 c1 e8 03 <80> 3c 18 00 0f 85 a5 02 00 00 4d 8d 5c 24 10 4d 8b 2c 24 4c 89 da All code ======== 0: 0f 85 ac 06 00 00 jne 0x6b2 6: 49 8b 6e 08 mov 0x8(%r14),%rbp a: 48 85 ed test %rbp,%rbp d: 0f 84 38 03 00 00 je 0x34b 13: 4c 89 64 24 40 mov %r12,0x40(%rsp) 18: 49 89 ec mov %rbp,%r12 1b: 44 89 dd mov %r11d,%ebp 1e: 4c 89 e0 mov %r12,%rax 21: 4c 89 6c 24 48 mov %r13,0x48(%rsp) 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 0f 85 a5 02 00 00 jne 0x2d9 34: 4d 8d 5c 24 10 lea 0x10(%r12),%r11 39: 4d 8b 2c 24 mov (%r12),%r13 3d: 4c 89 da mov %r11,%rdx Code starting with the faulting instruction =========================================== 0: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 4: 0f 85 a5 02 00 00 jne 0x2af a: 4d 8d 5c 24 10 lea 0x10(%r12),%r11 f: 4d 8b 2c 24 mov (%r12),%r13 13: 4c 89 da mov %r11,%rdx [ 43.595402][ T694] RSP: 0018:ffffc900005c6ef0 EFLAGS: 00010207 [ 43.595621][ T694] RAX: 00006000400001ff RBX: dffffc0000000000 RCX: ffffffff8aa846de [ 43.595883][ T694] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888001932748 [ 43.596142][ T694] RBP: 0000000000000000 R08: 0000000000000001 R09: fffffbfff1b364c0 [ 43.596400][ T694] R10: ffffffff8d9b2607 R11: 0000000000000000 R12: 0003000200000fff [ 43.596768][ T694] R13: 0000000000000000 R14: ffff888001932740 R15: ffff88800a6e2f40 [ 43.597025][ T694] FS: 00007f88707d0800(0000) GS:ffff8880a16bc000(0000) knlGS:0000000000000000 [ 43.597432][ T694] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.597649][ T694] CR2: 00000000004e5a80 CR3: 000000000ed6f001 CR4: 0000000000772ef0 [ 43.597911][ T694] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 43.598278][ T694] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 43.598541][ T694] PKRU: 55555554 [ 43.598669][ T694] Call Trace: [ 43.598797][ T694] [ 43.598886][ T694] ? __pfx_fib_table_flush (net/ipv4/fib_trie.c:2001) [ 43.599172][ T694] ? __pfx_fib_sync_down_dev (net/ipv4/fib_semantics.c:1937) [ 43.599371][ T694] fib_flush (net/ipv4/fib_frontend.c:195 (discriminator 11)) [ 43.599504][ T694] fib_netdev_event (net/ipv4/fib_frontend.c:1458 net/ipv4/fib_frontend.c:1545) [ 43.599688][ T694] notifier_call_chain (kernel/notifier.c:87 (discriminator 2)) [ 43.599967][ T694] dev_close_many (net/core/dev.c:1786) [ 43.600139][ T694] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6944) [ 43.600309][ T694] ? netlink_rcv_skb (net/netlink/af_netlink.c:2541) [ 43.600479][ T694] ? netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339) [ 43.600757][ T694] ? netlink_sendmsg (net/netlink/af_netlink.c:1886) [ 43.600929][ T694] ? __pfx_dev_close_many (net/core/dev.c:1773) [ 43.601099][ T694] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 43.601269][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.601548][ T694] unregister_netdevice_many_notify (net/core/dev.c:12090) [ 43.601763][ T694] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:12045) [ 43.601979][ T694] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:953 ./include/linux/mmzone.h:2168 arch/x86/mm/physaddr.c:65) [ 43.602257][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.602430][ T694] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3115) [ 43.602642][ T694] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4475) [ 43.602815][ T694] rtnl_dellink (net/core/rtnetlink.c:3513 net/core/rtnetlink.c:3553) [ 43.603091][ T694] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3519) [ 43.603281][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.603455][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.603627][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.603907][ T694] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/core/rtnetlink.c:6942) [ 43.604075][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.604244][ T694] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3519) [ 43.604415][ T694] rtnetlink_rcv_msg (net/core/rtnetlink.c:6944) [ 43.604698][ T694] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6847) [ 43.604871][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.605043][ T694] netlink_rcv_skb (net/netlink/af_netlink.c:2541) [ 43.605216][ T694] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6847) [ 43.605492][ T694] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2518) [ 43.605666][ T694] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/netlink/af_netlink.c:340) [ 43.605837][ T694] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 43.606006][ T694] netlink_unicast (net/netlink/af_netlink.c:1314 net/netlink/af_netlink.c:1339) [ 43.606282][ T694] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1324) [ 43.606453][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.606634][ T694] netlink_sendmsg (net/netlink/af_netlink.c:1886) [ 43.606805][ T694] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1805) [ 43.607080][ T694] ? __import_iovec (lib/iov_iter.c:1441 lib/iov_iter.c:1456) [ 43.607253][ T694] ____sys_sendmsg (net/socket.c:712 net/socket.c:727 net/socket.c:2612) [ 43.607426][ T694] ? __pfx_____sys_sendmsg (net/socket.c:2558) [ 43.607596][ T694] ? __pfx_copy_msghdr_from_user (net/socket.c:2538) [ 43.607921][ T694] ___sys_sendmsg (net/socket.c:2668) [ 43.608096][ T694] ? kasan_record_aux_stack (mm/kasan/generic.c:548) [ 43.608268][ T694] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3092) [ 43.608485][ T694] ? __pfx____sys_sendmsg (net/socket.c:2655) [ 43.608762][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.608935][ T694] ? __lock_acquire (kernel/locking/lockdep.c:5240) [ 43.609106][ T694] ? find_held_lock (kernel/locking/lockdep.c:5353) [ 43.609277][ T694] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:953 ./include/linux/mmzone.h:2168 arch/x86/mm/physaddr.c:65) [ 43.609555][ T694] ? __lock_release (kernel/locking/lockdep.c:5539) [ 43.609730][ T694] __sys_sendmsg (net/socket.c:2698) [ 43.609899][ T694] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3115) [ 43.610215][ T694] ? __pfx___sys_sendmsg (net/socket.c:2683) [ 43.610390][ T694] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:745) [ 43.610561][ T694] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 43.610731][ T694] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 43.611048][ T694] RIP: 0033:0x7f88709dc9a7 [ 43.611228][ T694] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 43.611949][ T694] RSP: 002b:00007ffd153efb68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 43.612210][ T694] RAX: ffffffffffffffda RBX: 00007ffd153f0290 RCX: 00007f88709dc9a7 [ 43.612471][ T694] RDX: 0000000000000000 RSI: 00007ffd153efbd0 RDI: 0000000000000005 [ 43.612837][ T694] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 43.613094][ T694] R10: 00007f887089aef8 R11: 0000000000000246 R12: 0000000000000002 Finger prints: fib_table_flush:fib_flush:fib_netdev_event:notifier_call_chain:dev_close_many print_report:kasan_report:fib_table_flush:fib_flush:fib_netdev_event