====================================== | [ 23.421408][ T304] ================================================================== | [ 23.421675][ T304] BUG: KASAN: null-ptr-deref in try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) | [ 23.421968][ T304] Write of size 8 at addr 0000000000000000 by task ip/304 | [ 23.422203][ T304] [ 23.422310][ T304] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 23.422313][ T304] Call Trace: [ 23.422315][ T304] [ 23.422318][ T304] dump_stack_lvl (lib/dump_stack.c:123) [ 23.422331][ T304] ? try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 23.422334][ T304] kasan_report (mm/kasan/report.c:597) [ 23.422346][ T304] ? try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 23.422351][ T304] kasan_check_range (mm/kasan/generic.c:194 mm/kasan/generic.c:200) [ 23.422355][ T304] try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 23.422360][ T304] __cancel_work (kernel/workqueue.c:2161 kernel/workqueue.c:4364) [ 23.422363][ T304] ? enable_delayed_work (kernel/workqueue.c:4359) [ 23.422367][ T304] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 23.422372][ T304] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 23.422377][ T304] ? dev_uc_del (net/core/dev_addr_lists.c:718) [ 23.422386][ T304] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 23.422391][ T304] __cancel_work_sync (kernel/workqueue.c:4383) [ 23.422395][ T304] __dev_close_many (net/core/dev.c:1879 (discriminator 2) net/core/dev.c:1932 (discriminator 2)) [ 23.422403][ T304] ? netdev_notify_peers (net/core/dev.c:1891) [ 23.422407][ T304] ? netif_close_many (net/core/dev.c:1959) [ 23.422412][ T304] netif_close_many (net/core/dev.c:1959) [ 23.422415][ T304] ? ip6_route_dev_notify (./include/net/net_namespace.h:418 ./include/linux/netdevice.h:2766 net/ipv6/route.c:6454) [ 23.422424][ T304] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 23.422436][ T304] ? __dev_close_many (net/core/dev.c:1949) [ 23.422440][ T304] ? netif_close_many_and_unlock (net/core/dev.c:12476) [ 23.422445][ T304] unregister_netdevice_many_notify (net/core/dev.c:12545) [ 23.422452][ T304] ? dev_ingress_queue_create (net/core/dev.c:12499) [ 23.422456][ T304] ? netdev_upper_dev_unlink (net/core/dev.c:9149) [ 23.422460][ T304] ? __netdev_upper_dev_unlink (net/core/dev.c:9149) [ 23.422466][ T304] rtnl_dellink (net/core/rtnetlink.c:3530 net/core/rtnetlink.c:3570) [ 23.422473][ T304] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 23.422492][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.422503][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.422509][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.422512][ T304] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 23.422515][ T304] ? __lock_release (kernel/locking/lockdep.c:5536) [ 23.422521][ T304] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 23.422524][ T304] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 23.422528][ T304] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 23.422531][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.422538][ T304] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 23.422546][ T304] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 23.422550][ T304] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 23.422557][ T304] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 23.422560][ T304] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 23.422564][ T304] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 23.422569][ T304] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 23.422573][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.422578][ T304] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 23.422583][ T304] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 23.422586][ T304] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 23.422603][ T304] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 23.422607][ T304] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 23.422618][ T304] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 23.422621][ T304] ? __copy_msghdr (net/socket.c:2556) [ 23.422629][ T304] ___sys_sendmsg (net/socket.c:2686) [ 23.422632][ T304] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 23.422635][ T304] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 23.422643][ T304] ? copy_msghdr_from_user (net/socket.c:2673) [ 23.422648][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.422653][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.422659][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.422663][ T304] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 23.422675][ T304] ? __lock_release (kernel/locking/lockdep.c:5536) [ 23.422681][ T304] __sys_sendmsg (net/socket.c:2716) [ 23.422685][ T304] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 23.422689][ T304] ? __sys_sendmsg_sock (net/socket.c:2701) [ 23.422696][ T304] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 23.422700][ T304] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 23.422707][ T304] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 23.422717][ T304] RIP: 0033:0x7fcd1f5ea1d7 [ 23.422721][ T304] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 23.422724][ T304] RSP: 002b:00007ffdf4a079f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 23.422729][ T304] RAX: ffffffffffffffda RBX: 00007ffdf4a08120 RCX: 00007fcd1f5ea1d7 [ 23.422731][ T304] RDX: 0000000000000000 RSI: 00007ffdf4a07a60 RDI: 0000000000000005 [ 23.422733][ T304] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078 [ 23.422735][ T304] R10: 00007fcd1f4e6f60 R11: 0000000000000246 R12: 0000000000000001 [ 23.422737][ T304] R13: 00000000691cba4e R14: 0000000000499600 R15: 0000000000000000 | [ 23.439441][ T304] #PF: error_code(0x0002) - not-present page | [ 23.439708][ T304] PGD 9031067 P4D 9031067 PUD bcce067 PMD 0 | [ 23.439971][ T304] Oops: Oops: 0002 [#1] SMP KASAN | [ 23.440548][ T304] Tainted: [B]=BAD_PAGE [ 23.440690][ T304] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 23.440917][ T304] RIP: 0010:try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 23.441172][ T304] Code: 00 41 89 c0 b8 01 00 00 00 45 85 c0 74 0f 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 be 08 00 00 00 48 89 df e8 7f 7f 81 00 48 0f ba 2b 00 72 11 48 83 c4 10 31 c0 5b 5d 41 5c 41 5d 41 5e All code ======== 0: 00 41 89 add %al,-0x77(%rcx) 3: c0 b8 01 00 00 00 45 sarb $0x45,0x1(%rax) a: 85 c0 test %eax,%eax c: 74 0f je 0x1d e: 48 83 c4 10 add $0x10,%rsp 12: 5b pop %rbx 13: 5d pop %rbp 14: 41 5c pop %r12 16: 41 5d pop %r13 18: 41 5e pop %r14 1a: 41 5f pop %r15 1c: c3 ret 1d: be 08 00 00 00 mov $0x8,%esi 22: 48 89 df mov %rbx,%rdi 25: e8 7f 7f 81 00 call 0x817fa9 2a:* f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) <-- trapping instruction 30: 72 11 jb 0x43 32: 48 83 c4 10 add $0x10,%rsp 36: 31 c0 xor %eax,%eax 38: 5b pop %rbx 39: 5d pop %rbp 3a: 41 5c pop %r12 3c: 41 5d pop %r13 3e: 41 5e pop %r14 Code starting with the faulting instruction =========================================== 0: f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) 6: 72 11 jb 0x19 8: 48 83 c4 10 add $0x10,%rsp c: 31 c0 xor %eax,%eax e: 5b pop %rbx f: 5d pop %rbp 10: 41 5c pop %r12 12: 41 5d pop %r13 14: 41 5e pop %r14 [ 23.441829][ T304] RSP: 0018:ffffc90000586f18 EFLAGS: 00010046 [ 23.442060][ T304] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffb1e4090a [ 23.442330][ T304] RDX: fffffbfff6c0f2cd RSI: 0000000000000008 RDI: ffffffffb6079660 [ 23.442586][ T304] RBP: ffffc90000586f80 R08: 0000000000000001 R09: fffffbfff6c0f2cc [ 23.442844][ T304] R10: ffffffffb6079667 R11: ffffc90000586a00 R12: 0000000000000000 [ 23.443113][ T304] R13: 0000000000000286 R14: ffff888007129000 R15: dffffc0000000000 [ 23.443425][ T304] FS: 00007fcd1f41c800(0000) GS:ffff88807a772000(0000) knlGS:0000000000000000 [ 23.443776][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.444020][ T304] CR2: 0000000000000000 CR3: 000000000896e004 CR4: 0000000000772ef0 [ 23.444333][ T304] PKRU: 55555554 [ 23.444480][ T304] Call Trace: [ 23.444628][ T304] [ 23.444733][ T304] __cancel_work (kernel/workqueue.c:2161 kernel/workqueue.c:4364) [ 23.444931][ T304] ? enable_delayed_work (kernel/workqueue.c:4359) [ 23.445138][ T304] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 23.445332][ T304] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 23.445523][ T304] ? dev_uc_del (net/core/dev_addr_lists.c:718) [ 23.445674][ T304] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 23.445859][ T304] __cancel_work_sync (kernel/workqueue.c:4383) [ 23.446046][ T304] __dev_close_many (net/core/dev.c:1879 (discriminator 2) net/core/dev.c:1932 (discriminator 2)) [ 23.446232][ T304] ? netdev_notify_peers (net/core/dev.c:1891) [ 23.446411][ T304] ? netif_close_many (net/core/dev.c:1959) [ 23.446590][ T304] netif_close_many (net/core/dev.c:1959) [ 23.446769][ T304] ? ip6_route_dev_notify (./include/net/net_namespace.h:418 ./include/linux/netdevice.h:2766 net/ipv6/route.c:6454) [ 23.446951][ T304] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 23.447138][ T304] ? __dev_close_many (net/core/dev.c:1949) [ 23.447425][ T304] ? netif_close_many_and_unlock (net/core/dev.c:12476) [ 23.447659][ T304] unregister_netdevice_many_notify (net/core/dev.c:12545) [ 23.447999][ T304] ? dev_ingress_queue_create (net/core/dev.c:12499) [ 23.448209][ T304] ? netdev_upper_dev_unlink (net/core/dev.c:9149) [ 23.448493][ T304] ? __netdev_upper_dev_unlink (net/core/dev.c:9149) [ 23.448723][ T304] rtnl_dellink (net/core/rtnetlink.c:3530 net/core/rtnetlink.c:3570) [ 23.448903][ T304] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 23.449168][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.449355][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.449542][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.449725][ T304] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 23.450009][ T304] ? __lock_release (kernel/locking/lockdep.c:5536) [ 23.450214][ T304] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 23.450440][ T304] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 23.450624][ T304] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 23.450939][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.451124][ T304] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 23.451295][ T304] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 23.451508][ T304] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 23.451798][ T304] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 23.451983][ T304] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 23.452175][ T304] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 23.452359][ T304] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 23.452646][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.452836][ T304] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 23.453041][ T304] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 23.453239][ T304] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 23.453548][ T304] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 23.453758][ T304] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 23.454030][ T304] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 23.454384][ T304] ? __copy_msghdr (net/socket.c:2556) [ 23.454860][ T304] ___sys_sendmsg (net/socket.c:2686) [ 23.455148][ T304] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 23.455438][ T304] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 23.455988][ T304] ? copy_msghdr_from_user (net/socket.c:2673) [ 23.456304][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.456604][ T304] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 23.456908][ T304] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 23.457388][ T304] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 23.457695][ T304] ? __lock_release (kernel/locking/lockdep.c:5536) [ 23.457998][ T304] __sys_sendmsg (net/socket.c:2716) [ 23.458298][ T304] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 23.458875][ T304] ? __sys_sendmsg_sock (net/socket.c:2701) [ 23.459187][ T304] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 23.459492][ T304] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 23.459803][ T304] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 23.460367][ T304] RIP: 0033:0x7fcd1f5ea1d7 [ 23.460690][ T304] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 23.461614][ T304] RSP: 002b:00007ffdf4a079f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 23.461907][ T304] RAX: ffffffffffffffda RBX: 00007ffdf4a08120 RCX: 00007fcd1f5ea1d7 [ 23.462314][ T304] RDX: 0000000000000000 RSI: 00007ffdf4a07a60 RDI: 0000000000000005 [ 23.462604][ T304] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078 [ 23.462899][ T304] R10: 00007fcd1f4e6f60 R11: 0000000000000246 R12: 0000000000000001 Finger prints: try_to_grab_pending:__cancel_work:__cancel_work_sync:__dev_close_many:netif_close_many kasan_report:kasan_check_range:try_to_grab_pending:__cancel_work:__cancel_work_sync