====================================== | [ 22.564283][ T303] ================================================================== | [ 22.564570][ T303] BUG: KASAN: null-ptr-deref in try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) | [ 22.564840][ T303] Write of size 8 at addr 0000000000000000 by task ip/303 | [ 22.565061][ T303] [ 22.565163][ T303] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 22.565165][ T303] Call Trace: [ 22.565167][ T303] [ 22.565169][ T303] dump_stack_lvl (lib/dump_stack.c:123) [ 22.565177][ T303] ? try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 22.565180][ T303] kasan_report (mm/kasan/report.c:597) [ 22.565189][ T303] ? try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 22.565194][ T303] kasan_check_range (mm/kasan/generic.c:194 mm/kasan/generic.c:200) [ 22.565197][ T303] try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 22.565202][ T303] __cancel_work (kernel/workqueue.c:2161 kernel/workqueue.c:4364) [ 22.565206][ T303] ? enable_delayed_work (kernel/workqueue.c:4359) [ 22.565209][ T303] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 22.565214][ T303] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 22.565219][ T303] ? dev_uc_del (net/core/dev_addr_lists.c:718) [ 22.565225][ T303] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 22.565229][ T303] __cancel_work_sync (kernel/workqueue.c:4383) [ 22.565233][ T303] __dev_close_many (net/core/dev.c:1879 (discriminator 2) net/core/dev.c:1932 (discriminator 2)) [ 22.565240][ T303] ? netdev_notify_peers (net/core/dev.c:1891) [ 22.565244][ T303] ? netif_close_many (net/core/dev.c:1959) [ 22.565248][ T303] netif_close_many (net/core/dev.c:1959) [ 22.565252][ T303] ? ip6_route_dev_notify (./include/net/net_namespace.h:418 ./include/linux/netdevice.h:2766 net/ipv6/route.c:6454) [ 22.565258][ T303] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 22.565264][ T303] ? __dev_close_many (net/core/dev.c:1949) [ 22.565268][ T303] ? netif_close_many_and_unlock (net/core/dev.c:12476) [ 22.565273][ T303] unregister_netdevice_many_notify (net/core/dev.c:12545) [ 22.565280][ T303] ? dev_ingress_queue_create (net/core/dev.c:12499) [ 22.565284][ T303] ? netdev_upper_dev_unlink (net/core/dev.c:9149) [ 22.565288][ T303] ? __netdev_upper_dev_unlink (net/core/dev.c:9149) [ 22.565293][ T303] rtnl_dellink (net/core/rtnetlink.c:3530 net/core/rtnetlink.c:3570) [ 22.565298][ T303] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 22.565317][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.565326][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.565332][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.565336][ T303] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 22.565338][ T303] ? __lock_release (kernel/locking/lockdep.c:5536) [ 22.565344][ T303] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 22.565348][ T303] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 22.565351][ T303] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 22.565354][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.565361][ T303] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 22.565366][ T303] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 22.565369][ T303] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 22.565376][ T303] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 22.565379][ T303] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 22.565382][ T303] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 22.565387][ T303] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 22.565390][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.565396][ T303] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 22.565400][ T303] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 22.565404][ T303] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 22.565415][ T303] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 22.565418][ T303] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 22.565424][ T303] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 22.565427][ T303] ? __copy_msghdr (net/socket.c:2556) [ 22.565434][ T303] ___sys_sendmsg (net/socket.c:2686) [ 22.565437][ T303] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 22.565440][ T303] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 22.565448][ T303] ? copy_msghdr_from_user (net/socket.c:2673) [ 22.565455][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.565462][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.565468][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.565471][ T303] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 22.565478][ T303] ? __lock_release (kernel/locking/lockdep.c:5536) [ 22.565485][ T303] __sys_sendmsg (net/socket.c:2716) [ 22.565491][ T303] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 22.565496][ T303] ? __sys_sendmsg_sock (net/socket.c:2701) [ 22.565506][ T303] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 22.565520][ T303] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 22.565528][ T303] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 22.565532][ T303] RIP: 0033:0x7f99756e21d7 [ 22.565536][ T303] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 22.565539][ T303] RSP: 002b:00007ffebcffd388 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 22.565543][ T303] RAX: ffffffffffffffda RBX: 00007ffebcffdab0 RCX: 00007f99756e21d7 [ 22.565545][ T303] RDX: 0000000000000000 RSI: 00007ffebcffd3f0 RDI: 0000000000000005 [ 22.565547][ T303] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078 [ 22.565549][ T303] R10: 00007f99755def60 R11: 0000000000000246 R12: 0000000000000001 [ 22.565551][ T303] R13: 00000000691ccf11 R14: 0000000000499600 R15: 0000000000000000 | [ 22.581690][ T303] #PF: error_code(0x0002) - not-present page | [ 22.581894][ T303] PGD 9dcf067 P4D 9dcf067 PUD 8d6b067 PMD 0 | [ 22.582119][ T303] Oops: Oops: 0002 [#1] SMP KASAN | [ 22.582660][ T303] Tainted: [B]=BAD_PAGE [ 22.582790][ T303] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 22.583015][ T303] RIP: 0010:try_to_grab_pending (./arch/x86/include/asm/bitops.h:136 ./include/asm-generic/bitops/instrumented-atomic.h:72 kernel/workqueue.c:2072) [ 22.583239][ T303] Code: 00 41 89 c0 b8 01 00 00 00 45 85 c0 74 0f 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 be 08 00 00 00 48 89 df e8 7f 7f 81 00 48 0f ba 2b 00 72 11 48 83 c4 10 31 c0 5b 5d 41 5c 41 5d 41 5e All code ======== 0: 00 41 89 add %al,-0x77(%rcx) 3: c0 b8 01 00 00 00 45 sarb $0x45,0x1(%rax) a: 85 c0 test %eax,%eax c: 74 0f je 0x1d e: 48 83 c4 10 add $0x10,%rsp 12: 5b pop %rbx 13: 5d pop %rbp 14: 41 5c pop %r12 16: 41 5d pop %r13 18: 41 5e pop %r14 1a: 41 5f pop %r15 1c: c3 ret 1d: be 08 00 00 00 mov $0x8,%esi 22: 48 89 df mov %rbx,%rdi 25: e8 7f 7f 81 00 call 0x817fa9 2a:* f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) <-- trapping instruction 30: 72 11 jb 0x43 32: 48 83 c4 10 add $0x10,%rsp 36: 31 c0 xor %eax,%eax 38: 5b pop %rbx 39: 5d pop %rbp 3a: 41 5c pop %r12 3c: 41 5d pop %r13 3e: 41 5e pop %r14 Code starting with the faulting instruction =========================================== 0: f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) 6: 72 11 jb 0x19 8: 48 83 c4 10 add $0x10,%rsp c: 31 c0 xor %eax,%eax e: 5b pop %rbx f: 5d pop %rbp 10: 41 5c pop %r12 12: 41 5d pop %r13 14: 41 5e pop %r14 [ 22.583853][ T303] RSP: 0018:ffffc90000576f18 EFLAGS: 00010046 [ 22.584086][ T303] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffa7e4090a [ 22.584336][ T303] RDX: fffffbfff580f2cd RSI: 0000000000000008 RDI: ffffffffac079660 [ 22.584607][ T303] RBP: ffffc90000576f80 R08: 0000000000000001 R09: fffffbfff580f2cc [ 22.584859][ T303] R10: ffffffffac079667 R11: ffffc90000576a00 R12: 0000000000000000 [ 22.585136][ T303] R13: 0000000000000286 R14: ffff888008181000 R15: dffffc0000000000 [ 22.585394][ T303] FS: 00007f9975514800(0000) GS:ffff88808a2f2000(0000) knlGS:0000000000000000 [ 22.585717][ T303] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.585927][ T303] CR2: 0000000000000000 CR3: 000000000ba1a006 CR4: 0000000000772ef0 [ 22.586223][ T303] PKRU: 55555554 [ 22.586351][ T303] Call Trace: [ 22.586505][ T303] [ 22.586601][ T303] __cancel_work (kernel/workqueue.c:2161 kernel/workqueue.c:4364) [ 22.586773][ T303] ? enable_delayed_work (kernel/workqueue.c:4359) [ 22.586941][ T303] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 22.587126][ T303] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 22.587293][ T303] ? dev_uc_del (net/core/dev_addr_lists.c:718) [ 22.587422][ T303] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 22.587615][ T303] __cancel_work_sync (kernel/workqueue.c:4383) [ 22.587783][ T303] __dev_close_many (net/core/dev.c:1879 (discriminator 2) net/core/dev.c:1932 (discriminator 2)) [ 22.587957][ T303] ? netdev_notify_peers (net/core/dev.c:1891) [ 22.588144][ T303] ? netif_close_many (net/core/dev.c:1959) [ 22.588310][ T303] netif_close_many (net/core/dev.c:1959) [ 22.588491][ T303] ? ip6_route_dev_notify (./include/net/net_namespace.h:418 ./include/linux/netdevice.h:2766 net/ipv6/route.c:6454) [ 22.588666][ T303] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 22.588840][ T303] ? __dev_close_many (net/core/dev.c:1949) [ 22.589020][ T303] ? netif_close_many_and_unlock (net/core/dev.c:12476) [ 22.589233][ T303] unregister_netdevice_many_notify (net/core/dev.c:12545) [ 22.589445][ T303] ? dev_ingress_queue_create (net/core/dev.c:12499) [ 22.589635][ T303] ? netdev_upper_dev_unlink (net/core/dev.c:9149) [ 22.589801][ T303] ? __netdev_upper_dev_unlink (net/core/dev.c:9149) [ 22.590030][ T303] rtnl_dellink (net/core/rtnetlink.c:3530 net/core/rtnetlink.c:3570) [ 22.590315][ T303] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 22.590558][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.590733][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.590901][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.591183][ T303] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 22.591347][ T303] ? __lock_release (kernel/locking/lockdep.c:5536) [ 22.591535][ T303] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 22.591748][ T303] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 22.592032][ T303] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 22.592199][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.592372][ T303] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 22.592551][ T303] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 22.592819][ T303] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 22.592991][ T303] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 22.593173][ T303] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 22.593338][ T303] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 22.593626][ T303] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 22.593790][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.593961][ T303] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 22.594146][ T303] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 22.594414][ T303] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 22.594596][ T303] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 22.594768][ T303] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 22.594932][ T303] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 22.595253][ T303] ? __copy_msghdr (net/socket.c:2556) [ 22.595423][ T303] ___sys_sendmsg (net/socket.c:2686) [ 22.595619][ T303] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 22.595884][ T303] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 22.596112][ T303] ? copy_msghdr_from_user (net/socket.c:2673) [ 22.596283][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.596455][ T303] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 22.596734][ T303] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 22.596898][ T303] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 22.597079][ T303] ? __lock_release (kernel/locking/lockdep.c:5536) [ 22.597244][ T303] __sys_sendmsg (net/socket.c:2716) [ 22.597531][ T303] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 22.597740][ T303] ? __sys_sendmsg_sock (net/socket.c:2701) [ 22.597919][ T303] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 22.598101][ T303] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 22.598367][ T303] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 22.598590][ T303] RIP: 0033:0x7f99756e21d7 [ 22.598764][ T303] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 22.599491][ T303] RSP: 002b:00007ffebcffd388 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 22.599751][ T303] RAX: ffffffffffffffda RBX: 00007ffebcffdab0 RCX: 00007f99756e21d7 [ 22.600149][ T303] RDX: 0000000000000000 RSI: 00007ffebcffd3f0 RDI: 0000000000000005 [ 22.600409][ T303] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078 [ 22.600797][ T303] R10: 00007f99755def60 R11: 0000000000000246 R12: 0000000000000001 Finger prints: try_to_grab_pending:__cancel_work:__cancel_work_sync:__dev_close_many:netif_close_many kasan_report:kasan_check_range:try_to_grab_pending:__cancel_work:__cancel_work_sync