====================================== | [ 192.954831][ T1017] ================================================================== | [ 192.955206][ T1017] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 192.955533][ T1017] Write of size 8 at addr ffff888012ed4c18 by task ip/1017 | [ 192.955869][ T1017] [ 192.956340][ T1017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 192.956871][ T1017] Call Trace: [ 192.957042][ T1017] [ 192.957161][ T1017] dump_stack_lvl (lib/dump_stack.c:123) [ 192.957385][ T1017] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 192.957677][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.957913][ T1017] print_report (mm/kasan/report.c:489) [ 192.958143][ T1017] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 192.958361][ T1017] kasan_report (mm/kasan/report.c:603) [ 192.958531][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.958778][ T1017] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.958987][ T1017] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 192.959224][ T1017] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 192.959439][ T1017] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 192.959664][ T1017] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 192.959890][ T1017] neigh_ifdown (net/core/neighbour.c:445) [ 192.960062][ T1017] rt6_disable_ip (net/ipv6/route.c:4912) [ 192.960294][ T1017] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 192.960519][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 192.960758][ T1017] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 192.960973][ T1017] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 192.961201][ T1017] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 192.961482][ T1017] addrconf_notify (net/ipv6/addrconf.c:3815) [ 192.961707][ T1017] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 192.961942][ T1017] dev_close_many (net/core/dev.c:1590) [ 192.962174][ T1017] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 192.962410][ T1017] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 192.962698][ T1017] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 192.962984][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 192.963155][ T1017] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 192.963377][ T1017] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 192.963640][ T1017] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 192.963906][ T1017] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 192.964069][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 192.964294][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 192.964516][ T1017] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 192.964730][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 192.964941][ T1017] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 192.965156][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 192.965398][ T1017] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 192.965611][ T1017] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 192.965825][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 192.966039][ T1017] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 192.966251][ T1017] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 192.966461][ T1017] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 192.966669][ T1017] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 192.966876][ T1017] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 192.967093][ T1017] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 192.967307][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 192.967515][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 192.967720][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 192.967891][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 192.968102][ T1017] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 192.968314][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 192.968523][ T1017] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 192.968781][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 192.968983][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 192.969192][ T1017] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 192.969405][ T1017] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 192.969626][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 192.969869][ T1017] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 192.970107][ T1017] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 192.970335][ T1017] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 192.970567][ T1017] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 192.970811][ T1017] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 192.971019][ T1017] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 192.971226][ T1017] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 192.971508][ T1017] ___sys_sendmsg (net/socket.c:2663) [ 192.971742][ T1017] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 192.971974][ T1017] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 192.972190][ T1017] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 192.972425][ T1017] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 192.972701][ T1017] ? kasan_save_stack (mm/kasan/common.c:49) [ 192.972924][ T1017] ? kasan_save_stack (mm/kasan/common.c:48) [ 192.973144][ T1017] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 192.973376][ T1017] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 192.973659][ T1017] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 192.973891][ T1017] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 192.974127][ T1017] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 192.974399][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 192.974639][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 192.974860][ T1017] ? __lock_release (kernel/locking/lockdep.c:5501) [ 192.975096][ T1017] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 192.975278][ T1017] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 192.975510][ T1017] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 192.975741][ T1017] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 192.975982][ T1017] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 192.976214][ T1017] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 192.976487][ T1017] RIP: 0033:0x7f7f6084c7b7 [ 192.976736][ T1017] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 192.977541][ T1017] RSP: 002b:00007fff65f36398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 192.977907][ T1017] RAX: ffffffffffffffda RBX: 00007fff65f36ac0 RCX: 00007f7f6084c7b7 [ 192.978282][ T1017] RDX: 0000000000000000 RSI: 00007fff65f36400 RDI: 0000000000000005 [ 192.978646][ T1017] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 192.978998][ T1017] R10: 00007f7f6070aef8 R11: 0000000000000246 R12: 0000000000000002 [ 192.979356][ T1017] R13: 0000000067167506 R14: 0000000000496600 R15: 0000000000000000 | [ 192.985806][ T1017] ------------[ cut here ]------------ | [ 192.986041][ T1017] pool index 93034 out of bounds (719) for stack id 6b6b6b6b | [ 192.986451][ T1017] WARNING: CPU: 1 PID: 1017 at lib/stackdepot.c:451 depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) | [ 192.986872][ T1017] Modules linked in: macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel act_gact cls_flower sch_ingress bridge stp llc vrf veth [ 192.987858][ T1017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 192.988399][ T1017] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 192.988671][ T1017] Code: b8 11 4d 96 e8 cb c0 9a 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 28 47 c0 95 44 89 e1 44 89 ea 89 ee e8 7b f2 0d ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad All code ======== 0: b8 11 4d 96 e8 mov $0xe8964d11,%eax 5: cb lret 6: c0 9a 01 83 f8 01 75 rcrb $0x75,0x1f88301(%rdx) d: b8 90 0f 0b 90 mov $0x900b0f90,%eax 12: eb b2 jmp 0xffffffffffffffc6 14: 90 nop 15: 48 c7 c7 28 47 c0 95 mov $0xffffffff95c04728,%rdi 1c: 44 89 e1 mov %r12d,%ecx 1f: 44 89 ea mov %r13d,%edx 22: 89 ee mov %ebp,%esi 24: e8 7b f2 0d ff call 0xffffffffff0df2a4 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: 31 c0 xor %eax,%eax 30: eb bb jmp 0xffffffffffffffed 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: eb b5 jmp 0xffffffffffffffed 38: 90 nop 39: 0f 0b ud2 3b: 90 nop 3c: 31 c0 xor %eax,%eax 3e: eb ad jmp 0xffffffffffffffed Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: 31 c0 xor %eax,%eax 6: eb bb jmp 0xffffffffffffffc3 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: eb b5 jmp 0xffffffffffffffc3 e: 90 nop f: 0f 0b ud2 11: 90 nop 12: 31 c0 xor %eax,%eax 14: eb ad jmp 0xffffffffffffffc3 [ 192.989521][ T1017] RSP: 0018:ffffc90000f1ebe8 EFLAGS: 00010086 [ 192.989828][ T1017] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff2bfb43c [ 192.990182][ T1017] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 192.990723][ T1017] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff2bfb43c [ 192.991089][ T1017] R10: 0000000000000003 R11: 205d373130315420 R12: 000000006b6b6b6b [ 192.991472][ T1017] R13: 00000000000002cf R14: 0000000000000008 R15: ffff88800550a300 [ 192.992003][ T1017] FS: 00007f7f60640800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 192.992432][ T1017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 192.992745][ T1017] CR2: 00000000004e28e0 CR3: 0000000012c3e003 CR4: 0000000000772ef0 [ 192.993445][ T1017] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 192.993803][ T1017] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 192.994180][ T1017] PKRU: 55555554 [ 192.994374][ T1017] Call Trace: [ 192.994569][ T1017] [ 192.994697][ T1017] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 192.994957][ T1017] ? __warn (kernel/panic.c:748) [ 192.995152][ T1017] ? __down_trylock_console_sem (kernel/printk/printk.c:332) [ 192.995390][ T1017] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 192.995792][ T1017] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 192.996035][ T1017] ? handle_bug (arch/x86/kernel/traps.c:285) [ 192.996233][ T1017] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 192.996459][ T1017] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 192.996858][ T1017] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 192.997083][ T1017] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 192.997305][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.997530][ T1017] stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 192.997912][ T1017] stack_depot_print (lib/stackdepot.c:745) [ 192.998134][ T1017] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 192.998418][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.998667][ T1017] print_report (mm/kasan/report.c:489) [ 192.999070][ T1017] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 192.999331][ T1017] kasan_report (mm/kasan/report.c:603) [ 192.999516][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.999762][ T1017] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 192.999992][ T1017] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 193.000398][ T1017] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 193.000643][ T1017] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 193.000887][ T1017] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 193.001127][ T1017] neigh_ifdown (net/core/neighbour.c:445) [ 193.001300][ T1017] rt6_disable_ip (net/ipv6/route.c:4912) [ 193.001533][ T1017] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 193.001769][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.002023][ T1017] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 193.002273][ T1017] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 193.002520][ T1017] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 193.002843][ T1017] addrconf_notify (net/ipv6/addrconf.c:3815) [ 193.003088][ T1017] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 193.003324][ T1017] dev_close_many (net/core/dev.c:1590) [ 193.003713][ T1017] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 193.003933][ T1017] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 193.004215][ T1017] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 193.004648][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.004820][ T1017] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 193.005055][ T1017] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 193.005330][ T1017] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 193.005782][ T1017] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 193.005955][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.006200][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.006443][ T1017] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 193.006690][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.007080][ T1017] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 193.007329][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.007595][ T1017] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 193.007843][ T1017] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 193.008257][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.008485][ T1017] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 193.008736][ T1017] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 193.008968][ T1017] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 193.009210][ T1017] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 193.009441][ T1017] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 193.009687][ T1017] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 193.009936][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.010182][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.010428][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.010618][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.010868][ T1017] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 193.011112][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.011690][ T1017] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 193.011944][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 193.012191][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 193.012421][ T1017] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 193.012832][ T1017] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 193.013065][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.013311][ T1017] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 193.013545][ T1017] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 193.013795][ T1017] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 193.014201][ T1017] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 193.014451][ T1017] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 193.014701][ T1017] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 193.014932][ T1017] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 193.015410][ T1017] ___sys_sendmsg (net/socket.c:2663) [ 193.015646][ T1017] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 193.015969][ T1017] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 193.016224][ T1017] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 193.016462][ T1017] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 193.016763][ T1017] ? kasan_save_stack (mm/kasan/common.c:49) [ 193.017007][ T1017] ? kasan_save_stack (mm/kasan/common.c:48) [ 193.017244][ T1017] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 193.017652][ T1017] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 193.017959][ T1017] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 193.018207][ T1017] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.018453][ T1017] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.018864][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.019020][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.019188][ T1017] ? __lock_release (kernel/locking/lockdep.c:5501) [ 193.019336][ T1017] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 193.019545][ T1017] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 193.019694][ T1017] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 193.019842][ T1017] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 193.019997][ T1017] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.020255][ T1017] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.020439][ T1017] RIP: 0033:0x7f7f6084c7b7 [ 193.020609][ T1017] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 193.021142][ T1017] RSP: 002b:00007fff65f36398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.021370][ T1017] RAX: ffffffffffffffda RBX: 00007fff65f36ac0 RCX: 00007f7f6084c7b7 [ 193.021682][ T1017] RDX: 0000000000000000 RSI: 00007fff65f36400 RDI: 0000000000000005 [ 193.021900][ T1017] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 193.022134][ T1017] R10: 00007f7f6070aef8 R11: 0000000000000246 R12: 0000000000000002 [ 193.022446][ T1017] R13: 0000000067167506 R14: 0000000000496600 R15: 0000000000000000 | [ 193.024567][ T1017] corrupt handle or use after stack_depot_put() | [ 193.024609][ T1017] WARNING: CPU: 1 PID: 1017 at lib/stackdepot.c:711 stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) | [ 193.025036][ T1017] Modules linked in: macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel act_gact cls_flower sch_ingress bridge stp llc vrf veth | [ 193.025776][ T1017] Tainted: [W]=WARN [ 193.026073][ T1017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 193.026408][ T1017] RIP: 0010:stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 193.026567][ T1017] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 08 48 c0 95 e8 62 ed 0d ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 All code ======== 0: 74 1a je 0x1c 2: 48 8d 50 20 lea 0x20(%rax),%rdx 6: 48 89 13 mov %rdx,(%rbx) 9: 5b pop %rbx a: 8b 40 14 mov 0x14(%rax),%eax d: 5d pop %rbp e: 41 5c pop %r12 10: c3 ret 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: 31 c0 xor %eax,%eax 17: c3 ret 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: 90 nop 1d: 48 c7 c7 08 48 c0 95 mov $0xffffffff95c04808,%rdi 24: e8 62 ed 0d ff call 0xffffffffff0ded8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: eb bb jmp 0xffffffffffffffeb 30: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 37: 00 00 00 00 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: eb bb jmp 0xffffffffffffffc1 6: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) d: 00 00 00 00 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 193.027181][ T1017] RSP: 0018:ffffc90000f1ec10 EFLAGS: 00010086 [ 193.027366][ T1017] RAX: 0000000000000000 RBX: ffffc90000f1ec30 RCX: 1ffffffff2bfb43c [ 193.027673][ T1017] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 193.027889][ T1017] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff2bfb43c [ 193.028114][ T1017] R10: 0000000000000003 R11: 6361747320726574 R12: 0000000000000000 [ 193.028469][ T1017] R13: ffffffff94679707 R14: 0000000000000008 R15: ffff88800550a300 [ 193.028718][ T1017] FS: 00007f7f60640800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 193.028978][ T1017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 193.029174][ T1017] CR2: 00000000004e28e0 CR3: 0000000012c3e003 CR4: 0000000000772ef0 [ 193.029396][ T1017] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 193.029618][ T1017] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 193.029840][ T1017] PKRU: 55555554 [ 193.029953][ T1017] Call Trace: [ 193.030066][ T1017] [ 193.030156][ T1017] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 193.030395][ T1017] ? __warn (kernel/panic.c:748) [ 193.030507][ T1017] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 193.030652][ T1017] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 193.030800][ T1017] ? handle_bug (arch/x86/kernel/traps.c:285) [ 193.030912][ T1017] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 193.031156][ T1017] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 193.031303][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 193.031452][ T1017] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 193.031604][ T1017] stack_depot_print (lib/stackdepot.c:745) [ 193.031840][ T1017] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 193.032022][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 193.032180][ T1017] print_report (mm/kasan/report.c:489) [ 193.032326][ T1017] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 193.032561][ T1017] kasan_report (mm/kasan/report.c:603) [ 193.032671][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 193.032820][ T1017] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 193.032968][ T1017] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 193.033264][ T1017] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 193.033409][ T1017] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 193.033553][ T1017] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 193.033709][ T1017] neigh_ifdown (net/core/neighbour.c:445) [ 193.033819][ T1017] rt6_disable_ip (net/ipv6/route.c:4912) [ 193.033996][ T1017] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 193.034178][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.034333][ T1017] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 193.034481][ T1017] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 193.034720][ T1017] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 193.034904][ T1017] addrconf_notify (net/ipv6/addrconf.c:3815) [ 193.035050][ T1017] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 193.035216][ T1017] dev_close_many (net/core/dev.c:1590) [ 193.035453][ T1017] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 193.035599][ T1017] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 193.035787][ T1017] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 193.035971][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.036228][ T1017] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 193.036374][ T1017] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 193.036552][ T1017] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 193.036732][ T1017] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 193.036843][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.036991][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.037151][ T1017] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 193.037302][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.037538][ T1017] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 193.037683][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.037841][ T1017] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 193.037986][ T1017] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 193.038142][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.038379][ T1017] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 193.038523][ T1017] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 193.038686][ T1017] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 193.038832][ T1017] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 193.039067][ T1017] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 193.039225][ T1017] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 193.039372][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.039516][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.039750][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.039863][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.040014][ T1017] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 193.040179][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.040328][ T1017] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 193.040570][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 193.040715][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 193.040859][ T1017] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 193.041006][ T1017] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 193.041311][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.041458][ T1017] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 193.041603][ T1017] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 193.041748][ T1017] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 193.041895][ T1017] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 193.042071][ T1017] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 193.042227][ T1017] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 193.042370][ T1017] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 193.042651][ T1017] ___sys_sendmsg (net/socket.c:2663) [ 193.042802][ T1017] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 193.042947][ T1017] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 193.043098][ T1017] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 193.043340][ T1017] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 193.043520][ T1017] ? kasan_save_stack (mm/kasan/common.c:49) [ 193.043661][ T1017] ? kasan_save_stack (mm/kasan/common.c:48) [ 193.043803][ T1017] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 193.044039][ T1017] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 193.044227][ T1017] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 193.044377][ T1017] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.044523][ T1017] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.044812][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.044958][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.045116][ T1017] ? __lock_release (kernel/locking/lockdep.c:5501) [ 193.045267][ T1017] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 193.045381][ T1017] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 193.045621][ T1017] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 193.045765][ T1017] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 193.045919][ T1017] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.046075][ T1017] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.046357][ T1017] RIP: 0033:0x7f7f6084c7b7 [ 193.046509][ T1017] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 193.047146][ T1017] RSP: 002b:00007fff65f36398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.047365][ T1017] RAX: ffffffffffffffda RBX: 00007fff65f36ac0 RCX: 00007f7f6084c7b7 [ 193.047582][ T1017] RDX: 0000000000000000 RSI: 00007fff65f36400 RDI: 0000000000000005 [ 193.047901][ T1017] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 193.048133][ T1017] R10: 00007f7f6070aef8 R11: 0000000000000246 R12: 0000000000000002 [ 193.048442][ T1017] R13: 0000000067167506 R14: 0000000000496600 R15: 0000000000000000 | [ 193.056012][ T1017] Disabling lock debugging due to kernel taint | [ 193.056304][ T1017] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 193.056633][ T1017] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] | [ 193.057231][ T1017] Tainted: [B]=BAD_PAGE, [W]=WARN [ 193.057368][ T1017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 193.057667][ T1017] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 193.057854][ T1017] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 193.058415][ T1017] RSP: 0018:ffffc90000f1ed70 EFLAGS: 00010202 [ 193.058588][ T1017] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffff946796f0 [ 193.058809][ T1017] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888012ed4c08 [ 193.059092][ T1017] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000 [ 193.059295][ T1017] R10: ffffffff96b71f0f R11: ffffc90000f1e981 R12: ffff888012ed4d3c [ 193.059493][ T1017] R13: dffffc0000000000 R14: ffff888009994000 R15: ffff888012ed4c00 [ 193.059854][ T1017] FS: 00007f7f60640800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 193.060097][ T1017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 193.060272][ T1017] CR2: 00000000004e28e0 CR3: 0000000012c3e003 CR4: 0000000000772ef0 [ 193.060559][ T1017] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 193.060774][ T1017] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 193.060974][ T1017] PKRU: 55555554 [ 193.061209][ T1017] Call Trace: [ 193.061320][ T1017] [ 193.061390][ T1017] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 193.061499][ T1017] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 193.061638][ T1017] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 193.061785][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 193.061930][ T1017] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 193.062076][ T1017] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 193.062232][ T1017] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 193.062386][ T1017] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 193.062612][ T1017] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 193.062761][ T1017] neigh_ifdown (net/core/neighbour.c:445) [ 193.062873][ T1017] rt6_disable_ip (net/ipv6/route.c:4912) [ 193.063021][ T1017] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 193.063250][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.063399][ T1017] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 193.063545][ T1017] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 193.063693][ T1017] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 193.063957][ T1017] addrconf_notify (net/ipv6/addrconf.c:3815) [ 193.064110][ T1017] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 193.064260][ T1017] dev_close_many (net/core/dev.c:1590) [ 193.064410][ T1017] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 193.064556][ T1017] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 193.064819][ T1017] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 193.065001][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.065116][ T1017] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 193.065265][ T1017] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 193.065522][ T1017] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 193.065705][ T1017] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 193.065817][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.065961][ T1017] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 193.066188][ T1017] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 193.066337][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.066491][ T1017] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 193.066641][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.066876][ T1017] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 193.067019][ T1017] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 193.067194][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.067355][ T1017] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 193.067568][ T1017] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 193.067702][ T1017] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 193.067859][ T1017] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 193.067998][ T1017] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 193.068232][ T1017] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 193.068365][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.068496][ T1017] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 193.068653][ T1017] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 193.068761][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.068894][ T1017] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 193.069028][ T1017] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 193.069171][ T1017] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 193.069309][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 193.069518][ T1017] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 193.069650][ T1017] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 193.069783][ T1017] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 193.069915][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.070158][ T1017] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 193.070309][ T1017] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 193.070443][ T1017] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 193.070576][ T1017] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 193.070711][ T1017] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 193.070924][ T1017] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 193.071056][ T1017] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 193.071249][ T1017] ___sys_sendmsg (net/socket.c:2663) [ 193.071383][ T1017] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 193.071593][ T1017] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 193.071731][ T1017] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 193.071865][ T1017] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 193.072031][ T1017] ? kasan_save_stack (mm/kasan/common.c:49) [ 193.072301][ T1017] ? kasan_save_stack (mm/kasan/common.c:48) [ 193.072432][ T1017] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 193.072567][ T1017] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 193.072734][ T1017] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 193.072867][ T1017] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.073003][ T1017] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.073175][ T1017] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 193.073310][ T1017] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 193.073445][ T1017] ? __lock_release (kernel/locking/lockdep.c:5501) [ 193.073578][ T1017] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 193.073682][ T1017] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 193.073823][ T1017] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 193.074031][ T1017] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 193.074180][ T1017] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 193.074315][ T1017] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 193.074480][ T1017] RIP: 0033:0x7f7f6084c7b7 [ 193.074701][ T1017] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 193.075181][ T1017] RSP: 002b:00007fff65f36398 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.075471][ T1017] RAX: ffffffffffffffda RBX: 00007fff65f36ac0 RCX: 00007f7f6084c7b7 [ 193.075671][ T1017] RDX: 0000000000000000 RSI: 00007fff65f36400 RDI: 0000000000000005 [ 193.075871][ T1017] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 193.076168][ T1017] R10: 00007f7f6070aef8 R11: 0000000000000246 R12: 0000000000000002 Finger prints: stack_depot_fetch:stack_depot_print:print_report:kasan_report:neigh_ifdown neigh_ifdown:rt6_disable_ip:addrconf_notify:notifier_call_chain:dev_close_many print_report:kasan_report:neigh_ifdown:rt6_disable_ip:addrconf_notify depot_fetch_stack:stack_depot_fetch:stack_depot_print:print_report:kasan_report