====================================== | [ 93.967169][ T397] ================================================================== | [ 93.967528][ T397] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 93.967884][ T397] Write of size 8 at addr ffff88800205cc18 by task ip/397 | [ 93.968175][ T397] [ 93.968642][ T397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 93.969163][ T397] Call Trace: [ 93.969345][ T397] [ 93.969465][ T397] dump_stack_lvl (lib/dump_stack.c:123) [ 93.969703][ T397] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 93.970044][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 93.970285][ T397] print_report (mm/kasan/report.c:489) [ 93.970527][ T397] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 93.970773][ T397] kasan_report (mm/kasan/report.c:603) [ 93.970959][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 93.971205][ T397] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 93.971445][ T397] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 93.971694][ T397] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 93.971932][ T397] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 93.972238][ T397] neigh_ifdown (net/core/neighbour.c:445) [ 93.972417][ T397] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 93.972660][ T397] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 93.972902][ T397] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 93.973145][ T397] __inet_del_ifa (net/ipv4/devinet.c:488) [ 93.973389][ T397] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 93.973638][ T397] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 93.973908][ T397] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 93.974150][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 93.974388][ T397] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 93.974629][ T397] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 93.974848][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 93.975102][ T397] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 93.975346][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 93.975588][ T397] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 93.975844][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 93.976083][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 93.976345][ T397] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 93.976598][ T397] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 93.976833][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 93.977062][ T397] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 93.977297][ T397] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 93.977531][ T397] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 93.977793][ T397] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 93.978039][ T397] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 93.978286][ T397] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 93.978517][ T397] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 93.978804][ T397] ___sys_sendmsg (net/socket.c:2663) [ 93.979026][ T397] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 93.979256][ T397] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 93.979509][ T397] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 93.979747][ T397] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 93.980043][ T397] ? kasan_save_stack (mm/kasan/common.c:49) [ 93.980297][ T397] ? kasan_save_stack (mm/kasan/common.c:48) [ 93.980533][ T397] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 93.980774][ T397] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 93.981086][ T397] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 93.981327][ T397] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 93.981575][ T397] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 93.981868][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 93.982128][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 93.982372][ T397] ? __lock_release (kernel/locking/lockdep.c:5501) [ 93.982612][ T397] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 93.982799][ T397] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 93.983040][ T397] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 93.983276][ T397] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 93.983531][ T397] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 93.983803][ T397] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 93.984098][ T397] RIP: 0033:0x7feaaeef07b7 [ 93.984348][ T397] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 93.985230][ T397] RSP: 002b:00007ffd4f0cbf48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.985607][ T397] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feaaeef07b7 [ 93.985965][ T397] RDX: 0000000000000000 RSI: 00007ffd4f0cbfb0 RDI: 0000000000000005 [ 93.986321][ T397] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 93.986701][ T397] R10: 00007feaaedaeef8 R11: 0000000000000246 R12: 00007ffd4f0cc700 [ 93.987056][ T397] R13: 00000000671670a7 R14: 0000000000496600 R15: 00007ffd4f0cc708 | [ 93.993741][ T397] ------------[ cut here ]------------ | [ 93.994018][ T397] pool index 93034 out of bounds (586) for stack id 6b6b6b6b | [ 93.994407][ T397] WARNING: CPU: 0 PID: 397 at lib/stackdepot.c:451 depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) | [ 93.994844][ T397] Modules linked in: 8021q vrf veth [ 93.995475][ T397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 93.996052][ T397] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 93.996315][ T397] Code: b8 11 ed af e8 cb c0 9a 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 28 47 60 af 44 89 e1 44 89 ea 89 ee e8 7b f2 0d ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad All code ======== 0: b8 11 ed af e8 mov $0xe8afed11,%eax 5: cb lret 6: c0 9a 01 83 f8 01 75 rcrb $0x75,0x1f88301(%rdx) d: b8 90 0f 0b 90 mov $0x900b0f90,%eax 12: eb b2 jmp 0xffffffffffffffc6 14: 90 nop 15: 48 c7 c7 28 47 60 af mov $0xffffffffaf604728,%rdi 1c: 44 89 e1 mov %r12d,%ecx 1f: 44 89 ea mov %r13d,%edx 22: 89 ee mov %ebp,%esi 24: e8 7b f2 0d ff call 0xffffffffff0df2a4 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: 31 c0 xor %eax,%eax 30: eb bb jmp 0xffffffffffffffed 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: eb b5 jmp 0xffffffffffffffed 38: 90 nop 39: 0f 0b ud2 3b: 90 nop 3c: 31 c0 xor %eax,%eax 3e: eb ad jmp 0xffffffffffffffed Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: 31 c0 xor %eax,%eax 6: eb bb jmp 0xffffffffffffffc3 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: eb b5 jmp 0xffffffffffffffc3 e: 90 nop f: 0f 0b ud2 11: 90 nop 12: 31 c0 xor %eax,%eax 14: eb ad jmp 0xffffffffffffffc3 [ 93.997226][ T397] RSP: 0018:ffffc9000071f200 EFLAGS: 00010086 [ 93.997533][ T397] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff5f3b43c [ 93.997910][ T397] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 93.998283][ T397] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff5f3b43c [ 93.998654][ T397] R10: 0000000000000003 R11: 205d373933542020 R12: 000000006b6b6b6b [ 93.999021][ T397] R13: 000000000000024a R14: 0000000000000008 R15: ffff888006ada300 [ 93.999411][ T397] FS: 00007feaaece4800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 93.999845][ T397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.000179][ T397] CR2: 00000000004e3370 CR3: 0000000005f9a003 CR4: 0000000000772ef0 [ 94.000560][ T397] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 94.000947][ T397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 94.001348][ T397] PKRU: 55555554 [ 94.001547][ T397] Call Trace: [ 94.001734][ T397] [ 94.001873][ T397] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 94.002137][ T397] ? __warn (kernel/panic.c:748) [ 94.002332][ T397] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 94.002600][ T397] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 94.002847][ T397] ? handle_bug (arch/x86/kernel/traps.c:285) [ 94.003035][ T397] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 94.003274][ T397] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 94.003548][ T397] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 94.003933][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.004180][ T397] stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.004470][ T397] stack_depot_print (lib/stackdepot.c:745) [ 94.004700][ T397] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 94.005022][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.005266][ T397] print_report (mm/kasan/report.c:489) [ 94.005514][ T397] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 94.005771][ T397] kasan_report (mm/kasan/report.c:603) [ 94.005959][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.006205][ T397] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.006449][ T397] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 94.006721][ T397] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 94.006990][ T397] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 94.007304][ T397] neigh_ifdown (net/core/neighbour.c:445) [ 94.007491][ T397] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 94.007742][ T397] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 94.008020][ T397] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 94.008269][ T397] __inet_del_ifa (net/ipv4/devinet.c:488) [ 94.008554][ T397] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 94.008815][ T397] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 94.009086][ T397] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 94.009334][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.009612][ T397] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 94.009867][ T397] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 94.010070][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.010474][ T397] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 94.010690][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.010952][ T397] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 94.011214][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 94.011586][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 94.011874][ T397] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 94.012130][ T397] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 94.012384][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.012635][ T397] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 94.012891][ T397] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 94.013140][ T397] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 94.013410][ T397] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 94.013664][ T397] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 94.014170][ T397] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 94.014394][ T397] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 94.014708][ T397] ___sys_sendmsg (net/socket.c:2663) [ 94.014959][ T397] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 94.015330][ T397] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 94.015558][ T397] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 94.015815][ T397] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 94.016121][ T397] ? kasan_save_stack (mm/kasan/common.c:49) [ 94.016496][ T397] ? kasan_save_stack (mm/kasan/common.c:48) [ 94.016742][ T397] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 94.016992][ T397] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 94.017300][ T397] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 94.017678][ T397] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.017913][ T397] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.018225][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.018482][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.018740][ T397] ? __lock_release (kernel/locking/lockdep.c:5501) [ 94.019004][ T397] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 94.019215][ T397] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 94.019475][ T397] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 94.019882][ T397] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 94.020096][ T397] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.020349][ T397] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.020666][ T397] RIP: 0033:0x7feaaeef07b7 [ 94.021083][ T397] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 94.021910][ T397] RSP: 002b:00007ffd4f0cbf48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.022420][ T397] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feaaeef07b7 [ 94.022823][ T397] RDX: 0000000000000000 RSI: 00007ffd4f0cbfb0 RDI: 0000000000000005 [ 94.023231][ T397] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 94.023742][ T397] R10: 00007feaaedaeef8 R11: 0000000000000246 R12: 00007ffd4f0cc700 [ 94.024132][ T397] R13: 00000000671670a7 R14: 0000000000496600 R15: 00007ffd4f0cc708 | [ 94.027467][ T397] corrupt handle or use after stack_depot_put() | [ 94.027517][ T397] WARNING: CPU: 0 PID: 397 at lib/stackdepot.c:711 stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) | [ 94.028306][ T397] Modules linked in: 8021q vrf veth | [ 94.029119][ T397] Tainted: [W]=WARN [ 94.029261][ T397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 94.029786][ T397] RIP: 0010:stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.030034][ T397] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 08 48 60 af e8 62 ed 0d ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 All code ======== 0: 74 1a je 0x1c 2: 48 8d 50 20 lea 0x20(%rax),%rdx 6: 48 89 13 mov %rdx,(%rbx) 9: 5b pop %rbx a: 8b 40 14 mov 0x14(%rax),%eax d: 5d pop %rbp e: 41 5c pop %r12 10: c3 ret 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: 31 c0 xor %eax,%eax 17: c3 ret 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: 90 nop 1d: 48 c7 c7 08 48 60 af mov $0xffffffffaf604808,%rdi 24: e8 62 ed 0d ff call 0xffffffffff0ded8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: eb bb jmp 0xffffffffffffffeb 30: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 37: 00 00 00 00 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: eb bb jmp 0xffffffffffffffc1 6: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) d: 00 00 00 00 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 94.031052][ T397] RSP: 0018:ffffc9000071f228 EFLAGS: 00010086 [ 94.031499][ T397] RAX: 0000000000000000 RBX: ffffc9000071f248 RCX: 1ffffffff5f3b43c [ 94.031803][ T397] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 94.032177][ T397] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff5f3b43c [ 94.032673][ T397] R10: 0000000000000003 R11: 65737520726f2065 R12: 0000000000000000 [ 94.033035][ T397] R13: ffffffffae079707 R14: 0000000000000008 R15: ffff888006ada300 [ 94.033405][ T397] FS: 00007feaaece4800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 94.033836][ T397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.034142][ T397] CR2: 00000000004e3370 CR3: 0000000005f9a003 CR4: 0000000000772ef0 [ 94.034513][ T397] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 94.035020][ T397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 94.035399][ T397] PKRU: 55555554 [ 94.035578][ T397] Call Trace: [ 94.035769][ T397] [ 94.036014][ T397] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.036215][ T397] ? __warn (kernel/panic.c:748) [ 94.036397][ T397] ? nbcon_get_cpu_emergency_nesting (kernel/printk/nbcon.c:1356) [ 94.036704][ T397] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.037069][ T397] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 94.037298][ T397] ? handle_bug (arch/x86/kernel/traps.c:285) [ 94.037481][ T397] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 94.037751][ T397] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 94.038016][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.038395][ T397] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.038586][ T397] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 94.038823][ T397] stack_depot_print (lib/stackdepot.c:745) [ 94.039055][ T397] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 94.039528][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.039790][ T397] print_report (mm/kasan/report.c:489) [ 94.040051][ T397] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 94.040318][ T397] kasan_report (mm/kasan/report.c:603) [ 94.040520][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.040765][ T397] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 94.041045][ T397] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 94.041316][ T397] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 94.041510][ T397] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 94.041812][ T397] neigh_ifdown (net/core/neighbour.c:445) [ 94.042013][ T397] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 94.042258][ T397] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 94.042503][ T397] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 94.042897][ T397] __inet_del_ifa (net/ipv4/devinet.c:488) [ 94.043158][ T397] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 94.043404][ T397] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 94.043695][ T397] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 94.044113][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.044335][ T397] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 94.044589][ T397] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 94.044796][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.045067][ T397] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 94.045436][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.045685][ T397] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 94.045952][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 94.046221][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 94.046602][ T397] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 94.046826][ T397] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 94.047081][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.047337][ T397] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 94.047581][ T397] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 94.047836][ T397] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 94.048090][ T397] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 94.048350][ T397] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 94.048764][ T397] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 94.048969][ T397] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 94.049292][ T397] ___sys_sendmsg (net/socket.c:2663) [ 94.049543][ T397] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 94.049917][ T397] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 94.050154][ T397] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 94.050404][ T397] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 94.050714][ T397] ? kasan_save_stack (mm/kasan/common.c:49) [ 94.051208][ T397] ? kasan_save_stack (mm/kasan/common.c:48) [ 94.051413][ T397] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 94.051663][ T397] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 94.051977][ T397] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 94.052353][ T397] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.052589][ T397] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.052901][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.053157][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.053574][ T397] ? __lock_release (kernel/locking/lockdep.c:5501) [ 94.053789][ T397] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 94.053912][ T397] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 94.054072][ T397] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 94.054230][ T397] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 94.054417][ T397] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.054611][ T397] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.054807][ T397] RIP: 0033:0x7feaaeef07b7 [ 94.054971][ T397] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 94.055618][ T397] RSP: 002b:00007ffd4f0cbf48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.055949][ T397] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feaaeef07b7 [ 94.056182][ T397] RDX: 0000000000000000 RSI: 00007ffd4f0cbfb0 RDI: 0000000000000005 [ 94.056416][ T397] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 94.056735][ T397] R10: 00007feaaedaeef8 R11: 0000000000000246 R12: 00007ffd4f0cc700 [ 94.057000][ T397] R13: 00000000671670a7 R14: 0000000000496600 R15: 00007ffd4f0cc708 | [ 94.065190][ T397] Disabling lock debugging due to kernel taint | [ 94.065573][ T397] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 94.065939][ T397] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] | [ 94.066476][ T397] Tainted: [B]=BAD_PAGE, [W]=WARN [ 94.066624][ T397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 94.067037][ T397] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 94.067229][ T397] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 94.067844][ T397] RSP: 0018:ffffc9000071f388 EFLAGS: 00010202 [ 94.068033][ T397] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffffae0796f0 [ 94.068261][ T397] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88800205cc08 [ 94.068490][ T397] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000 [ 94.068714][ T397] R10: ffffffffb0571f0f R11: ffffffffac7ec8d4 R12: ffff88800205cd3c [ 94.069017][ T397] R13: dffffc0000000000 R14: ffff8880079c1000 R15: ffff88800205cc00 [ 94.069235][ T397] FS: 00007feaaece4800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 94.069492][ T397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.069763][ T397] CR2: 00000000004e3370 CR3: 0000000005f9a003 CR4: 0000000000772ef0 [ 94.069984][ T397] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 94.070205][ T397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 94.070422][ T397] PKRU: 55555554 [ 94.070536][ T397] Call Trace: [ 94.070652][ T397] [ 94.070728][ T397] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 94.070848][ T397] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 94.071090][ T397] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 94.071236][ T397] ? kasan_save_stack (mm/kasan/common.c:48) [ 94.071382][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 94.071540][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 94.071766][ T397] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 94.071907][ T397] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 94.072043][ T397] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 94.072184][ T397] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 94.072436][ T397] neigh_ifdown (net/core/neighbour.c:445) [ 94.072542][ T397] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 94.072675][ T397] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 94.072826][ T397] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 94.073033][ T397] __inet_del_ifa (net/ipv4/devinet.c:488) [ 94.073188][ T397] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 94.073334][ T397] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 94.073473][ T397] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 94.073628][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.073912][ T397] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 94.074071][ T397] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 94.074172][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.074312][ T397] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 94.074536][ T397] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 94.074674][ T397] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 94.074814][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 94.074981][ T397] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 94.075216][ T397] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 94.075379][ T397] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 94.075530][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.075678][ T397] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 94.075825][ T397] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 94.076055][ T397] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 94.076201][ T397] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 94.076368][ T397] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 94.076499][ T397] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 94.076742][ T397] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 94.076933][ T397] ___sys_sendmsg (net/socket.c:2663) [ 94.077091][ T397] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 94.077244][ T397] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 94.077469][ T397] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 94.077604][ T397] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 94.077769][ T397] ? kasan_save_stack (mm/kasan/common.c:49) [ 94.077898][ T397] ? kasan_save_stack (mm/kasan/common.c:48) [ 94.078108][ T397] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 94.078244][ T397] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 94.078414][ T397] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 94.078568][ T397] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.078808][ T397] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.078968][ T397] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 94.079112][ T397] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 94.079248][ T397] ? __lock_release (kernel/locking/lockdep.c:5501) [ 94.079460][ T397] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 94.079568][ T397] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 94.079699][ T397] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 94.079828][ T397] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 94.080043][ T397] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 94.080175][ T397] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 94.080351][ T397] RIP: 0033:0x7feaaeef07b7 [ 94.080492][ T397] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 94.081047][ T397] RSP: 002b:00007ffd4f0cbf48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.081247][ T397] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feaaeef07b7 [ 94.081533][ T397] RDX: 0000000000000000 RSI: 00007ffd4f0cbfb0 RDI: 0000000000000005 [ 94.081728][ T397] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 94.082002][ T397] R10: 00007feaaedaeef8 R11: 0000000000000246 R12: 00007ffd4f0cc700 Finger prints: stack_depot_fetch:stack_depot_print:print_report:kasan_report:neigh_ifdown neigh_ifdown:fib_inetaddr_event:notifier_call_chain:blocking_notifier_call_chain:__inet_del_ifa print_report:kasan_report:neigh_ifdown:fib_inetaddr_event:notifier_call_chain depot_fetch_stack:stack_depot_fetch:stack_depot_print:print_report:kasan_report