====================================== | [ 443.657344][ T2903] ================================================================== | [ 443.657645][ T2903] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 443.657863][ T2903] Write of size 8 at addr ffff888005224018 by task ip/2903 | [ 443.658075][ T2903] [ 443.658364][ T2903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 443.658670][ T2903] Call Trace: [ 443.658782][ T2903] [ 443.658857][ T2903] dump_stack_lvl (lib/dump_stack.c:123) [ 443.659005][ T2903] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 443.659189][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.659338][ T2903] print_report (mm/kasan/report.c:489) [ 443.659480][ T2903] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 443.659618][ T2903] kasan_report (mm/kasan/report.c:603) [ 443.659724][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.659864][ T2903] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.660000][ T2903] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 443.660143][ T2903] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 443.660280][ T2903] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 443.660427][ T2903] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 443.660574][ T2903] neigh_ifdown (net/core/neighbour.c:445) [ 443.660677][ T2903] rt6_disable_ip (net/ipv6/route.c:4912) [ 443.660817][ T2903] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 443.660956][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.661096][ T2903] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 443.661245][ T2903] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 443.661392][ T2903] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 443.661571][ T2903] addrconf_notify (net/ipv6/addrconf.c:3815) [ 443.661710][ T2903] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 443.661856][ T2903] dev_close_many (net/core/dev.c:1590) [ 443.661995][ T2903] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 443.662132][ T2903] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 443.662316][ T2903] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 443.662488][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.662593][ T2903] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 443.662730][ T2903] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 443.662902][ T2903] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 443.663073][ T2903] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 443.663178][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.663315][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.663459][ T2903] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 443.663605][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.663743][ T2903] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 443.663881][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.664037][ T2903] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 443.664174][ T2903] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 443.664313][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.664450][ T2903] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 443.664603][ T2903] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 443.664741][ T2903] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 443.664878][ T2903] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 443.665015][ T2903] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 443.665157][ T2903] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 443.665294][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.665430][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.665566][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.665677][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.665828][ T2903] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 443.665968][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.666104][ T2903] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 443.666245][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 443.666385][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 443.666522][ T2903] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 443.666662][ T2903] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 443.666801][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.666942][ T2903] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 443.667079][ T2903] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 443.667216][ T2903] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 443.667354][ T2903] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 443.667492][ T2903] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 443.667634][ T2903] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 443.667773][ T2903] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 443.667951][ T2903] ___sys_sendmsg (net/socket.c:2663) [ 443.668089][ T2903] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 443.668230][ T2903] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 443.668370][ T2903] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 443.668507][ T2903] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 443.668675][ T2903] ? kasan_save_stack (mm/kasan/common.c:49) [ 443.668813][ T2903] ? kasan_save_stack (mm/kasan/common.c:48) [ 443.668949][ T2903] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 443.669090][ T2903] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 443.669271][ T2903] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 443.669409][ T2903] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.669547][ T2903] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.669721][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.669863][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.670012][ T2903] ? __lock_release (kernel/locking/lockdep.c:5501) [ 443.670151][ T2903] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 443.670259][ T2903] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 443.670398][ T2903] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 443.670537][ T2903] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 443.670680][ T2903] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.670825][ T2903] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.670996][ T2903] RIP: 0033:0x7f48c29027b7 [ 443.671144][ T2903] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 443.671633][ T2903] RSP: 002b:00007ffcaac03e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.671849][ T2903] RAX: ffffffffffffffda RBX: 00007ffcaac04550 RCX: 00007f48c29027b7 [ 443.672057][ T2903] RDX: 0000000000000000 RSI: 00007ffcaac03e90 RDI: 0000000000000005 [ 443.672264][ T2903] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 443.672479][ T2903] R10: 00007f48c27c0ef8 R11: 0000000000000246 R12: 0000000000000002 [ 443.672685][ T2903] R13: 00000000671677dc R14: 0000000000496600 R15: 0000000000000000 | [ 443.676674][ T2903] ------------[ cut here ]------------ | [ 443.676814][ T2903] pool index 93034 out of bounds (751) for stack id 6b6b6b6b | [ 443.677071][ T2903] WARNING: CPU: 1 PID: 2903 at lib/stackdepot.c:451 depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) | [ 443.677331][ T2903] Modules linked in: macvlan vxlan ip6_udp_tunnel udp_tunnel 8021q act_gact cls_flower sch_ingress bridge stp llc vrf veth [ 443.677962][ T2903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 443.678289][ T2903] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 443.678449][ T2903] Code: b8 11 4d a2 e8 cb c0 9a 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 28 47 c0 a1 44 89 e1 44 89 ea 89 ee e8 7b f2 0d ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad All code ======== 0: b8 11 4d a2 e8 mov $0xe8a24d11,%eax 5: cb lret 6: c0 9a 01 83 f8 01 75 rcrb $0x75,0x1f88301(%rdx) d: b8 90 0f 0b 90 mov $0x900b0f90,%eax 12: eb b2 jmp 0xffffffffffffffc6 14: 90 nop 15: 48 c7 c7 28 47 c0 a1 mov $0xffffffffa1c04728,%rdi 1c: 44 89 e1 mov %r12d,%ecx 1f: 44 89 ea mov %r13d,%edx 22: 89 ee mov %ebp,%esi 24: e8 7b f2 0d ff call 0xffffffffff0df2a4 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: 31 c0 xor %eax,%eax 30: eb bb jmp 0xffffffffffffffed 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: eb b5 jmp 0xffffffffffffffed 38: 90 nop 39: 0f 0b ud2 3b: 90 nop 3c: 31 c0 xor %eax,%eax 3e: eb ad jmp 0xffffffffffffffed Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: 31 c0 xor %eax,%eax 6: eb bb jmp 0xffffffffffffffc3 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: eb b5 jmp 0xffffffffffffffc3 e: 90 nop f: 0f 0b ud2 11: 90 nop 12: 31 c0 xor %eax,%eax 14: eb ad jmp 0xffffffffffffffc3 [ 443.678968][ T2903] RSP: 0018:ffffc90000e8ebe8 EFLAGS: 00010086 [ 443.679262][ T2903] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff43fb43c [ 443.679485][ T2903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 443.679702][ T2903] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff43fb43c [ 443.679921][ T2903] R10: 0000000000000003 R11: 205d333039325420 R12: 000000006b6b6b6b [ 443.680145][ T2903] R13: 00000000000002ef R14: 0000000000000008 R15: ffff888007aac5c0 [ 443.680367][ T2903] FS: 00007f48c26f6800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 443.680718][ T2903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 443.680902][ T2903] CR2: 00000000004e28e0 CR3: 0000000005ec8003 CR4: 0000000000772ef0 [ 443.681122][ T2903] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 443.681442][ T2903] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 443.681662][ T2903] PKRU: 55555554 [ 443.681774][ T2903] Call Trace: [ 443.681890][ T2903] [ 443.681965][ T2903] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 443.682112][ T2903] ? __warn (kernel/panic.c:748) [ 443.682238][ T2903] ? __down_trylock_console_sem (kernel/printk/printk.c:332) [ 443.682387][ T2903] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 443.682533][ T2903] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 443.682771][ T2903] ? handle_bug (arch/x86/kernel/traps.c:285) [ 443.682890][ T2903] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 443.683041][ T2903] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 443.683190][ T2903] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 443.683426][ T2903] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 443.683571][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.683718][ T2903] stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 443.683865][ T2903] stack_depot_print (lib/stackdepot.c:745) [ 443.684104][ T2903] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 443.684287][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.684436][ T2903] print_report (mm/kasan/report.c:489) [ 443.684595][ T2903] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 443.684829][ T2903] kasan_report (mm/kasan/report.c:603) [ 443.684940][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.685087][ T2903] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.685232][ T2903] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 443.685378][ T2903] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 443.685611][ T2903] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 443.685759][ T2903] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 443.685908][ T2903] neigh_ifdown (net/core/neighbour.c:445) [ 443.686018][ T2903] rt6_disable_ip (net/ipv6/route.c:4912) [ 443.686261][ T2903] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 443.686406][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.686553][ T2903] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 443.686700][ T2903] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 443.686847][ T2903] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 443.687035][ T2903] addrconf_notify (net/ipv6/addrconf.c:3815) [ 443.687180][ T2903] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 443.687337][ T2903] dev_close_many (net/core/dev.c:1590) [ 443.687485][ T2903] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 443.687720][ T2903] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 443.687902][ T2903] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 443.688083][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.688194][ T2903] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 443.688437][ T2903] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 443.688621][ T2903] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 443.688803][ T2903] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 443.688913][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.689060][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.689205][ T2903] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 443.689351][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.689497][ T2903] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 443.689732][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.689895][ T2903] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 443.690042][ T2903] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 443.690190][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.690427][ T2903] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 443.690572][ T2903] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 443.690717][ T2903] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 443.690862][ T2903] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 443.691098][ T2903] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 443.691258][ T2903] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 443.691407][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.691552][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.691709][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.691912][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.692059][ T2903] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 443.692207][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.692354][ T2903] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 443.692597][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 443.692749][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 443.692896][ T2903] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 443.693043][ T2903] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 443.693288][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.693437][ T2903] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 443.693584][ T2903] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 443.693729][ T2903] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 443.693888][ T2903] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 443.694038][ T2903] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 443.694185][ T2903] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 443.694330][ T2903] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 443.694522][ T2903] ___sys_sendmsg (net/socket.c:2663) [ 443.694757][ T2903] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 443.694905][ T2903] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 443.695051][ T2903] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 443.695206][ T2903] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 443.695476][ T2903] ? kasan_save_stack (mm/kasan/common.c:49) [ 443.695620][ T2903] ? kasan_save_stack (mm/kasan/common.c:48) [ 443.695763][ T2903] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 443.695909][ T2903] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 443.696189][ T2903] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 443.696335][ T2903] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.696485][ T2903] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.696670][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.696914][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.697061][ T2903] ? __lock_release (kernel/locking/lockdep.c:5501) [ 443.697207][ T2903] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 443.697320][ T2903] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 443.697649][ T2903] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 443.697795][ T2903] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 443.697949][ T2903] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.698099][ T2903] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.698368][ T2903] RIP: 0033:0x7f48c29027b7 [ 443.698528][ T2903] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 443.699137][ T2903] RSP: 002b:00007ffcaac03e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.699368][ T2903] RAX: ffffffffffffffda RBX: 00007ffcaac04550 RCX: 00007f48c29027b7 [ 443.699594][ T2903] RDX: 0000000000000000 RSI: 00007ffcaac03e90 RDI: 0000000000000005 [ 443.699902][ T2903] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 443.700119][ T2903] R10: 00007f48c27c0ef8 R11: 0000000000000246 R12: 0000000000000002 [ 443.700338][ T2903] R13: 00000000671677dc R14: 0000000000496600 R15: 0000000000000000 | [ 443.702378][ T2903] corrupt handle or use after stack_depot_put() | [ 443.702414][ T2903] WARNING: CPU: 1 PID: 2903 at lib/stackdepot.c:711 stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) | [ 443.702937][ T2903] Modules linked in: macvlan vxlan ip6_udp_tunnel udp_tunnel 8021q act_gact cls_flower sch_ingress bridge stp llc vrf veth | [ 443.703667][ T2903] Tainted: [W]=WARN [ 443.703783][ T2903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 443.704102][ T2903] RIP: 0010:stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 443.704257][ T2903] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 08 48 c0 a1 e8 62 ed 0d ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 All code ======== 0: 74 1a je 0x1c 2: 48 8d 50 20 lea 0x20(%rax),%rdx 6: 48 89 13 mov %rdx,(%rbx) 9: 5b pop %rbx a: 8b 40 14 mov 0x14(%rax),%eax d: 5d pop %rbp e: 41 5c pop %r12 10: c3 ret 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: 31 c0 xor %eax,%eax 17: c3 ret 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: 90 nop 1d: 48 c7 c7 08 48 c0 a1 mov $0xffffffffa1c04808,%rdi 24: e8 62 ed 0d ff call 0xffffffffff0ded8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: eb bb jmp 0xffffffffffffffeb 30: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 37: 00 00 00 00 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: eb bb jmp 0xffffffffffffffc1 6: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) d: 00 00 00 00 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 443.704872][ T2903] RSP: 0018:ffffc90000e8ec10 EFLAGS: 00010086 [ 443.705053][ T2903] RAX: 0000000000000000 RBX: ffffc90000e8ec30 RCX: 1ffffffff43fb43c [ 443.705357][ T2903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 443.705575][ T2903] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff43fb43c [ 443.705790][ T2903] R10: 0000000000000003 R11: 6361747320726574 R12: 0000000000000000 [ 443.706095][ T2903] R13: ffffffffa0679707 R14: 0000000000000008 R15: ffff888007aac5c0 [ 443.706310][ T2903] FS: 00007f48c26f6800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 443.706561][ T2903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 443.706843][ T2903] CR2: 00000000004e28e0 CR3: 0000000005ec8003 CR4: 0000000000772ef0 [ 443.707061][ T2903] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 443.707277][ T2903] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 443.707581][ T2903] PKRU: 55555554 [ 443.707689][ T2903] Call Trace: [ 443.707797][ T2903] [ 443.707871][ T2903] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 443.708019][ T2903] ? __warn (kernel/panic.c:748) [ 443.708218][ T2903] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 443.708363][ T2903] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 443.708511][ T2903] ? handle_bug (arch/x86/kernel/traps.c:285) [ 443.708622][ T2903] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 443.708765][ T2903] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 443.709082][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.709231][ T2903] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 443.709377][ T2903] stack_depot_print (lib/stackdepot.c:745) [ 443.709525][ T2903] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 443.709792][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.709945][ T2903] print_report (mm/kasan/report.c:489) [ 443.710102][ T2903] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 443.710249][ T2903] kasan_report (mm/kasan/report.c:603) [ 443.710447][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.710598][ T2903] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 443.710746][ T2903] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 443.710900][ T2903] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 443.711131][ T2903] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 443.711274][ T2903] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 443.711422][ T2903] neigh_ifdown (net/core/neighbour.c:445) [ 443.711531][ T2903] rt6_disable_ip (net/ipv6/route.c:4912) [ 443.711676][ T2903] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 443.711907][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.712052][ T2903] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 443.712206][ T2903] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 443.712351][ T2903] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 443.712620][ T2903] addrconf_notify (net/ipv6/addrconf.c:3815) [ 443.712764][ T2903] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 443.712912][ T2903] dev_close_many (net/core/dev.c:1590) [ 443.713057][ T2903] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 443.713296][ T2903] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 443.713474][ T2903] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 443.713660][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.713770][ T2903] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 443.713913][ T2903] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 443.714091][ T2903] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 443.714269][ T2903] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 443.714378][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.714620][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.714765][ T2903] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 443.714923][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.715068][ T2903] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 443.715318][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.715477][ T2903] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 443.715623][ T2903] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 443.715768][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.715912][ T2903] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 443.716056][ T2903] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 443.716205][ T2903] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 443.716349][ T2903] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 443.716495][ T2903] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 443.716736][ T2903] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 443.716880][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.717023][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.717168][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.717367][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.717515][ T2903] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 443.717661][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.717811][ T2903] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 443.717960][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 443.718191][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 443.718337][ T2903] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 443.718484][ T2903] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 443.718629][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.718879][ T2903] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 443.719026][ T2903] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 443.719170][ T2903] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 443.719323][ T2903] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 443.719558][ T2903] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 443.719702][ T2903] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 443.719852][ T2903] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 443.720038][ T2903] ___sys_sendmsg (net/socket.c:2663) [ 443.720365][ T2903] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 443.720511][ T2903] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 443.720655][ T2903] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 443.720800][ T2903] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 443.720977][ T2903] ? kasan_save_stack (mm/kasan/common.c:49) [ 443.721120][ T2903] ? kasan_save_stack (mm/kasan/common.c:48) [ 443.721263][ T2903] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 443.721408][ T2903] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 443.721679][ T2903] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 443.721822][ T2903] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.721966][ T2903] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.722146][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.722381][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.722526][ T2903] ? __lock_release (kernel/locking/lockdep.c:5501) [ 443.722670][ T2903] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 443.722788][ T2903] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 443.722934][ T2903] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 443.723082][ T2903] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 443.723235][ T2903] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.723380][ T2903] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.723559][ T2903] RIP: 0033:0x7f48c29027b7 [ 443.723800][ T2903] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 443.724405][ T2903] RSP: 002b:00007ffcaac03e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.724639][ T2903] RAX: ffffffffffffffda RBX: 00007ffcaac04550 RCX: 00007f48c29027b7 [ 443.724856][ T2903] RDX: 0000000000000000 RSI: 00007ffcaac03e90 RDI: 0000000000000005 [ 443.725159][ T2903] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 443.725377][ T2903] R10: 00007f48c27c0ef8 R11: 0000000000000246 R12: 0000000000000002 [ 443.725597][ T2903] R13: 00000000671677dc R14: 0000000000496600 R15: 0000000000000000 | [ 443.733201][ T2903] Disabling lock debugging due to kernel taint | [ 443.733468][ T2903] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 443.733882][ T2903] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] | [ 443.734351][ T2903] Tainted: [B]=BAD_PAGE, [W]=WARN [ 443.734574][ T2903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 443.734873][ T2903] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 443.735055][ T2903] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 443.735618][ T2903] RSP: 0018:ffffc90000e8ed70 EFLAGS: 00010202 [ 443.735866][ T2903] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffffa06796f0 [ 443.736064][ T2903] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888005224008 [ 443.736278][ T2903] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000 [ 443.736556][ T2903] R10: ffffffffa2b71f0f R11: ffffc90000e8e981 R12: ffff88800522413c [ 443.736755][ T2903] R13: dffffc0000000000 R14: ffff888005521000 R15: ffff888005224000 [ 443.736954][ T2903] FS: 00007f48c26f6800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 443.737265][ T2903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 443.737440][ T2903] CR2: 00000000004e28e0 CR3: 0000000005ec8003 CR4: 0000000000772ef0 [ 443.737642][ T2903] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 443.737944][ T2903] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 443.738146][ T2903] PKRU: 55555554 [ 443.738247][ T2903] Call Trace: [ 443.738346][ T2903] [ 443.738495][ T2903] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 443.738603][ T2903] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 443.738736][ T2903] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 443.738870][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 443.739002][ T2903] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 443.739212][ T2903] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 443.739349][ T2903] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 443.739482][ T2903] ? __fib6_clean_all (net/ipv6/ip6_fib.c:2274) [ 443.739624][ T2903] ? __pfx_fib6_ifdown (net/ipv6/route.c:4853) [ 443.739838][ T2903] neigh_ifdown (net/core/neighbour.c:445) [ 443.739939][ T2903] rt6_disable_ip (net/ipv6/route.c:4912) [ 443.740078][ T2903] ? __pfx_rt6_disable_ip (net/ipv6/route.c:4912) [ 443.740211][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.740423][ T2903] addrconf_ifdown.isra.0 (./include/net/addrconf.h:330 net/ipv6/addrconf.c:3860) [ 443.740558][ T2903] ? __try_to_del_timer_sync (kernel/time/timer.c:1499) [ 443.740692][ T2903] ? __pfx_addrconf_ifdown.isra.0 (net/ipv6/addrconf.c:3845) [ 443.740866][ T2903] addrconf_notify (net/ipv6/addrconf.c:3815) [ 443.741075][ T2903] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 443.741214][ T2903] dev_close_many (net/core/dev.c:1590) [ 443.741347][ T2903] ? __pfx_dev_close_many (net/core/dev.c:1577) [ 443.741481][ T2903] ? __debug_check_no_obj_freed (lib/debugobjects.c:1000) [ 443.741801][ T2903] unregister_netdevice_many_notify (net/core/dev.c:11503) [ 443.741968][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.742074][ T2903] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 443.742213][ T2903] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11470) [ 443.742458][ T2903] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 443.742623][ T2903] ? kfree (mm/slub.c:4579 mm/slub.c:4727) [ 443.742724][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.742861][ T2903] ? vlan_vid_del (net/8021q/vlan_core.c:368 net/8021q/vlan_core.c:387) [ 443.742996][ T2903] rtnl_dellink (net/core/rtnetlink.c:3329 net/core/rtnetlink.c:3379) [ 443.743218][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.743351][ T2903] ? __pfx_rtnl_dellink (net/core/rtnetlink.c:3335) [ 443.743485][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.743635][ T2903] ? trace_contention_end (./include/trace/events/lock.h:122 (discriminator 52)) [ 443.743849][ T2903] ? __mutex_lock (./arch/x86/include/asm/preempt.h:94 kernel/locking/mutex.c:618 kernel/locking/mutex.c:752) [ 443.743983][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.744125][ T2903] ? rtnetlink_rcv_msg (net/core/rtnetlink.c:6719) [ 443.744272][ T2903] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) [ 443.744507][ T2903] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 443.744653][ T2903] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 443.744798][ T2903] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 443.744951][ T2903] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 443.745176][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.745322][ T2903] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 443.745470][ T2903] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 443.745583][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.745731][ T2903] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 443.745956][ T2903] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 443.746102][ T2903] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 443.746255][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 443.746402][ T2903] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 443.746627][ T2903] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 443.746775][ T2903] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 443.746920][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.747065][ T2903] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 443.747312][ T2903] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 443.747462][ T2903] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 443.747616][ T2903] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 443.747761][ T2903] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 443.747909][ T2903] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 443.748052][ T2903] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 443.748235][ T2903] ___sys_sendmsg (net/socket.c:2663) [ 443.748382][ T2903] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 443.748527][ T2903] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 443.748762][ T2903] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 443.748910][ T2903] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 443.749091][ T2903] ? kasan_save_stack (mm/kasan/common.c:49) [ 443.749242][ T2903] ? kasan_save_stack (mm/kasan/common.c:48) [ 443.749467][ T2903] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 443.749611][ T2903] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 443.749793][ T2903] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 443.749939][ T2903] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.750163][ T2903] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.750344][ T2903] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 443.750498][ T2903] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 443.750644][ T2903] ? __lock_release (kernel/locking/lockdep.c:5501) [ 443.750868][ T2903] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 443.750979][ T2903] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 443.751122][ T2903] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 443.751267][ T2903] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 443.751494][ T2903] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 443.751631][ T2903] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 443.751793][ T2903] RIP: 0033:0x7f48c29027b7 [ 443.751936][ T2903] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 443.752494][ T2903] RSP: 002b:00007ffcaac03e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.752863][ T2903] RAX: ffffffffffffffda RBX: 00007ffcaac04550 RCX: 00007f48c29027b7 [ 443.753063][ T2903] RDX: 0000000000000000 RSI: 00007ffcaac03e90 RDI: 0000000000000005 [ 443.753263][ T2903] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 443.753537][ T2903] R10: 00007f48c27c0ef8 R11: 0000000000000246 R12: 0000000000000002 Finger prints: stack_depot_fetch:stack_depot_print:print_report:kasan_report:neigh_ifdown neigh_ifdown:rt6_disable_ip:addrconf_notify:notifier_call_chain:dev_close_many print_report:kasan_report:neigh_ifdown:rt6_disable_ip:addrconf_notify depot_fetch_stack:stack_depot_fetch:stack_depot_print:print_report:kasan_report