====================================== | [ 111.753307][ T38] ================================================================== | [ 111.753559][ T38] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 111.753793][ T38] Write of size 8 at addr ffff888005af9c18 by task kworker/u18:0/38 | [ 111.754023][ T38] [ 111.754369][ T38] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 111.754700][ T38] Workqueue: events_unbound linkwatch_event [ 111.754867][ T38] Call Trace: [ 111.754994][ T38] [ 111.755067][ T38] dump_stack_lvl (lib/dump_stack.c:123) [ 111.755215][ T38] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 111.755403][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 111.755533][ T38] print_report (mm/kasan/report.c:489) [ 111.755672][ T38] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 111.755832][ T38] kasan_report (mm/kasan/report.c:603) [ 111.755949][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 111.756129][ T38] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 111.756273][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 111.756409][ T38] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 111.756559][ T38] neigh_carrier_down (net/core/neighbour.c:438) [ 111.756688][ T38] arp_netdev_event (net/ipv4/arp.c:1343) [ 111.756841][ T38] ? trace_notifier_run (./include/trace/events/notifier.h:59 (discriminator 52)) [ 111.757008][ T38] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 111.757139][ T38] netdev_state_change (net/core/dev.c:1380 net/core/dev.c:1371) [ 111.757283][ T38] ? __pfx_netdev_state_change (net/core/dev.c:1372) [ 111.757429][ T38] ? dev_deactivate (./include/linux/list.h:111 ./include/linux/list.h:215 ./include/linux/list.h:229 net/sched/sch_generic.c:1404) [ 111.757617][ T38] linkwatch_do_dev (net/core/link_watch.c:177) [ 111.757752][ T38] __linkwatch_run_queue (./include/linux/spinlock.h:376 net/core/link_watch.c:236) [ 111.757886][ T38] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 111.758071][ T38] ? __pfx___linkwatch_run_queue (net/core/link_watch.c:186) [ 111.758334][ T38] ? process_one_work (kernel/workqueue.c:3205) [ 111.758512][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 111.758654][ T38] linkwatch_event (net/core/link_watch.c:278) [ 111.758835][ T38] process_one_work (kernel/workqueue.c:3229) [ 111.758987][ T38] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 111.759132][ T38] ? __pfx_process_one_work (kernel/workqueue.c:3131) [ 111.759291][ T38] ? assign_work (kernel/workqueue.c:1200) [ 111.759435][ T38] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391) [ 111.759593][ T38] ? __pfx_worker_thread (kernel/workqueue.c:3337) [ 111.759751][ T38] kthread (kernel/kthread.c:389) [ 111.759850][ T38] ? __pfx_kthread (kernel/kthread.c:342) [ 111.759993][ T38] ret_from_fork (arch/x86/kernel/process.c:147) [ 111.760149][ T38] ? __pfx_kthread (kernel/kthread.c:342) [ 111.760277][ T38] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) | [ 111.773674][ T38] Disabling lock debugging due to kernel taint | [ 111.773950][ T38] Oops: general protection fault, probably for non-canonical address 0xe02c3c380000004a: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 111.774506][ T38] KASAN: maybe wild-memory-access in range [0x016201c000000250-0x016201c000000257] | [ 111.775108][ T38] Tainted: [B]=BAD_PAGE [ 111.775209][ T38] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 111.775601][ T38] Workqueue: events_unbound linkwatch_event [ 111.775891][ T38] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 111.776176][ T38] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 111.776926][ T38] RSP: 0018:ffffc900002b7a08 EFLAGS: 00010202 [ 111.777099][ T38] RAX: 002c40380000004a RBX: ffff88800604db40 RCX: ffffffffac0796f0 [ 111.777304][ T38] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888005af9c08 [ 111.777535][ T38] RBP: 016201c000000251 R08: 0000000000000000 R09: 0000000000000000 [ 111.777819][ T38] R10: ffffffffae571f0f R11: ffffffffa9ec2ce1 R12: ffff888005af9d3c [ 111.778044][ T38] R13: dffffc0000000000 R14: ffff88800572c000 R15: ffff888005af9c00 [ 111.778286][ T38] FS: 0000000000000000(0000) GS:ffff88802f600000(0000) knlGS:0000000000000000 [ 111.778569][ T38] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 111.778817][ T38] CR2: 00007fd6da45c000 CR3: 0000000034326006 CR4: 0000000000772ef0 [ 111.779134][ T38] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 111.779337][ T38] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 111.779532][ T38] PKRU: 55555554 [ 111.779666][ T38] Call Trace: [ 111.779767][ T38] [ 111.779841][ T38] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 111.779948][ T38] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 111.780173][ T38] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 111.780304][ T38] ? ret_from_fork (arch/x86/kernel/process.c:147) [ 111.780456][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 111.780588][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 111.780791][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 111.780933][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 111.781067][ T38] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 111.781209][ T38] neigh_carrier_down (net/core/neighbour.c:438) [ 111.781439][ T38] arp_netdev_event (net/ipv4/arp.c:1343) [ 111.781572][ T38] ? trace_notifier_run (./include/trace/events/notifier.h:59 (discriminator 52)) [ 111.781710][ T38] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 111.781850][ T38] netdev_state_change (net/core/dev.c:1380 net/core/dev.c:1371) [ 111.782014][ T38] ? __pfx_netdev_state_change (net/core/dev.c:1372) [ 111.782223][ T38] ? dev_deactivate (./include/linux/list.h:111 ./include/linux/list.h:215 ./include/linux/list.h:229 net/sched/sch_generic.c:1404) [ 111.782363][ T38] linkwatch_do_dev (net/core/link_watch.c:177) [ 111.782513][ T38] __linkwatch_run_queue (./include/linux/spinlock.h:376 net/core/link_watch.c:236) [ 111.782646][ T38] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 111.782862][ T38] ? __pfx___linkwatch_run_queue (net/core/link_watch.c:186) [ 111.783024][ T38] ? process_one_work (kernel/workqueue.c:3205) [ 111.783160][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 111.783293][ T38] linkwatch_event (net/core/link_watch.c:278) [ 111.783502][ T38] process_one_work (kernel/workqueue.c:3229) [ 111.783635][ T38] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 111.783775][ T38] ? __pfx_process_one_work (kernel/workqueue.c:3131) [ 111.783907][ T38] ? assign_work (kernel/workqueue.c:1200) [ 111.784051][ T38] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391) [ 111.784184][ T38] ? __pfx_worker_thread (kernel/workqueue.c:3337) [ 111.784386][ T38] kthread (kernel/kthread.c:389) [ 111.784488][ T38] ? __pfx_kthread (kernel/kthread.c:342) [ 111.784617][ T38] ret_from_fork (arch/x86/kernel/process.c:147) [ 111.784782][ T38] ? __pfx_kthread (kernel/kthread.c:342) Finger prints: print_report:kasan_report:neigh_carrier_down:arp_netdev_event:notifier_call_chain neigh_carrier_down:arp_netdev_event:notifier_call_chain:netdev_state_change:linkwatch_do_dev