====================================== | [ 1706.895938][T12419] ================================================================== | [1706.896311][T12419] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 1706.896596][T12419] Write of size 8 at addr ffff888005ba4018 by task ip/12419 | [ 1706.896869][T12419] [ 1706.897245][T12419] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1706.897659][T12419] Call Trace: [ 1706.897803][T12419] [1706.897901][T12419] dump_stack_lvl (lib/dump_stack.c:123) [1706.898092][T12419] print_address_description.constprop.0 (mm/kasan/report.c:378) [1706.898319][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.898515][T12419] print_report (mm/kasan/report.c:489) [1706.898709][T12419] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [1706.898890][T12419] kasan_report (mm/kasan/report.c:603) [1706.899030][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.899215][T12419] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.899395][T12419] ? lock_acquire (kernel/locking/lockdep.c:5798) [1706.899580][T12419] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [1706.899770][T12419] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [1706.900001][T12419] neigh_ifdown (net/core/neighbour.c:445) [1706.900140][T12419] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [1706.900324][T12419] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [1706.900507][T12419] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [1706.900687][T12419] __inet_del_ifa (net/ipv4/devinet.c:488) [1706.900876][T12419] inet_rtm_deladdr (net/ipv4/devinet.c:706) [1706.901060][T12419] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [1706.901248][T12419] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [1706.901431][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.901612][T12419] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [1706.901797][T12419] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [1706.901937][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.902121][T12419] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [1706.902306][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.902488][T12419] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [1706.902675][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [1706.902857][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [1706.903039][T12419] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [1706.903229][T12419] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [1706.903410][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.903597][T12419] netlink_sendmsg (net/netlink/af_netlink.c:1901) [1706.903779][T12419] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [1706.903961][T12419] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [1706.904143][T12419] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [1706.904330][T12419] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [1706.904510][T12419] ? __pfx_____sys_sendmsg (net/socket.c:2553) [1706.904695][T12419] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [1706.904927][T12419] ___sys_sendmsg (net/socket.c:2663) [1706.905108][T12419] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [1706.905291][T12419] ? __pfx____sys_sendmsg (net/socket.c:2650) [1706.905479][T12419] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [1706.905660][T12419] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [1706.905883][T12419] ? kasan_save_stack (mm/kasan/common.c:49) [1706.906062][T12419] ? kasan_save_stack (mm/kasan/common.c:48) [1706.906246][T12419] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [1706.906428][T12419] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [1706.906653][T12419] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [1706.906833][T12419] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.907020][T12419] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1706.907243][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.907441][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.907623][T12419] ? __lock_release (kernel/locking/lockdep.c:5501) [1706.907817][T12419] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [1706.907958][T12419] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [1706.908137][T12419] ? __pfx___sys_sendmsg (net/socket.c:2678) [1706.908319][T12419] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [1706.908509][T12419] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.908692][T12419] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1706.908917][T12419] RIP: 0033:0x7f6200bfb7b7 [ 1706.909107][T12419] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1706.909804][T12419] RSP: 002b:00007ffdd1bc3b18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1706.910096][T12419] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6200bfb7b7 [ 1706.910389][T12419] RDX: 0000000000000000 RSI: 00007ffdd1bc3b80 RDI: 0000000000000005 [ 1706.910684][T12419] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1706.910974][T12419] R10: 00007f6200ab9ef8 R11: 0000000000000246 R12: 00007ffdd1bc42d0 [ 1706.911267][T12419] R13: 000000006716a06c R14: 0000000000496600 R15: 00007ffdd1bc42d8 | [ 1706.916711][T12419] ------------[ cut here ]------------ | [ 1706.916914][T12419] pool index 93034 out of bounds (780) for stack id 6b6b6b6b | [1706.917256][T12419] WARNING: CPU: 0 PID: 12419 at lib/stackdepot.c:451 depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) | [ 1706.917623][T12419] Modules linked in: act_pedit act_gact cls_flower vxlan ip6_udp_tunnel udp_tunnel bridge stp llc 8021q sch_ingress vrf veth [ 1706.918483][T12419] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [1706.918949][T12419] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 1706.919164][T12419] Code: b8 11 cd ad e8 cb c0 9a 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 28 47 40 ad 44 89 e1 44 89 ea 89 ee e8 7b f2 0d ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad All code ======== 0: b8 11 cd ad e8 mov $0xe8adcd11,%eax 5: cb lret 6: c0 9a 01 83 f8 01 75 rcrb $0x75,0x1f88301(%rdx) d: b8 90 0f 0b 90 mov $0x900b0f90,%eax 12: eb b2 jmp 0xffffffffffffffc6 14: 90 nop 15: 48 c7 c7 28 47 40 ad mov $0xffffffffad404728,%rdi 1c: 44 89 e1 mov %r12d,%ecx 1f: 44 89 ea mov %r13d,%edx 22: 89 ee mov %ebp,%esi 24: e8 7b f2 0d ff call 0xffffffffff0df2a4 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: 31 c0 xor %eax,%eax 30: eb bb jmp 0xffffffffffffffed 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: eb b5 jmp 0xffffffffffffffed 38: 90 nop 39: 0f 0b ud2 3b: 90 nop 3c: 31 c0 xor %eax,%eax 3e: eb ad jmp 0xffffffffffffffed Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: 31 c0 xor %eax,%eax 6: eb bb jmp 0xffffffffffffffc3 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: eb b5 jmp 0xffffffffffffffc3 e: 90 nop f: 0f 0b ud2 11: 90 nop 12: 31 c0 xor %eax,%eax 14: eb ad jmp 0xffffffffffffffc3 [ 1706.919912][T12419] RSP: 0018:ffffc9000060f200 EFLAGS: 00010086 [ 1706.920179][T12419] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff5afb43c [ 1706.920477][T12419] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 1706.920772][T12419] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff5afb43c [ 1706.921064][T12419] R10: 0000000000000003 R11: 205d393134323154 R12: 000000006b6b6b6b [ 1706.921359][T12419] R13: 000000000000030c R14: 0000000000000008 R15: ffff8880090c45c0 [ 1706.921660][T12419] FS: 00007f62009ef800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 1706.922003][T12419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1706.922247][T12419] CR2: 00000000004e3370 CR3: 0000000005e38002 CR4: 0000000000772ef0 [ 1706.922544][T12419] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1706.922847][T12419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1706.923168][T12419] PKRU: 55555554 [ 1706.923327][T12419] Call Trace: [ 1706.923486][T12419] [1706.923594][T12419] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [1706.923809][T12419] ? __warn (kernel/panic.c:748) [1706.923969][T12419] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [1706.924180][T12419] ? report_bug (lib/bug.c:201 lib/bug.c:219) [1706.924391][T12419] ? handle_bug (arch/x86/kernel/traps.c:285) [1706.924550][T12419] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [1706.924760][T12419] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [1706.924972][T12419] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [1706.925182][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.925390][T12419] stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [1706.925731][T12419] stack_depot_print (lib/stackdepot.c:745) [1706.925939][T12419] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [1706.926199][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.926405][T12419] print_report (mm/kasan/report.c:489) [1706.926741][T12419] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [1706.926948][T12419] kasan_report (mm/kasan/report.c:603) [1706.927097][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.927297][T12419] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.927492][T12419] ? lock_acquire (kernel/locking/lockdep.c:5798) [1706.927951][T12419] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [1706.928145][T12419] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [1706.928400][T12419] neigh_ifdown (net/core/neighbour.c:445) [1706.928550][T12419] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [1706.928878][T12419] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [1706.929074][T12419] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [1706.929269][T12419] __inet_del_ifa (net/ipv4/devinet.c:488) [1706.929468][T12419] inet_rtm_deladdr (net/ipv4/devinet.c:706) [1706.929803][T12419] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [1706.930018][T12419] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [1706.930228][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.930442][T12419] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [1706.930777][T12419] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [1706.930937][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.931145][T12419] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [1706.931355][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.931563][T12419] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [1706.931907][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [1706.932114][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [1706.932326][T12419] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [1706.932537][T12419] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [1706.932874][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.933087][T12419] netlink_sendmsg (net/netlink/af_netlink.c:1901) [1706.933298][T12419] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [1706.933505][T12419] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [1706.933843][T12419] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [1706.934042][T12419] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [1706.934238][T12419] ? __pfx_____sys_sendmsg (net/socket.c:2553) [1706.934438][T12419] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [1706.934822][T12419] ___sys_sendmsg (net/socket.c:2663) [1706.935016][T12419] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [1706.935211][T12419] ? __pfx____sys_sendmsg (net/socket.c:2650) [1706.935408][T12419] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [1706.935604][T12419] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [1706.935974][T12419] ? kasan_save_stack (mm/kasan/common.c:49) [1706.936170][T12419] ? kasan_save_stack (mm/kasan/common.c:48) [1706.936364][T12419] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [1706.936564][T12419] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [1706.936953][T12419] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [1706.937158][T12419] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.937366][T12419] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1706.937748][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.937961][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.938177][T12419] ? __lock_release (kernel/locking/lockdep.c:5501) [1706.938385][T12419] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [1706.938549][T12419] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [1706.938884][T12419] ? __pfx___sys_sendmsg (net/socket.c:2678) [1706.939093][T12419] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [1706.939316][T12419] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.939525][T12419] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1706.939920][T12419] RIP: 0033:0x7f6200bfb7b7 [ 1706.940136][T12419] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1706.941008][T12419] RSP: 002b:00007ffdd1bc3b18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1706.941306][T12419] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6200bfb7b7 [ 1706.941602][T12419] RDX: 0000000000000000 RSI: 00007ffdd1bc3b80 RDI: 0000000000000005 [ 1706.942026][T12419] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1706.942316][T12419] R10: 00007f6200ab9ef8 R11: 0000000000000246 R12: 00007ffdd1bc42d0 [ 1706.942605][T12419] R13: 000000006716a06c R14: 0000000000496600 R15: 00007ffdd1bc42d8 | [ 1706.945701][T12419] corrupt handle or use after stack_depot_put() | [1706.945737][T12419] WARNING: CPU: 0 PID: 12419 at lib/stackdepot.c:711 stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) | [ 1706.946460][T12419] Modules linked in: act_pedit act_gact cls_flower vxlan ip6_udp_tunnel udp_tunnel bridge stp llc 8021q sch_ingress vrf veth | [ 1706.947475][T12419] Tainted: [W]=WARN [ 1706.947635][T12419] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [1706.948193][T12419] RIP: 0010:stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1706.948400][T12419] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 08 48 40 ad e8 62 ed 0d ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 All code ======== 0: 74 1a je 0x1c 2: 48 8d 50 20 lea 0x20(%rax),%rdx 6: 48 89 13 mov %rdx,(%rbx) 9: 5b pop %rbx a: 8b 40 14 mov 0x14(%rax),%eax d: 5d pop %rbp e: 41 5c pop %r12 10: c3 ret 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: 31 c0 xor %eax,%eax 17: c3 ret 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: 90 nop 1d: 48 c7 c7 08 48 40 ad mov $0xffffffffad404808,%rdi 24: e8 62 ed 0d ff call 0xffffffffff0ded8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: eb bb jmp 0xffffffffffffffeb 30: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 37: 00 00 00 00 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: eb bb jmp 0xffffffffffffffc1 6: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) d: 00 00 00 00 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 1706.949222][T12419] RSP: 0018:ffffc9000060f228 EFLAGS: 00010086 [ 1706.949465][T12419] RAX: 0000000000000000 RBX: ffffc9000060f248 RCX: 1ffffffff5afb43c [ 1706.949884][T12419] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 1706.950170][T12419] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff5afb43c [ 1706.950461][T12419] R10: 0000000000000003 R11: 6361747320726574 R12: 0000000000000000 [ 1706.950896][T12419] R13: ffffffffabe79707 R14: 0000000000000008 R15: ffff8880090c45c0 [ 1706.951201][T12419] FS: 00007f62009ef800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 1706.951558][T12419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1706.951946][T12419] CR2: 00000000004e3370 CR3: 0000000005e38002 CR4: 0000000000772ef0 [ 1706.952258][T12419] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1706.952567][T12419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1706.953001][T12419] PKRU: 55555554 [ 1706.953155][T12419] Call Trace: [ 1706.953310][T12419] [1706.953415][T12419] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [1706.953621][T12419] ? __warn (kernel/panic.c:748) [1706.953902][T12419] ? nbcon_get_cpu_emergency_nesting (kernel/printk/nbcon.c:1356) [1706.954161][T12419] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [1706.954368][T12419] ? report_bug (lib/bug.c:201 lib/bug.c:219) [1706.954577][T12419] ? handle_bug (arch/x86/kernel/traps.c:285) [1706.954847][T12419] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [1706.955042][T12419] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [1706.955234][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.955433][T12419] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [1706.955752][T12419] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [1706.955944][T12419] stack_depot_print (lib/stackdepot.c:745) [1706.956140][T12419] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [1706.956382][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.956699][T12419] print_report (mm/kasan/report.c:489) [1706.956890][T12419] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [1706.957082][T12419] kasan_report (mm/kasan/report.c:603) [1706.957228][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.957435][T12419] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [1706.957771][T12419] ? lock_acquire (kernel/locking/lockdep.c:5798) [1706.957987][T12419] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [1706.958191][T12419] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [1706.958450][T12419] neigh_ifdown (net/core/neighbour.c:445) [1706.958729][T12419] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [1706.958937][T12419] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [1706.959144][T12419] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [1706.959351][T12419] __inet_del_ifa (net/ipv4/devinet.c:488) [1706.959820][T12419] inet_rtm_deladdr (net/ipv4/devinet.c:706) [1706.960034][T12419] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [1706.960246][T12419] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [1706.960452][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.960657][T12419] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [1706.960988][T12419] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [1706.961145][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.961354][T12419] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [1706.961546][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.961868][T12419] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [1706.962078][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [1706.962270][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [1706.962463][T12419] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [1706.962784][T12419] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [1706.962977][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.963171][T12419] netlink_sendmsg (net/netlink/af_netlink.c:1901) [1706.963365][T12419] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [1706.963561][T12419] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [1706.963880][T12419] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [1706.964086][T12419] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [1706.964292][T12419] ? __pfx_____sys_sendmsg (net/socket.c:2553) [1706.964495][T12419] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [1706.964882][T12419] ___sys_sendmsg (net/socket.c:2663) [1706.965088][T12419] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [1706.965293][T12419] ? __pfx____sys_sendmsg (net/socket.c:2650) [1706.965501][T12419] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [1706.965834][T12419] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [1706.966088][T12419] ? kasan_save_stack (mm/kasan/common.c:49) [1706.966294][T12419] ? kasan_save_stack (mm/kasan/common.c:48) [1706.966497][T12419] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [1706.966829][T12419] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [1706.967083][T12419] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [1706.967286][T12419] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.967494][T12419] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1706.967877][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.968098][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.968298][T12419] ? __lock_release (kernel/locking/lockdep.c:5501) [1706.968491][T12419] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [1706.968765][T12419] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [1706.968962][T12419] ? __pfx___sys_sendmsg (net/socket.c:2678) [1706.969152][T12419] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [1706.969360][T12419] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.969692][T12419] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1706.969932][T12419] RIP: 0033:0x7f6200bfb7b7 [ 1706.970130][T12419] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1706.970945][T12419] RSP: 002b:00007ffdd1bc3b18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1706.971245][T12419] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6200bfb7b7 [ 1706.971685][T12419] RDX: 0000000000000000 RSI: 00007ffdd1bc3b80 RDI: 0000000000000005 [ 1706.971995][T12419] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1706.972300][T12419] R10: 00007f6200ab9ef8 R11: 0000000000000246 R12: 00007ffdd1bc42d0 [ 1706.972735][T12419] R13: 000000006716a06c R14: 0000000000496600 R15: 00007ffdd1bc42d8 | [ 1706.983182][T12419] Disabling lock debugging due to kernel taint | [ 1706.983538][T12419] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 1706.984079][T12419] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] | [ 1706.984810][T12419] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1706.984987][T12419] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [1706.985492][T12419] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 1706.985738][T12419] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 1706.986532][T12419] RSP: 0018:ffffc9000060f388 EFLAGS: 00010202 [ 1706.986773][T12419] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffffabe796f0 [ 1706.987056][T12419] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888005ba4008 [ 1706.987337][T12419] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000 [ 1706.987622][T12419] R10: ffffffffae371f0f R11: ffffc9000060ef99 R12: ffff888005ba413c [ 1706.987904][T12419] R13: dffffc0000000000 R14: ffff88800b1bc000 R15: ffff888005ba4000 [ 1706.988300][T12419] FS: 00007f62009ef800(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 1706.988628][T12419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1706.988866][T12419] CR2: 00000000004e3370 CR3: 0000000005e38002 CR4: 0000000000772ef0 [ 1706.989267][T12419] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1706.989549][T12419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1706.989821][T12419] PKRU: 55555554 [ 1706.990073][T12419] Call Trace: [ 1706.990175][T12419] [1706.990243][T12419] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [1706.990353][T12419] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [1706.990498][T12419] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [1706.990706][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [1706.990837][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [1706.990967][T12419] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [1706.991095][T12419] ? lock_acquire (kernel/locking/lockdep.c:5798) [1706.991304][T12419] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [1706.991438][T12419] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [1706.991600][T12419] neigh_ifdown (net/core/neighbour.c:445) [1706.991701][T12419] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [1706.991837][T12419] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [1706.991967][T12419] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [1706.992098][T12419] __inet_del_ifa (net/ipv4/devinet.c:488) [1706.992231][T12419] inet_rtm_deladdr (net/ipv4/devinet.c:706) [1706.992363][T12419] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [1706.992583][T12419] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [1706.992726][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.992874][T12419] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [1706.993017][T12419] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [1706.993200][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.993346][T12419] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [1706.993488][T12419] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [1706.993631][T12419] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [1706.993778][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [1706.993996][T12419] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [1706.994143][T12419] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [1706.994289][T12419] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [1706.994431][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.994657][T12419] netlink_sendmsg (net/netlink/af_netlink.c:1901) [1706.994802][T12419] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [1706.994949][T12419] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [1706.995091][T12419] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [1706.995310][T12419] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [1706.995453][T12419] ? __pfx_____sys_sendmsg (net/socket.c:2553) [1706.995598][T12419] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [1706.995778][T12419] ___sys_sendmsg (net/socket.c:2663) [1706.995995][T12419] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [1706.996145][T12419] ? __pfx____sys_sendmsg (net/socket.c:2650) [1706.996287][T12419] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [1706.996427][T12419] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [1706.996682][T12419] ? kasan_save_stack (mm/kasan/common.c:49) [1706.996826][T12419] ? kasan_save_stack (mm/kasan/common.c:48) [1706.996970][T12419] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [1706.997111][T12419] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [1706.997369][T12419] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [1706.997509][T12419] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.997652][T12419] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1706.997827][T12419] ? __lock_acquire (kernel/locking/lockdep.c:5202) [1706.997972][T12419] ? find_held_lock (kernel/locking/lockdep.c:5315) [1706.998140][T12419] ? __lock_release (kernel/locking/lockdep.c:5501) [1706.998283][T12419] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [1706.998395][T12419] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [1706.998539][T12419] ? __pfx___sys_sendmsg (net/socket.c:2678) [1706.998756][T12419] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [1706.998905][T12419] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1706.999047][T12419] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1706.999223][T12419] RIP: 0033:0x7f6200bfb7b7 [ 1706.999456][T12419] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1706.999976][T12419] RSP: 002b:00007ffdd1bc3b18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1707.000192][T12419] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6200bfb7b7 [ 1707.000417][T12419] RDX: 0000000000000000 RSI: 00007ffdd1bc3b80 RDI: 0000000000000005 [ 1707.000793][T12419] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1707.001006][T12419] R10: 00007f6200ab9ef8 R11: 0000000000000246 R12: 00007ffdd1bc42d0 Finger prints: stack_depot_fetch:stack_depot_print:print_report:kasan_report:neigh_ifdown neigh_ifdown:fib_inetaddr_event:notifier_call_chain:blocking_notifier_call_chain:__inet_del_ifa print_report:kasan_report:neigh_ifdown:fib_inetaddr_event:notifier_call_chain depot_fetch_stack:stack_depot_fetch:stack_depot_print:print_report:kasan_report