====================================== | [ 1194.053595][ T7836] ================================================================== | [ 1194.053912][ T7836] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) | [ 1194.054131][ T7836] Write of size 8 at addr ffff88800ae94018 by task ip/7836 | [ 1194.054337][ T7836] [ 1194.054637][ T7836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1194.054959][ T7836] Call Trace: [ 1194.055073][ T7836] <TASK> [ 1194.055145][ T7836] dump_stack_lvl (lib/dump_stack.c:123) [ 1194.055292][ T7836] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 1194.055472][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.055620][ T7836] print_report (mm/kasan/report.c:489) [ 1194.055775][ T7836] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 1194.055915][ T7836] kasan_report (mm/kasan/report.c:603) [ 1194.056021][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.056162][ T7836] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.056303][ T7836] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1194.056450][ T7836] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 1194.056589][ T7836] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 1194.056780][ T7836] neigh_ifdown (net/core/neighbour.c:445) [ 1194.056889][ T7836] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 1194.057035][ T7836] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 1194.057177][ T7836] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 1194.057317][ T7836] __inet_del_ifa (net/ipv4/devinet.c:488) [ 1194.057462][ T7836] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 1194.057603][ T7836] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 1194.057759][ T7836] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 1194.057907][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.058049][ T7836] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1194.058194][ T7836] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1194.058301][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.058440][ T7836] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 1194.058581][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.058719][ T7836] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 1194.058903][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 1194.059044][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 1194.059200][ T7836] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 1194.059342][ T7836] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 1194.059484][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.059640][ T7836] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 1194.059798][ T7836] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 1194.059937][ T7836] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 1194.060094][ T7836] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 1194.060239][ T7836] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 1194.060392][ T7836] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 1194.060533][ T7836] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 1194.060724][ T7836] ___sys_sendmsg (net/socket.c:2663) [ 1194.060876][ T7836] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 1194.061040][ T7836] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 1194.061178][ T7836] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 1194.061322][ T7836] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 1194.061507][ T7836] ? kasan_save_stack (mm/kasan/common.c:49) [ 1194.061658][ T7836] ? kasan_save_stack (mm/kasan/common.c:48) [ 1194.061820][ T7836] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 1194.061962][ T7836] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 1194.062150][ T7836] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 1194.062289][ T7836] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.062446][ T7836] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.062622][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.062784][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.062936][ T7836] ? __lock_release (kernel/locking/lockdep.c:5501) [ 1194.063085][ T7836] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 1194.063199][ T7836] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 1194.063359][ T7836] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 1194.063529][ T7836] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 1194.063696][ T7836] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.063885][ T7836] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.064083][ T7836] RIP: 0033:0x7efe5bb3d7b7 [ 1194.064246][ T7836] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1194.064766][ T7836] RSP: 002b:00007ffc3dc19da8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1194.064995][ T7836] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efe5bb3d7b7 [ 1194.065206][ T7836] RDX: 0000000000000000 RSI: 00007ffc3dc19e10 RDI: 0000000000000005 [ 1194.065434][ T7836] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1194.065659][ T7836] R10: 00007efe5b9fbef8 R11: 0000000000000246 R12: 00007ffc3dc1a560 [ 1194.065910][ T7836] R13: 000000006716a077 R14: 0000000000496600 R15: 00007ffc3dc1a568 | [ 1194.069998][ T7836] ------------[ cut here ]------------ | [ 1194.070158][ T7836] pool index 93034 out of bounds (803) for stack id 6b6b6b6b | [ 1194.070420][ T7836] WARNING: CPU: 1 PID: 7836 at lib/stackdepot.c:451 depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) | [ 1194.070705][ T7836] Modules linked in: dummy cls_flower act_mirred 8021q bridge stp llc ip6_gre ip6_tunnel tunnel6 act_gact cls_matchall ip_gre gre sch_ingress vrf veth [ 1194.071411][ T7836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1194.071772][ T7836] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 1194.071931][ T7836] Code: b8 11 ad a3 e8 cb c0 9a 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 28 47 20 a3 44 89 e1 44 89 ea 89 ee e8 7b f2 0d ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad All code ======== 0: b8 11 ad a3 e8 mov $0xe8a3ad11,%eax 5: cb lret 6: c0 9a 01 83 f8 01 75 rcrb $0x75,0x1f88301(%rdx) d: b8 90 0f 0b 90 mov $0x900b0f90,%eax 12: eb b2 jmp 0xffffffffffffffc6 14: 90 nop 15: 48 c7 c7 28 47 20 a3 mov $0xffffffffa3204728,%rdi 1c: 44 89 e1 mov %r12d,%ecx 1f: 44 89 ea mov %r13d,%edx 22: 89 ee mov %ebp,%esi 24: e8 7b f2 0d ff call 0xffffffffff0df2a4 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: 31 c0 xor %eax,%eax 30: eb bb jmp 0xffffffffffffffed 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: eb b5 jmp 0xffffffffffffffed 38: 90 nop 39: 0f 0b ud2 3b: 90 nop 3c: 31 c0 xor %eax,%eax 3e: eb ad jmp 0xffffffffffffffed Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: 31 c0 xor %eax,%eax 6: eb bb jmp 0xffffffffffffffc3 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: eb b5 jmp 0xffffffffffffffc3 e: 90 nop f: 0f 0b ud2 11: 90 nop 12: 31 c0 xor %eax,%eax 14: eb ad jmp 0xffffffffffffffc3 [ 1194.072473][ T7836] RSP: 0018:ffffc90002f8f200 EFLAGS: 00010086 [ 1194.072670][ T7836] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff46bb43c [ 1194.072927][ T7836] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 1194.073160][ T7836] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff46bb43c [ 1194.073384][ T7836] R10: 0000000000000003 R11: 205d363338375420 R12: 000000006b6b6b6b [ 1194.073623][ T7836] R13: 0000000000000323 R14: 0000000000000008 R15: ffff8880097d0040 [ 1194.073861][ T7836] FS: 00007efe5b931800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 1194.074144][ T7836] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1194.074345][ T7836] CR2: 00000000004e2aa0 CR3: 000000000974a001 CR4: 0000000000772ef0 [ 1194.074583][ T7836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1194.074836][ T7836] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1194.075061][ T7836] PKRU: 55555554 [ 1194.075180][ T7836] Call Trace: [ 1194.075295][ T7836] <TASK> [ 1194.075373][ T7836] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 1194.075525][ T7836] ? __warn (kernel/panic.c:748) [ 1194.075641][ T7836] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 1194.075797][ T7836] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 1194.076037][ T7836] ? handle_bug (arch/x86/kernel/traps.c:285) [ 1194.076153][ T7836] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 1194.076299][ T7836] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 1194.076450][ T7836] ? depot_fetch_stack (lib/stackdepot.c:451 (discriminator 1)) [ 1194.076603][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.076849][ T7836] stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.076998][ T7836] stack_depot_print (lib/stackdepot.c:745) [ 1194.077149][ T7836] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 1194.077334][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.077567][ T7836] print_report (mm/kasan/report.c:489) [ 1194.077713][ T7836] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 1194.077875][ T7836] kasan_report (mm/kasan/report.c:603) [ 1194.077991][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.078229][ T7836] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.078376][ T7836] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1194.078524][ T7836] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 1194.078670][ T7836] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 1194.078955][ T7836] neigh_ifdown (net/core/neighbour.c:445) [ 1194.079078][ T7836] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 1194.079229][ T7836] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 1194.079382][ T7836] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 1194.079548][ T7836] __inet_del_ifa (net/ipv4/devinet.c:488) [ 1194.079798][ T7836] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 1194.079964][ T7836] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 1194.080116][ T7836] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 1194.080276][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.080529][ T7836] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1194.080678][ T7836] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1194.080802][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.080981][ T7836] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 1194.081241][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.081391][ T7836] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 1194.081544][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 1194.081708][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 1194.081884][ T7836] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 1194.082236][ T7836] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 1194.082392][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.082542][ T7836] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 1194.082704][ T7836] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 1194.083027][ T7836] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 1194.083176][ T7836] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 1194.083330][ T7836] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 1194.083480][ T7836] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 1194.083713][ T7836] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 1194.083912][ T7836] ___sys_sendmsg (net/socket.c:2663) [ 1194.084060][ T7836] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 1194.084209][ T7836] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 1194.084467][ T7836] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 1194.084615][ T7836] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 1194.084805][ T7836] ? kasan_save_stack (mm/kasan/common.c:49) [ 1194.084952][ T7836] ? kasan_save_stack (mm/kasan/common.c:48) [ 1194.085099][ T7836] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 1194.085251][ T7836] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 1194.085435][ T7836] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 1194.085581][ T7836] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.085846][ T7836] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.086031][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.086181][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.086342][ T7836] ? __lock_release (kernel/locking/lockdep.c:5501) [ 1194.086579][ T7836] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 1194.086698][ T7836] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 1194.086870][ T7836] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 1194.087018][ T7836] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 1194.087184][ T7836] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.087421][ T7836] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.087618][ T7836] RIP: 0033:0x7efe5bb3d7b7 [ 1194.087786][ T7836] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1194.088340][ T7836] RSP: 002b:00007ffc3dc19da8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1194.088567][ T7836] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efe5bb3d7b7 [ 1194.088904][ T7836] RDX: 0000000000000000 RSI: 00007ffc3dc19e10 RDI: 0000000000000005 [ 1194.089126][ T7836] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1194.089369][ T7836] R10: 00007efe5b9fbef8 R11: 0000000000000246 R12: 00007ffc3dc1a560 [ 1194.089693][ T7836] R13: 000000006716a077 R14: 0000000000496600 R15: 00007ffc3dc1a568 | [ 1194.091999][ T7836] corrupt handle or use after stack_depot_put() | [ 1194.092030][ T7836] WARNING: CPU: 1 PID: 7836 at lib/stackdepot.c:711 stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) | [ 1194.092561][ T7836] Modules linked in: dummy cls_flower act_mirred 8021q bridge stp llc ip6_gre ip6_tunnel tunnel6 act_gact cls_matchall ip_gre gre sch_ingress vrf veth | [ 1194.093365][ T7836] Tainted: [W]=WARN [ 1194.093482][ T7836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1194.093843][ T7836] RIP: 0010:stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.094189][ T7836] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 08 48 20 a3 e8 62 ed 0d ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 All code ======== 0: 74 1a je 0x1c 2: 48 8d 50 20 lea 0x20(%rax),%rdx 6: 48 89 13 mov %rdx,(%rbx) 9: 5b pop %rbx a: 8b 40 14 mov 0x14(%rax),%eax d: 5d pop %rbp e: 41 5c pop %r12 10: c3 ret 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: 31 c0 xor %eax,%eax 17: c3 ret 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: 90 nop 1d: 48 c7 c7 08 48 20 a3 mov $0xffffffffa3204808,%rdi 24: e8 62 ed 0d ff call 0xffffffffff0ded8b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: eb bb jmp 0xffffffffffffffeb 30: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 37: 00 00 00 00 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: eb bb jmp 0xffffffffffffffc1 6: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) d: 00 00 00 00 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 1194.094780][ T7836] RSP: 0018:ffffc90002f8f228 EFLAGS: 00010086 [ 1194.095082][ T7836] RAX: 0000000000000000 RBX: ffffc90002f8f248 RCX: 1ffffffff46bb43c [ 1194.095329][ T7836] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 1194.095574][ T7836] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff46bb43c [ 1194.095922][ T7836] R10: 0000000000000003 R11: 65737520726f2065 R12: 0000000000000000 [ 1194.096197][ T7836] R13: ffffffffa1c79707 R14: 0000000000000008 R15: ffff8880097d0040 [ 1194.096462][ T7836] FS: 00007efe5b931800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 1194.096839][ T7836] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1194.097046][ T7836] CR2: 00000000004e2aa0 CR3: 000000000974a001 CR4: 0000000000772ef0 [ 1194.097278][ T7836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1194.097618][ T7836] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1194.097856][ T7836] PKRU: 55555554 [ 1194.097987][ T7836] Call Trace: [ 1194.098097][ T7836] <TASK> [ 1194.098171][ T7836] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.098322][ T7836] ? __warn (kernel/panic.c:748) [ 1194.098434][ T7836] ? nbcon_get_cpu_emergency_nesting (kernel/printk/nbcon.c:1356) [ 1194.098617][ T7836] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.098885][ T7836] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 1194.099038][ T7836] ? handle_bug (arch/x86/kernel/traps.c:285) [ 1194.099151][ T7836] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1)) [ 1194.099308][ T7836] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 1194.099457][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.099703][ T7836] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.099895][ T7836] ? stack_depot_fetch (lib/stackdepot.c:711 lib/stackdepot.c:691) [ 1194.100066][ T7836] stack_depot_print (lib/stackdepot.c:745) [ 1194.100215][ T7836] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:352 mm/kasan/report.c:381) [ 1194.100522][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.100670][ T7836] print_report (mm/kasan/report.c:489) [ 1194.100837][ T7836] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 1194.100993][ T7836] kasan_report (mm/kasan/report.c:603) [ 1194.101106][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.101270][ T7836] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) [ 1194.101416][ T7836] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1194.101580][ T7836] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 1194.101848][ T7836] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 1194.102034][ T7836] neigh_ifdown (net/core/neighbour.c:445) [ 1194.102160][ T7836] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 1194.102308][ T7836] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 1194.102471][ T7836] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 1194.102706][ T7836] __inet_del_ifa (net/ipv4/devinet.c:488) [ 1194.102867][ T7836] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 1194.103031][ T7836] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 1194.103186][ T7836] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 1194.103426][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.103573][ T7836] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1194.103719][ T7836] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1194.103840][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.103990][ T7836] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 1194.104135][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.104283][ T7836] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 1194.104434][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 1194.104585][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 1194.104829][ T7836] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 1194.104978][ T7836] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 1194.105124][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.105276][ T7836] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 1194.105511][ T7836] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 1194.105657][ T7836] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 1194.105817][ T7836] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 1194.105971][ T7836] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 1194.106289][ T7836] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 1194.106435][ T7836] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 1194.106621][ T7836] ___sys_sendmsg (net/socket.c:2663) [ 1194.106792][ T7836] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 1194.107050][ T7836] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 1194.107197][ T7836] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 1194.107349][ T7836] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 1194.107530][ T7836] ? kasan_save_stack (mm/kasan/common.c:49) [ 1194.107773][ T7836] ? kasan_save_stack (mm/kasan/common.c:48) [ 1194.107935][ T7836] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 1194.108082][ T7836] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 1194.108263][ T7836] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 1194.108497][ T7836] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.108643][ T7836] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.108835][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.108985][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.109220][ T7836] ? __lock_release (kernel/locking/lockdep.c:5501) [ 1194.109367][ T7836] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 1194.109479][ T7836] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 1194.109625][ T7836] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 1194.109784][ T7836] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 1194.110023][ T7836] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.110169][ T7836] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.110355][ T7836] RIP: 0033:0x7efe5bb3d7b7 [ 1194.110505][ T7836] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1194.111130][ T7836] RSP: 002b:00007ffc3dc19da8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1194.111454][ T7836] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efe5bb3d7b7 [ 1194.111682][ T7836] RDX: 0000000000000000 RSI: 00007ffc3dc19e10 RDI: 0000000000000005 [ 1194.111908][ T7836] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1194.112127][ T7836] R10: 00007efe5b9fbef8 R11: 0000000000000246 R12: 00007ffc3dc1a560 [ 1194.112344][ T7836] R13: 000000006716a077 R14: 0000000000496600 R15: 00007ffc3dc1a568 | [ 1194.120135][ T7836] Disabling lock debugging due to kernel taint | [ 1194.120504][ T7836] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 1194.120854][ T7836] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] | [ 1194.121341][ T7836] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1194.121478][ T7836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1194.121871][ T7836] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 1194.122045][ T7836] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d All code ======== 0: 0f 85 ef 04 00 00 jne 0x4f5 6: 49 8d 7f 08 lea 0x8(%r15),%rdi a: 49 8b 1f mov (%r15),%rbx d: 48 89 f8 mov %rdi,%rax 10: 48 c1 e8 03 shr $0x3,%rax 14: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 19: 0f 85 cc 04 00 00 jne 0x4eb 1f: 49 8b 6f 08 mov 0x8(%r15),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 0f 85 19 05 00 00 jne 0x54e 35: 48 89 5d 00 mov %rbx,0x0(%rbp) 39: 48 85 db test %rbx,%rbx 3c: 74 1a je 0x58 3e: 48 rex.W 3f: 8d .byte 0x8d Code starting with the faulting instruction =========================================== 0: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 5: 0f 85 19 05 00 00 jne 0x524 b: 48 89 5d 00 mov %rbx,0x0(%rbp) f: 48 85 db test %rbx,%rbx 12: 74 1a je 0x2e 14: 48 rex.W 15: 8d .byte 0x8d [ 1194.122806][ T7836] RSP: 0018:ffffc90002f8f388 EFLAGS: 00010202 [ 1194.123080][ T7836] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffffa1c796f0 [ 1194.123547][ T7836] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88800ae94008 [ 1194.123867][ T7836] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000 [ 1194.124183][ T7836] R10: ffffffffa4171f0f R11: ffffc90002f8ef99 R12: ffff88800ae9413c [ 1194.124509][ T7836] R13: dffffc0000000000 R14: ffff888007c99000 R15: ffff88800ae94000 [ 1194.124769][ T7836] FS: 00007efe5b931800(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 1194.125275][ T7836] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1194.125458][ T7836] CR2: 00000000004e2aa0 CR3: 000000000974a001 CR4: 0000000000772ef0 [ 1194.125761][ T7836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1194.126148][ T7836] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1194.126465][ T7836] PKRU: 55555554 [ 1194.126641][ T7836] Call Trace: [ 1194.126819][ T7836] <TASK> [ 1194.126941][ T7836] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 1194.127252][ T7836] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 1194.127477][ T7836] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 1194.127663][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 1194.127903][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 1194.128266][ T7836] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) [ 1194.128492][ T7836] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1194.128727][ T7836] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) [ 1194.128938][ T7836] ? blocking_notifier_call_chain (kernel/notifier.c:388 kernel/notifier.c:376) [ 1194.129348][ T7836] neigh_ifdown (net/core/neighbour.c:445) [ 1194.129509][ T7836] fib_inetaddr_event (net/ipv4/fib_frontend.c:1431 net/ipv4/fib_frontend.c:1455) [ 1194.129724][ T7836] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) [ 1194.129943][ T7836] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) [ 1194.130160][ T7836] __inet_del_ifa (net/ipv4/devinet.c:488) [ 1194.130383][ T7836] inet_rtm_deladdr (net/ipv4/devinet.c:706) [ 1194.130597][ T7836] ? __pfx_inet_rtm_deladdr (net/ipv4/devinet.c:665) [ 1194.130817][ T7836] rtnetlink_rcv_msg (net/core/rtnetlink.c:6721) [ 1194.131044][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.131532][ T7836] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1194.131741][ T7836] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1194.131907][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.132124][ T7836] netlink_rcv_skb (net/netlink/af_netlink.c:2551) [ 1194.132343][ T7836] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6615) [ 1194.132546][ T7836] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2528) [ 1194.132763][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340) [ 1194.132977][ T7836] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 1194.133157][ T7836] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 1194.133526][ T7836] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1342) [ 1194.133720][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.133940][ T7836] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 1194.134153][ T7836] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1820) [ 1194.134358][ T7836] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693) [ 1194.134558][ T7836] ? __import_iovec (lib/iov_iter.c:1433 lib/iov_iter.c:1449) [ 1194.134773][ T7836] ____sys_sendmsg (net/socket.c:729 net/socket.c:744 net/socket.c:2607) [ 1194.134980][ T7836] ? __pfx_____sys_sendmsg (net/socket.c:2553) [ 1194.135324][ T7836] ? __pfx_copy_msghdr_from_user (net/socket.c:2533) [ 1194.135605][ T7836] ___sys_sendmsg (net/socket.c:2663) [ 1194.135810][ T7836] ? __pfx_stack_trace_save (kernel/stacktrace.c:114) [ 1194.136017][ T7836] ? __pfx____sys_sendmsg (net/socket.c:2650) [ 1194.136225][ T7836] ? __pfx_validate_chain (kernel/locking/lockdep.c:3860) [ 1194.136432][ T7836] ? __pfx_slab_free_after_rcu_debug (mm/slub.c:4609) [ 1194.136685][ T7836] ? kasan_save_stack (mm/kasan/common.c:49) [ 1194.136901][ T7836] ? kasan_save_stack (mm/kasan/common.c:48) [ 1194.137254][ T7836] ? __kasan_record_aux_stack (mm/kasan/generic.c:541) [ 1194.137467][ T7836] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:123 kernel/rcu/tree.c:3087) [ 1194.137728][ T7836] ? __x64_sys_close (fs/open.c:1568 fs/open.c:1550 fs/open.c:1550) [ 1194.137935][ T7836] ? do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.138290][ T7836] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.138539][ T7836] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1194.138755][ T7836] ? find_held_lock (kernel/locking/lockdep.c:5315) [ 1194.138974][ T7836] ? __lock_release (kernel/locking/lockdep.c:5501) [ 1194.139322][ T7836] ? fdget (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1114 fs/file.c:1128) [ 1194.139488][ T7836] __sys_sendmsg (./include/linux/file.h:35 net/socket.c:2692) [ 1194.139701][ T7836] ? __pfx___sys_sendmsg (net/socket.c:2678) [ 1194.139908][ T7836] ? __virt_addr_valid (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:962 ./include/linux/mmzone.h:2053 arch/x86/mm/physaddr.c:65) [ 1194.140124][ T7836] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1194.140338][ T7836] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1194.140601][ T7836] RIP: 0033:0x7efe5bb3d7b7 [ 1194.140826][ T7836] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1194.141710][ T7836] RSP: 002b:00007ffc3dc19da8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1194.142016][ T7836] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007efe5bb3d7b7 [ 1194.142445][ T7836] RDX: 0000000000000000 RSI: 00007ffc3dc19e10 RDI: 0000000000000005 [ 1194.142748][ T7836] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 1194.143075][ T7836] R10: 00007efe5b9fbef8 R11: 0000000000000246 R12: 00007ffc3dc1a560 Finger prints: stack_depot_fetch:stack_depot_print:print_report:kasan_report:neigh_ifdown neigh_ifdown:fib_inetaddr_event:notifier_call_chain:blocking_notifier_call_chain:__inet_del_ifa print_report:kasan_report:neigh_ifdown:fib_inetaddr_event:notifier_call_chain depot_fetch_stack:stack_depot_fetch:stack_depot_print:print_report:kasan_report