======================================
| [ 1170.346811][ C1] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
| [ 1170.347116][ C1] ------------[ cut here ]------------
| [ 1170.347275][ C1] kernel BUG at include/linux/mm.h:1140!
| [ 1170.347486][ C1] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 1170.347913][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 1170.348246][ C1] RIP: 0010:__free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.348397][ C1] Code: 0f 94 c3 e9 ba fe ff ff 48 c7 c6 a0 18 38 ba 4c 89 e7 e8 df bf f4 ff 90 0f 0b 48 c7 c6 40 29 38 ba 4c 89 e7 e8 cd bf f4 ff 90 <0f> 0b 48 89 ef e8 72 03 09 00 e9 c5 fe ff ff e8 98 03 09 00 e9 35
All code
========
0: 0f 94 c3 sete %bl
3: e9 ba fe ff ff jmp 0xfffffffffffffec2
8: 48 c7 c6 a0 18 38 ba mov $0xffffffffba3818a0,%rsi
f: 4c 89 e7 mov %r12,%rdi
12: e8 df bf f4 ff call 0xfffffffffff4bff6
17: 90 nop
18: 0f 0b ud2
1a: 48 c7 c6 40 29 38 ba mov $0xffffffffba382940,%rsi
21: 4c 89 e7 mov %r12,%rdi
24: e8 cd bf f4 ff call 0xfffffffffff4bff6
29: 90 nop
2a:* 0f 0b ud2 <-- trapping instruction
2c: 48 89 ef mov %rbp,%rdi
2f: e8 72 03 09 00 call 0x903a6
34: e9 c5 fe ff ff jmp 0xfffffffffffffefe
39: e8 98 03 09 00 call 0x903d6
3e: e9 .byte 0xe9
3f: 35 .byte 0x35
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 48 89 ef mov %rbp,%rdi
5: e8 72 03 09 00 call 0x9037c
a: e9 c5 fe ff ff jmp 0xfffffffffffffed4
f: e8 98 03 09 00 call 0x903ac
14: e9 .byte 0xe9
15: 35 .byte 0x35
[ 1170.348874][ C1] RSP: 0018:ffffc900001e8df8 EFLAGS: 00010246
[ 1170.349049][ C1] RAX: 000000000000003e RBX: 0000000000000000 RCX: 1ffffffff75fb43c
[ 1170.349277][ C1] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
[ 1170.349494][ C1] RBP: ffffea0000234534 R08: 0000000000000000 R09: fffffbfff75fb43c
[ 1170.349745][ C1] R10: 0000000000000003 R11: 205d314320202020 R12: ffffea0000234500
[ 1170.349944][ C1] R13: ffffc900001e8ec0 R14: 0000000000000000 R15: 0000000000000008
[ 1170.350164][ C1] FS: 00007fc03a56f740(0000) GS:ffff888036080000(0000) knlGS:0000000000000000
[ 1170.350460][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1170.350630][ C1] CR2: 00007fc03a9c9270 CR3: 0000000012d32002 CR4: 0000000000772ef0
[ 1170.350830][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1170.351029][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1170.351250][ C1] PKRU: 55555554
[ 1170.351352][ C1] Call Trace:
[ 1170.351455][ C1]
[ 1170.351538][ C1] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)
[ 1170.351679][ C1] ? do_trap (arch/x86/kernel/traps.c:156 arch/x86/kernel/traps.c:197)
[ 1170.351782][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.351922][ C1] ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:218)
[ 1170.352074][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.352207][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.352340][ C1] ? handle_invalid_op (arch/x86/kernel/traps.c:256)
[ 1170.352472][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.352606][ C1] ? exc_invalid_op (arch/x86/kernel/traps.c:315)
[ 1170.352739][ C1] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
[ 1170.352875][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.353026][ C1] ? __free_pages (./include/linux/mm.h:1140 ./include/linux/mm.h:1138 mm/page_alloc.c:4819)
[ 1170.353159][ C1] ? rcu_do_batch (kernel/rcu/tree.c:2567)
[ 1170.353291][ C1] neigh_hash_free_rcu (net/core/neighbour.c:554)
[ 1170.353441][ C1] rcu_do_batch (kernel/rcu/tree.c:2567)
[ 1170.353578][ C1] ? __pfx_rcu_do_batch (kernel/rcu/tree.c:2491)
[ 1170.353712][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406)
[ 1170.353877][ C1] rcu_core (kernel/rcu/tree.c:2825)
[ 1170.353978][ C1] handle_softirqs (kernel/softirq.c:554)
[ 1170.354111][ C1] irq_exit_rcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637 kernel/softirq.c:649)
[ 1170.354216][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1037 arch/x86/kernel/apic/apic.c:1037)
[ 1170.354348][ C1]
[ 1170.354421][ C1]
[ 1170.354487][ C1] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702)
[ 1170.354650][ C1] RIP: 0010:lock_is_held_type (kernel/locking/lockdep.c:122 kernel/locking/lockdep.c:5890)
[ 1170.354787][ C1] Code: 69 d0 01 85 c9 0f 84 c0 00 00 00 65 8b 05 a3 c0 1b 46 85 c0 0f 85 b1 00 00 00 65 4c 8b 25 e3 fe 1c 46 41 8b 94 24 34 0a 00 00 <85> d2 0f 85 99 00 00 00 48 89 fd 41 89 f6 9c 8f 04 24 fa 65 ff 05
All code
========
0: 69 d0 01 85 c9 0f imul $0xfc98501,%eax,%edx
6: 84 c0 test %al,%al
8: 00 00 add %al,(%rax)
a: 00 65 8b add %ah,-0x75(%rbp)
d: 05 a3 c0 1b 46 add $0x461bc0a3,%eax
12: 85 c0 test %eax,%eax
14: 0f 85 b1 00 00 00 jne 0xcb
1a: 65 4c 8b 25 e3 fe 1c mov %gs:0x461cfee3(%rip),%r12 # 0x461cff05
21: 46
22: 41 8b 94 24 34 0a 00 mov 0xa34(%r12),%edx
29: 00
2a:* 85 d2 test %edx,%edx <-- trapping instruction
2c: 0f 85 99 00 00 00 jne 0xcb
32: 48 89 fd mov %rdi,%rbp
35: 41 89 f6 mov %esi,%r14d
38: 9c pushf
39: 8f 04 24 pop (%rsp)
3c: fa cli
3d: 65 gs
3e: ff .byte 0xff
3f: 05 .byte 0x5
Code starting with the faulting instruction
===========================================
0: 85 d2 test %edx,%edx
2: 0f 85 99 00 00 00 jne 0xa1
8: 48 89 fd mov %rdi,%rbp
b: 41 89 f6 mov %esi,%r14d
e: 9c pushf
f: 8f 04 24 pop (%rsp)
12: fa cli
13: 65 gs
14: ff .byte 0xff
15: 05 .byte 0x5
[ 1170.355257][ C1] RSP: 0018:ffffc9000157fc60 EFLAGS: 00000246
[ 1170.355426][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
[ 1170.355625][ C1] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffffbb156ec0
[ 1170.355826][ C1] RBP: ffffffffba43a300 R08: 0000000000000000 R09: ffffed1000343558
[ 1170.356027][ C1] R10: ffff888001a1aac3 R11: 0000000000000000 R12: ffff888006728040
[ 1170.356233][ C1] R13: 00000000ffffffff R14: ffff888006c18680 R15: 0000000000000000
[ 1170.356435][ C1] __might_resched (kernel/sched/core.c:8600)
[ 1170.356571][ C1] __might_fault (mm/memory.c:6699)
[ 1170.356703][ C1] _copy_from_user (./arch/x86/include/asm/uaccess_64.h:98 ./include/linux/uaccess.h:162 lib/usercopy.c:18)
[ 1170.356838][ C1] __sys_sendto (net/socket.c:252 net/socket.c:246 net/socket.c:2204)
[ 1170.356976][ C1] ? __pfx___sys_sendto (net/socket.c:2184)
[ 1170.357112][ C1] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693)
[ 1170.357249][ C1] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52))
[ 1170.357382][ C1] ? lock_acquire (kernel/locking/lockdep.c:5798)
[ 1170.357514][ C1] ? __might_fault (mm/memory.c:6700 mm/memory.c:6693)
[ 1170.357645][ C1] ? trace_rseq_update (./include/trace/events/rseq.h:11 (discriminator 52))
[ 1170.357780][ C1] ? __pfx___rseq_handle_notify_resume (kernel/rseq.c:316)
[ 1170.357946][ C1] ? __pfx_task_work_run (kernel/task_work.c:196)
[ 1170.358080][ C1] __x64_sys_sendto (net/socket.c:2222)
[ 1170.358241][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 1170.358409][ C1] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 1170.358568][ C1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 1170.358737][ C1] RIP: 0033:0x7fc03a7c985a
[ 1170.358889][ C1] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
All code
========
0: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
4: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
b: eb b8 jmp 0xffffffffffffffc5
d: 0f 1f 00 nopl (%rax)
10: f3 0f 1e fa endbr64
14: 41 89 ca mov %ecx,%r10d
17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax
1e: 00
1f: 85 c0 test %eax,%eax
21: 75 15 jne 0x38
23: b8 2c 00 00 00 mov $0x2c,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 7e ja 0xb0
32: c3 ret
33: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
38: 41 54 push %r12
3a: 48 83 ec 30 sub $0x30,%rsp
3e: 44 rex.R
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 7e ja 0x86
8: c3 ret
9: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
e: 41 54 push %r12
10: 48 83 ec 30 sub $0x30,%rsp
14: 44 rex.R
15: 89 .byte 0x89
[ 1170.359423][ C1] RSP: 002b:00007ffca10e7e98 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 1170.359632][ C1] RAX: ffffffffffffffda RBX: 000000001fd1bec0 RCX: 00007fc03a7c985a
[ 1170.359854][ C1] RDX: 0000000000000070 RSI: 000000001fd1c160 RDI: 0000000000000005
[ 1170.360075][ C1] RBP: 000000001fd1bec0 R08: 00007ffca10e7ea0 R09: 000000000000001c
[ 1170.360310][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000070
Finger prints:
__free_pages:neigh_hash_free_rcu:rcu_do_batch:rcu_core:handle_softirqs