====================================== | [ 1116.391460][ T8995] eth1: renamed from tmp | [ 1136.369610][ T9130] eth1: renamed from tmp | [ 1145.080104][ T9172] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] SMP KASAN | [ 1145.080989][ T9172] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 1145.082063][ T9172] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1145.082472][ T9172] RIP: 0010:ip6_rt_pcpu_alloc (./include/net/net_namespace.h:414 ./include/linux/netdevice.h:2722 net/ipv6/route.c:1418) [ 1145.082816][ T9172] Code: ff 45 0f b7 ef 49 89 c6 e8 7c 69 39 00 49 8d 86 08 01 00 00 48 89 c2 48 89 44 24 08 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 b8 03 00 00 4d 8b be 08 01 00 00 44 89 e9 ba ff All code ======== 0: ff 45 0f incl 0xf(%rbp) 3: b7 ef mov $0xef,%bh 5: 49 89 c6 mov %rax,%r14 8: e8 7c 69 39 00 call 0x396989 d: 49 8d 86 08 01 00 00 lea 0x108(%r14),%rax 14: 48 89 c2 mov %rax,%rdx 17: 48 89 44 24 08 mov %rax,0x8(%rsp) 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 b8 03 00 00 jne 0x3ec 34: 4d 8b be 08 01 00 00 mov 0x108(%r14),%r15 3b: 44 89 e9 mov %r13d,%ecx 3e: ba .byte 0xba 3f: ff .byte 0xff Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 b8 03 00 00 jne 0x3c2 a: 4d 8b be 08 01 00 00 mov 0x108(%r14),%r15 11: 44 89 e9 mov %r13d,%ecx 14: ba .byte 0xba 15: ff .byte 0xff [ 1145.083992][ T9172] RSP: 0018:ffffc900032a69e0 EFLAGS: 00010206 [ 1145.084415][ T9172] RAX: dffffc0000000000 RBX: ffff888013a2ee00 RCX: 0000000000000001 [ 1145.084873][ T9172] RDX: 0000000000000021 RSI: ffffffffa8a5d940 RDI: ffff888012841000 [ 1145.085353][ T9172] RBP: ffff888013a2ee2c R08: 0000000000000000 R09: 0000000000000001 [ 1145.085813][ T9172] R10: 0000000000000000 R11: ffffffffa99852c0 R12: ffffc900032a6b00 [ 1145.086282][ T9172] R13: 0000000000000008 R14: 0000000000000000 R15: 0000000000000008 [ 1145.086763][ T9172] FS: 00007f958d953b80(0000) GS:ffff8880c2416000(0000) knlGS:0000000000000000 [ 1145.087315][ T9172] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1145.087673][ T9172] CR2: 00005582a80f4dec CR3: 0000000011fd4005 CR4: 0000000000772ef0 [ 1145.087962][ T9172] PKRU: 55555554 [ 1145.088108][ T9172] Call Trace: [ 1145.088277][ T9172] [ 1145.088375][ T9172] ? ip6_rt_cache_alloc.constprop.0 (net/ipv6/route.c:1407) [ 1145.088610][ T9172] ? rt6_check_expired (net/ipv6/route.c:1835) [ 1145.088794][ T9172] ip6_pol_route (net/ipv6/route.c:1467 net/ipv6/route.c:2310) [ 1145.088978][ T9172] ? ip6_pol_route_lookup (net/ipv6/route.c:2254) [ 1145.089201][ T9172] ? l3mdev_fib_rule_match (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/l3mdev/l3mdev.c:266) [ 1145.089391][ T9172] ? __lock_release (kernel/locking/lockdep.c:5536) [ 1145.089578][ T9172] __fib6_rule_action (net/ipv6/fib6_rules.c:239) [ 1145.089761][ T9172] ? ip6_pol_route_input (net/ipv6/route.c:2655) [ 1145.089946][ T9172] ? l3mdev_fib_rule_match (net/l3mdev/l3mdev.c:269) [ 1145.090152][ T9172] fib_rules_lookup (net/core/fib_rules.c:339) [ 1145.090344][ T9172] ? fib_nl_dumprule (net/core/fib_rules.c:315) [ 1145.090530][ T9172] ? l3mdev_update_flow (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 net/l3mdev/l3mdev.c:301) [ 1145.090711][ T9172] ? ip6_pol_route_input (net/ipv6/route.c:2655) [ 1145.090914][ T9172] fib6_rule_lookup (net/ipv6/fib6_rules.c:115) [ 1145.091122][ T9172] ? fib6_lookup (net/ipv6/fib6_rules.c:99) [ 1145.091316][ T9172] ? ip6_pol_route_input (net/ipv6/route.c:2655) [ 1145.091497][ T9172] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 1145.091694][ T9172] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 1145.091889][ T9172] ? ip6_route_output_flags (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv6/route.c:2700) [ 1145.092092][ T9172] ip6_route_output_flags (net/ipv6/route.c:2689 net/ipv6/route.c:2701) [ 1145.092297][ T9172] ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1169) [ 1145.092528][ T9172] ? tcp_wfree (net/ipv4/tcp_output.c:1391) [ 1145.092712][ T9172] ip6_dst_lookup_flow (net/ipv6/ip6_output.c:1273) [ 1145.092902][ T9172] ? ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1268) [ 1145.093147][ T9172] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 1145.093352][ T9172] ? trace_netif_rx_exit (./include/trace/events/net.h:302 (discriminator 21)) [ 1145.093541][ T9172] vrf_process_v6_outbound (drivers/net/vrf.c:436) [ 1145.093728][ T9172] ? vrf_ip6_local_out (drivers/net/vrf.c:413) [ 1145.093921][ T9172] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1145.094118][ T9172] vrf_xmit (drivers/net/vrf.c:556 drivers/net/vrf.c:568) [ 1145.094261][ T9172] dev_hard_start_xmit (./include/linux/netdevice.h:5248 ./include/linux/netdevice.h:5257 net/core/dev.c:3845 net/core/dev.c:3861) [ 1145.094456][ T9172] __dev_queue_xmit (net/core/dev.h:378 net/core/dev.c:4764) [ 1145.094635][ T9172] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1145.094818][ T9172] ? netdev_core_pick_tx (net/core/dev.c:4671) [ 1145.095028][ T9172] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:836 ./include/net/neighbour.h:501) [ 1145.095215][ T9172] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 1145.095410][ T9172] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:836 ./include/net/neighbour.h:501) [ 1145.095592][ T9172] ? ip6_mtu (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 ./include/net/ip6_route.h:343 net/ipv6/route.c:3271) [ 1145.095741][ T9172] ip6_finish_output (net/ipv6/ip6_output.c:209 net/ipv6/ip6_output.c:220) [ 1145.095924][ T9172] ip6_output (./include/linux/netfilter.h:307 net/ipv6/ip6_output.c:247) [ 1145.096075][ T9172] ? ip6_finish_output (net/ipv6/ip6_output.c:228) [ 1145.096259][ T9172] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1145.096442][ T9172] ? ip6_mtu (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 ./include/net/ip6_route.h:343 net/ipv6/route.c:3271) [ 1145.096576][ T9172] ? __lock_release (kernel/locking/lockdep.c:5536) [ 1145.096764][ T9172] ip6_xmit (./include/net/dst.h:464 ./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv6/ip6_output.c:371) [ 1145.096904][ T9172] ? ip6_append_data (net/ipv6/ip6_output.c:271) [ 1145.097098][ T9172] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1145.097286][ T9172] inet6_csk_xmit (net/ipv6/inet6_connection_sock.c:120 (discriminator 11)) [ 1145.097484][ T9172] ? __lock_release (kernel/locking/lockdep.c:5536) [ 1145.097675][ T9172] ? inet6_csk_route_socket (net/ipv6/inet6_connection_sock.c:100) [ 1145.097862][ T9172] ? __kernel_text_address (kernel/extable.c:79) [ 1145.098055][ T9172] ? __copy_skb_header (./include/net/dst.h:293 net/core/skbuff.c:1496) [ 1145.098244][ T9172] __tcp_transmit_skb (net/ipv4/tcp_output.c:1628) [ 1145.098429][ T9172] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1145.098612][ T9172] ? __tcp_select_window (net/ipv4/tcp_output.c:1449) [ 1145.098801][ T9172] ? ktime_get (./include/linux/seqlock.h:74 kernel/time/timekeeping.c:824) [ 1145.098997][ T9172] tcp_write_xmit (net/ipv4/tcp_output.c:2988) [ 1145.099178][ T9172] ? __build_skb_around (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 net/core/skbuff.c:383 net/core/skbuff.c:440) [ 1145.099369][ T9172] ? __alloc_skb (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 ./include/linux/refcount.h:134 net/core/skbuff.c:694) [ 1145.099548][ T9172] ? tcp_retrans_try_collapse (net/ipv4/tcp_output.c:2892) [ 1145.099774][ T9172] ? trace_tcp_ao_handshake_failure (./include/net/sock.h:2260) [ 1145.100018][ T9172] ? trace_tcp_ao_handshake_failure (./include/net/sock.h:2260) [ 1145.100249][ T9172] ? skb_page_frag_refill (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/page_ref.h:67 net/core/sock.c:3103) [ 1145.100441][ T9172] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3171) [ 1145.100626][ T9172] tcp_sendmsg_locked (net/ipv4/tcp.c:1376) [ 1145.100816][ T9172] ? tcp_sendmsg_fastopen (net/ipv4/tcp.c:1079) [ 1145.101013][ T9172] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1145.101196][ T9172] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 1145.101380][ T9172] tcp_sendmsg (net/ipv4/tcp.c:1414) [ 1145.101517][ T9172] sock_write_iter (net/socket.c:727 net/socket.c:742 net/socket.c:1195) [ 1145.101697][ T9172] ? ____sys_recvmsg (net/socket.c:1176) [ 1145.101883][ T9172] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1145.102071][ T9172] vfs_write (fs/read_write.c:594 fs/read_write.c:686) [ 1145.102215][ T9172] ? kernel_write (fs/read_write.c:667) [ 1145.102398][ T9172] ? trace_rseq_update (./include/trace/events/rseq.h:11 (discriminator 21)) [ 1145.102577][ T9172] ? rseq_update_cpu_node_id (kernel/rseq.c:189 (discriminator 10)) [ 1145.102756][ T9172] ? __rseq_handle_notify_resume (kernel/rseq.c:442) [ 1145.102990][ T9172] ksys_write (fs/read_write.c:738) [ 1145.103127][ T9172] ? __ia32_sys_read (fs/read_write.c:728) [ 1145.103319][ T9172] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 1145.103504][ T9172] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 1145.103687][ T9172] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1145.103915][ T9172] RIP: 0033:0x7f958da54257 [ 1145.104174][ T9172] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 All code ======== 0: 0f 00 (bad) 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b7 jmp 0xffffffffffffffc7 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 48 89 54 24 18 mov %rdx,0x18(%rsp) 3c: 48 rex.W 3d: 89 .byte 0x89 3e: 74 24 je 0x64 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 48 89 54 24 18 mov %rdx,0x18(%rsp) 12: 48 rex.W 13: 89 .byte 0x89 14: 74 24 je 0x3a [ 1145.104840][ T9172] RSP: 002b:00007fffb8a81de8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1145.105123][ T9172] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007f958da54257 [ 1145.105401][ T9172] RDX: 000000000000000c RSI: 00007fffb8a81ec0 RDI: 0000000000000006 [ 1145.105677][ T9172] RBP: 00007fffb8a81e30 R08: 000000000000000c R09: 0000000000000000 [ 1145.105951][ T9172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 Finger prints: ip6_rt_pcpu_alloc:ip6_pol_route:__fib6_rule_action:fib_rules_lookup:fib6_rule_lookup