====================================== | [ 4495.523579][T31101] ------------[ cut here ]------------ | [ 4495.524127][T31101] rcuref - imbalanced put() | [ 4495.524130][T31101] WARNING: lib/rcuref.c:266 at 0x0, CPU#2: mausezahn/31101 | [ 4495.524945][T31101] Modules linked in: sctp sch_fq cls_matchall xt_conntrack nf_conntrack nf_defrag_ipv4 nft_compat nf_tables nf_defrag_ipv6 cls_bpf act_mirred cls_u32 ifb unix_diag geneve ip6_gre ip_gre gre chacha libchacha chacha20poly1305 libpoly1305 tls act_gact cls_flower sch_ingress vxlan [last unloaded: psample] [ 4495.527297][T31101] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 4495.527706][T31101] RIP: 0010:rcuref_put_slowpath (lib/rcuref.c:266 (discriminator 1)) [ 4495.528123][T31101] Code: 07 83 c0 03 38 d0 7c 04 84 d2 75 69 c7 03 00 00 00 a0 31 c0 eb 8b 4c 89 ef e8 47 03 a0 ff e9 6c ff ff ff 48 8d 3d 0b 05 3d 03 <67> 48 0f b9 3a be 04 00 00 00 48 89 df e8 49 0a a0 ff 48 89 d8 48 All code ======== 0: 07 (bad) 1: 83 c0 03 add $0x3,%eax 4: 38 d0 cmp %dl,%al 6: 7c 04 jl 0xc 8: 84 d2 test %dl,%dl a: 75 69 jne 0x75 c: c7 03 00 00 00 a0 movl $0xa0000000,(%rbx) 12: 31 c0 xor %eax,%eax 14: eb 8b jmp 0xffffffffffffffa1 16: 4c 89 ef mov %r13,%rdi 19: e8 47 03 a0 ff call 0xffffffffffa00365 1e: e9 6c ff ff ff jmp 0xffffffffffffff8f 23: 48 8d 3d 0b 05 3d 03 lea 0x33d050b(%rip),%rdi # 0x33d0535 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: be 04 00 00 00 mov $0x4,%esi 34: 48 89 df mov %rbx,%rdi 37: e8 49 0a a0 ff call 0xffffffffffa00a85 3c: 48 89 d8 mov %rbx,%rax 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 67 48 0f b9 3a ud1 (%edx),%rdi 5: be 04 00 00 00 mov $0x4,%esi a: 48 89 df mov %rbx,%rdi d: e8 49 0a a0 ff call 0xffffffffffa00a5b 12: 48 89 d8 mov %rbx,%rax 15: 48 rex.W [ 4495.529756][T31101] RSP: 0018:ffffc90001e8f240 EFLAGS: 00010206 [ 4495.530221][T31101] RAX: 0000000000000000 RBX: ffff88800ea41a00 RCX: ffffffff83a8bb71 [ 4495.530707][T31101] RDX: ffffed1001d48341 RSI: 00000000dfffffff RDI: ffffffff862bbf20 [ 4495.531201][T31101] RBP: 1ffff920003d1e48 R08: 0000000000000001 R09: ffffed1001d48340 [ 4495.531680][T31101] R10: ffff88800ea41a03 R11: ffff88800affd090 R12: dffffc0000000000 [ 4495.532159][T31101] R13: ffff88800ea41100 R14: ffff88800c4c0a80 R15: 0000000000000000 [ 4495.532647][T31101] FS: 00007f7fad872740(0000) GS:ffff8880e6418000(0000) knlGS:0000000000000000 [ 4495.533217][T31101] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4495.533622][T31101] CR2: 00007f7fad9c90b0 CR3: 0000000012f57006 CR4: 0000000000772ef0 [ 4495.534101][T31101] PKRU: 55555554 [ 4495.534361][T31101] Call Trace: [ 4495.534612][T31101] [ 4495.534793][T31101] ? rcuref_get_slowpath (lib/rcuref.c:238) [ 4495.535130][T31101] dst_release (./include/linux/rcuref.h:117 ./include/linux/rcuref.h:173 net/core/dst.c:167) [ 4495.535476][T31101] rt_cache_route (net/ipv4/route.c:1510) [ 4495.535806][T31101] rt_set_nexthop.constprop.0 (net/ipv4/route.c:1622) [ 4495.536138][T31101] __mkroute_output (./include/net/lwtunnel.h:140 net/ipv4/route.c:2682) [ 4495.536481][T31101] ip_route_output_key_hash (net/ipv4/route.c:2705) [ 4495.536806][T31101] ? ip_route_output_key_hash_rcu (net/ipv4/route.c:2693) [ 4495.537214][T31101] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4495.537542][T31101] ? dst_cache_get_ip4 (./include/linux/local_lock_internal.h:57 net/core/dst_cache.c:98) [ 4495.537873][T31101] ? __lock_release (kernel/locking/lockdep.c:5536) [ 4495.538214][T31101] ip_route_output_flow (net/ipv4/route.c:2934) [ 4495.538542][T31101] udp_tunnel_dst_lookup (net/ipv4/udp_tunnel_core.c:261 net/ipv4/udp_tunnel_core.c:230) [ 4495.538872][T31101] ? udp_tunnel_drop_rx_port (net/ipv4/udp_tunnel_core.c:237) [ 4495.539213][T31101] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4495.539542][T31101] vxlan_xmit_one (drivers/net/vxlan/vxlan_core.c:2472 (discriminator 4)) vxlan [ 4495.539877][T31101] ? __skb_flow_dissect (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/flow_dissector.c:1172) [ 4495.540250][T31101] ? __skb_flow_dissect (net/core/flow_dissector.c:1160 (discriminator 2)) [ 4495.540594][T31101] ? vxlan_fdb_delete (drivers/net/vxlan/vxlan_core.c:2337) vxlan [ 4495.540931][T31101] ? vxlan_find_mac_rcu (./include/linux/rhashtable.h:632 ./include/linux/rhashtable.h:670 drivers/net/vxlan/vxlan_core.c:392) vxlan [ 4495.541355][T31101] ? vxlan_remcsum (drivers/net/vxlan/vxlan_core.c:382) vxlan [ 4495.541698][T31101] ? vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 4495.542035][T31101] vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 4495.542390][T31101] ? vxlan_xmit_nhid (drivers/net/vxlan/vxlan_core.c:2721) vxlan [ 4495.542724][T31101] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 4495.543051][T31101] ? __lock_release (kernel/locking/lockdep.c:5536) [ 4495.543388][T31101] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 4495.543715][T31101] ? dev_queue_xmit_nit (net/core/dev.c:2592) [ 4495.544049][T31101] dev_hard_start_xmit (./include/linux/netdevice.h:5272 ./include/linux/netdevice.h:5281 net/core/dev.c:3853 net/core/dev.c:3869) [ 4495.544391][T31101] __dev_queue_xmit (net/core/dev.h:381 net/core/dev.c:4818) [ 4495.544724][T31101] ? _copy_from_iter (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:67 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 4495.545059][T31101] ? netdev_core_pick_tx (net/core/dev.c:4725) [ 4495.545393][T31101] ? packet_parse_headers (net/packet/af_packet.c:1933) [ 4495.545724][T31101] ? sock_wmalloc (net/core/sock.c:2968) [ 4495.546051][T31101] ? packet_cached_dev_get (net/packet/af_packet.c:1923) [ 4495.546387][T31101] ? skb_copy_datagram_from_iter (net/core/datagram.c:561) [ 4495.546796][T31101] packet_snd (net/packet/af_packet.c:3076) [ 4495.547136][T31101] ? tpacket_snd (net/packet/af_packet.c:2940) [ 4495.547471][T31101] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 4495.547806][T31101] ? __might_fault (mm/memory.c:7129 mm/memory.c:7123) [ 4495.548138][T31101] __sys_sendto (net/socket.c:718 net/socket.c:733 net/socket.c:2222) [ 4495.548477][T31101] ? __ia32_sys_getpeername (net/socket.c:2189) [ 4495.548811][T31101] ? sock_ioctl (net/socket.c:1369) [ 4495.549136][T31101] ? _copy_to_user (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:147 ./include/linux/uaccess.h:206 lib/usercopy.c:26) [ 4495.549474][T31101] ? ns_to_timespec64 (kernel/time/time.c:905) [ 4495.549804][T31101] ? posix_cpu_clock_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/time/posix-cpu-timers.c:375) [ 4495.550188][T31101] ? posix_cpu_clock_get (kernel/time/posix-cpu-timers.c:377) [ 4495.550528][T31101] ? __x64_sys_clock_gettime (kernel/time/posix-timers.c:1146 kernel/time/posix-timers.c:1134 kernel/time/posix-timers.c:1134) [ 4495.550862][T31101] __x64_sys_sendto (net/socket.c:2225) [ 4495.551201][T31101] ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:108 arch/x86/entry/syscall_64.c:90) [ 4495.551531][T31101] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4495.551856][T31101] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 4495.552199][T31101] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) [ 4495.552600][T31101] RIP: 0033:0x7f7fada8e27a [ 4495.552943][T31101] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 All code ======== 0: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 4: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax b: eb b8 jmp 0xffffffffffffffc5 d: 0f 1f 00 nopl (%rax) 10: f3 0f 1e fa endbr64 14: 41 89 ca mov %ecx,%r10d 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 15 jne 0x38 23: b8 2c 00 00 00 mov $0x2c,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 7e ja 0xb0 32: c3 ret 33: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 38: 41 54 push %r12 3a: 48 83 ec 30 sub $0x30,%rsp 3e: 44 rex.R 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 7e ja 0x86 8: c3 ret 9: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) e: 41 54 push %r12 10: 48 83 ec 30 sub $0x30,%rsp 14: 44 rex.R 15: 89 .byte 0x89 [ 4495.554062][T31101] RSP: 002b:00007ffda87c3ba8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 4495.554555][T31101] RAX: ffffffffffffffda RBX: 000000002fb429d0 RCX: 00007f7fada8e27a [ 4495.555036][T31101] RDX: 0000000000000064 RSI: 000000002fb425c2 RDI: 0000000000000005 [ 4495.555521][T31101] RBP: 000000002fb425c2 R08: 00007ffda87c3bb0 R09: 0000000000000014 [ 4495.555998][T31101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 4495.556490][T31101] R13: 0000000000000064 R14: 00007ffda87c3bb0 R15: 0000000000000000 | [ 4496.266965][ C1] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146) | [ 4496.267262][ C1] Read of size 8 at addr ffff88800ea410c0 by task kworker/1:0/19389 | [ 4496.267550][ C1] | [ 4496.267656][ C1] Tainted: [W]=WARN [ 4496.267657][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 4496.267660][ C1] Workqueue: events virtio_fs_requests_done_work [ 4496.267669][ C1] Call Trace: [ 4496.267671][ C1] [ 4496.267673][ C1] dump_stack_lvl (lib/dump_stack.c:123) [ 4496.267681][ C1] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 4496.267689][ C1] ? dst_dev_put (net/core/dst.c:146) [ 4496.267693][ C1] print_report (mm/kasan/report.c:483) [ 4496.267696][ C1] ? dst_dev_put (net/core/dst.c:146) [ 4496.267699][ C1] ? kasan_addr_to_slab (mm/kasan/../slab.h:178 mm/kasan/common.c:47) [ 4496.267703][ C1] ? dst_dev_put (net/core/dst.c:146) [ 4496.267706][ C1] kasan_report (mm/kasan/report.c:597) [ 4496.267710][ C1] ? dst_dev_put (net/core/dst.c:146) [ 4496.267715][ C1] dst_dev_put (net/core/dst.c:146) [ 4496.267719][ C1] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 4496.267727][ C1] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 4496.267731][ C1] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 4496.267735][ C1] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 4496.267739][ C1] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 4496.267746][ C1] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 4496.267749][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.267754][ C1] ? note_gp_changes (kernel/rcu/tree.c:1332 (discriminator 1)) [ 4496.267757][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.267765][ C1] rcu_core (kernel/rcu/tree.c:2859) [ 4496.267769][ C1] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 4496.267777][ C1] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 4496.267780][ C1] irq_exit_rcu (kernel/softirq.c:741) [ 4496.267783][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 4496.267787][ C1] [ 4496.267788][ C1] [ 4496.267789][ C1] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 4496.267794][ C1] RIP: 0010:lock_acquire.part.0 (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:114 ./arch/x86/include/asm/irqflags.h:128 kernel/locking/lockdep.c:5864) [ 4496.267797][ C1] Code: 00 00 00 65 8b 05 11 cb b5 04 85 c0 0f 85 b8 00 00 00 65 48 8b 05 11 86 b5 04 8b 90 4c 0a 00 00 85 d2 0f 85 a2 00 00 00 9c 5b 48 c7 c7 69 d9 e2 84 e8 94 ad 25 02 41 89 e8 44 89 e1 44 89 ea All code ======== 0: 00 00 add %al,(%rax) 2: 00 65 8b add %ah,-0x75(%rbp) 5: 05 11 cb b5 04 add $0x4b5cb11,%eax a: 85 c0 test %eax,%eax c: 0f 85 b8 00 00 00 jne 0xca 12: 65 48 8b 05 11 86 b5 mov %gs:0x4b58611(%rip),%rax # 0x4b5862b 19: 04 1a: 8b 90 4c 0a 00 00 mov 0xa4c(%rax),%edx 20: 85 d2 test %edx,%edx 22: 0f 85 a2 00 00 00 jne 0xca 28: 9c pushf 29: 5b pop %rbx 2a:* fa cli <-- trapping instruction 2b: 48 c7 c7 69 d9 e2 84 mov $0xffffffff84e2d969,%rdi 32: e8 94 ad 25 02 call 0x225adcb 37: 41 89 e8 mov %ebp,%r8d 3a: 44 89 e1 mov %r12d,%ecx 3d: 44 89 ea mov %r13d,%edx Code starting with the faulting instruction =========================================== 0: fa cli 1: 48 c7 c7 69 d9 e2 84 mov $0xffffffff84e2d969,%rdi 8: e8 94 ad 25 02 call 0x225ada1 d: 41 89 e8 mov %ebp,%r8d 10: 44 89 e1 mov %r12d,%ecx 13: 44 89 ea mov %r13d,%edx [ 4496.267800][ C1] RSP: 0018:ffffc90000a374c8 EFLAGS: 00000246 [ 4496.267804][ C1] RAX: ffff888005c62340 RBX: 0000000000000246 RCX: 0000000000000001 [ 4496.267806][ C1] RDX: 0000000000000000 RSI: ffffffff81ff20a7 RDI: fffffbfff0b2ffc4 [ 4496.267808][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 4496.267809][ C1] R10: ffffffff81ff2093 R11: ffffc90000a37680 R12: 0000000000000002 [ 4496.267811][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff8597fe20 [ 4496.267814][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:867 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.267821][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:868 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.267826][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.267831][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.267835][ C1] unwind_next_frame (./include/linux/rcupdate.h:868 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.267837][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:867 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.267840][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.267846][ C1] ? stack_access_ok (arch/x86/kernel/unwind_orc.c:469) [ 4496.267849][ C1] ? stack_access_ok (arch/x86/kernel/unwind_orc.c:469) [ 4496.267853][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.267855][ C1] ? kernel_text_address (kernel/extable.c:99) [ 4496.267860][ C1] ? write_profile (kernel/stacktrace.c:83) [ 4496.267864][ C1] arch_stack_walk (arch/x86/kernel/stacktrace.c:24) [ 4496.267869][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.267873][ C1] stack_trace_save (kernel/stacktrace.c:123) [ 4496.267876][ C1] ? stack_trace_snprint (kernel/stacktrace.c:114) [ 4496.267879][ C1] ? validate_chain (kernel/locking/lockdep.c:3801 kernel/locking/lockdep.c:3821 kernel/locking/lockdep.c:3876) [ 4496.267883][ C1] kasan_save_stack (mm/kasan/common.c:57) [ 4496.267886][ C1] ? kasan_save_stack (mm/kasan/common.c:57) [ 4496.267889][ C1] ? kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:69 mm/kasan/common.c:78) [ 4496.267892][ C1] ? __kasan_save_free_info (mm/kasan/generic.c:590) [ 4496.267894][ C1] ? __kasan_slab_free (mm/kasan/common.c:286) [ 4496.267897][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.267902][ C1] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 4496.267910][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.267913][ C1] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 4496.267919][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.267923][ C1] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 4496.267927][ C1] ? __debug_check_no_obj_freed (lib/debugobjects.c:1110) [ 4496.267934][ C1] ? debug_objects_fill_pool (lib/debugobjects.c:1070) [ 4496.267936][ C1] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:54) [ 4496.267941][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.267944][ C1] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3144) [ 4496.267947][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.267951][ C1] kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:69 mm/kasan/common.c:78) [ 4496.267954][ C1] __kasan_save_free_info (mm/kasan/generic.c:590) [ 4496.267956][ C1] __kasan_slab_free (mm/kasan/common.c:286) [ 4496.267960][ C1] kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.267963][ C1] ? detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.267969][ C1] ? detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.267971][ C1] detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.267976][ C1] virtqueue_get_buf_ctx_split (drivers/virtio/virtio_ring.c:858) [ 4496.267981][ C1] virtio_fs_requests_done_work (fs/fuse/virtio_fs.c:826) [ 4496.267985][ C1] ? virtio_fs_complete_req_work (fs/fuse/virtio_fs.c:811) [ 4496.267990][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.267993][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.267997][ C1] process_one_work (kernel/workqueue.c:3262) [ 4496.268005][ C1] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3159) [ 4496.268011][ C1] ? assign_work (kernel/workqueue.c:1200) [ 4496.268015][ C1] worker_thread (kernel/workqueue.c:3334 kernel/workqueue.c:3421) [ 4496.268021][ C1] ? bh_worker (kernel/workqueue.c:3367) [ 4496.268025][ C1] kthread (kernel/kthread.c:463) [ 4496.268029][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.268032][ C1] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 4496.268035][ C1] ? __lock_release (kernel/locking/lockdep.c:5536) [ 4496.268038][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.268041][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.268044][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.268048][ C1] ret_from_fork (arch/x86/kernel/process.c:164) [ 4496.268051][ C1] ? arch_exit_to_user_mode_prepare.constprop.0 (arch/x86/entry/syscall_64.c:37) [ 4496.268054][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.268057][ C1] ? __switch_to (./include/linux/thread_info.h:140 arch/x86/kernel/process.h:16 arch/x86/kernel/process_64.c:676) [ 4496.268062][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.268065][ C1] ret_from_fork_asm (arch/x86/entry/entry_64.S:256) | [ 4496.310979][ C1] Disabling lock debugging due to kernel taint | [ 4496.311230][ C1] Oops: general protection fault, probably for non-canonical address 0xe0b73c4ba0000008: 0000 [#1] SMP KASAN | [ 4496.311748][ C1] KASAN: maybe wild-memory-access in range [0x05ba025d00000040-0x05ba025d00000047] | [ 4496.312588][ C1] Tainted: [B]=BAD_PAGE, [W]=WARN [ 4496.312770][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 4496.312994][ C1] Workqueue: events virtio_fs_requests_done_work [ 4496.313235][ C1] RIP: 0010:dst_dev_put (net/core/dst.c:149) [ 4496.313424][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 All code ======== 0: fc cld 1: ff lcall (bad) 2: df 48 c1 fisttps -0x3f(%rax) 5: ea (bad) 6: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax c: 85 9c 01 00 00 48 b8 test %ebx,-0x47b80000(%rcx,%rax,1) 13: 00 00 add %al,(%rax) 15: 00 00 add %al,(%rax) 17: 00 fc add %bh,%ah 19: ff lcall (bad) 1a: df 49 8b fisttps -0x75(%rcx) 1d: 6d insl (%dx),%es:(%rdi) 1e: 08 48 8d or %cl,-0x73(%rax) 21: 7d 38 jge 0x5b 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 6f 01 00 00 jne 0x1a3 34: 48 8b 45 38 mov 0x38(%rbp),%rax 38: 48 85 c0 test %rax,%rax 3b: 74 08 je 0x45 3d: 4c 89 e6 mov %r12,%rsi Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 6f 01 00 00 jne 0x179 a: 48 8b 45 38 mov 0x38(%rbp),%rax e: 48 85 c0 test %rax,%rax 11: 74 08 je 0x1b 13: 4c 89 e6 mov %r12,%rsi [ 4496.314183][ C1] RSP: 0018:ffffc900001c0d48 EFLAGS: 00010203 [ 4496.314411][ C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff83a8b398 [ 4496.314684][ C1] RDX: 00b7404ba0000008 RSI: 0000000000000008 RDI: 05ba025d00000044 [ 4496.315072][ C1] RBP: 05ba025d0000000c R08: 0000000000000001 R09: fffffbfff0daa8c4 [ 4496.315343][ C1] R10: ffffffff86d54627 R11: ffffc900001c0800 R12: ffff8880154a7868 [ 4496.315733][ C1] R13: ffff88800ea410c0 R14: 0000000000000002 R15: ffff88800ea410c0 [ 4496.316009][ C1] FS: 0000000000000000(0000) GS:ffff8880e6398000(0000) knlGS:0000000000000000 [ 4496.316321][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4496.316666][ C1] CR2: 000055ae0f40e1b0 CR3: 0000000063745005 CR4: 0000000000772ef0 [ 4496.316937][ C1] PKRU: 55555554 [ 4496.317075][ C1] Call Trace: [ 4496.317214][ C1] [ 4496.317428][ C1] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 4496.317618][ C1] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 4496.317797][ C1] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 4496.317979][ C1] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 4496.318324][ C1] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 4496.318507][ C1] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 4496.318688][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.318873][ C1] ? note_gp_changes (kernel/rcu/tree.c:1332 (discriminator 1)) [ 4496.319164][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.319347][ C1] rcu_core (kernel/rcu/tree.c:2859) [ 4496.319483][ C1] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 4496.319667][ C1] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 4496.319961][ C1] irq_exit_rcu (kernel/softirq.c:741) [ 4496.320105][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 4496.320284][ C1] [ 4496.320382][ C1] [ 4496.320473][ C1] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 4496.320814][ C1] RIP: 0010:lock_acquire.part.0 (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:114 ./arch/x86/include/asm/irqflags.h:128 kernel/locking/lockdep.c:5864) [ 4496.321047][ C1] Code: 00 00 00 65 8b 05 11 cb b5 04 85 c0 0f 85 b8 00 00 00 65 48 8b 05 11 86 b5 04 8b 90 4c 0a 00 00 85 d2 0f 85 a2 00 00 00 9c 5b 48 c7 c7 69 d9 e2 84 e8 94 ad 25 02 41 89 e8 44 89 e1 44 89 ea All code ======== 0: 00 00 add %al,(%rax) 2: 00 65 8b add %ah,-0x75(%rbp) 5: 05 11 cb b5 04 add $0x4b5cb11,%eax a: 85 c0 test %eax,%eax c: 0f 85 b8 00 00 00 jne 0xca 12: 65 48 8b 05 11 86 b5 mov %gs:0x4b58611(%rip),%rax # 0x4b5862b 19: 04 1a: 8b 90 4c 0a 00 00 mov 0xa4c(%rax),%edx 20: 85 d2 test %edx,%edx 22: 0f 85 a2 00 00 00 jne 0xca 28: 9c pushf 29: 5b pop %rbx 2a:* fa cli <-- trapping instruction 2b: 48 c7 c7 69 d9 e2 84 mov $0xffffffff84e2d969,%rdi 32: e8 94 ad 25 02 call 0x225adcb 37: 41 89 e8 mov %ebp,%r8d 3a: 44 89 e1 mov %r12d,%ecx 3d: 44 89 ea mov %r13d,%edx Code starting with the faulting instruction =========================================== 0: fa cli 1: 48 c7 c7 69 d9 e2 84 mov $0xffffffff84e2d969,%rdi 8: e8 94 ad 25 02 call 0x225ada1 d: 41 89 e8 mov %ebp,%r8d 10: 44 89 e1 mov %r12d,%ecx 13: 44 89 ea mov %r13d,%edx [ 4496.321809][ C1] RSP: 0018:ffffc90000a374c8 EFLAGS: 00000246 [ 4496.322036][ C1] RAX: ffff888005c62340 RBX: 0000000000000246 RCX: 0000000000000001 [ 4496.322306][ C1] RDX: 0000000000000000 RSI: ffffffff81ff20a7 RDI: fffffbfff0b2ffc4 [ 4496.322701][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 4496.322970][ C1] R10: ffffffff81ff2093 R11: ffffc90000a37680 R12: 0000000000000002 [ 4496.323361][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff8597fe20 [ 4496.323634][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:867 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.323818][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:868 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.323998][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.324296][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.324475][ C1] unwind_next_frame (./include/linux/rcupdate.h:868 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.324660][ C1] ? unwind_next_frame (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:867 ./include/linux/rcupdate.h:1195 arch/x86/kernel/unwind_orc.c:479) [ 4496.324839][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.325092][ C1] ? stack_access_ok (arch/x86/kernel/unwind_orc.c:469) [ 4496.325274][ C1] ? stack_access_ok (arch/x86/kernel/unwind_orc.c:469) [ 4496.325453][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.325592][ C1] ? kernel_text_address (kernel/extable.c:99) [ 4496.325888][ C1] ? write_profile (kernel/stacktrace.c:83) [ 4496.326071][ C1] arch_stack_walk (arch/x86/kernel/stacktrace.c:24) [ 4496.326261][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.326401][ C1] stack_trace_save (kernel/stacktrace.c:123) [ 4496.326582][ C1] ? stack_trace_snprint (kernel/stacktrace.c:114) [ 4496.326879][ C1] ? validate_chain (kernel/locking/lockdep.c:3801 kernel/locking/lockdep.c:3821 kernel/locking/lockdep.c:3876) [ 4496.327060][ C1] kasan_save_stack (mm/kasan/common.c:57) [ 4496.327243][ C1] ? kasan_save_stack (mm/kasan/common.c:57) [ 4496.327421][ C1] ? kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:69 mm/kasan/common.c:78) [ 4496.327715][ C1] ? __kasan_save_free_info (mm/kasan/generic.c:590) [ 4496.327898][ C1] ? __kasan_slab_free (mm/kasan/common.c:286) [ 4496.328081][ C1] ? kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.328219][ C1] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 4496.328517][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.328696][ C1] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 4496.328923][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.329103][ C1] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 4496.329447][ C1] ? __debug_check_no_obj_freed (lib/debugobjects.c:1110) [ 4496.329675][ C1] ? debug_objects_fill_pool (lib/debugobjects.c:1070) [ 4496.329853][ C1] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:54) [ 4496.330154][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 4496.330332][ C1] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3144) [ 4496.330555][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 4496.330739][ C1] kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:69 mm/kasan/common.c:78) [ 4496.331039][ C1] __kasan_save_free_info (mm/kasan/generic.c:590) [ 4496.331221][ C1] __kasan_slab_free (mm/kasan/common.c:286) [ 4496.331401][ C1] kfree (mm/slub.c:6663 mm/slub.c:6871) [ 4496.331536][ C1] ? detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.331834][ C1] ? detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.332016][ C1] detach_buf_split (drivers/virtio/virtio_ring.c:803) [ 4496.332198][ C1] virtqueue_get_buf_ctx_split (drivers/virtio/virtio_ring.c:858) [ 4496.332425][ C1] virtio_fs_requests_done_work (fs/fuse/virtio_fs.c:826) [ 4496.332762][ C1] ? virtio_fs_complete_req_work (fs/fuse/virtio_fs.c:811) [ 4496.332985][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.333164][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.333459][ C1] process_one_work (kernel/workqueue.c:3262) [ 4496.333648][ C1] ? pwq_dec_nr_in_flight (kernel/workqueue.c:3159) [ 4496.333829][ C1] ? assign_work (kernel/workqueue.c:1200) [ 4496.334017][ C1] worker_thread (kernel/workqueue.c:3334 kernel/workqueue.c:3421) [ 4496.334200][ C1] ? bh_worker (kernel/workqueue.c:3367) [ 4496.334382][ C1] kthread (kernel/kthread.c:463) [ 4496.334519][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.334699][ C1] ? ret_from_fork (arch/x86/kernel/process.c:157) [ 4496.334878][ C1] ? __lock_release (kernel/locking/lockdep.c:5536) [ 4496.335173][ C1] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831) [ 4496.335352][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 4496.335533][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.335719][ C1] ret_from_fork (arch/x86/kernel/process.c:164) [ 4496.336016][ C1] ? arch_exit_to_user_mode_prepare.constprop.0 (arch/x86/entry/syscall_64.c:37) [ 4496.336286][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) [ 4496.336472][ C1] ? __switch_to (./include/linux/thread_info.h:140 arch/x86/kernel/process.h:16 arch/x86/kernel/process_64.c:676) [ 4496.336767][ C1] ? kthread_is_per_cpu (kernel/kthread.c:412) Finger prints: print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core rcuref_put_slowpath:dst_release:rt_cache_route:__mkroute_output:ip_route_output_key_hash