====================================== | [ 2839.250910][T24860] ------------[ cut here ]------------ | [ 2839.251372][T24860] rcuref - imbalanced put() | [ 2839.251375][T24860] WARNING: lib/rcuref.c:266 at 0x0, CPU#3: mausezahn/24860 | [ 2839.252565][T24860] Modules linked in: act_gact sch_ingress xfrm_user openvswitch psample nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nsh geneve vxlan act_csum act_pedit cls_flower sch_prio [ 2839.254198][T24860] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2839.254583][T24860] RIP: 0010:rcuref_put_slowpath (lib/rcuref.c:266 (discriminator 1)) [ 2839.254987][T24860] Code: 07 83 c0 03 38 d0 7c 04 84 d2 75 69 c7 03 00 00 00 a0 31 c0 eb 8b 4c 89 ef e8 47 03 a0 ff e9 6c ff ff ff 48 8d 3d 0b 05 3d 03 <67> 48 0f b9 3a be 04 00 00 00 48 89 df e8 49 0a a0 ff 48 89 d8 48 All code ======== 0: 07 (bad) 1: 83 c0 03 add $0x3,%eax 4: 38 d0 cmp %dl,%al 6: 7c 04 jl 0xc 8: 84 d2 test %dl,%dl a: 75 69 jne 0x75 c: c7 03 00 00 00 a0 movl $0xa0000000,(%rbx) 12: 31 c0 xor %eax,%eax 14: eb 8b jmp 0xffffffffffffffa1 16: 4c 89 ef mov %r13,%rdi 19: e8 47 03 a0 ff call 0xffffffffffa00365 1e: e9 6c ff ff ff jmp 0xffffffffffffff8f 23: 48 8d 3d 0b 05 3d 03 lea 0x33d050b(%rip),%rdi # 0x33d0535 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: be 04 00 00 00 mov $0x4,%esi 34: 48 89 df mov %rbx,%rdi 37: e8 49 0a a0 ff call 0xffffffffffa00a85 3c: 48 89 d8 mov %rbx,%rax 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 67 48 0f b9 3a ud1 (%edx),%rdi 5: be 04 00 00 00 mov $0x4,%esi a: 48 89 df mov %rbx,%rdi d: e8 49 0a a0 ff call 0xffffffffffa00a5b 12: 48 89 d8 mov %rbx,%rax 15: 48 rex.W [ 2839.256087][T24860] RSP: 0018:ffffc90000457240 EFLAGS: 00010206 [ 2839.256472][T24860] RAX: 0000000000000000 RBX: ffff88800addf880 RCX: ffffffffbba8bb71 [ 2839.256940][T24860] RDX: ffffed10015bbf11 RSI: 00000000dfffffff RDI: ffffffffbe2bbf20 [ 2839.257403][T24860] RBP: 1ffff9200008ae48 R08: 0000000000000001 R09: ffffed10015bbf10 [ 2839.257857][T24860] R10: ffff88800addf883 R11: ffff88800a5e8a90 R12: dffffc0000000000 [ 2839.258324][T24860] R13: ffff88800addfd00 R14: ffff8880090df480 R15: 0000000000000000 [ 2839.258802][T24860] FS: 00007f8582ed3740(0000) GS:ffff8880ae498000(0000) knlGS:0000000000000000 [ 2839.259347][T24860] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2839.259730][T24860] CR2: 00007f858302a0b0 CR3: 0000000016754004 CR4: 0000000000772ef0 [ 2839.260195][T24860] PKRU: 55555554 [ 2839.260424][T24860] Call Trace: [ 2839.260651][T24860] [ 2839.260806][T24860] ? rcuref_get_slowpath (lib/rcuref.c:238) [ 2839.261130][T24860] dst_release (./include/linux/rcuref.h:117 ./include/linux/rcuref.h:173 net/core/dst.c:167) [ 2839.261437][T24860] rt_cache_route (net/ipv4/route.c:1510) [ 2839.261742][T24860] rt_set_nexthop.constprop.0 (net/ipv4/route.c:1622) [ 2839.262060][T24860] __mkroute_output (./include/net/lwtunnel.h:140 net/ipv4/route.c:2682) [ 2839.262374][T24860] ip_route_output_key_hash (net/ipv4/route.c:2705) [ 2839.262678][T24860] ? ip_route_output_key_hash_rcu (net/ipv4/route.c:2693) [ 2839.263065][T24860] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 2839.263371][T24860] ? dst_cache_get_ip4 (./include/linux/local_lock_internal.h:57 net/core/dst_cache.c:98) [ 2839.263671][T24860] ? __lock_release (kernel/locking/lockdep.c:5536) [ 2839.263998][T24860] ip_route_output_flow (net/ipv4/route.c:2934) [ 2839.264306][T24860] udp_tunnel_dst_lookup (net/ipv4/udp_tunnel_core.c:261 net/ipv4/udp_tunnel_core.c:230) [ 2839.264611][T24860] ? udp_tunnel_drop_rx_port (net/ipv4/udp_tunnel_core.c:237) [ 2839.264920][T24860] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 2839.265237][T24860] vxlan_xmit_one (drivers/net/vxlan/vxlan_core.c:2472 (discriminator 4)) vxlan [ 2839.265553][T24860] ? __skb_flow_dissect (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/flow_dissector.c:1172) [ 2839.265857][T24860] ? __skb_flow_dissect (net/core/flow_dissector.c:1160 (discriminator 2)) [ 2839.266185][T24860] ? vxlan_fdb_delete (drivers/net/vxlan/vxlan_core.c:2337) vxlan [ 2839.266502][T24860] ? vxlan_find_mac_rcu (./include/linux/rhashtable.h:632 ./include/linux/rhashtable.h:670 drivers/net/vxlan/vxlan_core.c:392) vxlan [ 2839.266902][T24860] ? vxlan_remcsum (drivers/net/vxlan/vxlan_core.c:382) vxlan [ 2839.267228][T24860] ? vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 2839.267538][T24860] vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 2839.267857][T24860] ? vxlan_xmit_nhid (drivers/net/vxlan/vxlan_core.c:2721) vxlan [ 2839.268179][T24860] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 2839.268484][T24860] ? __lock_release (kernel/locking/lockdep.c:5536) [ 2839.268794][T24860] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 2839.269105][T24860] ? dev_queue_xmit_nit (net/core/dev.c:2592) [ 2839.269414][T24860] dev_hard_start_xmit (./include/linux/netdevice.h:5272 ./include/linux/netdevice.h:5281 net/core/dev.c:3853 net/core/dev.c:3869) [ 2839.269720][T24860] __dev_queue_xmit (net/core/dev.h:381 net/core/dev.c:4818) [ 2839.270027][T24860] ? _copy_from_iter (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:67 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 2839.270338][T24860] ? netdev_core_pick_tx (net/core/dev.c:4725) [ 2839.270637][T24860] ? packet_parse_headers (net/packet/af_packet.c:1933) [ 2839.270955][T24860] ? sock_wmalloc (net/core/sock.c:2968) [ 2839.271263][T24860] ? packet_cached_dev_get (net/packet/af_packet.c:1923) [ 2839.271563][T24860] ? skb_copy_datagram_from_iter (net/core/datagram.c:561) [ 2839.271953][T24860] packet_snd (net/packet/af_packet.c:3076) [ 2839.272267][T24860] ? tpacket_snd (net/packet/af_packet.c:2940) [ 2839.272568][T24860] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 2839.272876][T24860] ? __might_fault (mm/memory.c:7129 mm/memory.c:7123) [ 2839.273193][T24860] __sys_sendto (net/socket.c:718 net/socket.c:733 net/socket.c:2222) [ 2839.273494][T24860] ? __ia32_sys_getpeername (net/socket.c:2189) [ 2839.273804][T24860] ? sock_ioctl (net/socket.c:1369) [ 2839.274113][T24860] ? _copy_to_user (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:147 ./include/linux/uaccess.h:206 lib/usercopy.c:26) [ 2839.274417][T24860] ? ns_to_timespec64 (kernel/time/time.c:905) [ 2839.274716][T24860] ? posix_cpu_clock_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/time/posix-cpu-timers.c:375) [ 2839.275029][T24860] ? posix_cpu_clock_get (kernel/time/posix-cpu-timers.c:377) [ 2839.275333][T24860] ? __x64_sys_clock_gettime (kernel/time/posix-timers.c:1146 kernel/time/posix-timers.c:1134 kernel/time/posix-timers.c:1134) [ 2839.275643][T24860] __x64_sys_sendto (net/socket.c:2225) [ 2839.275949][T24860] ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:108 arch/x86/entry/syscall_64.c:90) [ 2839.276257][T24860] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 2839.276559][T24860] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 2839.276871][T24860] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) [ 2839.277255][T24860] RIP: 0033:0x7f85830ef27a [ 2839.277571][T24860] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 All code ======== 0: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 4: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax b: eb b8 jmp 0xffffffffffffffc5 d: 0f 1f 00 nopl (%rax) 10: f3 0f 1e fa endbr64 14: 41 89 ca mov %ecx,%r10d 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 15 jne 0x38 23: b8 2c 00 00 00 mov $0x2c,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 7e ja 0xb0 32: c3 ret 33: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 38: 41 54 push %r12 3a: 48 83 ec 30 sub $0x30,%rsp 3e: 44 rex.R 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 7e ja 0x86 8: c3 ret 9: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) e: 41 54 push %r12 10: 48 83 ec 30 sub $0x30,%rsp 14: 44 rex.R 15: 89 .byte 0x89 [ 2839.278664][T24860] RSP: 002b:00007ffc48f28708 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 2839.279132][T24860] RAX: ffffffffffffffda RBX: 00000000017a59d0 RCX: 00007f85830ef27a [ 2839.279587][T24860] RDX: 0000000000000064 RSI: 00000000017a55c2 RDI: 0000000000000005 [ 2839.280056][T24860] RBP: 00000000017a55c2 R08: 00007ffc48f28710 R09: 0000000000000014 [ 2839.280511][T24860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2839.280973][T24860] R13: 0000000000000064 R14: 00007ffc48f28710 R15: 0000000000000000 | [ 2840.819599][ C1] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146) | [ 2840.819927][ C1] Read of size 8 at addr ffff88800addf540 by task swapper/1/0 | [ 2840.820241][ C1] | [ 2840.820359][ C1] Tainted: [W]=WARN [ 2840.820360][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2840.820362][ C1] Call Trace: [ 2840.820364][ C1] [ 2840.820366][ C1] dump_stack_lvl (lib/dump_stack.c:123) [ 2840.820373][ C1] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 2840.820379][ C1] ? dst_dev_put (net/core/dst.c:146) [ 2840.820383][ C1] print_report (mm/kasan/report.c:483) [ 2840.820387][ C1] ? dst_dev_put (net/core/dst.c:146) [ 2840.820390][ C1] ? kasan_addr_to_slab (mm/kasan/../slab.h:178 mm/kasan/common.c:47) [ 2840.820393][ C1] ? dst_dev_put (net/core/dst.c:146) [ 2840.820396][ C1] kasan_report (mm/kasan/report.c:597) [ 2840.820400][ C1] ? dst_dev_put (net/core/dst.c:146) [ 2840.820406][ C1] dst_dev_put (net/core/dst.c:146) [ 2840.820409][ C1] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 2840.820415][ C1] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 2840.820419][ C1] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 2840.820423][ C1] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 2840.820427][ C1] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 2840.820433][ C1] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 2840.820436][ C1] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 2840.820442][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 2840.820446][ C1] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 2840.820451][ C1] rcu_core (kernel/rcu/tree.c:2859) [ 2840.820455][ C1] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 2840.820462][ C1] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 2840.820465][ C1] irq_exit_rcu (kernel/softirq.c:741) [ 2840.820468][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 2840.820472][ C1] [ 2840.820473][ C1] [ 2840.820474][ C1] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 2840.820478][ C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82) [ 2840.820482][ C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 All code ======== 0: 48 8b 3d 34 31 90 02 mov 0x2903134(%rip),%rdi # 0x290313b 7: e8 1f 00 00 00 call 0x2b c: 48 2b 05 28 07 a9 00 sub 0xa90728(%rip),%rax # 0xa9073b 13: c3 ret 14: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d d3 d6 28 00 verw 0x28d6d3(%rip) # 0x28d6fb 28: fb sti 29: f4 hlt 2a:* c3 ret <-- trapping instruction 2b: 0f 1f 40 d6 nopl -0x2a(%rax) 2f: 41 54 push %r12 31: 55 push %rbp 32: 53 push %rbx 33: 48 89 fb mov %rdi,%rbx 36: 48 83 ec 10 sub $0x10,%rsp 3a: 8b 17 mov (%rdi),%edx 3c: 83 e2 fe and $0xfffffffe,%edx 3f: 41 rex.B Code starting with the faulting instruction =========================================== 0: c3 ret 1: 0f 1f 40 d6 nopl -0x2a(%rax) 5: 41 54 push %r12 7: 55 push %rbp 8: 53 push %rbx 9: 48 89 fb mov %rdi,%rbx c: 48 83 ec 10 sub $0x10,%rsp 10: 8b 17 mov (%rdi),%edx 12: 83 e2 fe and $0xfffffffe,%edx 15: 41 rex.B [ 2840.820485][ C1] RSP: 0018:ffffc90000137dd8 EFLAGS: 00000202 [ 2840.820488][ C1] RAX: 0000000007463589 RBX: 1ffff92000026fbf RCX: ffffffffbc40a255 [ 2840.820491][ C1] RDX: 0000000000000000 RSI: ffffffffbcdfa925 RDI: ffffffffbc86a600 [ 2840.820492][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a [ 2840.820494][ C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000 [ 2840.820496][ C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000 [ 2840.820500][ C1] ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146) [ 2840.820504][ C1] default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767) [ 2840.820506][ C1] default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123) [ 2840.820508][ C1] cpuidle_idle_call (kernel/sched/idle.c:192) [ 2840.820513][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 2840.820516][ C1] ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60) [ 2840.820522][ C1] do_idle (kernel/sched/idle.c:332) [ 2840.820525][ C1] cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1)) [ 2840.820528][ C1] start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280) [ 2840.820531][ C1] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230) [ 2840.820536][ C1] common_startup_64 (arch/x86/kernel/head_64.S:419) | [ 2840.849980][ C1] Disabling lock debugging due to kernel taint | [ 2840.850252][ C1] Oops: general protection fault, probably for non-canonical address 0xe0747c3720000008: 0000 [#1] SMP KASAN | [ 2840.850699][ C1] KASAN: maybe wild-memory-access in range [0x03a401b900000040-0x03a401b900000047] | [ 2840.851455][ C1] Tainted: [B]=BAD_PAGE, [W]=WARN [ 2840.851659][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2840.851911][ C1] RIP: 0010:dst_dev_put (net/core/dst.c:149) [ 2840.852126][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 All code ======== 0: fc cld 1: ff lcall (bad) 2: df 48 c1 fisttps -0x3f(%rax) 5: ea (bad) 6: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax c: 85 9c 01 00 00 48 b8 test %ebx,-0x47b80000(%rcx,%rax,1) 13: 00 00 add %al,(%rax) 15: 00 00 add %al,(%rax) 17: 00 fc add %bh,%ah 19: ff lcall (bad) 1a: df 49 8b fisttps -0x75(%rcx) 1d: 6d insl (%dx),%es:(%rdi) 1e: 08 48 8d or %cl,-0x73(%rax) 21: 7d 38 jge 0x5b 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 6f 01 00 00 jne 0x1a3 34: 48 8b 45 38 mov 0x38(%rbp),%rax 38: 48 85 c0 test %rax,%rax 3b: 74 08 je 0x45 3d: 4c 89 e6 mov %r12,%rsi Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 6f 01 00 00 jne 0x179 a: 48 8b 45 38 mov 0x38(%rbp),%rax e: 48 85 c0 test %rax,%rax 11: 74 08 je 0x1b 13: 4c 89 e6 mov %r12,%rsi [ 2840.852836][ C1] RSP: 0018:ffffc900001c0d48 EFLAGS: 00010203 [ 2840.853092][ C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffbba8b398 [ 2840.853502][ C1] RDX: 0074803720000008 RSI: 0000000000000008 RDI: 03a401b900000044 [ 2840.853806][ C1] RBP: 03a401b90000000c R08: 0000000000000001 R09: fffffbfff7daa8c4 [ 2840.854108][ C1] R10: ffffffffbed54627 R11: ffffc900001c0800 R12: ffff88800b857730 [ 2840.854513][ C1] R13: ffff88800addf540 R14: 0000000000000002 R15: ffff88800addf540 [ 2840.854813][ C1] FS: 0000000000000000(0000) GS:ffff8880ae398000(0000) knlGS:0000000000000000 [ 2840.855266][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2840.855520][ C1] CR2: 000055f434ac81b0 CR3: 0000000052b45004 CR4: 0000000000772ef0 [ 2840.855823][ C1] PKRU: 55555554 [ 2840.855975][ C1] Call Trace: [ 2840.856229][ C1] [ 2840.856333][ C1] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 2840.856544][ C1] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 2840.856754][ C1] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 2840.856958][ C1] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 2840.857210][ C1] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 2840.857414][ C1] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 2840.857615][ C1] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 2840.857967][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 2840.858173][ C1] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 2840.858424][ C1] rcu_core (kernel/rcu/tree.c:2859) [ 2840.858576][ C1] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 2840.858881][ C1] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 2840.859084][ C1] irq_exit_rcu (kernel/softirq.c:741) [ 2840.859237][ C1] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 2840.859437][ C1] [ 2840.859543][ C1] [ 2840.859745][ C1] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 2840.859993][ C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82) [ 2840.860202][ C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 All code ======== 0: 48 8b 3d 34 31 90 02 mov 0x2903134(%rip),%rdi # 0x290313b 7: e8 1f 00 00 00 call 0x2b c: 48 2b 05 28 07 a9 00 sub 0xa90728(%rip),%rax # 0xa9073b 13: c3 ret 14: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d d3 d6 28 00 verw 0x28d6d3(%rip) # 0x28d6fb 28: fb sti 29: f4 hlt 2a:* c3 ret <-- trapping instruction 2b: 0f 1f 40 d6 nopl -0x2a(%rax) 2f: 41 54 push %r12 31: 55 push %rbp 32: 53 push %rbx 33: 48 89 fb mov %rdi,%rbx 36: 48 83 ec 10 sub $0x10,%rsp 3a: 8b 17 mov (%rdi),%edx 3c: 83 e2 fe and $0xfffffffe,%edx 3f: 41 rex.B Code starting with the faulting instruction =========================================== 0: c3 ret 1: 0f 1f 40 d6 nopl -0x2a(%rax) 5: 41 54 push %r12 7: 55 push %rbp 8: 53 push %rbx 9: 48 89 fb mov %rdi,%rbx c: 48 83 ec 10 sub $0x10,%rsp 10: 8b 17 mov (%rdi),%edx 12: 83 e2 fe and $0xfffffffe,%edx 15: 41 rex.B [ 2840.861016][ C1] RSP: 0018:ffffc90000137dd8 EFLAGS: 00000202 [ 2840.861276][ C1] RAX: 0000000007463589 RBX: 1ffff92000026fbf RCX: ffffffffbc40a255 [ 2840.861683][ C1] RDX: 0000000000000000 RSI: ffffffffbcdfa925 RDI: ffffffffbc86a600 [ 2840.861985][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a [ 2840.862286][ C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000 [ 2840.862690][ C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000 [ 2840.862993][ C1] ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146) [ 2840.863247][ C1] default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767) [ 2840.863499][ C1] default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123) [ 2840.863699][ C1] cpuidle_idle_call (kernel/sched/idle.c:192) [ 2840.863901][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 2840.864103][ C1] ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60) [ 2840.864408][ C1] do_idle (kernel/sched/idle.c:332) [ 2840.864561][ C1] cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1)) [ 2840.864763][ C1] start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280) [ 2840.864965][ C1] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230) Finger prints: print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core rcuref_put_slowpath:dst_release:rt_cache_route:__mkroute_output:ip_route_output_key_hash