====================================== | [ 1061.739653][ T9039] ------------[ cut here ]------------ | [ 1061.740135][ T9039] rcuref - imbalanced put() | [ 1061.740138][ T9039] WARNING: lib/rcuref.c:266 at 0x0, CPU#0: mausezahn/9039 | [ 1061.740844][ T9039] Modules linked in: cls_bpf netdevsim psample sch_fq ip6t_rpfilter nft_compat nf_tables act_gact cls_flower sch_ingress sctp_diag sctp ip6_gre ip_gre gre vxlan [last unloaded: psample] [ 1061.742942][ T9039] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1061.743348][ T9039] RIP: 0010:rcuref_put_slowpath (lib/rcuref.c:266 (discriminator 1)) [ 1061.743774][ T9039] Code: 07 83 c0 03 38 d0 7c 04 84 d2 75 69 c7 03 00 00 00 a0 31 c0 eb 8b 4c 89 ef e8 47 03 a0 ff e9 6c ff ff ff 48 8d 3d 0b 05 3d 03 <67> 48 0f b9 3a be 04 00 00 00 48 89 df e8 49 0a a0 ff 48 89 d8 48 All code ======== 0: 07 (bad) 1: 83 c0 03 add $0x3,%eax 4: 38 d0 cmp %dl,%al 6: 7c 04 jl 0xc 8: 84 d2 test %dl,%dl a: 75 69 jne 0x75 c: c7 03 00 00 00 a0 movl $0xa0000000,(%rbx) 12: 31 c0 xor %eax,%eax 14: eb 8b jmp 0xffffffffffffffa1 16: 4c 89 ef mov %r13,%rdi 19: e8 47 03 a0 ff call 0xffffffffffa00365 1e: e9 6c ff ff ff jmp 0xffffffffffffff8f 23: 48 8d 3d 0b 05 3d 03 lea 0x33d050b(%rip),%rdi # 0x33d0535 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: be 04 00 00 00 mov $0x4,%esi 34: 48 89 df mov %rbx,%rdi 37: e8 49 0a a0 ff call 0xffffffffffa00a85 3c: 48 89 d8 mov %rbx,%rax 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 67 48 0f b9 3a ud1 (%edx),%rdi 5: be 04 00 00 00 mov $0x4,%esi a: 48 89 df mov %rbx,%rdi d: e8 49 0a a0 ff call 0xffffffffffa00a5b 12: 48 89 d8 mov %rbx,%rax 15: 48 rex.W [ 1061.744891][ T9039] RSP: 0018:ffffc90001937240 EFLAGS: 00010206 [ 1061.745279][ T9039] RAX: 0000000000000000 RBX: ffff88800bd78b00 RCX: ffffffffbba8bb71 [ 1061.745747][ T9039] RDX: ffffed10017af161 RSI: 00000000dfffffff RDI: ffffffffbe2bbf20 [ 1061.746214][ T9039] RBP: 1ffff92000326e48 R08: 0000000000000001 R09: ffffed10017af160 [ 1061.746687][ T9039] R10: ffff88800bd78b03 R11: ffff88800ebdad90 R12: dffffc0000000000 [ 1061.747153][ T9039] R13: ffff88800bd78800 R14: ffff888010ade280 R15: 0000000000000000 [ 1061.747635][ T9039] FS: 00007ff89fd67740(0000) GS:ffff8880ae318000(0000) knlGS:0000000000000000 [ 1061.748183][ T9039] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1061.748586][ T9039] CR2: 00007ff89febe0b0 CR3: 000000000e097002 CR4: 0000000000772ef0 [ 1061.749067][ T9039] PKRU: 55555554 [ 1061.749307][ T9039] Call Trace: [ 1061.749562][ T9039] [ 1061.749721][ T9039] ? rcuref_get_slowpath (lib/rcuref.c:238) [ 1061.750041][ T9039] dst_release (./include/linux/rcuref.h:117 ./include/linux/rcuref.h:173 net/core/dst.c:167) [ 1061.750361][ T9039] rt_cache_route (net/ipv4/route.c:1510) [ 1061.750679][ T9039] rt_set_nexthop.constprop.0 (net/ipv4/route.c:1622) [ 1061.751003][ T9039] __mkroute_output (./include/net/lwtunnel.h:140 net/ipv4/route.c:2682) [ 1061.751320][ T9039] ip_route_output_key_hash (net/ipv4/route.c:2705) [ 1061.751642][ T9039] ? ip_route_output_key_hash_rcu (net/ipv4/route.c:2693) [ 1061.752029][ T9039] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 1061.752341][ T9039] ? dst_cache_get_ip4 (./include/linux/local_lock_internal.h:57 net/core/dst_cache.c:98) [ 1061.752655][ T9039] ? __lock_release (kernel/locking/lockdep.c:5536) [ 1061.752966][ T9039] ip_route_output_flow (net/ipv4/route.c:2934) [ 1061.753279][ T9039] udp_tunnel_dst_lookup (net/ipv4/udp_tunnel_core.c:261 net/ipv4/udp_tunnel_core.c:230) [ 1061.753597][ T9039] ? udp_tunnel_drop_rx_port (net/ipv4/udp_tunnel_core.c:237) [ 1061.753922][ T9039] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 1061.754240][ T9039] vxlan_xmit_one (drivers/net/vxlan/vxlan_core.c:2472 (discriminator 4)) vxlan [ 1061.754565][ T9039] ? __skb_flow_dissect (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/flow_dissector.c:1172) [ 1061.754873][ T9039] ? __skb_flow_dissect (net/core/flow_dissector.c:1160 (discriminator 2)) [ 1061.755198][ T9039] ? vxlan_fdb_delete (drivers/net/vxlan/vxlan_core.c:2337) vxlan [ 1061.755530][ T9039] ? vxlan_find_mac_rcu (./include/linux/rhashtable.h:632 ./include/linux/rhashtable.h:670 drivers/net/vxlan/vxlan_core.c:392) vxlan [ 1061.755931][ T9039] ? vxlan_remcsum (drivers/net/vxlan/vxlan_core.c:382) vxlan [ 1061.756262][ T9039] ? vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 1061.756582][ T9039] vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan [ 1061.756917][ T9039] ? vxlan_xmit_nhid (drivers/net/vxlan/vxlan_core.c:2721) vxlan [ 1061.757242][ T9039] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 1061.757568][ T9039] ? __lock_release (kernel/locking/lockdep.c:5536) [ 1061.757875][ T9039] ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591) [ 1061.758188][ T9039] ? dev_queue_xmit_nit (net/core/dev.c:2592) [ 1061.758509][ T9039] dev_hard_start_xmit (./include/linux/netdevice.h:5272 ./include/linux/netdevice.h:5281 net/core/dev.c:3853 net/core/dev.c:3869) [ 1061.758820][ T9039] __dev_queue_xmit (net/core/dev.h:381 net/core/dev.c:4818) [ 1061.759138][ T9039] ? _copy_from_iter (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:67 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 1061.759464][ T9039] ? netdev_core_pick_tx (net/core/dev.c:4725) [ 1061.759780][ T9039] ? packet_parse_headers (net/packet/af_packet.c:1933) [ 1061.760109][ T9039] ? sock_wmalloc (net/core/sock.c:2968) [ 1061.760429][ T9039] ? packet_cached_dev_get (net/packet/af_packet.c:1923) [ 1061.760749][ T9039] ? skb_copy_datagram_from_iter (net/core/datagram.c:561) [ 1061.761144][ T9039] packet_snd (net/packet/af_packet.c:3076) [ 1061.761468][ T9039] ? tpacket_snd (net/packet/af_packet.c:2940) [ 1061.761774][ T9039] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1061.762097][ T9039] ? __might_fault (mm/memory.c:7129 mm/memory.c:7123) [ 1061.762415][ T9039] __sys_sendto (net/socket.c:718 net/socket.c:733 net/socket.c:2222) [ 1061.762738][ T9039] ? __ia32_sys_getpeername (net/socket.c:2189) [ 1061.763055][ T9039] ? sock_ioctl (net/socket.c:1369) [ 1061.763357][ T9039] ? _copy_to_user (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:147 ./include/linux/uaccess.h:206 lib/usercopy.c:26) [ 1061.763672][ T9039] ? ns_to_timespec64 (kernel/time/time.c:905) [ 1061.763974][ T9039] ? posix_cpu_clock_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/time/posix-cpu-timers.c:375) [ 1061.764301][ T9039] ? posix_cpu_clock_get (kernel/time/posix-cpu-timers.c:377) [ 1061.764634][ T9039] ? __x64_sys_clock_gettime (kernel/time/posix-timers.c:1146 kernel/time/posix-timers.c:1134 kernel/time/posix-timers.c:1134) [ 1061.764956][ T9039] __x64_sys_sendto (net/socket.c:2225) [ 1061.765264][ T9039] ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:108 arch/x86/entry/syscall_64.c:90) [ 1061.765587][ T9039] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 1061.765894][ T9039] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 1061.766207][ T9039] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) [ 1061.766594][ T9039] RIP: 0033:0x7ff89ff8327a [ 1061.766922][ T9039] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 All code ======== 0: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 4: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax b: eb b8 jmp 0xffffffffffffffc5 d: 0f 1f 00 nopl (%rax) 10: f3 0f 1e fa endbr64 14: 41 89 ca mov %ecx,%r10d 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 15 jne 0x38 23: b8 2c 00 00 00 mov $0x2c,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 7e ja 0xb0 32: c3 ret 33: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 38: 41 54 push %r12 3a: 48 83 ec 30 sub $0x30,%rsp 3e: 44 rex.R 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 7e ja 0x86 8: c3 ret 9: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) e: 41 54 push %r12 10: 48 83 ec 30 sub $0x30,%rsp 14: 44 rex.R 15: 89 .byte 0x89 [ 1061.768039][ T9039] RSP: 002b:00007fff8eaf0b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1061.768526][ T9039] RAX: ffffffffffffffda RBX: 0000000030d209d0 RCX: 00007ff89ff8327a [ 1061.768993][ T9039] RDX: 0000000000000064 RSI: 0000000030d205c2 RDI: 0000000000000005 [ 1061.769484][ T9039] RBP: 0000000030d205c2 R08: 00007fff8eaf0b90 R09: 0000000000000014 [ 1061.769951][ T9039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1061.770424][ T9039] R13: 0000000000000064 R14: 00007fff8eaf0b90 R15: 0000000000000000 | [ 1063.356118][ C3] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146) | [ 1063.356393][ C3] Read of size 8 at addr ffff88800bd78940 by task swapper/3/0 | [ 1063.356655][ C3] | [ 1063.356753][ C3] Tainted: [W]=WARN [ 1063.356754][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1063.356757][ C3] Call Trace: [ 1063.356759][ C3] [ 1063.356761][ C3] dump_stack_lvl (lib/dump_stack.c:123) [ 1063.356768][ C3] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 1063.356774][ C3] ? dst_dev_put (net/core/dst.c:146) [ 1063.356778][ C3] print_report (mm/kasan/report.c:483) [ 1063.356782][ C3] ? dst_dev_put (net/core/dst.c:146) [ 1063.356785][ C3] ? kasan_addr_to_slab (mm/kasan/../slab.h:178 mm/kasan/common.c:47) [ 1063.356788][ C3] ? dst_dev_put (net/core/dst.c:146) [ 1063.356791][ C3] kasan_report (mm/kasan/report.c:597) [ 1063.356795][ C3] ? dst_dev_put (net/core/dst.c:146) [ 1063.356800][ C3] dst_dev_put (net/core/dst.c:146) [ 1063.356804][ C3] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 1063.356810][ C3] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 1063.356814][ C3] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 1063.356818][ C3] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 1063.356822][ C3] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 1063.356829][ C3] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 1063.356832][ C3] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 1063.356838][ C3] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 1063.356843][ C3] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 1063.356848][ C3] rcu_core (kernel/rcu/tree.c:2859) [ 1063.356852][ C3] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 1063.356859][ C3] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 1063.356862][ C3] irq_exit_rcu (kernel/softirq.c:741) [ 1063.356865][ C3] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 1063.356869][ C3] [ 1063.356870][ C3] [ 1063.356871][ C3] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 1063.356875][ C3] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82) [ 1063.356879][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 All code ======== 0: 48 8b 3d 34 31 90 02 mov 0x2903134(%rip),%rdi # 0x290313b 7: e8 1f 00 00 00 call 0x2b c: 48 2b 05 28 07 a9 00 sub 0xa90728(%rip),%rax # 0xa9073b 13: c3 ret 14: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d d3 d6 28 00 verw 0x28d6d3(%rip) # 0x28d6fb 28: fb sti 29: f4 hlt 2a:* c3 ret <-- trapping instruction 2b: 0f 1f 40 d6 nopl -0x2a(%rax) 2f: 41 54 push %r12 31: 55 push %rbp 32: 53 push %rbx 33: 48 89 fb mov %rdi,%rbx 36: 48 83 ec 10 sub $0x10,%rsp 3a: 8b 17 mov (%rdi),%edx 3c: 83 e2 fe and $0xfffffffe,%edx 3f: 41 rex.B Code starting with the faulting instruction =========================================== 0: c3 ret 1: 0f 1f 40 d6 nopl -0x2a(%rax) 5: 41 54 push %r12 7: 55 push %rbp 8: 53 push %rbx 9: 48 89 fb mov %rdi,%rbx c: 48 83 ec 10 sub $0x10,%rsp 10: 8b 17 mov (%rdi),%edx 12: 83 e2 fe and $0xfffffffe,%edx 15: 41 rex.B [ 1063.356882][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000206 [ 1063.356886][ C3] RAX: 000000000159dbb1 RBX: 1ffff9200002afbf RCX: ffffffffbc40a255 [ 1063.356888][ C3] RDX: 0000000000000000 RSI: ffffffffbcdfa925 RDI: ffffffffbc86a600 [ 1063.356890][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da3631a [ 1063.356891][ C3] R10: ffff88806d1b18d3 R11: ffff888001ae5090 R12: 0000000000000000 [ 1063.356893][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000 [ 1063.356897][ C3] ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146) [ 1063.356901][ C3] default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767) [ 1063.356903][ C3] default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123) [ 1063.356906][ C3] cpuidle_idle_call (kernel/sched/idle.c:192) [ 1063.356910][ C3] ? arch_cpu_idle_exit+0x40/0x40 [ 1063.356913][ C3] ? trace_sched_exit_tp (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/sched.h:886) [ 1063.356918][ C3] ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60) [ 1063.356924][ C3] do_idle (kernel/sched/idle.c:332) [ 1063.356927][ C3] cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1)) [ 1063.356930][ C3] start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280) [ 1063.356933][ C3] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230) [ 1063.356937][ C3] common_startup_64 (arch/x86/kernel/head_64.S:419) | [ 1063.382866][ C3] Disabling lock debugging due to kernel taint | [ 1063.383210][ C3] Oops: general protection fault, probably for non-canonical address 0xe0943c3840000007: 0000 [#1] SMP KASAN | [ 1063.383596][ C3] KASAN: maybe wild-memory-access in range [0x04a201c200000038-0x04a201c20000003f] | [ 1063.384475][ C3] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1063.384647][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1063.384971][ C3] RIP: 0010:dst_dev_put (net/core/dst.c:149) [ 1063.385156][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 All code ======== 0: fc cld 1: ff lcall (bad) 2: df 48 c1 fisttps -0x3f(%rax) 5: ea (bad) 6: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax c: 85 9c 01 00 00 48 b8 test %ebx,-0x47b80000(%rcx,%rax,1) 13: 00 00 add %al,(%rax) 15: 00 00 add %al,(%rax) 17: 00 fc add %bh,%ah 19: ff lcall (bad) 1a: df 49 8b fisttps -0x75(%rcx) 1d: 6d insl (%dx),%es:(%rdi) 1e: 08 48 8d or %cl,-0x73(%rax) 21: 7d 38 jge 0x5b 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 6f 01 00 00 jne 0x1a3 34: 48 8b 45 38 mov 0x38(%rbp),%rax 38: 48 85 c0 test %rax,%rax 3b: 74 08 je 0x45 3d: 4c 89 e6 mov %r12,%rsi Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 6f 01 00 00 jne 0x179 a: 48 8b 45 38 mov 0x38(%rbp),%rax e: 48 85 c0 test %rax,%rax 11: 74 08 je 0x1b 13: 4c 89 e6 mov %r12,%rsi [ 1063.385777][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010202 [ 1063.386006][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffbba8b398 [ 1063.386278][ C3] RDX: 0094403840000007 RSI: 0000000000000008 RDI: 04a201c200000038 [ 1063.386762][ C3] RBP: 04a201c200000000 R08: 0000000000000001 R09: fffffbfff7daa8c4 [ 1063.387023][ C3] R10: ffffffffbed54627 R11: ffffc90000270800 R12: ffff8880108c8278 [ 1063.387398][ C3] R13: ffff88800bd78940 R14: 0000000000000002 R15: ffff88800bd78940 [ 1063.387654][ C3] FS: 0000000000000000(0000) GS:ffff8880ae498000(0000) knlGS:0000000000000000 [ 1063.387963][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1063.388390][ C3] CR2: 000055e007845978 CR3: 0000000056d45002 CR4: 0000000000772ef0 [ 1063.388643][ C3] PKRU: 55555554 [ 1063.388788][ C3] Call Trace: [ 1063.388921][ C3] [ 1063.389016][ C3] rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196) [ 1063.389194][ C3] fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207) [ 1063.389384][ C3] free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3)) [ 1063.389563][ C3] ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223) [ 1063.389895][ C3] rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607) [ 1063.390076][ C3] ? trace_rcu_batch_end (kernel/rcu/tree.c:2529) [ 1063.390259][ C3] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) [ 1063.390485][ C3] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 1063.390656][ C3] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) [ 1063.390874][ C3] rcu_core (kernel/rcu/tree.c:2859) [ 1063.391016][ C3] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 1063.391196][ C3] __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723) [ 1063.391569][ C3] irq_exit_rcu (kernel/softirq.c:741) [ 1063.391700][ C3] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056) [ 1063.391874][ C3] [ 1063.391962][ C3] [ 1063.392057][ C3] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 1063.392383][ C3] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82) [ 1063.392663][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 All code ======== 0: 48 8b 3d 34 31 90 02 mov 0x2903134(%rip),%rdi # 0x290313b 7: e8 1f 00 00 00 call 0x2b c: 48 2b 05 28 07 a9 00 sub 0xa90728(%rip),%rax # 0xa9073b 13: c3 ret 14: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d d3 d6 28 00 verw 0x28d6d3(%rip) # 0x28d6fb 28: fb sti 29: f4 hlt 2a:* c3 ret <-- trapping instruction 2b: 0f 1f 40 d6 nopl -0x2a(%rax) 2f: 41 54 push %r12 31: 55 push %rbp 32: 53 push %rbx 33: 48 89 fb mov %rdi,%rbx 36: 48 83 ec 10 sub $0x10,%rsp 3a: 8b 17 mov (%rdi),%edx 3c: 83 e2 fe and $0xfffffffe,%edx 3f: 41 rex.B Code starting with the faulting instruction =========================================== 0: c3 ret 1: 0f 1f 40 d6 nopl -0x2a(%rax) 5: 41 54 push %r12 7: 55 push %rbp 8: 53 push %rbx 9: 48 89 fb mov %rdi,%rbx c: 48 83 ec 10 sub $0x10,%rsp 10: 8b 17 mov (%rdi),%edx 12: 83 e2 fe and $0xfffffffe,%edx 15: 41 rex.B [ 1063.393411][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000206 [ 1063.393637][ C3] RAX: 000000000159dbb1 RBX: 1ffff9200002afbf RCX: ffffffffbc40a255 [ 1063.393915][ C3] RDX: 0000000000000000 RSI: ffffffffbcdfa925 RDI: ffffffffbc86a600 [ 1063.394189][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da3631a [ 1063.394462][ C3] R10: ffff88806d1b18d3 R11: ffff888001ae5090 R12: 0000000000000000 [ 1063.394740][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000 [ 1063.395120][ C3] ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146) [ 1063.395338][ C3] default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767) [ 1063.395483][ C3] default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123) [ 1063.395653][ C3] cpuidle_idle_call (kernel/sched/idle.c:192) [ 1063.395830][ C3] ? arch_cpu_idle_exit+0x40/0x40 [ 1063.396002][ C3] ? trace_sched_exit_tp (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/sched.h:886) [ 1063.396291][ C3] ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60) [ 1063.396462][ C3] do_idle (kernel/sched/idle.c:332) [ 1063.396592][ C3] cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1)) [ 1063.396772][ C3] start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280) [ 1063.396952][ C3] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230) Finger prints: print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core rcuref_put_slowpath:dst_release:rt_cache_route:__mkroute_output:ip_route_output_key_hash