======================================
| [   52.529434][  T438] ip (438) used greatest stack depth: 23424 bytes left
| [  152.744398][    C0] ------------[ cut here ]------------
| [  152.745157][    C0] kernel BUG at net/core/skbuff.c:2813!
| [  152.745381][    C0] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
[  152.745865][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 152.746258][ C0] RIP: 0010:__pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.746482][ C0] Code: e9 52 f7 ff ff 48 8b 7c 24 38 be 02 00 00 00 e8 8e 9c ff ff 48 83 c4 58 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 48 c7 44 24 38 00 00 00 00 e9 dc fa ff ff 84 c9 0f 84 4b f9
All code
========
   0:	e9 52 f7 ff ff       	jmp    0xfffffffffffff757
   5:	48 8b 7c 24 38       	mov    0x38(%rsp),%rdi
   a:	be 02 00 00 00       	mov    $0x2,%esi
   f:	e8 8e 9c ff ff       	call   0xffffffffffff9ca2
  14:	48 83 c4 58          	add    $0x58,%rsp
  18:	31 c0                	xor    %eax,%eax
  1a:	5b                   	pop    %rbx
  1b:	41 5c                	pop    %r12
  1d:	41 5d                	pop    %r13
  1f:	41 5e                	pop    %r14
  21:	41 5f                	pop    %r15
  23:	5d                   	pop    %rbp
  24:	c3                   	ret
  25:	cc                   	int3
  26:	cc                   	int3
  27:	cc                   	int3
  28:	cc                   	int3
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	48 c7 44 24 38 00 00 	movq   $0x0,0x38(%rsp)
  33:	00 00 
  35:	e9 dc fa ff ff       	jmp    0xfffffffffffffb16
  3a:	84 c9                	test   %cl,%cl
  3c:	0f                   	.byte 0xf
  3d:	84 4b f9             	test   %cl,-0x7(%rbx)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	48 c7 44 24 38 00 00 	movq   $0x0,0x38(%rsp)
   9:	00 00 
   b:	e9 dc fa ff ff       	jmp    0xfffffffffffffaec
  10:	84 c9                	test   %cl,%cl
  12:	0f                   	.byte 0xf
  13:	84 4b f9             	test   %cl,-0x7(%rbx)
[  152.747093][    C0] RSP: 0018:ffffc90000007188 EFLAGS: 00010282
[  152.747314][    C0] RAX: 00000000fffffff2 RBX: ffff88800926f3f4 RCX: 0000000000000004
[  152.747577][    C0] RDX: dffffc0000000000 RSI: 1ffff11000be47d9 RDI: ffff888005f23ec8
[  152.747837][    C0] RBP: ffffc90000007208 R08: 00000000000007b4 R09: ffff88800926f43c
[  152.748098][    C0] R10: ffff88800926f440 R11: ffffffff881470e4 R12: ffff88800926f380
[  152.748356][    C0] R13: 0000000000000ec0 R14: ffff88800926f434 R15: ffff88800926f440
[  152.748616][    C0] FS:  00007f0cea578740(0000) GS:ffff888036000000(0000) knlGS:0000000000000000
[  152.748919][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  152.749135][    C0] CR2: 0000564c13412000 CR3: 0000000003514003 CR4: 0000000000770ef0
[  152.749404][    C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  152.749660][    C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  152.749918][    C0] PKRU: 55555554
[  152.750045][    C0] Call Trace:
[  152.750174][    C0]  <IRQ>
[ 152.750262][ C0] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) 
[ 152.750399][ C0] ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) 
[ 152.750531][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.750703][ C0] ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) 
[ 152.750871][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.751039][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.751209][ C0] ? handle_invalid_op (arch/x86/kernel/traps.c:213) 
[ 152.751382][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.751550][ C0] ? exc_invalid_op (arch/x86/kernel/traps.c:265) 
[ 152.751720][ C0] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[ 152.752012][ C0] ? kasan_save_track (./arch/x86/include/asm/current.h:42 mm/kasan/common.c:60 mm/kasan/common.c:69) 
[ 152.752183][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 152.752352][ C0] ? __pskb_pull_tail (net/core/skbuff.c:2813) 
[ 152.752523][ C0] tcf_csum_skb_nextlayer (./include/linux/skbuff.h:2731 ./include/linux/skbuff.h:2739 net/sched/act_csum.c:140) act_csum
[ 152.752738][ C0] ? skb_ensure_writable (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/skbuff.h:1919 ./include/linux/skbuff.h:1916 net/core/skbuff.c:6109) 
[ 152.752912][ C0] tcf_csum_ipv4_udp (net/sched/act_csum.c:271) act_csum
[ 152.753125][ C0] ? tcf_pedit_act (net/sched/act_pedit.c:405) act_pedit
[ 152.753358][ C0] tcf_csum_ipv4 (net/sched/act_csum.c:423) act_csum
[ 152.753645][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.753819][ C0] tcf_csum_act (net/sched/act_csum.c:592) act_csum
[ 152.753991][ C0] ? __lock_acquire (kernel/locking/lockdep.c:5137) 
[ 152.754163][ C0] tcf_action_exec.part.0 (./include/net/tc_wrapper.h:130 net/sched/act_api.c:1100) 
[ 152.754453][ C0] fl_classify (net/sched/cls_flower.c:345) cls_flower
[ 152.754630][ C0] ? __pfx_fl_classify (net/sched/cls_flower.c:316) cls_flower
[ 152.754846][ C0] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825) 
[ 152.755018][ C0] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825) 
[ 152.755298][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.755466][ C0] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 3)) 
[ 152.755595][ C0] ? __lock_acquire (kernel/locking/lockdep.c:5137) 
[ 152.755764][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.755936][ C0] ? validate_chain (./include/linux/hash.h:78 kernel/locking/lockdep.c:3759 kernel/locking/lockdep.c:3782 kernel/locking/lockdep.c:3837) 
[ 152.756222][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.756390][ C0] ? validate_chain (./include/linux/hash.h:78 kernel/locking/lockdep.c:3759 kernel/locking/lockdep.c:3782 kernel/locking/lockdep.c:3837) 
[ 152.756557][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.756727][ C0] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 3)) 
[ 152.756968][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.757139][ C0] ? __pfx_validate_chain (kernel/locking/lockdep.c:3825) 
[ 152.757309][ C0] __tcf_classify.constprop.0 (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1768) 
[ 152.757484][ C0] tcf_classify (net/sched/cls_api.c:1813) 
[ 152.757618][ C0] ? __pfx_tcf_classify (net/sched/cls_api.c:1813) 
[ 152.757787][ C0] prio_enqueue (net/sched/sch_prio.c:44 net/sched/sch_prio.c:75) sch_prio
[ 152.757963][ C0] ? __pfx_prio_enqueue (net/sched/sch_prio.c:70) sch_prio
[ 152.758176][ C0] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:115 ./include/linux/atomic/atomic-arch-fallback.h:2164 ./include/linux/atomic/atomic-instrumented.h:1296 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 152.758347][ C0] dev_qdisc_enqueue (net/core/dev.c:3758) 
[ 152.758628][ C0] __dev_xmit_skb (./include/net/sch_generic.h:194 net/core/dev.c:3850) 
[ 152.758795][ C0] ? lock_sync (kernel/locking/lockdep.c:116 kernel/locking/lockdep.c:5794) 
[ 152.758965][ C0] ? __pfx___dev_xmit_skb (net/core/dev.c:3767) 
[ 152.759138][ C0] __dev_queue_xmit (net/core/dev.c:4338) 
[ 152.759420][ C0] ? __pfx_do_raw_write_lock (kernel/locking/spinlock_debug.c:209) 
[ 152.759589][ C0] ? eth_header (net/ethernet/eth.c:100) 
[ 152.759759][ C0] ? __pfx___dev_queue_xmit (net/core/dev.c:4281) 
[ 152.759928][ C0] ? neigh_resolve_output (./include/linux/netdevice.h:3226 net/core/neighbour.c:1558 net/core/neighbour.c:1543) 
[ 152.760210][ C0] ? __neigh_update (./include/linux/rcupdate.h:298 ./include/linux/rcupdate.h:750 net/core/neighbour.c:1446) 
[ 152.760379][ C0] __neigh_update (net/core/neighbour.c:1461) 
[ 152.760551][ C0] arp_process (./include/linux/instrumented.h:96 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:400 (discriminator 4) ./include/linux/refcount.h:261 (discriminator 4) ./include/linux/refcount.h:304 (discriminator 4) ./include/linux/refcount.h:322 (discriminator 4) ./include/net/neighbour.h:444 (discriminator 4) net/ipv4/arp.c:934 (discriminator 4)) 
[ 152.760727][ C0] ? __pfx_arp_process (net/ipv4/arp.c:699) 
[ 152.761011][ C0] ? lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5756) 
[ 152.761182][ C0] ? __pfx_arp_rcv (net/ipv4/arp.c:965) 
[ 152.761351][ C0] __netif_receive_skb_one_core (net/core/dev.c:5610 (discriminator 5)) 
[ 152.761562][ C0] ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5603) 
[ 152.761773][ C0] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) 
[ 152.761943][ C0] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5725) 
[ 152.762111][ C0] ? process_backlog (./include/linux/rcupdate.h:298 ./include/linux/rcupdate.h:750 net/core/dev.c:6051) 
[ 152.762284][ C0] process_backlog (./include/linux/rcupdate.h:779 net/core/dev.c:6053) 
[ 152.762567][ C0] ? find_held_lock (kernel/locking/lockdep.c:5244) 
[ 152.762737][ C0] __napi_poll.constprop.0 (net/core/dev.c:6703) 
[ 152.762908][ C0] net_rx_action (net/core/dev.c:6772 net/core/dev.c:6886) 
[ 152.763078][ C0] ? __pfx_net_rx_action (net/core/dev.c:6850) 
[ 152.763252][ C0] ? kvm_clock_get_cycles (./arch/x86/include/asm/preempt.h:94 arch/x86/kernel/kvmclock.c:80 arch/x86/kernel/kvmclock.c:86) 
[ 152.763536][ C0] ? ktime_get (kernel/time/timekeeping.c:195 (discriminator 4) kernel/time/timekeeping.c:289 (discriminator 4) kernel/time/timekeeping.c:388 (discriminator 4) kernel/time/timekeeping.c:848 (discriminator 4)) 
[ 152.763666][ C0] ? hrtimer_interrupt (kernel/time/hrtimer.c:1828) 
[ 152.763839][ C0] ? hrtimer_interrupt (kernel/time/hrtimer.c:1828) 
[ 152.764009][ C0] __do_softirq (kernel/softirq.c:553) 
[ 152.764294][ C0] ? __neigh_event_send (./include/linux/bottom_half.h:33 net/core/neighbour.c:1245) 
[ 152.764466][ C0] do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) 
[  152.764600][    C0]  </IRQ>
[  152.764690][    C0]  <TASK>
[ 152.764775][ C0] __local_bh_enable_ip (kernel/softirq.c:381) 
[ 152.764944][ C0] __neigh_event_send (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/neigh.h:237 net/core/neighbour.c:1246) 
[ 152.765229][ C0] ? do_raw_write_lock (kernel/locking/spinlock_debug.c:187 kernel/locking/spinlock_debug.c:210) 
[ 152.765404][ C0] ? __pfx_do_raw_write_lock (kernel/locking/spinlock_debug.c:209) 
[ 152.765572][ C0] neigh_resolve_output (net/core/neighbour.c:1547) 
[ 152.765741][ C0] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:77 kernel/softirq.c:386) 
[ 152.766025][ C0] ? ___neigh_create (net/core/neighbour.c:722 (discriminator 9)) 
[ 152.766194][ C0] ip_finish_output2 (./include/net/neighbour.h:542 net/ipv4/ip_output.c:235) 
[ 152.766369][ C0] ? kfree (./include/trace/events/kmem.h:94 mm/slub.c:4396) 
[ 152.766498][ C0] ? ip_select_ident_segs (./arch/x86/include/asm/atomic.h:85 ./include/linux/atomic/atomic-arch-fallback.h:564 ./include/linux/atomic/atomic-instrumented.h:124 ./include/net/ip.h:561) 
[ 152.766780][ C0] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:199) 
[ 152.766955][ C0] ? __ip_finish_output (./include/linux/skbuff.h:1624 ./include/linux/skbuff.h:4942 net/ipv4/ip_output.c:307 net/ipv4/ip_output.c:295) 
[ 152.767125][ C0] ip_output (./include/linux/netfilter.h:303 net/ipv4/ip_output.c:433) 
[ 152.767252][ C0] ? __ip_local_out (net/ipv4/ip_output.c:96 net/ipv4/ip_output.c:107) 
[ 152.767421][ C0] ? __pfx_ip_output (net/ipv4/ip_output.c:427) 
[ 152.767702][ C0] ? ip_make_skb (net/ipv4/ip_output.c:1570) 
[ 152.767872][ C0] ? find_held_lock (kernel/locking/lockdep.c:5244) 
[ 152.768041][ C0] ? __pfx_ip_make_skb (net/ipv4/ip_output.c:1546) 
[ 152.768208][ C0] ? __lock_release (kernel/locking/lockdep.c:5430) 
[ 152.768489][ C0] ip_send_skb (./include/net/dst.h:450 net/ipv4/ip_output.c:129 net/ipv4/ip_output.c:1496) 
[ 152.768664][ C0] udp_send_skb (net/ipv4/udp.c:963) 
[ 152.768837][ C0] udp_sendmsg (net/ipv4/udp.c:1250) 
[ 152.769006][ C0] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 152.769287][ C0] ? mark_lock (kernel/locking/lockdep.c:4656 (discriminator 3)) 
[ 152.769416][ C0] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) 
[ 152.769586][ C0] ? __pfx_udp_sendmsg (net/ipv4/udp.c:1039) 
[ 152.769755][ C0] ? mark_held_locks (kernel/locking/lockdep.c:4274) 
[ 152.769925][ C0] ? __lock_release (kernel/locking/lockdep.c:5430) 
[ 152.770203][ C0] ? __unix_dgram_recvmsg (net/unix/af_unix.c:2517) 
[ 152.770380][ C0] ? __pfx___lock_release (kernel/locking/lockdep.c:5406) 
[ 152.770547][ C0] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) 
[ 152.770715][ C0] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:115 ./include/linux/atomic/atomic-arch-fallback.h:2164 ./include/linux/atomic/atomic-instrumented.h:1296 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 152.771000][ C0] ? __unix_dgram_recvmsg (net/unix/af_unix.c:2517) 
[ 152.771169][ C0] ? do_raw_spin_unlock (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141) 
[ 152.771339][ C0] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:94 ./include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) 
[ 152.771506][ C0] ? __unix_dgram_recvmsg (net/unix/af_unix.c:2517) 
[ 152.771682][ C0] ? sock_write_iter (net/socket.c:730 net/socket.c:745 net/socket.c:1160) 
[ 152.771852][ C0] sock_write_iter (net/socket.c:730 net/socket.c:745 net/socket.c:1160) 
[ 152.772019][ C0] ? __pfx_sock_write_iter (net/socket.c:1144) 
[ 152.772192][ C0] vfs_write (./include/linux/fs.h:2087 fs/read_write.c:497 fs/read_write.c:590) 
[ 152.772320][ C0] ? __lock_release (kernel/locking/lockdep.c:5430) 
[ 152.772601][ C0] ? __pfx_vfs_write (fs/read_write.c:571) 
[ 152.772773][ C0] ? __fget_light (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1145) 
[ 152.772946][ C0] ? __pfx_find_vma (mm/mmap.c:1883) 
[ 152.773118][ C0] ksys_write (fs/read_write.c:643) 
[ 152.773368][ C0] ? __pfx_ksys_write (fs/read_write.c:633) 
[ 152.773537][ C0] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 152.773706][ C0] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) 
[  152.773917][    C0] RIP: 0033:0x7f0cea704957
[ 152.774207][ C0] Code: 0b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
All code
========
   0:	0b 00                	or     (%rax),%eax
   2:	f7 d8                	neg    %eax
   4:	64 89 02             	mov    %eax,%fs:(%rdx)
   7:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   e:	eb b7                	jmp    0xffffffffffffffc7
  10:	0f 1f 00             	nopl   (%rax)
  13:	f3 0f 1e fa          	endbr64
  17:	64 8b 04 25 18 00 00 	mov    %fs:0x18,%eax
  1e:	00 
  1f:	85 c0                	test   %eax,%eax
  21:	75 10                	jne    0x33
  23:	b8 01 00 00 00       	mov    $0x1,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 51                	ja     0x83
  32:	c3                   	ret
  33:	48 83 ec 28          	sub    $0x28,%rsp
  37:	48 89 54 24 18       	mov    %rdx,0x18(%rsp)
  3c:	48                   	rex.W
  3d:	89                   	.byte 0x89
  3e:	74 24                	je     0x64

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 51                	ja     0x59
   8:	c3                   	ret
   9:	48 83 ec 28          	sub    $0x28,%rsp
   d:	48 89 54 24 18       	mov    %rdx,0x18(%rsp)
  12:	48                   	rex.W
  13:	89                   	.byte 0x89
  14:	74 24                	je     0x3a
[  152.774807][    C0] RSP: 002b:00007fffd54ffe68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  152.775177][    C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0cea704957
[  152.775432][    C0] RDX: 00000000000007b4 RSI: 0000564c13412000 RDI: 0000000000000008
[  152.775682][    C0] RBP: 0000564c13412000 R08: 00000000000007b4 R09: 0000000000000000
[  152.776055][    C0] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000008


Finger prints:
__pskb_pull_tail:tcf_csum_skb_nextlayer:tcf_csum_ipv4_udp:tcf_csum_ipv4