====================================== | [ 1973.026206][T12742] ================================================================== | [1973.026532][T12742] BUG: KASAN: null-ptr-deref in sock_def_write_space_wfree (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 net/core/sock.c:3397) | [ 1973.026755][T12742] Read of size 8 at addr 0000000000000008 by task cmsg_sender/12742 | [ 1973.026972][T12742] [ 1973.027269][T12742] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1973.027590][T12742] Call Trace: [ 1973.027702][T12742] [1973.027779][T12742] dump_stack_lvl (lib/dump_stack.c:117) [1973.027931][T12742] kasan_report (mm/kasan/report.c:603) [1973.028043][T12742] ? sock_def_write_space_wfree (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 net/core/sock.c:3397) [1973.028228][T12742] kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) [1973.028369][T12742] sock_def_write_space_wfree (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 net/core/sock.c:3397) [1973.028515][T12742] sock_wfree (./include/linux/rcupdate.h:810 net/core/sock.c:2471) [1973.028624][T12742] skb_release_head_state (net/core/skbuff.c:1162 (discriminator 3)) [1973.028773][T12742] consume_skb (net/core/skbuff.c:1174 net/core/skbuff.c:1189 net/core/skbuff.c:1405 net/core/skbuff.c:1399) [1973.028880][T12742] dummy_xmit (drivers/net/dummy.c:66) [1973.028987][T12742] ? trace_net_dev_start_xmit (./include/trace/events/net.h:14 (discriminator 52)) [1973.029141][T12742] dev_hard_start_xmit (./include/linux/netdevice.h:4875 ./include/linux/netdevice.h:4889 net/core/dev.c:3563 net/core/dev.c:3579) [1973.029287][T12742] sch_direct_xmit (net/sched/sch_generic.c:343) [1973.029437][T12742] ? __pfx_sch_direct_xmit (net/sched/sch_generic.c:318) [1973.029581][T12742] __qdisc_run (net/sched/sch_generic.c:416) [1973.029722][T12742] ? __lock_acquire (kernel/locking/lockdep.c:5137) [1973.029867][T12742] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) [1973.030010][T12742] ? __pfx___qdisc_run (net/sched/sch_generic.c:412) [1973.030151][T12742] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:115 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [1973.030293][T12742] ? spin_bug (./include/linux/pid.h:232 kernel/locking/spinlock_debug.c:64 kernel/locking/spinlock_debug.c:78) [1973.030400][T12742] __dev_xmit_skb (./include/net/sch_generic.h:217 net/core/dev.c:3856) [1973.030541][T12742] ? lock_sync (kernel/locking/lockdep.c:122 kernel/locking/lockdep.c:5794) [1973.030649][T12742] ? __pfx___dev_xmit_skb (net/core/dev.c:3767) [1973.030794][T12742] __dev_queue_xmit (net/core/dev.c:4338) [1973.030938][T12742] ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4300 kernel/locking/lockdep.c:4359) [1973.031120][T12742] ? __pfx___dev_queue_xmit (net/core/dev.c:4281) [1973.031266][T12742] ip6_finish_output2 (./include/net/neighbour.h:540 net/ipv6/ip6_output.c:137) [1973.031411][T12742] ip6_finish_output (net/ipv6/ip6_output.c:211 net/ipv6/ip6_output.c:222) [1973.031557][T12742] ip6_output (./include/linux/netfilter.h:303 net/ipv6/ip6_output.c:243) [1973.031668][T12742] ? __pfx_ip6_output (net/ipv6/ip6_output.c:230) [1973.031820][T12742] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) [1973.031966][T12742] ? ip6_local_out (net/ipv6/output_core.c:154) [1973.032110][T12742] ip6_send_skb (net/ipv6/ip6_output.c:1956) [1973.032255][T12742] udp_v6_send_skb (net/ipv6/udp.c:1297) [1973.032405][T12742] udpv6_sendmsg (net/ipv6/udp.c:1592) [1973.032549][T12742] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) [1973.032690][T12742] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:1333) [1973.032839][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.032980][T12742] ? lock_acquire (kernel/locking/lockdep.c:5727) [1973.033123][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.033264][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.033403][T12742] ? __pfx_inet6_sendmsg (net/ipv6/af_inet6.c:652) [1973.033545][T12742] ? ____sys_sendmsg (net/socket.c:730 net/socket.c:745 net/socket.c:2584) [1973.033688][T12742] ____sys_sendmsg (net/socket.c:730 net/socket.c:745 net/socket.c:2584) [1973.033831][T12742] ? __pfx_____sys_sendmsg (net/socket.c:2530) [1973.033971][T12742] ? __pfx_copy_msghdr_from_user (net/socket.c:2510) [1973.034149][T12742] ? lookup_memtype (arch/x86/mm/pat/memtype.c:677) [1973.034301][T12742] ? trace_kfree (./include/trace/events/kmem.h:94 (discriminator 52)) [1973.034444][T12742] ? kfree (mm/slub.c:4379) [1973.034552][T12742] ___sys_sendmsg (net/socket.c:2640) [1973.034696][T12742] ? __pfx____sys_sendmsg (net/socket.c:2627) [1973.034839][T12742] ? udp_lib_setsockopt (net/ipv4/udp.c:2678) [1973.034983][T12742] ? __pfx_udp_lib_setsockopt (net/ipv4/udp.c:2671) [1973.035124][T12742] ? __do_fault (mm/memory.c:4531) [1973.035267][T12742] ? trace_kfree (./include/trace/events/kmem.h:94 (discriminator 52)) [1973.035413][T12742] ? kfree (mm/slub.c:4379) [1973.035522][T12742] ? __pfx_do_sock_setsockopt (net/socket.c:2280) [1973.035666][T12742] ? __fget_light (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1145) [1973.035813][T12742] __sys_sendmsg (./include/linux/file.h:34 net/socket.c:2669) [1973.035953][T12742] ? __pfx___sys_sendmsg (net/socket.c:2655) [1973.036097][T12742] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2336) [1973.036239][T12742] ? __pfx___sys_setsockopt (net/socket.c:2324) [1973.036383][T12742] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1973.036525][T12742] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) [ 1973.036704][T12742] RIP: 0033:0x7f055c8a97b7 [ 1973.036852][T12742] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1973.037351][T12742] RSP: 002b:00007fff828656b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1973.037570][T12742] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f055c8a97b7 [ 1973.037789][T12742] RDX: 0000000000000000 RSI: 00007fff82865730 RDI: 0000000000000005 [ 1973.038003][T12742] RBP: 0000000038d072a0 R08: 0000000000000008 R09: 00007f055c969080 [ 1973.038214][T12742] R10: 00007f055c762708 R11: 0000000000000246 R12: 0000000000000005 [ 1973.038427][T12742] R13: 00007fff82865730 R14: 0000000000403e00 R15: 00007f055c9a4000 | [ 1973.038757][T12742] ================================================================== | [ 1973.038976][T12742] Disabling lock debugging due to kernel taint | [ 1973.039194][T12742] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 1973.039503][T12742] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 1973.039952][T12742] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [1973.040258][T12742] RIP: 0010:sock_def_write_space_wfree (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 net/core/sock.c:3397) [ 1973.040442][T12742] Code: 00 4c 8b bb a0 01 00 00 be 08 00 00 00 4d 8d 77 08 4c 89 f7 e8 e0 0e 8b fe 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 fe 00 00 00 49 8b 47 08 a8 04 0f 85 dc fe ff ff All code ======== 0: 00 4c 8b bb add %cl,-0x45(%rbx,%rcx,4) 4: a0 01 00 00 be 08 00 movabs 0x8be000001,%al b: 00 00 d: 4d 8d 77 08 lea 0x8(%r15),%r14 11: 4c 89 f7 mov %r14,%rdi 14: e8 e0 0e 8b fe call 0xfffffffffe8b0ef9 19: 4c 89 f2 mov %r14,%rdx 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 fe 00 00 00 jne 0x132 34: 49 8b 47 08 mov 0x8(%r15),%rax 38: a8 04 test $0x4,%al 3a: 0f 85 dc fe ff ff jne 0xffffffffffffff1c Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 fe 00 00 00 jne 0x108 a: 49 8b 47 08 mov 0x8(%r15),%rax e: a8 04 test $0x4,%al 10: 0f 85 dc fe ff ff jne 0xfffffffffffffef2 [ 1973.040935][T12742] RSP: 0018:ffffc90000fff130 EFLAGS: 00010202 [ 1973.041110][T12742] RAX: dffffc0000000000 RBX: ffff88800bb10040 RCX: ffffffffb479564a [ 1973.041317][T12742] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffb9cfda00 [ 1973.041527][T12742] RBP: ffff88800bb100a0 R08: 0000000000000001 R09: fffffbfff739fb40 [ 1973.041742][T12742] R10: ffffffffb9cfda07 R11: 205d323437323154 R12: 0000000000000000 [ 1973.041949][T12742] R13: ffff88800bb101c0 R14: 0000000000000008 R15: 0000000000000000 [ 1973.042158][T12742] FS: 00007f055c757740(0000) GS:ffff888036080000(0000) knlGS:0000000000000000 [ 1973.042398][T12742] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1973.042570][T12742] CR2: 00007f055c96a000 CR3: 0000000009a4c001 CR4: 0000000000770ef0 [ 1973.042786][T12742] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1973.042992][T12742] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1973.043198][T12742] PKRU: 55555554 [ 1973.043306][T12742] Call Trace: [ 1973.043412][T12742] [1973.043482][T12742] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [1973.043589][T12742] ? exc_general_protection (arch/x86/kernel/traps.c:702 arch/x86/kernel/traps.c:644) [1973.043730][T12742] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [1973.043873][T12742] ? add_taint (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 kernel/panic.c:555) [1973.043979][T12742] ? sock_def_write_space_wfree (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 net/core/sock.c:3397) [1973.044149][T12742] sock_wfree (./include/linux/rcupdate.h:810 net/core/sock.c:2471) [1973.044255][T12742] skb_release_head_state (net/core/skbuff.c:1162 (discriminator 3)) [1973.044394][T12742] consume_skb (net/core/skbuff.c:1174 net/core/skbuff.c:1189 net/core/skbuff.c:1405 net/core/skbuff.c:1399) [1973.044499][T12742] dummy_xmit (drivers/net/dummy.c:66) [1973.044605][T12742] ? trace_net_dev_start_xmit (./include/trace/events/net.h:14 (discriminator 52)) [1973.044747][T12742] dev_hard_start_xmit (./include/linux/netdevice.h:4875 ./include/linux/netdevice.h:4889 net/core/dev.c:3563 net/core/dev.c:3579) [1973.044890][T12742] sch_direct_xmit (net/sched/sch_generic.c:343) [1973.045032][T12742] ? __pfx_sch_direct_xmit (net/sched/sch_generic.c:318) [1973.045174][T12742] __qdisc_run (net/sched/sch_generic.c:416) [1973.045312][T12742] ? __lock_acquire (kernel/locking/lockdep.c:5137) [1973.045452][T12742] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) [1973.045591][T12742] ? __pfx___qdisc_run (net/sched/sch_generic.c:412) [1973.045730][T12742] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:115 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [1973.045868][T12742] ? spin_bug (./include/linux/pid.h:232 kernel/locking/spinlock_debug.c:64 kernel/locking/spinlock_debug.c:78) [1973.045977][T12742] __dev_xmit_skb (./include/net/sch_generic.h:217 net/core/dev.c:3856) [1973.046113][T12742] ? lock_sync (kernel/locking/lockdep.c:122 kernel/locking/lockdep.c:5794) [1973.046216][T12742] ? __pfx___dev_xmit_skb (net/core/dev.c:3767) [1973.046358][T12742] __dev_queue_xmit (net/core/dev.c:4338) [1973.046496][T12742] ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4300 kernel/locking/lockdep.c:4359) [1973.046665][T12742] ? __pfx___dev_queue_xmit (net/core/dev.c:4281) [1973.046804][T12742] ip6_finish_output2 (./include/net/neighbour.h:540 net/ipv6/ip6_output.c:137) [1973.046947][T12742] ip6_finish_output (net/ipv6/ip6_output.c:211 net/ipv6/ip6_output.c:222) [1973.047090][T12742] ip6_output (./include/linux/netfilter.h:303 net/ipv6/ip6_output.c:243) [1973.047194][T12742] ? __pfx_ip6_output (net/ipv6/ip6_output.c:230) [1973.047332][T12742] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) [1973.047475][T12742] ? ip6_local_out (net/ipv6/output_core.c:154) [1973.047616][T12742] ip6_send_skb (net/ipv6/ip6_output.c:1956) [1973.047753][T12742] udp_v6_send_skb (net/ipv6/udp.c:1297) [1973.047893][T12742] udpv6_sendmsg (net/ipv6/udp.c:1592) [1973.048033][T12742] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) [1973.048252][T12742] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:1333) [1973.048399][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.048540][T12742] ? lock_acquire (kernel/locking/lockdep.c:5727) [1973.048675][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.048895][T12742] ? __might_fault (mm/memory.c:6216 mm/memory.c:6209) [1973.049032][T12742] ? __pfx_inet6_sendmsg (net/ipv6/af_inet6.c:652) [1973.049179][T12742] ? ____sys_sendmsg (net/socket.c:730 net/socket.c:745 net/socket.c:2584) [1973.049315][T12742] ____sys_sendmsg (net/socket.c:730 net/socket.c:745 net/socket.c:2584) [1973.049536][T12742] ? __pfx_____sys_sendmsg (net/socket.c:2530) [1973.049675][T12742] ? __pfx_copy_msghdr_from_user (net/socket.c:2510) [1973.049846][T12742] ? lookup_memtype (arch/x86/mm/pat/memtype.c:677) [1973.049984][T12742] ? trace_kfree (./include/trace/events/kmem.h:94 (discriminator 52)) [1973.050123][T12742] ? kfree (mm/slub.c:4379) [1973.050227][T12742] ___sys_sendmsg (net/socket.c:2640) [1973.050363][T12742] ? __pfx____sys_sendmsg (net/socket.c:2627) [1973.050498][T12742] ? udp_lib_setsockopt (net/ipv4/udp.c:2678) [1973.050636][T12742] ? __pfx_udp_lib_setsockopt (net/ipv4/udp.c:2671) [1973.050853][T12742] ? __do_fault (mm/memory.c:4531) [1973.050993][T12742] ? trace_kfree (./include/trace/events/kmem.h:94 (discriminator 52)) [1973.051134][T12742] ? kfree (mm/slub.c:4379) [1973.051239][T12742] ? __pfx_do_sock_setsockopt (net/socket.c:2280) [1973.051456][T12742] ? __fget_light (./include/linux/atomic/atomic-arch-fallback.h:479 ./include/linux/atomic/atomic-instrumented.h:50 fs/file.c:1145) [1973.051598][T12742] __sys_sendmsg (./include/linux/file.h:34 net/socket.c:2669) [1973.051739][T12742] ? __pfx___sys_sendmsg (net/socket.c:2655) [1973.051877][T12742] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2336) [1973.052097][T12742] ? __pfx___sys_setsockopt (net/socket.c:2324) [1973.052240][T12742] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [1973.052377][T12742] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) [ 1973.052550][T12742] RIP: 0033:0x7f055c8a97b7 [ 1973.052857][T12742] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 1973.053348][T12742] RSP: 002b:00007fff828656b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1973.053645][T12742] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f055c8a97b7 [ 1973.053850][T12742] RDX: 0000000000000000 RSI: 00007fff82865730 RDI: 0000000000000005 [ 1973.054053][T12742] RBP: 0000000038d072a0 R08: 0000000000000008 R09: 00007f055c969080 [ 1973.054339][T12742] R10: 00007f055c762708 R11: 0000000000000246 R12: 0000000000000005 Finger prints: dump_stack_lvl:kasan_report:kasan_check_range:sock_def_write_space_wfree sock_def_write_space_wfree:sock_wfree:skb_release_head_state:consume_skb