[ 122.282213][ T1000] u32 classifier [ 122.282368][ T1000] input device check on [ 122.282511][ T1000] Actions configured [ 124.416291][ T1019] gre: GRE over IPv4 demultiplexor driver [ 124.432530][ T1019] ip_gre: GRE over IPv4 tunneling driver [ 129.870488][ T1081] ip6_gre: GRE over IPv6 tunneling driver [ 130.252513][ T61] ip6_tunnel: ip6gretap00 xmit: Local address not yet configured! [ 130.341401][ T61] ip6_tunnel: ip6gretap00 xmit: Local address not yet configured! [ 135.609370][ T66] ip6_tunnel: ip6erspan00 xmit: Local address not yet configured! [ 136.315966][ T10] ip6_tunnel: ip6erspan00 xmit: Local address not yet configured! [ 136.438605][ T11] ip6_tunnel: ip6erspan00 xmit: Local address not yet configured! [ 137.385965][ T1161] test-br0: port 1(test-dummy0) entered blocking state [ 137.387275][ T1161] test-br0: port 1(test-dummy0) entered disabled state [ 137.387657][ T1161] test-dummy0: entered allmulticast mode [ 137.388825][ T1161] test-dummy0: entered promiscuous mode [ 137.550184][ T1165] test-br0: port 1(test-dummy0) entered blocking state [ 137.550570][ T1165] test-br0: port 1(test-dummy0) entered forwarding state [ 140.421683][ T1201] test-dummy0: left allmulticast mode [ 140.421882][ T1201] test-dummy0: left promiscuous mode [ 140.422415][ T1201] test-br0: port 1(test-dummy0) entered disabled state [ 293.937009][ T3428] MACsec IEEE 802.1AE [ 296.125886][ T3431] netdevsim netdevsim0 eni0np1: renamed from eth0 [ 300.117079][ T3495] Initializing XFRM netlink socket [ 304.812422][ T3574] netdevsim netdevsim0 eni0np1: renamed from eth0 [ 310.897485][ T3620] test-br0: port 1(vxlan10) entered blocking state [ 310.897830][ T3620] test-br0: port 1(vxlan10) entered disabled state [ 310.898113][ T3620] vxlan10: entered allmulticast mode [ 310.903857][ T3620] vxlan10: entered promiscuous mode [ 311.859555][ T11] vxlan10: left allmulticast mode [ 311.859863][ T11] vxlan10: left promiscuous mode [ 311.860192][ T11] test-br0: port 1(vxlan10) entered disabled state [ 314.585967][ T3671] netdevsim netdevsim10 eni10np1: renamed from eth0 [ 314.683190][ T3670] netdevsim netdevsim20 eni20np1: renamed from eth1 [ 315.849315][ T3684] test-bond0: (slave eni10np1): Enslaving as a backup interface with an up link [ 316.034867][ T3686] test-bond0: (slave eni20np1): Enslaving as a backup interface with an up link [ 316.410750][ T3697] test-br0: port 1(test-bond0) entered blocking state [ 316.411000][ T3697] test-br0: port 1(test-bond0) entered disabled state [ 316.411903][ T3697] test-bond0: entered allmulticast mode [ 316.412134][ T3697] netdevsim netdevsim10 eni10np1: entered allmulticast mode [ 316.412431][ T3697] netdevsim netdevsim20 eni20np1: entered allmulticast mode [ 316.414105][ T3697] test-bond0: entered promiscuous mode [ 316.414286][ T3697] netdevsim netdevsim10 eni10np1: entered promiscuous mode [ 316.414704][ T3697] netdevsim netdevsim20 eni20np1: entered promiscuous mode [ 316.597038][ T3699] test-bond0: left allmulticast mode [ 316.597302][ T3699] netdevsim netdevsim10 eni10np1: left allmulticast mode [ 316.597514][ T3699] netdevsim netdevsim20 eni20np1: left allmulticast mode [ 316.597721][ T3699] test-bond0: left promiscuous mode [ 316.597883][ T3699] netdevsim netdevsim10 eni10np1: left promiscuous mode [ 316.598229][ T3699] netdevsim netdevsim20 eni20np1: left promiscuous mode [ 316.598676][ T3699] test-br0: port 1(test-bond0) entered disabled state [ 316.814403][ T3700] test-bond0 (unregistering): (slave eni10np1): Releasing backup interface [ 316.832687][ T3700] test-bond0 (unregistering): (slave eni20np1): Releasing backup interface [ 316.856472][ T3700] test-bond0 (unregistering): Released all slaves [ 319.835901][ T3733] ================================================================== [ 319.836125][ T3733] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0+0x629/0x650 [ 319.836332][ T3733] Read of size 8 at addr ffff888008591010 by task ip/3733 [ 319.836501][ T3733] [ 319.836577][ T3733] CPU: 1 UID: 0 PID: 3733 Comm: ip Not tainted 6.12.0-rc3-virtme #1 [ 319.836780][ T3733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 319.837081][ T3733] Call Trace: [ 319.837190][ T3733] [ 319.837262][ T3733] dump_stack_lvl+0x82/0xd0 [ 319.837406][ T3733] print_address_description.constprop.0+0x2c/0x3b0 [ 319.837574][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.837713][ T3733] print_report+0xb4/0x270 [ 319.837849][ T3733] ? kasan_addr_to_slab+0x25/0x80 [ 319.837986][ T3733] kasan_report+0xbd/0xf0 [ 319.838093][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.838228][ T3733] neigh_flush_dev.isra.0+0x629/0x650 [ 319.838362][ T3733] ? lock_acquire+0x32/0xc0 [ 319.838500][ T3733] __neigh_ifdown.isra.0+0x74/0x440 [ 319.838634][ T3733] ? blocking_notifier_call_chain+0x50/0x90 [ 319.838804][ T3733] neigh_ifdown+0x10/0x20 [ 319.838916][ T3733] fib_inetaddr_event+0x1e8/0x280 [ 319.839052][ T3733] notifier_call_chain+0xcd/0x150 [ 319.839192][ T3733] blocking_notifier_call_chain+0x66/0x90 [ 319.839327][ T3733] __inet_del_ifa+0x394/0xcd0 [ 319.839465][ T3733] inet_rtm_deladdr+0x381/0x770 [ 319.839606][ T3733] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 319.839744][ T3733] rtnetlink_rcv_msg+0x2fb/0xc10 [ 319.839880][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.840014][ T3733] ? hlock_class+0x4e/0x130 [ 319.840149][ T3733] ? mark_lock+0x38/0x3e0 [ 319.840254][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.840390][ T3733] netlink_rcv_skb+0x130/0x360 [ 319.840524][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.840659][ T3733] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 319.840796][ T3733] ? netlink_deliver_tap+0x13e/0x340 [ 319.840932][ T3733] ? netlink_deliver_tap+0xc3/0x340 [ 319.841066][ T3733] netlink_unicast+0x44b/0x710 [ 319.841201][ T3733] ? __pfx_netlink_unicast+0x10/0x10 [ 319.841337][ T3733] ? find_held_lock+0x2c/0x110 [ 319.841472][ T3733] netlink_sendmsg+0x723/0xbe0 [ 319.841607][ T3733] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.841739][ T3733] ? __might_fault+0xc3/0x170 [ 319.841875][ T3733] ? __import_iovec+0x35d/0x5d0 [ 319.842013][ T3733] ____sys_sendmsg+0x7ac/0xa10 [ 319.842152][ T3733] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.842284][ T3733] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 319.842458][ T3733] ___sys_sendmsg+0xee/0x170 [ 319.842592][ T3733] ? __pfx_stack_trace_save+0x10/0x10 [ 319.842727][ T3733] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.842861][ T3733] ? __pfx_validate_chain+0x10/0x10 [ 319.842997][ T3733] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 319.843165][ T3733] ? kasan_save_stack+0x34/0x50 [ 319.843299][ T3733] ? kasan_save_stack+0x24/0x50 [ 319.843432][ T3733] ? __kasan_record_aux_stack+0x8e/0xa0 [ 319.843569][ T3733] ? __call_rcu_common.constprop.0+0xa1/0x4b0 [ 319.843734][ T3733] ? __x64_sys_close+0x7c/0xd0 [ 319.843868][ T3733] ? do_syscall_64+0xc1/0x1d0 [ 319.844005][ T3733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.844171][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.844306][ T3733] ? find_held_lock+0x2c/0x110 [ 319.844441][ T3733] ? __lock_release+0x103/0x460 [ 319.844575][ T3733] ? fdget+0x52/0x1e0 [ 319.844680][ T3733] __sys_sendmsg+0xcd/0x170 [ 319.844816][ T3733] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.844949][ T3733] ? __virt_addr_valid+0x22b/0x430 [ 319.845089][ T3733] do_syscall_64+0xc1/0x1d0 [ 319.845227][ T3733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.845393][ T3733] RIP: 0033:0x7f26b96ef7b7 [ 319.845535][ T3733] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 319.846014][ T3733] RSP: 002b:00007ffedaa94eb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.846224][ T3733] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f26b96ef7b7 [ 319.846425][ T3733] RDX: 0000000000000000 RSI: 00007ffedaa94f20 RDI: 0000000000000005 [ 319.846624][ T3733] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 319.846827][ T3733] R10: 00007f26b95adef8 R11: 0000000000000246 R12: 00007ffedaa95670 [ 319.847028][ T3733] R13: 000000006716aaa6 R14: 0000000000496600 R15: 00007ffedaa95678 [ 319.847231][ T3733] [ 319.847334][ T3733] [ 319.847401][ T3733] Allocated by task 3723: [ 319.847504][ T3733] kasan_save_stack+0x24/0x50 [ 319.847644][ T3733] kasan_save_track+0x14/0x30 [ 319.847776][ T3733] __kasan_kmalloc+0x7f/0x90 [ 319.847912][ T3733] __kmalloc_noprof+0x1ab/0x3a0 [ 319.848045][ T3733] p9_fcall_init+0x7d/0x220 [ 319.848183][ T3733] p9_tag_alloc+0x1bd/0x700 [ 319.848316][ T3733] p9_client_prepare_req+0xe6/0x290 [ 319.848448][ T3733] p9_client_rpc+0x18d/0x930 [ 319.848581][ T3733] p9_client_read_once+0x1f1/0x860 [ 319.848716][ T3733] p9_client_read+0xfd/0x160 [ 319.848847][ T3733] v9fs_issue_read+0x10c/0x2d0 [ 319.848995][ T3733] netfs_dispatch_unbuffered_reads.isra.0+0x4e6/0x8f0 [ 319.849162][ T3733] netfs_unbuffered_read+0x8e/0x310 [ 319.849295][ T3733] netfs_unbuffered_read_iter_locked+0x52e/0x6f0 [ 319.849460][ T3733] netfs_unbuffered_read_iter+0xa4/0xe0 [ 319.849594][ T3733] do_iter_readv_writev+0x433/0x670 [ 319.849727][ T3733] vfs_iter_read+0x11e/0x520 [ 319.849862][ T3733] backing_file_read_iter+0x4c8/0x6f0 [ 319.850000][ T3733] ovl_read_iter+0x200/0x270 [ 319.850134][ T3733] vfs_read+0x74c/0xcd0 [ 319.850236][ T3733] ksys_read+0xf5/0x1e0 [ 319.850338][ T3733] do_syscall_64+0xc1/0x1d0 [ 319.850473][ T3733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.850638][ T3733] [ 319.850707][ T3733] Freed by task 1802201963: [ 319.850839][ T3733] ------------[ cut here ]------------ [ 319.850979][ T3733] pool index 93034 out of bounds (846) for stack id 6b6b6b6b [ 319.851221][ T3733] WARNING: CPU: 1 PID: 3733 at lib/stackdepot.c:451 depot_fetch_stack+0x96/0xc0 [ 319.851470][ T3733] Modules linked in: bonding xfrm_user psample macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb [last unloaded: netdevsim] [ 319.851801][ T3733] CPU: 1 UID: 0 PID: 3733 Comm: ip Not tainted 6.12.0-rc3-virtme #1 [ 319.852014][ T3733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 319.852333][ T3733] RIP: 0010:depot_fetch_stack+0x96/0xc0 [ 319.852481][ T3733] Code: 18 a3 ce a1 e8 9b 58 bd 01 83 f8 01 75 b8 90 0f 0b 90 eb b2 90 48 c7 c7 e0 e2 46 a1 44 89 e1 44 89 ea 89 ee e8 3b ad 0c ff 90 <0f> 0b 90 90 31 c0 eb bb 90 0f 0b 90 eb b5 90 0f 0b 90 31 c0 eb ad [ 319.852980][ T3733] RSP: 0018:ffffc9000072f200 EFLAGS: 00010086 [ 319.853161][ T3733] RAX: 0000000000000000 RBX: 0000000000001b50 RCX: 1ffffffff42fdc3c [ 319.853378][ T3733] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 319.853590][ T3733] RBP: 0000000000016b6a R08: 0000000000000000 R09: fffffbfff42fdc3c [ 319.853800][ T3733] R10: 0000000000000003 R11: 205d333337335420 R12: 000000006b6b6b6b [ 319.854012][ T3733] R13: 000000000000034e R14: 0000000000000008 R15: ffff888005208040 [ 319.854228][ T3733] FS: 00007f26b94e3800(0000) GS:ffff88802f480000(0000) knlGS:0000000000000000 [ 319.854473][ T3733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 319.854652][ T3733] CR2: 00000000004e2d90 CR3: 0000000009c94005 CR4: 0000000000772ef0 [ 319.854865][ T3733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 319.855076][ T3733] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 319.855294][ T3733] PKRU: 55555554 [ 319.855403][ T3733] Call Trace: [ 319.855513][ T3733] [ 319.855593][ T3733] ? depot_fetch_stack+0x96/0xc0 [ 319.855736][ T3733] ? __warn+0xd1/0x1c0 [ 319.855845][ T3733] ? depot_fetch_stack+0x96/0xc0 [ 319.855989][ T3733] ? report_bug+0x28c/0x2d0 [ 319.856133][ T3733] ? handle_bug+0x54/0xa0 [ 319.856241][ T3733] ? exc_invalid_op+0x18/0x50 [ 319.856384][ T3733] ? asm_exc_invalid_op+0x1a/0x20 [ 319.856533][ T3733] ? depot_fetch_stack+0x96/0xc0 [ 319.856676][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.856817][ T3733] stack_depot_fetch+0x42/0x80 [ 319.856960][ T3733] stack_depot_print+0x20/0x60 [ 319.857103][ T3733] print_address_description.constprop.0+0x335/0x3b0 [ 319.857285][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.857426][ T3733] print_report+0xb4/0x270 [ 319.857568][ T3733] ? kasan_addr_to_slab+0x25/0x80 [ 319.857713][ T3733] kasan_report+0xbd/0xf0 [ 319.857821][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.857964][ T3733] neigh_flush_dev.isra.0+0x629/0x650 [ 319.858105][ T3733] ? lock_acquire+0x32/0xc0 [ 319.858248][ T3733] __neigh_ifdown.isra.0+0x74/0x440 [ 319.858390][ T3733] ? blocking_notifier_call_chain+0x50/0x90 [ 319.858567][ T3733] neigh_ifdown+0x10/0x20 [ 319.858673][ T3733] fib_inetaddr_event+0x1e8/0x280 [ 319.858818][ T3733] notifier_call_chain+0xcd/0x150 [ 319.858968][ T3733] blocking_notifier_call_chain+0x66/0x90 [ 319.859110][ T3733] __inet_del_ifa+0x394/0xcd0 [ 319.859255][ T3733] inet_rtm_deladdr+0x381/0x770 [ 319.859396][ T3733] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 319.859542][ T3733] rtnetlink_rcv_msg+0x2fb/0xc10 [ 319.859685][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.859826][ T3733] ? hlock_class+0x4e/0x130 [ 319.859968][ T3733] ? mark_lock+0x38/0x3e0 [ 319.860079][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.860223][ T3733] netlink_rcv_skb+0x130/0x360 [ 319.860364][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.860506][ T3733] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 319.860650][ T3733] ? netlink_deliver_tap+0x13e/0x340 [ 319.860794][ T3733] ? netlink_deliver_tap+0xc3/0x340 [ 319.860936][ T3733] netlink_unicast+0x44b/0x710 [ 319.861077][ T3733] ? __pfx_netlink_unicast+0x10/0x10 [ 319.861221][ T3733] ? find_held_lock+0x2c/0x110 [ 319.861365][ T3733] netlink_sendmsg+0x723/0xbe0 [ 319.861509][ T3733] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.861649][ T3733] ? __might_fault+0xc3/0x170 [ 319.861790][ T3733] ? __import_iovec+0x35d/0x5d0 [ 319.861934][ T3733] ____sys_sendmsg+0x7ac/0xa10 [ 319.862080][ T3733] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.862222][ T3733] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 319.862403][ T3733] ___sys_sendmsg+0xee/0x170 [ 319.862546][ T3733] ? __pfx_stack_trace_save+0x10/0x10 [ 319.862690][ T3733] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.862831][ T3733] ? __pfx_validate_chain+0x10/0x10 [ 319.862972][ T3733] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 319.863148][ T3733] ? kasan_save_stack+0x34/0x50 [ 319.863291][ T3733] ? kasan_save_stack+0x24/0x50 [ 319.863434][ T3733] ? __kasan_record_aux_stack+0x8e/0xa0 [ 319.863579][ T3733] ? __call_rcu_common.constprop.0+0xa1/0x4b0 [ 319.863755][ T3733] ? __x64_sys_close+0x7c/0xd0 [ 319.863897][ T3733] ? do_syscall_64+0xc1/0x1d0 [ 319.864038][ T3733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.864213][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.864358][ T3733] ? find_held_lock+0x2c/0x110 [ 319.864502][ T3733] ? __lock_release+0x103/0x460 [ 319.864642][ T3733] ? fdget+0x52/0x1e0 [ 319.864755][ T3733] __sys_sendmsg+0xcd/0x170 [ 319.864896][ T3733] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.865128][ T3733] ? __virt_addr_valid+0x22b/0x430 [ 319.865276][ T3733] do_syscall_64+0xc1/0x1d0 [ 319.865418][ T3733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.865594][ T3733] RIP: 0033:0x7f26b96ef7b7 [ 319.865742][ T3733] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 319.866249][ T3733] RSP: 002b:00007ffedaa94eb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.866462][ T3733] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f26b96ef7b7 [ 319.866674][ T3733] RDX: 0000000000000000 RSI: 00007ffedaa94f20 RDI: 0000000000000005 [ 319.866883][ T3733] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 319.867203][ T3733] R10: 00007f26b95adef8 R11: 0000000000000246 R12: 00007ffedaa95670 [ 319.867416][ T3733] R13: 000000006716aaa6 R14: 0000000000496600 R15: 00007ffedaa95678 [ 319.867630][ T3733] [ 319.867827][ T3733] irq event stamp: 62777 [ 319.867934][ T3733] hardirqs last enabled at (62775): [] _raw_spin_unlock_irqrestore+0x51/0x70 [ 319.868222][ T3733] hardirqs last disabled at (62777): [] _raw_spin_lock_irqsave+0x58/0x60 [ 319.868588][ T3733] softirqs last enabled at (62462): [] netlink_release+0x139/0xc00 [ 319.868832][ T3733] softirqs last disabled at (62776): [] __neigh_ifdown.isra.0+0x2e/0x440 [ 319.869209][ T3733] ---[ end trace 0000000000000000 ]--- [ 319.869350][ T3733] ------------[ cut here ]------------ [ 319.869489][ T3733] corrupt handle or use after stack_depot_put() [ 319.869518][ T3733] WARNING: CPU: 1 PID: 3733 at lib/stackdepot.c:711 stack_depot_fetch+0x6f/0x80 [ 319.869927][ T3733] Modules linked in: bonding xfrm_user psample macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb [last unloaded: netdevsim] [ 319.870249][ T3733] CPU: 1 UID: 0 PID: 3733 Comm: ip Tainted: G W 6.12.0-rc3-virtme #1 [ 319.870494][ T3733] Tainted: [W]=WARN [ 319.870607][ T3733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 319.870918][ T3733] RIP: 0010:stack_depot_fetch+0x6f/0x80 [ 319.871152][ T3733] Code: 74 1a 48 8d 50 20 48 89 13 5b 8b 40 14 5d 41 5c c3 cc cc cc cc 31 c0 c3 cc cc cc cc 90 48 c7 c7 c0 e3 46 a1 e8 22 a8 0c ff 90 <0f> 0b 90 90 eb bb 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 319.871740][ T3733] RSP: 0018:ffffc9000072f228 EFLAGS: 00010086 [ 319.871917][ T3733] RAX: 0000000000000000 RBX: ffffc9000072f248 RCX: 1ffffffff42fdc3c [ 319.872125][ T3733] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 [ 319.872421][ T3733] RBP: 000000006b6b6b6b R08: 0000000000000000 R09: fffffbfff42fdc3c [ 319.872628][ T3733] R10: 0000000000000003 R11: 65737520726f2065 R12: 0000000000000000 [ 319.872843][ T3733] R13: ffffffff9fcc6f49 R14: 0000000000000008 R15: ffff888005208040 [ 319.873235][ T3733] FS: 00007f26b94e3800(0000) GS:ffff88802f480000(0000) knlGS:0000000000000000 [ 319.873477][ T3733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 319.873652][ T3733] CR2: 00000000004e2d90 CR3: 0000000009c94005 CR4: 0000000000772ef0 [ 319.873863][ T3733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 319.874074][ T3733] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 319.874283][ T3733] PKRU: 55555554 [ 319.874390][ T3733] Call Trace: [ 319.874495][ T3733] [ 319.874566][ T3733] ? stack_depot_fetch+0x6f/0x80 [ 319.874705][ T3733] ? __warn+0xd1/0x1c0 [ 319.874811][ T3733] ? nbcon_get_cpu_emergency_nesting+0xa/0x30 [ 319.875072][ T3733] ? stack_depot_fetch+0x6f/0x80 [ 319.875215][ T3733] ? report_bug+0x28c/0x2d0 [ 319.875361][ T3733] ? handle_bug+0x54/0xa0 [ 319.875467][ T3733] ? exc_invalid_op+0x18/0x50 [ 319.875608][ T3733] ? asm_exc_invalid_op+0x1a/0x20 [ 319.875833][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.875974][ T3733] ? stack_depot_fetch+0x6f/0x80 [ 319.876114][ T3733] ? stack_depot_fetch+0x6e/0x80 [ 319.876254][ T3733] stack_depot_print+0x20/0x60 [ 319.876481][ T3733] print_address_description.constprop.0+0x335/0x3b0 [ 319.876659][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.876798][ T3733] print_report+0xb4/0x270 [ 319.876937][ T3733] ? kasan_addr_to_slab+0x25/0x80 [ 319.877165][ T3733] kasan_report+0xbd/0xf0 [ 319.877272][ T3733] ? neigh_flush_dev.isra.0+0x629/0x650 [ 319.877414][ T3733] neigh_flush_dev.isra.0+0x629/0x650 [ 319.877552][ T3733] ? lock_acquire+0x32/0xc0 [ 319.877694][ T3733] __neigh_ifdown.isra.0+0x74/0x440 [ 319.877836][ T3733] ? blocking_notifier_call_chain+0x50/0x90 [ 319.878011][ T3733] neigh_ifdown+0x10/0x20 [ 319.878117][ T3733] fib_inetaddr_event+0x1e8/0x280 [ 319.878258][ T3733] notifier_call_chain+0xcd/0x150 [ 319.878403][ T3733] blocking_notifier_call_chain+0x66/0x90 [ 319.878544][ T3733] __inet_del_ifa+0x394/0xcd0 [ 319.878687][ T3733] inet_rtm_deladdr+0x381/0x770 [ 319.878827][ T3733] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 319.879073][ T3733] rtnetlink_rcv_msg+0x2fb/0xc10 [ 319.879215][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.879355][ T3733] ? hlock_class+0x4e/0x130 [ 319.879495][ T3733] ? mark_lock+0x38/0x3e0 [ 319.879602][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.879826][ T3733] netlink_rcv_skb+0x130/0x360 [ 319.879965][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.880105][ T3733] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 319.880248][ T3733] ? netlink_deliver_tap+0x13e/0x340 [ 319.880478][ T3733] ? netlink_deliver_tap+0xc3/0x340 [ 319.880620][ T3733] netlink_unicast+0x44b/0x710 [ 319.880760][ T3733] ? __pfx_netlink_unicast+0x10/0x10 [ 319.880900][ T3733] ? find_held_lock+0x2c/0x110 [ 319.881128][ T3733] netlink_sendmsg+0x723/0xbe0 [ 319.881269][ T3733] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.881408][ T3733] ? __might_fault+0xc3/0x170 [ 319.881549][ T3733] ? __import_iovec+0x35d/0x5d0 [ 319.881781][ T3733] ____sys_sendmsg+0x7ac/0xa10 [ 319.881922][ T3733] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.882062][ T3733] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 319.882240][ T3733] ___sys_sendmsg+0xee/0x170 [ 319.882464][ T3733] ? __pfx_stack_trace_save+0x10/0x10 [ 319.882606][ T3733] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.882746][ T3733] ? __pfx_validate_chain+0x10/0x10 [ 319.882889][ T3733] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 319.883156][ T3733] ? kasan_save_stack+0x34/0x50 [ 319.883295][ T3733] ? kasan_save_stack+0x24/0x50 [ 319.883435][ T3733] ? __kasan_record_aux_stack+0x8e/0xa0 [ 319.883572][ T3733] ? __call_rcu_common.constprop.0+0xa1/0x4b0 [ 319.883830][ T3733] ? __x64_sys_close+0x7c/0xd0 [ 319.883970][ T3733] ? do_syscall_64+0xc1/0x1d0 [ 319.884109][ T3733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.884285][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.884512][ T3733] ? find_held_lock+0x2c/0x110 [ 319.884654][ T3733] ? __lock_release+0x103/0x460 [ 319.884795][ T3733] ? fdget+0x52/0x1e0 [ 319.884905][ T3733] __sys_sendmsg+0xcd/0x170 [ 319.885045][ T3733] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.885287][ T3733] ? __virt_addr_valid+0x22b/0x430 [ 319.885431][ T3733] do_syscall_64+0xc1/0x1d0 [ 319.885571][ T3733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.885747][ T3733] RIP: 0033:0x7f26b96ef7b7 [ 319.885895][ T3733] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 319.886388][ T3733] RSP: 002b:00007ffedaa94eb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.886596][ T3733] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f26b96ef7b7 [ 319.886809][ T3733] RDX: 0000000000000000 RSI: 00007ffedaa94f20 RDI: 0000000000000005 [ 319.887108][ T3733] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 319.887316][ T3733] R10: 00007f26b95adef8 R11: 0000000000000246 R12: 00007ffedaa95670 [ 319.887525][ T3733] R13: 000000006716aaa6 R14: 0000000000496600 R15: 00007ffedaa95678 [ 319.887739][ T3733] [ 319.887849][ T3733] irq event stamp: 62777 [ 319.887953][ T3733] hardirqs last enabled at (62775): [] _raw_spin_unlock_irqrestore+0x51/0x70 [ 319.888227][ T3733] hardirqs last disabled at (62777): [] _raw_spin_lock_irqsave+0x58/0x60 [ 319.888585][ T3733] softirqs last enabled at (62462): [] netlink_release+0x139/0xc00 [ 319.888825][ T3733] softirqs last disabled at (62776): [] __neigh_ifdown.isra.0+0x2e/0x440 [ 319.889194][ T3733] ---[ end trace 0000000000000000 ]--- [ 319.889332][ T3733] [ 319.889400][ T3733] The buggy address belongs to the object at ffff888008591000 [ 319.889400][ T3733] which belongs to the cache kmalloc-1k of size 1024 [ 319.889794][ T3733] The buggy address is located 16 bytes inside of [ 319.889794][ T3733] freed 1024-byte region [ffff888008591000, ffff888008591400) [ 319.890115][ T3733] [ 319.890182][ T3733] The buggy address belongs to the physical page: [ 319.890420][ T3733] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888008597000 pfn:0x8590 [ 319.890689][ T3733] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 319.890969][ T3733] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 319.891142][ T3733] page_type: f5(slab) [ 319.891251][ T3733] raw: 0080000000000240 ffff8880010430c0 ffffea0000189010 ffffea0000170610 [ 319.891490][ T3733] raw: ffff888008597000 00000000000a0001 00000001f5000000 0000000000000000 [ 319.891807][ T3733] head: 0080000000000240 ffff8880010430c0 ffffea0000189010 ffffea0000170610 [ 319.892042][ T3733] head: ffff888008597000 00000000000a0001 00000001f5000000 0000000000000000 [ 319.892359][ T3733] head: 0080000000000003 ffffea0000216401 ffffffffffffffff 0000000000000000 [ 319.892596][ T3733] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 319.892828][ T3733] page dumped because: kasan: bad access detected [ 319.893071][ T3733] [ 319.893138][ T3733] Memory state around the buggy address: [ 319.893267][ T3733] ffff888008590f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 319.893462][ T3733] ffff888008590f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 319.893742][ T3733] >ffff888008591000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 319.893935][ T3733] ^ [ 319.894064][ T3733] ffff888008591080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 319.894345][ T3733] ffff888008591100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 319.894537][ T3733] ================================================================== [ 319.894744][ T3733] Disabling lock debugging due to kernel taint [ 319.894926][ T3733] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d6d: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 319.895244][ T3733] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6b68-0x6b6b6b6b6b6b6b6f] [ 319.895536][ T3733] CPU: 1 UID: 0 PID: 3733 Comm: ip Tainted: G B W 6.12.0-rc3-virtme #1 [ 319.895769][ T3733] Tainted: [B]=BAD_PAGE, [W]=WARN [ 319.895902][ T3733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 319.896266][ T3733] RIP: 0010:neigh_flush_dev.isra.0+0x10a/0x650 [ 319.896432][ T3733] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d [ 319.897021][ T3733] RSP: 0018:ffffc9000072f388 EFLAGS: 00010202 [ 319.897185][ T3733] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffff9fcc6ef0 [ 319.897460][ T3733] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888008591008 [ 319.897653][ T3733] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000001 R09: fffffbfff4677680 [ 319.897853][ T3733] R10: ffffffffa33bb407 R11: 205d333337335420 R12: ffff88800859113c [ 319.898150][ T3733] R13: dffffc0000000000 R14: ffff88800853c000 R15: ffff888008591000 [ 319.898371][ T3733] FS: 00007f26b94e3800(0000) GS:ffff88802f480000(0000) knlGS:0000000000000000 [ 319.898699][ T3733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 319.898861][ T3733] CR2: 00000000004e2d90 CR3: 0000000009c94005 CR4: 0000000000772ef0 [ 319.899063][ T3733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 319.899339][ T3733] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 319.899533][ T3733] PKRU: 55555554 [ 319.899631][ T3733] Call Trace: [ 319.899731][ T3733] [ 319.899798][ T3733] ? die_addr+0x41/0xa0 [ 319.899976][ T3733] ? exc_general_protection+0x14d/0x230 [ 319.900108][ T3733] ? asm_exc_general_protection+0x26/0x30 [ 319.900239][ T3733] ? neigh_flush_dev.isra.0+0x5d0/0x650 [ 319.900371][ T3733] ? neigh_flush_dev.isra.0+0x10a/0x650 [ 319.900500][ T3733] ? neigh_flush_dev.isra.0+0x5d0/0x650 [ 319.900704][ T3733] ? lock_acquire+0x32/0xc0 [ 319.900836][ T3733] __neigh_ifdown.isra.0+0x74/0x440 [ 319.900965][ T3733] ? blocking_notifier_call_chain+0x50/0x90 [ 319.901127][ T3733] neigh_ifdown+0x10/0x20 [ 319.901302][ T3733] fib_inetaddr_event+0x1e8/0x280 [ 319.901436][ T3733] notifier_call_chain+0xcd/0x150 [ 319.901566][ T3733] blocking_notifier_call_chain+0x66/0x90 [ 319.901696][ T3733] __inet_del_ifa+0x394/0xcd0 [ 319.901903][ T3733] inet_rtm_deladdr+0x381/0x770 [ 319.902036][ T3733] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 319.902169][ T3733] rtnetlink_rcv_msg+0x2fb/0xc10 [ 319.902299][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.902504][ T3733] ? hlock_class+0x4e/0x130 [ 319.902633][ T3733] ? mark_lock+0x38/0x3e0 [ 319.902735][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.902864][ T3733] netlink_rcv_skb+0x130/0x360 [ 319.902992][ T3733] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 319.903201][ T3733] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 319.903333][ T3733] ? netlink_deliver_tap+0x13e/0x340 [ 319.903463][ T3733] ? netlink_deliver_tap+0xc3/0x340 [ 319.903593][ T3733] netlink_unicast+0x44b/0x710 [ 319.903724][ T3733] ? __pfx_netlink_unicast+0x10/0x10 [ 319.903855][ T3733] ? find_held_lock+0x2c/0x110 [ 319.903986][ T3733] netlink_sendmsg+0x723/0xbe0 [ 319.904115][ T3733] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.904393][ T3733] ? __might_fault+0xc3/0x170 [ 319.904522][ T3733] ? __import_iovec+0x35d/0x5d0 [ 319.904653][ T3733] ____sys_sendmsg+0x7ac/0xa10 [ 319.904783][ T3733] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.904912][ T3733] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 319.905155][ T3733] ___sys_sendmsg+0xee/0x170 [ 319.905284][ T3733] ? __pfx_stack_trace_save+0x10/0x10 [ 319.905414][ T3733] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.905542][ T3733] ? __pfx_validate_chain+0x10/0x10 [ 319.905746][ T3733] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 319.905906][ T3733] ? kasan_save_stack+0x34/0x50 [ 319.906033][ T3733] ? kasan_save_stack+0x24/0x50 [ 319.906161][ T3733] ? __kasan_record_aux_stack+0x8e/0xa0 [ 319.906369][ T3733] ? __call_rcu_common.constprop.0+0xa1/0x4b0 [ 319.906528][ T3733] ? __x64_sys_close+0x7c/0xd0 [ 319.906656][ T3733] ? do_syscall_64+0xc1/0x1d0 [ 319.906785][ T3733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.907018][ T3733] ? __lock_acquire+0xb3f/0x1580 [ 319.907148][ T3733] ? find_held_lock+0x2c/0x110 [ 319.907279][ T3733] ? __lock_release+0x103/0x460 [ 319.907407][ T3733] ? fdget+0x52/0x1e0 [ 319.907587][ T3733] __sys_sendmsg+0xcd/0x170 [ 319.907719][ T3733] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.907881][ T3733] ? __virt_addr_valid+0x22b/0x430 [ 319.908016][ T3733] do_syscall_64+0xc1/0x1d0 [ 319.908264][ T3733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.908461][ T3733] RIP: 0033:0x7f26b96ef7b7 [ 319.908599][ T3733] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 319.909084][ T3733] RSP: 002b:00007ffedaa94eb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.909287][ T3733] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f26b96ef7b7 [ 319.909500][ T3733] RDX: 0000000000000000 RSI: 00007ffedaa94f20 RDI: 0000000000000005 [ 319.909699][ T3733] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000078 [ 319.909919][ T3733] R10: 00007f26b95adef8 R11: 0000000000000246 R12: 00007ffedaa95670 [ 319.910213][ T3733] R13: 000000006716aaa6 R14: 0000000000496600 R15: 00007ffedaa95678 [ 319.910419][ T3733] [ 319.910519][ T3733] Modules linked in: bonding xfrm_user psample macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb [last unloaded: netdevsim] [ 319.910952][ T3733] ---[ end trace 0000000000000000 ]--- [ 319.911111][ T3733] RIP: 0010:neigh_flush_dev.isra.0+0x10a/0x650 [ 319.911281][ T3733] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d [ 319.911848][ T3733] RSP: 0018:ffffc9000072f388 EFLAGS: 00010202 [ 319.912019][ T3733] RAX: 0d6d6d6d6d6d6d6d RBX: 6b6b6b6b6b6b6b6b RCX: ffffffff9fcc6ef0 [ 319.912349][ T3733] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888008591008 [ 319.912558][ T3733] RBP: 6b6b6b6b6b6b6b6b R08: 0000000000000001 R09: fffffbfff4677680 [ 319.912749][ T3733] R10: ffffffffa33bb407 R11: 205d333337335420 R12: ffff88800859113c [ 319.912959][ T3733] R13: dffffc0000000000 R14: ffff88800853c000 R15: ffff888008591000 [ 319.913159][ T3733] FS: 00007f26b94e3800(0000) GS:ffff88802f480000(0000) knlGS:0000000000000000 [ 319.913463][ T3733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 319.913625][ T3733] CR2: 00000000004e2d90 CR3: 0000000009c94005 CR4: 0000000000772ef0 [ 319.913819][ T3733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 319.914095][ T3733] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 319.914290][ T3733] PKRU: 55555554 [ 319.914389][ T3733] Kernel panic - not syncing: Fatal exception in interrupt [ 319.914819][ T3733] Kernel Offset: 0x1c800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 319.915278][ T3733] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr