[ 82.425380][ T1394] udpgso_bench_tx (1394) used greatest stack depth: 24016 bytes left [ 83.508181][ T1409] ip (1409) used greatest stack depth: 23360 bytes left [ 85.707903][ T50] ================================================================== [ 85.708216][ T50] BUG: KASAN: use-after-free in page_pool_item_uninit+0x100/0x130 [ 85.708428][ T50] Read of size 8 at addr ffff88800ca28008 by task kworker/2:1/50 [ 85.708631][ T50] [ 85.708704][ T50] CPU: 2 UID: 0 PID: 50 Comm: kworker/2:1 Not tainted 6.13.0-rc5-virtme #1 [ 85.708953][ T50] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 85.709129][ T50] Workqueue: events page_pool_release_retry [ 85.709308][ T50] Call Trace: [ 85.709414][ T50] [ 85.709489][ T50] dump_stack_lvl+0x82/0xd0 [ 85.709638][ T50] print_address_description.constprop.0+0x2c/0x3b0 [ 85.709819][ T50] ? page_pool_item_uninit+0x100/0x130 [ 85.709962][ T50] print_report+0xb4/0x270 [ 85.710102][ T50] ? kasan_addr_to_slab+0x25/0x80 [ 85.710246][ T50] kasan_report+0xbd/0xf0 [ 85.710352][ T50] ? page_pool_item_uninit+0x100/0x130 [ 85.710492][ T50] page_pool_item_uninit+0x100/0x130 [ 85.710634][ T50] page_pool_release+0x44a/0x5b0 [ 85.710769][ T50] ? __pfx_page_pool_release+0x10/0x10 [ 85.710907][ T50] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 85.711049][ T50] ? trace_lock_acquire+0x14c/0x1f0 [ 85.711186][ T50] ? trace_lock_acquire+0x14c/0x1f0 [ 85.711322][ T50] page_pool_release_retry+0x21/0x290 [ 85.711455][ T50] ? trace_workqueue_execute_start+0xe7/0x150 [ 85.711634][ T50] process_one_work+0xe55/0x16d0 [ 85.711780][ T50] ? __pfx___lock_release+0x10/0x10 [ 85.711918][ T50] ? __pfx_process_one_work+0x10/0x10 [ 85.712055][ T50] ? assign_work+0x16c/0x240 [ 85.712192][ T50] worker_thread+0x58c/0xce0 [ 85.712330][ T50] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 85.712502][ T50] ? __pfx_worker_thread+0x10/0x10 [ 85.712636][ T50] ? __pfx_worker_thread+0x10/0x10 [ 85.712775][ T50] kthread+0x28a/0x350 [ 85.712883][ T50] ? __pfx_kthread+0x10/0x10 [ 85.713021][ T50] ret_from_fork+0x31/0x70 [ 85.713163][ T50] ? __pfx_kthread+0x10/0x10 [ 85.713308][ T50] ret_from_fork_asm+0x1a/0x30 [ 85.713453][ T50] [ 85.713558][ T50] [ 85.713629][ T50] The buggy address belongs to the physical page: [ 85.713811][ T50] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xca28 [ 85.714057][ T50] flags: 0x80000000000000(node=0|zone=1) [ 85.714200][ T50] page_type: f5(slab) [ 85.714309][ T50] raw: 0080000000000000 ffff8880010427c0 ffffea00001d5c50 ffffea00004229d0 [ 85.714555][ T50] raw: 0000000000000000 0000000000190019 00000001f5000000 0000000000000000 [ 85.714798][ T50] page dumped because: kasan: bad access detected [ 85.714969][ T50] [ 85.715040][ T50] Memory state around the buggy address: [ 85.715174][ T50] ffff88800ca27f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 85.715373][ T50] ffff88800ca27f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 85.715574][ T50] >ffff88800ca28000: fc fc fa fb fc fc fc fc fc fc fc fc fc fc fc fc [ 85.715775][ T50] ^ [ 85.715877][ T50] ffff88800ca28080: fc fc fc fc fc fc fa fb fc fc fc fc fc fc fc fc [ 85.716073][ T50] ffff88800ca28100: fc fc fc fc fc fc fc fc fc fc fa fb fc fc fc fc [ 85.716272][ T50] ================================================================== [ 85.716533][ T50] Disabling lock debugging due to kernel taint [ 85.716737][ T50] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 85.717088][ T50] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7] [ 85.717314][ T50] CPU: 2 UID: 0 PID: 50 Comm: kworker/2:1 Tainted: G B 6.13.0-rc5-virtme #1 [ 85.717594][ T50] Tainted: [B]=BAD_PAGE [ 85.717699][ T50] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 85.717870][ T50] Workqueue: events page_pool_release_retry [ 85.718046][ T50] RIP: 0010:page_pool_item_uninit+0x7a/0x130 [ 85.718222][ T50] Code: 8d 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41 [ 85.718799][ T50] RSP: 0018:ffffc9000036fbc0 EFLAGS: 00010a06 [ 85.719034][ T50] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff8c09f6e3 [ 85.719237][ T50] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0 [ 85.719442][ T50] RBP: fffffbfff1ae4c78 R08: 0000000000000000 R09: fffffbfff1ebf688 [ 85.719709][ T50] R10: ffffffff8f5fb447 R11: 205d303554202020 R12: ffff88800af8e620 [ 85.719913][ T50] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea00004229c0 [ 85.720117][ T50] FS: 0000000000000000(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 85.720419][ T50] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.720591][ T50] CR2: 00007fe7dff662f0 CR3: 000000000cef8006 CR4: 0000000000772ef0 [ 85.720865][ T50] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 85.721071][ T50] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 85.721274][ T50] PKRU: 55555554 [ 85.721439][ T50] Call Trace: [ 85.721540][ T50] [ 85.721613][ T50] ? die_addr+0x41/0xa0 [ 85.721722][ T50] ? exc_general_protection+0x14d/0x230 [ 85.721863][ T50] ? asm_exc_general_protection+0x26/0x30 [ 85.722071][ T50] ? page_pool_item_uninit+0x73/0x130 [ 85.722208][ T50] ? page_pool_item_uninit+0x7a/0x130 [ 85.722343][ T50] page_pool_release+0x44a/0x5b0 [ 85.722482][ T50] ? __pfx_page_pool_release+0x10/0x10 [ 85.722681][ T50] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 85.722819][ T50] ? trace_lock_acquire+0x14c/0x1f0 [ 85.722959][ T50] ? trace_lock_acquire+0x14c/0x1f0 [ 85.723100][ T50] page_pool_release_retry+0x21/0x290 [ 85.723299][ T50] ? trace_workqueue_execute_start+0xe7/0x150 [ 85.723467][ T50] process_one_work+0xe55/0x16d0 [ 85.723610][ T50] ? __pfx___lock_release+0x10/0x10 [ 85.723748][ T50] ? __pfx_process_one_work+0x10/0x10 [ 85.723959][ T50] ? assign_work+0x16c/0x240 [ 85.724096][ T50] worker_thread+0x58c/0xce0 [ 85.724231][ T50] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 85.724397][ T50] ? __pfx_worker_thread+0x10/0x10 [ 85.724597][ T50] ? __pfx_worker_thread+0x10/0x10 [ 85.724730][ T50] kthread+0x28a/0x350 [ 85.724833][ T50] ? __pfx_kthread+0x10/0x10 [ 85.724970][ T50] ret_from_fork+0x31/0x70 [ 85.725180][ T50] ? __pfx_kthread+0x10/0x10 [ 85.725316][ T50] ret_from_fork_asm+0x1a/0x30 [ 85.725453][ T50] [ 85.725553][ T50] Modules linked in: cls_bpf sch_ingress [ 85.725728][ T50] ---[ end trace 0000000000000000 ]--- [ 85.725973][ T50] RIP: 0010:page_pool_item_uninit+0x7a/0x130 [ 85.726162][ T50] Code: 8d 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41 [ 85.726719][ T50] RSP: 0018:ffffc9000036fbc0 EFLAGS: 00010a06 [ 85.726920][ T50] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff8c09f6e3 [ 85.727132][ T50] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0 [ 85.727344][ T50] RBP: fffffbfff1ae4c78 R08: 0000000000000000 R09: fffffbfff1ebf688 [ 85.727559][ T50] R10: ffffffff8f5fb447 R11: 205d303554202020 R12: ffff88800af8e620 [ 85.727767][ T50] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea00004229c0 [ 85.727983][ T50] FS: 0000000000000000(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000 [ 85.728230][ T50] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.728413][ T50] CR2: 00007fe7dff662f0 CR3: 000000000cef8006 CR4: 0000000000772ef0 [ 85.728625][ T50] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 85.728912][ T50] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 85.729123][ T50] PKRU: 55555554 [ 85.729301][ T50] Kernel panic - not syncing: Fatal exception [ 85.729666][ T50] Kernel Offset: 0x8a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 85.729972][ T50] ---[ end Kernel panic - not syncing: Fatal exception ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr