======================================
| [   11.126659] ip (629) used greatest stack depth: 12328 bytes left
| [   21.171131] ------------[ cut here ]------------
| [   21.171174] kernel BUG at net/core/skbuff.c:2813!
| [   21.171209] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[   21.171286] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   21.171350] RIP: 0010:__pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[ 21.171387] Code: 44 24 10 e8 ad e4 81 ff 49 8b be c0 00 00 00 44 8b 44 24 10 41 8b 8e bc 00 00 00 e9 f4 fc ff ff 4c 8d 48 ff e9 41 fd ff ff 90 <0f> 0b 48 c7 44 24 10 00 00 00 00 e9 99 fe ff ff 41 f6 44 24 7e 20
All code
========
   0:	44 24 10             	rex.R and $0x10,%al
   3:	e8 ad e4 81 ff       	call   0xffffffffff81e4b5
   8:	49 8b be c0 00 00 00 	mov    0xc0(%r14),%rdi
   f:	44 8b 44 24 10       	mov    0x10(%rsp),%r8d
  14:	41 8b 8e bc 00 00 00 	mov    0xbc(%r14),%ecx
  1b:	e9 f4 fc ff ff       	jmp    0xfffffffffffffd14
  20:	4c 8d 48 ff          	lea    -0x1(%rax),%r9
  24:	e9 41 fd ff ff       	jmp    0xfffffffffffffd6a
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	48 c7 44 24 10 00 00 	movq   $0x0,0x10(%rsp)
  33:	00 00 
  35:	e9 99 fe ff ff       	jmp    0xfffffffffffffed3
  3a:	41 f6 44 24 7e 20    	testb  $0x20,0x7e(%r12)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	48 c7 44 24 10 00 00 	movq   $0x0,0x10(%rsp)
   9:	00 00 
   b:	e9 99 fe ff ff       	jmp    0xfffffffffffffea9
  10:	41 f6 44 24 7e 20    	testb  $0x20,0x7e(%r12)
[   21.171483] RSP: 0018:ffffabe340114858 EFLAGS: 00010282
[   21.171514] RAX: 00000000fffffff2 RBX: 00000000000007b4 RCX: 00000000000007b4
[   21.171559] RDX: ffff9da8026847e0 RSI: 0000000000001ec0 RDI: 0000000000000000
[   21.171603] RBP: ffffabe340114898 R08: 0000000000000000 R09: 0000000000000000
[   21.171648] R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000001c
[   21.171686] R13: 00000000000007b4 R14: ffff9da80273a000 R15: 0000000000000000
[   21.171727] FS:  00007f839c1d5740(0000) GS:ffff9da83ed00000(0000) knlGS:0000000000000000
[   21.171771] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   21.171808] CR2: 0000562193cbb000 CR3: 0000000003340004 CR4: 0000000000770ef0
[   21.171854] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   21.171897] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   21.171936] PKRU: 55555554
[   21.171948] Call Trace:
[   21.171965]  <IRQ>
[   21.171981] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) 
[   21.172010] ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) 
[   21.172035] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[   21.172060] ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) 
[   21.172085] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[   21.172111] ? exc_invalid_op (arch/x86/kernel/traps.c:265) 
[   21.172136] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[   21.172162] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[   21.172187] ? __pskb_pull_tail (net/core/skbuff.c:2813 (discriminator 1)) 
[   21.172212] ? __pskb_pull_tail (net/core/skbuff.c:2813) 
[   21.172239] tcf_csum_skb_nextlayer (./include/linux/skbuff.h:2731 ./include/linux/skbuff.h:2739 net/sched/act_csum.c:140) act_csum
[   21.172273] tcf_csum_ipv4_udp (net/sched/act_csum.c:271) act_csum
[   21.172304] tcf_csum_act (net/sched/act_csum.c:423 net/sched/act_csum.c:592) act_csum
[   21.172336] tcf_action_exec (./include/net/tc_wrapper.h:130 net/sched/act_api.c:1100 net/sched/act_api.c:1074) 
[   21.172363] fl_classify (net/sched/cls_flower.c:345) cls_flower
[   21.172401] ? autoremove_wake_function (kernel/sched/wait.c:386) 
[   21.172433] ? __wake_up_common (kernel/sched/wait.c:89) 
[   21.172459] ? __wake_up (kernel/sched/wait.c:110 kernel/sched/wait.c:127) 
[   21.172484] ? req_done (net/9p/trans_virtio.c:152) 
[   21.172509] ? vring_interrupt (drivers/virtio/virtio_ring.c:2595 drivers/virtio/virtio_ring.c:2570) 
[   21.172534] ? handle_irq_event (kernel/irq/internals.h:234 kernel/irq/handle.c:213) 
[   21.172559] ? handle_edge_irq (kernel/irq/chip.c:833) 
[   21.172585] ? kvm_clock_get_cycles (./arch/x86/include/asm/preempt.h:94 arch/x86/kernel/kvmclock.c:80 arch/x86/kernel/kvmclock.c:86) 
[   21.172616] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) 
[   21.172651] ? sched_clock (./arch/x86/include/asm/preempt.h:94 arch/x86/kernel/tsc.c:284) 
[   21.172676] ? sched_clock_cpu (kernel/sched/clock.c:394) 
[   21.172702] ? fib_table_lookup (net/ipv4/fib_trie.c:1620) 
[   21.172727] __tcf_classify.constprop.0 (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1768) 
[   21.172761] tcf_classify (net/sched/cls_api.c:1888) 
[   21.172785] prio_enqueue (net/sched/sch_prio.c:44 net/sched/sch_prio.c:75) sch_prio
[   21.172817] dev_qdisc_enqueue (net/core/dev.c:3758) 
[   21.172843] __dev_queue_xmit (net/core/dev.c:3849 net/core/dev.c:4338) 
[   21.172868] ? eth_header (net/ethernet/eth.c:85) 
[   21.172895] __neigh_update (net/core/neighbour.c:1461) 
[   21.172922] arp_process (./include/net/neighbour.h:444 (discriminator 4) net/ipv4/arp.c:934 (discriminator 4)) 
[   21.172947] __netif_receive_skb_one_core (net/core/dev.c:5610 (discriminator 5)) 
[   21.172977] process_backlog (./include/linux/rcupdate.h:782 net/core/dev.c:6053) 
[   21.173002] __napi_poll (net/core/dev.c:6703) 
[   21.173028] net_rx_action (net/core/dev.c:6774 net/core/dev.c:6886) 
[   21.173053] __do_softirq (kernel/softirq.c:553) 
[   21.173079] do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) 
[   21.173103]  </IRQ>
[   21.173121]  <TASK>
[   21.173134] __local_bh_enable_ip (kernel/softirq.c:381) 
[   21.173159] __neigh_event_send (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/neigh.h:237 net/core/neighbour.c:1246) 
[   21.173185] neigh_resolve_output (net/core/neighbour.c:1547) 
[   21.173216] ip_finish_output2 (./include/net/neighbour.h:542 net/ipv4/ip_output.c:235) 
[   21.173243] ip_send_skb (./include/net/dst.h:450 net/ipv4/ip_output.c:129 net/ipv4/ip_output.c:1496) 
[   21.173268] udp_send_skb (net/ipv4/udp.c:964) 
[   21.173294] udp_sendmsg (net/ipv4/udp.c:1250) 
[   21.173318] ? __pfx_ip_generic_getfrag (net/ipv4/ip_output.c:935) 
[   21.173350] ? __skb_try_recv_datagram (net/core/datagram.c:267) 
[   21.173381] ? __unix_dgram_recvmsg (net/unix/af_unix.c:2517) 
[   21.173413] ? sock_write_iter (net/socket.c:730 net/socket.c:745 net/socket.c:1160) 
[   21.173438] sock_write_iter (net/socket.c:730 net/socket.c:745 net/socket.c:1160) 
[   21.173466] vfs_write (./include/linux/fs.h:2087 fs/read_write.c:497 fs/read_write.c:590) 
[   21.173493] ksys_write (fs/read_write.c:643) 
[   21.173518] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[   21.173545] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) 
[   21.173577] RIP: 0033:0x7f839c361957
[ 21.173600] Code: 0b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
All code
========
   0:	0b 00                	or     (%rax),%eax
   2:	f7 d8                	neg    %eax
   4:	64 89 02             	mov    %eax,%fs:(%rdx)
   7:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   e:	eb b7                	jmp    0xffffffffffffffc7
  10:	0f 1f 00             	nopl   (%rax)
  13:	f3 0f 1e fa          	endbr64
  17:	64 8b 04 25 18 00 00 	mov    %fs:0x18,%eax
  1e:	00 
  1f:	85 c0                	test   %eax,%eax
  21:	75 10                	jne    0x33
  23:	b8 01 00 00 00       	mov    $0x1,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 51                	ja     0x83
  32:	c3                   	ret
  33:	48 83 ec 28          	sub    $0x28,%rsp
  37:	48 89 54 24 18       	mov    %rdx,0x18(%rsp)
  3c:	48                   	rex.W
  3d:	89                   	.byte 0x89
  3e:	74 24                	je     0x64

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 51                	ja     0x59
   8:	c3                   	ret
   9:	48 83 ec 28          	sub    $0x28,%rsp
   d:	48 89 54 24 18       	mov    %rdx,0x18(%rsp)
  12:	48                   	rex.W
  13:	89                   	.byte 0x89
  14:	74 24                	je     0x3a
[   21.173695] RSP: 002b:00007fff6634e4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   21.173740] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f839c361957
[   21.173784] RDX: 00000000000007b4 RSI: 0000562193cbb000 RDI: 0000000000000008
[   21.173823] RBP: 0000562193cbb000 R08: 00000000000007b4 R09: 0000000000000000
[   21.173861] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000008


Finger prints:
__pskb_pull_tail:tcf_csum_skb_nextlayer:tcf_csum_ipv4_udp:tcf_csum_act