====================================== | [ 990.496041] ------------[ cut here ]------------ | [ 990.496124] rcuref - imbalanced put() | [ 990.496145] WARNING: CPU: 3 PID: 2510 at lib/rcuref.c:267 rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 3)) | [ 990.496256] Modules linked in: ip6t_rpfilter nft_compat nf_tables libcrc32c vxlan mpls_gso mpls_iptunnel mpls_router [ 990.496381] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 990.496446] RIP: 0010:rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 3)) [ 990.496483] Code: cc cc c7 03 00 00 00 a0 31 c0 eb f0 80 3d b7 78 6a 01 00 75 19 c6 05 ae 78 6a 01 01 90 48 c7 c7 d6 47 cc a6 e8 33 9c b9 ff 90 <0f> 0b 90 90 c7 03 00 00 00 e0 31 c0 5b c3 cc cc cc cc 90 90 90 90 All code ======== 0: cc int3 1: cc int3 2: c7 03 00 00 00 a0 movl $0xa0000000,(%rbx) 8: 31 c0 xor %eax,%eax a: eb f0 jmp 0xfffffffffffffffc c: 80 3d b7 78 6a 01 00 cmpb $0x0,0x16a78b7(%rip) # 0x16a78ca 13: 75 19 jne 0x2e 15: c6 05 ae 78 6a 01 01 movb $0x1,0x16a78ae(%rip) # 0x16a78ca 1c: 90 nop 1d: 48 c7 c7 d6 47 cc a6 mov $0xffffffffa6cc47d6,%rdi 24: e8 33 9c b9 ff call 0xffffffffffb99c5c 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: c7 03 00 00 00 e0 movl $0xe0000000,(%rbx) 34: 31 c0 xor %eax,%eax 36: 5b pop %rbx 37: c3 ret 38: cc int3 39: cc int3 3a: cc int3 3b: cc int3 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: c7 03 00 00 00 e0 movl $0xe0000000,(%rbx) a: 31 c0 xor %eax,%eax c: 5b pop %rbx d: c3 ret e: cc int3 f: cc int3 10: cc int3 11: cc int3 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop [ 990.496580] RSP: 0018:ffffacf5032278c8 EFLAGS: 00010282 [ 990.496615] RAX: 0000000000000000 RBX: ffff902342300b40 RCX: 00000000ffffdfff [ 990.496675] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001 [ 990.496729] RBP: 0000000000000002 R08: ffffffffa715aa08 R09: 00000000ffffdfff [ 990.496778] R10: ffffffffa707aa20 R11: ffffffffa712cf88 R12: ffff902342300b00 [ 990.496829] R13: ffff9023430c1ce0 R14: 0000000000000000 R15: ffff9023441d6180 [ 990.496878] FS: 00007f5f2f8e1800(0000) GS:ffff90237ed80000(0000) knlGS:0000000000000000 [ 990.496931] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 990.496975] CR2: 00007f5f2fb3d423 CR3: 0000000003388002 CR4: 0000000000770ef0 [ 990.497027] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 990.497083] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 990.497135] PKRU: 55555554 [ 990.497157] Call Trace: [ 990.497181] <TASK> [ 990.497203] ? __warn (kernel/panic.c:741) [ 990.497233] ? rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 3)) [ 990.497268] ? report_bug (lib/bug.c:201 lib/bug.c:219) [ 990.497301] ? handle_bug (arch/x86/kernel/traps.c:239) [ 990.497330] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 990.497357] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 990.497387] ? rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 3)) [ 990.497422] ? rcuref_put_slowpath (lib/rcuref.c:267 (discriminator 3)) [ 990.497454] dst_release (./include/linux/rcuref.h:94 ./include/linux/rcuref.h:150 net/core/dst.c:164 net/core/dst.c:162) [ 990.497486] fib6_nh_release_dsts.part.0 (net/ipv6/route.c:3678) [ 990.497524] rtm_new_nexthop (net/ipv4/nexthop.c:2191 net/ipv4/nexthop.c:2533 net/ipv4/nexthop.c:2570 net/ipv4/nexthop.c:2944 net/ipv4/nexthop.c:3220) [ 990.497557] ? get_page_from_freelist (mm/page_alloc.c:1504 mm/page_alloc.c:3439) [ 990.497594] rtnetlink_rcv_msg (net/core/rtnetlink.c:6646) [ 990.497621] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6540) [ 990.497658] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 990.497689] netlink_unicast (net/netlink/af_netlink.c:1331 net/netlink/af_netlink.c:1357) [ 990.497716] netlink_sendmsg (net/netlink/af_netlink.c:1901) [ 990.497742] ____sys_sendmsg (net/socket.c:730 net/socket.c:745 net/socket.c:2597) [ 990.497772] ? copy_msghdr_from_user (net/socket.c:2537) [ 990.497808] ___sys_sendmsg (net/socket.c:2653) [ 990.497836] __sys_sendmsg (./include/linux/file.h:34 net/socket.c:2682) [ 990.497864] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 990.497895] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 990.497932] RIP: 0033:0x7f5f2faed7b7 [ 990.497961] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0a 00 or (%rax),%al 2: f7 d8 neg %eax 4: 64 89 02 mov %eax,%fs:(%rdx) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 990.498058] RSP: 002b:00007ffee7c4cee8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 990.498112] RAX: ffffffffffffffda RBX: 00007ffee7c4da60 RCX: 00007f5f2faed7b7 [ 990.498157] RDX: 0000000000000000 RSI: 00007ffee7c4cf50 RDI: 0000000000000005 [ 990.498203] RBP: 00007ffee7c4d410 R08: 0000000000000002 R09: 0000000000000000 [ 990.498248] R10: 00007f5f2f9a6708 R11: 0000000000000246 R12: 0000000000000001 Finger prints: rcuref_put_slowpath:dst_release:rtm_new_nexthop:rtnetlink_rcv_msg:netlink_rcv_skb