======================================
| xx__-> [ 2680.683533][T26859] tun: Universal TUN/TAP device driver, 1.6
| [ 2684.046316][T26865] ------------[ cut here ]------------
| [ 2684.047237][T26865] WARNING: CPU: 2 PID: 26865 at ./include/net/sch_generic.h:843 __dev_xmit_skb (./include/net/sch_generic.h:843 ./include/net/sch_generic.h:889 ./include/net/sch_generic.h:901 net/core/dev.c:4239)
| [ 2684.048091][T26865] Modules linked in: xt_tcpudp xt_conntrack nft_compat x_tables tun nft_meta_bridge br_netfilter macvlan sctp_diag nft_limit nfnetlink_queue nft_queue sctp ip6_udp_tunnel udp_tunnel nft_numgen dummy nf_log_syslog nft_log nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nf_conntrack_netlink nft_redir esp4 sha1 xfrm_user 8021q bridge stp llc nft_nat nft_flow_offload nf_flow_table_inet nf_flow_table nft_masq nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tcp_diag inet_diag veth nf_tables
[ 2684.052476][T26865] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2684.052980][T26865] RIP: 0010:__dev_xmit_skb (./include/net/sch_generic.h:843 ./include/net/sch_generic.h:889 ./include/net/sch_generic.h:901 net/core/dev.c:4239)
[ 2684.053409][T26865] Code: 7d 06 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 7e 0d 00 00 66 83 7d 06 00 74 04 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 28 48 89 fa 48
All code
========
   0:	7d 06                	jge    0x8
   2:	48 89 fa             	mov    %rdi,%rdx
   5:	48 c1 ea 03          	shr    $0x3,%rdx
   9:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx
   d:	48 89 f8             	mov    %rdi,%rax
  10:	83 e0 07             	and    $0x7,%eax
  13:	83 c0 01             	add    $0x1,%eax
  16:	38 d0                	cmp    %dl,%al
  18:	7c 08                	jl     0x22
  1a:	84 d2                	test   %dl,%dl
  1c:	0f 85 7e 0d 00 00    	jne    0xda0
  22:	66 83 7d 06 00       	cmpw   $0x0,0x6(%rbp)
  27:	74 04                	je     0x2d
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  34:	fc ff df 
  37:	49 8d 7c 24 28       	lea    0x28(%r12),%rdi
  3c:	48 89 fa             	mov    %rdi,%rdx
  3f:	48                   	rex.W

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   a:	fc ff df 
   d:	49 8d 7c 24 28       	lea    0x28(%r12),%rdi
  12:	48 89 fa             	mov    %rdi,%rdx
  15:	48                   	rex.W
[ 2684.054773][T26865] RSP: 0018:ffffc9000266ee20 EFLAGS: 00010202
[ 2684.055281][T26865] RAX: 0000000000000007 RBX: 0000000000000001 RCX: ffffffff87c1eef5
[ 2684.055864][T26865] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801f8da106
[ 2684.056427][T26865] RBP: ffff88801f8da100 R08: ffff888009a38e40 R09: ffffed1002f859b3
[ 2684.057020][T26865] R10: ffff888017c2cd9f R11: ffffc9000266eb38 R12: ffff888009a38e40
[ 2684.057593][T26865] R13: ffff888017c2cc00 R14: ffff888017c2ce08 R15: ffff888017c2cc00
[ 2684.058182][T26865] FS:  00000000195e13c0(0000) GS:ffff8880abeec000(0000) knlGS:0000000000000000
[ 2684.058883][T26865] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2684.059370][T26865] CR2: 00007fbe0b8a4000 CR3: 000000000960a001 CR4: 0000000000772ef0
[ 2684.059962][T26865] PKRU: 55555554
[ 2684.060263][T26865] Call Trace:
[ 2684.060565][T26865]  <TASK>
[ 2684.060808][T26865]  ? dev_get_stats (net/core/dev.c:4143)
[ 2684.061203][T26865]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2684.061586][T26865]  ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831)
[ 2684.061983][T26865]  __dev_queue_xmit (net/core/dev.c:4786)
[ 2684.062374][T26865]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 2684.062771][T26865]  ? netdev_core_pick_tx (net/core/dev.c:4728)
[ 2684.063160][T26865]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[ 2684.063542][T26865]  ? neigh_connected_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:836 net/core/neighbour.c:1617)
[ 2684.063941][T26865]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[ 2684.064327][T26865]  ? neigh_connected_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:836 net/core/neighbour.c:1617)
[ 2684.064739][T26865]  ip_finish_output2 (./include/net/neighbour.h:556 net/ipv4/ip_output.c:237)
[ 2684.065128][T26865]  ? ip_skb_dst_mtu (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/ip.h:504 ./include/net/ip.h:518)
[ 2684.065511][T26865]  ? ip_append_data.part.0 (net/ipv4/ip_output.c:201)
[ 2684.065899][T26865]  ? ip_skb_dst_mtu (./include/net/ip.h:523)
[ 2684.066291][T26865]  ? __ip_finish_output (./include/linux/skbuff.h:1724 ./include/linux/skbuff.h:5149 net/ipv4/ip_output.c:309 net/ipv4/ip_output.c:297)
[ 2684.066682][T26865]  ip_output (./include/linux/netfilter.h:307 net/ipv4/ip_output.c:438)
[ 2684.066987][T26865]  __ip_queue_xmit (./include/net/dst.h:464 net/ipv4/ip_output.c:131 net/ipv4/ip_output.c:534)
[ 2684.067377][T26865]  ? kmem_cache_alloc_node_noprof (mm/slub.c:5337)
[ 2684.067872][T26865]  __tcp_transmit_skb (net/ipv4/tcp_output.c:1628)
[ 2684.068279][T26865]  ? __tcp_select_window (net/ipv4/tcp_output.c:1449)
[ 2684.068672][T26865]  ? __tcp_send_ack.part.0 (./include/linux/skbuff.h:1383 net/ipv4/tcp_output.c:4434)
[ 2684.069067][T26865]  ? __tcp_ack_snd_check (./include/net/net_namespace.h:414 ./include/net/sock.h:695 ./include/net/inet_connection_sock.h:330 net/ipv4/tcp_input.c:341 net/ipv4/tcp_input.c:5910)
[ 2684.069504][T26865]  tcp_rcv_established (net/ipv4/tcp_input.c:5976 net/ipv4/tcp_input.c:6467)
[ 2684.069921][T26865]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[ 2684.070318][T26865]  ? tcp_check_space (net/ipv4/tcp_input.c:6276)
[ 2684.070727][T26865]  ? ipv4_dst_check (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/ipv4/route.c:402 net/ipv4/route.c:1217)
[ 2684.071120][T26865]  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929)
[ 2684.071508][T26865]  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2324)
[ 2684.071921][T26865]  ? tcp_filter (net/ipv4/tcp_ipv4.c:2153)
[ 2684.072239][T26865]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[ 2684.072653][T26865]  ip_local_deliver_finish (./include/linux/rcupdate.h:895 net/ipv4/ip_input.c:242)
[ 2684.073046][T26865]  ? ip_local_deliver (net/ipv4/ip_input.c:566)
[ 2684.073454][T26865]  __netif_receive_skb_one_core (net/core/dev.c:6131)
[ 2684.073965][T26865]  ? __netif_receive_skb_list_core (net/core/dev.c:6131)
[ 2684.074448][T26865]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2684.074862][T26865]  ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831)
[ 2684.075252][T26865]  ? netif_receive_skb_internal (./include/linux/rcupdate.h:331 (discriminator 16) ./include/linux/rcupdate.h:867 (discriminator 16) net/core/dev.c:6324 (discriminator 16))
[ 2684.075757][T26865]  netif_receive_skb_internal (net/core/dev.c:6337)
[ 2684.076147][T26865]  ? __netif_receive_skb (net/core/dev.c:6316)
[ 2684.076527][T26865]  ? _copy_from_iter (./arch/x86/include/asm/smap.h:29 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:55 ./include/linux/iov_iter.h:52 ./include/linux/iov_iter.h:304 ./include/linux/iov_iter.h:330 lib/iov_iter.c:249 lib/iov_iter.c:260)
[ 2684.076924][T26865]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2684.077318][T26865]  netif_receive_skb (net/core/dev.c:6396)
[ 2684.077711][T26865] tun_rx_batched.isra.0 (./include/linux/bottom_half.h:33 drivers/net/tun.c:1510) tun
[ 2684.078207][T26865]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 2684.078606][T26865]  ? tun_setup (drivers/net/tun.c:1474) tun
[ 2684.079028][T26865]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2684.079422][T26865]  ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5831)
[ 2684.079815][T26865]  ? tun_get_user (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:867 drivers/net/tun.c:1894) tun
[ 2684.080214][T26865] tun_get_user (drivers/net/tun.c:1953) tun
[ 2684.080626][T26865]  ? tun_build_skb (drivers/net/tun.c:1696) tun
[ 2684.081023][T26865]  ? ref_tracker_dir_print (lib/ref_tracker.c:256)
[ 2684.081455][T26865]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[ 2684.081860][T26865]  ? tun_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 drivers/net/tun.c:793) tun
[ 2684.082262][T26865]  ? __lock_release (kernel/locking/lockdep.c:5536)
[ 2684.082647][T26865]  ? tun_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 drivers/net/tun.c:793) tun
[ 2684.083044][T26865] tun_chr_write_iter (drivers/net/tun.c:800 drivers/net/tun.c:2001) tun
[ 2684.083444][T26865]  do_iter_readv_writev (fs/read_write.c:828)
[ 2684.083840][T26865]  ? ksys_lseek (fs/read_write.c:814)
[ 2684.084245][T26865]  ? import_iovec (lib/iov_iter.c:1430)
[ 2684.084636][T26865]  vfs_writev (fs/read_write.c:1057)
[ 2684.084955][T26865]  ? validate_chain (kernel/locking/lockdep.c:3801 kernel/locking/lockdep.c:3821 kernel/locking/lockdep.c:3876)
[ 2684.085355][T26865]  ? vfs_iocb_iter_write (fs/read_write.c:1030)
[ 2684.085751][T26865]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 2684.086159][T26865]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[ 2684.086556][T26865]  ? __lock_release (kernel/locking/lockdep.c:5536)
[ 2684.086950][T26865]  ? __fget_files (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 fs/file.c:1072)
[ 2684.087344][T26865]  ? __fget_files (fs/file.c:1075)
[ 2684.087744][T26865]  ? __rseq_handle_notify_resume (kernel/rseq.c:442)
[ 2684.088233][T26865]  ? do_writev (fs/read_write.c:1103)
[ 2684.088543][T26865]  do_writev (fs/read_write.c:1103)
[ 2684.088867][T26865]  ? vfs_writev (fs/read_write.c:1093)
[ 2684.089279][T26865]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 2684.089690][T26865]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 2684.090171][T26865] RIP: 0033:0x4909bd
[ 2684.090512][T26865] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 fa 70 04 00 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 4e 71 04 00 48
All code
========
   0:	28 89 54 24 1c 48    	sub    %cl,0x481c2454(%rcx)
   6:	89 74 24 10          	mov    %esi,0x10(%rsp)
   a:	89 7c 24 08          	mov    %edi,0x8(%rsp)
   e:	e8 fa 70 04 00       	call   0x4710d
  13:	8b 54 24 1c          	mov    0x1c(%rsp),%edx
  17:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi
  1c:	41 89 c0             	mov    %eax,%r8d
  1f:	8b 7c 24 08          	mov    0x8(%rsp),%edi
  23:	b8 14 00 00 00       	mov    $0x14,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 33                	ja     0x65
  32:	44 89 c7             	mov    %r8d,%edi
  35:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  3a:	e8 4e 71 04 00       	call   0x4718d
  3f:	48                   	rex.W

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 33                	ja     0x3b
   8:	44 89 c7             	mov    %r8d,%edi
   b:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  10:	e8 4e 71 04 00       	call   0x47163
  15:	48                   	rex.W
[ 2684.091854][T26865] RSP: 002b:00007ffc4c953900 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
[ 2684.092435][T26865] RAX: ffffffffffffffda RBX: 00007ffc4c953f48 RCX: 00000000004909bd
[ 2684.093017][T26865] RDX: 0000000000000002 RSI: 00007ffc4c953940 RDI: 0000000000000006
[ 2684.093588][T26865] RBP: 00007ffc4c953970 R08: 0000000000000000 R09: 00007ffc4c9539d0
[ 2684.094178][T26865] R10: 7fffffffffffffff R11: 0000000000000293 R12: 00007ffc4c953f08


Finger prints:
__dev_xmit_skb:__dev_queue_xmit:ip_finish_output2:ip_output:__ip_queue_xmit