====================================== | [ 1829.896275][ C3] ================================================================== | [ 1829.896575][ C3] BUG: KASAN: slab-use-after-free in xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) | [ 1829.896853][ C3] Read of size 8 at addr ffff8880146f1b40 by task socat/9405 | [ 1829.897113][ C3] [ 1829.897485][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1829.897872][ C3] Call Trace: [ 1829.898014][ C3] [ 1829.898103][ C3] dump_stack_lvl (lib/dump_stack.c:123) [ 1829.898284][ C3] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 1829.898505][ C3] ? xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) [ 1829.898685][ C3] print_report (mm/kasan/report.c:489) [ 1829.898873][ C3] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) [ 1829.899051][ C3] kasan_report (mm/kasan/report.c:603) [ 1829.899181][ C3] ? xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) [ 1829.899359][ C3] xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) [ 1829.899536][ C3] ? __pfx_xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3132) [ 1829.899761][ C3] ? l4proto_manip_pkt (./include/net/checksum.h:167 net/netfilter/nf_nat_proto.c:216 net/netfilter/nf_nat_proto.c:342) nf_nat [ 1829.899990][ C3] nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:684) nf_nat [ 1829.900172][ C3] ? __pfx_nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:664) nf_nat [ 1829.900396][ C3] ? nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables [ 1829.900657][ C3] ? __pfx_nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables [ 1829.900906][ C3] nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:783 net/netfilter/nf_nat_proto.c:755) nf_nat [ 1829.901089][ C3] ? __pfx_nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:757) nf_nat [ 1829.901311][ C3] nf_hook_slow (./include/linux/netfilter.h:154 net/netfilter/core.c:626) [ 1829.901492][ C3] nf_hook (./include/linux/netfilter.h:269) [ 1829.901632][ C3] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1829.901812][ C3] ? __pfx_nf_hook (./include/linux/netfilter.h:227) [ 1829.901989][ C3] ? __ip_append_data (./include/linux/skbuff.h:3205 ./include/linux/skbuff.h:3213 ./include/linux/skbuff.h:3227 net/ipv4/ip_output.c:1165) [ 1829.902174][ C3] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1829.902352][ C3] ip_output (./include/linux/netfilter.h:301 net/ipv4/ip_output.c:434) [ 1829.902485][ C3] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1829.902660][ C3] ip_push_pending_frames (./include/net/dst.h:450 net/ipv4/ip_output.c:130 net/ipv4/ip_output.c:1505 net/ipv4/ip_output.c:1525) [ 1829.902836][ C3] ip_send_unicast_reply (./include/net/route.h:266 net/ipv4/ip_output.c:1675) [ 1829.903018][ C3] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1829.903198][ C3] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1829.903333][ C3] ? __pfx_ip_send_unicast_reply (net/ipv4/ip_output.c:1605) [ 1829.903550][ C3] ? __lock_acquire (kernel/locking/lockdep.c:5202) [ 1829.903743][ C3] ? lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5827) [ 1829.903929][ C3] ? tcp_v4_send_ack.constprop.0 (./include/linux/local_lock_internal.h:29 net/ipv4/tcp_ipv4.c:1016) [ 1829.904157][ C3] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 1829.904342][ C3] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 1829.904530][ C3] tcp_v4_send_ack.constprop.0 (./include/net/net_namespace.h:380 ./include/net/sock.h:661 net/ipv4/tcp_ipv4.c:1030) [ 1829.904763][ C3] ? __pfx_tcp_v4_send_ack.constprop.0 (net/ipv4/tcp_ipv4.c:933) [ 1829.904986][ C3] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 1829.905166][ C3] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 1829.905349][ C3] ? tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) [ 1829.905527][ C3] tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) [ 1829.905707][ C3] ? __pfx_tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2177) [ 1829.905887][ C3] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) [ 1829.906070][ C3] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 8)) [ 1829.906256][ C3] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1829.906424][ C3] ip_local_deliver_finish (./include/linux/rcupdate.h:878 net/ipv4/ip_input.c:234) [ 1829.906600][ C3] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1829.906777][ C3] ? __pfx_ip_rcv (net/ipv4/ip_input.c:562) [ 1829.906967][ C3] __netif_receive_skb_one_core (net/core/dev.c:5670 (discriminator 4)) [ 1829.907189][ C3] ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5663) [ 1829.907420][ C3] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1829.907591][ C3] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1829.907769][ C3] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1829.907960][ C3] process_backlog (./include/linux/rcupdate.h:878 net/core/dev.c:6116) [ 1829.908138][ C3] __napi_poll.constprop.0 (net/core/dev.c:6779) [ 1829.908327][ C3] net_rx_action (net/core/dev.c:6848 net/core/dev.c:6970) [ 1829.908505][ C3] ? __pfx_net_rx_action (net/core/dev.c:6932) [ 1829.908686][ C3] ? clockevents_program_event (kernel/time/clockevents.c:326) [ 1829.908861][ C3] ? kvm_clock_get_cycles (./arch/x86/include/asm/preempt.h:94 arch/x86/kernel/kvmclock.c:80 arch/x86/kernel/kvmclock.c:86) [ 1829.909052][ C3] ? ktime_get (kernel/time/timekeeping.c:195 (discriminator 4) kernel/time/timekeeping.c:395 (discriminator 4) kernel/time/timekeeping.c:403 (discriminator 4) kernel/time/timekeeping.c:850 (discriminator 4)) [ 1829.909296][ C3] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1829.909474][ C3] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) [ 1829.909744][ C3] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 1829.909931][ C3] handle_softirqs (kernel/softirq.c:554) [ 1829.910226][ C3] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) [ 1829.910407][ C3] do_softirq (kernel/softirq.c:455 kernel/softirq.c:442) [ 1829.910642][ C3] [ 1829.910739][ C3] [ 1829.910822][ C3] __local_bh_enable_ip (kernel/softirq.c:382) [ 1829.911108][ C3] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) [ 1829.911397][ C3] __dev_queue_xmit (net/core/dev.c:4460) [ 1829.911576][ C3] ? __lock_release (kernel/locking/lockdep.c:5501) [ 1829.911756][ C3] ? ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) [ 1829.911932][ C3] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) [ 1829.912221][ C3] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) [ 1829.912399][ C3] ? __pfx___dev_queue_xmit (net/core/dev.c:4341) [ 1829.912578][ C3] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 1829.912864][ C3] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 1829.913086][ C3] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:757 ./include/net/neighbour.h:496) [ 1829.913268][ C3] ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) [ 1829.913452][ C3] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) [ 1829.913630][ C3] ? __ip_finish_output (./include/linux/skbuff.h:1669 ./include/linux/skbuff.h:5010 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:296) [ 1829.913910][ C3] __ip_queue_xmit (net/ipv4/ip_output.c:536 (discriminator 4)) [ 1829.914092][ C3] ? __skb_clone (./arch/x86/include/asm/atomic.h:53 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:992 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:436 (discriminator 4) net/core/skbuff.c:1605 (discriminator 4)) [ 1829.914276][ C3] __tcp_transmit_skb (net/ipv4/tcp_output.c:1466 (discriminator 4)) [ 1829.914466][ C3] ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1287) [ 1829.914655][ C3] ? mark_held_locks (kernel/locking/lockdep.c:4321) [ 1829.914939][ C3] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) [ 1829.915176][ C3] ? tcp_small_queue_check.isra.0 (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/ipv4/tcp_output.c:2631) [ 1829.915398][ C3] tcp_write_xmit (net/ipv4/tcp_output.c:2830) [ 1829.915687][ C3] ? tcp_current_mss (./include/net/dst.h:216 net/ipv4/tcp_output.c:1872) [ 1829.915872][ C3] ? __pfx_tcp_current_mss (net/ipv4/tcp_output.c:1861) [ 1829.916065][ C3] ? __alloc_skb (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 ./include/linux/refcount.h:125 net/core/skbuff.c:702) [ 1829.916244][ C3] ? __pfx_tcp_write_xmit (net/ipv4/tcp_output.c:2739) [ 1829.916423][ C3] ? tcp_set_state (net/ipv4/tcp.c:2870 (discriminator 53)) [ 1829.916697][ C3] ? __pfx_tcp_set_state (net/ipv4/tcp.c:2870) [ 1829.916866][ C3] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3015) [ 1829.917151][ C3] inet_shutdown (net/ipv4/af_inet.c:925) [ 1829.917334][ C3] ? sockfd_lookup_light (net/socket.c:557) [ 1829.917513][ C3] __sys_shutdown (net/socket.c:2448 net/socket.c:2460) [ 1829.917798][ C3] ? __pfx___sys_shutdown (net/socket.c:2454) [ 1829.917963][ C3] ? audit_reset_context.part.0.constprop.0 (./include/linux/list.h:373 kernel/auditsc.c:1023) [ 1829.918171][ C3] __x64_sys_shutdown (net/socket.c:2466) [ 1829.918438][ C3] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1829.918603][ C3] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1829.918807][ C3] RIP: 0033:0x7f8f33226beb [ 1829.918978][ C3] Code: 73 01 c3 48 8b 0d 15 92 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 30 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e5 91 1b 00 f7 d8 64 89 01 48 All code ======== 0: 73 01 jae 0x3 2: c3 ret 3: 48 8b 0d 15 92 1b 00 mov 0x1b9215(%rip),%rcx # 0x1b921f a: f7 d8 neg %eax c: 64 89 01 mov %eax,%fs:(%rcx) f: 48 83 c8 ff or $0xffffffffffffffff,%rax 13: c3 ret 14: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 1b: 00 00 00 1e: 90 nop 1f: f3 0f 1e fa endbr64 23: b8 30 00 00 00 mov $0x30,%eax 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 ret 33: 48 8b 0d e5 91 1b 00 mov 0x1b91e5(%rip),%rcx # 0x1b921f 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 73 01 jae 0x9 8: c3 ret 9: 48 8b 0d e5 91 1b 00 mov 0x1b91e5(%rip),%rcx # 0x1b91f5 10: f7 d8 neg %eax 12: 64 89 01 mov %eax,%fs:(%rcx) 15: 48 rex.W [ 1829.919551][ C3] RSP: 002b:00007ffd823f5608 EFLAGS: 00000202 ORIG_RAX: 0000000000000030 [ 1829.919909][ C3] RAX: ffffffffffffffda RBX: 00005636628cf610 RCX: 00007f8f33226beb [ 1829.920260][ C3] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000008 [ 1829.920505][ C3] RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000000 [ 1829.920867][ C3] R10: 0000000000000000 R11: 0000000000000202 R12: ffffffffffffffff [ 1829.921114][ C3] R13: 0000000000000000 R14: 000056363940810e R15: 0000000000000001 | [ 1829.939868][ C3] Disabling lock debugging due to kernel taint | [ 1831.883171][ C0] Oops: general protection fault, probably for non-canonical address 0xf9999599999999e1: 0000 [#1] PREEMPT SMP KASAN NOPTI | [ 1831.883679][ C0] KASAN: maybe wild-memory-access in range [0xcccccccccccccf08-0xcccccccccccccf0f] | [ 1831.884324][ C0] Tainted: [B]=BAD_PAGE [ 1831.884467][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1831.884893][ C0] RIP: 0010:xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2218) [ 1831.885136][ C0] Code: 48 89 44 24 18 0f b7 44 24 06 89 44 24 28 e9 a9 01 00 00 4d 85 ed 0f 84 2f 02 00 00 49 8d bd 3e 02 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 8c All code ======== 0: 48 89 44 24 18 mov %rax,0x18(%rsp) 5: 0f b7 44 24 06 movzwl 0x6(%rsp),%eax a: 89 44 24 28 mov %eax,0x28(%rsp) e: e9 a9 01 00 00 jmp 0x1bc 13: 4d 85 ed test %r13,%r13 16: 0f 84 2f 02 00 00 je 0x24b 1c: 49 8d bd 3e 02 00 00 lea 0x23e(%r13),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax 2a:* 0f b6 14 18 movzbl (%rax,%rbx,1),%edx <-- trapping instruction 2e: 48 89 f8 mov %rdi,%rax 31: 83 e0 07 and $0x7,%eax 34: 83 c0 01 add $0x1,%eax 37: 38 d0 cmp %dl,%al 39: 7c 08 jl 0x43 3b: 84 d2 test %dl,%dl 3d: 0f .byte 0xf 3e: 85 .byte 0x85 3f: 8c .byte 0x8c Code starting with the faulting instruction =========================================== 0: 0f b6 14 18 movzbl (%rax,%rbx,1),%edx 4: 48 89 f8 mov %rdi,%rax 7: 83 e0 07 and $0x7,%eax a: 83 c0 01 add $0x1,%eax d: 38 d0 cmp %dl,%al f: 7c 08 jl 0x19 11: 84 d2 test %dl,%dl 13: 0f .byte 0xf 14: 85 .byte 0x85 15: 8c .byte 0x8c [ 1831.885786][ C0] RSP: 0018:ffffc90000006a80 EFLAGS: 00010a06 [ 1831.886027][ C0] RAX: 19999999999999e1 RBX: dffffc0000000000 RCX: ffffffff9d3174b8 [ 1831.886312][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: cccccccccccccf0a [ 1831.886585][ C0] RBP: ffff8880146f1e50 R08: 0000000000000000 R09: 0000000000000000 [ 1831.886858][ C0] R10: ffffffff9f37388f R11: dffffc0000000000 R12: 0000000000000000 [ 1831.887132][ C0] R13: cccccccccccccccc R14: ffff8880146f1e50 R15: ffffc90000006c70 [ 1831.887408][ C0] FS: 00007f8f33198740(0000) GS:ffff888036000000(0000) knlGS:0000000000000000 [ 1831.887726][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1831.887975][ C0] CR2: 00005636628d5b88 CR3: 0000000002592003 CR4: 0000000000772ef0 [ 1831.888256][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1831.888535][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1831.888805][ C0] PKRU: 55555554 [ 1831.888960][ C0] Call Trace: [ 1831.889109][ C0] [ 1831.889206][ C0] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) [ 1831.889356][ C0] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) [ 1831.889546][ C0] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) [ 1831.889731][ C0] ? xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2213) [ 1831.889922][ C0] ? xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2218) [ 1831.890106][ C0] ? __pfx_xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2208) [ 1831.890340][ C0] xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3147) [ 1831.890546][ C0] ? __pfx_xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3132) [ 1831.890794][ C0] ? l4proto_manip_pkt (./include/net/checksum.h:167 net/netfilter/nf_nat_proto.c:216 net/netfilter/nf_nat_proto.c:342) nf_nat [ 1831.891043][ C0] nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:684) nf_nat [ 1831.891247][ C0] ? __pfx_nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:664) nf_nat [ 1831.891492][ C0] ? nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables [ 1831.891765][ C0] ? __pfx_nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables [ 1831.892024][ C0] nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:783 net/netfilter/nf_nat_proto.c:755) nf_nat [ 1831.892209][ C0] ? __pfx_nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:757) nf_nat [ 1831.892435][ C0] nf_hook_slow (./include/linux/netfilter.h:154 net/netfilter/core.c:626) [ 1831.892619][ C0] nf_hook (./include/linux/netfilter.h:269) [ 1831.892763][ C0] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1831.892944][ C0] ? __pfx_nf_hook (./include/linux/netfilter.h:227) [ 1831.893129][ C0] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1831.893314][ C0] ? nf_nat_ipv4_local_fn (net/netfilter/nf_nat_proto.c:801) nf_nat [ 1831.893540][ C0] ip_output (./include/linux/netfilter.h:301 net/ipv4/ip_output.c:434) [ 1831.893676][ C0] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) [ 1831.893864][ C0] vrf_ip_local_out (./include/net/dst.h:450 drivers/net/vrf.c:501) [ 1831.894047][ C0] ? __pfx_vrf_ip_local_out (drivers/net/vrf.c:493) [ 1831.894226][ C0] ? hpet_cpuhp_online (arch/x86/kernel/hpet.c:638 arch/x86/kernel/hpet.c:659 arch/x86/kernel/hpet.c:688) [ 1831.894410][ C0] ? __pfx_dst_output (./include/net/dst.h:449) [ 1831.894604][ C0] vrf_process_v4_outbound (drivers/net/vrf.c:553) [ 1831.894788][ C0] ? __pfx_vrf_process_v4_outbound (drivers/net/vrf.c:508) [ 1831.895019][ C0] ? arch_stack_walk (arch/x86/kernel/stacktrace.c:27 (discriminator 1)) [ 1831.895206][ C0] vrf_xmit (drivers/net/vrf.c:570 drivers/net/vrf.c:584) [ 1831.895350][ C0] dev_hard_start_xmit (./include/linux/netdevice.h:4920 ./include/linux/netdevice.h:4929 net/core/dev.c:3588 net/core/dev.c:3604) [ 1831.895535][ C0] sch_direct_xmit (net/sched/sch_generic.c:343) [ 1831.895722][ C0] ? __pfx_sch_direct_xmit (net/sched/sch_generic.c:318) [ 1831.895901][ C0] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [ 1831.896087][ C0] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 1831.896262][ C0] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1831.896451][ C0] ? __dev_xmit_skb (net/core/dev.c:3862) [ 1831.896636][ C0] __dev_xmit_skb (net/core/dev.c:3875) [ 1831.896827][ C0] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 1831.897028][ C0] ? __pfx___dev_xmit_skb (net/core/dev.c:3800) [ 1831.897317][ C0] ? __dev_queue_xmit (./include/linux/bottom_half.h:20 ./include/linux/rcupdate.h:901 net/core/dev.c:4357) [ 1831.897526][ C0] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1831.897707][ C0] ? __dev_queue_xmit (./include/linux/bottom_half.h:20 ./include/linux/rcupdate.h:901 net/core/dev.c:4357) [ 1831.897896][ C0] __dev_queue_xmit (net/core/dev.c:4398) [ 1831.898186][ C0] ? __pfx___alloc_skb (net/core/skbuff.c:651) [ 1831.898384][ C0] ? __pfx_nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables [ 1831.898768][ C0] ? __pfx_nf_confirm (net/netfilter/nf_conntrack_proto.c:137) nf_conntrack [ 1831.899137][ C0] ? __pfx___dev_queue_xmit (net/core/dev.c:4341) [ 1831.899341][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.899526][ C0] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40) [ 1831.899878][ C0] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:757 ./include/net/neighbour.h:496) [ 1831.900063][ C0] ? vrf_finish_output (./include/linux/rcupdate.h:337 ./include/linux/rcupdate.h:849 drivers/net/vrf.c:862) [ 1831.900255][ C0] vrf_finish_output (./include/net/neighbour.h:540 drivers/net/vrf.c:870) [ 1831.900445][ C0] ? __pfx_vrf_finish_output (drivers/net/vrf.c:843) [ 1831.900744][ C0] ? __pfx_vrf_finish_output (drivers/net/vrf.c:843) [ 1831.901045][ C0] ? vrf_output (./include/linux/netfilter.h:301 drivers/net/vrf.c:889) [ 1831.901236][ C0] ip_push_pending_frames (./include/net/dst.h:450 ./include/net/dst.h:448 net/ipv4/ip_output.c:130 net/ipv4/ip_output.c:1505 net/ipv4/ip_output.c:1525) [ 1831.901419][ C0] ip_send_unicast_reply (./include/net/route.h:266 net/ipv4/ip_output.c:1675) [ 1831.901714][ C0] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [ 1831.901890][ C0] ? __pfx_ip_send_unicast_reply (net/ipv4/ip_output.c:1605) [ 1831.902232][ C0] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 1831.902399][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.902691][ C0] ? lock_timer_base (kernel/time/timer.c:1051) [ 1831.902866][ C0] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1831.903033][ C0] ? lock_timer_base (kernel/time/timer.c:1051) [ 1831.903202][ C0] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 1831.903484][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.903769][ C0] tcp_v4_send_ack.constprop.0 (./include/net/net_namespace.h:380 ./include/net/sock.h:661 net/ipv4/tcp_ipv4.c:1030) [ 1831.904000][ C0] ? __pfx_tcp_v4_send_ack.constprop.0 (net/ipv4/tcp_ipv4.c:933) [ 1831.904334][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.904508][ C0] ? tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) [ 1831.904689][ C0] tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) [ 1831.904975][ C0] ? __pfx_tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2177) [ 1831.905159][ C0] ? nf_hook.constprop.0 (./include/linux/netfilter.h:223) [ 1831.905332][ C0] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 1831.905613][ C0] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 8)) [ 1831.905783][ C0] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1831.905957][ C0] ip_local_deliver_finish (./include/linux/rcupdate.h:878 net/ipv4/ip_input.c:234) [ 1831.906141][ C0] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1831.906327][ C0] ? __pfx_ip_rcv (net/ipv4/ip_input.c:562) [ 1831.906508][ C0] __netif_receive_skb_one_core (net/core/dev.c:5670 (discriminator 4)) [ 1831.906738][ C0] ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5663) [ 1831.907070][ C0] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1831.907237][ C0] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1831.907409][ C0] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) [ 1831.907578][ C0] process_backlog (./include/linux/rcupdate.h:878 net/core/dev.c:6116) [ 1831.907746][ C0] __napi_poll.constprop.0 (net/core/dev.c:6779) [ 1831.908033][ C0] net_rx_action (net/core/dev.c:6848 net/core/dev.c:6970) [ 1831.908206][ C0] ? __pfx_net_rx_action (net/core/dev.c:6932) [ 1831.908484][ C0] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [ 1831.908653][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.908935][ C0] ? _nohz_idle_balance.isra.0 (./include/linux/find.h:487 kernel/sched/fair.c:12558) [ 1831.909258][ C0] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91) [ 1831.909549][ C0] ? sched_clock (./arch/x86/include/asm/preempt.h:94 arch/x86/kernel/tsc.c:285) [ 1831.909717][ C0] ? sched_clock_cpu (kernel/sched/clock.c:394) [ 1831.910004][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.910188][ C0] ? tick_nohz_start_idle (kernel/time/tick-sched.c:750) [ 1831.910365][ C0] handle_softirqs (kernel/softirq.c:554) [ 1831.910540][ C0] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) [ 1831.910821][ C0] do_softirq (kernel/softirq.c:455 kernel/softirq.c:442) [ 1831.910950][ C0] [ 1831.911037][ C0] [ 1831.911122][ C0] __local_bh_enable_ip (kernel/softirq.c:382) [ 1831.911292][ C0] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) [ 1831.911478][ C0] __dev_queue_xmit (net/core/dev.c:4460) [ 1831.911761][ C0] ? __kernel_text_address (kernel/extable.c:79) [ 1831.912062][ C0] ? unwind_get_return_address (arch/x86/kernel/unwind_orc.c:369 arch/x86/kernel/unwind_orc.c:364) [ 1831.912252][ C0] ? __pfx_stack_trace_consume_entry (kernel/stacktrace.c:83) [ 1831.912463][ C0] ? arch_stack_walk (arch/x86/kernel/stacktrace.c:26) [ 1831.912749][ C0] ? __pfx___dev_queue_xmit (net/core/dev.c:4341) [ 1831.913027][ C0] ? trace_lock_release (./include/trace/events/lock.h:69 (discriminator 52)) [ 1831.913197][ C0] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40) [ 1831.913415][ C0] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:757 ./include/net/neighbour.h:496) [ 1831.913706][ C0] ? ip_finish_output2 (./include/linux/rcupdate.h:337 ./include/linux/rcupdate.h:849 net/ipv4/ip_output.c:229) [ 1831.913876][ C0] ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) [ 1831.914168][ C0] ? lock_release (kernel/locking/lockdep.c:116 kernel/locking/lockdep.c:5838) [ 1831.914337][ C0] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) [ 1831.914635][ C0] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) [ 1831.914804][ C0] ? rcu_read_lock_held (kernel/rcu/update.c:105 kernel/rcu/update.c:349) [ 1831.914986][ C0] ? __ip_finish_output (./include/linux/skbuff.h:1669 ./include/linux/skbuff.h:5010 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:296) [ 1831.915154][ C0] __ip_queue_xmit (net/ipv4/ip_output.c:536 (discriminator 4)) [ 1831.915439][ C0] ? __skb_clone (./arch/x86/include/asm/atomic.h:53 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:992 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:436 (discriminator 4) net/core/skbuff.c:1605 (discriminator 4)) [ 1831.915608][ C0] __tcp_transmit_skb (net/ipv4/tcp_output.c:1466 (discriminator 4)) [ 1831.915927][ C0] ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1287) [ 1831.916097][ C0] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40) [ 1831.916440][ C0] ? tcp_small_queue_check.isra.0 (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/ipv4/tcp_output.c:2631) [ 1831.916650][ C0] tcp_write_xmit (net/ipv4/tcp_output.c:2830) [ 1831.916822][ C0] ? tcp_current_mss (./include/net/dst.h:216 net/ipv4/tcp_output.c:1872) [ 1831.916998][ C0] ? __pfx_tcp_current_mss (net/ipv4/tcp_output.c:1861) [ 1831.917166][ C0] ? __alloc_skb (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 ./include/linux/refcount.h:125 net/core/skbuff.c:702) [ 1831.917337][ C0] ? __pfx_tcp_write_xmit (net/ipv4/tcp_output.c:2739) [ 1831.917615][ C0] ? tcp_set_state (net/ipv4/tcp.c:2870 (discriminator 53)) [ 1831.917783][ C0] ? __pfx_tcp_set_state (net/ipv4/tcp.c:2870) [ 1831.917956][ C0] ? lock_acquire (kernel/locking/lockdep.c:5798) [ 1831.918237][ C0] ? lock_sock_nested (./include/net/sock.h:1723 net/core/sock.c:3623) [ 1831.918408][ C0] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3015) [ 1831.918578][ C0] inet_shutdown (net/ipv4/af_inet.c:925) [ 1831.918862][ C0] ? sockfd_lookup_light (net/socket.c:557) [ 1831.919035][ C0] __sys_shutdown (net/socket.c:2448 net/socket.c:2460) [ 1831.919315][ C0] ? __pfx___sys_shutdown (net/socket.c:2454) [ 1831.919483][ C0] ? audit_reset_context.part.0.constprop.0 (./include/linux/list.h:373 kernel/auditsc.c:1023) [ 1831.919695][ C0] __x64_sys_shutdown (net/socket.c:2466) [ 1831.919866][ C0] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) [ 1831.920145][ C0] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1831.920358][ C0] RIP: 0033:0x7f8f33226beb [ 1831.920530][ C0] Code: 73 01 c3 48 8b 0d 15 92 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 30 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e5 91 1b 00 f7 d8 64 89 01 48 All code ======== 0: 73 01 jae 0x3 2: c3 ret 3: 48 8b 0d 15 92 1b 00 mov 0x1b9215(%rip),%rcx # 0x1b921f a: f7 d8 neg %eax c: 64 89 01 mov %eax,%fs:(%rcx) f: 48 83 c8 ff or $0xffffffffffffffff,%rax 13: c3 ret 14: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 1b: 00 00 00 1e: 90 nop 1f: f3 0f 1e fa endbr64 23: b8 30 00 00 00 mov $0x30,%eax 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 ret 33: 48 8b 0d e5 91 1b 00 mov 0x1b91e5(%rip),%rcx # 0x1b921f 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 73 01 jae 0x9 8: c3 ret 9: 48 8b 0d e5 91 1b 00 mov 0x1b91e5(%rip),%rcx # 0x1b91f5 10: f7 d8 neg %eax 12: 64 89 01 mov %eax,%fs:(%rcx) 15: 48 rex.W [ 1831.921264][ C0] RSP: 002b:00007ffd823f5608 EFLAGS: 00000202 ORIG_RAX: 0000000000000030 [ 1831.921661][ C0] RAX: ffffffffffffffda RBX: 00005636628cf610 RCX: 00007f8f33226beb [ 1831.922069][ C0] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000008 [ 1831.922341][ C0] RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000000 [ 1831.922610][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: ffffffffffffffff Finger prints: xfrm_sk_policy_lookup:xfrm_lookup_with_ifid:nf_xfrm_me_harder:nf_nat_ipv4_out:nf_hook_slow print_report:kasan_report:xfrm_lookup_with_ifid:nf_xfrm_me_harder:nf_nat_ipv4_out