====================================== | xx__-> [ 2.338111] ------------[ cut here ]------------ | [ 2.338233] refcount_t: underflow; use-after-free. | [ 2.338317] WARNING: CPU: 0 PID: 12 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 2.338400] Modules linked in: nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 [ 2.338583] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2.338638] Workqueue: netns cleanup_net [ 2.338681] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 2.338727] Code: b7 e8 18 ed b9 ff 90 0f 0b 90 90 c3 80 3d d9 ea ea 00 00 75 89 c6 05 d0 ea ea 00 01 90 48 c7 c7 78 de b1 b7 e8 f5 ec b9 ff 90 <0f> 0b 90 90 c3 80 3d b4 ea ea 00 00 0f 85 62 ff ff ff c6 05 a7 ea All code ======== 0: b7 e8 mov $0xe8,%bh 2: 18 ed sbb %ch,%ch 4: b9 ff 90 0f 0b mov $0xb0f90ff,%ecx 9: 90 nop a: 90 nop b: c3 ret c: 80 3d d9 ea ea 00 00 cmpb $0x0,0xeaead9(%rip) # 0xeaeaec 13: 75 89 jne 0xffffffffffffff9e 15: c6 05 d0 ea ea 00 01 movb $0x1,0xeaead0(%rip) # 0xeaeaec 1c: 90 nop 1d: 48 c7 c7 78 de b1 b7 mov $0xffffffffb7b1de78,%rdi 24: e8 f5 ec b9 ff call 0xffffffffffb9ed1e 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: c3 ret 2f: 80 3d b4 ea ea 00 00 cmpb $0x0,0xeaeab4(%rip) # 0xeaeaea 36: 0f 85 62 ff ff ff jne 0xffffffffffffff9e 3c: c6 .byte 0xc6 3d: 05 .byte 0x5 3e: a7 cmpsl %es:(%rdi),%ds:(%rsi) 3f: ea (bad) Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: c3 ret 5: 80 3d b4 ea ea 00 00 cmpb $0x0,0xeaeab4(%rip) # 0xeaeac0 c: 0f 85 62 ff ff ff jne 0xffffffffffffff74 12: c6 .byte 0xc6 13: 05 .byte 0x5 14: a7 cmpsl %es:(%rdi),%ds:(%rsi) 15: ea (bad) [ 2.338902] RSP: 0018:ffffb22680067d50 EFLAGS: 00010286 [ 2.338952] RAX: 0000000000000000 RBX: ffffb22680067d60 RCX: 00000000ffffdfff [ 2.339017] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001 Finger prints: