====================================== | xx__-> [ 12.356886][ T234] ================================================================== | [ 12.357159][ T234] BUG: KASAN: global-out-of-bounds in snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) | [ 12.357437][ T234] Read of size 8 at addr ffffffffa42d4790 by task rst_ipv6/234 | [ 12.357676][ T234] [ 12.357762][ T234] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 12.357764][ T234] Call Trace: [ 12.357766][ T234] [ 12.357768][ T234] dump_stack_lvl (lib/dump_stack.c:123) [ 12.357774][ T234] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 12.357781][ T234] ? snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) [ 12.357785][ T234] print_report (mm/kasan/report.c:483) [ 12.357788][ T234] ? snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) [ 12.357791][ T234] ? kasan_addr_to_slab (./include/linux/mm.h:1180 mm/kasan/../slab.h:187 mm/kasan/common.c:38) [ 12.357795][ T234] ? snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) [ 12.357797][ T234] kasan_report (mm/kasan/report.c:597) [ 12.357801][ T234] ? snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) [ 12.357806][ T234] snmp6_seq_show_item64.constprop.0 (net/ipv6/proc.c:211) [ 12.357811][ T234] ? sockstat6_seq_show (net/ipv6/proc.c:202) [ 12.357822][ T234] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 12.357827][ T234] ? trace_kmalloc (./include/trace/events/kmem.h:54 (discriminator 21)) [ 12.357832][ T234] ? __kvmalloc_node_noprof (mm/slub.c:5055) [ 12.357837][ T234] snmp6_seq_show (net/ipv6/proc.c:224) [ 12.357840][ T234] seq_read_iter (fs/seq_file.c:231) [ 12.357849][ T234] seq_read (fs/seq_file.c:163) [ 12.357852][ T234] ? seq_read_iter (fs/seq_file.c:152) [ 12.357856][ T234] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 12.357863][ T234] ? __mutex_trylock_common (./arch/x86/include/asm/atomic64_64.h:101 ./include/linux/atomic/atomic-arch-fallback.h:4296 ./include/linux/atomic/atomic-long.h:1482 ./include/linux/atomic/atomic-instrumented.h:4458 kernel/locking/mutex.c:113) [ 12.357867][ T234] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 12.357872][ T234] proc_reg_read (fs/proc/inode.c:308 fs/proc/inode.c:320) [ 12.357878][ T234] vfs_read (fs/read_write.c:570) [ 12.357881][ T234] ? fdget_pos (fs/file.c:1235) [ 12.357886][ T234] ? ww_mutex_lock (kernel/locking/mutex.c:759) [ 12.357892][ T234] ? kernel_read (fs/read_write.c:553) [ 12.357895][ T234] ? __lock_release (kernel/locking/lockdep.c:5536) [ 12.357899][ T234] ? __fget_files (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 fs/file.c:1072) [ 12.357903][ T234] ? __fget_files (fs/file.c:1075) [ 12.357909][ T234] ksys_read (fs/read_write.c:715) [ 12.357913][ T234] ? vfs_write (fs/read_write.c:705) [ 12.357917][ T234] ? trace_irq_enable.constprop.0 (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:646 ./include/linux/cpumask.h:1205 ./include/trace/events/preemptirq.h:40) [ 12.357924][ T234] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 12.357928][ T234] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 12.357932][ T234] RIP: 0033:0x7fe5605492cc [ 12.357935][ T234] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 8b f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 7f 8b f8 ff 48 All code ======== 0: ec in (%dx),%al 1: 28 48 89 sub %cl,-0x77(%rax) 4: 54 push %rsp 5: 24 18 and $0x18,%al 7: 48 89 74 24 10 mov %rsi,0x10(%rsp) c: 89 7c 24 08 mov %edi,0x8(%rsp) 10: e8 29 8b f8 ff call 0xfffffffffff88b3e 15: 48 8b 54 24 18 mov 0x18(%rsp),%rdx 1a: 48 8b 74 24 10 mov 0x10(%rsp),%rsi 1f: 41 89 c0 mov %eax,%r8d 22: 8b 7c 24 08 mov 0x8(%rsp),%edi 26: 31 c0 xor %eax,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 34 ja 0x66 32: 44 89 c7 mov %r8d,%edi 35: 48 89 44 24 08 mov %rax,0x8(%rsp) 3a: e8 7f 8b f8 ff call 0xfffffffffff88bbe 3f: 48 rex.W Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 34 ja 0x3c 8: 44 89 c7 mov %r8d,%edi b: 48 89 44 24 08 mov %rax,0x8(%rsp) 10: e8 7f 8b f8 ff call 0xfffffffffff88b94 15: 48 rex.W [ 12.357938][ T234] RSP: 002b:00007fe55fc454d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 12.357942][ T234] RAX: ffffffffffffffda RBX: 00007fe550000b60 RCX: 00007fe5605492cc [ 12.357944][ T234] RDX: 0000000000000400 RSI: 00007fe550000dc0 RDI: 000000000000000a [ 12.357946][ T234] RBP: 00007fe5606415c0 R08: 0000000000000000 R09: 0000000000000000 [ 12.357948][ T234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 Finger prints: print_report:kasan_report:snmp6_seq_show:seq_read_iter:seq_read