====================================== | [ 1923.446244][T19682] ================================================================== | [ 1923.446398][T19682] BUG: KASAN: slab-use-after-free in ip6_pol_route (net/ipv6/route.c:1446 (discriminator 1) net/ipv6/route.c:2316 (discriminator 1)) | [ 1923.446526][T19682] Read of size 4 at addr ff110000167947d8 by task cmsg_sender/19682 | [ 1923.446639][T19682] [ 1923.446685][T19682] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1923.446687][T19682] Call Trace: [ 1923.446688][T19682] [ 1923.446689][T19682] dump_stack_lvl (lib/dump_stack.c:122) [ 1923.446695][T19682] print_address_description.constprop.0 (mm/kasan/report.c:379 (discriminator 1)) [ 1923.446700][T19682] print_report (mm/kasan/report.c:483) [ 1923.446702][T19682] ? __virt_addr_valid (./include/linux/rcupdate.h:937 (discriminator 1) ./include/linux/mmzone.h:2197 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 1923.446706][T19682] ? __virt_addr_valid (./include/linux/rcupdate.h:963 (discriminator 4) ./include/linux/mmzone.h:2207 (discriminator 4) arch/x86/mm/physaddr.c:54 (discriminator 4)) [ 1923.446708][T19682] kasan_report (mm/kasan/report.c:597) [ 1923.446712][T19682] ? ip6_pol_route (net/ipv6/route.c:1446 (discriminator 1) net/ipv6/route.c:2316 (discriminator 1)) [ 1923.446714][T19682] ? ip6_pol_route (net/ipv6/route.c:1446 (discriminator 1) net/ipv6/route.c:2316 (discriminator 1)) [ 1923.446716][T19682] ip6_pol_route (net/ipv6/route.c:1446 (discriminator 1) net/ipv6/route.c:2316 (discriminator 1)) [ 1923.446717][T19682] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1923.446721][T19682] ? ip6_pol_route_lookup (net/ipv6/route.c:2268) [ 1923.446723][T19682] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1923.446725][T19682] ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4040 (discriminator 4) kernel/rcu/tree.c:4032 (discriminator 4)) [ 1923.446728][T19682] ? rcu_read_lock_any_held (kernel/rcu/update.c:386 (discriminator 1) kernel/rcu/update.c:380 (discriminator 1)) [ 1923.446730][T19682] ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 3) kernel/locking/lockdep.c:3821 (discriminator 3) kernel/locking/lockdep.c:3876 (discriminator 3)) [ 1923.446732][T19682] ? ip6_pol_route_input (net/ipv6/route.c:2665) [ 1923.446734][T19682] fib6_rule_lookup (net/ipv6/fib6_rules.c:130) [ 1923.446737][T19682] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1923.446739][T19682] ? fib6_lookup (net/ipv6/fib6_rules.c:102) [ 1923.446742][T19682] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1923.446743][T19682] ? ip6_route_output_flags (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:838 (discriminator 2) net/ipv6/route.c:2710 (discriminator 2)) [ 1923.446745][T19682] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1923.446747][T19682] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1923.446749][T19682] ip6_route_output_flags (net/ipv6/route.c:2699 net/ipv6/route.c:2711) [ 1923.446751][T19682] ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1155 (discriminator 1)) [ 1923.446753][T19682] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1923.446755][T19682] ip6_dst_lookup_flow (net/ipv6/ip6_output.c:1289) [ 1923.446757][T19682] ? ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1282) [ 1923.446759][T19682] ? sk_dst_check (net/core/sock.c:622) [ 1923.446762][T19682] ip6_sk_dst_lookup_flow (net/ipv6/ip6_output.c:1326 (discriminator 1)) [ 1923.446764][T19682] ping_v6_sendmsg (net/ipv6/ping.c:151) [ 1923.446767][T19682] ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 3) kernel/locking/lockdep.c:3821 (discriminator 3) kernel/locking/lockdep.c:3876 (discriminator 3)) [ 1923.446770][T19682] ? l3mdev_master_ifindex_by_index (./include/linux/rcupdate.h:867 (discriminator 7) ./include/net/l3mdev.h:102 (discriminator 7)) [ 1923.446773][T19682] ? release_sock (net/core/sock.c:3814) [ 1923.446774][T19682] ? reacquire_held_locks (kernel/locking/lockdep.c:5385 (discriminator 2)) [ 1923.446776][T19682] ? release_sock (net/core/sock.c:3814) [ 1923.446777][T19682] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1923.446779][T19682] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536) [ 1923.446782][T19682] ? inet_autobind (net/ipv4/af_inet.c:195) [ 1923.446784][T19682] ? inet_send_prepare (net/ipv4/af_inet.c:853) [ 1923.446787][T19682] ____sys_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4) net/socket.c:2698 (discriminator 4)) [ 1923.446789][T19682] ? copy_msghdr_from_user (net/socket.c:2638) [ 1923.446790][T19682] ? get_timestamp.constprop.0 (net/socket.c:2644) [ 1923.446792][T19682] ? move_addr_to_kernel (net/socket.c:2624) [ 1923.446795][T19682] ___sys_sendmsg (net/socket.c:2754) [ 1923.446796][T19682] ? copy_msghdr_from_user (net/socket.c:2741) [ 1923.446798][T19682] ? do_fault_around (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:869 (discriminator 2) mm/memory.c:5760 (discriminator 2)) [ 1923.446802][T19682] ? do_pte_missing (mm/memory.c:5790 mm/memory.c:5933 mm/memory.c:4477) [ 1923.446805][T19682] ? lock_vma_under_rcu (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:869 (discriminator 2) mm/mmap_lock.c:329 (discriminator 2)) [ 1923.446808][T19682] __sys_sendmsg (net/socket.c:2784 (discriminator 1)) [ 1923.446810][T19682] ? __sys_sendmsg_sock (net/socket.c:2769) [ 1923.446813][T19682] ? do_user_addr_fault (./arch/x86/include/asm/atomic.h:93 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:949 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:401 (discriminator 4) ./include/linux/refcount.h:389 (discriminator 4) ./include/linux/refcount.h:432 (discriminator 4) ./include/linux/mmap_lock.h:196 (discriminator 4) ./include/linux/mmap_lock.h:217 (discriminator 4) ./include/linux/mmap_lock.h:264 (discriminator 4) arch/x86/mm/fault.c:1336 (discriminator 4)) [ 1923.446815][T19682] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1923.446816][T19682] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1923.446818][T19682] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1923.446820][T19682] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:106 (discriminator 9)) [ 1923.446825][T19682] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3)) [ 1923.446828][T19682] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1923.446830][T19682] RIP: 0033:0x7fe7a9d8f22e [ 1923.446833][T19682] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 94 bd 00 00 call 0xbd9c 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1923.446835][T19682] RSP: 002b:00007fff0da75200 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 1923.446839][T19682] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe7a9d8f22e [ 1923.446840][T19682] RDX: 0000000000000000 RSI: 00007fff0da752d0 RDI: 0000000000000005 [ 1923.446841][T19682] RBP: 00007fff0da75210 R08: 0000000000000000 R09: 0000000000000000 [ 1923.446842][T19682] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000005 [ 1923.446843][T19682] R13: 000000002ccd1010 R14: 00007fe7a9f61000 R15: 0000000000404e00 | [ 1923.459255][T19682] Disabling lock debugging due to kernel taint | [ 1927.734258][T19926] Oops: general protection fault, probably for non-canonical address 0xed6d696d6d6d6d8e: 0000 [#1] SMP KASAN | [ 1927.734474][T19926] KASAN: maybe wild-memory-access in range [0x6b6b6b6b6b6b6c70-0x6b6b6b6b6b6b6c77] | [ 1927.734768][T19926] Tainted: [B]=BAD_PAGE [ 1927.734829][T19926] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1927.734929][T19926] RIP: 0010:ip6_pol_route (./include/net/net_namespace.h:419 (discriminator 7) ./include/linux/netdevice.h:2764 (discriminator 7) net/ipv6/route.c:1436 (discriminator 7) net/ipv6/route.c:1446 (discriminator 7) net/ipv6/route.c:2316 (discriminator 7)) [ 1927.735018][T19926] Code: 80 3c 02 00 0f 85 80 04 00 00 4c 8b 3b e8 7f 4e 40 00 48 b8 00 00 00 00 00 fc ff df 49 8d bf 08 01 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4c 04 00 00 49 8b 97 08 01 00 00 be 04 00 00 00 All code ======== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 80 04 00 00 jne 0x48a a: 4c 8b 3b mov (%rbx),%r15 d: e8 7f 4e 40 00 call 0x404e91 12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 19: fc ff df 1c: 49 8d bf 08 01 00 00 lea 0x108(%r15),%rdi 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx 2a:* 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 4c 04 00 00 jne 0x480 34: 49 8b 97 08 01 00 00 mov 0x108(%r15),%rdx 3b: be 04 00 00 00 mov $0x4,%esi Code starting with the faulting instruction =========================================== 0: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 4: 0f 85 4c 04 00 00 jne 0x456 a: 49 8b 97 08 01 00 00 mov 0x108(%r15),%rdx 11: be 04 00 00 00 mov $0x4,%esi [ 1927.735288][T19926] RSP: 0018:ffa0000002557388 EFLAGS: 00010216 [ 1927.735387][T19926] RAX: dffffc0000000000 RBX: ff11000016795a80 RCX: ffffffff9054dee1 [ 1927.735506][T19926] RDX: 0d6d6d6d6d6d6d8e RSI: 0000000000000008 RDI: 6b6b6b6b6b6b6c73 [ 1927.735623][T19926] RBP: 1ff40000004aae74 R08: 0000000000000000 R09: 0000000000000000 [ 1927.735739][T19926] R10: 0000000000000000 R11: ff11000016b2c4c0 R12: ff1100000f260040 [ 1927.735855][T19926] R13: 000000006b6b6b6b R14: 0000000000000080 R15: 6b6b6b6b6b6b6b6b [ 1927.735976][T19926] FS: 00007ff0207d1740(0000) GS:ff110000d91cc000(0000) knlGS:0000000000000000 [ 1927.736112][T19926] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1927.736211][T19926] CR2: 00007ff0209d9000 CR3: 00000000142ef003 CR4: 0000000000771ef0 [ 1927.736326][T19926] PKRU: 55555554 [ 1927.736385][T19926] Call Trace: [ 1927.736443][T19926] [ 1927.736483][T19926] ? ip6_pol_route_lookup (net/ipv6/route.c:2268) [ 1927.736559][T19926] ? unwind_next_frame (./include/linux/rcupdate.h:871 ./include/linux/rcupdate.h:1181 arch/x86/kernel/unwind_orc.c:495) [ 1927.736642][T19926] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1927.736721][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.736798][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.736876][T19926] ? ip6_pol_route_input (net/ipv6/route.c:2665) [ 1927.736952][T19926] __fib6_rule_action (net/ipv6/fib6_rules.c:242) [ 1927.737033][T19926] fib_rules_lookup (net/core/fib_rules.c:339) [ 1927.737110][T19926] ? fib_nl_dumprule (net/core/fib_rules.c:315) [ 1927.737186][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.737261][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.737338][T19926] ? ip6_pol_route_input (net/ipv6/route.c:2665) [ 1927.737414][T19926] fib6_rule_lookup (net/ipv6/fib6_rules.c:118) [ 1927.737490][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.737566][T19926] ? fib6_lookup (net/ipv6/fib6_rules.c:102) [ 1927.737643][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.737718][T19926] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1927.737793][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.737869][T19926] ? ip6_pol_route_input (net/ipv6/route.c:2665) [ 1927.737945][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.738025][T19926] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1927.738100][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.738175][T19926] ip6_route_output_flags (net/ipv6/route.c:2699 net/ipv6/route.c:2711) [ 1927.738251][T19926] ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1155 (discriminator 1)) [ 1927.738346][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.738421][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.738497][T19926] ip6_dst_lookup_flow (net/ipv6/ip6_output.c:1289) [ 1927.738574][T19926] ? ip6_dst_lookup_tail.constprop.0 (net/ipv6/ip6_output.c:1282) [ 1927.738669][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.738746][T19926] ? sk_dst_check (./include/linux/rcupdate.h:839 (discriminator 1) ./include/net/sock.h:2197 (discriminator 1) net/core/sock.c:620 (discriminator 1)) [ 1927.738823][T19926] ? sk_dst_check (net/core/sock.c:622) [ 1927.738900][T19926] ip6_sk_dst_lookup_flow (net/ipv6/ip6_output.c:1326 (discriminator 1)) [ 1927.738978][T19926] udpv6_sendmsg (net/ipv6/udp.c:1686) [ 1927.739056][T19926] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1927.739134][T19926] ? udpv6_splice_eof (net/ipv6/udp.c:1457) [ 1927.739209][T19926] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1)) [ 1927.739286][T19926] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 1927.739365][T19926] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24)) [ 1927.739458][T19926] ? trace_irq_disable.constprop.0 (./include/trace/events/preemptirq.h:36 (discriminator 24)) [ 1927.739551][T19926] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1)) [ 1927.739626][T19926] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:455) [ 1927.739703][T19926] ? inet_autobind (net/ipv4/af_inet.c:195) [ 1927.739780][T19926] ? ____sys_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4) net/socket.c:2698 (discriminator 4)) [ 1927.739857][T19926] ____sys_sendmsg (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4) net/socket.c:2698 (discriminator 4)) [ 1927.739932][T19926] ? copy_msghdr_from_user (net/socket.c:2638) [ 1927.740011][T19926] ? get_timestamp.constprop.0 (net/socket.c:2644) [ 1927.740105][T19926] ? move_addr_to_kernel (net/socket.c:2624) [ 1927.740181][T19926] ___sys_sendmsg (net/socket.c:2754) [ 1927.740258][T19926] ? copy_msghdr_from_user (net/socket.c:2741) [ 1927.740334][T19926] ? insert_pfn (mm/memory.c:2712) [ 1927.740412][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.740488][T19926] ? do_pte_missing (mm/memory.c:5799 mm/memory.c:5933 mm/memory.c:4477) [ 1927.740562][T19926] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1927.740639][T19926] __sys_sendmsg (net/socket.c:2784 (discriminator 1)) [ 1927.740714][T19926] ? __sys_sendmsg_sock (net/socket.c:2769) [ 1927.740790][T19926] ? down_write_nested (kernel/locking/rwsem.c:1380) [ 1927.740868][T19926] ? do_user_addr_fault (./include/linux/mmap_lock.h:619 arch/x86/mm/fault.c:1413) [ 1927.740947][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.741027][T19926] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1927.741104][T19926] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1927.741182][T19926] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:106 (discriminator 9)) [ 1927.741258][T19926] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3)) [ 1927.741335][T19926] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1927.741431][T19926] RIP: 0033:0x7ff02084422e [ 1927.741514][T19926] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 94 bd 00 00 call 0xbd9c 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1927.741784][T19926] RSP: 002b:00007ffc86237db0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 1927.741902][T19926] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff02084422e [ 1927.742019][T19926] RDX: 0000000000000000 RSI: 00007ffc86237e80 RDI: 0000000000000005 [ 1927.742134][T19926] RBP: 00007ffc86237dc0 R08: 0000000000000000 R09: 0000000000000000 [ 1927.742247][T19926] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000005 Finger prints: ip6_pol_route:__fib6_rule_action:fib_rules_lookup:fib6_rule_lookup:ip6_route_output_flags print_report:kasan_report:ip6_pol_route:fib6_rule_lookup:ip6_route_output_flags