====================================== | [ 1164.361591][ T2104] ================================================================== | [ 1164.361785][ T2104] BUG: KASAN: slab-use-after-free in __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5)) | [ 1164.361950][ T2104] Read of size 8 at addr ff11000014b00d10 by task tun/2104 | [ 1164.362096][ T2104] [ 1164.362150][ T2104] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1164.362152][ T2104] Call Trace: [ 1164.362153][ T2104] [ 1164.362155][ T2104] dump_stack_lvl (lib/dump_stack.c:122) [ 1164.362161][ T2104] print_address_description.constprop.0 (mm/kasan/report.c:379 (discriminator 1)) [ 1164.362166][ T2104] print_report (mm/kasan/report.c:483) [ 1164.362168][ T2104] ? __virt_addr_valid (./include/linux/rcupdate.h:937 (discriminator 1) ./include/linux/mmzone.h:2197 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 1164.362171][ T2104] ? __virt_addr_valid (./include/linux/rcupdate.h:963 (discriminator 4) ./include/linux/mmzone.h:2207 (discriminator 4) arch/x86/mm/physaddr.c:54 (discriminator 4)) [ 1164.362174][ T2104] kasan_report (mm/kasan/report.c:597) [ 1164.362177][ T2104] ? __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5)) [ 1164.362179][ T2104] ? __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5)) [ 1164.362182][ T2104] __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5)) [ 1164.362184][ T2104] fib6_purge_rt (net/ipv6/ip6_fib.c:1037 net/ipv6/ip6_fib.c:1038 net/ipv6/ip6_fib.c:1049) [ 1164.362187][ T2104] fib6_del_route (net/ipv6/ip6_fib.c:2052) [ 1164.362188][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362193][ T2104] ? fib6_purge_rt (net/ipv6/ip6_fib.c:1972) [ 1164.362195][ T2104] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1164.362196][ T2104] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536) [ 1164.362198][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362200][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362202][ T2104] fib6_del (net/ipv6/ip6_fib.c:2096) [ 1164.362204][ T2104] ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 3) kernel/locking/lockdep.c:3821 (discriminator 3) kernel/locking/lockdep.c:3876 (discriminator 3)) [ 1164.362206][ T2104] fib6_clean_node (net/ipv6/ip6_fib.c:2258) [ 1164.362209][ T2104] ? fib6_del (net/ipv6/ip6_fib.c:2234) [ 1164.362211][ T2104] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1164.362213][ T2104] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 1164.362215][ T2104] fib6_walk_continue (net/ipv6/ip6_fib.c:2180) [ 1164.362217][ T2104] ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1)) [ 1164.362219][ T2104] ? fib6_ifup (net/ipv6/route.c:4963) [ 1164.362220][ T2104] ? fib6_ifup (net/ipv6/route.c:4963) [ 1164.362222][ T2104] fib6_walk (net/ipv6/ip6_fib.c:2227) [ 1164.362224][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362225][ T2104] fib6_clean_tree (net/ipv6/ip6_fib.c:2293) [ 1164.362227][ T2104] ? fib6_walk (net/ipv6/ip6_fib.c:2293) [ 1164.362229][ T2104] ? fib6_del (net/ipv6/ip6_fib.c:2234) [ 1164.362231][ T2104] ? fib6_ifup (net/ipv6/route.c:4963) [ 1164.362233][ T2104] ? fib6_ifup (net/ipv6/route.c:4963) [ 1164.362238][ T2104] __fib6_clean_all (./include/linux/spinlock.h:396 net/ipv6/ip6_fib.c:2325) [ 1164.362240][ T2104] rt6_disable_ip (net/ipv6/route.c:5018 net/ipv6/route.c:5023) [ 1164.362242][ T2104] ? rt6_sync_down_dev (net/ipv6/route.c:5022) [ 1164.362244][ T2104] ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 11) kernel/locking/lockdep.c:4411 (discriminator 11)) [ 1164.362246][ T2104] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:179 (discriminator 4) kernel/locking/spinlock.c:198 (discriminator 4)) [ 1164.362249][ T2104] addrconf_ifdown.isra.0 (./include/net/addrconf.h:348 (discriminator 4) net/ipv6/addrconf.c:3873 (discriminator 4)) [ 1164.362253][ T2104] ? __timer_delete_sync (kernel/time/timer.c:1603 (discriminator 2)) [ 1164.362255][ T2104] ? __timer_delete_sync (kernel/time/timer.c:1623 (discriminator 1)) [ 1164.362257][ T2104] ? __neigh_ifdown.isra.0 (net/core/neighbour.c:479 (discriminator 1)) [ 1164.362260][ T2104] ? addrconf_dad_run (net/ipv6/addrconf.c:3858) [ 1164.362262][ T2104] ? netkit_xmit (drivers/net/netkit.c:1186) [ 1164.362266][ T2104] ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1)) [ 1164.362268][ T2104] addrconf_notify (net/ipv6/addrconf.c:3828) [ 1164.362270][ T2104] ? team_port_get_rtnl (drivers/net/team/team_core.c:42 (discriminator 4)) [ 1164.362272][ T2104] notifier_call_chain (kernel/notifier.c:87) [ 1164.362276][ T2104] netif_close_many (net/core/dev.c:1806) [ 1164.362279][ T2104] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1164.362281][ T2104] ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24)) [ 1164.362283][ T2104] ? __dev_close_many (net/core/dev.c:1793) [ 1164.362285][ T2104] ? netif_close_many_and_unlock (net/core/dev.c:12322 (discriminator 1)) [ 1164.362286][ T2104] ? __mutex_lock (./arch/x86/include/asm/preempt.h:104 kernel/locking/mutex.c:784 kernel/locking/mutex.c:806) [ 1164.362289][ T2104] unregister_netdevice_many_notify (net/core/dev.c:12397 (discriminator 1)) [ 1164.362292][ T2104] ? nla_get_range_signed (lib/nlattr.c:396) [ 1164.362295][ T2104] ? unregister_netdevice_queued (net/core/dev.c:12351) [ 1164.362297][ T2104] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:48 kernel/locking/mutex.c:65) [ 1164.362299][ T2104] ? rtnl_is_locked (net/core/rtnetlink.c:169 (discriminator 1)) [ 1164.362300][ T2104] ? unregister_netdevice_queue (net/core/dev.c:12290 (discriminator 3)) [ 1164.362302][ T2104] ? unregister_netdevice_many (net/core/dev.c:12289) [ 1164.362304][ T2104] ? __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 1164.362307][ T2104] rtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3601) [ 1164.362309][ T2104] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1164.362311][ T2104] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 1164.362312][ T2104] ? rtnl_mdb_del (net/core/rtnetlink.c:3559) [ 1164.362314][ T2104] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1164.362316][ T2104] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536) [ 1164.362323][ T2104] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1164.362325][ T2104] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 1164.362326][ T2104] ? mark_usage (kernel/locking/lockdep.c:4674 (discriminator 1)) [ 1164.362328][ T2104] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536) [ 1164.362330][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362332][ T2104] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536) [ 1164.362335][ T2104] ? rtnl_mdb_del (net/core/rtnetlink.c:3559) [ 1164.362337][ T2104] rtnetlink_rcv_msg (net/core/rtnetlink.c:6995) [ 1164.362339][ T2104] ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 3) kernel/locking/lockdep.c:3821 (discriminator 3) kernel/locking/lockdep.c:3876 (discriminator 3)) [ 1164.362341][ T2104] ? rtnl_fdb_dump (net/core/rtnetlink.c:6898) [ 1164.362343][ T2104] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1164.362345][ T2104] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1164.362347][ T2104] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 1164.362349][ T2104] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 1164.362351][ T2104] ? rtnl_fdb_dump (net/core/rtnetlink.c:6898) [ 1164.362354][ T2104] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 1164.362356][ T2104] ? netlink_deliver_tap (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:869 (discriminator 2) ./include/net/netns/generic.h:48 (discriminator 2) net/netlink/af_netlink.c:333 (discriminator 2)) [ 1164.362358][ T2104] ? netlink_deliver_tap (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:869 (discriminator 2) net/netlink/af_netlink.c:340 (discriminator 2)) [ 1164.362360][ T2104] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 1164.362362][ T2104] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 1164.362363][ T2104] ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4040 (discriminator 4) kernel/rcu/tree.c:4032 (discriminator 4)) [ 1164.362365][ T2104] ? rcu_read_lock_any_held (kernel/rcu/update.c:386 (discriminator 1) kernel/rcu/update.c:380 (discriminator 1)) [ 1164.362368][ T2104] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 1164.362370][ T2104] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 1164.362372][ T2104] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2)) [ 1164.362374][ T2104] ? __might_fault (mm/memory.c:7230 (discriminator 6)) [ 1164.362378][ T2104] __sys_sendto (net/socket.c:787 (discriminator 4) net/socket.c:802 (discriminator 4) net/socket.c:2265 (discriminator 4)) [ 1164.362381][ T2104] ? __ia32_sys_getpeername (net/socket.c:2232) [ 1164.362382][ T2104] ? __might_fault (mm/memory.c:7230 (discriminator 6)) [ 1164.362385][ T2104] ? __ia32_sys_connect (net/socket.c:2178) [ 1164.362386][ T2104] ? __sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1)) [ 1164.362390][ T2104] __x64_sys_sendto (net/socket.c:2272 (discriminator 1) net/socket.c:2268 (discriminator 1) net/socket.c:2268 (discriminator 1)) [ 1164.362392][ T2104] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24)) [ 1164.362395][ T2104] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473) [ 1164.362398][ T2104] ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:187 arch/x86/entry/syscall_64.c:89) [ 1164.362399][ T2104] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1164.362401][ T2104] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:106 (discriminator 9)) [ 1164.362402][ T2104] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3)) [ 1164.362405][ T2104] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1164.362407][ T2104] RIP: 0033:0x7fb5802ac22e [ 1164.362411][ T2104] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 94 bd 00 00 call 0xbd9c 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1164.362413][ T2104] RSP: 002b:00007ffcc96a6bb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 1164.362417][ T2104] RAX: ffffffffffffffda RBX: 00007ffcc96a6c40 RCX: 00007fb5802ac22e [ 1164.362418][ T2104] RDX: 000000000000002c RSI: 00000000036de638 RDI: 0000000000000027 [ 1164.362419][ T2104] RBP: 00007ffcc96a6bc0 R08: 0000000000000000 R09: 0000000000000000 [ 1164.362420][ T2104] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000036de3d0 [ 1164.362421][ T2104] R13: 00007ffcc96a6cd0 R14: 0000000000000022 R15: 00007fb580232000 | [ 1164.381389][ T2104] Disabling lock debugging due to kernel taint | [ 1164.392641][ C2] Oops: general protection fault, probably for non-canonical address 0xe09b3c3520000007: 0000 [#1] SMP KASAN | [ 1164.392853][ C2] KASAN: maybe wild-memory-access in range [0x04da01a900000038-0x04da01a90000003f] | [ 1164.393154][ C2] Tainted: [B]=BAD_PAGE [ 1164.393213][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1164.393325][ C2] RIP: 0010:dst_dev_put (net/core/dst.c:150) [ 1164.393413][ C2] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee All code ======== 0: fc cld 1: ff lcall (bad) 2: df 48 c1 fisttps -0x3f(%rax) 5: ea (bad) 6: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax c: 85 2c 02 test %ebp,(%rdx,%rax,1) f: 00 00 add %al,(%rax) 11: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 18: fc ff df 1b: 48 8b 43 08 mov 0x8(%rbx),%rax 1f: 48 8d 78 38 lea 0x38(%rax),%rdi 23: 48 89 f9 mov %rdi,%rcx 26: 48 c1 e9 03 shr $0x3,%rcx 2a:* 80 3c 11 00 cmpb $0x0,(%rcx,%rdx,1) <-- trapping instruction 2e: 0f 85 d8 01 00 00 jne 0x20c 34: 48 8b 40 38 mov 0x38(%rax),%rax 38: 48 85 c0 test %rax,%rax 3b: 74 08 je 0x45 3d: 48 89 ee mov %rbp,%rsi Code starting with the faulting instruction =========================================== 0: 80 3c 11 00 cmpb $0x0,(%rcx,%rdx,1) 4: 0f 85 d8 01 00 00 jne 0x1e2 a: 48 8b 40 38 mov 0x38(%rax),%rax e: 48 85 c0 test %rax,%rax 11: 74 08 je 0x1b 13: 48 89 ee mov %rbp,%rsi [ 1164.393689][ C2] RSP: 0018:ffa0000000228d48 EFLAGS: 00010212 [ 1164.393793][ C2] RAX: 04da01a900000000 RBX: ff11000014b00c80 RCX: 009b403520000007 [ 1164.393914][ C2] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 04da01a900000038 [ 1164.394034][ C2] RBP: ff11000004a0e9e8 R08: ffffffffb4b2c4fc R09: 1ffa3ffffff8129f [ 1164.394151][ C2] R10: fffa3bfffff812a0 R11: fffa3bfffff812a0 R12: ff1100002a362000 [ 1164.394270][ C2] R13: fffffbfff6b2684c R14: ff1100002a3620c8 R15: 0000000000000386 [ 1164.394393][ C2] FS: 0000000000000000(0000) GS:ff110000b4bcc000(0000) knlGS:0000000000000000 [ 1164.394530][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1164.394630][ C2] CR2: 0000564892a241c8 CR3: 000000001ccf7006 CR4: 0000000000771ef0 [ 1164.394752][ C2] PKRU: 55555554 [ 1164.394811][ C2] Call Trace: [ 1164.394872][ C2] [ 1164.394918][ C2] fib6_nh_release_dsts.part.0 (net/ipv6/route.c:3748) [ 1164.395001][ C2] fib6_nh_release (net/ipv6/route.c:3729) [ 1164.395079][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1164.395158][ C2] fib6_info_destroy_rcu (net/ipv6/ip6_fib.c:177) [ 1164.395238][ C2] ? rcu_do_batch (kernel/rcu/tree.c:2617) [ 1164.395317][ C2] ? rcu_do_batch (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/rcu.h:597 kernel/rcu/tree.c:2612) [ 1164.395396][ C2] rcu_do_batch (./include/linux/rcupdate.h:310 (discriminator 2) kernel/rcu/tree.c:2619 (discriminator 2)) [ 1164.395475][ C2] ? trace_rcu_batch_end (kernel/rcu/tree.c:2541) [ 1164.395556][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24)) [ 1164.395656][ C2] ? do_raw_spin_unlock (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141) [ 1164.395740][ C2] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1)) [ 1164.395817][ C2] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:179 (discriminator 4) kernel/locking/spinlock.c:198 (discriminator 4)) [ 1164.395914][ C2] rcu_core (kernel/rcu/tree.c:2871) [ 1164.395974][ C2] handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623) [ 1164.396054][ C2] ? clockevents_tick_resume (kernel/time/clockevents.c:337) [ 1164.396136][ C2] ? _local_bh_enable (kernel/softirq.c:580) [ 1164.396214][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1164.396297][ C2] ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24)) [ 1164.396377][ C2] __irq_exit_rcu (kernel/softirq.c:496 (discriminator 1) kernel/softirq.c:735 (discriminator 1)) [ 1164.396455][ C2] irq_exit_rcu (kernel/softirq.c:754) [ 1164.396514][ C2] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 37) arch/x86/kernel/apic/apic.c:1061 (discriminator 37)) [ 1164.396592][ C2] [ 1164.396633][ C2] [ 1164.396675][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1164.396760][ C2] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697) [ 1164.396857][ C2] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:63) [ 1164.396939][ C2] Code: 48 8b 3d 54 63 60 02 e8 1f 00 00 00 48 2b 05 d8 21 9e 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 13 54 14 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01 All code ======== 0: 48 8b 3d 54 63 60 02 mov 0x2606354(%rip),%rdi # 0x260635b 7: e8 1f 00 00 00 call 0x2b c: 48 2b 05 d8 21 9e 00 sub 0x9e21d8(%rip),%rax # 0x9e21eb 13: c3 ret 14: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 1b: f3 0f 1e fa endbr64 1f: eb 07 jmp 0x28 21: 0f 00 2d 13 54 14 00 verw 0x145413(%rip) # 0x14543b 28: fb sti 29: f4 hlt 2a:* c3 ret <-- trapping instruction 2b: 0f 1f 40 d6 nopl -0x2a(%rax) 2f: 48 83 ec 20 sub $0x20,%rsp 33: 8b 17 mov (%rdi),%edx 35: 49 89 f8 mov %rdi,%r8 38: 83 e2 fe and $0xfffffffe,%edx 3b: 41 89 d2 mov %edx,%r10d 3e: 0f .byte 0xf 3f: 01 .byte 0x1 Code starting with the faulting instruction =========================================== 0: c3 ret 1: 0f 1f 40 d6 nopl -0x2a(%rax) 5: 48 83 ec 20 sub $0x20,%rsp 9: 8b 17 mov (%rdi),%edx b: 49 89 f8 mov %rdi,%r8 e: 83 e2 fe and $0xfffffffe,%edx 11: 41 89 d2 mov %edx,%r10d 14: 0f .byte 0xf 15: 01 .byte 0x1 [ 1164.397214][ C2] RSP: 0018:ffa0000000157de8 EFLAGS: 00000246 [ 1164.397313][ C2] RAX: 0000000000000002 RBX: ff11000001b9c640 RCX: 0000000000000001 [ 1164.397432][ C2] RDX: 0000000000000002 RSI: ffffffffb52719c0 RDI: ffffffffb28df5db [ 1164.397550][ C2] RBP: 0000000000000000 R08: ffffffffb4f534f1 R09: 1fe220000d82639a [ 1164.397669][ C2] R10: 0000000000000002 R11: 0000000000000000 R12: 1ff400000002afc0 [ 1164.397794][ C2] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 1164.397913][ C2] ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:126) [ 1164.398011][ C2] ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200) [ 1164.398110][ C2] default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767) [ 1164.398169][ C2] default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1)) [ 1164.398288][ C2] cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200) [ 1164.398388][ C2] ? arch_cpu_idle_exit+0x40/0x40 [ 1164.398467][ C2] ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52) [ 1164.398546][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24)) [ 1164.398642][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1164.398725][ C2] do_idle (kernel/sched/idle.c:352) [ 1164.398784][ C2] cpu_startup_entry (kernel/sched/idle.c:450 (discriminator 1)) [ 1164.398863][ C2] start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 11) arch/x86/kernel/smpboot.c:280 (discriminator 11)) [ 1164.398944][ C2] ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230) Finger prints: dst_dev_put:fib6_nh_release:fib6_info_destroy_rcu:rcu_do_batch:rcu_core print_report:kasan_report:fib6_purge_rt:fib6_del_route:fib6_del