====================================== | 0 | xx__-> [ 1479.062303][T26024] ------------[ cut here ]------------ | [ 1479.062542][T26024] WARNING: ./include/linux/skbuff.h:3094 at geneve_udp_encap_recv+0x933/0xc68 [geneve], CPU#1: tun/26024 | [ 1479.062945][T26024] Modules linked in: geneve ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables [ 1479.063594][T26024] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1479.063772][T26024] RIP: 0010:geneve_udp_encap_recv (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) drivers/net/geneve.c:214 (discriminator 4) drivers/net/geneve.c:695 (discriminator 4)) geneve [ 1479.063955][T26024] Code: df 48 c1 ee 03 0f b6 34 06 48 89 f8 83 e0 07 83 c0 03 40 38 f0 7c 09 40 84 f6 0f 85 f9 02 00 00 41 8b 76 0c e9 13 fd ff ff 90 <0f> 0b 90 e9 1b fc ff ff 90 0f 0b 90 e9 66 fe ff ff 48 8d b9 a0 00 All code ======== 0: df 48 c1 fisttps -0x3f(%rax) 3: ee out %al,(%dx) 4: 03 0f add (%rdi),%ecx 6: b6 34 mov $0x34,%dh 8: 06 (bad) 9: 48 89 f8 mov %rdi,%rax c: 83 e0 07 and $0x7,%eax f: 83 c0 03 add $0x3,%eax 12: 40 38 f0 cmp %sil,%al 15: 7c 09 jl 0x20 17: 40 84 f6 test %sil,%sil 1a: 0f 85 f9 02 00 00 jne 0x319 20: 41 8b 76 0c mov 0xc(%r14),%esi 24: e9 13 fd ff ff jmp 0xfffffffffffffd3c 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: e9 1b fc ff ff jmp 0xfffffffffffffc4d 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: e9 66 fe ff ff jmp 0xfffffffffffffea1 3b: 48 rex.W 3c: 8d .byte 0x8d 3d: b9 .byte 0xb9 3e: a0 .byte 0xa0 ... Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: e9 1b fc ff ff jmp 0xfffffffffffffc23 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: e9 66 fe ff ff jmp 0xfffffffffffffe77 11: 48 rex.W 12: 8d .byte 0x8d 13: b9 .byte 0xb9 14: a0 .byte 0xa0 ... [ 1479.064525][T26024] RSP: 0018:ffa00000010f73c0 EFLAGS: 00010246 [ 1479.064703][T26024] RAX: 0000000000000007 RBX: ff11000015340000 RCX: 0000000000000001 [ 1479.064911][T26024] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ff110000099ab781 [ 1479.065230][T26024] RBP: ffa00000010f7490 R08: ffffffffbaef86bb R09: 1fe220000170dae0 [ 1479.065541][T26024] R10: ffe21c000170dae1 R11: ffe21c000170dae1 R12: 0000000000000000 [ 1479.065842][T26024] R13: 000000000000ffff R14: ff11000012734e80 R15: ff110000099ab700 [ 1479.066051][T26024] FS: 00007f10f039a740(0000) GS:ff110000ae130000(0000) knlGS:0000000000000000 [ 1479.066398][T26024] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1479.066578][T26024] CR2: 00007fffe67d7d00 CR3: 000000000277e001 CR4: 0000000000771ef0 [ 1479.066787][T26024] PKRU: 55555554 [ 1479.066987][T26024] Call Trace: [ 1479.067094][T26024] [ 1479.067167][T26024] ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1)) [ 1479.067319][T26024] ? geneve_udp_encap_err_lookup (./include/linux/skbuff.h:3095) geneve [ 1479.067498][T26024] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 1479.067736][T26024] ? __xfrm_policy_check2.constprop.0 (./include/net/net_namespace.h:419 (discriminator 7) ./include/linux/netdevice.h:2783 (discriminator 7) ./include/net/xfrm.h:1292 (discriminator 7)) [ 1479.067910][T26024] ? geneve_udp_encap_err_lookup (./include/linux/skbuff.h:3095) geneve [ 1479.068083][T26024] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 1479.068325][T26024] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1479.068476][T26024] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 1479.068624][T26024] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 1479.068765][T26024] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 1479.068869][T26024] udp_rcv (net/ipv4/udp.c:2651) [ 1479.069071][T26024] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 1479.069234][T26024] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1479.069373][T26024] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 1479.069539][T26024] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 1479.069775][T26024] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 1479.069914][T26024] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1479.070052][T26024] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 1479.070189][T26024] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 1479.070338][T26024] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 1479.070485][T26024] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 1479.070589][T26024] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 1479.070727][T26024] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1479.070869][T26024] ? update_group_capacity (kernel/sched/fair.c:11388 (discriminator 3)) [ 1479.071008][T26024] ? mark_usage (kernel/locking/lockdep.c:4674) [ 1479.071147][T26024] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1479.071295][T26024] ? mutex_spin_on_owner (kernel/locking/mutex.c:411 (discriminator 1)) [ 1479.071436][T26024] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 1479.071609][T26024] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1479.071748][T26024] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 1479.071921][T26024] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1479.072061][T26024] netif_receive_skb_internal (net/core/dev.c:6405) [ 1479.072199][T26024] ? __netif_receive_skb (./include/linux/skbuff.h:1143) [ 1479.072339][T26024] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1479.072482][T26024] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535) [ 1479.072621][T26024] netif_receive_skb (net/core/dev.c:6464) [ 1479.072759][T26024] ? __local_bh_disable_ip (./include/linux/ftrace.h:1168 kernel/softirq.c:395) [ 1479.072900][T26024] tun_rx_batched.isra.0 (drivers/net/tun.c:1542) [ 1479.073041][T26024] ? mark_usage (kernel/locking/lockdep.c:4674) [ 1479.073178][T26024] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 1479.073324][T26024] ? tun_setup (drivers/net/tun.c:2336) [ 1479.073473][T26024] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1479.073611][T26024] ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5831 (discriminator 22)) [ 1479.073750][T26024] tun_get_user (drivers/net/tun.c:1986) [ 1479.073892][T26024] ? tun_build_skb (./arch/x86/include/asm/atomic.h:23) [ 1479.074031][T26024] ? ref_tracker_dir_print (lib/ref_tracker.c:200) [ 1479.074172][T26024] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1479.074325][T26024] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535) [ 1479.074468][T26024] ? tun_get_user (drivers/net/tun.c:1856 (discriminator 1)) [ 1479.074604][T26024] ? tun_get (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:871 (discriminator 2) drivers/net/tun.c:803 (discriminator 2)) [ 1479.074709][T26024] tun_chr_write_iter (drivers/net/tun.c:2032) [ 1479.074848][T26024] ? tun_get_user (drivers/net/tun.c:1856 (discriminator 1)) [ 1479.074987][T26024] new_sync_write (fs/read_write.c:595) [ 1479.075127][T26024] ? __handle_mm_fault (mm/memory.c:6427 mm/memory.c:6565) [ 1479.075275][T26024] ? new_sync_read (./include/linux/ioprio.h:41) [ 1479.075413][T26024] ? __pmd_alloc (./include/linux/mm.h:1682) [ 1479.075558][T26024] ? __lock_downgrade.isra.0 (kernel/locking/lockdep.c:5488) [ 1479.075699][T26024] ? __up_read (kernel/locking/rwsem.c:1386) [ 1479.075835][T26024] ? __up_read (kernel/locking/rwsem.c:1397 (discriminator 1)) [ 1479.075976][T26024] vfs_write (fs/read_write.c:687) [ 1479.076080][T26024] ? down_write_nested (kernel/locking/rwsem.c:1759) [ 1479.076218][T26024] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535) [ 1479.076363][T26024] ksys_write (fs/read_write.c:739) [ 1479.076471][T26024] ? __ia32_sys_read (fs/read_write.c:723) [ 1479.076610][T26024] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1479.076747][T26024] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1479.076884][T26024] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 1479.077120][T26024] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 1479.077265][T26024] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 1479.077403][T26024] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 1479.077577][T26024] RIP: 0033:0x7f10f040c64e [ 1479.077821][T26024] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1479.078416][T26024] RSP: 002b:00007fffe67d86c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 1479.078631][T26024] RAX: ffffffffffffffda RBX: 0000000000000075 RCX: 00007f10f040c64e [ 1479.078838][T26024] RDX: 0000000000000075 RSI: 00007fffe67d8730 RDI: 0000000000000005 [ 1479.079046][T26024] RBP: 00007fffe67d86d0 R08: 0000000000000000 R09: 0000000000000000 [ 1479.079262][T26024] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000075 [ 1479.079473][T26024] R13: 0000000000427fa0 R14: 0000000000000002 R15: 00007f10f0394000 | [ 1490.069243][T26052] BUG: KASAN: use-after-free in geneve_rx (drivers/net/geneve.c:293) geneve | [ 1490.069380][T26052] Read of size 1 at addr ff11000019f9b808 by task tun/26052 | [ 1490.069516][T26052] | [ 1490.069568][T26052] Tainted: [W]=WARN [ 1490.069569][T26052] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1490.069571][T26052] Call Trace: [ 1490.069572][T26052] [ 1490.069573][T26052] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 1490.069580][T26052] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 1490.069585][T26052] print_report (mm/kasan/report.c:482) [ 1490.069588][T26052] ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54) [ 1490.069591][T26052] ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 1490.069592][T26052] kasan_report (mm/kasan/report.c:595) [ 1490.069596][T26052] ? geneve_rx (drivers/net/geneve.c:293) geneve [ 1490.069599][T26052] ? geneve_rx (drivers/net/geneve.c:293) geneve [ 1490.069601][T26052] geneve_rx (drivers/net/geneve.c:293) geneve [ 1490.069603][T26052] ? geneve_udp_encap_recv (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) drivers/net/geneve.c:214 (discriminator 4) drivers/net/geneve.c:695 (discriminator 4)) geneve [ 1490.069605][T26052] ? exc_invalid_op (arch/x86/kernel/traps.c:490 (discriminator 2)) [ 1490.069610][T26052] ? geneve_gro_receive (./include/net/gro.h:368 drivers/net/geneve.c:946) geneve [ 1490.069613][T26052] ? INET_ECN_decapsulate (./include/net/dsfield.h:24) geneve [ 1490.069615][T26052] ? dst_release (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:326 ./include/linux/rcuref.h:109 ./include/linux/rcuref.h:173 net/core/dst.c:168) [ 1490.069619][T26052] geneve_udp_encap_recv (drivers/net/geneve.c:702) geneve [ 1490.069621][T26052] ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1)) [ 1490.069625][T26052] ? geneve_udp_encap_err_lookup (./include/linux/skbuff.h:3095) geneve [ 1490.069627][T26052] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 1490.069629][T26052] ? __xfrm_policy_check2.constprop.0 (./include/net/net_namespace.h:419 (discriminator 7) ./include/linux/netdevice.h:2783 (discriminator 7) ./include/net/xfrm.h:1292 (discriminator 7)) [ 1490.069631][T26052] ? geneve_udp_encap_err_lookup (./include/linux/skbuff.h:3095) geneve [ 1490.069633][T26052] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 1490.069634][T26052] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1490.069637][T26052] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 1490.069639][T26052] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 1490.069641][T26052] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 1490.069643][T26052] udp_rcv (net/ipv4/udp.c:2651) [ 1490.069646][T26052] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 1490.069648][T26052] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1490.069650][T26052] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 1490.069653][T26052] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 1490.069655][T26052] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 1490.069657][T26052] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 1490.069659][T26052] ? kasan_save_track (mm/kasan/common.c:78) [ 1490.069661][T26052] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 1490.069663][T26052] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 1490.069666][T26052] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 1490.069668][T26052] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 1490.069669][T26052] ? rcu_read_lock_any_held (./include/linux/lockdep.h:249 kernel/rcu/update.c:386 kernel/rcu/update.c:380) [ 1490.069672][T26052] ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 2) kernel/locking/lockdep.c:3821 (discriminator 2) kernel/locking/lockdep.c:3876 (discriminator 2)) [ 1490.069674][T26052] ? mark_usage (kernel/locking/lockdep.c:4674) [ 1490.069676][T26052] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 1490.069678][T26052] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 1490.069680][T26052] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 1490.069682][T26052] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 1490.069684][T26052] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1490.069686][T26052] netif_receive_skb_internal (net/core/dev.c:6405) [ 1490.069688][T26052] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 1490.069692][T26052] ? __netif_receive_skb (./include/linux/skbuff.h:1143) [ 1490.069694][T26052] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 1490.069698][T26052] ? __alloc_skb (./include/linux/instrumented.h:97 ./include/linux/atomic/atomic-instrumented.h:67 net/core/skbuff.c:410 net/core/skbuff.c:722) [ 1490.069700][T26052] ? __alloc_skb (./include/linux/bottom_half.h:20 (discriminator 2) net/core/skbuff.c:697 (discriminator 2)) [ 1490.069702][T26052] netif_receive_skb (net/core/dev.c:6464) [ 1490.069704][T26052] ? __local_bh_disable_ip (./include/linux/ftrace.h:1168 kernel/softirq.c:395) [ 1490.069706][T26052] tun_rx_batched.isra.0 (drivers/net/tun.c:1542) [ 1490.069710][T26052] ? mark_usage (kernel/locking/lockdep.c:4674) [ 1490.069712][T26052] ? tun_setup (drivers/net/tun.c:2336) [ 1490.069714][T26052] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1490.069715][T26052] ? sock_alloc_send_pskb (net/core/sock.c:3013) [ 1490.069718][T26052] ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5831 (discriminator 22)) [ 1490.069720][T26052] tun_get_user (drivers/net/tun.c:1986) [ 1490.069723][T26052] ? tun_build_skb (./arch/x86/include/asm/atomic.h:23) [ 1490.069725][T26052] ? ref_tracker_dir_print (lib/ref_tracker.c:200) [ 1490.069728][T26052] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 1490.069730][T26052] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535) [ 1490.069732][T26052] ? tun_get_user (drivers/net/tun.c:1856 (discriminator 1)) [ 1490.069734][T26052] ? tun_get (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:871 (discriminator 2) drivers/net/tun.c:803 (discriminator 2)) [ 1490.069736][T26052] tun_chr_write_iter (drivers/net/tun.c:2032) [ 1490.069737][T26052] ? tun_get_user (drivers/net/tun.c:1856 (discriminator 1)) [ 1490.069739][T26052] new_sync_write (fs/read_write.c:595) [ 1490.069742][T26052] ? __handle_mm_fault (mm/memory.c:6427 mm/memory.c:6565) [ 1490.069744][T26052] ? new_sync_read (./include/linux/ioprio.h:41) [ 1490.069746][T26052] ? __pmd_alloc (./include/linux/mm.h:1682) [ 1490.069747][T26052] ? __lock_downgrade.isra.0 (kernel/locking/lockdep.c:5488) [ 1490.069750][T26052] ? __up_read (kernel/locking/rwsem.c:1386) [ 1490.069752][T26052] ? __up_read (kernel/locking/rwsem.c:1397 (discriminator 1)) [ 1490.069753][T26052] vfs_write (fs/read_write.c:687) [ 1490.069755][T26052] ? down_write_nested (kernel/locking/rwsem.c:1759) [ 1490.069757][T26052] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535) [ 1490.069759][T26052] ksys_write (fs/read_write.c:739) [ 1490.069761][T26052] ? __ia32_sys_read (fs/read_write.c:723) [ 1490.069763][T26052] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1490.069764][T26052] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 1490.069766][T26052] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 1490.069768][T26052] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 1490.069770][T26052] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 1490.069773][T26052] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 1490.069775][T26052] RIP: 0033:0x7f10f040c64e [ 1490.069778][T26052] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1490.069780][T26052] RSP: 002b:00007fffe67d86c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 1490.069784][T26052] RAX: ffffffffffffffda RBX: 0000000000000602 RCX: 00007f10f040c64e [ 1490.069785][T26052] RDX: 0000000000000602 RSI: 00007fffe67d8730 RDI: 0000000000000005 [ 1490.069787][T26052] RBP: 00007fffe67d86d0 R08: 0000000000000000 R09: 0000000000000000 [ 1490.069787][T26052] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000602 Finger prints: geneve_udp_encap_recv:udp_queue_rcv_one_skb:udp_unicast_rcv_skb:udp_rcv:ip_protocol_deliver_rcu print_report:kasan_report:geneve_rx:geneve_udp_encap_recv:udp_queue_rcv_one_skb