====================================== | [ 27.573417][ T38] br0: port 1(swp1) entered disabled state | [ 27.689615][ C2] ------------[ cut here ]------------ | [ 27.689890][ C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa92/0x1060, CPU#2: mausezahn/592 | [ 27.690287][ C2] Modules linked in: act_gact cls_flower sch_ingress vxlan [ 27.690957][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.691183][ C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:217 (discriminator 4)) [ 27.691394][ C2] Code: 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 <0f> 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9 a7 fa ff ff 44 89 44 24 18 All code ======== 0: 24 18 and $0x18,%al 2: 4c 89 44 24 20 mov %r8,0x20(%rsp) 7: e8 4c 6b 74 fe call 0xfffffffffe746b58 c: 4c 8b 44 24 20 mov 0x20(%rsp),%r8 11: 49 0f ba 28 08 btsq $0x8,(%r8) 16: 4c 8b 4c 24 18 mov 0x18(%rsp),%r9 1b: e9 c0 f9 ff ff jmp 0xfffffffffffff9e0 20: 90 nop 21: 0f 0b ud2 23: 90 nop 24: e9 7d fb ff ff jmp 0xfffffffffffffba6 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: e9 f1 f9 ff ff jmp 0xfffffffffffffa23 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: e9 a7 fa ff ff jmp 0xfffffffffffffae2 3b: 44 89 44 24 18 mov %r8d,0x18(%rsp) Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: e9 f1 f9 ff ff jmp 0xfffffffffffff9f9 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: e9 a7 fa ff ff jmp 0xfffffffffffffab8 11: 44 89 44 24 18 mov %r8d,0x18(%rsp) [ 27.692009][ C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246 [ 27.692241][ C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000000 [ 27.692495][ C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff1100000ef39c24 [ 27.692749][ C2] RBP: ffa00000002286a0 R08: ff110000096632c8 R09: ff1100000e8b31c0 [ 27.693007][ C2] R10: ffe21c00012cc65c R11: ffe21c00012cc65c R12: ff110000096632dc [ 27.693271][ C2] R13: ff110000096632da R14: ff1100000e8b3276 R15: ff11000009663200 [ 27.693526][ C2] FS: 00007fdbe4c82c80(0000) GS:ff110000c75b0000(0000) knlGS:0000000000000000 [ 27.693815][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.694044][ C2] CR2: 00007ffff4d37cd0 CR3: 000000000f5c5002 CR4: 0000000000771ef0 [ 27.694306][ C2] PKRU: 55555554 [ 27.694471][ C2] Call Trace: [ 27.694623][ C2] [ 27.694746][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.694954][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.695143][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.695340][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.695493][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.695714][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.695907][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.696094][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.696292][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.696482][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.696667][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.696894][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.697084][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.697279][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.697500][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.697683][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.697874][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.698059][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.698257][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.698442][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.698592][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.698745][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.698937][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.699123][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.699322][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.699508][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.699691][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.699881][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.700069][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.700266][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.700455][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.700638][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.700789][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.700980][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.701164][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.701360][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.701547][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.701766][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.701958][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.702176][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.702376][ C2] process_backlog (net/core/dev.c:6670) [ 27.702564][ C2] __napi_poll (net/core/dev.c:7729) [ 27.702716][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.702910][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.703094][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.703300][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.703486][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.703672][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.703855][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.704046][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.704242][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.704394][ C2] [ 27.704509][ C2] [ 27.704628][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.704812][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.705004][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.705203][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.705392][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.705713][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.705872][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.706063][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.706264][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.706548][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.706730][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.706925][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.707111][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.707309][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.707495][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.707685][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.707879][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.708159][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.708364][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.708590][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.708775][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.709064][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.709265][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.709453][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.709639][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.709960][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.710157][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.710803][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.711071][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.711434][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.711687][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.711942][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 [ 27.712306][ C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055a65a061830 | [ 27.714616][ C2] BUG: KASAN: slab-use-after-free in udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) | [ 27.714746][ C2] Read of size 2 at addr ff1100000ef49bff by task mausezahn/592 | [ 27.714927][ C2] | [ 27.714977][ C2] Tainted: [W]=WARN [ 27.714978][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.714979][ C2] Call Trace: [ 27.714980][ C2] [ 27.714981][ C2] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 27.714985][ C2] print_address_description.constprop.0 (mm/kasan/report.c:378) [ 27.714990][ C2] print_report (mm/kasan/report.c:482) [ 27.714992][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54) [ 27.714994][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 27.714996][ C2] kasan_report (mm/kasan/report.c:595) [ 27.714999][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.715001][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.715004][ C2] udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.715006][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.715011][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.715013][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.715015][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.715016][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.715018][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.715019][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.715020][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.715021][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.715023][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.715026][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.715030][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.715032][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.715034][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.715037][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.715039][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.715040][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.715042][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.715044][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.715046][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.715048][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.715051][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.715053][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.715054][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.715056][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.715058][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.715060][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.715062][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.715063][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.715065][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.715068][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.715069][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.715071][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.715073][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.715074][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.715076][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.715078][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.715079][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.715081][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.715082][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.715085][ C2] process_backlog (net/core/dev.c:6670) [ 27.715087][ C2] __napi_poll (net/core/dev.c:7729) [ 27.715089][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.715091][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.715093][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.715096][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.715098][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.715100][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.715101][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.715103][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.715105][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.715107][ C2] [ 27.715108][ C2] [ 27.715108][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.715110][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.715111][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.715113][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.715116][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.715118][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.715120][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.715123][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.715125][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.715128][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.715130][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.715133][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.715135][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.715137][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.715139][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.715141][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.715144][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.715146][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.715147][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.715149][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.715151][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.715152][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.715154][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.715155][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.715157][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.715159][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.715161][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.715163][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.715165][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.715167][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.715168][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.715168][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 [ 27.715169][ C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055a65a061830 | [ 27.726792][ C2] pool index 93034 out of bounds (518) for stack id 6b6b6b6b | [ 27.726980][ C2] WARNING: lib/stackdepot.c:506 at depot_fetch_stack+0xa9/0xd0, CPU#2: mausezahn/592 | [ 27.727138][ C2] Modules linked in: act_gact cls_flower sch_ingress vxlan | [ 27.727523][ C2] Tainted: [W]=WARN [ 27.727594][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.727708][ C2] RIP: 0010:depot_fetch_stack (lib/stackdepot.c:506 (discriminator 7)) [ 27.727859][ C2] Code: 01 44 8b 04 24 8b 54 24 04 83 f8 01 44 8b 4c 24 08 8b 4c 24 0c 75 95 90 0f 0b 90 eb 8f 48 8d 3d c7 8c 3e 03 44 89 ca 44 89 c6 <67> 48 0f b9 3a 31 c9 48 89 c8 48 83 c4 10 c3 90 0f 0b 90 eb 98 90 All code ======== 0: 01 44 8b 04 add %eax,0x4(%rbx,%rcx,4) 4: 24 8b and $0x8b,%al 6: 54 push %rsp 7: 24 04 and $0x4,%al 9: 83 f8 01 cmp $0x1,%eax c: 44 8b 4c 24 08 mov 0x8(%rsp),%r9d 11: 8b 4c 24 0c mov 0xc(%rsp),%ecx 15: 75 95 jne 0xffffffffffffffac 17: 90 nop 18: 0f 0b ud2 1a: 90 nop 1b: eb 8f jmp 0xffffffffffffffac 1d: 48 8d 3d c7 8c 3e 03 lea 0x33e8cc7(%rip),%rdi # 0x33e8ceb 24: 44 89 ca mov %r9d,%edx 27: 44 89 c6 mov %r8d,%esi 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 31 c9 xor %ecx,%ecx 31: 48 89 c8 mov %rcx,%rax 34: 48 83 c4 10 add $0x10,%rsp 38: c3 ret 39: 90 nop 3a: 0f 0b ud2 3c: 90 nop 3d: eb 98 jmp 0xffffffffffffffd7 3f: 90 nop Code starting with the faulting instruction =========================================== 0: 67 48 0f b9 3a ud1 (%edx),%rdi 5: 31 c9 xor %ecx,%ecx 7: 48 89 c8 mov %rcx,%rax a: 48 83 c4 10 add $0x10,%rsp e: c3 ret f: 90 nop 10: 0f 0b ud2 12: 90 nop 13: eb 98 jmp 0xffffffffffffffad 15: 90 nop [ 27.728238][ C2] RSP: 0018:ffa00000002284d8 EFLAGS: 00010002 [ 27.728354][ C2] RAX: 00000000ffffffff RBX: ff1100000ef49bff RCX: 000000006b6b6b6b [ 27.728491][ C2] RDX: 0000000000000206 RSI: 0000000000016b6a RDI: ffffffffa4318c40 [ 27.728685][ C2] RBP: ffa00000002285b8 R08: 0000000000016b6a R09: 0000000000000206 [ 27.728822][ C2] R10: 0000000000000003 R11: fffffbfff470111d R12: ffd40000003bd200 [ 27.728964][ C2] R13: ff1100000ef49bff R14: 00000000fffffffe R15: ff11000009663200 [ 27.729157][ C2] FS: 00007fdbe4c82c80(0000) GS:ff110000c75b0000(0000) knlGS:0000000000000000 [ 27.729322][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.729439][ C2] CR2: 00007ffff4d37cd0 CR3: 000000000f5c5002 CR4: 0000000000771ef0 [ 27.729631][ C2] PKRU: 55555554 [ 27.729701][ C2] Call Trace: [ 27.729770][ C2] [ 27.729816][ C2] stack_depot_print (lib/stackdepot.c:775 lib/stackdepot.c:813) [ 27.729970][ C2] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:353 mm/kasan/report.c:382) [ 27.730086][ C2] print_report (mm/kasan/report.c:482) [ 27.730179][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54) [ 27.730271][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 27.730415][ C2] kasan_report (mm/kasan/report.c:595) [ 27.730505][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.730596][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.730688][ C2] udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.730834][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.730930][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.731021][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.731111][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.731233][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.731346][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.731436][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.731526][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.731674][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.731766][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.731860][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.731981][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.732127][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.732219][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.732338][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.732484][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.732575][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.732668][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.732760][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.732907][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.732978][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.733049][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.733140][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.733232][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.733376][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.733468][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.733560][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.733651][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.733797][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.733892][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.733983][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.734073][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.734195][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.734286][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.734376][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.734467][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.734614][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.734729][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.734821][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.734938][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.735081][ C2] process_backlog (net/core/dev.c:6670) [ 27.735173][ C2] __napi_poll (net/core/dev.c:7729) [ 27.735243][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.735337][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.735484][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.735577][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.735668][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.735760][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.735908][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.735998][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.736091][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.736161][ C2] [ 27.736211][ C2] [ 27.736312][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.736402][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.736494][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.736584][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.736729][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.736842][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.736915][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.737007][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.737152][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.737244][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.737334][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.737426][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.737572][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.737664][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.737759][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.737851][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.738001][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.738092][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.738183][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.738297][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.738442][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.738534][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.738625][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.738716][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.738860][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.738976][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.739070][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.739449][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.739587][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.739780][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.739920][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.740110][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 [ 27.740245][ C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055a65a061830 | [ 27.741538][ C2] corrupt handle or use after stack_depot_put() | [ 27.741539][ C2] WARNING: lib/stackdepot.c:780 at stack_depot_print+0x52/0x60, CPU#2: mausezahn/592 | [ 27.741855][ C2] Modules linked in: act_gact cls_flower sch_ingress vxlan | [ 27.742231][ C2] Tainted: [W]=WARN [ 27.742300][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.742412][ C2] RIP: 0010:stack_depot_print (lib/stackdepot.c:780 (discriminator 7) lib/stackdepot.c:760 (discriminator 7) lib/stackdepot.c:813 (discriminator 7)) [ 27.742504][ C2] Code: 89 c7 e8 31 f8 ff ff 48 85 c0 74 17 8b 70 14 85 f6 74 e8 48 8d 78 20 31 d2 48 83 c4 08 e9 d6 d2 10 ff c3 48 8d 3d 6e 86 3e 03 <67> 48 0f b9 3a eb ca 0f 1f 80 00 00 00 00 f3 0f 1e fa 85 ff 74 65 All code ======== 0: 89 c7 mov %eax,%edi 2: e8 31 f8 ff ff call 0xfffffffffffff838 7: 48 85 c0 test %rax,%rax a: 74 17 je 0x23 c: 8b 70 14 mov 0x14(%rax),%esi f: 85 f6 test %esi,%esi 11: 74 e8 je 0xfffffffffffffffb 13: 48 8d 78 20 lea 0x20(%rax),%rdi 17: 31 d2 xor %edx,%edx 19: 48 83 c4 08 add $0x8,%rsp 1d: e9 d6 d2 10 ff jmp 0xffffffffff10d2f8 22: c3 ret 23: 48 8d 3d 6e 86 3e 03 lea 0x33e866e(%rip),%rdi # 0x33e8698 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: eb ca jmp 0xfffffffffffffffb 31: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 38: f3 0f 1e fa endbr64 3c: 85 ff test %edi,%edi 3e: 74 65 je 0xa5 Code starting with the faulting instruction =========================================== 0: 67 48 0f b9 3a ud1 (%edx),%rdi 5: eb ca jmp 0xffffffffffffffd1 7: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) e: f3 0f 1e fa endbr64 12: 85 ff test %edi,%edi 14: 74 65 je 0x7b [ 27.742879][ C2] RSP: 0018:ffa00000002284f0 EFLAGS: 00010046 [ 27.743046][ C2] RAX: 0000000000000000 RBX: ff1100000ef49bff RCX: 0000000000000000 [ 27.743181][ C2] RDX: 0000000000000206 RSI: 0000000000016b6a RDI: ffffffffa4318d30 [ 27.743317][ C2] RBP: ffa00000002285b8 R08: 0000000000016b6a R09: 0000000000000206 [ 27.743508][ C2] R10: 0000000000000003 R11: fffffbfff470111d R12: ffd40000003bd200 [ 27.743644][ C2] R13: ff1100000ef49bff R14: 00000000fffffffe R15: ff11000009663200 [ 27.743780][ C2] FS: 00007fdbe4c82c80(0000) GS:ff110000c75b0000(0000) knlGS:0000000000000000 [ 27.743999][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.744115][ C2] CR2: 00007ffff4d37cd0 CR3: 000000000f5c5002 CR4: 0000000000771ef0 [ 27.744332][ C2] PKRU: 55555554 [ 27.744401][ C2] Call Trace: [ 27.744469][ C2] [ 27.744515][ C2] print_address_description.constprop.0 (mm/kasan/report.c:343 mm/kasan/report.c:353 mm/kasan/report.c:382) [ 27.744630][ C2] print_report (mm/kasan/report.c:482) [ 27.744775][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54) [ 27.744869][ C2] ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 27.744960][ C2] kasan_report (mm/kasan/report.c:595) [ 27.745049][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.745194][ C2] ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.745286][ C2] udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1)) [ 27.745377][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.745470][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.745614][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.745708][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.745777][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.745892][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.746035][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.746126][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.746216][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.746306][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.746453][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.746568][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.746659][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.746750][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.746921][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.747013][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.747102][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.747246][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.747338][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.747428][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.747496][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.747566][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.747711][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.747802][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.747896][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.747987][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.748133][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.748225][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.748317][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.748408][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.748553][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.748645][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.748714][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.748805][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.748951][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.749042][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.749133][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.749246][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.749392][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.749506][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.749596][ C2] process_backlog (net/core/dev.c:6670) [ 27.749686][ C2] __napi_poll (net/core/dev.c:7729) [ 27.749808][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.749903][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.749993][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.750085][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.750230][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.750321][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.750412][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.750501][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.750646][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.750714][ C2] [ 27.750760][ C2] [ 27.750806][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.750900][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.751043][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.751134][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.751225][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.751337][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.751458][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.751549][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.751640][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.751733][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.751877][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.751970][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.752061][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.752152][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.752297][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.752388][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.752478][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.752570][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.752711][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.752822][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.752919][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.753009][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.753152][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.753245][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.753336][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.753449][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.753598][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.753978][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.754117][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.754254][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.754442][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.754577][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 [ 27.754713][ C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055a65a061830 | [ 27.759762][ C2] ------------[ cut here ]------------ | [ 27.759898][ C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa9b/0x1060, CPU#2: mausezahn/592 | [ 27.760111][ C2] Modules linked in: act_gact cls_flower sch_ingress vxlan | [ 27.760569][ C2] Tainted: [B]=BAD_PAGE, [W]=WARN [ 27.760749][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.760907][ C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:218 (discriminator 4)) [ 27.761042][ C2] Code: 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 <0f> 0b 90 e9 a7 fa ff ff 44 89 44 24 18 89 74 24 20 4c 89 4c 24 28 All code ======== 0: 6b 74 fe 4c 8b imul $0xffffff8b,0x4c(%rsi,%rdi,8),%esi 5: 44 24 20 rex.R and $0x20,%al 8: 49 0f ba 28 08 btsq $0x8,(%r8) d: 4c 8b 4c 24 18 mov 0x18(%rsp),%r9 12: e9 c0 f9 ff ff jmp 0xfffffffffffff9d7 17: 90 nop 18: 0f 0b ud2 1a: 90 nop 1b: e9 7d fb ff ff jmp 0xfffffffffffffb9d 20: 90 nop 21: 0f 0b ud2 23: 90 nop 24: e9 f1 f9 ff ff jmp 0xfffffffffffffa1a 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: e9 a7 fa ff ff jmp 0xfffffffffffffad9 32: 44 89 44 24 18 mov %r8d,0x18(%rsp) 37: 89 74 24 20 mov %esi,0x20(%rsp) 3b: 4c 89 4c 24 28 mov %r9,0x28(%rsp) Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: e9 a7 fa ff ff jmp 0xfffffffffffffaaf 8: 44 89 44 24 18 mov %r8d,0x18(%rsp) d: 89 74 24 20 mov %esi,0x20(%rsp) 11: 4c 89 4c 24 28 mov %r9,0x28(%rsp) [ 27.761445][ C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246 [ 27.761598][ C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000001 [ 27.761818][ C2] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffffa4bbc6a0 [ 27.762002][ C2] RBP: ffa00000002286a0 R08: ff110000096632c8 R09: ff1100000e8b31c0 [ 27.762179][ C2] R10: fffffbfff49778d5 R11: fffffbfff49778d5 R12: ff110000096632dc [ 27.762366][ C2] R13: ff110000096632da R14: ff1100000e8b3276 R15: ff11000009663200 [ 27.762539][ C2] FS: 00007fdbe4c82c80(0000) GS:ff110000c75b0000(0000) knlGS:0000000000000000 [ 27.762781][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.762945][ C2] CR2: 00007ffff4d37cd0 CR3: 000000000f5c5002 CR4: 0000000000771ef0 [ 27.763119][ C2] PKRU: 55555554 [ 27.763238][ C2] Call Trace: [ 27.763347][ C2] [ 27.763435][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.763569][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.763699][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.763885][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.763996][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.764146][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.764287][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.764467][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.764597][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.764728][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.764859][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.765071][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.765211][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.765343][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.765496][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.765674][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.765805][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.765946][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.766077][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.766265][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.766374][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.766484][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.766615][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.766794][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.766936][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.767069][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.767208][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.767387][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.767519][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.767649][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.767780][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.767968][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.768078][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.768218][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.768349][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.768526][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.768657][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.768807][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.768943][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.769144][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.769287][ C2] process_backlog (net/core/dev.c:6670) [ 27.769419][ C2] __napi_poll (net/core/dev.c:7729) [ 27.769528][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.769707][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.769837][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.769978][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.770109][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.770297][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.770426][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.770556][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.770686][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.770844][ C2] [ 27.770937][ C2] [ 27.771023][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.771152][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.771297][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.771475][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.771604][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.771755][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.771870][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.772049][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.772180][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.772326][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.772456][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.772634][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.772764][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.772900][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.773030][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.773216][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.773346][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.773479][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.773609][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.773803][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.773942][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.774073][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.774212][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.774389][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.774520][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.774673][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.774804][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.775212][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.775436][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.775605][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.775774][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.776003][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 [ 27.776173][ C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055a65a061830 | [ 27.777658][ C2] ------------[ cut here ]------------ | [ 27.777787][ C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa89/0x1060, CPU#2: mausezahn/592 | [ 27.778055][ C2] Modules linked in: act_gact cls_flower sch_ingress vxlan | [ 27.778509][ C2] Tainted: [B]=BAD_PAGE, [W]=WARN [ 27.778639][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 27.778789][ C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:219 (discriminator 4)) [ 27.778934][ C2] Code: c7 be 08 00 00 00 4c 89 4c 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 <0f> 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9 All code ======== 0: c7 (bad) 1: be 08 00 00 00 mov $0x8,%esi 6: 4c 89 4c 24 18 mov %r9,0x18(%rsp) b: 4c 89 44 24 20 mov %r8,0x20(%rsp) 10: e8 4c 6b 74 fe call 0xfffffffffe746b61 15: 4c 8b 44 24 20 mov 0x20(%rsp),%r8 1a: 49 0f ba 28 08 btsq $0x8,(%r8) 1f: 4c 8b 4c 24 18 mov 0x18(%rsp),%r9 24: e9 c0 f9 ff ff jmp 0xfffffffffffff9e9 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: e9 7d fb ff ff jmp 0xfffffffffffffbaf 32: 90 nop 33: 0f 0b ud2 35: 90 nop 36: e9 f1 f9 ff ff jmp 0xfffffffffffffa2c 3b: 90 nop 3c: 0f 0b ud2 3e: 90 nop 3f: e9 .byte 0xe9 Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: e9 7d fb ff ff jmp 0xfffffffffffffb85 8: 90 nop 9: 0f 0b ud2 b: 90 nop c: e9 f1 f9 ff ff jmp 0xfffffffffffffa02 11: 90 nop 12: 0f 0b ud2 14: 90 nop 15: e9 .byte 0xe9 [ 27.779335][ C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246 [ 27.779535][ C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: ffffffffa2031c3e [ 27.779710][ C2] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 27.779888][ C2] RBP: ffa00000002286a0 R08: ff110000096632c8 R09: ff1100000e8b31c0 [ 27.780111][ C2] R10: fffffbfff49778d5 R11: fffffbfff49778d5 R12: ff110000096632dc [ 27.780292][ C2] R13: ff110000096632da R14: ff1100000e8b3276 R15: ff11000009663200 [ 27.780469][ C2] FS: 00007fdbe4c82c80(0000) GS:ff110000c75b0000(0000) knlGS:0000000000000000 [ 27.780710][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.780870][ C2] CR2: 00007ffff4d37cd0 CR3: 000000000f5c5002 CR4: 0000000000771ef0 [ 27.781090][ C2] PKRU: 55555554 [ 27.781207][ C2] Call Trace: [ 27.781316][ C2] [ 27.781404][ C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan [ 27.781539][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.781716][ C2] ? ip_rcv_finish (net/ipv4/ip_input.c:490) [ 27.781845][ C2] ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.781960][ C2] ? __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.782109][ C2] ? process_backlog (net/core/dev.c:6670) [ 27.782301][ C2] ? __napi_poll (net/core/dev.c:7729) [ 27.782430][ C2] ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.782559][ C2] ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215) [ 27.782691][ C2] ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21)) [ 27.782875][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.783026][ C2] ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1)) [ 27.783157][ C2] ? __udp4_lib_lookup (net/ipv4/udp.c:713) [ 27.783294][ C2] ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan [ 27.783493][ C2] ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.783626][ C2] udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) [ 27.783755][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.783890][ C2] ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2)) [ 27.784070][ C2] udp_unicast_rcv_skb (net/ipv4/udp.c:2574) [ 27.784212][ C2] ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3)) [ 27.784321][ C2] udp_rcv (net/ipv4/udp.c:2651) [ 27.784431][ C2] ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1)) [ 27.784611][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.784741][ C2] ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2)) [ 27.784876][ C2] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) [ 27.785006][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.785183][ C2] ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1)) [ 27.785325][ C2] ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262) [ 27.785454][ C2] ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42)) [ 27.785587][ C2] ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1)) [ 27.785764][ C2] ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2)) [ 27.785900][ C2] ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612) [ 27.786010][ C2] ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3)) [ 27.786141][ C2] ? mark_usage (kernel/locking/lockdep.c:4674) [ 27.786332][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 27.786462][ C2] ? __dev_queue_xmit (net/core/dev.c:4821) [ 27.786591][ C2] __netif_receive_skb_one_core (net/core/dev.c:6206) [ 27.786744][ C2] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1)) [ 27.786928][ C2] ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2)) [ 27.787081][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.787221][ C2] process_backlog (net/core/dev.c:6670) [ 27.787351][ C2] __napi_poll (net/core/dev.c:7729) [ 27.787508][ C2] net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949) [ 27.787639][ C2] ? __napi_poll (./include/net/gro.h:507) [ 27.787769][ C2] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 27.787904][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.788081][ C2] handle_softirqs (kernel/softirq.c:622) [ 27.788222][ C2] ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1)) [ 27.788352][ C2] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3)) [ 27.788481][ C2] ? trace_csd_function_exit (./include/trace/events/csd.h:64 (discriminator 22)) [ 27.788660][ C2] do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19)) [ 27.788770][ C2] [ 27.788856][ C2] [ 27.788949][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.789079][ C2] __local_bh_enable_ip (kernel/softirq.c:450) [ 27.789219][ C2] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2)) [ 27.789348][ C2] ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272) [ 27.789478][ C2] ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112) [ 27.789628][ C2] ? stats_show (lib/stackdepot.c:861 (discriminator 5)) [ 27.789737][ C2] ? netdev_core_pick_tx (net/core/dev.c:4733) [ 27.789923][ C2] ? packet_release (net/packet/af_packet.c:3171) [ 27.790057][ C2] packet_snd (net/packet/af_packet.c:3082) [ 27.790200][ C2] ? tpacket_snd (net/packet/af_packet.c:2685) [ 27.790329][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.790507][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.790637][ C2] ? __might_fault (mm/memory.c:7340 (discriminator 5)) [ 27.790768][ C2] __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4)) [ 27.790902][ C2] ? __ia32_sys_getpeername (net/socket.c:2206) [ 27.791083][ C2] ? sock_ioctl (net/socket.c:1421) [ 27.791225][ C2] ? __sys_setsockopt (net/socket.c:2393) [ 27.791356][ C2] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255) [ 27.791486][ C2] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22)) [ 27.791684][ C2] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472) [ 27.791813][ C2] ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89) [ 27.791944][ C2] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 27.792124][ C2] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1)) [ 27.792266][ C2] ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3)) [ 27.792397][ C2] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 27.792549][ C2] RIP: 0033:0x7fdbe4e4064e [ 27.792731][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 b4 bd 00 00 call 0xbdbc 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 03 ff ff ff call 0xffffffffffffff3c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 03 ff ff ff call 0xffffffffffffff12 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 27.793085][ C2] RSP: 002b:00007ffff4d49a50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 27.793314][ C2] RAX: ffffffffffffffda RBX: 000055a65a061b42 RCX: 00007fdbe4e4064e [ 27.793486][ C2] RDX: 0000000000000086 RSI: 000055a65a061b42 RDI: 0000000000000005 [ 27.793706][ C2] RBP: 00007ffff4d49a60 R08: 00007ffff4d49ab0 R09: 0000000000000014 [ 27.793887][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055a65a061830 Finger prints: stack_depot_print:print_report:kasan_report:udp_tun_rx_dst:vxlan_rcv depot_fetch_stack:stack_depot_print:print_report:kasan_report:udp_tun_rx_dst print_report:kasan_report:udp_tun_rx_dst:vxlan_rcv:udp_queue_rcv_one_skb udp_tun_rx_dst:vxlan_rcv:udp_queue_rcv_one_skb:udp_unicast_rcv_skb:udp_rcv