[ 195.964141][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 196.976412][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 196.976945][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 198.000375][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 198.000969][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 199.023382][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 199.023975][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 200.048381][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 200.049034][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 201.072712][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 201.074054][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 202.096368][ C3] TCP: TCP-AO: the keyid 100 from SYN packet is not present - not sending SYNACK [ 202.782082][ C0] ================================================================== [ 202.782430][ C0] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response+0xe2c/0x2450 [ 202.782696][ C0] Read of size 8 at addr ff1100000521c8c0 by task connect-deny_ip/2466 [ 202.782959][ C0] [ 202.783052][ C0] CPU: 0 UID: 0 PID: 2466 Comm: connect-deny_ip Not tainted 7.2.0-virtme #1 PREEMPT(full) [ 202.783055][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 202.783058][ C0] Call Trace: [ 202.783059][ C0] [ 202.783061][ C0] dump_stack_lvl+0x6f/0xa0 [ 202.783067][ C0] print_address_description.constprop.0+0x56/0x2d0 [ 202.783072][ C0] print_report+0xfc/0x1fa [ 202.783074][ C0] ? __virt_addr_valid+0x102/0x440 [ 202.783078][ C0] ? __virt_addr_valid+0x1da/0x440 [ 202.783080][ C0] kasan_report+0x108/0x130 [ 202.783084][ C0] ? tcp_v6_send_response+0xe2c/0x2450 [ 202.783086][ C0] ? tcp_v6_send_response+0xe2c/0x2450 [ 202.783088][ C0] kasan_check_range+0x130/0x200 [ 202.783090][ C0] tcp_v6_send_response+0xe2c/0x2450 [ 202.783093][ C0] ? tcp_v6_send_synack+0xe10/0xe10 [ 202.783095][ C0] ? __lock_acquire+0x518/0xc20 [ 202.783099][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783100][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783105][ C0] tcp_v6_timewait_ack+0x35b/0x7f0 [ 202.783107][ C0] ? tcp_v6_reqsk_send_ack+0xe00/0xe00 [ 202.783109][ C0] ? __local_bh_enable_ip+0xaa/0x150 [ 202.783112][ C0] ? tcp_ecn_openreq_child+0x14c0/0x14c0 [ 202.783115][ C0] ? ip6_pol_route+0x2e7/0xaa0 [ 202.783119][ C0] ? __asan_memcpy+0x3c/0x60 [ 202.783121][ C0] tcp_v6_rcv+0x217b/0x2dc0 [ 202.783124][ C0] ? tcp_v6_syn_recv_sock+0x1be0/0x1be0 [ 202.783126][ C0] ? ipv6_raw_deliver+0x35f/0x930 [ 202.783128][ C0] ? ipv6_raw_deliver+0x369/0x930 [ 202.783131][ C0] ip6_protocol_deliver_rcu+0x15c/0x1480 [ 202.783135][ C0] ip6_input_finish+0x196/0x590 [ 202.783138][ C0] ip6_input+0x130/0x570 [ 202.783139][ C0] ? ip6_input_finish+0x590/0x590 [ 202.783142][ C0] ? ip6_rcv_core+0xe22/0x1be0 [ 202.783144][ C0] ipv6_rcv+0x3c1/0x5a0 [ 202.783146][ C0] ? ip6_rcv_core+0x1be0/0x1be0 [ 202.783148][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783150][ C0] ? __update_load_avg_cfs_rq+0x36c/0x10c0 [ 202.783153][ C0] ? mark_usage+0x61/0x170 [ 202.783154][ C0] ? __lock_acquire+0x518/0xc20 [ 202.783156][ C0] ? trace_raw_output_rcu_invoke_kfree_bulk_callback+0x57/0x130 [ 202.783159][ C0] ? process_backlog+0x3f1/0x14c0 [ 202.783162][ C0] __netif_receive_skb_one_core+0xfc/0x180 [ 202.783165][ C0] ? lock_acquire.part.0+0xd4/0x280 [ 202.783166][ C0] ? process_backlog+0x3f1/0x14c0 [ 202.783168][ C0] ? __netif_receive_skb_list_core+0x9e0/0x9e0 [ 202.783171][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783173][ C0] process_backlog+0x431/0x14c0 [ 202.783176][ C0] __napi_poll+0xa7/0x3b0 [ 202.783179][ C0] net_rx_action+0x513/0xf50 [ 202.783181][ C0] ? __napi_poll+0x3b0/0x3b0 [ 202.783183][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783185][ C0] ? mark_held_locks+0x40/0x70 [ 202.783188][ C0] ? clockevents_program_event+0x307/0x7e0 [ 202.783191][ C0] ? mark_held_locks+0x40/0x70 [ 202.783192][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783194][ C0] ? mark_held_locks+0x40/0x70 [ 202.783196][ C0] handle_softirqs+0x1d3/0x900 [ 202.783198][ C0] ? _local_bh_enable+0xc0/0xc0 [ 202.783200][ C0] ? _local_bh_enable+0xc0/0xc0 [ 202.783201][ C0] ? __dev_queue_xmit+0x964/0x1b80 [ 202.783204][ C0] do_softirq+0xac/0xe0 [ 202.783205][ C0] [ 202.783206][ C0] [ 202.783207][ C0] __local_bh_enable_ip+0x118/0x150 [ 202.783208][ C0] __dev_queue_xmit+0x979/0x1b80 [ 202.783211][ C0] ? down_read_nested+0xe7/0x500 [ 202.783213][ C0] ? netdev_core_pick_tx+0x2c0/0x2c0 [ 202.783215][ C0] ? lock_acquire.part.0+0xd4/0x280 [ 202.783217][ C0] ? find_held_lock+0x2b/0x80 [ 202.783219][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783220][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783222][ C0] ? mark_held_locks+0x40/0x70 [ 202.783224][ C0] ? __asan_memcpy+0x3c/0x60 [ 202.783225][ C0] ? neigh_hh_output+0x152/0x4c0 [ 202.783228][ C0] ip6_finish_output2+0x96f/0x12a0 [ 202.783230][ C0] ? ip6_dst_lookup+0x80/0x80 [ 202.783232][ C0] ? find_held_lock+0x2b/0x80 [ 202.783234][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783236][ C0] ? ip6_mtu+0x15d/0x310 [ 202.783238][ C0] ip6_finish_output+0x646/0xda0 [ 202.783240][ C0] ip6_output+0x23f/0x7f0 [ 202.783242][ C0] ? ip6_finish_output+0xda0/0xda0 [ 202.783244][ C0] ? lock_acquire.part.0+0xd4/0x280 [ 202.783246][ C0] ? find_held_lock+0x2b/0x80 [ 202.783247][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783250][ C0] ip6_xmit+0xc44/0x1ec0 [ 202.783251][ C0] ? mark_usage+0x61/0x170 [ 202.783253][ C0] ? __lock_acquire+0x518/0xc20 [ 202.783255][ C0] ? ip6_autoflowlabel+0x120/0x120 [ 202.783257][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783259][ C0] ? mark_usage+0x61/0x170 [ 202.783260][ C0] ? __lock_acquire+0x518/0xc20 [ 202.783263][ C0] ? lock_acquire.part.0+0xd4/0x280 [ 202.783264][ C0] ? inet6_csk_xmit+0xfe/0x5f0 [ 202.783266][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783268][ C0] ? lock_acquire+0x13c/0x160 [ 202.783270][ C0] inet6_csk_xmit+0x2f6/0x5f0 [ 202.783273][ C0] __tcp_transmit_skb+0x1b6e/0x3c10 [ 202.783276][ C0] ? __tcp_select_window+0xf20/0xf20 [ 202.783277][ C0] ? find_held_lock+0x2b/0x80 [ 202.783279][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783280][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783282][ C0] ? tcp_mtu_probe+0x19/0x1b60 [ 202.783285][ C0] tcp_write_xmit+0xff9/0x3710 [ 202.783288][ C0] ? __alloc_skb+0x3f0/0x5f0 [ 202.783291][ C0] ? tcp_retrans_try_collapse+0xee0/0xee0 [ 202.783293][ C0] ? tcp_set_state+0x101/0x580 [ 202.783296][ C0] __tcp_push_pending_frames+0x8f/0x3b0 [ 202.783298][ C0] __tcp_close+0x84e/0xe70 [ 202.783301][ C0] tcp_close+0x23/0xb0 [ 202.783303][ C0] inet_release+0x10a/0x240 [ 202.783305][ C0] ? fcntl_setlk+0xc80/0xc80 [ 202.783308][ C0] __sock_release+0xb8/0x280 [ 202.783312][ C0] sock_close+0x18/0x20 [ 202.783313][ C0] __fput+0x363/0xac0 [ 202.783316][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783317][ C0] ? trace_irq_enable.constprop.0+0x9b/0x160 [ 202.783320][ C0] ? do_raw_spin_unlock+0x59/0x250 [ 202.783322][ C0] ? _raw_spin_unlock_irq+0x28/0x50 [ 202.783324][ C0] ? _raw_spin_unlock_irq+0x33/0x50 [ 202.783326][ C0] task_work_run+0x12b/0x240 [ 202.783328][ C0] ? lockdep_hardirqs_on+0x91/0x130 [ 202.783331][ C0] ? task_work_cancel+0x30/0x30 [ 202.783332][ C0] ? kmem_cache_free+0xf8/0x550 [ 202.783336][ C0] do_exit+0x614/0xdc0 [ 202.783337][ C0] ? exit_notify+0x890/0x890 [ 202.783338][ C0] ? find_held_lock+0x2b/0x80 [ 202.783340][ C0] ? __lock_release.isra.0+0x69/0x1a0 [ 202.783341][ C0] ? __rwlock_init+0x150/0x150 [ 202.783344][ C0] do_group_exit+0xb8/0x370 [ 202.783345][ C0] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 202.783346][ C0] ? lockdep_hardirqs_on+0x91/0x130 [ 202.783348][ C0] ? _raw_spin_unlock_irq+0x28/0x50 [ 202.783349][ C0] ? _raw_spin_unlock_irq+0x33/0x50 [ 202.783350][ C0] get_signal+0x1886/0x1980 [ 202.783354][ C0] ? ptrace_signal+0x600/0x600 [ 202.783356][ C0] arch_do_signal_or_restart+0xc2/0x3a0 [ 202.783360][ C0] ? get_sigframe_size+0x20/0x20 [ 202.783362][ C0] ? lockdep_hardirqs_on+0x91/0x130 [ 202.783364][ C0] ? do_futex+0x270/0x270 [ 202.783366][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783367][ C0] ? trace_irq_enable.constprop.0+0x9b/0x160 [ 202.783369][ C0] exit_to_user_mode_loop+0xd5/0x5a0 [ 202.783371][ C0] ? rcu_is_watching+0x16/0xd0 [ 202.783374][ C0] do_syscall_64+0x3e3/0x530 [ 202.783376][ C0] ? irq_exit_rcu+0x1a/0x30 [ 202.783378][ C0] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 202.783380][ C0] RIP: 0033:0x7fda435a3312 [ 202.783383][ C0] Code: Unable to access opcode bytes at 0x7fda435a32e8. [ 202.783384][ C0] RSP: 002b:00007ffdb6214508 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 202.783388][ C0] RAX: fffffffffffffe00 RBX: 0000000000416440 RCX: 00007fda435a3312 [ 202.783389][ C0] RDX: 000000000000002a RSI: 0000000000000189 RDI: 0000000000416460 [ 202.783390][ C0] RBP: 00007ffdb6214530 R08: 0000000000000000 R09: 00000000ffffffff [ 202.783391][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.783392][ C0] R13: 0000000000416480 R14: 0000000000000058 R15: 0000000000000000 [ 202.783395][ C0] [ 202.783395][ C0] [ 202.810529][ C0] The buggy address belongs to the object at ff1100000521c850 [ 202.810529][ C0] which belongs to the cache tw_sock_TCPv6 of size 296 [ 202.811003][ C0] The buggy address is located 112 bytes inside of [ 202.811003][ C0] allocated 296-byte region [ff1100000521c850, ff1100000521c978) [ 202.811470][ C0] [ 202.811559][ C0] The buggy address belongs to the physical page: [ 202.811774][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff1100000521c500 pfn:0x521c [ 202.812139][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 202.812409][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 202.812634][ C0] page_type: f5(slab) [ 202.812770][ C0] raw: 0080000000000240 ff11000005ba5b40 ff11000005bb0e48 ff11000005bb0e48 [ 202.813093][ C0] raw: ff1100000521c500 0000000000130003 00000000f5000000 0000000000000000 [ 202.813403][ C0] head: 0080000000000240 ff11000005ba5b40 ff11000005bb0e48 ff11000005bb0e48 [ 202.813716][ C0] head: ff1100000521c500 0000000000130003 00000000f5000000 0000000000000000 [ 202.814031][ C0] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 202.814340][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 202.814653][ C0] page dumped because: kasan: bad access detected [ 202.814876][ C0] [ 202.814963][ C0] Memory state around the buggy address: [ 202.815135][ C0] ff1100000521c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.815394][ C0] ff1100000521c800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.815647][ C0] >ff1100000521c880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.815906][ C0] ^ [ 202.816118][ C0] ff1100000521c900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.816372][ C0] ff1100000521c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 202.816687][ C0] ================================================================== [ 202.817016][ C0] Disabling lock debugging due to kernel taint