====================================== | [ 1596.661067] #PF: supervisor read access in kernel mode | [ 1596.661096] #PF: error_code(0x0000) - not-present page | [ 1596.661124] PGD 5c86067 P4D e6ed067 PUD 6ca6067 PMD 0 | [ 1596.661153] Oops: Oops: 0000 [#1] SMP [ 1596.661221] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1596.661262] RIP: 0010:l2tp_eth_create (net/l2tp/l2tp_core.h:341 net/l2tp/l2tp_core.h:346 net/l2tp/l2tp_eth.c:202 net/l2tp/l2tp_eth.c:250) l2tp_eth [ 1596.661290] Code: 00 00 ff ff 00 00 48 89 85 18 02 00 00 41 8b 74 24 3c 85 f6 0f 84 a2 00 00 00 48 8b 53 20 0f b7 43 4a 4d 8b ac 24 b8 00 00 00 <8b> 4a 54 03 42 3c 31 d2 85 c9 0f 94 c2 44 8d 74 d0 0e e8 37 61 d2 All code ======== 0: 00 00 add %al,(%rax) 2: ff (bad) 3: ff 00 incl (%rax) 5: 00 48 89 add %cl,-0x77(%rax) 8: 85 18 test %ebx,(%rax) a: 02 00 add (%rax),%al c: 00 41 8b add %al,-0x75(%rcx) f: 74 24 je 0x35 11: 3c 85 cmp $0x85,%al 13: f6 0f 84 testb $0x84,(%rdi) 16: a2 00 00 00 48 8b 53 movabs %al,0xf20538b48000000 1d: 20 0f 1f: b7 43 mov $0x43,%bh 21: 4a rex.WX 22: 4d 8b ac 24 b8 00 00 mov 0xb8(%r12),%r13 29: 00 2a:* 8b 4a 54 mov 0x54(%rdx),%ecx <-- trapping instruction 2d: 03 42 3c add 0x3c(%rdx),%eax 30: 31 d2 xor %edx,%edx 32: 85 c9 test %ecx,%ecx 34: 0f 94 c2 sete %dl 37: 44 8d 74 d0 0e lea 0xe(%rax,%rdx,8),%r14d 3c: e8 .byte 0xe8 3d: 37 (bad) 3e: 61 (bad) 3f: d2 .byte 0xd2 Code starting with the faulting instruction =========================================== 0: 8b 4a 54 mov 0x54(%rdx),%ecx 3: 03 42 3c add 0x3c(%rdx),%eax 6: 31 d2 xor %edx,%edx 8: 85 c9 test %ecx,%ecx a: 0f 94 c2 sete %dl d: 44 8d 74 d0 0e lea 0xe(%rax,%rdx,8),%r14d 12: e8 .byte 0xe8 13: 37 (bad) 14: 61 (bad) 15: d2 .byte 0xd2 [ 1596.661377] RSP: 0018:ff5bd9a88128f8f8 EFLAGS: 00010206 [ 1596.661407] RAX: 0000000000000008 RBX: ff1108d94e291400 RCX: 0000000000000005 [ 1596.661445] RDX: 0000000000000000 RSI: 0000000000000014 RDI: 7f7f7fffffffffff [ 1596.661483] RBP: ff1108d9479ec000 R08: 8080808080808080 R09: ff1108d9479ec120 [ 1596.661530] R10: ff5bd9a88128f900 R11: fefefefefefefeff R12: ff1108d942fb0c00 [ 1596.661576] R13: ff1108d941943300 R14: 0000000000000411 R15: 0000000000000000 [ 1596.661614] FS: 00007f6ca7aab400(0000) GS:ff1108d9e4b34000(0000) knlGS:0000000000000000 [ 1596.661657] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1596.661699] CR2: 0000000000000054 CR3: 0000000008bdb005 CR4: 0000000000771ef0 [ 1596.661735] PKRU: 55555554 [ 1596.661749] Call Trace: [ 1596.661766] [ 1596.661783] l2tp_nl_cmd_session_create (net/l2tp/l2tp_netlink.c:644) l2tp_netlink [ 1596.661818] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) [ 1596.661852] genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [ 1596.661873] ? l2tp_session_notify.constprop.0 (net/l2tp/l2tp_netlink.c:529) l2tp_netlink [ 1596.661910] ? genl_family_rcv_msg_dumpit (net/netlink/genetlink.c:1200) [ 1596.661941] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 1596.661963] genl_rcv (net/netlink/genetlink.c:1219) [ 1596.661984] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 1596.662005] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 1596.662028] ____sys_sendmsg (net/socket.c:727 (discriminator 4) net/socket.c:742 (discriminator 4) net/socket.c:2592 (discriminator 4)) [ 1596.662057] ___sys_sendmsg (net/socket.c:2648) [ 1596.662081] __sys_sendmsg (net/socket.c:2678 (discriminator 1)) [ 1596.662105] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1596.662128] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:114 arch/x86/mm/fault.c:1480 arch/x86/mm/fault.c:1527) [ 1596.662152] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 1596.662184] RIP: 0033:0x7f6ca7c05c5e [ 1596.662207] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 34 bd 00 00 call 0xbd3c 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 13 ff ff ff call 0xffffffffffffff4c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 13 ff ff ff call 0xffffffffffffff22 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 1596.662311] RSP: 002b:00007ffd1435f870 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 1596.662348] RAX: ffffffffffffffda RBX: 00007ffd1435fc30 RCX: 00007f6ca7c05c5e [ 1596.662384] RDX: 0000000000000000 RSI: 00007ffd1435f930 RDI: 0000000000000006 [ 1596.662429] RBP: 00007ffd1435f880 R08: 0000000000000000 R09: 0000000000000000 [ 1596.662468] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 Finger prints: l2tp_eth_create:l2tp_nl_cmd_session_create:genl_family_rcv_msg_doit:genl_rcv_msg:netlink_rcv_skb