======================================
| [ 501.551059][ C1] ==================================================================
| [ 501.551596][ C1] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response.isra.0 (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 ./include/net/inet_sock.h:411 net/ipv6/tcp_ipv6.c:983)
| [ 501.552031][ C1] Read of size 8 at addr ff110000117632c0 by task socat/3287
| [ 501.552297][ C1]
[ 501.552395][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 501.552397][ C1] Call Trace:
[ 501.552398][ C1]
[ 501.552400][ C1] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 501.552406][ C1] print_address_description.constprop.0 (mm/kasan/report.c:378)
[ 501.552411][ C1] print_report (mm/kasan/report.c:482)
[ 501.552413][ C1] ? __virt_addr_valid (./include/linux/rcupdate.h:948 ./include/linux/mmzone.h:2276 arch/x86/mm/physaddr.c:54)
[ 501.552416][ C1] ? __virt_addr_valid (./include/linux/rcupdate.h:974 (discriminator 1) ./include/linux/mmzone.h:2286 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[ 501.552418][ C1] kasan_report (mm/kasan/report.c:595)
[ 501.552422][ C1] ? tcp_v6_send_response.isra.0 (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 ./include/net/inet_sock.h:411 net/ipv6/tcp_ipv6.c:983)
[ 501.552425][ C1] ? tcp_v6_send_response.isra.0 (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 ./include/net/inet_sock.h:411 net/ipv6/tcp_ipv6.c:983)
[ 501.552428][ C1] kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
[ 501.552430][ C1] tcp_v6_send_response.isra.0 (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 ./include/net/inet_sock.h:411 net/ipv6/tcp_ipv6.c:983)
[ 501.552434][ C1] ? __xfrm_policy_check2.constprop.0 (net/ipv4/ip_input.c:414 (discriminator 5))
[ 501.552437][ C1] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5554)
[ 501.552441][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:753 (discriminator 3))
[ 501.552444][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4341)
[ 501.552446][ C1] tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1149 net/ipv6/tcp_ipv6.c:1201 net/ipv6/tcp_ipv6.c:1993)
[ 501.552451][ C1] ? tcp_v6_syn_recv_sock (./include/net/sock.h:2479)
[ 501.552453][ C1] ? ipv6_raw_deliver (./include/linux/rcupdate.h:319 (discriminator 2) ./include/linux/rcupdate.h:880 (discriminator 2) net/ipv6/raw.c:207 (discriminator 2))
[ 501.552455][ C1] ? ipv6_raw_deliver (./include/linux/rcupdate.h:882 net/ipv6/raw.c:207)
[ 501.552457][ C1] ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
[ 501.552461][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:753 (discriminator 3))
[ 501.552463][ C1] ip6_input (net/ipv6/ip6_input.c:534 ./include/linux/netfilter.h:429 net/ipv6/ip6_input.c:545)
[ 501.552465][ C1] ip6_sublist_rcv_finish (./include/net/dst.h:480 (discriminator 4) net/ipv6/ip6_input.c:128 (discriminator 4))
[ 501.552467][ C1] ip6_list_rcv_finish.constprop.0 (net/ipv6/ip6_input.c:185)
[ 501.552470][ C1] ? ip6_rcv_finish_core.isra.0 (net/ipv6/ip6_input.c:93 (discriminator 1))
[ 501.552472][ C1] ? update_group_capacity (kernel/sched/fair.c:8287 (discriminator 4))
[ 501.552475][ C1] ipv6_list_rcv (net/ipv6/ip6_input.c:361 net/ipv6/ip6_input.c:395)
[ 501.552477][ C1] ? ipv6_rcv (./include/linux/skbuff.h:1165)
[ 501.552479][ C1] ? common_startup_64 (arch/x86/kernel/head_64.S:418)
[ 501.552483][ C1] __netif_receive_skb_list_core (net/core/dev.c:6307 net/core/dev.c:6354)
[ 501.552487][ C1] ? __netif_receive_skb_core.constprop.0 (./include/linux/filter.h:885 (discriminator 1))
[ 501.552489][ C1] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5908 (discriminator 2))
[ 501.552491][ C1] ? netif_receive_skb_list_internal (./include/linux/rcupdate.h:309 (discriminator 2) ./include/linux/rcupdate.h:849 (discriminator 2) net/core/dev.c:6482 (discriminator 2))
[ 501.552493][ C1] ? csum_partial (lib/checksum.c:119)
[ 501.552497][ C1] ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5871 (discriminator 22))
[ 501.552500][ C1] netif_receive_skb_list_internal (net/core/dev.c:6406 net/core/dev.c:6497)
[ 501.552501][ C1] ? mark_usage (kernel/locking/lockdep.c:4690)
[ 501.552504][ C1] ? process_backlog (net/core/dev.c:6752 (discriminator 28))
[ 501.552505][ C1] ? ipv6_gro_receive (net/ipv6/tcpv6_offload.c:74 net/ipv6/ip6_offload.c:288)
[ 501.552508][ C1] ? mark_usage (kernel/locking/lockdep.c:4690)
[ 501.552510][ C1] ? __lock_acquire (kernel/locking/lockdep.c:5254)
[ 501.552512][ C1] ? reacquire_held_locks (kernel/locking/lockdep.c:5401)
[ 501.552515][ C1] napi_complete_done (./include/net/gro.h:523 ./include/net/gro.h:519 ./include/net/gro.h:531 net/core/dev.c:6865)
[ 501.552517][ C1] ? __lock_release.isra.0 (kernel/locking/lockdep.c:5554)
[ 501.552519][ C1] ? netif_receive_skb_list (net/core/dev.c:6551)
[ 501.552521][ C1] ? nsim_start_peer_tx_queue.isra.0 (./include/linux/rcupdate.h:319 (discriminator 2) ./include/linux/rcupdate.h:880 (discriminator 2) drivers/net/netdevsim/netdev.c:65 (discriminator 2)) netdevsim
[ 501.552528][ C1] nsim_poll (drivers/net/netdevsim/netdev.c:420) netdevsim
[ 501.552533][ C1] ? nsim_start_peer_tx_queue.isra.0 (./include/linux/netdevice.h:2731) netdevsim
[ 501.552537][ C1] ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4116 (discriminator 3) kernel/rcu/tree.c:4108 (discriminator 3))
[ 501.552538][ C1] ? rcu_read_lock_any_held (./include/linux/lockdep.h:249 kernel/rcu/update.c:386 kernel/rcu/update.c:380)
[ 501.552541][ C1] __napi_poll (net/core/dev.c:7787)
[ 501.552544][ C1] net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
[ 501.552546][ C1] ? __lock_acquire (kernel/locking/lockdep.c:5254)
[ 501.552548][ C1] ? __napi_poll (./include/net/gro.h:507)
[ 501.552552][ C1] ? ktime_get_update_offsets_now (kernel/time/timekeeping.c:304 kernel/time/timekeeping.c:482 kernel/time/timekeeping.c:2859)
[ 501.552555][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4341)
[ 501.552557][ C1] handle_softirqs (kernel/softirq.c:645)
[ 501.552561][ C1] ? _local_bh_enable (kernel/softirq.c:428 (discriminator 1))
[ 501.552563][ C1] ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:58 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 501.552565][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:753 (discriminator 3))
[ 501.552567][ C1] do_softirq (kernel/softirq.c:546 (discriminator 19) kernel/softirq.c:533 (discriminator 19))
[ 501.552569][ C1]
[ 501.552570][ C1]
[ 501.552571][ C1] ? __dev_queue_xmit (./include/linux/rcupdate.h:319 (discriminator 2) ./include/linux/rcupdate.h:920 (discriminator 2) net/core/dev.c:4961 (discriminator 2))
[ 501.552572][ C1] __local_bh_enable_ip (kernel/softirq.c:473)
[ 501.552574][ C1] __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:923 (discriminator 2) net/core/dev.c:4961 (discriminator 2))
[ 501.552577][ C1] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5908 (discriminator 2))
[ 501.552579][ C1] ? netdev_core_pick_tx (net/core/dev.c:4784)
[ 501.552581][ C1] ? __asan_memcpy (mm/kasan/shadow.c:106 (discriminator 1))
[ 501.552582][ C1] ? eth_header (net/ethernet/eth.c:99)
[ 501.552586][ C1] ? neigh_resolve_output.part.0 (./include/linux/netdevice.h:3537 net/core/neighbour.c:1611)
[ 501.552590][ C1] ip6_finish_output (net/ipv6/ip6_output.c:210 net/ipv6/ip6_output.c:221)
[ 501.552592][ C1] ip6_output (./include/linux/netfilter.h:421 net/ipv6/ip6_output.c:248)
[ 501.552594][ C1] ip6_xmit (./include/net/dst.h:470 (discriminator 4) ./include/linux/netfilter.h:429 (discriminator 4) net/ipv6/ip6_output.c:381 (discriminator 4))
[ 501.552597][ C1] ? ip6_autoflowlabel (./arch/x86/include/asm/bitops.h:202 (discriminator 1))
[ 501.552598][ C1] ? __lock_acquire (kernel/locking/lockdep.c:5254)
[ 501.552601][ C1] ? lock_acquire.part.0 (kernel/locking/lockdep.c:5908 (discriminator 2))
[ 501.552603][ C1] ? inet6_csk_xmit (./include/linux/rcupdate.h:309 (discriminator 2) ./include/linux/rcupdate.h:849 (discriminator 2) net/ipv6/inet6_connection_sock.c:120 (discriminator 2))
[ 501.552605][ C1] ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:753 (discriminator 3))
[ 501.552606][ C1] ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5871 (discriminator 22))
[ 501.552608][ C1] inet6_csk_xmit (net/ipv6/inet6_connection_sock.c:123 (discriminator 13))
[ 501.552611][ C1] __tcp_transmit_skb (net/ipv4/tcp_output.c:1716)
[ 501.552615][ C1] ? __tcp_select_window (./arch/x86/include/asm/atomic.h:23)
[ 501.552616][ C1] ? tcp_mtu_probe (./include/net/net_namespace.h:422 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/tcp_output.c:2697 (discriminator 1))
[ 501.552619][ C1] tcp_write_xmit (net/ipv4/tcp_output.c:1734 net/ipv4/tcp_output.c:3070)
[ 501.552621][ C1] ? ip6_mtu (./include/linux/rcupdate.h:882 ./include/net/ip6_route.h:384 net/ipv6/route.c:3290)
[ 501.552624][ C1] ? tcp_connect_init (net/ipv4/tcp_output.c:4179)
[ 501.552626][ C1] ? tcp_retrans_try_collapse (./arch/x86/include/asm/atomic.h:23)
[ 501.552627][ C1] ? tcp_set_state (net/ipv4/tcp.c:2998)
[ 501.552631][ C1] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3253 (discriminator 1))
[ 501.552633][ C1] inet_shutdown (net/ipv4/af_inet.c:931)
[ 501.552636][ C1] ? vfs_write (./include/linux/fsnotify.h:93 ./include/linux/fsnotify.h:113 ./include/linux/fsnotify.h:127 ./include/linux/fsnotify.h:116 ./include/linux/fsnotify.h:437 fs/read_write.c:691)
[ 501.552639][ C1] __sys_shutdown (net/socket.c:2554 (discriminator 3) net/socket.c:2570 (discriminator 3))
[ 501.552642][ C1] __x64_sys_shutdown (net/socket.c:2575 net/socket.c:2573 net/socket.c:2573)
[ 501.552644][ C1] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4488)
[ 501.552646][ C1] ? do_syscall_64 (arch/x86/entry/syscall_64.c:81 (discriminator 44))
[ 501.552649][ C1] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 501.552651][ C1] ? exc_page_fault (arch/x86/mm/fault.c:1489 (discriminator 3) arch/x86/mm/fault.c:1536 (discriminator 3))
[ 501.552653][ C1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 501.552656][ C1] RIP: 0033:0x7f11b06c631b
[ 501.552659][ C1] Code: 8b 15 e1 6a 0f 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa b8 30 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ad 6a 0f 00 f7 d8 64 89 01 48
All code
========
0: 8b 15 e1 6a 0f 00 mov 0xf6ae1(%rip),%edx # 0xf6ae7
6: f7 d8 neg %eax
8: 64 89 02 mov %eax,%fs:(%rdx)
b: b8 ff ff ff ff mov $0xffffffff,%eax
10: c3 ret
11: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
18: 00 00 00
1b: 0f 1f 40 00 nopl 0x0(%rax)
1f: f3 0f 1e fa endbr64
23: b8 30 00 00 00 mov $0x30,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 ret
33: 48 8b 0d ad 6a 0f 00 mov 0xf6aad(%rip),%rcx # 0xf6ae7
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 ret
9: 48 8b 0d ad 6a 0f 00 mov 0xf6aad(%rip),%rcx # 0xf6abd
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
[ 501.552661][ C1] RSP: 002b:00007fffd8ee7568 EFLAGS: 00000206 ORIG_RAX: 0000000000000030
[ 501.552666][ C1] RAX: ffffffffffffffda RBX: 00005647a526b330 RCX: 00007f11b06c631b
[ 501.552668][ C1] RDX: 0000000000000006 RSI: 0000000000000002 RDI: 0000000000000006
[ 501.552669][ C1] RBP: 00007fffd8ee75e0 R08: 0000000000000001 R09: 00005647a526d000
[ 501.552670][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f11b0573b30
Finger prints:
print_report:kasan_report:kasan_check_range:tcp_v6_rcv:ip6_protocol_deliver_rcu