[ 8.816334][ T184] modprobe (184) used greatest stack depth: 24544 bytes left [ 10.697922][ T249] ip (249) used greatest stack depth: 24256 bytes left [ 67.396288][ C0] clocksource: Watchdog remote CPU 1 read timed out [ 104.559236][ T6666] ip (6666) used greatest stack depth: 23856 bytes left [ 233.227333][ T9327] ================================================================== [ 233.227497][ T9327] BUG: KASAN: slab-use-after-free in rtnl_fill_prop_list+0x5c0/0x620 [ 233.227627][ T9327] Read of size 8 at addr ff11000008568750 by task ip/9327 [ 233.227729][ T9327] [ 233.227773][ T9327] CPU: 0 UID: 0 PID: 9327 Comm: ip Not tainted 7.1.0-rc3-virtme #1 PREEMPT(full) [ 233.227777][ T9327] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 233.227778][ T9327] Call Trace: [ 233.227780][ T9327] [ 233.227781][ T9327] dump_stack_lvl+0x6f/0xa0 [ 233.227787][ T9327] print_address_description.constprop.0+0x56/0x2d0 [ 233.227791][ T9327] print_report+0xfc/0x1fa [ 233.227792][ T9327] ? __virt_addr_valid+0x102/0x440 [ 233.227797][ T9327] ? __virt_addr_valid+0x1da/0x440 [ 233.227799][ T9327] kasan_report+0x108/0x130 [ 233.227803][ T9327] ? rtnl_fill_prop_list+0x5c0/0x620 [ 233.227805][ T9327] ? rtnl_fill_prop_list+0x5c0/0x620 [ 233.227807][ T9327] rtnl_fill_prop_list+0x5c0/0x620 [ 233.227809][ T9327] ? __asan_memcpy+0x3c/0x60 [ 233.227812][ T9327] rtnl_fill_ifinfo.isra.0+0x3d6/0x2bf0 [ 233.227814][ T9327] ? kfree+0x22/0x5a0 [ 233.227817][ T9327] ? rtnl_fill_vf+0x460/0x460 [ 233.227819][ T9327] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 233.227822][ T9327] ? ref_tracker_free+0x380/0x870 [ 233.227826][ T9327] ? __lock_acquire+0x508/0xc10 [ 233.227829][ T9327] ? rtnl_calcit.isra.0+0x147/0x460 [ 233.227830][ T9327] ? ref_tracker_alloc+0x430/0x430 [ 233.227832][ T9327] ? linkwatch_clean_dev+0x14a/0x280 [ 233.227834][ T9327] ? linkwatch_sync_dev+0x1a/0x1c0 [ 233.227836][ T9327] ? rtnl_getlink+0x995/0xe50 [ 233.227837][ T9327] ? rtnetlink_rcv_msg+0x6fd/0xbd0 [ 233.227839][ T9327] ? netlink_rcv_skb+0x14e/0x3a0 [ 233.227842][ T9327] ? netlink_unicast+0x47c/0x740 [ 233.227844][ T9327] ? find_held_lock+0x2b/0x80 [ 233.227847][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227848][ T9327] ? mark_held_locks+0x40/0x70 [ 233.227850][ T9327] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 233.227851][ T9327] ? lockdep_hardirqs_on+0x8c/0x130 [ 233.227854][ T9327] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 233.227856][ T9327] rtnl_getlink+0xa48/0xe50 [ 233.227858][ T9327] ? find_held_lock+0x2b/0x80 [ 233.227860][ T9327] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 233.227862][ T9327] ? mark_usage+0x61/0x170 [ 233.227863][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227864][ T9327] ? __lock_acquire+0x508/0xc10 [ 233.227871][ T9327] ? lock_acquire.part.0+0xbc/0x260 [ 233.227873][ T9327] ? find_held_lock+0x2b/0x80 [ 233.227875][ T9327] ? mark_usage+0x61/0x170 [ 233.227876][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227877][ T9327] ? __lock_acquire+0x508/0xc10 [ 233.227880][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227882][ T9327] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 233.227883][ T9327] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 233.227885][ T9327] ? validate_chain+0x38b/0xc20 [ 233.227887][ T9327] ? rtnl_link_fill+0x920/0x920 [ 233.227889][ T9327] ? __lock_acquire+0x508/0xc10 [ 233.227891][ T9327] ? lock_acquire.part.0+0xbc/0x260 [ 233.227892][ T9327] ? find_held_lock+0x2b/0x80 [ 233.227894][ T9327] netlink_rcv_skb+0x14e/0x3a0 [ 233.227896][ T9327] ? rtnl_link_fill+0x920/0x920 [ 233.227898][ T9327] ? netlink_ack+0xce0/0xce0 [ 233.227901][ T9327] ? netlink_deliver_tap+0xc5/0x330 [ 233.227903][ T9327] ? netlink_deliver_tap+0x13c/0x330 [ 233.227905][ T9327] netlink_unicast+0x47c/0x740 [ 233.227908][ T9327] ? netlink_attachskb+0x800/0x800 [ 233.227910][ T9327] ? __lock_acquire+0x508/0xc10 [ 233.227911][ T9327] ? __lock_acquire+0x431/0xc10 [ 233.227913][ T9327] netlink_sendmsg+0x735/0xc60 [ 233.227915][ T9327] ? netlink_unicast+0x740/0x740 [ 233.227917][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227919][ T9327] ? __might_fault+0x97/0x140 [ 233.227922][ T9327] ? __might_fault+0x97/0x140 [ 233.227924][ T9327] ____sys_sendmsg+0x419/0x850 [ 233.227927][ T9327] ? copy_msghdr_from_user+0x2a0/0x460 [ 233.227929][ T9327] ? get_timestamp.constprop.0+0x390/0x390 [ 233.227930][ T9327] ? move_addr_to_kernel+0xf0/0xf0 [ 233.227931][ T9327] ? rcu_read_lock_any_held+0x3c/0x90 [ 233.227935][ T9327] ? rcu_lockdep_current_cpu_online+0x39/0x1b0 [ 233.227937][ T9327] ? rcu_read_lock_any_held+0x3c/0x90 [ 233.227939][ T9327] ? validate_chain+0x38b/0xc20 [ 233.227941][ T9327] ___sys_sendmsg+0x14e/0x1d0 [ 233.227942][ T9327] ? copy_msghdr_from_user+0x460/0x460 [ 233.227945][ T9327] ? __lock_release.isra.0+0x6b/0x1a0 [ 233.227948][ T9327] ? _copy_from_user+0x42/0x90 [ 233.227951][ T9327] ? do_getsockname+0xfa/0x180 [ 233.227953][ T9327] __sys_sendmsg+0x145/0x1f0 [ 233.227955][ T9327] ? __sys_sendmsg_sock+0x20/0x20 [ 233.227958][ T9327] ? __sys_getsockname+0xa2/0x110 [ 233.227960][ T9327] ? rcu_is_watching+0x15/0xd0 [ 233.227962][ T9327] do_syscall_64+0xf3/0xfc0 [ 233.227965][ T9327] ? trace_hardirqs_off+0xd/0x30 [ 233.227967][ T9327] ? exc_page_fault+0xee/0x100 [ 233.227969][ T9327] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 233.227971][ T9327] RIP: 0033:0x7fa72f91008e [ 233.227975][ T9327] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa [ 233.227976][ T9327] RSP: 002b:00007ffe99c051d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 233.227980][ T9327] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa72f91008e [ 233.227982][ T9327] RDX: 0000000000000000 RSI: 00007ffe99c05280 RDI: 0000000000000006 [ 233.227983][ T9327] RBP: 00007ffe99c051e0 R08: 0000000000000000 R09: 0000000000000000 [ 233.227984][ T9327] R10: 0000000000000000 R11: 0000000000000202 R12: 000000006a0c7d8d [ 233.227984][ T9327] R13: 00007ffe99c05330 R14: 000000000049f620 R15: 0000000000000001 [ 233.227987][ T9327] [ 233.227988][ T9327] [ 233.236169][ T9327] Allocated by task 9082: [ 233.236231][ T9327] kasan_save_stack+0x2f/0x50 [ 233.236313][ T9327] kasan_save_track+0x14/0x30 [ 233.236395][ T9327] __kasan_kmalloc+0x7b/0x90 [ 233.236472][ T9327] register_netdevice+0x48b/0x1980 [ 233.236551][ T9327] veth_newlink+0x3a9/0x8d0 [veth] [ 233.236630][ T9327] rtnl_newlink_create+0x2da/0x780 [ 233.236712][ T9327] __rtnl_newlink+0x22b/0xa50 [ 233.236793][ T9327] rtnl_newlink+0x8d1/0xee0 [ 233.236871][ T9327] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 233.236953][ T9327] netlink_rcv_skb+0x14e/0x3a0 [ 233.237033][ T9327] netlink_unicast+0x47c/0x740 [ 233.237117][ T9327] netlink_sendmsg+0x735/0xc60 [ 233.237196][ T9327] ____sys_sendmsg+0x419/0x850 [ 233.237275][ T9327] ___sys_sendmsg+0x14e/0x1d0 [ 233.237358][ T9327] __sys_sendmsg+0x145/0x1f0 [ 233.237439][ T9327] do_syscall_64+0xf3/0xfc0 [ 233.237520][ T9327] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 233.237619][ T9327] [ 233.237659][ T9327] Freed by task 9326: [ 233.237719][ T9327] kasan_save_stack+0x2f/0x50 [ 233.237804][ T9327] kasan_save_track+0x14/0x30 [ 233.237884][ T9327] kasan_save_free_info+0x3b/0x60 [ 233.237963][ T9327] __kasan_slab_free+0x43/0x70 [ 233.238044][ T9327] kfree+0x123/0x5a0 [ 233.238109][ T9327] unregister_netdevice_many_notify+0xe38/0x1d80 [ 233.238212][ T9327] rtnl_dellink+0x4a0/0xae0 [ 233.238292][ T9327] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 233.238375][ T9327] netlink_rcv_skb+0x14e/0x3a0 [ 233.238454][ T9327] netlink_unicast+0x47c/0x740 [ 233.238531][ T9327] netlink_sendmsg+0x735/0xc60 [ 233.238611][ T9327] ____sys_sendmsg+0x419/0x850 [ 233.238692][ T9327] ___sys_sendmsg+0x14e/0x1d0 [ 233.238771][ T9327] __sys_sendmsg+0x145/0x1f0 [ 233.238851][ T9327] do_syscall_64+0xf3/0xfc0 [ 233.238932][ T9327] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 233.239031][ T9327] [ 233.239072][ T9327] The buggy address belongs to the object at ff11000008568740 [ 233.239072][ T9327] which belongs to the cache kmalloc-64 of size 64 [ 233.239268][ T9327] The buggy address is located 16 bytes inside of [ 233.239268][ T9327] freed 64-byte region [ff11000008568740, ff11000008568780) [ 233.239467][ T9327] [ 233.239508][ T9327] The buggy address belongs to the physical page: [ 233.239607][ T9327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff11000008568340 pfn:0x8568 [ 233.239769][ T9327] flags: 0x80000000000200(workingset|node=0|zone=1) [ 233.239874][ T9327] page_type: f5(slab) [ 233.239940][ T9327] raw: 0080000000000200 ff1100000103cac0 ffd4000000074610 ffd4000000048890 [ 233.240097][ T9327] raw: ff11000008568340 000000000010000c 00000000f5000000 0000000000000000 [ 233.240240][ T9327] page dumped because: kasan: bad access detected [ 233.240344][ T9327] [ 233.240386][ T9327] Memory state around the buggy address: [ 233.240464][ T9327] ff11000008568600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 233.240583][ T9327] ff11000008568680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 233.240698][ T9327] >ff11000008568700: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 233.240815][ T9327] ^ [ 233.240912][ T9327] ff11000008568780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 233.241028][ T9327] ff11000008568800: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 233.241144][ T9327] ================================================================== [ 233.241284][ T9327] Disabling lock debugging due to kernel taint