[ 0.000000] Linux version 4.8.15-ab+ (root@localhost.localdomain) (gcc version 5.4.0 (GCC) ) #5 SMP Thu May 11 20:06:10 MSK 2017 [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.8.15-ab+ root=UUID=c6fd2578-db8d-42e5-a1eb-ff6b4aa51fc0 ro text console=tty0 console=ttyS0,115200n8 net.ifnames=0 crashkernel=512M [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format. [ 0.000000] x86/fpu: Using 'eager' FPU context switches. [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffdffff] usable [ 0.000000] BIOS-e820: [mem 0x00000000bffe0000-0x00000000bfffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000043fffffff] usable [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] SMBIOS 2.8 present. [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved [ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable [ 0.000000] e820: last_pfn = 0x440000 max_arch_pfn = 0x400000000 [ 0.000000] MTRR default type: write-back [ 0.000000] MTRR fixed ranges enabled: [ 0.000000] 00000-9FFFF write-back [ 0.000000] A0000-BFFFF uncachable [ 0.000000] C0000-FFFFF write-protect [ 0.000000] MTRR variable ranges enabled: [ 0.000000] 0 base 00C0000000 mask FFC0000000 uncachable [ 0.000000] 1 disabled [ 0.000000] 2 disabled [ 0.000000] 3 disabled [ 0.000000] 4 disabled [ 0.000000] 5 disabled [ 0.000000] 6 disabled [ 0.000000] 7 disabled [ 0.000000] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WC UC- WT [ 0.000000] e820: last_pfn = 0xbffe0 max_arch_pfn = 0x400000000 [ 0.000000] found SMP MP-table at [mem 0x000f6620-0x000f662f] mapped at [ffff8800000f6620] [ 0.000000] Base memory trampoline at [ffff880000099000] 99000 size 24576 [ 0.000000] Using GB pages for direct mapping [ 0.000000] BRK [0x04d20000, 0x04d20fff] PGTABLE [ 0.000000] BRK [0x04d21000, 0x04d21fff] PGTABLE [ 0.000000] BRK [0x04d22000, 0x04d22fff] PGTABLE [ 0.000000] RAMDISK: [mem 0x35faa000-0x36fccfff] [ 0.000000] ACPI: Early table checksum verification disabled [ 0.000000] ACPI: RSDP 0x00000000000F6420 000014 (v00 BOCHS ) [ 0.000000] ACPI: RSDT 0x00000000BFFE17D1 000034 (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001) [ 0.000000] ACPI: FACP 0x00000000BFFE0C14 000074 (v01 BOCHS BXPCFACP 00000001 BXPC 00000001) [ 0.000000] ACPI: DSDT 0x00000000BFFE0040 000BD4 (v01 BOCHS BXPCDSDT 00000001 BXPC 00000001) [ 0.000000] ACPI: FACS 0x00000000BFFE0000 000040 [ 0.000000] ACPI: SSDT 0x00000000BFFE0C88 000A81 (v01 BOCHS BXPCSSDT 00000001 BXPC 00000001) [ 0.000000] ACPI: APIC 0x00000000BFFE1709 000090 (v01 BOCHS BXPCAPIC 00000001 BXPC 00000001) [ 0.000000] ACPI: HPET 0x00000000BFFE1799 000038 (v01 BOCHS BXPCHPET 00000001 BXPC 00000001) [ 0.000000] ACPI: Local APIC address 0xfee00000 [ 0.000000] No NUMA configuration found [ 0.000000] Faking a node at [mem 0x0000000000000000-0x000000043fffffff] [ 0.000000] NODE_DATA(0) allocated [mem 0x43fffc000-0x43fffdfff] [ 0.000000] Reserving 512MB of memory at 336MB for crashkernel (System RAM: 16383MB) [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.000000] DMA32 [mem 0x0000000001000000-0x00000000ffffffff] [ 0.000000] Normal [mem 0x0000000100000000-0x000000043fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.000000] node 0: [mem 0x0000000000100000-0x00000000bffdffff] [ 0.000000] node 0: [mem 0x0000000100000000-0x000000043fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000043fffffff] [ 0.000000] On node 0 totalpages: 4194174 [ 0.000000] DMA zone: 64 pages used for memmap [ 0.000000] DMA zone: 21 pages reserved [ 0.000000] DMA zone: 3998 pages, LIFO batch:0 [ 0.000000] DMA32 zone: 12224 pages used for memmap [ 0.000000] DMA32 zone: 782304 pages, LIFO batch:31 [ 0.000000] Normal zone: 53248 pages used for memmap [ 0.000000] Normal zone: 3407872 pages, LIFO batch:31 [ 0.000000] kmemleak: Kernel memory leak detector disabled [ 0.000000] kasan: KernelAddressSanitizer initialized [ 0.000000] ACPI: PM-Timer IO Port: 0x608 [ 0.000000] ACPI: Local APIC address 0xfee00000 [ 0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1]) [ 0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23 [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level) [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level) [ 0.000000] ACPI: IRQ0 used by override. [ 0.000000] ACPI: IRQ5 used by override. [ 0.000000] ACPI: IRQ9 used by override. [ 0.000000] ACPI: IRQ10 used by override. [ 0.000000] ACPI: IRQ11 used by override. [ 0.000000] Using ACPI (MADT) for SMP configuration information [ 0.000000] ACPI: HPET id: 0x8086a201 base: 0xfed00000 [ 0.000000] smpboot: Allowing 4 CPUs, 0 hotplug CPUs [ 0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff] [ 0.000000] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff] [ 0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000effff] [ 0.000000] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff] [ 0.000000] PM: Registered nosave memory: [mem 0xbffe0000-0xbfffffff] [ 0.000000] PM: Registered nosave memory: [mem 0xc0000000-0xfeffbfff] [ 0.000000] PM: Registered nosave memory: [mem 0xfeffc000-0xfeffffff] [ 0.000000] PM: Registered nosave memory: [mem 0xff000000-0xfffbffff] [ 0.000000] PM: Registered nosave memory: [mem 0xfffc0000-0xffffffff] [ 0.000000] e820: [mem 0xc0000000-0xfeffbfff] available for PCI devices [ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns [ 0.000000] setup_percpu: NR_CPUS:32 nr_cpumask_bits:32 nr_cpu_ids:4 nr_node_ids:1 [ 0.000000] percpu: Embedded 44 pages/cpu @ffff8803aee00000 s140680 r8192 d31352 u524288 [ 0.000000] pcpu-alloc: s140680 r8192 d31352 u524288 alloc=1*2097152 [ 0.000000] pcpu-alloc: [0] 0 1 2 3 [ 0.000000] Built 1 zonelists in Node order, mobility grouping on. Total pages: 4128617 [ 0.000000] Policy zone: Normal [ 0.000000] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-4.8.15-ab+ root=UUID=c6fd2578-db8d-42e5-a1eb-ff6b4aa51fc0 ro text console=tty0 console=ttyS0,115200n8 net.ifnames=0 crashkernel=512M [ 0.000000] log_buf_len individual max cpu contribution: 131072 bytes [ 0.000000] log_buf_len total cpu_extra contributions: 393216 bytes [ 0.000000] log_buf_len min size: 524288 bytes [ 0.000000] log_buf_len: 1048576 bytes [ 0.000000] early log buf free: 516248(98%) [ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes) [ 0.000000] Memory: 13735288K/16776696K available (19367K kernel code, 3941K rwdata, 4776K rodata, 9944K init, 22044K bss, 3041408K reserved, 0K cma-reserved) [ 0.000000] Tempesta: allocated huge pages space ffff88038ec00000 512MB at node 0 [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Running RCU self tests [ 0.000000] Hierarchical RCU implementation. [ 0.000000] RCU lockdep checking is enabled. [ 0.000000] Build-time adjustment of leaf fanout to 64. [ 0.000000] RCU restricting CPUs from NR_CPUS=32 to nr_cpu_ids=4. [ 0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=4 [ 0.000000] NR_IRQS:4352 nr_irqs:456 16 [ 0.000000] Console: colour VGA+ 80x25 [ 0.000000] console [tty0] enabled [ 0.000000] console [ttyS0] enabled [ 0.000000] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar [ 0.000000] ... MAX_LOCKDEP_SUBCLASSES: 8 [ 0.000000] ... MAX_LOCK_DEPTH: 48 [ 0.000000] ... MAX_LOCKDEP_KEYS: 8191 [ 0.000000] ... CLASSHASH_SIZE: 4096 [ 0.000000] ... MAX_LOCKDEP_ENTRIES: 32768 [ 0.000000] ... MAX_LOCKDEP_CHAINS: 65536 [ 0.000000] ... CHAINHASH_SIZE: 32768 [ 0.000000] memory used by lock dependency info: 8159 kB [ 0.000000] per task-struct memory footprint: 1920 bytes [ 0.000000] kmemleak: Early log buffer exceeded (2659), please increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE [ 0.000000] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns [ 0.000000] hpet clockevent registered [ 0.000000] tsc: Fast TSC calibration using PIT [ 0.000000] tsc: Detected 3400.204 MHz processor [ 0.003005] Calibrating delay loop (skipped), value calculated using timer frequency.. 6800.40 BogoMIPS (lpj=3400204) [ 0.004493] pid_max: default: 32768 minimum: 301 [ 0.005088] ACPI: Core revision 20160422 [ 0.136153] ACPI: 2 ACPI AML tables successfully acquired and loaded [ 0.136978] [ 0.137272] Security Framework initialized [ 0.139476] Dentry cache hash table entries: 2097152 (order: 12, 16777216 bytes) [ 0.146724] Inode-cache hash table entries: 1048576 (order: 11, 8388608 bytes) [ 0.150708] Mount-cache hash table entries: 32768 (order: 6, 262144 bytes) [ 0.151078] Mountpoint-cache hash table entries: 32768 (order: 6, 262144 bytes) [ 0.156905] CPU: Physical Processor ID: 0 [ 0.157004] CPU: Processor Core ID: 0 [ 0.158004] mce: CPU supports 10 MCE banks [ 0.158662] numa_add_cpu cpu 0 node 0: mask now 0 [ 0.158666] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0 [ 0.159003] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0 [ 0.161250] Freeing SMP alternatives memory: 24K (ffffffff83791000 - ffffffff83797000) [ 0.162012] ftrace: allocating 23496 entries in 92 pages [ 0.169531] smpboot: APIC(0) Converting physical 0 to logical package 0 [ 0.170006] smpboot: Max logical packages: 1 [ 0.172000] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1 [ 0.181410] TSC deadline timer enabled [ 0.181424] smpboot: CPU0: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz (family: 0x6, model: 0x3c, stepping: 0x3) [ 0.182424] Performance Events: Haswell events, Intel PMU driver. [ 0.183044] ... version: 2 [ 0.183627] ... bit width: 48 [ 0.184009] ... generic registers: 8 [ 0.184615] ... value mask: 0000ffffffffffff [ 0.185003] ... max period: 000000007fffffff [ 0.185709] ... fixed-purpose events: 3 [ 0.186003] ... event mask: 00000007000000ff [ 0.192413] NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. [ 0.194881] x86: Booting SMP configuration: [ 0.195006] .... node #0, CPUs: #1 [ 0.004000] numa_add_cpu cpu 1 node 0: mask now 0-1 [ 0.257829] #2 [ 0.004000] numa_add_cpu cpu 2 node 0: mask now 0-2 [ 0.320869] #3 [ 0.004000] numa_add_cpu cpu 3 node 0: mask now 0-3 [ 0.382211] x86: Booted up 1 node, 4 CPUs [ 0.383005] smpboot: Total of 4 processors activated (27326.60 BogoMIPS) [ 0.395036] devtmpfs: initialized [ 0.404892] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns [ 0.407723] NET: Registered protocol family 16 [ 0.414040] cpuidle: using governor ladder [ 0.418013] cpuidle: using governor menu [ 0.418948] ACPI: bus type PCI registered [ 0.420836] PCI: Using configuration type 1 for base access [ 0.421122] core: PMU erratum BJ122, BV98, HSD29 workaround disabled, HT off [ 0.422094] NMI watchdog: enabled on all CPUs, permanently consumes one hw-PMU counter. [ 0.476741] HugeTLB registered 1 GB page size, pre-allocated 0 pages [ 0.477005] HugeTLB registered 2 MB page size, pre-allocated 0 pages [ 0.482078] ACPI: Added _OSI(Module Device) [ 0.482678] ACPI: Added _OSI(Processor Device) [ 0.483005] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.483630] ACPI: Added _OSI(Processor Aggregator Device) [ 0.547688] ACPI: Interpreter enabled [ 0.548419] ACPI: (supports S0 S3 S4 S5) [ 0.548995] ACPI: Using IOAPIC for interrupt routing [ 0.549476] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug [ 0.846503] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) [ 0.847100] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI] [ 0.848402] acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM [ 0.849694] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge. [ 0.880533] PCI host bridge to bus 0000:00 [ 0.881041] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window] [ 0.881846] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window] [ 0.882036] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window] [ 0.883036] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window] [ 0.884038] pci_bus 0000:00: root bus resource [bus 00-ff] [ 0.884893] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 0.894954] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100 [ 0.904755] pci 0000:00:01.1: [8086:7010] type 00 class 0x010180 [ 0.906009] pci 0000:00:01.1: reg 0x20: [io 0xc0e0-0xc0ef] [ 0.906615] pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io 0x01f0-0x01f7] [ 0.907006] pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io 0x03f6] [ 0.907772] pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io 0x0170-0x0177] [ 0.908005] pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io 0x0376] [ 0.917638] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000 [ 0.918079] pci 0000:00:01.3: quirk: [io 0x0600-0x063f] claimed by PIIX4 ACPI [ 0.919011] pci 0000:00:01.3: quirk: [io 0x0700-0x070f] claimed by PIIX4 SMB [ 0.929092] pci 0000:00:02.0: [1234:1111] type 00 class 0x030000 [ 0.930442] pci 0000:00:02.0: reg 0x10: [mem 0xfd000000-0xfdffffff pref] [ 0.931815] pci 0000:00:02.0: reg 0x18: [mem 0xfebf0000-0xfebf0fff] [ 0.934505] pci 0000:00:02.0: reg 0x30: [mem 0xfebe0000-0xfebeffff pref] [ 0.944635] pci 0000:00:03.0: [8086:100e] type 00 class 0x020000 [ 0.945009] pci 0000:00:03.0: reg 0x10: [mem 0xfebc0000-0xfebdffff] [ 0.945529] pci 0000:00:03.0: reg 0x14: [io 0xc000-0xc03f] [ 0.948356] pci 0000:00:03.0: reg 0x30: [mem 0xfeb80000-0xfebbffff pref] [ 0.958576] pci 0000:00:04.0: [1af4:1002] type 00 class 0x00ff00 [ 0.958913] pci 0000:00:04.0: reg 0x10: [io 0xc0c0-0xc0df] [ 0.970148] pci 0000:00:05.0: [1af4:1009] type 00 class 0x000200 [ 0.970695] pci 0000:00:05.0: reg 0x10: [io 0xc040-0xc07f] [ 0.971007] pci 0000:00:05.0: reg 0x14: [mem 0xfebf1000-0xfebf1fff] [ 0.983066] pci 0000:00:06.0: [1af4:1009] type 00 class 0x000200 [ 0.983606] pci 0000:00:06.0: reg 0x10: [io 0xc080-0xc0bf] [ 0.984007] pci 0000:00:06.0: reg 0x14: [mem 0xfebf2000-0xfebf2fff] [ 1.025229] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11) [ 1.031875] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11) [ 1.038437] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11) [ 1.045191] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11) [ 1.048395] ACPI: PCI Interrupt Link [LNKS] (IRQs *9) [ 1.081302] ACPI: Enabled 16 GPEs in block 00 to 0F [ 1.084275] vgaarb: setting as boot device: PCI:0000:00:02.0 [ 1.084836] vgaarb: device added: PCI:0000:00:02.0,decodes=io+mem,owns=io+mem,locks=none [ 1.085011] vgaarb: loaded [ 1.085504] vgaarb: bridge control possible 0000:00:02.0 [ 1.089434] SCSI subsystem initialized [ 1.090406] libata version 3.00 loaded. [ 1.093024] PCI: Using ACPI for IRQ routing [ 1.093630] PCI: pci_cache_line_size set to 64 bytes [ 1.093723] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff] [ 1.093765] e820: reserve RAM buffer [mem 0xbffe0000-0xbfffffff] [ 1.098604] NetLabel: Initializing [ 1.099005] NetLabel: domain hash size = 128 [ 1.099609] NetLabel: protocols = UNLABELED CIPSOv4 [ 1.100239] NetLabel: unlabeled traffic allowed by default [ 1.101356] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0 [ 1.102401] hpet0: 3 comparators, 64-bit 100.000000 MHz counter [ 1.113787] clocksource: Switched to clocksource hpet [ 1.324298] VFS: Disk quotas dquot_6.6.0 [ 1.325039] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 1.327382] pnp: PnP ACPI init [ 1.330065] pnp 00:00: Plug and Play ACPI device, IDs PNP0b00 (active) [ 1.331824] pnp 00:01: Plug and Play ACPI device, IDs PNP0303 (active) [ 1.333511] pnp 00:02: Plug and Play ACPI device, IDs PNP0f13 (active) [ 1.334940] pnp 00:03: [dma 2] [ 1.335893] pnp 00:03: Plug and Play ACPI device, IDs PNP0700 (active) [ 1.338299] pnp 00:04: Plug and Play ACPI device, IDs PNP0400 (active) [ 1.340736] pnp 00:05: Plug and Play ACPI device, IDs PNP0501 (active) [ 1.343202] pnp 00:06: Plug and Play ACPI device, IDs PNP0501 (active) [ 1.354157] pnp: PnP ACPI: found 7 devices [ 1.425474] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 1.426696] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] [ 1.426698] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window] [ 1.426699] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window] [ 1.426700] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfffff window] [ 1.427106] NET: Registered protocol family 2 [ 1.430831] TCP established hash table entries: 131072 (order: 8, 1048576 bytes) [ 1.432911] TCP bind hash table entries: 65536 (order: 10, 4194304 bytes) [ 1.440133] TCP: Hash tables configured (established 131072 bind 65536) [ 1.441315] UDP hash table entries: 8192 (order: 8, 1310720 bytes) [ 1.443536] UDP-Lite hash table entries: 8192 (order: 8, 1310720 bytes) [ 1.447040] NET: Registered protocol family 1 [ 1.447768] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 1.448509] pci 0000:00:01.0: PIIX3: Enabling Passive Release [ 1.449244] pci 0000:00:01.0: Activating ISA DMA hang workarounds [ 1.449998] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 1.451161] PCI: CLS 0 bytes, default 64 [ 1.452341] Trying to unpack rootfs image as initramfs... [ 2.071886] Freeing initrd memory: 16524K (ffff880035faa000 - ffff880036fcd000) [ 2.073023] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) [ 2.073773] software IO TLB [mem 0xbbfe0000-0xbffe0000] (64MB) mapped at [ffff8800bbfe0000-ffff8800bffdffff] [ 2.100982] futex hash table entries: 1024 (order: 5, 131072 bytes) [ 2.102036] audit: initializing netlink subsys (disabled) [ 2.103040] audit: type=2000 audit(1494581512.102:1): initialized [ 2.111916] workingset: timestamp_bits=59 max_order=22 bucket_order=0 [ 2.275694] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251) [ 2.277167] io scheduler noop registered [ 2.277748] io scheduler deadline registered [ 2.280884] io scheduler cfq registered (default) [ 2.289939] intel_idle: does not run on family 6 model 60 [ 2.292394] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 [ 2.293588] ACPI: Power Button [PWRF] [ 2.300191] GHES: HEST is not enabled! [ 2.301763] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 2.325145] 00:05: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 2.351682] 00:06: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A [ 2.364646] Non-volatile memory driver v1.3 [ 2.366319] Linux agpgart interface v0.103 [ 2.459277] brd: module loaded [ 2.516318] loop: module loaded [ 2.520437] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 [ 2.523665] serio: i8042 KBD port at 0x60,0x64 irq 1 [ 2.524533] serio: i8042 AUX port at 0x60,0x64 irq 12 [ 2.529603] mousedev: PS/2 mouse device common for all mice [ 2.536479] drop_monitor: Initializing network drop monitor service [ 2.538394] Initializing XFRM netlink socket [ 2.539138] NET: Registered protocol family 17 [ 2.539780] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1 [ 2.548521] microcode: sig=0x306c3, pf=0x1, revision=0x1 [ 2.550517] microcode: Microcode Update Driver: v2.01 , Peter Oruba [ 2.555049] registered taskstats version 1 [ 2.555698] page_owner is disabled [ 2.556921] ima: No TPM chip found, activating TPM-bypass! [ 2.562199] hctosys: unable to open rtc device (rtc0) [ 2.579059] Freeing unused kernel memory: 9944K (ffffffff82ddb000 - ffffffff83791000) [ 2.580171] Write protecting the kernel read-only data: 26624k [ 2.582036] Freeing unused kernel memory: 1092K (ffff8800022ef000 - ffff880002400000) [ 2.586110] Freeing unused kernel memory: 1368K (ffff8800028aa000 - ffff880002a00000) [ 2.603213] systemd[1]: Inserted module 'autofs4' [ 2.630863] NET: Registered protocol family 10 [ 2.645193] systemd[1]: Inserted module 'ipv6' [ 2.653080] random: systemd: uninitialized urandom read (16 bytes read) [ 2.657138] random: systemd: uninitialized urandom read (16 bytes read) [ 2.674923] systemd[1]: systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN) [ 2.677217] systemd[1]: Detected virtualization kvm. [ 2.677904] systemd[1]: Detected architecture x86-64. [ 2.678610] systemd[1]: Running in initial RAM disk. [ 2.680994] systemd[1]: Set hostname to . [ 2.799361] random: systemd: uninitialized urandom read (16 bytes read) [ 2.800236] random: systemd: uninitialized urandom read (16 bytes read) [ 2.801125] random: systemd: uninitialized urandom read (16 bytes read) [ 2.801964] random: systemd: uninitialized urandom read (16 bytes read) [ 2.805681] random: systemd: uninitialized urandom read (16 bytes read) [ 2.806772] random: systemd: uninitialized urandom read (16 bytes read) [ 2.807896] random: systemd: uninitialized urandom read (16 bytes read) [ 2.809739] random: systemd: uninitialized urandom read (16 bytes read) [ 2.820471] systemd[1]: Reached target Timers. [ 2.821175] systemd[1]: Starting Timers. [ 2.823441] systemd[1]: Reached target Local File Systems. [ 2.824187] systemd[1]: Starting Local File Systems. [ 2.831164] systemd[1]: Created slice -.slice. [ 3.103207] tsc: Refined TSC clocksource calibration: 3399.987 MHz [ 3.124873] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x310242702b2, max_idle_ns: 440795263614 ns [ 3.468414] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3 [ 3.742490] ata_piix 0000:00:01.1: version 2.13 [ 3.775002] Floppy drive(s): fd0 is 1.44M [ 3.796084] scsi host0: ata_piix [ 3.803669] FDC 0 is a S82078B [ 3.827230] e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI [ 3.828055] e1000: Copyright (c) 1999-2006 Intel Corporation. [ 3.852792] random: fast init done [ 3.873235] scsi host1: ata_piix [ 3.891632] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc0e0 irq 14 [ 3.892460] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc0e8 irq 15 [ 4.055759] ata1.01: NODEV after polling detection [ 4.055953] ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100 [ 4.058100] ata1.00: 41943040 sectors, multi 16: LBA48 [ 4.060435] ata1.00: configured for MWDMA2 [ 4.063437] ata2.01: NODEV after polling detection [ 4.063636] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100 [ 4.068323] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 [ 4.075817] ata2.00: configured for MWDMA2 [ 4.112030] sd 0:0:0:0: [sda] 41943040 512-byte logical blocks: (21.5 GB/20.0 GiB) [ 4.114835] sd 0:0:0:0: [sda] Write Protect is off [ 4.116145] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00 [ 4.116623] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 4.126435] sd 0:0:0:0: Attached scsi generic sg0 type 0 [ 4.136091] clocksource: Switched to clocksource tsc [ 4.149786] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5 [ 4.153528] sda: sda1 [ 4.171661] sd 0:0:0:0: [sda] Attached SCSI disk [ 4.179126] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray [ 4.181496] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 4.202983] sr 1:0:0:0: Attached scsi CD-ROM sr0 [ 4.206885] sr 1:0:0:0: Attached scsi generic sg1 type 5 [ 11.576440] ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 11 [ 11.577240] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver [ 15.252008] perf: interrupt took too long (2571 > 2500), lowering kernel.perf_event_max_sample_rate to 77000 [ 18.666250] perf: interrupt took too long (3245 > 3213), lowering kernel.perf_event_max_sample_rate to 61000 [ 19.137728] ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 10 [ 19.138524] virtio-pci 0000:00:05.0: virtio_pci: leaving for legacy driver [ 22.555007] perf: interrupt took too long (4057 > 4056), lowering kernel.perf_event_max_sample_rate to 49000 [ 26.685231] ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 10 [ 26.692274] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver [ 34.619068] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11 [ 34.922501] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:00:f1:cb:48 [ 34.923426] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection [ 37.134735] perf: interrupt took too long (5095 > 5071), lowering kernel.perf_event_max_sample_rate to 39000 [ 42.627752] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null) [ 43.390343] systemd-journald[118]: Received SIGTERM from PID 1 (systemd). [ 43.460060] systemd: 23 output lines suppressed due to ratelimiting [ 43.472245] random: crng init done [ 43.720069] ip_tables: (C) 2000-2006 Netfilter Core Team [ 43.721374] systemd[1]: Inserted module 'ip_tables' [ 44.260279] EXT4-fs (sda1): re-mounted. Opts: (null) [ 44.410253] systemd-journald[371]: Received request to flush runtime journal from PID 1 [ 44.836186] audit: type=1305 audit(1494581554.835:2): audit_pid=408 old=0 auid=4294967295 ses=4294967295 res=1 [ 45.630048] parport_pc 00:04: reported by Plug and Play ACPI [ 45.632470] parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE] [ 45.680727] input: PC Speaker as /devices/platform/pcspkr/input/input4 [ 45.749685] 9pnet: Installing 9P2000 support [ 45.967589] piix4_smbus 0000:00:01.3: SMBus Host Controller at 0x700, revision 0 [ 46.165358] ppdev: user-space parallel port driver [ 46.288691] AVX2 version of gcm_enc/dec engaged. [ 46.289987] AES CTR mode by8 optimization enabled [ 46.628769] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 46.632712] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 46.647761] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX [ 46.651624] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 55.718235] perf: interrupt took too long (6416 > 6368), lowering kernel.perf_event_max_sample_rate to 31000 [ 100.325931] perf: interrupt took too long (8031 > 8020), lowering kernel.perf_event_max_sample_rate to 24000 [ 353.258133] perf: interrupt took too long (10043 > 10038), lowering kernel.perf_event_max_sample_rate to 19000 [ 601.827713] tempesta_tls: loading out-of-tree module taints kernel. [ 605.339646] [tdb] Start Tempesta DB [ 605.360718] [tempesta] Initializing Tempesta FW kernel module... [ 605.437907] [tempesta] Registering new scheduler: hash [ 605.447384] [tempesta] Registering new scheduler: http [ 605.456698] [tempesta] Registering new scheduler: round-robin [ 605.496278] [tempesta] Starting all modules... [ 605.518760] [tdb] Opened table /opt/tempesta/db/filter.tdb: size=16777216 rec_size=20 base=ffff8803adc00000 [ 605.824774] [tdb] Opened table /opt/tempesta/db/cache.tdb: size=268435456 rec_size=0 base=ffff88039dc00000 [ 605.826372] [tempesta] Open listen socket on: 0.0.0.0 [ 605.827656] [tempesta] modules are started [ 664.513244] perf: interrupt took too long (12559 > 12553), lowering kernel.perf_event_max_sample_rate to 15000 [ 1283.286004] ================================================================== [ 1283.286004] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880389e56014 [ 1283.286004] Read of size 4 by task ksoftirqd/2/22 [ 1283.286004] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.286004] flags: 0x1000000000000000() [ 1283.286004] page dumped because: kasan: bad access detected [ 1283.286004] CPU: 2 PID: 22 Comm: ksoftirqd/2 Tainted: G O 4.8.15-ab+ #5 [ 1283.286004] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.286004] ffff880389e56000 ffff88038c9af870 ffffffff8199f263 ffff88038c9af900 [ 1283.286004] ffff880389e56014 ffff88038c9af8f0 ffffffff8151c33e ffff880312156cf8 [ 1283.286004] 0000000000000000 ffff88038c9af9b8 0000000000000282 00000001000f00d3 [ 1283.286004] Call Trace: [ 1283.286004] [] dump_stack+0x67/0x94 [ 1283.286004] [] kasan_report_error+0x4ae/0x4e0 [ 1283.286004] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.286004] [] ? skb_page_frag_refill+0x280/0x330 [ 1283.286004] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.286004] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.286004] [] tcp_rearm_rto+0x72/0xc0 [ 1283.286004] [] tcp_event_new_data_sent+0x225/0x2c0 [ 1283.286004] [] tcp_write_xmit+0x596/0x4d10 [ 1283.286004] [] ? tcp_v4_md5_lookup+0x13/0x20 [ 1283.286004] [] ? tcp_established_options+0x94/0x3f0 [ 1283.286004] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.286004] [] ? tcp_sync_mss+0x540/0x5b0 [ 1283.286004] [] __tcp_push_pending_frames+0x8d/0x2a0 [ 1283.286004] [] tcp_push+0x460/0x740 [ 1283.286004] [] ? tcp_send_mss+0x24/0x2b0 [ 1283.286004] [] ss_tx_action+0x962/0x1210 [tempesta_fw] [ 1283.286004] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.286004] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.286004] [] net_tx_action+0x244/0x9d0 [ 1283.286004] [] ? net_tx_action+0x1e0/0x9d0 [ 1283.286004] [] ? cpu_callback+0x850/0x850 [ 1283.286004] [] __do_softirq+0x22c/0x99f [ 1283.286004] [] ? cpu_callback+0x850/0x850 [ 1283.286004] [] run_ksoftirqd+0x1f/0x60 [ 1283.286004] [] smpboot_thread_fn+0x3c4/0x840 [ 1283.286004] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.286004] [] ? schedule+0x9c/0x1c0 [ 1283.286004] [] ? __kthread_parkme+0xdc/0x200 [ 1283.286004] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.286004] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.286004] [] kthread+0x20e/0x2d0 [ 1283.286004] [] ? kthread_create_on_node+0x390/0x390 [ 1283.286004] [] ret_from_fork+0x1f/0x40 [ 1283.286004] [] ? kthread_create_on_node+0x390/0x390 [ 1283.286004] Memory state around the buggy address: [ 1283.286004] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.286004] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.286004] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.286004] ^ [ 1283.286004] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.286004] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.286004] ================================================================== [ 1283.286004] Disabling lock debugging due to kernel taint [ 1283.335552] ================================================================== [ 1283.336060] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880389e56014 [ 1283.336060] Read of size 4 by task ksoftirqd/2/22 [ 1283.336060] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.336060] flags: 0x1000000000000000() [ 1283.339925] page dumped because: kasan: bad access detected [ 1283.339925] CPU: 2 PID: 22 Comm: ksoftirqd/2 Tainted: G B O 4.8.15-ab+ #5 [ 1283.339925] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.339925] ffff880389e56000 ffff88038c9af870 ffffffff8199f263 ffff88038c9af900 [ 1283.339925] ffff880389e56014 ffff88038c9af8f0 ffffffff8151c33e ffff880383c368f8 [ 1283.339925] 0000000000000000 ffff88038c9af9b8 0000000000000282 00000001000f00d3 [ 1283.339925] Call Trace: [ 1283.339925] [] dump_stack+0x67/0x94 [ 1283.339925] [] kasan_report_error+0x4ae/0x4e0 [ 1283.339925] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.339925] [] ? skb_page_frag_refill+0x280/0x330 [ 1283.339925] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.339925] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.339925] [] tcp_rearm_rto+0x72/0xc0 [ 1283.339925] [] tcp_event_new_data_sent+0x225/0x2c0 [ 1283.339925] [] tcp_write_xmit+0x596/0x4d10 [ 1283.339925] [] ? tcp_v4_md5_lookup+0x13/0x20 [ 1283.339925] [] ? tcp_established_options+0x94/0x3f0 [ 1283.339925] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.339925] [] ? tcp_sync_mss+0x540/0x5b0 [ 1283.339925] [] __tcp_push_pending_frames+0x8d/0x2a0 [ 1283.339925] [] tcp_push+0x460/0x740 [ 1283.339925] [] ? tcp_send_mss+0x24/0x2b0 [ 1283.339925] [] ss_tx_action+0x962/0x1210 [tempesta_fw] [ 1283.339925] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.339925] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.339925] [] net_tx_action+0x244/0x9d0 [ 1283.339925] [] ? net_tx_action+0x1e0/0x9d0 [ 1283.339925] [] ? cpu_callback+0x850/0x850 [ 1283.339925] [] __do_softirq+0x22c/0x99f [ 1283.339925] [] ? cpu_callback+0x850/0x850 [ 1283.339925] [] run_ksoftirqd+0x1f/0x60 [ 1283.339925] [] smpboot_thread_fn+0x3c4/0x840 [ 1283.339925] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.339925] [] ? schedule+0x9c/0x1c0 [ 1283.339925] [] ? __kthread_parkme+0xdc/0x200 [ 1283.339925] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.339925] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.339925] [] kthread+0x20e/0x2d0 [ 1283.339925] [] ? kthread_create_on_node+0x390/0x390 [ 1283.339925] [] ret_from_fork+0x1f/0x40 [ 1283.339925] [] ? kthread_create_on_node+0x390/0x390 [ 1283.339925] Memory state around the buggy address: [ 1283.339925] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.339925] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.339925] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.339925] ^ [ 1283.339925] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.339925] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.339925] ================================================================== [ 1283.381625] ================================================================== [ 1283.382579] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880389e56014 [ 1283.383031] Read of size 4 by task ksoftirqd/2/22 [ 1283.383031] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.383031] flags: 0x1000000000000000() [ 1283.383031] page dumped because: kasan: bad access detected [ 1283.383031] CPU: 2 PID: 22 Comm: ksoftirqd/2 Tainted: G B O 4.8.15-ab+ #5 [ 1283.383031] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.383031] ffff880389e56000 ffff88038c9af870 ffffffff8199f263 ffff88038c9af900 [ 1283.383031] ffff880389e56014 ffff88038c9af8f0 ffffffff8151c33e ffff8803144f50f8 [ 1283.383031] 0000000000000000 ffff88038c9af9b8 0000000000000282 00000001000f00d3 [ 1283.383031] Call Trace: [ 1283.383031] [] dump_stack+0x67/0x94 [ 1283.383031] [] kasan_report_error+0x4ae/0x4e0 [ 1283.383031] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.383031] [] ? skb_page_frag_refill+0x280/0x330 [ 1283.383031] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.383031] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.383031] [] tcp_rearm_rto+0x72/0xc0 [ 1283.383031] [] tcp_event_new_data_sent+0x225/0x2c0 [ 1283.383031] [] tcp_write_xmit+0x596/0x4d10 [ 1283.383031] [] ? tcp_v4_md5_lookup+0x13/0x20 [ 1283.383031] [] ? tcp_established_options+0x94/0x3f0 [ 1283.383031] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.383031] [] ? tcp_sync_mss+0x540/0x5b0 [ 1283.383031] [] __tcp_push_pending_frames+0x8d/0x2a0 [ 1283.383031] [] tcp_push+0x460/0x740 [ 1283.383031] [] ? tcp_send_mss+0x24/0x2b0 [ 1283.383031] [] ss_tx_action+0x962/0x1210 [tempesta_fw] [ 1283.383031] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.383031] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.383031] [] net_tx_action+0x244/0x9d0 [ 1283.383031] [] ? net_tx_action+0x1e0/0x9d0 [ 1283.383031] [] ? cpu_callback+0x850/0x850 [ 1283.383031] [] __do_softirq+0x22c/0x99f [ 1283.383031] [] ? cpu_callback+0x850/0x850 [ 1283.383031] [] run_ksoftirqd+0x1f/0x60 [ 1283.383031] [] smpboot_thread_fn+0x3c4/0x840 [ 1283.383031] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.383031] [] ? schedule+0x9c/0x1c0 [ 1283.383031] [] ? __kthread_parkme+0xdc/0x200 [ 1283.383031] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.383031] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.383031] [] kthread+0x20e/0x2d0 [ 1283.383031] [] ? kthread_create_on_node+0x390/0x390 [ 1283.383031] [] ret_from_fork+0x1f/0x40 [ 1283.383031] [] ? kthread_create_on_node+0x390/0x390 [ 1283.383031] Memory state around the buggy address: [ 1283.383031] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.383031] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.383031] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.383031] ^ [ 1283.383031] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.383031] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.383031] ================================================================== [ 1283.438117] ================================================================== [ 1283.439010] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880389e56014 [ 1283.439010] Read of size 4 by task ksoftirqd/2/22 [ 1283.439010] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.439010] flags: 0x1000000000000000() [ 1283.439010] page dumped because: kasan: bad access detected [ 1283.439010] CPU: 2 PID: 22 Comm: ksoftirqd/2 Tainted: G B O 4.8.15-ab+ #5 [ 1283.439010] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.439010] ffff880389e56000 ffff88038c9af870 ffffffff8199f263 ffff88038c9af900 [ 1283.439010] ffff880389e56014 ffff88038c9af8f0 ffffffff8151c33e ffff88037e28b0f8 [ 1283.439010] 0000000000000000 ffff88038c9af9b8 0000000000000282 0000000000000292 [ 1283.439010] Call Trace: [ 1283.439010] [] dump_stack+0x67/0x94 [ 1283.439010] [] kasan_report_error+0x4ae/0x4e0 [ 1283.439010] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.439010] [] ? skb_page_frag_refill+0x280/0x330 [ 1283.439010] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.439010] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.439010] [] tcp_rearm_rto+0x72/0xc0 [ 1283.439010] [] tcp_event_new_data_sent+0x225/0x2c0 [ 1283.439010] [] tcp_write_xmit+0x596/0x4d10 [ 1283.439010] [] ? tcp_v4_md5_lookup+0x13/0x20 [ 1283.439010] [] ? tcp_established_options+0x94/0x3f0 [ 1283.439010] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.439010] [] ? tcp_sync_mss+0x540/0x5b0 [ 1283.439010] [] __tcp_push_pending_frames+0x8d/0x2a0 [ 1283.439010] [] tcp_push+0x460/0x740 [ 1283.439010] [] ? tcp_send_mss+0x24/0x2b0 [ 1283.439010] [] ss_tx_action+0x962/0x1210 [tempesta_fw] [ 1283.439010] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.439010] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 1283.439010] [] net_tx_action+0x244/0x9d0 [ 1283.439010] [] ? net_tx_action+0x1e0/0x9d0 [ 1283.439010] [] ? cpu_callback+0x850/0x850 [ 1283.439010] [] __do_softirq+0x22c/0x99f [ 1283.439010] [] ? cpu_callback+0x850/0x850 [ 1283.439010] [] run_ksoftirqd+0x1f/0x60 [ 1283.439010] [] smpboot_thread_fn+0x3c4/0x840 [ 1283.439010] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.439010] [] ? schedule+0x9c/0x1c0 [ 1283.439010] [] ? __kthread_parkme+0xdc/0x200 [ 1283.439010] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.439010] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 1283.439010] [] kthread+0x20e/0x2d0 [ 1283.439010] [] ? kthread_create_on_node+0x390/0x390 [ 1283.439010] [] ret_from_fork+0x1f/0x40 [ 1283.439010] [] ? kthread_create_on_node+0x390/0x390 [ 1283.439010] Memory state around the buggy address: [ 1283.439010] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.439010] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.439010] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.439010] ^ [ 1283.439010] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.439010] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.439010] ================================================================== [ 1283.488183] ================================================================== [ 1283.489005] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880389e56014 [ 1283.489005] Read of size 4 by task httpd/819 [ 1283.489005] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.489005] flags: 0x1000000000000000() [ 1283.489005] page dumped because: kasan: bad access detected [ 1283.489005] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1283.489005] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.489005] ffff880389e56000 ffff8803aef07448 ffffffff8199f263 ffff8803aef074d8 [ 1283.489005] ffff880389e56014 ffff8803aef074c8 ffffffff8151c33e 0000000000000046 [ 1283.489005] 0000000000000000 ffffffff812714f9 0000000000000296 ffff8803aef07530 [ 1283.489005] Call Trace: [ 1283.489005] [] dump_stack+0x67/0x94 [ 1283.489005] [] kasan_report_error+0x4ae/0x4e0 [ 1283.489005] [] ? lock_timer_base+0xf9/0x190 [ 1283.489005] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.489005] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.489005] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1283.489005] [] tcp_ack+0x22a9/0x2e60 [ 1283.489005] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.489005] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1283.489005] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.489005] [] tcp_rcv_established+0x58c/0x2de0 [ 1283.489005] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1283.489005] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1283.489005] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1283.489005] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1283.489005] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1283.489005] [] tcp_v4_rcv+0x213e/0x3420 [ 1283.489005] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1283.489005] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1283.489005] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1283.489005] [] ip_local_deliver+0x24d/0x330 [ 1283.489005] [] ? ip_call_ra_chain+0x510/0x510 [ 1283.489005] [] ? nf_hook_slow+0x186/0x2a0 [ 1283.489005] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1283.489005] [] ? nf_hook_slow+0x5/0x2a0 [ 1283.489005] [] ip_rcv_finish+0x599/0x1870 [ 1283.489005] [] ip_rcv+0x89b/0x11d0 [ 1283.489005] [] ? ip_local_deliver+0x330/0x330 [ 1283.525020] [] ? inet_del_offload+0x40/0x40 [ 1283.525020] [] ? ip_local_deliver+0x330/0x330 [ 1283.525020] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1283.525020] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.525020] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.525020] [] ? net_tx_action+0x9d0/0x9d0 [ 1283.525020] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.525020] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1283.525020] [] ? process_backlog+0x217/0x650 [ 1283.525020] [] __netif_receive_skb+0x5a/0x190 [ 1283.525020] [] process_backlog+0xd8/0x650 [ 1283.525020] [] ? process_backlog+0x217/0x650 [ 1283.525020] [] ? find_next_bit+0x15/0x20 [ 1283.525020] [] net_rx_action+0x655/0xde0 [ 1283.525020] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1283.525020] [] ? sk_busy_loop+0xb90/0xb90 [ 1283.525020] [] ? trace_hardirqs_off+0xd/0x10 [ 1283.525020] [] ? ktime_get+0x96/0x130 [ 1283.525020] [] ? clockevents_program_event+0x1cf/0x300 [ 1283.525020] [] ? irq_exit+0x15c/0x190 [ 1283.525020] [] __do_softirq+0x22c/0x99f [ 1283.525020] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1283.525020] [] irq_exit+0x15c/0x190 [ 1283.525020] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1283.525020] [] apic_timer_interrupt+0x89/0x90 [ 1283.525020] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1283.525020] [] finish_task_switch+0x1fa/0x5a0 [ 1283.525020] [] ? finish_task_switch+0x1ce/0x5a0 [ 1283.525020] [] __schedule+0x90c/0x1b60 [ 1283.525020] [] schedule+0x9c/0x1c0 [ 1283.525020] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1283.525020] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1283.525020] [] ? __hrtimer_init+0x170/0x170 [ 1283.525020] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1283.525020] [] schedule_hrtimeout_range+0x13/0x20 [ 1283.525020] [] poll_schedule_timeout+0xf4/0x1f0 [ 1283.525020] [] ? poll_freewait+0x220/0x220 [ 1283.525020] [] ? do_select+0x433/0x1390 [ 1283.525020] [] do_select+0xe16/0x1390 [ 1283.525020] [] ? do_select+0xb9/0x1390 [ 1283.525020] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.525020] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.525020] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1283.525020] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.525020] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1283.525020] [] ? print_context_stack+0x8b/0x100 [ 1283.525020] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.525020] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1283.525020] [] ? __lock_acquire+0xaa6/0x3a90 [ 1283.525020] [] ? dump_trace+0x113/0x2d0 [ 1283.525020] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.525020] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.525020] [] ? core_sys_select+0x170/0x690 [ 1283.525020] [] core_sys_select+0x3a6/0x690 [ 1283.525020] [] ? core_sys_select+0x75/0x690 [ 1283.525020] [] ? do_select+0x1390/0x1390 [ 1283.525020] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.525020] [] ? ktime_get_ts64+0x8c/0x220 [ 1283.525020] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1283.525020] [] ? trace_hardirqs_on+0xd/0x10 [ 1283.525020] [] ? ktime_get_ts64+0xc2/0x220 [ 1283.525020] [] ? poll_select_set_timeout+0x87/0xc0 [ 1283.525020] [] SyS_select+0x132/0x1a0 [ 1283.525020] [] ? core_sys_select+0x690/0x690 [ 1283.525020] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1283.525020] [] ? syscall_trace_enter+0x351/0x8e0 [ 1283.525020] [] ? core_sys_select+0x690/0x690 [ 1283.525020] [] do_syscall_64+0x196/0x440 [ 1283.525020] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1283.525020] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1283.525020] Memory state around the buggy address: [ 1283.525020] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.525020] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.525020] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.525020] ^ [ 1283.525020] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.525020] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.525020] ================================================================== [ 1283.634069] ================================================================== [ 1283.635060] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2bbc/0x2ce0 at addr ffff880389e56035 [ 1283.635060] Read of size 1 by task httpd/819 [ 1283.635060] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.635060] flags: 0x1000000000000000() [ 1283.635060] page dumped because: kasan: bad access detected [ 1283.635060] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1283.635060] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.635060] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1283.635060] ffff880389e56035 ffff8803aef073d0 ffffffff8151c33e ffff88038093b4f8 [ 1283.635060] ffff8803aef17d00 000000001ec00002 0000000000000282 ffffffff822e3d7b [ 1283.635060] Call Trace: [ 1283.635060] [] dump_stack+0x67/0x94 [ 1283.635060] [] kasan_report_error+0x4ae/0x4e0 [ 1283.635060] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1283.635060] [] ? mod_timer+0x56e/0xe30 [ 1283.635060] [] __asan_report_load1_noabort+0x43/0x50 [ 1283.635060] [] ? tcp_clean_rtx_queue+0x2bbc/0x2ce0 [ 1283.635060] [] tcp_clean_rtx_queue+0x2bbc/0x2ce0 [ 1283.635060] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1283.635060] [] tcp_ack+0x1487/0x2e60 [ 1283.635060] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.635060] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1283.635060] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.635060] [] tcp_rcv_established+0x58c/0x2de0 [ 1283.635060] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1283.635060] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1283.635060] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1283.635060] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1283.635060] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1283.635060] [] tcp_v4_rcv+0x213e/0x3420 [ 1283.635060] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1283.635060] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1283.635060] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1283.635060] [] ip_local_deliver+0x24d/0x330 [ 1283.635060] [] ? ip_call_ra_chain+0x510/0x510 [ 1283.635060] [] ? nf_hook_slow+0x186/0x2a0 [ 1283.635060] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1283.635060] [] ? nf_hook_slow+0x5/0x2a0 [ 1283.635060] [] ip_rcv_finish+0x599/0x1870 [ 1283.635060] [] ip_rcv+0x89b/0x11d0 [ 1283.635060] [] ? ip_local_deliver+0x330/0x330 [ 1283.635060] [] ? inet_del_offload+0x40/0x40 [ 1283.635060] [] ? ip_local_deliver+0x330/0x330 [ 1283.635060] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1283.635060] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.635060] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.635060] [] ? net_tx_action+0x9d0/0x9d0 [ 1283.635060] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.635060] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1283.635060] [] ? process_backlog+0x217/0x650 [ 1283.635060] [] __netif_receive_skb+0x5a/0x190 [ 1283.635060] [] process_backlog+0xd8/0x650 [ 1283.635060] [] ? process_backlog+0x217/0x650 [ 1283.635060] [] ? find_next_bit+0x15/0x20 [ 1283.635060] [] net_rx_action+0x655/0xde0 [ 1283.635060] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1283.635060] [] ? sk_busy_loop+0xb90/0xb90 [ 1283.635060] [] ? trace_hardirqs_off+0xd/0x10 [ 1283.635060] [] ? ktime_get+0x96/0x130 [ 1283.635060] [] ? clockevents_program_event+0x1cf/0x300 [ 1283.635060] [] ? irq_exit+0x15c/0x190 [ 1283.635060] [] __do_softirq+0x22c/0x99f [ 1283.635060] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1283.635060] [] irq_exit+0x15c/0x190 [ 1283.635060] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1283.635060] [] apic_timer_interrupt+0x89/0x90 [ 1283.635060] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1283.635060] [] finish_task_switch+0x1fa/0x5a0 [ 1283.635060] [] ? finish_task_switch+0x1ce/0x5a0 [ 1283.635060] [] __schedule+0x90c/0x1b60 [ 1283.635060] [] schedule+0x9c/0x1c0 [ 1283.635060] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1283.635060] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1283.635060] [] ? __hrtimer_init+0x170/0x170 [ 1283.635060] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1283.635060] [] schedule_hrtimeout_range+0x13/0x20 [ 1283.635060] [] poll_schedule_timeout+0xf4/0x1f0 [ 1283.635060] [] ? poll_freewait+0x220/0x220 [ 1283.635060] [] ? do_select+0x433/0x1390 [ 1283.635060] [] do_select+0xe16/0x1390 [ 1283.635060] [] ? do_select+0xb9/0x1390 [ 1283.635060] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.635060] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.635060] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1283.635060] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.635060] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1283.635060] [] ? print_context_stack+0x8b/0x100 [ 1283.635060] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.635060] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1283.635060] [] ? __lock_acquire+0xaa6/0x3a90 [ 1283.635060] [] ? dump_trace+0x113/0x2d0 [ 1283.635060] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.635060] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.635060] [] ? core_sys_select+0x170/0x690 [ 1283.635060] [] core_sys_select+0x3a6/0x690 [ 1283.635060] [] ? core_sys_select+0x75/0x690 [ 1283.635060] [] ? do_select+0x1390/0x1390 [ 1283.635060] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.635060] [] ? ktime_get_ts64+0x8c/0x220 [ 1283.635060] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1283.635060] [] ? trace_hardirqs_on+0xd/0x10 [ 1283.635060] [] ? ktime_get_ts64+0xc2/0x220 [ 1283.635060] [] ? poll_select_set_timeout+0x87/0xc0 [ 1283.635060] [] SyS_select+0x132/0x1a0 [ 1283.635060] [] ? core_sys_select+0x690/0x690 [ 1283.635060] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1283.635060] [] ? syscall_trace_enter+0x351/0x8e0 [ 1283.635060] [] ? core_sys_select+0x690/0x690 [ 1283.635060] [] do_syscall_64+0x196/0x440 [ 1283.635060] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1283.635060] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1283.635060] Memory state around the buggy address: [ 1283.635060] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.635060] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.635060] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.635060] ^ [ 1283.635060] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.635060] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.635060] ================================================================== [ 1283.754576] ================================================================== [ 1283.755568] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2a29/0x2ce0 at addr ffff880389e56037 [ 1283.755568] Read of size 1 by task httpd/819 [ 1283.755568] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.755568] flags: 0x1000000000000000() [ 1283.755568] page dumped because: kasan: bad access detected [ 1283.755568] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1283.755568] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.755568] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1283.755568] ffff880389e56037 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1283.755568] ffff880300000000 ffffed00713cac06 0000000000000282 ffffffff822e3d7b [ 1283.755568] Call Trace: [ 1283.755568] [] dump_stack+0x67/0x94 [ 1283.755568] [] kasan_report_error+0x4ae/0x4e0 [ 1283.755568] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1283.755568] [] __asan_report_load1_noabort+0x43/0x50 [ 1283.755568] [] ? tcp_clean_rtx_queue+0x2a29/0x2ce0 [ 1283.755568] [] tcp_clean_rtx_queue+0x2a29/0x2ce0 [ 1283.755568] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1283.755568] [] tcp_ack+0x1487/0x2e60 [ 1283.755568] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.755568] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1283.755568] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.755568] [] tcp_rcv_established+0x58c/0x2de0 [ 1283.755568] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1283.755568] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1283.755568] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1283.755568] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1283.755568] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1283.755568] [] tcp_v4_rcv+0x213e/0x3420 [ 1283.755568] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1283.755568] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1283.755568] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1283.755568] [] ip_local_deliver+0x24d/0x330 [ 1283.755568] [] ? ip_call_ra_chain+0x510/0x510 [ 1283.755568] [] ? nf_hook_slow+0x186/0x2a0 [ 1283.755568] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1283.755568] [] ? nf_hook_slow+0x5/0x2a0 [ 1283.755568] [] ip_rcv_finish+0x599/0x1870 [ 1283.755568] [] ip_rcv+0x89b/0x11d0 [ 1283.755568] [] ? ip_local_deliver+0x330/0x330 [ 1283.755568] [] ? inet_del_offload+0x40/0x40 [ 1283.755568] [] ? ip_local_deliver+0x330/0x330 [ 1283.755568] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1283.755568] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.755568] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.755568] [] ? net_tx_action+0x9d0/0x9d0 [ 1283.755568] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.755568] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1283.755568] [] ? process_backlog+0x217/0x650 [ 1283.755568] [] __netif_receive_skb+0x5a/0x190 [ 1283.755568] [] process_backlog+0xd8/0x650 [ 1283.755568] [] ? process_backlog+0x217/0x650 [ 1283.755568] [] ? find_next_bit+0x15/0x20 [ 1283.755568] [] net_rx_action+0x655/0xde0 [ 1283.755568] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1283.755568] [] ? sk_busy_loop+0xb90/0xb90 [ 1283.755568] [] ? trace_hardirqs_off+0xd/0x10 [ 1283.755568] [] ? ktime_get+0x96/0x130 [ 1283.755568] [] ? clockevents_program_event+0x1cf/0x300 [ 1283.755568] [] ? irq_exit+0x15c/0x190 [ 1283.755568] [] __do_softirq+0x22c/0x99f [ 1283.755568] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1283.755568] [] irq_exit+0x15c/0x190 [ 1283.755568] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1283.755568] [] apic_timer_interrupt+0x89/0x90 [ 1283.755568] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1283.755568] [] finish_task_switch+0x1fa/0x5a0 [ 1283.755568] [] ? finish_task_switch+0x1ce/0x5a0 [ 1283.755568] [] __schedule+0x90c/0x1b60 [ 1283.755568] [] schedule+0x9c/0x1c0 [ 1283.755568] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1283.755568] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1283.755568] [] ? __hrtimer_init+0x170/0x170 [ 1283.755568] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1283.755568] [] schedule_hrtimeout_range+0x13/0x20 [ 1283.755568] [] poll_schedule_timeout+0xf4/0x1f0 [ 1283.755568] [] ? poll_freewait+0x220/0x220 [ 1283.755568] [] ? do_select+0x433/0x1390 [ 1283.755568] [] do_select+0xe16/0x1390 [ 1283.755568] [] ? do_select+0xb9/0x1390 [ 1283.755568] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.755568] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.755568] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1283.755568] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.755568] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1283.755568] [] ? print_context_stack+0x8b/0x100 [ 1283.755568] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.755568] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1283.755568] [] ? __lock_acquire+0xaa6/0x3a90 [ 1283.755568] [] ? dump_trace+0x113/0x2d0 [ 1283.755568] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.755568] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.755568] [] ? core_sys_select+0x170/0x690 [ 1283.755568] [] core_sys_select+0x3a6/0x690 [ 1283.755568] [] ? core_sys_select+0x75/0x690 [ 1283.755568] [] ? do_select+0x1390/0x1390 [ 1283.755568] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.755568] [] ? ktime_get_ts64+0x8c/0x220 [ 1283.755568] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1283.755568] [] ? trace_hardirqs_on+0xd/0x10 [ 1283.755568] [] ? ktime_get_ts64+0xc2/0x220 [ 1283.755568] [] ? poll_select_set_timeout+0x87/0xc0 [ 1283.755568] [] SyS_select+0x132/0x1a0 [ 1283.755568] [] ? core_sys_select+0x690/0x690 [ 1283.755568] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1283.755568] [] ? syscall_trace_enter+0x351/0x8e0 [ 1283.755568] [] ? core_sys_select+0x690/0x690 [ 1283.755568] [] do_syscall_64+0x196/0x440 [ 1283.755568] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1283.755568] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1283.755568] Memory state around the buggy address: [ 1283.755568] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.755568] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.755568] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.755568] ^ [ 1283.755568] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.755568] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.755568] ================================================================== [ 1283.840584] ================================================================== [ 1283.841566] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2a60/0x2ce0 at addr ffff880389e5602c [ 1283.841570] Read of size 4 by task httpd/819 [ 1283.841570] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.841570] flags: 0x1000000000000000() [ 1283.841570] page dumped because: kasan: bad access detected [ 1283.841570] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1283.841570] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.841570] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1283.841570] ffff880389e5602c ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1283.841570] ffff880300000000 ffffed00713cac06 0000000000000282 ffffffff822e3d7b [ 1283.841570] Call Trace: [ 1283.841570] [] dump_stack+0x67/0x94 [ 1283.841570] [] kasan_report_error+0x4ae/0x4e0 [ 1283.841570] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1283.841570] [] __asan_report_load4_noabort+0x43/0x50 [ 1283.841570] [] ? tcp_clean_rtx_queue+0x2a60/0x2ce0 [ 1283.841570] [] tcp_clean_rtx_queue+0x2a60/0x2ce0 [ 1283.841570] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1283.841570] [] tcp_ack+0x1487/0x2e60 [ 1283.841570] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.841570] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1283.841570] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.841570] [] tcp_rcv_established+0x58c/0x2de0 [ 1283.841570] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1283.841570] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1283.841570] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1283.841570] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1283.841570] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1283.841570] [] tcp_v4_rcv+0x213e/0x3420 [ 1283.841570] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1283.841570] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1283.841570] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1283.841570] [] ip_local_deliver+0x24d/0x330 [ 1283.841570] [] ? ip_call_ra_chain+0x510/0x510 [ 1283.841570] [] ? nf_hook_slow+0x186/0x2a0 [ 1283.841570] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1283.841570] [] ? nf_hook_slow+0x5/0x2a0 [ 1283.841570] [] ip_rcv_finish+0x599/0x1870 [ 1283.841570] [] ip_rcv+0x89b/0x11d0 [ 1283.841570] [] ? ip_local_deliver+0x330/0x330 [ 1283.841570] [] ? inet_del_offload+0x40/0x40 [ 1283.841570] [] ? ip_local_deliver+0x330/0x330 [ 1283.841570] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1283.841570] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.841570] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.841570] [] ? net_tx_action+0x9d0/0x9d0 [ 1283.841570] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.841570] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1283.841570] [] ? process_backlog+0x217/0x650 [ 1283.841570] [] __netif_receive_skb+0x5a/0x190 [ 1283.841570] [] process_backlog+0xd8/0x650 [ 1283.841570] [] ? process_backlog+0x217/0x650 [ 1283.841570] [] ? find_next_bit+0x15/0x20 [ 1283.841570] [] net_rx_action+0x655/0xde0 [ 1283.841570] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1283.841570] [] ? sk_busy_loop+0xb90/0xb90 [ 1283.841570] [] ? trace_hardirqs_off+0xd/0x10 [ 1283.841570] [] ? ktime_get+0x96/0x130 [ 1283.841570] [] ? clockevents_program_event+0x1cf/0x300 [ 1283.841570] [] ? irq_exit+0x15c/0x190 [ 1283.841570] [] __do_softirq+0x22c/0x99f [ 1283.841570] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1283.841570] [] irq_exit+0x15c/0x190 [ 1283.841570] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1283.841570] [] apic_timer_interrupt+0x89/0x90 [ 1283.841570] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1283.841570] [] finish_task_switch+0x1fa/0x5a0 [ 1283.841570] [] ? finish_task_switch+0x1ce/0x5a0 [ 1283.841570] [] __schedule+0x90c/0x1b60 [ 1283.841570] [] schedule+0x9c/0x1c0 [ 1283.841570] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1283.841570] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1283.841570] [] ? __hrtimer_init+0x170/0x170 [ 1283.841570] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1283.841570] [] schedule_hrtimeout_range+0x13/0x20 [ 1283.841570] [] poll_schedule_timeout+0xf4/0x1f0 [ 1283.841570] [] ? poll_freewait+0x220/0x220 [ 1283.841570] [] ? do_select+0x433/0x1390 [ 1283.841570] [] do_select+0xe16/0x1390 [ 1283.841570] [] ? do_select+0xb9/0x1390 [ 1283.841570] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.841570] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.841570] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1283.841570] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.841570] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1283.841570] [] ? print_context_stack+0x8b/0x100 [ 1283.841570] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.841570] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1283.841570] [] ? __lock_acquire+0xaa6/0x3a90 [ 1283.841570] [] ? dump_trace+0x113/0x2d0 [ 1283.841570] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.841570] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.841570] [] ? core_sys_select+0x170/0x690 [ 1283.841570] [] core_sys_select+0x3a6/0x690 [ 1283.841570] [] ? core_sys_select+0x75/0x690 [ 1283.841570] [] ? do_select+0x1390/0x1390 [ 1283.841570] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.841570] [] ? ktime_get_ts64+0x8c/0x220 [ 1283.841570] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1283.841570] [] ? trace_hardirqs_on+0xd/0x10 [ 1283.841570] [] ? ktime_get_ts64+0xc2/0x220 [ 1283.841570] [] ? poll_select_set_timeout+0x87/0xc0 [ 1283.841570] [] SyS_select+0x132/0x1a0 [ 1283.841570] [] ? core_sys_select+0x690/0x690 [ 1283.841570] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1283.841570] [] ? syscall_trace_enter+0x351/0x8e0 [ 1283.841570] [] ? core_sys_select+0x690/0x690 [ 1283.841570] [] do_syscall_64+0x196/0x440 [ 1283.841570] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1283.841570] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1283.841570] Memory state around the buggy address: [ 1283.841570] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.841570] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.841570] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.841570] ^ [ 1283.841570] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.841570] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.841570] ================================================================== [ 1283.936855] ================================================================== [ 1283.937848] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2c13/0x2ce0 at addr ffff880389e56000 [ 1283.937848] Read of size 8 by task httpd/819 [ 1283.937848] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1283.937848] flags: 0x1000000000000000() [ 1283.937848] page dumped because: kasan: bad access detected [ 1283.937848] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1283.937848] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1283.937848] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1283.937848] ffff880389e56000 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1283.937848] ffff880300000000 ffffed00713cac05 0000000000000282 ffffffff822e3d7b [ 1283.937848] Call Trace: [ 1283.937848] [] dump_stack+0x67/0x94 [ 1283.937848] [] kasan_report_error+0x4ae/0x4e0 [ 1283.937848] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1283.937848] [] __asan_report_load8_noabort+0x43/0x50 [ 1283.937848] [] ? tcp_clean_rtx_queue+0x2c13/0x2ce0 [ 1283.937848] [] tcp_clean_rtx_queue+0x2c13/0x2ce0 [ 1283.937848] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1283.937848] [] tcp_ack+0x1487/0x2e60 [ 1283.937848] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.937848] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1283.937848] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.937848] [] tcp_rcv_established+0x58c/0x2de0 [ 1283.937848] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1283.937848] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1283.937848] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1283.937848] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1283.937848] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1283.937848] [] tcp_v4_rcv+0x213e/0x3420 [ 1283.937848] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1283.937848] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1283.937848] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1283.937848] [] ip_local_deliver+0x24d/0x330 [ 1283.937848] [] ? ip_call_ra_chain+0x510/0x510 [ 1283.937848] [] ? nf_hook_slow+0x186/0x2a0 [ 1283.937848] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1283.937848] [] ? nf_hook_slow+0x5/0x2a0 [ 1283.937848] [] ip_rcv_finish+0x599/0x1870 [ 1283.937848] [] ip_rcv+0x89b/0x11d0 [ 1283.937848] [] ? ip_local_deliver+0x330/0x330 [ 1283.937848] [] ? inet_del_offload+0x40/0x40 [ 1283.937848] [] ? ip_local_deliver+0x330/0x330 [ 1283.937848] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1283.937848] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.937848] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.937848] [] ? net_tx_action+0x9d0/0x9d0 [ 1283.937848] [] ? default_send_IPI_single+0x75/0xa0 [ 1283.937848] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1283.937848] [] ? process_backlog+0x217/0x650 [ 1283.937848] [] __netif_receive_skb+0x5a/0x190 [ 1283.937848] [] process_backlog+0xd8/0x650 [ 1283.937848] [] ? process_backlog+0x217/0x650 [ 1283.937848] [] ? find_next_bit+0x15/0x20 [ 1283.937848] [] net_rx_action+0x655/0xde0 [ 1283.937848] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1283.937848] [] ? sk_busy_loop+0xb90/0xb90 [ 1283.937848] [] ? trace_hardirqs_off+0xd/0x10 [ 1283.937848] [] ? ktime_get+0x96/0x130 [ 1283.937848] [] ? clockevents_program_event+0x1cf/0x300 [ 1283.937848] [] ? irq_exit+0x15c/0x190 [ 1283.937848] [] __do_softirq+0x22c/0x99f [ 1283.937848] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1283.937848] [] irq_exit+0x15c/0x190 [ 1283.937848] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1283.937848] [] apic_timer_interrupt+0x89/0x90 [ 1283.937848] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1283.937848] [] finish_task_switch+0x1fa/0x5a0 [ 1283.937848] [] ? finish_task_switch+0x1ce/0x5a0 [ 1283.937848] [] __schedule+0x90c/0x1b60 [ 1283.937848] [] schedule+0x9c/0x1c0 [ 1283.937848] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1283.937848] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1283.937848] [] ? __hrtimer_init+0x170/0x170 [ 1283.937848] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1283.937848] [] schedule_hrtimeout_range+0x13/0x20 [ 1283.937848] [] poll_schedule_timeout+0xf4/0x1f0 [ 1283.937848] [] ? poll_freewait+0x220/0x220 [ 1283.937848] [] ? do_select+0x433/0x1390 [ 1283.937848] [] do_select+0xe16/0x1390 [ 1283.937848] [] ? do_select+0xb9/0x1390 [ 1283.937848] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.937848] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1283.937848] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1283.937848] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.937848] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1283.937848] [] ? print_context_stack+0x8b/0x100 [ 1283.937848] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.937848] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1283.937848] [] ? __lock_acquire+0xaa6/0x3a90 [ 1283.937848] [] ? dump_trace+0x113/0x2d0 [ 1283.937848] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1283.937848] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.937848] [] ? core_sys_select+0x170/0x690 [ 1283.937848] [] core_sys_select+0x3a6/0x690 [ 1283.937848] [] ? core_sys_select+0x75/0x690 [ 1283.937848] [] ? do_select+0x1390/0x1390 [ 1283.937848] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1283.937848] [] ? ktime_get_ts64+0x8c/0x220 [ 1283.937848] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1283.937848] [] ? trace_hardirqs_on+0xd/0x10 [ 1283.937848] [] ? ktime_get_ts64+0xc2/0x220 [ 1283.937848] [] ? poll_select_set_timeout+0x87/0xc0 [ 1283.937848] [] SyS_select+0x132/0x1a0 [ 1283.937848] [] ? core_sys_select+0x690/0x690 [ 1283.937848] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1283.937848] [] ? syscall_trace_enter+0x351/0x8e0 [ 1283.937848] [] ? core_sys_select+0x690/0x690 [ 1283.937848] [] do_syscall_64+0x196/0x440 [ 1283.937848] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1283.937848] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1283.937848] Memory state around the buggy address: [ 1283.937848] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.937848] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1283.937848] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.937848] ^ [ 1283.937848] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.937848] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1283.937848] ================================================================== [ 1284.030233] ================================================================== [ 1284.031225] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1bf1/0x2ce0 at addr ffff880389e56030 [ 1284.031225] Read of size 2 by task httpd/819 [ 1284.031225] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.031225] flags: 0x1000000000000000() [ 1284.031225] page dumped because: kasan: bad access detected [ 1284.031225] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.031225] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.031225] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.031225] ffff880389e56030 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.031225] ffff880300000000 ffffed00713cac00 0000000000000282 ffffffff822e3d7b [ 1284.031225] Call Trace: [ 1284.031225] [] dump_stack+0x67/0x94 [ 1284.031225] [] kasan_report_error+0x4ae/0x4e0 [ 1284.031225] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1284.031225] [] __asan_report_load2_noabort+0x43/0x50 [ 1284.031225] [] ? tcp_clean_rtx_queue+0x1bf1/0x2ce0 [ 1284.031225] [] tcp_clean_rtx_queue+0x1bf1/0x2ce0 [ 1284.031225] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.031225] [] tcp_ack+0x1487/0x2e60 [ 1284.031225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.031225] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.031225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.031225] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.031225] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.031225] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.031225] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.031225] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.031225] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.031225] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.031225] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.031225] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.031225] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.031225] [] ip_local_deliver+0x24d/0x330 [ 1284.031225] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.031225] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.031225] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.031225] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.031225] [] ip_rcv_finish+0x599/0x1870 [ 1284.031225] [] ip_rcv+0x89b/0x11d0 [ 1284.031225] [] ? ip_local_deliver+0x330/0x330 [ 1284.031225] [] ? inet_del_offload+0x40/0x40 [ 1284.031225] [] ? ip_local_deliver+0x330/0x330 [ 1284.031225] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.031225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.031225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.031225] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.031225] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.031225] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.031225] [] ? process_backlog+0x217/0x650 [ 1284.031225] [] __netif_receive_skb+0x5a/0x190 [ 1284.031225] [] process_backlog+0xd8/0x650 [ 1284.031225] [] ? process_backlog+0x217/0x650 [ 1284.031225] [] ? find_next_bit+0x15/0x20 [ 1284.031225] [] net_rx_action+0x655/0xde0 [ 1284.031225] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.031225] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.031225] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.031225] [] ? ktime_get+0x96/0x130 [ 1284.031225] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.031225] [] ? irq_exit+0x15c/0x190 [ 1284.031225] [] __do_softirq+0x22c/0x99f [ 1284.031225] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.031225] [] irq_exit+0x15c/0x190 [ 1284.031225] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.031225] [] apic_timer_interrupt+0x89/0x90 [ 1284.031225] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.031225] [] finish_task_switch+0x1fa/0x5a0 [ 1284.031225] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.031225] [] __schedule+0x90c/0x1b60 [ 1284.031225] [] schedule+0x9c/0x1c0 [ 1284.031225] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.031225] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.031225] [] ? __hrtimer_init+0x170/0x170 [ 1284.031225] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.031225] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.031225] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.031225] [] ? poll_freewait+0x220/0x220 [ 1284.031225] [] ? do_select+0x433/0x1390 [ 1284.031225] [] do_select+0xe16/0x1390 [ 1284.031225] [] ? do_select+0xb9/0x1390 [ 1284.031225] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.031225] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.031225] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.031225] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.031225] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.031225] [] ? print_context_stack+0x8b/0x100 [ 1284.031225] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.031225] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.031225] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.031225] [] ? dump_trace+0x113/0x2d0 [ 1284.031225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.031225] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.031225] [] ? core_sys_select+0x170/0x690 [ 1284.031225] [] core_sys_select+0x3a6/0x690 [ 1284.031225] [] ? core_sys_select+0x75/0x690 [ 1284.031225] [] ? do_select+0x1390/0x1390 [ 1284.031225] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.031225] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.031225] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.031225] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.031225] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.031225] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.031225] [] SyS_select+0x132/0x1a0 [ 1284.031225] [] ? core_sys_select+0x690/0x690 [ 1284.031225] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.031225] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.031225] [] ? core_sys_select+0x690/0x690 [ 1284.031225] [] do_syscall_64+0x196/0x440 [ 1284.031225] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.031225] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.031225] Memory state around the buggy address: [ 1284.031225] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.031225] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.031225] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.031225] ^ [ 1284.031225] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.031225] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.031225] ================================================================== [ 1284.122384] ================================================================== [ 1284.123376] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1ebd/0x2ce0 at addr ffff880389e56035 [ 1284.123376] Read of size 1 by task httpd/819 [ 1284.123376] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.123376] flags: 0x1000000000000000() [ 1284.123376] page dumped because: kasan: bad access detected [ 1284.123376] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.123376] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.123376] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.123376] ffff880389e56035 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.123376] ffff880300000000 ffffed00713cac06 0000000000000282 ffffffff822e3d7b [ 1284.123376] Call Trace: [ 1284.123376] [] dump_stack+0x67/0x94 [ 1284.123376] [] kasan_report_error+0x4ae/0x4e0 [ 1284.123376] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1284.123376] [] __asan_report_load1_noabort+0x43/0x50 [ 1284.123376] [] ? tcp_clean_rtx_queue+0x1ebd/0x2ce0 [ 1284.123376] [] tcp_clean_rtx_queue+0x1ebd/0x2ce0 [ 1284.123376] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.123376] [] tcp_ack+0x1487/0x2e60 [ 1284.123376] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.123376] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.123376] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.123376] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.123376] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.123376] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.123376] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.123376] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.123376] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.123376] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.123376] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.123376] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.123376] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.123376] [] ip_local_deliver+0x24d/0x330 [ 1284.123376] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.123376] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.123376] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.123376] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.123376] [] ip_rcv_finish+0x599/0x1870 [ 1284.123376] [] ip_rcv+0x89b/0x11d0 [ 1284.123376] [] ? ip_local_deliver+0x330/0x330 [ 1284.123376] [] ? inet_del_offload+0x40/0x40 [ 1284.123376] [] ? ip_local_deliver+0x330/0x330 [ 1284.123376] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.123376] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.123376] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.123376] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.123376] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.123376] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.123376] [] ? process_backlog+0x217/0x650 [ 1284.123376] [] __netif_receive_skb+0x5a/0x190 [ 1284.123376] [] process_backlog+0xd8/0x650 [ 1284.123376] [] ? process_backlog+0x217/0x650 [ 1284.123376] [] ? find_next_bit+0x15/0x20 [ 1284.123376] [] net_rx_action+0x655/0xde0 [ 1284.123376] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.123376] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.123376] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.123376] [] ? ktime_get+0x96/0x130 [ 1284.123376] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.123376] [] ? irq_exit+0x15c/0x190 [ 1284.123376] [] __do_softirq+0x22c/0x99f [ 1284.123376] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.123376] [] irq_exit+0x15c/0x190 [ 1284.123376] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.123376] [] apic_timer_interrupt+0x89/0x90 [ 1284.123376] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.123376] [] finish_task_switch+0x1fa/0x5a0 [ 1284.123376] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.123376] [] __schedule+0x90c/0x1b60 [ 1284.123376] [] schedule+0x9c/0x1c0 [ 1284.123376] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.123376] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.123376] [] ? __hrtimer_init+0x170/0x170 [ 1284.123376] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.123376] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.123376] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.123376] [] ? poll_freewait+0x220/0x220 [ 1284.123376] [] ? do_select+0x433/0x1390 [ 1284.123376] [] do_select+0xe16/0x1390 [ 1284.123376] [] ? do_select+0xb9/0x1390 [ 1284.123376] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.123376] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.123376] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.123376] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.123376] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.123376] [] ? print_context_stack+0x8b/0x100 [ 1284.123376] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.123376] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.123376] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.123376] [] ? dump_trace+0x113/0x2d0 [ 1284.123376] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.123376] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.123376] [] ? core_sys_select+0x170/0x690 [ 1284.123376] [] core_sys_select+0x3a6/0x690 [ 1284.123376] [] ? core_sys_select+0x75/0x690 [ 1284.123376] [] ? do_select+0x1390/0x1390 [ 1284.123376] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.123376] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.123376] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.123376] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.123376] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.123376] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.123376] [] SyS_select+0x132/0x1a0 [ 1284.123376] [] ? core_sys_select+0x690/0x690 [ 1284.123376] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.123376] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.123376] [] ? core_sys_select+0x690/0x690 [ 1284.123376] [] do_syscall_64+0x196/0x440 [ 1284.123376] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.123376] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.123376] Memory state around the buggy address: [ 1284.123376] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.123376] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.123376] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.123376] ^ [ 1284.123376] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.123376] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.123376] ================================================================== [ 1284.205676] ================================================================== [ 1284.206660] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2803/0x2ce0 at addr ffff880389e56014 [ 1284.206668] Read of size 4 by task httpd/819 [ 1284.206668] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.206668] flags: 0x1000000000000000() [ 1284.206668] page dumped because: kasan: bad access detected [ 1284.206668] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.206668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.206668] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.206668] ffff880389e56014 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.206668] ffff880300000000 ffffed00713cac06 0000000000000282 ffffffff822e3d7b [ 1284.206668] Call Trace: [ 1284.206668] [] dump_stack+0x67/0x94 [ 1284.206668] [] kasan_report_error+0x4ae/0x4e0 [ 1284.206668] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 1284.206668] [] __asan_report_load4_noabort+0x43/0x50 [ 1284.206668] [] ? tcp_clean_rtx_queue+0x2803/0x2ce0 [ 1284.206668] [] tcp_clean_rtx_queue+0x2803/0x2ce0 [ 1284.206668] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.206668] [] tcp_ack+0x1487/0x2e60 [ 1284.206668] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.206668] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.206668] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.206668] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.206668] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.206668] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.206668] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.206668] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.206668] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.206668] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.206668] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.206668] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.206668] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.206668] [] ip_local_deliver+0x24d/0x330 [ 1284.206668] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.206668] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.206668] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.206668] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.206668] [] ip_rcv_finish+0x599/0x1870 [ 1284.206668] [] ip_rcv+0x89b/0x11d0 [ 1284.206668] [] ? ip_local_deliver+0x330/0x330 [ 1284.206668] [] ? inet_del_offload+0x40/0x40 [ 1284.206668] [] ? ip_local_deliver+0x330/0x330 [ 1284.206668] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.206668] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.206668] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.206668] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.206668] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.206668] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.206668] [] ? process_backlog+0x217/0x650 [ 1284.206668] [] __netif_receive_skb+0x5a/0x190 [ 1284.206668] [] process_backlog+0xd8/0x650 [ 1284.206668] [] ? process_backlog+0x217/0x650 [ 1284.206668] [] ? find_next_bit+0x15/0x20 [ 1284.206668] [] net_rx_action+0x655/0xde0 [ 1284.206668] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.206668] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.206668] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.206668] [] ? ktime_get+0x96/0x130 [ 1284.206668] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.206668] [] ? irq_exit+0x15c/0x190 [ 1284.206668] [] __do_softirq+0x22c/0x99f [ 1284.206668] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.206668] [] irq_exit+0x15c/0x190 [ 1284.206668] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.206668] [] apic_timer_interrupt+0x89/0x90 [ 1284.206668] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.206668] [] finish_task_switch+0x1fa/0x5a0 [ 1284.206668] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.206668] [] __schedule+0x90c/0x1b60 [ 1284.206668] [] schedule+0x9c/0x1c0 [ 1284.206668] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.206668] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.206668] [] ? __hrtimer_init+0x170/0x170 [ 1284.206668] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.206668] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.206668] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.206668] [] ? poll_freewait+0x220/0x220 [ 1284.206668] [] ? do_select+0x433/0x1390 [ 1284.206668] [] do_select+0xe16/0x1390 [ 1284.206668] [] ? do_select+0xb9/0x1390 [ 1284.206668] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.206668] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.206668] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.206668] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.206668] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.206668] [] ? print_context_stack+0x8b/0x100 [ 1284.206668] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.206668] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.206668] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.206668] [] ? dump_trace+0x113/0x2d0 [ 1284.206668] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.206668] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.206668] [] ? core_sys_select+0x170/0x690 [ 1284.206668] [] core_sys_select+0x3a6/0x690 [ 1284.206668] [] ? core_sys_select+0x75/0x690 [ 1284.206668] [] ? do_select+0x1390/0x1390 [ 1284.206668] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.206668] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.206668] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.206668] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.206668] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.206668] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.206668] [] SyS_select+0x132/0x1a0 [ 1284.206668] [] ? core_sys_select+0x690/0x690 [ 1284.206668] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.206668] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.206668] [] ? core_sys_select+0x690/0x690 [ 1284.206668] [] do_syscall_64+0x196/0x440 [ 1284.206668] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.206668] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.206668] Memory state around the buggy address: [ 1284.206668] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.206668] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.206668] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.206668] ^ [ 1284.206668] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.206668] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.206668] ================================================================== [ 1284.296090] ================================================================== [ 1284.297075] BUG: KASAN: use-after-free in tcp_rack_advance+0x2c3/0x3a0 at addr ffff880389e56014 [ 1284.297082] Read of size 4 by task httpd/819 [ 1284.297082] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.297082] flags: 0x1000000000000000() [ 1284.297082] page dumped because: kasan: bad access detected [ 1284.297082] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.297082] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.297082] ffff88038093b748 ffff8803aef07310 ffffffff8199f263 ffff8803aef073a0 [ 1284.297082] ffff880389e56014 ffff8803aef07390 ffffffff8151c33e 0000000000000282 [ 1284.297082] ffff8803aef07378 ffffed00713cac30 0000000000000282 ffffffff8151be77 [ 1284.297082] Call Trace: [ 1284.297082] [] dump_stack+0x67/0x94 [ 1284.297082] [] kasan_report_error+0x4ae/0x4e0 [ 1284.297082] [] ? kasan_end_report+0x37/0x50 [ 1284.297082] [] ? kasan_report_error+0x42d/0x4e0 [ 1284.297082] [] __asan_report_load4_noabort+0x43/0x50 [ 1284.297082] [] ? tcp_rack_advance+0x2c3/0x3a0 [ 1284.297082] [] tcp_rack_advance+0x2c3/0x3a0 [ 1284.297082] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 1284.297082] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.297082] [] tcp_ack+0x1487/0x2e60 [ 1284.297082] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.297082] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.297082] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.297082] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.297082] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.297082] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.297082] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.297082] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.297082] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.297082] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.297082] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.297082] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.297082] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.297082] [] ip_local_deliver+0x24d/0x330 [ 1284.297082] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.297082] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.297082] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.297082] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.297082] [] ip_rcv_finish+0x599/0x1870 [ 1284.297082] [] ip_rcv+0x89b/0x11d0 [ 1284.297082] [] ? ip_local_deliver+0x330/0x330 [ 1284.297082] [] ? inet_del_offload+0x40/0x40 [ 1284.297082] [] ? ip_local_deliver+0x330/0x330 [ 1284.297082] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.297082] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.297082] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.297082] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.297082] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.297082] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.297082] [] ? process_backlog+0x217/0x650 [ 1284.297082] [] __netif_receive_skb+0x5a/0x190 [ 1284.297082] [] process_backlog+0xd8/0x650 [ 1284.297082] [] ? process_backlog+0x217/0x650 [ 1284.297082] [] ? find_next_bit+0x15/0x20 [ 1284.297082] [] net_rx_action+0x655/0xde0 [ 1284.297082] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.297082] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.297082] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.297082] [] ? ktime_get+0x96/0x130 [ 1284.297082] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.297082] [] ? irq_exit+0x15c/0x190 [ 1284.297082] [] __do_softirq+0x22c/0x99f [ 1284.297082] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.297082] [] irq_exit+0x15c/0x190 [ 1284.297082] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.297082] [] apic_timer_interrupt+0x89/0x90 [ 1284.297082] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.297082] [] finish_task_switch+0x1fa/0x5a0 [ 1284.297082] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.297082] [] __schedule+0x90c/0x1b60 [ 1284.297082] [] schedule+0x9c/0x1c0 [ 1284.297082] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.297082] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.297082] [] ? __hrtimer_init+0x170/0x170 [ 1284.297082] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.297082] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.297082] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.297082] [] ? poll_freewait+0x220/0x220 [ 1284.297082] [] ? do_select+0x433/0x1390 [ 1284.297082] [] do_select+0xe16/0x1390 [ 1284.297082] [] ? do_select+0xb9/0x1390 [ 1284.297082] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.297082] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.297082] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.297082] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.297082] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.297082] [] ? print_context_stack+0x8b/0x100 [ 1284.297082] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.297082] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.297082] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.297082] [] ? dump_trace+0x113/0x2d0 [ 1284.297082] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.297082] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.297082] [] ? core_sys_select+0x170/0x690 [ 1284.297082] [] core_sys_select+0x3a6/0x690 [ 1284.297082] [] ? core_sys_select+0x75/0x690 [ 1284.297082] [] ? do_select+0x1390/0x1390 [ 1284.297082] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.297082] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.297082] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.297082] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.297082] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.297082] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.297082] [] SyS_select+0x132/0x1a0 [ 1284.297082] [] ? core_sys_select+0x690/0x690 [ 1284.297082] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.297082] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.297082] [] ? core_sys_select+0x690/0x690 [ 1284.297082] [] do_syscall_64+0x196/0x440 [ 1284.297082] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.297082] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.297082] Memory state around the buggy address: [ 1284.297082] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.297082] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.297082] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.297082] ^ [ 1284.297082] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.297082] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.297082] ================================================================== [ 1284.389100] ================================================================== [ 1284.390093] BUG: KASAN: use-after-free in tcp_rack_advance+0x311/0x3a0 at addr ffff880389e56010 [ 1284.390093] Read of size 4 by task httpd/819 [ 1284.390093] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.390093] flags: 0x1000000000000000() [ 1284.390093] page dumped because: kasan: bad access detected [ 1284.390093] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.390093] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.390093] ffff88038093b748 ffff8803aef07310 ffffffff8199f263 ffff8803aef073a0 [ 1284.390093] ffff880389e56010 ffff8803aef07390 ffffffff8151c33e ffffed0075de43b8 [ 1284.390093] ffff8803aef07378 ffffffff811af0c3 0000000000000282 ffffffff8151be77 [ 1284.390093] Call Trace: [ 1284.390093] [] dump_stack+0x67/0x94 [ 1284.390093] [] kasan_report_error+0x4ae/0x4e0 [ 1284.390093] [] ? sched_clock_local+0x43/0x120 [ 1284.390093] [] ? kasan_end_report+0x37/0x50 [ 1284.390093] [] __asan_report_load4_noabort+0x43/0x50 [ 1284.390093] [] ? tcp_rack_advance+0x311/0x3a0 [ 1284.390093] [] tcp_rack_advance+0x311/0x3a0 [ 1284.390093] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 1284.390093] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.390093] [] tcp_ack+0x1487/0x2e60 [ 1284.390093] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.390093] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.390093] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.390093] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.390093] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.390093] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.390093] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.390093] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.390093] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.390093] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.390093] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.390093] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.390093] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.390093] [] ip_local_deliver+0x24d/0x330 [ 1284.390093] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.390093] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.390093] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.390093] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.390093] [] ip_rcv_finish+0x599/0x1870 [ 1284.390093] [] ip_rcv+0x89b/0x11d0 [ 1284.390093] [] ? ip_local_deliver+0x330/0x330 [ 1284.390093] [] ? inet_del_offload+0x40/0x40 [ 1284.390093] [] ? ip_local_deliver+0x330/0x330 [ 1284.390093] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.390093] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.390093] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.390093] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.390093] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.390093] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.390093] [] ? process_backlog+0x217/0x650 [ 1284.390093] [] __netif_receive_skb+0x5a/0x190 [ 1284.390093] [] process_backlog+0xd8/0x650 [ 1284.390093] [] ? process_backlog+0x217/0x650 [ 1284.390093] [] ? find_next_bit+0x15/0x20 [ 1284.390093] [] net_rx_action+0x655/0xde0 [ 1284.390093] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.390093] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.390093] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.390093] [] ? ktime_get+0x96/0x130 [ 1284.390093] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.390093] [] ? irq_exit+0x15c/0x190 [ 1284.390093] [] __do_softirq+0x22c/0x99f [ 1284.390093] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.390093] [] irq_exit+0x15c/0x190 [ 1284.390093] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.390093] [] apic_timer_interrupt+0x89/0x90 [ 1284.390093] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.390093] [] finish_task_switch+0x1fa/0x5a0 [ 1284.390093] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.390093] [] __schedule+0x90c/0x1b60 [ 1284.390093] [] schedule+0x9c/0x1c0 [ 1284.390093] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.390093] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.390093] [] ? __hrtimer_init+0x170/0x170 [ 1284.390093] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.390093] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.390093] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.390093] [] ? poll_freewait+0x220/0x220 [ 1284.390093] [] ? do_select+0x433/0x1390 [ 1284.390093] [] do_select+0xe16/0x1390 [ 1284.390093] [] ? do_select+0xb9/0x1390 [ 1284.390093] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.390093] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.390093] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.390093] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.390093] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.390093] [] ? print_context_stack+0x8b/0x100 [ 1284.390093] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.390093] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.390093] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.390093] [] ? dump_trace+0x113/0x2d0 [ 1284.390093] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.390093] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.390093] [] ? core_sys_select+0x170/0x690 [ 1284.390093] [] core_sys_select+0x3a6/0x690 [ 1284.390093] [] ? core_sys_select+0x75/0x690 [ 1284.390093] [] ? do_select+0x1390/0x1390 [ 1284.390093] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.390093] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.390093] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.390093] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.390093] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.390093] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.390093] [] SyS_select+0x132/0x1a0 [ 1284.390093] [] ? core_sys_select+0x690/0x690 [ 1284.390093] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.390093] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.390093] [] ? core_sys_select+0x690/0x690 [ 1284.390093] [] do_syscall_64+0x196/0x440 [ 1284.390093] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.390093] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.390093] Memory state around the buggy address: [ 1284.390093] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.390093] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.390093] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.390093] ^ [ 1284.390093] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.390093] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.390093] ================================================================== [ 1284.482409] ================================================================== [ 1284.483397] BUG: KASAN: use-after-free in tcp_rack_advance+0x326/0x3a0 at addr ffff880389e56014 [ 1284.483397] Read of size 4 by task httpd/819 [ 1284.483397] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.483397] flags: 0x1000000000000000() [ 1284.483397] page dumped because: kasan: bad access detected [ 1284.483397] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.483397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.483397] ffff88038093b748 ffff8803aef07310 ffffffff8199f263 ffff8803aef073a0 [ 1284.483397] ffff880389e56014 ffff8803aef07390 ffffffff8151c33e 0000000000000010 [ 1284.483397] ffff880300000000 ffffed00713cac02 0000000000000282 ffffffff8151be77 [ 1284.483397] Call Trace: [ 1284.483397] [] dump_stack+0x67/0x94 [ 1284.483397] [] kasan_report_error+0x4ae/0x4e0 [ 1284.483397] [] ? kasan_end_report+0x37/0x50 [ 1284.483397] [] __asan_report_load4_noabort+0x43/0x50 [ 1284.483397] [] ? tcp_rack_advance+0x326/0x3a0 [ 1284.483397] [] tcp_rack_advance+0x326/0x3a0 [ 1284.483397] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 1284.483397] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.483397] [] tcp_ack+0x1487/0x2e60 [ 1284.483397] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.483397] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.483397] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.483397] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.483397] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.483397] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.483397] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.483397] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.483397] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.483397] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.483397] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.483397] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.483397] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.483397] [] ip_local_deliver+0x24d/0x330 [ 1284.483397] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.483397] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.483397] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.483397] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.483397] [] ip_rcv_finish+0x599/0x1870 [ 1284.483397] [] ip_rcv+0x89b/0x11d0 [ 1284.483397] [] ? ip_local_deliver+0x330/0x330 [ 1284.483397] [] ? inet_del_offload+0x40/0x40 [ 1284.483397] [] ? ip_local_deliver+0x330/0x330 [ 1284.483397] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.483397] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.483397] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.483397] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.483397] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.483397] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.483397] [] ? process_backlog+0x217/0x650 [ 1284.483397] [] __netif_receive_skb+0x5a/0x190 [ 1284.483397] [] process_backlog+0xd8/0x650 [ 1284.483397] [] ? process_backlog+0x217/0x650 [ 1284.483397] [] ? find_next_bit+0x15/0x20 [ 1284.483397] [] net_rx_action+0x655/0xde0 [ 1284.483397] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.483397] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.483397] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.483397] [] ? ktime_get+0x96/0x130 [ 1284.483397] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.483397] [] ? irq_exit+0x15c/0x190 [ 1284.483397] [] __do_softirq+0x22c/0x99f [ 1284.483397] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.483397] [] irq_exit+0x15c/0x190 [ 1284.483397] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.483397] [] apic_timer_interrupt+0x89/0x90 [ 1284.483397] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.483397] [] finish_task_switch+0x1fa/0x5a0 [ 1284.483397] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.483397] [] __schedule+0x90c/0x1b60 [ 1284.483397] [] schedule+0x9c/0x1c0 [ 1284.483397] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.483397] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.483397] [] ? __hrtimer_init+0x170/0x170 [ 1284.483397] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.483397] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.483397] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.483397] [] ? poll_freewait+0x220/0x220 [ 1284.483397] [] ? do_select+0x433/0x1390 [ 1284.483397] [] do_select+0xe16/0x1390 [ 1284.483397] [] ? do_select+0xb9/0x1390 [ 1284.483397] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.483397] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.483397] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.483397] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.483397] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.483397] [] ? print_context_stack+0x8b/0x100 [ 1284.483397] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.483397] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.483397] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.483397] [] ? dump_trace+0x113/0x2d0 [ 1284.483397] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.483397] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.483397] [] ? core_sys_select+0x170/0x690 [ 1284.483397] [] core_sys_select+0x3a6/0x690 [ 1284.483397] [] ? core_sys_select+0x75/0x690 [ 1284.483397] [] ? do_select+0x1390/0x1390 [ 1284.483397] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.483397] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.483397] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.483397] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.483397] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.483397] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.483397] [] SyS_select+0x132/0x1a0 [ 1284.483397] [] ? core_sys_select+0x690/0x690 [ 1284.483397] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.483397] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.483397] [] ? core_sys_select+0x690/0x690 [ 1284.483397] [] do_syscall_64+0x196/0x440 [ 1284.483397] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.483397] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.483397] Memory state around the buggy address: [ 1284.483397] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.483397] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.483397] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.483397] ^ [ 1284.483397] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.483397] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.483397] ================================================================== [ 1284.568640] ================================================================== [ 1284.569632] BUG: KASAN: use-after-free in tcp_rack_advance+0x356/0x3a0 at addr ffff880389e56010 [ 1284.569632] Read of size 8 by task httpd/819 [ 1284.569632] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.569632] flags: 0x1000000000000000() [ 1284.569632] page dumped because: kasan: bad access detected [ 1284.569632] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.569632] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.569632] ffff88038093b748 ffff8803aef07310 ffffffff8199f263 ffff8803aef073a0 [ 1284.569632] ffff880389e56010 ffff8803aef07390 ffffffff8151c33e 0000000000000010 [ 1284.569632] ffff880300000000 ffffed00713cac02 0000000000000282 ffffffff8151be77 [ 1284.569632] Call Trace: [ 1284.569632] [] dump_stack+0x67/0x94 [ 1284.569632] [] kasan_report_error+0x4ae/0x4e0 [ 1284.569632] [] ? kasan_end_report+0x37/0x50 [ 1284.569632] [] __asan_report_load8_noabort+0x43/0x50 [ 1284.569632] [] ? tcp_rack_advance+0x356/0x3a0 [ 1284.569632] [] tcp_rack_advance+0x356/0x3a0 [ 1284.569632] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 1284.569632] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.569632] [] tcp_ack+0x1487/0x2e60 [ 1284.569632] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.569632] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.569632] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.569632] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.569632] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.569632] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.569632] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.569632] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.569632] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.569632] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.569632] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.569632] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.569632] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.569632] [] ip_local_deliver+0x24d/0x330 [ 1284.569632] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.569632] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.569632] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.569632] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.569632] [] ip_rcv_finish+0x599/0x1870 [ 1284.569632] [] ip_rcv+0x89b/0x11d0 [ 1284.569632] [] ? ip_local_deliver+0x330/0x330 [ 1284.569632] [] ? inet_del_offload+0x40/0x40 [ 1284.569632] [] ? ip_local_deliver+0x330/0x330 [ 1284.569632] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.569632] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.569632] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.569632] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.569632] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.569632] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.569632] [] ? process_backlog+0x217/0x650 [ 1284.569632] [] __netif_receive_skb+0x5a/0x190 [ 1284.569632] [] process_backlog+0xd8/0x650 [ 1284.569632] [] ? process_backlog+0x217/0x650 [ 1284.569632] [] ? find_next_bit+0x15/0x20 [ 1284.569632] [] net_rx_action+0x655/0xde0 [ 1284.569632] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.569632] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.569632] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.569632] [] ? ktime_get+0x96/0x130 [ 1284.569632] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.569632] [] ? irq_exit+0x15c/0x190 [ 1284.569632] [] __do_softirq+0x22c/0x99f [ 1284.569632] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.569632] [] irq_exit+0x15c/0x190 [ 1284.569632] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.569632] [] apic_timer_interrupt+0x89/0x90 [ 1284.569632] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.569632] [] finish_task_switch+0x1fa/0x5a0 [ 1284.569632] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.569632] [] __schedule+0x90c/0x1b60 [ 1284.569632] [] schedule+0x9c/0x1c0 [ 1284.569632] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.569632] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.569632] [] ? __hrtimer_init+0x170/0x170 [ 1284.569632] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.569632] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.569632] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.569632] [] ? poll_freewait+0x220/0x220 [ 1284.569632] [] ? do_select+0x433/0x1390 [ 1284.569632] [] do_select+0xe16/0x1390 [ 1284.569632] [] ? do_select+0xb9/0x1390 [ 1284.569632] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.569632] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.569632] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.569632] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.569632] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.569632] [] ? print_context_stack+0x8b/0x100 [ 1284.569632] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.569632] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.569632] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.569632] [] ? dump_trace+0x113/0x2d0 [ 1284.569632] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.569632] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.569632] [] ? core_sys_select+0x170/0x690 [ 1284.569632] [] core_sys_select+0x3a6/0x690 [ 1284.569632] [] ? core_sys_select+0x75/0x690 [ 1284.569632] [] ? do_select+0x1390/0x1390 [ 1284.569632] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.569632] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.569632] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.569632] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.569632] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.569632] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.569632] [] SyS_select+0x132/0x1a0 [ 1284.569632] [] ? core_sys_select+0x690/0x690 [ 1284.569632] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.569632] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.569632] [] ? core_sys_select+0x690/0x690 [ 1284.569632] [] do_syscall_64+0x196/0x440 [ 1284.569632] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.569632] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.569632] Memory state around the buggy address: [ 1284.569632] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.569632] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.569632] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.569632] ^ [ 1284.569632] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.569632] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.569632] ================================================================== [ 1284.658797] ================================================================== [ 1284.659777] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2afc/0x2ce0 at addr ffff880389e56034 [ 1284.659789] Read of size 1 by task httpd/819 [ 1284.659789] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.659789] flags: 0x1000000000000000() [ 1284.659789] page dumped because: kasan: bad access detected [ 1284.659789] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.659789] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.659789] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.659789] ffff880389e56034 ffff8803aef073d0 ffffffff8151c33e 00203a3030313635 [ 1284.659789] ffff88038093af40 00000001000f0546 0000000000000282 000000004c8e38ec [ 1284.659789] Call Trace: [ 1284.659789] [] dump_stack+0x67/0x94 [ 1284.659789] [] kasan_report_error+0x4ae/0x4e0 [ 1284.659789] [] ? __asan_report_load8_noabort+0x43/0x50 [ 1284.659789] [] __asan_report_load1_noabort+0x43/0x50 [ 1284.659789] [] ? tcp_clean_rtx_queue+0x2afc/0x2ce0 [ 1284.659789] [] tcp_clean_rtx_queue+0x2afc/0x2ce0 [ 1284.659789] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.659789] [] tcp_ack+0x1487/0x2e60 [ 1284.659789] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.659789] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.659789] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.659789] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.659789] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.659789] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.659789] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.659789] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.659789] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.659789] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.659789] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.659789] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.659789] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.659789] [] ip_local_deliver+0x24d/0x330 [ 1284.659789] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.659789] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.659789] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.659789] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.659789] [] ip_rcv_finish+0x599/0x1870 [ 1284.659789] [] ip_rcv+0x89b/0x11d0 [ 1284.659789] [] ? ip_local_deliver+0x330/0x330 [ 1284.659789] [] ? inet_del_offload+0x40/0x40 [ 1284.659789] [] ? ip_local_deliver+0x330/0x330 [ 1284.659789] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.659789] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.659789] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.659789] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.659789] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.659789] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.659789] [] ? process_backlog+0x217/0x650 [ 1284.659789] [] __netif_receive_skb+0x5a/0x190 [ 1284.659789] [] process_backlog+0xd8/0x650 [ 1284.659789] [] ? process_backlog+0x217/0x650 [ 1284.659789] [] ? find_next_bit+0x15/0x20 [ 1284.659789] [] net_rx_action+0x655/0xde0 [ 1284.659789] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.659789] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.659789] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.659789] [] ? ktime_get+0x96/0x130 [ 1284.659789] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.659789] [] ? irq_exit+0x15c/0x190 [ 1284.659789] [] __do_softirq+0x22c/0x99f [ 1284.659789] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.659789] [] irq_exit+0x15c/0x190 [ 1284.659789] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.659789] [] apic_timer_interrupt+0x89/0x90 [ 1284.659789] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.659789] [] finish_task_switch+0x1fa/0x5a0 [ 1284.659789] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.659789] [] __schedule+0x90c/0x1b60 [ 1284.659789] [] schedule+0x9c/0x1c0 [ 1284.659789] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.659789] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.659789] [] ? __hrtimer_init+0x170/0x170 [ 1284.659789] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.659789] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.659789] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.659789] [] ? poll_freewait+0x220/0x220 [ 1284.659789] [] ? do_select+0x433/0x1390 [ 1284.659789] [] do_select+0xe16/0x1390 [ 1284.659789] [] ? do_select+0xb9/0x1390 [ 1284.659789] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.659789] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.659789] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.659789] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.659789] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.659789] [] ? print_context_stack+0x8b/0x100 [ 1284.659789] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.659789] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.659789] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.659789] [] ? dump_trace+0x113/0x2d0 [ 1284.659789] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.659789] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.659789] [] ? core_sys_select+0x170/0x690 [ 1284.659789] [] core_sys_select+0x3a6/0x690 [ 1284.659789] [] ? core_sys_select+0x75/0x690 [ 1284.659789] [] ? do_select+0x1390/0x1390 [ 1284.659789] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.659789] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.659789] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.659789] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.659789] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.659789] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.659789] [] SyS_select+0x132/0x1a0 [ 1284.659789] [] ? core_sys_select+0x690/0x690 [ 1284.659789] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.659789] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.659789] [] ? core_sys_select+0x690/0x690 [ 1284.659789] [] do_syscall_64+0x196/0x440 [ 1284.659789] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.659789] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.659789] Memory state around the buggy address: [ 1284.659789] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.659789] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.659789] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.659789] ^ [ 1284.659789] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.659789] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.659789] ================================================================== [ 1284.748858] ================================================================== [ 1284.749850] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2c97/0x2ce0 at addr ffff880389e56000 [ 1284.749850] Read of size 8 by task httpd/819 [ 1284.749850] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.749850] flags: 0x1000000000000000() [ 1284.749850] page dumped because: kasan: bad access detected [ 1284.749850] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.749850] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.749850] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.749850] ffff880389e56000 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.749850] ffff880300000000 ffffed00713cac06 0000000000000282 ffffffff4c8e38ec [ 1284.749850] Call Trace: [ 1284.749850] [] dump_stack+0x67/0x94 [ 1284.749850] [] kasan_report_error+0x4ae/0x4e0 [ 1284.749850] [] __asan_report_load8_noabort+0x43/0x50 [ 1284.749850] [] ? tcp_clean_rtx_queue+0x2c97/0x2ce0 [ 1284.749850] [] tcp_clean_rtx_queue+0x2c97/0x2ce0 [ 1284.749850] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.749850] [] tcp_ack+0x1487/0x2e60 [ 1284.749850] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.749850] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.749850] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.749850] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.749850] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.749850] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.749850] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.749850] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.749850] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.749850] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.749850] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.749850] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.749850] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.749850] [] ip_local_deliver+0x24d/0x330 [ 1284.749850] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.749850] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.749850] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.749850] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.749850] [] ip_rcv_finish+0x599/0x1870 [ 1284.749850] [] ip_rcv+0x89b/0x11d0 [ 1284.749850] [] ? ip_local_deliver+0x330/0x330 [ 1284.749850] [] ? inet_del_offload+0x40/0x40 [ 1284.749850] [] ? ip_local_deliver+0x330/0x330 [ 1284.749850] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.749850] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.749850] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.749850] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.749850] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.749850] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.749850] [] ? process_backlog+0x217/0x650 [ 1284.749850] [] __netif_receive_skb+0x5a/0x190 [ 1284.749850] [] process_backlog+0xd8/0x650 [ 1284.749850] [] ? process_backlog+0x217/0x650 [ 1284.749850] [] ? find_next_bit+0x15/0x20 [ 1284.749850] [] net_rx_action+0x655/0xde0 [ 1284.749850] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.749850] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.749850] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.749850] [] ? ktime_get+0x96/0x130 [ 1284.749850] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.749850] [] ? irq_exit+0x15c/0x190 [ 1284.749850] [] __do_softirq+0x22c/0x99f [ 1284.749850] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.749850] [] irq_exit+0x15c/0x190 [ 1284.749850] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.749850] [] apic_timer_interrupt+0x89/0x90 [ 1284.749850] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.749850] [] finish_task_switch+0x1fa/0x5a0 [ 1284.749850] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.749850] [] __schedule+0x90c/0x1b60 [ 1284.749850] [] schedule+0x9c/0x1c0 [ 1284.749850] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.749850] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.749850] [] ? __hrtimer_init+0x170/0x170 [ 1284.749850] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.749850] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.749850] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.749850] [] ? poll_freewait+0x220/0x220 [ 1284.749850] [] ? do_select+0x433/0x1390 [ 1284.749850] [] do_select+0xe16/0x1390 [ 1284.749850] [] ? do_select+0xb9/0x1390 [ 1284.749850] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.749850] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.749850] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.749850] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.749850] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.749850] [] ? print_context_stack+0x8b/0x100 [ 1284.749850] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.749850] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.749850] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.749850] [] ? dump_trace+0x113/0x2d0 [ 1284.749850] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.749850] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.749850] [] ? core_sys_select+0x170/0x690 [ 1284.749850] [] core_sys_select+0x3a6/0x690 [ 1284.749850] [] ? core_sys_select+0x75/0x690 [ 1284.749850] [] ? do_select+0x1390/0x1390 [ 1284.749850] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.749850] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.749850] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.749850] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.749850] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.749850] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.749850] [] SyS_select+0x132/0x1a0 [ 1284.749850] [] ? core_sys_select+0x690/0x690 [ 1284.749850] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.749850] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.749850] [] ? core_sys_select+0x690/0x690 [ 1284.749850] [] do_syscall_64+0x196/0x440 [ 1284.749850] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.749850] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.749850] Memory state around the buggy address: [ 1284.749850] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.749850] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.749850] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.749850] ^ [ 1284.749850] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.749850] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.749850] ================================================================== [ 1284.839908] ================================================================== [ 1284.840892] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2b73/0x2ce0 at addr ffff880389e56008 [ 1284.840900] Read of size 8 by task httpd/819 [ 1284.840900] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.840900] flags: 0x1000000000000000() [ 1284.840900] page dumped because: kasan: bad access detected [ 1284.840900] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.840900] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.840900] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.840900] ffff880389e56008 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.840900] ffff880300000000 ffffed00713cac00 0000000000000282 ffffffff4c8e38ec [ 1284.840900] Call Trace: [ 1284.840900] [] dump_stack+0x67/0x94 [ 1284.840900] [] kasan_report_error+0x4ae/0x4e0 [ 1284.840900] [] __asan_report_load8_noabort+0x43/0x50 [ 1284.840900] [] ? tcp_clean_rtx_queue+0x2b73/0x2ce0 [ 1284.840900] [] tcp_clean_rtx_queue+0x2b73/0x2ce0 [ 1284.840900] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.840900] [] tcp_ack+0x1487/0x2e60 [ 1284.840900] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.840900] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.840900] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.840900] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.840900] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.840900] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.840900] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.840900] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.840900] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.840900] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.840900] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.840900] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.840900] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.840900] [] ip_local_deliver+0x24d/0x330 [ 1284.840900] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.840900] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.840900] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.840900] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.840900] [] ip_rcv_finish+0x599/0x1870 [ 1284.840900] [] ip_rcv+0x89b/0x11d0 [ 1284.840900] [] ? ip_local_deliver+0x330/0x330 [ 1284.840900] [] ? inet_del_offload+0x40/0x40 [ 1284.840900] [] ? ip_local_deliver+0x330/0x330 [ 1284.840900] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.840900] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.840900] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.840900] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.840900] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.840900] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.840900] [] ? process_backlog+0x217/0x650 [ 1284.840900] [] __netif_receive_skb+0x5a/0x190 [ 1284.840900] [] process_backlog+0xd8/0x650 [ 1284.840900] [] ? process_backlog+0x217/0x650 [ 1284.840900] [] ? find_next_bit+0x15/0x20 [ 1284.840900] [] net_rx_action+0x655/0xde0 [ 1284.840900] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.840900] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.840900] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.840900] [] ? ktime_get+0x96/0x130 [ 1284.840900] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.840900] [] ? irq_exit+0x15c/0x190 [ 1284.840900] [] __do_softirq+0x22c/0x99f [ 1284.840900] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.840900] [] irq_exit+0x15c/0x190 [ 1284.840900] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.840900] [] apic_timer_interrupt+0x89/0x90 [ 1284.840900] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.840900] [] finish_task_switch+0x1fa/0x5a0 [ 1284.840900] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.840900] [] __schedule+0x90c/0x1b60 [ 1284.840900] [] schedule+0x9c/0x1c0 [ 1284.840900] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.840900] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.840900] [] ? __hrtimer_init+0x170/0x170 [ 1284.840900] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.840900] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.840900] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.840900] [] ? poll_freewait+0x220/0x220 [ 1284.840900] [] ? do_select+0x433/0x1390 [ 1284.840900] [] do_select+0xe16/0x1390 [ 1284.840900] [] ? do_select+0xb9/0x1390 [ 1284.840900] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.840900] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.840900] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.840900] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.840900] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.840900] [] ? print_context_stack+0x8b/0x100 [ 1284.840900] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.840900] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.840900] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.840900] [] ? dump_trace+0x113/0x2d0 [ 1284.840900] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.840900] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.840900] [] ? core_sys_select+0x170/0x690 [ 1284.840900] [] core_sys_select+0x3a6/0x690 [ 1284.840900] [] ? core_sys_select+0x75/0x690 [ 1284.840900] [] ? do_select+0x1390/0x1390 [ 1284.840900] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.840900] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.840900] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.840900] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.840900] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.840900] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.840900] [] SyS_select+0x132/0x1a0 [ 1284.840900] [] ? core_sys_select+0x690/0x690 [ 1284.840900] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.840900] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.840900] [] ? core_sys_select+0x690/0x690 [ 1284.840900] [] do_syscall_64+0x196/0x440 [ 1284.840900] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.840900] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.840900] Memory state around the buggy address: [ 1284.840900] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.840900] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.840900] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.840900] ^ [ 1284.840900] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.840900] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.840900] ================================================================== [ 1284.924745] ================================================================== [ 1284.925736] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1ba5/0x2ce0 at addr ffff880389e560f0 [ 1284.925736] Read of size 4 by task httpd/819 [ 1284.925736] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1284.925736] flags: 0x1000000000000000() [ 1284.925736] page dumped because: kasan: bad access detected [ 1284.925736] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1284.925736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1284.925736] dffffc0000000000 ffff8803aef07350 ffffffff8199f263 ffff8803aef073e0 [ 1284.925736] ffff880389e560f0 ffff8803aef073d0 ffffffff8151c33e 0000000000000010 [ 1284.925736] ffff880300000000 ffffed00713cac01 0000000000000282 ffffffff4c8e38ec [ 1284.925736] Call Trace: [ 1284.925736] [] dump_stack+0x67/0x94 [ 1284.925736] [] kasan_report_error+0x4ae/0x4e0 [ 1284.925736] [] __asan_report_load4_noabort+0x43/0x50 [ 1284.925736] [] ? tcp_clean_rtx_queue+0x1ba5/0x2ce0 [ 1284.925736] [] tcp_clean_rtx_queue+0x1ba5/0x2ce0 [ 1284.925736] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1284.925736] [] tcp_ack+0x1487/0x2e60 [ 1284.925736] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.925736] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1284.925736] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.925736] [] tcp_rcv_established+0x58c/0x2de0 [ 1284.925736] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1284.925736] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1284.925736] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1284.925736] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1284.925736] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1284.925736] [] tcp_v4_rcv+0x213e/0x3420 [ 1284.925736] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1284.925736] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1284.925736] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1284.925736] [] ip_local_deliver+0x24d/0x330 [ 1284.925736] [] ? ip_call_ra_chain+0x510/0x510 [ 1284.925736] [] ? nf_hook_slow+0x186/0x2a0 [ 1284.925736] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1284.925736] [] ? nf_hook_slow+0x5/0x2a0 [ 1284.925736] [] ip_rcv_finish+0x599/0x1870 [ 1284.925736] [] ip_rcv+0x89b/0x11d0 [ 1284.925736] [] ? ip_local_deliver+0x330/0x330 [ 1284.925736] [] ? inet_del_offload+0x40/0x40 [ 1284.925736] [] ? ip_local_deliver+0x330/0x330 [ 1284.925736] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1284.925736] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.925736] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.925736] [] ? net_tx_action+0x9d0/0x9d0 [ 1284.925736] [] ? default_send_IPI_single+0x75/0xa0 [ 1284.925736] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1284.925736] [] ? process_backlog+0x217/0x650 [ 1284.925736] [] __netif_receive_skb+0x5a/0x190 [ 1284.925736] [] process_backlog+0xd8/0x650 [ 1284.925736] [] ? process_backlog+0x217/0x650 [ 1284.925736] [] ? find_next_bit+0x15/0x20 [ 1284.925736] [] net_rx_action+0x655/0xde0 [ 1284.925736] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1284.925736] [] ? sk_busy_loop+0xb90/0xb90 [ 1284.925736] [] ? trace_hardirqs_off+0xd/0x10 [ 1284.925736] [] ? ktime_get+0x96/0x130 [ 1284.925736] [] ? clockevents_program_event+0x1cf/0x300 [ 1284.925736] [] ? irq_exit+0x15c/0x190 [ 1284.925736] [] __do_softirq+0x22c/0x99f [ 1284.925736] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1284.925736] [] irq_exit+0x15c/0x190 [ 1284.925736] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1284.925736] [] apic_timer_interrupt+0x89/0x90 [ 1284.925736] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1284.925736] [] finish_task_switch+0x1fa/0x5a0 [ 1284.925736] [] ? finish_task_switch+0x1ce/0x5a0 [ 1284.925736] [] __schedule+0x90c/0x1b60 [ 1284.925736] [] schedule+0x9c/0x1c0 [ 1284.925736] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1284.925736] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1284.925736] [] ? __hrtimer_init+0x170/0x170 [ 1284.925736] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1284.925736] [] schedule_hrtimeout_range+0x13/0x20 [ 1284.925736] [] poll_schedule_timeout+0xf4/0x1f0 [ 1284.925736] [] ? poll_freewait+0x220/0x220 [ 1284.925736] [] ? do_select+0x433/0x1390 [ 1284.925736] [] do_select+0xe16/0x1390 [ 1284.925736] [] ? do_select+0xb9/0x1390 [ 1284.925736] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.925736] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1284.925736] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1284.925736] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.925736] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1284.925736] [] ? print_context_stack+0x8b/0x100 [ 1284.925736] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.925736] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1284.925736] [] ? __lock_acquire+0xaa6/0x3a90 [ 1284.925736] [] ? dump_trace+0x113/0x2d0 [ 1284.925736] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1284.925736] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.925736] [] ? core_sys_select+0x170/0x690 [ 1284.925736] [] core_sys_select+0x3a6/0x690 [ 1284.925736] [] ? core_sys_select+0x75/0x690 [ 1284.925736] [] ? do_select+0x1390/0x1390 [ 1284.925736] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1284.925736] [] ? ktime_get_ts64+0x8c/0x220 [ 1284.925736] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1284.925736] [] ? trace_hardirqs_on+0xd/0x10 [ 1284.925736] [] ? ktime_get_ts64+0xc2/0x220 [ 1284.925736] [] ? poll_select_set_timeout+0x87/0xc0 [ 1284.925736] [] SyS_select+0x132/0x1a0 [ 1284.925736] [] ? core_sys_select+0x690/0x690 [ 1284.925736] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1284.925736] [] ? syscall_trace_enter+0x351/0x8e0 [ 1284.925736] [] ? core_sys_select+0x690/0x690 [ 1284.925736] [] do_syscall_64+0x196/0x440 [ 1284.925736] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1284.925736] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1284.925736] Memory state around the buggy address: [ 1284.925736] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1284.925736] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.925736] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.925736] ^ [ 1284.925736] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.925736] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1284.925736] ================================================================== [ 1285.015502] ================================================================== [ 1285.016493] BUG: KASAN: use-after-free in skb_release_head_state+0x1bc/0x1f0 at addr ffff880389e56068 [ 1285.016494] Read of size 8 by task httpd/819 [ 1285.016494] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.016494] flags: 0x1000000000000000() [ 1285.016494] page dumped because: kasan: bad access detected [ 1285.016494] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.016494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.016494] dffffc0000000000 ffff8803aef07300 ffffffff8199f263 ffff8803aef07390 [ 1285.016494] ffff880389e56068 ffff8803aef07380 ffffffff8151c33e ffff8803aef07328 [ 1285.016494] 0000000000000018 0000000000000282 0000000000000282 ffffed00713cac40 [ 1285.016494] Call Trace: [ 1285.016494] [] dump_stack+0x67/0x94 [ 1285.016494] [] kasan_report_error+0x4ae/0x4e0 [ 1285.016494] [] ? kasan_end_report+0x37/0x50 [ 1285.016494] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.016494] [] ? skb_release_head_state+0x1bc/0x1f0 [ 1285.016494] [] skb_release_head_state+0x1bc/0x1f0 [ 1285.016494] [] skb_release_all+0x12/0x50 [ 1285.016494] [] __kfree_skb+0x12/0x20 [ 1285.016494] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.016494] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.016494] [] tcp_ack+0x1487/0x2e60 [ 1285.016494] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.016494] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.016494] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.016494] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.016494] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.016494] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.016494] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.016494] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.016494] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.016494] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.016494] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.016494] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.016494] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.016494] [] ip_local_deliver+0x24d/0x330 [ 1285.016494] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.016494] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.016494] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.016494] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.016494] [] ip_rcv_finish+0x599/0x1870 [ 1285.016494] [] ip_rcv+0x89b/0x11d0 [ 1285.016494] [] ? ip_local_deliver+0x330/0x330 [ 1285.016494] [] ? inet_del_offload+0x40/0x40 [ 1285.016494] [] ? ip_local_deliver+0x330/0x330 [ 1285.016494] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.016494] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.016494] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.016494] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.016494] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.016494] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.016494] [] ? process_backlog+0x217/0x650 [ 1285.016494] [] __netif_receive_skb+0x5a/0x190 [ 1285.016494] [] process_backlog+0xd8/0x650 [ 1285.016494] [] ? process_backlog+0x217/0x650 [ 1285.016494] [] ? find_next_bit+0x15/0x20 [ 1285.016494] [] net_rx_action+0x655/0xde0 [ 1285.016494] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.016494] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.016494] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.016494] [] ? ktime_get+0x96/0x130 [ 1285.016494] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.016494] [] ? irq_exit+0x15c/0x190 [ 1285.016494] [] __do_softirq+0x22c/0x99f [ 1285.016494] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.016494] [] irq_exit+0x15c/0x190 [ 1285.016494] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.016494] [] apic_timer_interrupt+0x89/0x90 [ 1285.016494] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.016494] [] finish_task_switch+0x1fa/0x5a0 [ 1285.016494] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.016494] [] __schedule+0x90c/0x1b60 [ 1285.016494] [] schedule+0x9c/0x1c0 [ 1285.016494] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.016494] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.016494] [] ? __hrtimer_init+0x170/0x170 [ 1285.016494] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.016494] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.016494] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.016494] [] ? poll_freewait+0x220/0x220 [ 1285.016494] [] ? do_select+0x433/0x1390 [ 1285.016494] [] do_select+0xe16/0x1390 [ 1285.016494] [] ? do_select+0xb9/0x1390 [ 1285.016494] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.016494] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.016494] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.016494] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.016494] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.016494] [] ? print_context_stack+0x8b/0x100 [ 1285.016494] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.016494] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.016494] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.016494] [] ? dump_trace+0x113/0x2d0 [ 1285.016494] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.016494] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.016494] [] ? core_sys_select+0x170/0x690 [ 1285.016494] [] core_sys_select+0x3a6/0x690 [ 1285.016494] [] ? core_sys_select+0x75/0x690 [ 1285.016494] [] ? do_select+0x1390/0x1390 [ 1285.016494] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.016494] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.016494] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.016494] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.016494] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.016494] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.016494] [] SyS_select+0x132/0x1a0 [ 1285.016494] [] ? core_sys_select+0x690/0x690 [ 1285.016494] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.016494] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.016494] [] ? core_sys_select+0x690/0x690 [ 1285.016494] [] do_syscall_64+0x196/0x440 [ 1285.016494] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.016494] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.016494] Memory state around the buggy address: [ 1285.016494] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.016494] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.016494] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.016494] ^ [ 1285.016494] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.016494] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.016494] ================================================================== [ 1285.108793] ================================================================== [ 1285.109785] BUG: KASAN: use-after-free in skb_release_head_state+0x1c6/0x1f0 at addr ffff880389e56078 [ 1285.109785] Read of size 8 by task httpd/819 [ 1285.109785] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.109785] flags: 0x1000000000000000() [ 1285.109785] page dumped because: kasan: bad access detected [ 1285.109785] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.109785] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.109785] dffffc0000000000 ffff8803aef07300 ffffffff8199f263 ffff8803aef07390 [ 1285.109785] ffff880389e56078 ffff8803aef07380 ffffffff8151c33e 0000000000000010 [ 1285.109785] 0000000000000000 ffffed00713cac0d 0000000000000282 ffffffff713cac40 [ 1285.109785] Call Trace: [ 1285.109785] [] dump_stack+0x67/0x94 [ 1285.109785] [] kasan_report_error+0x4ae/0x4e0 [ 1285.109785] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.109785] [] ? skb_release_head_state+0x1c6/0x1f0 [ 1285.109785] [] skb_release_head_state+0x1c6/0x1f0 [ 1285.109785] [] skb_release_all+0x12/0x50 [ 1285.109785] [] __kfree_skb+0x12/0x20 [ 1285.109785] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.109785] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.109785] [] tcp_ack+0x1487/0x2e60 [ 1285.109785] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.109785] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.109785] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.109785] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.109785] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.109785] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.109785] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.109785] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.109785] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.109785] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.109785] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.109785] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.109785] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.109785] [] ip_local_deliver+0x24d/0x330 [ 1285.109785] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.109785] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.109785] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.109785] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.109785] [] ip_rcv_finish+0x599/0x1870 [ 1285.109785] [] ip_rcv+0x89b/0x11d0 [ 1285.109785] [] ? ip_local_deliver+0x330/0x330 [ 1285.109785] [] ? inet_del_offload+0x40/0x40 [ 1285.109785] [] ? ip_local_deliver+0x330/0x330 [ 1285.109785] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.109785] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.109785] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.109785] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.109785] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.109785] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.109785] [] ? process_backlog+0x217/0x650 [ 1285.109785] [] __netif_receive_skb+0x5a/0x190 [ 1285.109785] [] process_backlog+0xd8/0x650 [ 1285.109785] [] ? process_backlog+0x217/0x650 [ 1285.109785] [] ? find_next_bit+0x15/0x20 [ 1285.109785] [] net_rx_action+0x655/0xde0 [ 1285.109785] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.109785] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.109785] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.109785] [] ? ktime_get+0x96/0x130 [ 1285.109785] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.109785] [] ? irq_exit+0x15c/0x190 [ 1285.109785] [] __do_softirq+0x22c/0x99f [ 1285.109785] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.109785] [] irq_exit+0x15c/0x190 [ 1285.109785] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.109785] [] apic_timer_interrupt+0x89/0x90 [ 1285.109785] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.109785] [] finish_task_switch+0x1fa/0x5a0 [ 1285.109785] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.109785] [] __schedule+0x90c/0x1b60 [ 1285.109785] [] schedule+0x9c/0x1c0 [ 1285.109785] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.109785] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.109785] [] ? __hrtimer_init+0x170/0x170 [ 1285.109785] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.109785] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.109785] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.109785] [] ? poll_freewait+0x220/0x220 [ 1285.109785] [] ? do_select+0x433/0x1390 [ 1285.109785] [] do_select+0xe16/0x1390 [ 1285.109785] [] ? do_select+0xb9/0x1390 [ 1285.109785] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.109785] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.109785] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.109785] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.109785] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.109785] [] ? print_context_stack+0x8b/0x100 [ 1285.109785] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.109785] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.109785] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.109785] [] ? dump_trace+0x113/0x2d0 [ 1285.109785] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.109785] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.109785] [] ? core_sys_select+0x170/0x690 [ 1285.109785] [] core_sys_select+0x3a6/0x690 [ 1285.109785] [] ? core_sys_select+0x75/0x690 [ 1285.109785] [] ? do_select+0x1390/0x1390 [ 1285.109785] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.109785] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.109785] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.109785] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.109785] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.109785] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.109785] [] SyS_select+0x132/0x1a0 [ 1285.109785] [] ? core_sys_select+0x690/0x690 [ 1285.109785] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.109785] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.109785] [] ? core_sys_select+0x690/0x690 [ 1285.109785] [] do_syscall_64+0x196/0x440 [ 1285.109785] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.109785] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.109785] Memory state around the buggy address: [ 1285.109785] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.109785] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.109785] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.109785] ^ [ 1285.109785] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.109785] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.109785] ================================================================== [ 1285.201230] ================================================================== [ 1285.202222] BUG: KASAN: use-after-free in skb_release_head_state+0x1af/0x1f0 at addr ffff880389e56070 [ 1285.202222] Read of size 8 by task httpd/819 [ 1285.202222] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.202222] flags: 0x1000000000000000() [ 1285.202222] page dumped because: kasan: bad access detected [ 1285.202222] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.202222] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.202222] dffffc0000000000 ffff8803aef07300 ffffffff8199f263 ffff8803aef07390 [ 1285.202222] ffff880389e56070 ffff8803aef07380 ffffffff8151c33e 0000000000000010 [ 1285.202222] 0000000000000000 ffffed00713cac0f 0000000000000282 ffffffff713cac40 [ 1285.202222] Call Trace: [ 1285.202222] [] dump_stack+0x67/0x94 [ 1285.202222] [] kasan_report_error+0x4ae/0x4e0 [ 1285.202222] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.202222] [] ? skb_release_head_state+0x1af/0x1f0 [ 1285.202222] [] skb_release_head_state+0x1af/0x1f0 [ 1285.202222] [] skb_release_all+0x12/0x50 [ 1285.202222] [] __kfree_skb+0x12/0x20 [ 1285.202222] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.202222] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.202222] [] tcp_ack+0x1487/0x2e60 [ 1285.202222] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.202222] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.202222] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.202222] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.202222] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.202222] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.202222] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.202222] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.202222] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.202222] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.202222] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.202222] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.202222] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.202222] [] ip_local_deliver+0x24d/0x330 [ 1285.202222] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.202222] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.202222] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.202222] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.202222] [] ip_rcv_finish+0x599/0x1870 [ 1285.202222] [] ip_rcv+0x89b/0x11d0 [ 1285.202222] [] ? ip_local_deliver+0x330/0x330 [ 1285.202222] [] ? inet_del_offload+0x40/0x40 [ 1285.202222] [] ? ip_local_deliver+0x330/0x330 [ 1285.202222] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.202222] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.202222] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.202222] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.202222] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.202222] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.202222] [] ? process_backlog+0x217/0x650 [ 1285.202222] [] __netif_receive_skb+0x5a/0x190 [ 1285.202222] [] process_backlog+0xd8/0x650 [ 1285.202222] [] ? process_backlog+0x217/0x650 [ 1285.202222] [] ? find_next_bit+0x15/0x20 [ 1285.202222] [] net_rx_action+0x655/0xde0 [ 1285.202222] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.202222] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.202222] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.202222] [] ? ktime_get+0x96/0x130 [ 1285.202222] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.202222] [] ? irq_exit+0x15c/0x190 [ 1285.202222] [] __do_softirq+0x22c/0x99f [ 1285.202222] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.202222] [] irq_exit+0x15c/0x190 [ 1285.202222] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.202222] [] apic_timer_interrupt+0x89/0x90 [ 1285.202222] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.202222] [] finish_task_switch+0x1fa/0x5a0 [ 1285.202222] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.202222] [] __schedule+0x90c/0x1b60 [ 1285.202222] [] schedule+0x9c/0x1c0 [ 1285.202222] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.202222] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.202222] [] ? __hrtimer_init+0x170/0x170 [ 1285.202222] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.202222] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.202222] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.202222] [] ? poll_freewait+0x220/0x220 [ 1285.202222] [] ? do_select+0x433/0x1390 [ 1285.202222] [] do_select+0xe16/0x1390 [ 1285.202222] [] ? do_select+0xb9/0x1390 [ 1285.202222] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.202222] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.202222] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.202222] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.202222] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.202222] [] ? print_context_stack+0x8b/0x100 [ 1285.202222] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.202222] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.202222] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.202222] [] ? dump_trace+0x113/0x2d0 [ 1285.202222] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.202222] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.202222] [] ? core_sys_select+0x170/0x690 [ 1285.202222] [] core_sys_select+0x3a6/0x690 [ 1285.202222] [] ? core_sys_select+0x75/0x690 [ 1285.202222] [] ? do_select+0x1390/0x1390 [ 1285.202222] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.202222] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.202222] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.202222] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.202222] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.202222] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.202222] [] SyS_select+0x132/0x1a0 [ 1285.202222] [] ? core_sys_select+0x690/0x690 [ 1285.202222] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.202222] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.202222] [] ? core_sys_select+0x690/0x690 [ 1285.202222] [] do_syscall_64+0x196/0x440 [ 1285.202222] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.202222] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.202222] Memory state around the buggy address: [ 1285.202222] ffff880389e55f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.202222] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.202222] >ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.202222] ^ [ 1285.202222] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.202222] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.202222] ================================================================== [ 1285.286245] ================================================================== [ 1285.287231] BUG: KASAN: use-after-free in skb_release_head_state+0x1da/0x1f0 at addr ffff880389e56080 [ 1285.287237] Read of size 8 by task httpd/819 [ 1285.287237] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.287237] flags: 0x1000000000000000() [ 1285.287237] page dumped because: kasan: bad access detected [ 1285.287237] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.287237] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.287237] dffffc0000000000 ffff8803aef07300 ffffffff8199f263 ffff8803aef07390 [ 1285.287237] ffff880389e56080 ffff8803aef07380 ffffffff8151c33e 0000000000000010 [ 1285.287237] 0000000000000000 ffffed00713cac0e 0000000000000282 ffffffff713cac40 [ 1285.287237] Call Trace: [ 1285.287237] [] dump_stack+0x67/0x94 [ 1285.287237] [] kasan_report_error+0x4ae/0x4e0 [ 1285.287237] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.287237] [] ? skb_release_head_state+0x1da/0x1f0 [ 1285.287237] [] skb_release_head_state+0x1da/0x1f0 [ 1285.287237] [] skb_release_all+0x12/0x50 [ 1285.287237] [] __kfree_skb+0x12/0x20 [ 1285.287237] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.287237] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.287237] [] tcp_ack+0x1487/0x2e60 [ 1285.287237] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.287237] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.287237] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.287237] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.287237] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.287237] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.287237] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.287237] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.287237] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.287237] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.287237] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.287237] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.287237] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.287237] [] ip_local_deliver+0x24d/0x330 [ 1285.287237] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.287237] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.287237] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.287237] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.287237] [] ip_rcv_finish+0x599/0x1870 [ 1285.287237] [] ip_rcv+0x89b/0x11d0 [ 1285.287237] [] ? ip_local_deliver+0x330/0x330 [ 1285.287237] [] ? inet_del_offload+0x40/0x40 [ 1285.287237] [] ? ip_local_deliver+0x330/0x330 [ 1285.287237] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.287237] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.287237] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.287237] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.287237] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.287237] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.287237] [] ? process_backlog+0x217/0x650 [ 1285.287237] [] __netif_receive_skb+0x5a/0x190 [ 1285.287237] [] process_backlog+0xd8/0x650 [ 1285.287237] [] ? process_backlog+0x217/0x650 [ 1285.287237] [] ? find_next_bit+0x15/0x20 [ 1285.287237] [] net_rx_action+0x655/0xde0 [ 1285.287237] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.287237] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.287237] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.287237] [] ? ktime_get+0x96/0x130 [ 1285.287237] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.287237] [] ? irq_exit+0x15c/0x190 [ 1285.287237] [] __do_softirq+0x22c/0x99f [ 1285.287237] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.287237] [] irq_exit+0x15c/0x190 [ 1285.287237] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.287237] [] apic_timer_interrupt+0x89/0x90 [ 1285.287237] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.287237] [] finish_task_switch+0x1fa/0x5a0 [ 1285.287237] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.287237] [] __schedule+0x90c/0x1b60 [ 1285.287237] [] schedule+0x9c/0x1c0 [ 1285.287237] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.287237] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.287237] [] ? __hrtimer_init+0x170/0x170 [ 1285.287237] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.287237] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.287237] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.287237] [] ? poll_freewait+0x220/0x220 [ 1285.287237] [] ? do_select+0x433/0x1390 [ 1285.287237] [] do_select+0xe16/0x1390 [ 1285.287237] [] ? do_select+0xb9/0x1390 [ 1285.287237] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.287237] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.287237] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.287237] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.287237] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.287237] [] ? print_context_stack+0x8b/0x100 [ 1285.287237] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.287237] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.287237] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.287237] [] ? dump_trace+0x113/0x2d0 [ 1285.287237] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.287237] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.287237] [] ? core_sys_select+0x170/0x690 [ 1285.287237] [] core_sys_select+0x3a6/0x690 [ 1285.287237] [] ? core_sys_select+0x75/0x690 [ 1285.287237] [] ? do_select+0x1390/0x1390 [ 1285.287237] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.287237] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.287237] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.287237] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.287237] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.287237] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.287237] [] SyS_select+0x132/0x1a0 [ 1285.287237] [] ? core_sys_select+0x690/0x690 [ 1285.287237] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.287237] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.287237] [] ? core_sys_select+0x690/0x690 [ 1285.287237] [] do_syscall_64+0x196/0x440 [ 1285.287237] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.287237] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.287237] Memory state around the buggy address: [ 1285.287237] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.287237] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.287237] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.287237] ^ [ 1285.287237] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.287237] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.287237] ================================================================== [ 1285.377825] ================================================================== [ 1285.378813] BUG: KASAN: use-after-free in skb_release_head_state+0x1d0/0x1f0 at addr ffff880389e56088 [ 1285.378815] Read of size 8 by task httpd/819 [ 1285.378815] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.378815] flags: 0x1000000000000000() [ 1285.378815] page dumped because: kasan: bad access detected [ 1285.378815] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.378815] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.378815] dffffc0000000000 ffff8803aef07300 ffffffff8199f263 ffff8803aef07390 [ 1285.378815] ffff880389e56088 ffff8803aef07380 ffffffff8151c33e 0000000000000010 [ 1285.378815] 0000000000000000 ffffed00713cac10 0000000000000282 ffffffff713cac40 [ 1285.378815] Call Trace: [ 1285.378815] [] dump_stack+0x67/0x94 [ 1285.378815] [] kasan_report_error+0x4ae/0x4e0 [ 1285.378815] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.378815] [] ? skb_release_head_state+0x1d0/0x1f0 [ 1285.378815] [] skb_release_head_state+0x1d0/0x1f0 [ 1285.378815] [] skb_release_all+0x12/0x50 [ 1285.378815] [] __kfree_skb+0x12/0x20 [ 1285.378815] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.378815] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.378815] [] tcp_ack+0x1487/0x2e60 [ 1285.378815] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.378815] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.378815] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.378815] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.378815] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.378815] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.378815] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.378815] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.378815] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.378815] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.378815] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.378815] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.378815] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.378815] [] ip_local_deliver+0x24d/0x330 [ 1285.378815] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.378815] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.378815] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.378815] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.378815] [] ip_rcv_finish+0x599/0x1870 [ 1285.378815] [] ip_rcv+0x89b/0x11d0 [ 1285.378815] [] ? ip_local_deliver+0x330/0x330 [ 1285.378815] [] ? inet_del_offload+0x40/0x40 [ 1285.378815] [] ? ip_local_deliver+0x330/0x330 [ 1285.378815] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.378815] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.378815] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.378815] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.378815] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.378815] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.378815] [] ? process_backlog+0x217/0x650 [ 1285.378815] [] __netif_receive_skb+0x5a/0x190 [ 1285.378815] [] process_backlog+0xd8/0x650 [ 1285.378815] [] ? process_backlog+0x217/0x650 [ 1285.378815] [] ? find_next_bit+0x15/0x20 [ 1285.378815] [] net_rx_action+0x655/0xde0 [ 1285.378815] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.378815] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.378815] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.378815] [] ? ktime_get+0x96/0x130 [ 1285.378815] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.378815] [] ? irq_exit+0x15c/0x190 [ 1285.378815] [] __do_softirq+0x22c/0x99f [ 1285.378815] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.378815] [] irq_exit+0x15c/0x190 [ 1285.378815] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.378815] [] apic_timer_interrupt+0x89/0x90 [ 1285.378815] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.378815] [] finish_task_switch+0x1fa/0x5a0 [ 1285.378815] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.378815] [] __schedule+0x90c/0x1b60 [ 1285.378815] [] schedule+0x9c/0x1c0 [ 1285.378815] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.378815] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.378815] [] ? __hrtimer_init+0x170/0x170 [ 1285.378815] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.378815] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.378815] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.378815] [] ? poll_freewait+0x220/0x220 [ 1285.378815] [] ? do_select+0x433/0x1390 [ 1285.378815] [] do_select+0xe16/0x1390 [ 1285.378815] [] ? do_select+0xb9/0x1390 [ 1285.378815] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.378815] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.378815] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.378815] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.378815] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.378815] [] ? print_context_stack+0x8b/0x100 [ 1285.378815] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.378815] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.378815] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.378815] [] ? dump_trace+0x113/0x2d0 [ 1285.378815] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.378815] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.378815] [] ? core_sys_select+0x170/0x690 [ 1285.378815] [] core_sys_select+0x3a6/0x690 [ 1285.378815] [] ? core_sys_select+0x75/0x690 [ 1285.378815] [] ? do_select+0x1390/0x1390 [ 1285.378815] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.378815] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.378815] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.378815] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.378815] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.378815] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.378815] [] SyS_select+0x132/0x1a0 [ 1285.378815] [] ? core_sys_select+0x690/0x690 [ 1285.378815] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.378815] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.378815] [] ? core_sys_select+0x690/0x690 [ 1285.378815] [] do_syscall_64+0x196/0x440 [ 1285.378815] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.378815] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.378815] Memory state around the buggy address: [ 1285.378815] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.378815] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.378815] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.378815] ^ [ 1285.378815] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.378815] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.378815] ================================================================== [ 1285.471185] ================================================================== [ 1285.472176] BUG: KASAN: use-after-free in skb_release_all+0x4a/0x50 at addr ffff880389e560e0 [ 1285.472176] Read of size 8 by task httpd/819 [ 1285.472176] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.472176] flags: 0x1000000000000000() [ 1285.472176] page dumped because: kasan: bad access detected [ 1285.472176] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.472176] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.472176] dffffc0000000000 ffff8803aef07320 ffffffff8199f263 ffff8803aef073b0 [ 1285.472176] ffff880389e560e0 ffff8803aef073a0 ffffffff8151c33e ffffffff713cac40 [ 1285.472176] ffffffffffffffff 66666620ffffffff 0000000000000286 00203a3038313635 [ 1285.472176] Call Trace: [ 1285.472176] [] dump_stack+0x67/0x94 [ 1285.472176] [] kasan_report_error+0x4ae/0x4e0 [ 1285.472176] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.472176] [] ? skb_release_all+0x4a/0x50 [ 1285.472176] [] skb_release_all+0x4a/0x50 [ 1285.472176] [] __kfree_skb+0x12/0x20 [ 1285.472176] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.472176] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.472176] [] tcp_ack+0x1487/0x2e60 [ 1285.472176] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.472176] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.472176] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.472176] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.472176] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.472176] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.472176] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.472176] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.472176] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.472176] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.472176] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.472176] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.472176] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.472176] [] ip_local_deliver+0x24d/0x330 [ 1285.472176] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.472176] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.472176] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.472176] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.472176] [] ip_rcv_finish+0x599/0x1870 [ 1285.472176] [] ip_rcv+0x89b/0x11d0 [ 1285.472176] [] ? ip_local_deliver+0x330/0x330 [ 1285.472176] [] ? inet_del_offload+0x40/0x40 [ 1285.472176] [] ? ip_local_deliver+0x330/0x330 [ 1285.472176] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.472176] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.472176] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.472176] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.472176] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.472176] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.472176] [] ? process_backlog+0x217/0x650 [ 1285.472176] [] __netif_receive_skb+0x5a/0x190 [ 1285.472176] [] process_backlog+0xd8/0x650 [ 1285.472176] [] ? process_backlog+0x217/0x650 [ 1285.472176] [] ? find_next_bit+0x15/0x20 [ 1285.472176] [] net_rx_action+0x655/0xde0 [ 1285.472176] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.472176] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.472176] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.472176] [] ? ktime_get+0x96/0x130 [ 1285.472176] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.472176] [] ? irq_exit+0x15c/0x190 [ 1285.472176] [] __do_softirq+0x22c/0x99f [ 1285.472176] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.472176] [] irq_exit+0x15c/0x190 [ 1285.472176] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.472176] [] apic_timer_interrupt+0x89/0x90 [ 1285.472176] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.472176] [] finish_task_switch+0x1fa/0x5a0 [ 1285.472176] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.472176] [] __schedule+0x90c/0x1b60 [ 1285.472176] [] schedule+0x9c/0x1c0 [ 1285.472176] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.472176] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.472176] [] ? __hrtimer_init+0x170/0x170 [ 1285.472176] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.472176] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.472176] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.472176] [] ? poll_freewait+0x220/0x220 [ 1285.472176] [] ? do_select+0x433/0x1390 [ 1285.472176] [] do_select+0xe16/0x1390 [ 1285.472176] [] ? do_select+0xb9/0x1390 [ 1285.472176] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.472176] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.472176] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.472176] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.472176] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.472176] [] ? print_context_stack+0x8b/0x100 [ 1285.472176] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.472176] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.472176] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.472176] [] ? dump_trace+0x113/0x2d0 [ 1285.472176] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.472176] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.472176] [] ? core_sys_select+0x170/0x690 [ 1285.472176] [] core_sys_select+0x3a6/0x690 [ 1285.472176] [] ? core_sys_select+0x75/0x690 [ 1285.472176] [] ? do_select+0x1390/0x1390 [ 1285.472176] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.472176] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.472176] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.472176] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.472176] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.472176] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.472176] [] SyS_select+0x132/0x1a0 [ 1285.472176] [] ? core_sys_select+0x690/0x690 [ 1285.472176] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.472176] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.472176] [] ? core_sys_select+0x690/0x690 [ 1285.472176] [] do_syscall_64+0x196/0x440 [ 1285.472176] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.472176] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.472176] Memory state around the buggy address: [ 1285.472176] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.472176] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.472176] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.472176] ^ [ 1285.472176] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.472176] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.472176] ================================================================== [ 1285.576271] ================================================================== [ 1285.577263] BUG: KASAN: use-after-free in skb_release_data+0x2fb/0x320 at addr ffff880389e560dc [ 1285.577263] Read of size 4 by task httpd/819 [ 1285.577263] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.577263] flags: 0x1000000000000000() [ 1285.577263] page dumped because: kasan: bad access detected [ 1285.577263] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.577263] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.577263] dffffc0000000000 ffff8803aef072e0 ffffffff8199f263 ffff8803aef07370 [ 1285.577263] ffff880389e560dc ffff8803aef07360 ffffffff8151c33e 0000000000000286 [ 1285.577263] ffff8803aef07348 ffffed00713cac40 0000000000000282 ffffffff8151be77 [ 1285.577263] Call Trace: [ 1285.577263] [] dump_stack+0x67/0x94 [ 1285.577263] [] kasan_report_error+0x4ae/0x4e0 [ 1285.577263] [] ? kasan_end_report+0x37/0x50 [ 1285.577263] [] ? kasan_report_error+0x42d/0x4e0 [ 1285.577263] [] __asan_report_load4_noabort+0x43/0x50 [ 1285.577263] [] ? skb_release_data+0x2fb/0x320 [ 1285.577263] [] skb_release_data+0x2fb/0x320 [ 1285.577263] [] skb_release_all+0x42/0x50 [ 1285.577263] [] __kfree_skb+0x12/0x20 [ 1285.577263] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.577263] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.577263] [] tcp_ack+0x1487/0x2e60 [ 1285.577263] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.577263] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.577263] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.577263] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.577263] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.577263] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.577263] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.577263] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.577263] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.577263] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.577263] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.577263] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.577263] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.577263] [] ip_local_deliver+0x24d/0x330 [ 1285.577263] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.577263] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.577263] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.577263] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.577263] [] ip_rcv_finish+0x599/0x1870 [ 1285.577263] [] ip_rcv+0x89b/0x11d0 [ 1285.577263] [] ? ip_local_deliver+0x330/0x330 [ 1285.577263] [] ? inet_del_offload+0x40/0x40 [ 1285.577263] [] ? ip_local_deliver+0x330/0x330 [ 1285.577263] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.577263] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.577263] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.577263] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.577263] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.577263] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.577263] [] ? process_backlog+0x217/0x650 [ 1285.577263] [] __netif_receive_skb+0x5a/0x190 [ 1285.577263] [] process_backlog+0xd8/0x650 [ 1285.577263] [] ? process_backlog+0x217/0x650 [ 1285.577263] [] ? find_next_bit+0x15/0x20 [ 1285.577263] [] net_rx_action+0x655/0xde0 [ 1285.577263] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.577263] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.577263] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.577263] [] ? ktime_get+0x96/0x130 [ 1285.577263] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.577263] [] ? irq_exit+0x15c/0x190 [ 1285.577263] [] __do_softirq+0x22c/0x99f [ 1285.577263] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.577263] [] irq_exit+0x15c/0x190 [ 1285.577263] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.577263] [] apic_timer_interrupt+0x89/0x90 [ 1285.577263] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.577263] [] finish_task_switch+0x1fa/0x5a0 [ 1285.577263] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.577263] [] __schedule+0x90c/0x1b60 [ 1285.577263] [] schedule+0x9c/0x1c0 [ 1285.577263] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.577263] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.577263] [] ? __hrtimer_init+0x170/0x170 [ 1285.577263] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.577263] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.577263] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.577263] [] ? poll_freewait+0x220/0x220 [ 1285.577263] [] ? do_select+0x433/0x1390 [ 1285.577263] [] do_select+0xe16/0x1390 [ 1285.577263] [] ? do_select+0xb9/0x1390 [ 1285.577263] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.577263] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.577263] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.577263] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.577263] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.577263] [] ? print_context_stack+0x8b/0x100 [ 1285.577263] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.577263] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.577263] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.577263] [] ? dump_trace+0x113/0x2d0 [ 1285.577263] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.577263] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.577263] [] ? core_sys_select+0x170/0x690 [ 1285.577263] [] core_sys_select+0x3a6/0x690 [ 1285.577263] [] ? core_sys_select+0x75/0x690 [ 1285.577263] [] ? do_select+0x1390/0x1390 [ 1285.577263] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.577263] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.577263] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.577263] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.577263] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.577263] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.577263] [] SyS_select+0x132/0x1a0 [ 1285.577263] [] ? core_sys_select+0x690/0x690 [ 1285.577263] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.577263] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.577263] [] ? core_sys_select+0x690/0x690 [ 1285.577263] [] do_syscall_64+0x196/0x440 [ 1285.577263] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.577263] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.577263] Memory state around the buggy address: [ 1285.577263] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.577263] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.577263] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.577263] ^ [ 1285.577263] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.577263] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.577263] ================================================================== [ 1285.667059] ================================================================== [ 1285.668012] BUG: KASAN: use-after-free in skb_release_data+0x2f1/0x320 at addr ffff880389e560e0 [ 1285.668050] Read of size 8 by task httpd/819 [ 1285.668050] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.668050] flags: 0x1000000000000000() [ 1285.668050] page dumped because: kasan: bad access detected [ 1285.668050] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.668050] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.668050] dffffc0000000000 ffff8803aef072e0 ffffffff8199f263 ffff8803aef07370 [ 1285.668050] ffff880389e560e0 ffff8803aef07360 ffffffff8151c33e 0000000000000010 [ 1285.668050] ffff880300000000 ffffed00713cac1b 0000000000000282 ffffffff8151be77 [ 1285.668050] Call Trace: [ 1285.668050] [] dump_stack+0x67/0x94 [ 1285.668050] [] kasan_report_error+0x4ae/0x4e0 [ 1285.668050] [] ? kasan_end_report+0x37/0x50 [ 1285.668050] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.668050] [] ? skb_release_data+0x2f1/0x320 [ 1285.668050] [] skb_release_data+0x2f1/0x320 [ 1285.668050] [] skb_release_all+0x42/0x50 [ 1285.668050] [] __kfree_skb+0x12/0x20 [ 1285.668050] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.668050] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.668050] [] tcp_ack+0x1487/0x2e60 [ 1285.668050] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.668050] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.668050] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.668050] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.668050] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.668050] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.668050] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.668050] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.668050] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.668050] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.668050] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.668050] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.668050] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.668050] [] ip_local_deliver+0x24d/0x330 [ 1285.668050] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.668050] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.668050] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.668050] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.668050] [] ip_rcv_finish+0x599/0x1870 [ 1285.668050] [] ip_rcv+0x89b/0x11d0 [ 1285.668050] [] ? ip_local_deliver+0x330/0x330 [ 1285.668050] [] ? inet_del_offload+0x40/0x40 [ 1285.668050] [] ? ip_local_deliver+0x330/0x330 [ 1285.668050] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.668050] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.668050] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.668050] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.668050] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.668050] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.668050] [] ? process_backlog+0x217/0x650 [ 1285.668050] [] __netif_receive_skb+0x5a/0x190 [ 1285.668050] [] process_backlog+0xd8/0x650 [ 1285.668050] [] ? process_backlog+0x217/0x650 [ 1285.668050] [] ? find_next_bit+0x15/0x20 [ 1285.668050] [] net_rx_action+0x655/0xde0 [ 1285.668050] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.668050] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.668050] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.668050] [] ? ktime_get+0x96/0x130 [ 1285.668050] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.668050] [] ? irq_exit+0x15c/0x190 [ 1285.668050] [] __do_softirq+0x22c/0x99f [ 1285.668050] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.668050] [] irq_exit+0x15c/0x190 [ 1285.668050] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.668050] [] apic_timer_interrupt+0x89/0x90 [ 1285.668050] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.668050] [] finish_task_switch+0x1fa/0x5a0 [ 1285.668050] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.668050] [] __schedule+0x90c/0x1b60 [ 1285.668050] [] schedule+0x9c/0x1c0 [ 1285.668050] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.668050] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.668050] [] ? __hrtimer_init+0x170/0x170 [ 1285.668050] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.668050] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.668050] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.668050] [] ? poll_freewait+0x220/0x220 [ 1285.668050] [] ? do_select+0x433/0x1390 [ 1285.668050] [] do_select+0xe16/0x1390 [ 1285.668050] [] ? do_select+0xb9/0x1390 [ 1285.668050] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.668050] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.668050] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.668050] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.668050] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.668050] [] ? print_context_stack+0x8b/0x100 [ 1285.668050] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.668050] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.668050] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.668050] [] ? dump_trace+0x113/0x2d0 [ 1285.668050] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.668050] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.668050] [] ? core_sys_select+0x170/0x690 [ 1285.668050] [] core_sys_select+0x3a6/0x690 [ 1285.668050] [] ? core_sys_select+0x75/0x690 [ 1285.668050] [] ? do_select+0x1390/0x1390 [ 1285.668050] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.668050] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.668050] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.668050] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.668050] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.668050] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.668050] [] SyS_select+0x132/0x1a0 [ 1285.668050] [] ? core_sys_select+0x690/0x690 [ 1285.668050] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.668050] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.668050] [] ? core_sys_select+0x690/0x690 [ 1285.668050] [] do_syscall_64+0x196/0x440 [ 1285.668050] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.668050] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.668050] Memory state around the buggy address: [ 1285.668050] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.668050] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.668050] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.668050] ^ [ 1285.668050] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.668050] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.668050] ================================================================== [ 1285.762952] ================================================================== [ 1285.763927] BUG: KASAN: use-after-free in skb_release_data+0x2d0/0x320 at addr ffff880389e5609e [ 1285.763943] Read of size 1 by task httpd/819 [ 1285.763943] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.763943] flags: 0x1000000000000000() [ 1285.763943] page dumped because: kasan: bad access detected [ 1285.763943] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.763943] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.763943] dffffc0000000000 ffff8803aef072e0 ffffffff8199f263 ffff8803aef07370 [ 1285.763943] ffff880389e5609e ffff8803aef07360 ffffffff8151c33e 0000000000000010 [ 1285.763943] ffff880300000000 ffffed00713cac1c 0000000000000282 ffffffff8151be77 [ 1285.763943] Call Trace: [ 1285.763943] [] dump_stack+0x67/0x94 [ 1285.763943] [] kasan_report_error+0x4ae/0x4e0 [ 1285.763943] [] ? kasan_end_report+0x37/0x50 [ 1285.763943] [] __asan_report_load1_noabort+0x43/0x50 [ 1285.763943] [] ? skb_release_data+0x2d0/0x320 [ 1285.763943] [] skb_release_data+0x2d0/0x320 [ 1285.763943] [] skb_release_all+0x42/0x50 [ 1285.763943] [] __kfree_skb+0x12/0x20 [ 1285.763943] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.763943] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.763943] [] tcp_ack+0x1487/0x2e60 [ 1285.763943] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.763943] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.763943] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.763943] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.763943] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.763943] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.763943] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.763943] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.763943] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.763943] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.763943] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.763943] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.763943] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.763943] [] ip_local_deliver+0x24d/0x330 [ 1285.763943] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.763943] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.763943] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.763943] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.763943] [] ip_rcv_finish+0x599/0x1870 [ 1285.763943] [] ip_rcv+0x89b/0x11d0 [ 1285.763943] [] ? ip_local_deliver+0x330/0x330 [ 1285.763943] [] ? inet_del_offload+0x40/0x40 [ 1285.763943] [] ? ip_local_deliver+0x330/0x330 [ 1285.763943] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.763943] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.763943] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.763943] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.763943] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.763943] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.763943] [] ? process_backlog+0x217/0x650 [ 1285.763943] [] __netif_receive_skb+0x5a/0x190 [ 1285.763943] [] process_backlog+0xd8/0x650 [ 1285.763943] [] ? process_backlog+0x217/0x650 [ 1285.763943] [] ? find_next_bit+0x15/0x20 [ 1285.763943] [] net_rx_action+0x655/0xde0 [ 1285.763943] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.763943] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.763943] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.763943] [] ? ktime_get+0x96/0x130 [ 1285.763943] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.763943] [] ? irq_exit+0x15c/0x190 [ 1285.763943] [] __do_softirq+0x22c/0x99f [ 1285.763943] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.763943] [] irq_exit+0x15c/0x190 [ 1285.763943] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.763943] [] apic_timer_interrupt+0x89/0x90 [ 1285.763943] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.763943] [] finish_task_switch+0x1fa/0x5a0 [ 1285.763943] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.763943] [] __schedule+0x90c/0x1b60 [ 1285.763943] [] schedule+0x9c/0x1c0 [ 1285.763943] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.763943] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.763943] [] ? __hrtimer_init+0x170/0x170 [ 1285.763943] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.763943] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.763943] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.763943] [] ? poll_freewait+0x220/0x220 [ 1285.763943] [] ? do_select+0x433/0x1390 [ 1285.763943] [] do_select+0xe16/0x1390 [ 1285.763943] [] ? do_select+0xb9/0x1390 [ 1285.763943] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.763943] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.763943] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.763943] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.763943] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.763943] [] ? print_context_stack+0x8b/0x100 [ 1285.763943] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.763943] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.763943] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.763943] [] ? dump_trace+0x113/0x2d0 [ 1285.763943] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.763943] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.763943] [] ? core_sys_select+0x170/0x690 [ 1285.763943] [] core_sys_select+0x3a6/0x690 [ 1285.763943] [] ? core_sys_select+0x75/0x690 [ 1285.763943] [] ? do_select+0x1390/0x1390 [ 1285.763943] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.763943] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.763943] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.763943] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.763943] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.763943] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.763943] [] SyS_select+0x132/0x1a0 [ 1285.763943] [] ? core_sys_select+0x690/0x690 [ 1285.763943] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.763943] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.763943] [] ? core_sys_select+0x690/0x690 [ 1285.763943] [] do_syscall_64+0x196/0x440 [ 1285.763943] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.763943] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.763943] Memory state around the buggy address: [ 1285.763943] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.763943] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.763943] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.763943] ^ [ 1285.763943] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.763943] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.763943] ================================================================== [ 1285.857091] ================================================================== [ 1285.858064] BUG: KASAN: use-after-free in skb_free_head+0x8a/0x90 at addr ffff880389e560e0 [ 1285.858080] Read of size 8 by task httpd/819 [ 1285.858080] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.858080] flags: 0x1000000000000000() [ 1285.858080] page dumped because: kasan: bad access detected [ 1285.858080] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.858080] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.858080] 0000000000000004 ffff8803aef072c0 ffffffff8199f263 ffff8803aef07350 [ 1285.858080] ffff880389e560e0 ffff8803aef07340 ffffffff8151c33e ffffffff8151be77 [ 1285.858080] ffffed00713cac30 ffff8803aef07360 0000000000000286 0000000000000010 [ 1285.858080] Call Trace: [ 1285.858080] [] dump_stack+0x67/0x94 [ 1285.858080] [] kasan_report_error+0x4ae/0x4e0 [ 1285.858080] [] ? kasan_end_report+0x37/0x50 [ 1285.858080] [] ? kasan_end_report+0x37/0x50 [ 1285.858080] [] __asan_report_load8_noabort+0x43/0x50 [ 1285.858080] [] ? kasan_report_error+0x470/0x4e0 [ 1285.858080] [] ? skb_free_head+0x8a/0x90 [ 1285.858080] [] skb_free_head+0x8a/0x90 [ 1285.858080] [] skb_release_data+0x22c/0x320 [ 1285.858080] [] skb_release_all+0x42/0x50 [ 1285.858080] [] __kfree_skb+0x12/0x20 [ 1285.858080] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.858080] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.858080] [] tcp_ack+0x1487/0x2e60 [ 1285.858080] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.858080] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.858080] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.858080] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.858080] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.858080] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.858080] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.858080] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.858080] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.858080] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.858080] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.858080] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.858080] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.858080] [] ip_local_deliver+0x24d/0x330 [ 1285.858080] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.858080] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.858080] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.858080] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.858080] [] ip_rcv_finish+0x599/0x1870 [ 1285.858080] [] ip_rcv+0x89b/0x11d0 [ 1285.858080] [] ? ip_local_deliver+0x330/0x330 [ 1285.858080] [] ? inet_del_offload+0x40/0x40 [ 1285.858080] [] ? ip_local_deliver+0x330/0x330 [ 1285.858080] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.858080] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.858080] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.858080] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.858080] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.858080] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.858080] [] ? process_backlog+0x217/0x650 [ 1285.858080] [] __netif_receive_skb+0x5a/0x190 [ 1285.858080] [] process_backlog+0xd8/0x650 [ 1285.858080] [] ? process_backlog+0x217/0x650 [ 1285.858080] [] ? find_next_bit+0x15/0x20 [ 1285.858080] [] net_rx_action+0x655/0xde0 [ 1285.858080] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.858080] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.858080] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.858080] [] ? ktime_get+0x96/0x130 [ 1285.858080] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.858080] [] ? irq_exit+0x15c/0x190 [ 1285.858080] [] __do_softirq+0x22c/0x99f [ 1285.858080] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.858080] [] irq_exit+0x15c/0x190 [ 1285.858080] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.858080] [] apic_timer_interrupt+0x89/0x90 [ 1285.858080] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.858080] [] finish_task_switch+0x1fa/0x5a0 [ 1285.858080] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.858080] [] __schedule+0x90c/0x1b60 [ 1285.858080] [] schedule+0x9c/0x1c0 [ 1285.858080] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.858080] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.858080] [] ? __hrtimer_init+0x170/0x170 [ 1285.858080] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.858080] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.858080] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.858080] [] ? poll_freewait+0x220/0x220 [ 1285.858080] [] ? do_select+0x433/0x1390 [ 1285.858080] [] do_select+0xe16/0x1390 [ 1285.858080] [] ? do_select+0xb9/0x1390 [ 1285.858080] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.858080] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.858080] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.858080] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.858080] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.858080] [] ? print_context_stack+0x8b/0x100 [ 1285.858080] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.858080] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.858080] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.858080] [] ? dump_trace+0x113/0x2d0 [ 1285.858080] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.858080] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.858080] [] ? core_sys_select+0x170/0x690 [ 1285.858080] [] core_sys_select+0x3a6/0x690 [ 1285.858080] [] ? core_sys_select+0x75/0x690 [ 1285.858080] [] ? do_select+0x1390/0x1390 [ 1285.858080] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.858080] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.858080] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.858080] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.858080] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.858080] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.858080] [] SyS_select+0x132/0x1a0 [ 1285.858080] [] ? core_sys_select+0x690/0x690 [ 1285.858080] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.858080] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.858080] [] ? core_sys_select+0x690/0x690 [ 1285.858080] [] do_syscall_64+0x196/0x440 [ 1285.858080] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.858080] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.858080] Memory state around the buggy address: [ 1285.858080] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.858080] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.858080] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.858080] ^ [ 1285.858080] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.858080] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.858080] ================================================================== [ 1285.953248] ================================================================== [ 1285.954212] BUG: KASAN: use-after-free in skb_free_head+0x83/0x90 at addr ffff880389e5609e [ 1285.954238] Read of size 1 by task httpd/819 [ 1285.954238] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1285.954238] flags: 0x1000000000000000() [ 1285.954238] page dumped because: kasan: bad access detected [ 1285.954238] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1285.954238] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1285.954238] 0000000000000004 ffff8803aef072c0 ffffffff8199f263 ffff8803aef07350 [ 1285.954238] ffff880389e5609e ffff8803aef07340 ffffffff8151c33e 0000000000000010 [ 1285.954238] ffffed0000000000 ffffed00713cac1c 0000000000000286 ffffffff00000010 [ 1285.954238] Call Trace: [ 1285.954238] [] dump_stack+0x67/0x94 [ 1285.954238] [] kasan_report_error+0x4ae/0x4e0 [ 1285.954238] [] __asan_report_load1_noabort+0x43/0x50 [ 1285.954238] [] ? kasan_report_error+0x470/0x4e0 [ 1285.954238] [] ? skb_free_head+0x83/0x90 [ 1285.954238] [] skb_free_head+0x83/0x90 [ 1285.954238] [] skb_release_data+0x22c/0x320 [ 1285.954238] [] skb_release_all+0x42/0x50 [ 1285.954238] [] __kfree_skb+0x12/0x20 [ 1285.954238] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1285.954238] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1285.954238] [] tcp_ack+0x1487/0x2e60 [ 1285.954238] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.954238] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1285.954238] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.954238] [] tcp_rcv_established+0x58c/0x2de0 [ 1285.954238] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1285.954238] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1285.954238] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1285.954238] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1285.954238] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1285.954238] [] tcp_v4_rcv+0x213e/0x3420 [ 1285.954238] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1285.954238] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1285.954238] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1285.954238] [] ip_local_deliver+0x24d/0x330 [ 1285.954238] [] ? ip_call_ra_chain+0x510/0x510 [ 1285.954238] [] ? nf_hook_slow+0x186/0x2a0 [ 1285.954238] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1285.954238] [] ? nf_hook_slow+0x5/0x2a0 [ 1285.954238] [] ip_rcv_finish+0x599/0x1870 [ 1285.954238] [] ip_rcv+0x89b/0x11d0 [ 1285.954238] [] ? ip_local_deliver+0x330/0x330 [ 1285.954238] [] ? inet_del_offload+0x40/0x40 [ 1285.954238] [] ? ip_local_deliver+0x330/0x330 [ 1285.954238] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1285.954238] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.954238] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.954238] [] ? net_tx_action+0x9d0/0x9d0 [ 1285.954238] [] ? default_send_IPI_single+0x75/0xa0 [ 1285.954238] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1285.954238] [] ? process_backlog+0x217/0x650 [ 1285.954238] [] __netif_receive_skb+0x5a/0x190 [ 1285.954238] [] process_backlog+0xd8/0x650 [ 1285.954238] [] ? process_backlog+0x217/0x650 [ 1285.954238] [] ? find_next_bit+0x15/0x20 [ 1285.954238] [] net_rx_action+0x655/0xde0 [ 1285.954238] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1285.954238] [] ? sk_busy_loop+0xb90/0xb90 [ 1285.954238] [] ? trace_hardirqs_off+0xd/0x10 [ 1285.954238] [] ? ktime_get+0x96/0x130 [ 1285.954238] [] ? clockevents_program_event+0x1cf/0x300 [ 1285.954238] [] ? irq_exit+0x15c/0x190 [ 1285.954238] [] __do_softirq+0x22c/0x99f [ 1285.954238] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1285.954238] [] irq_exit+0x15c/0x190 [ 1285.954238] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1285.954238] [] apic_timer_interrupt+0x89/0x90 [ 1285.954238] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1285.954238] [] finish_task_switch+0x1fa/0x5a0 [ 1285.954238] [] ? finish_task_switch+0x1ce/0x5a0 [ 1285.954238] [] __schedule+0x90c/0x1b60 [ 1285.954238] [] schedule+0x9c/0x1c0 [ 1285.954238] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1285.954238] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1285.954238] [] ? __hrtimer_init+0x170/0x170 [ 1285.954238] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1285.954238] [] schedule_hrtimeout_range+0x13/0x20 [ 1285.954238] [] poll_schedule_timeout+0xf4/0x1f0 [ 1285.954238] [] ? poll_freewait+0x220/0x220 [ 1285.954238] [] ? do_select+0x433/0x1390 [ 1285.954238] [] do_select+0xe16/0x1390 [ 1285.954238] [] ? do_select+0xb9/0x1390 [ 1285.954238] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.954238] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1285.954238] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1285.954238] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.954238] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1285.954238] [] ? print_context_stack+0x8b/0x100 [ 1285.954238] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.954238] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1285.954238] [] ? __lock_acquire+0xaa6/0x3a90 [ 1285.954238] [] ? dump_trace+0x113/0x2d0 [ 1285.954238] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1285.954238] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.954238] [] ? core_sys_select+0x170/0x690 [ 1285.954238] [] core_sys_select+0x3a6/0x690 [ 1285.954238] [] ? core_sys_select+0x75/0x690 [ 1285.954238] [] ? do_select+0x1390/0x1390 [ 1285.954238] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1285.954238] [] ? ktime_get_ts64+0x8c/0x220 [ 1285.954238] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1285.954238] [] ? trace_hardirqs_on+0xd/0x10 [ 1285.954238] [] ? ktime_get_ts64+0xc2/0x220 [ 1285.954238] [] ? poll_select_set_timeout+0x87/0xc0 [ 1285.954238] [] SyS_select+0x132/0x1a0 [ 1285.954238] [] ? core_sys_select+0x690/0x690 [ 1285.954238] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1285.954238] [] ? syscall_trace_enter+0x351/0x8e0 [ 1285.954238] [] ? core_sys_select+0x690/0x690 [ 1285.954238] [] do_syscall_64+0x196/0x440 [ 1285.954238] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1285.954238] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1285.954238] Memory state around the buggy address: [ 1285.954238] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1285.954238] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.954238] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.954238] ^ [ 1285.954238] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.954238] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1285.954238] ================================================================== [ 1286.047833] ================================================================== [ 1286.048793] BUG: KASAN: use-after-free in kfree_skbmem+0x2ae/0x330 at addr ffff880389e5609e [ 1286.048823] Read of size 1 by task httpd/819 [ 1286.048823] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1286.048823] flags: 0x1000000000000000() [ 1286.048823] page dumped because: kasan: bad access detected [ 1286.048823] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1286.048823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1286.048823] dffffc0000000000 ffff8803aef07318 ffffffff8199f263 ffff8803aef073a8 [ 1286.048823] ffff880389e5609e ffff8803aef07398 ffffffff8151c33e 0000000000000004 [ 1286.048823] dffffc0000000000 dffffc0000000000 0000000000000296 ffffffff8151c3b3 [ 1286.048823] Call Trace: [ 1286.048823] [] dump_stack+0x67/0x94 [ 1286.048823] [] kasan_report_error+0x4ae/0x4e0 [ 1286.048823] [] ? __asan_report_load1_noabort+0x43/0x50 [ 1286.048823] [] ? kasan_report_error+0x470/0x4e0 [ 1286.048823] [] __asan_report_load1_noabort+0x43/0x50 [ 1286.048823] [] ? kfree_skbmem+0x2ae/0x330 [ 1286.048823] [] kfree_skbmem+0x2ae/0x330 [ 1286.048823] [] __kfree_skb+0x1a/0x20 [ 1286.048823] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1286.048823] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1286.048823] [] tcp_ack+0x1487/0x2e60 [ 1286.048823] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.048823] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1286.048823] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.048823] [] tcp_rcv_established+0x58c/0x2de0 [ 1286.048823] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1286.048823] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1286.048823] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1286.048823] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1286.048823] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1286.048823] [] tcp_v4_rcv+0x213e/0x3420 [ 1286.048823] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1286.048823] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1286.048823] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1286.048823] [] ip_local_deliver+0x24d/0x330 [ 1286.048823] [] ? ip_call_ra_chain+0x510/0x510 [ 1286.048823] [] ? nf_hook_slow+0x186/0x2a0 [ 1286.048823] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1286.048823] [] ? nf_hook_slow+0x5/0x2a0 [ 1286.048823] [] ip_rcv_finish+0x599/0x1870 [ 1286.048823] [] ip_rcv+0x89b/0x11d0 [ 1286.048823] [] ? ip_local_deliver+0x330/0x330 [ 1286.048823] [] ? inet_del_offload+0x40/0x40 [ 1286.048823] [] ? ip_local_deliver+0x330/0x330 [ 1286.048823] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1286.048823] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.048823] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.048823] [] ? net_tx_action+0x9d0/0x9d0 [ 1286.048823] [] ? default_send_IPI_single+0x75/0xa0 [ 1286.048823] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1286.048823] [] ? process_backlog+0x217/0x650 [ 1286.048823] [] __netif_receive_skb+0x5a/0x190 [ 1286.048823] [] process_backlog+0xd8/0x650 [ 1286.048823] [] ? process_backlog+0x217/0x650 [ 1286.048823] [] ? find_next_bit+0x15/0x20 [ 1286.048823] [] net_rx_action+0x655/0xde0 [ 1286.048823] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1286.048823] [] ? sk_busy_loop+0xb90/0xb90 [ 1286.048823] [] ? trace_hardirqs_off+0xd/0x10 [ 1286.048823] [] ? ktime_get+0x96/0x130 [ 1286.048823] [] ? clockevents_program_event+0x1cf/0x300 [ 1286.048823] [] ? irq_exit+0x15c/0x190 [ 1286.048823] [] __do_softirq+0x22c/0x99f [ 1286.048823] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1286.048823] [] irq_exit+0x15c/0x190 [ 1286.048823] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1286.048823] [] apic_timer_interrupt+0x89/0x90 [ 1286.048823] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1286.048823] [] finish_task_switch+0x1fa/0x5a0 [ 1286.048823] [] ? finish_task_switch+0x1ce/0x5a0 [ 1286.048823] [] __schedule+0x90c/0x1b60 [ 1286.048823] [] schedule+0x9c/0x1c0 [ 1286.048823] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1286.048823] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1286.048823] [] ? __hrtimer_init+0x170/0x170 [ 1286.048823] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1286.048823] [] schedule_hrtimeout_range+0x13/0x20 [ 1286.048823] [] poll_schedule_timeout+0xf4/0x1f0 [ 1286.048823] [] ? poll_freewait+0x220/0x220 [ 1286.048823] [] ? do_select+0x433/0x1390 [ 1286.048823] [] do_select+0xe16/0x1390 [ 1286.048823] [] ? do_select+0xb9/0x1390 [ 1286.048823] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1286.048823] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1286.048823] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1286.048823] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.048823] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1286.048823] [] ? print_context_stack+0x8b/0x100 [ 1286.048823] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.048823] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1286.048823] [] ? __lock_acquire+0xaa6/0x3a90 [ 1286.048823] [] ? dump_trace+0x113/0x2d0 [ 1286.048823] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.048823] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.048823] [] ? core_sys_select+0x170/0x690 [ 1286.048823] [] core_sys_select+0x3a6/0x690 [ 1286.048823] [] ? core_sys_select+0x75/0x690 [ 1286.048823] [] ? do_select+0x1390/0x1390 [ 1286.048823] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.048823] [] ? ktime_get_ts64+0x8c/0x220 [ 1286.048823] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1286.048823] [] ? trace_hardirqs_on+0xd/0x10 [ 1286.048823] [] ? ktime_get_ts64+0xc2/0x220 [ 1286.048823] [] ? poll_select_set_timeout+0x87/0xc0 [ 1286.048823] [] SyS_select+0x132/0x1a0 [ 1286.048823] [] ? core_sys_select+0x690/0x690 [ 1286.048823] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1286.048823] [] ? syscall_trace_enter+0x351/0x8e0 [ 1286.048823] [] ? core_sys_select+0x690/0x690 [ 1286.048823] [] do_syscall_64+0x196/0x440 [ 1286.048823] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1286.048823] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1286.048823] Memory state around the buggy address: [ 1286.048823] ffff880389e55f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1286.048823] ffff880389e56000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.048823] >ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.048823] ^ [ 1286.048823] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.048823] ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.048823] ================================================================== [ 1286.134992] ================================================================== [ 1286.135942] BUG: KASAN: use-after-free in kfree_skbmem+0x2dc/0x330 at addr ffff880389e561f0 [ 1286.135984] Read of size 4 by task httpd/819 [ 1286.135984] page:ffffea000e279580 count:0 mapcount:0 mapping: (null) index:0x0 [ 1286.135984] flags: 0x1000000000000000() [ 1286.135984] page dumped because: kasan: bad access detected [ 1286.135984] CPU: 2 PID: 819 Comm: httpd Tainted: G B O 4.8.15-ab+ #5 [ 1286.135984] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1286.135984] dffffc0000000000 ffff8803aef07318 ffffffff8199f263 ffff8803aef073a8 [ 1286.135984] ffff880389e561f0 ffff8803aef07398 ffffffff8151c33e 0000000000000010 [ 1286.135984] dffffc0000000000 ffffed00713cac13 0000000000000296 ffffffff8151c3b3 [ 1286.135984] Call Trace: [ 1286.135984] [] dump_stack+0x67/0x94 [ 1286.135984] [] kasan_report_error+0x4ae/0x4e0 [ 1286.135984] [] ? __asan_report_load1_noabort+0x43/0x50 [ 1286.135984] [] __asan_report_load4_noabort+0x43/0x50 [ 1286.135984] [] ? kfree_skbmem+0x2dc/0x330 [ 1286.135984] [] kfree_skbmem+0x2dc/0x330 [ 1286.135984] [] __kfree_skb+0x1a/0x20 [ 1286.135984] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 1286.135984] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 1286.135984] [] tcp_ack+0x1487/0x2e60 [ 1286.135984] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.135984] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1286.135984] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.135984] [] tcp_rcv_established+0x58c/0x2de0 [ 1286.135984] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1286.135984] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1286.135984] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1286.135984] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1286.135984] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1286.135984] [] tcp_v4_rcv+0x213e/0x3420 [ 1286.135984] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1286.135984] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1286.135984] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1286.135984] [] ip_local_deliver+0x24d/0x330 [ 1286.135984] [] ? ip_call_ra_chain+0x510/0x510 [ 1286.135984] [] ? nf_hook_slow+0x186/0x2a0 [ 1286.135984] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1286.135984] [] ? nf_hook_slow+0x5/0x2a0 [ 1286.135984] [] ip_rcv_finish+0x599/0x1870 [ 1286.135984] [] ip_rcv+0x89b/0x11d0 [ 1286.135984] [] ? ip_local_deliver+0x330/0x330 [ 1286.135984] [] ? inet_del_offload+0x40/0x40 [ 1286.135984] [] ? ip_local_deliver+0x330/0x330 [ 1286.135984] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1286.135984] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.135984] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.135984] [] ? net_tx_action+0x9d0/0x9d0 [ 1286.135984] [] ? default_send_IPI_single+0x75/0xa0 [ 1286.135984] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 1286.135984] [] ? process_backlog+0x217/0x650 [ 1286.135984] [] __netif_receive_skb+0x5a/0x190 [ 1286.135984] [] process_backlog+0xd8/0x650 [ 1286.135984] [] ? process_backlog+0x217/0x650 [ 1286.135984] [] ? find_next_bit+0x15/0x20 [ 1286.135984] [] net_rx_action+0x655/0xde0 [ 1286.135984] [] ? enqueue_hrtimer+0x134/0x3a0 [ 1286.135984] [] ? sk_busy_loop+0xb90/0xb90 [ 1286.135984] [] ? trace_hardirqs_off+0xd/0x10 [ 1286.135984] [] ? ktime_get+0x96/0x130 [ 1286.135984] [] ? clockevents_program_event+0x1cf/0x300 [ 1286.135984] [] ? irq_exit+0x15c/0x190 [ 1286.135984] [] __do_softirq+0x22c/0x99f [ 1286.135984] [] ? hrtimer_interrupt+0x1bc/0x440 [ 1286.135984] [] irq_exit+0x15c/0x190 [ 1286.135984] [] smp_apic_timer_interrupt+0x80/0xa0 [ 1286.135984] [] apic_timer_interrupt+0x89/0x90 [ 1286.135984] [] ? _raw_spin_unlock_irq+0x34/0x40 [ 1286.135984] [] finish_task_switch+0x1fa/0x5a0 [ 1286.135984] [] ? finish_task_switch+0x1ce/0x5a0 [ 1286.135984] [] __schedule+0x90c/0x1b60 [ 1286.135984] [] schedule+0x9c/0x1c0 [ 1286.135984] [] schedule_hrtimeout_range_clock+0x222/0x5f0 [ 1286.135984] [] ? hrtimer_nanosleep_restart+0x440/0x440 [ 1286.135984] [] ? __hrtimer_init+0x170/0x170 [ 1286.135984] [] ? schedule_hrtimeout_range_clock+0x215/0x5f0 [ 1286.135984] [] schedule_hrtimeout_range+0x13/0x20 [ 1286.135984] [] poll_schedule_timeout+0xf4/0x1f0 [ 1286.135984] [] ? poll_freewait+0x220/0x220 [ 1286.135984] [] ? do_select+0x433/0x1390 [ 1286.135984] [] do_select+0xe16/0x1390 [ 1286.135984] [] ? do_select+0xb9/0x1390 [ 1286.135984] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1286.135984] [] ? ep_poll_callback+0x1d2/0x6e0 [ 1286.135984] [] ? _raw_spin_unlock_irqrestore+0x36/0x50 [ 1286.135984] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.135984] [] ? poll_select_set_timeout+0xc0/0xc0 [ 1286.135984] [] ? print_context_stack+0x8b/0x100 [ 1286.135984] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.135984] [] ? is_ftrace_trampoline+0x99/0xe0 [ 1286.135984] [] ? __lock_acquire+0xaa6/0x3a90 [ 1286.135984] [] ? dump_trace+0x113/0x2d0 [ 1286.135984] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1286.135984] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.135984] [] ? core_sys_select+0x170/0x690 [ 1286.135984] [] core_sys_select+0x3a6/0x690 [ 1286.135984] [] ? core_sys_select+0x75/0x690 [ 1286.135984] [] ? do_select+0x1390/0x1390 [ 1286.135984] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 1286.135984] [] ? ktime_get_ts64+0x8c/0x220 [ 1286.135984] [] ? trace_hardirqs_on_caller+0x3f9/0x580 [ 1286.135984] [] ? trace_hardirqs_on+0xd/0x10 [ 1286.135984] [] ? ktime_get_ts64+0xc2/0x220 [ 1286.135984] [] ? poll_select_set_timeout+0x87/0xc0 [ 1286.135984] [] SyS_select+0x132/0x1a0 [ 1286.135984] [] ? core_sys_select+0x690/0x690 [ 1286.135984] [] ? __audit_syscall_exit+0x6ae/0x930 [ 1286.135984] [] ? syscall_trace_enter+0x351/0x8e0 [ 1286.135984] [] ? core_sys_select+0x690/0x690 [ 1286.135984] [] do_syscall_64+0x196/0x440 [ 1286.135984] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1286.135984] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1286.135984] Memory state around the buggy address: [ 1286.135984] ffff880389e56080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.135984] ffff880389e56100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.135984] >ffff880389e56180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.135984] ^ [ 1286.135984] ffff880389e56200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.135984] ffff880389e56280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1286.135984] ================================================================== [ 1828.192739] ================================================================== [ 1828.193287] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff880380e17c14 [ 1828.193287] Read of size 4 by task nginx/887 [ 1828.193287] page:ffffea000e0385c0 count:2 mapcount:0 mapping: (null) index:0x0 [ 1828.193287] flags: 0x1000000000000000() [ 1828.193287] page dumped because: kasan: bad access detected [ 1828.193287] CPU: 1 PID: 887 Comm: nginx Tainted: G B O 4.8.15-ab+ #5 [ 1828.193287] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1828.193287] ffff880380e17c00 ffff8803aee87450 ffffffff8199f263 ffff8803aee874e0 [ 1828.193287] ffff880380e17c14 ffff8803aee874d0 ffffffff8151c33e ffffffff81216ec0 [ 1828.193287] 0000000000000046 0000000000000000 0000000000000282 ffff880300000000 [ 1828.193287] Call Trace: [ 1828.193287] [] dump_stack+0x67/0x94 [ 1828.193287] [] kasan_report_error+0x4ae/0x4e0 [ 1828.193287] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1828.193287] [] __asan_report_load4_noabort+0x43/0x50 [ 1828.193287] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1828.193287] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 1828.193287] [] tcp_ack+0x22a9/0x2e60 [ 1828.193287] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 1828.223784] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1828.223784] [] tcp_rcv_established+0x58c/0x2de0 [ 1828.223784] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 1828.223784] [] ? sk_filter_trim_cap+0xd6/0x700 [ 1828.223784] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 1828.223784] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 1828.223784] [] tcp_v4_do_rcv+0x529/0x8c0 [ 1828.223784] [] tcp_v4_rcv+0x213e/0x3420 [ 1828.223784] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 1828.223784] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 1828.223784] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 1828.223784] [] ip_local_deliver+0x24d/0x330 [ 1828.223784] [] ? ip_call_ra_chain+0x510/0x510 [ 1828.223784] [] ? nf_hook_slow+0x186/0x2a0 [ 1828.223784] [] ? nf_hook_slow+0x1a5/0x2a0 [ 1828.223784] [] ? nf_hook_slow+0x5/0x2a0 [ 1828.223784] [] ip_rcv_finish+0x599/0x1870 [ 1828.223784] [] ip_rcv+0x89b/0x11d0 [ 1828.223784] [] ? ip_local_deliver+0x330/0x330 [ 1828.223784] [] ? inet_del_offload+0x40/0x40 [ 1828.223784] [] ? ip_local_deliver+0x330/0x330 [ 1828.223784] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 1828.223784] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1828.223784] [] ? debug_check_no_locks_freed+0x280/0x280 [ 1828.223784] [] ? sk_reset_timer+0x18/0x30 [ 1828.223784] [] ? net_tx_action+0x9d0/0x9d0 [ 1828.223784] [] ? tcp_write_xmit+0x6eb/0x4d10 [ 1828.223784] [] ? tcp_v4_md5_lookup+0x13/0x20 [ 1828.223784] [] ? tcp_established_options+0x94/0x3f0 [ 1828.223784] [] ? process_backlog+0x217/0x650 [ 1828.223784] [] __netif_receive_skb+0x5a/0x190 [ 1828.223784] [] process_backlog+0xd8/0x650 [ 1828.223784] [] ? process_backlog+0x217/0x650 [ 1828.223784] [] ? tfw_wq_pop+0x14a/0x290 [tempesta_fw] [ 1828.223784] [] net_rx_action+0x655/0xde0 [ 1828.223784] [] ? sk_busy_loop+0xb90/0xb90 [ 1828.223784] [] ? __kernel_fpu_end_bh+0x98/0x170 [ 1828.223784] [] ? irq_exit+0x15c/0x190 [ 1828.223784] [] __do_softirq+0x22c/0x99f [ 1828.223784] [] ? __raise_softirq_irqoff+0x12c/0x220 [ 1828.223784] [] irq_exit+0x15c/0x190 [ 1828.223784] [] smp_call_function_single_interrupt+0x70/0x90 [ 1828.223784] [] call_function_single_interrupt+0x89/0x90 [ 1828.223784] [] ? generic_file_splice_read+0x61/0x1e0 [ 1828.223784] [] ? rw_verify_area+0xbd/0x2b0 [ 1828.223784] [] do_splice_to+0xe8/0x140 [ 1828.223784] [] splice_direct_to_actor+0x23a/0x7c0 [ 1828.223784] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 1828.223784] [] ? do_splice_to+0x140/0x140 [ 1828.223784] [] ? rw_verify_area+0xbd/0x2b0 [ 1828.223784] [] do_splice_direct+0x153/0x270 [ 1828.223784] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 1828.223784] [] ? rw_verify_area+0xbd/0x2b0 [ 1828.223784] [] do_sendfile+0x4c5/0xe40 [ 1828.223784] [] ? do_compat_pwritev64.isra.25+0xc0/0xc0 [ 1828.223784] [] ? __might_fault+0xcb/0x1b0 [ 1828.223784] [] ? __might_fault+0xf6/0x1b0 [ 1828.223784] [] SyS_sendfile64+0xbb/0x130 [ 1828.223784] [] ? SyS_sendfile+0x120/0x120 [ 1828.223784] [] ? syscall_trace_enter+0x351/0x8e0 [ 1828.223784] [] ? syscall_slow_exit_work+0x25e/0x300 [ 1828.223784] [] ? SyS_sendfile+0x120/0x120 [ 1828.223784] [] do_syscall_64+0x196/0x440 [ 1828.223784] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1828.223784] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 1828.223784] Memory state around the buggy address: [ 1828.223784] ffff880380e17b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1828.223784] ffff880380e17b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1828.223784] >ffff880380e17c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1828.223784] ^ [ 1828.223784] ffff880380e17c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1828.223784] ffff880380e17d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1828.223784] ================================================================== [ 2825.146723] INFO: NMI handler (perf_event_nmi_handler) took too long to run: 1.544 msecs [ 2825.146723] perf: interrupt took too long (25954 > 15698), lowering kernel.perf_event_max_sample_rate to 7000 [ 2834.958773] [tempesta] Warning: Unable to find a back end server [ 2834.961302] [tempesta] Warning: Unable to find a back end server [ 2872.625407] ================================================================== [ 2872.626012] BUG: KASAN: use-after-free in tcp_rearm_rto.part.59+0x24a/0x2a0 at addr ffff8803795bb014 [ 2872.626012] Read of size 4 by task ksoftirqd/3/28 [ 2872.626012] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.626012] flags: 0x1000000000000000() [ 2872.626012] page dumped because: kasan: bad access detected [ 2872.626012] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.626012] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.626012] ffff8803795bb000 ffff88038ca17208 ffffffff8199f263 ffff88038ca17298 [ 2872.626012] ffff8803795bb014 ffff88038ca17288 ffffffff8151c33e ffffffff8211b9ba [ 2872.626012] ffffffff82150069 ffffffff8215494e 0000000000000296 ffffffff820a4abd [ 2872.626012] Call Trace: [ 2872.626012] [] dump_stack+0x67/0x94 [ 2872.626012] [] kasan_report_error+0x4ae/0x4e0 [ 2872.626012] [] ? tcp_rcv_established+0x10ca/0x2de0 [ 2872.626012] [] ? tcp_v4_do_rcv+0x529/0x8c0 [ 2872.626012] [] ? tcp_v4_rcv+0x213e/0x3420 [ 2872.626012] [] ? ip_local_deliver+0x24d/0x330 [ 2872.626012] [] ? ip_rcv_finish+0x599/0x1870 [ 2872.626012] [] ? ip_rcv+0x89b/0x11d0 [ 2872.626012] [] ? __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.626012] [] ? __netif_receive_skb+0x5a/0x190 [ 2872.626012] [] __asan_report_load4_noabort+0x43/0x50 [ 2872.626012] [] ? tcp_rearm_rto.part.59+0x24a/0x2a0 [ 2872.626012] [] tcp_rearm_rto.part.59+0x24a/0x2a0 [ 2872.626012] [] tcp_ack+0x22a9/0x2e60 [ 2872.626012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.626012] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.626012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.626012] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.626012] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.626012] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.626012] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.626012] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.626012] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.626012] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.626012] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.626012] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.626012] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.626012] [] ip_local_deliver+0x24d/0x330 [ 2872.626012] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.626012] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.626012] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.626012] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.626012] [] ip_rcv_finish+0x599/0x1870 [ 2872.626012] [] ip_rcv+0x89b/0x11d0 [ 2872.626012] [] ? ip_local_deliver+0x330/0x330 [ 2872.626012] [] ? inet_del_offload+0x40/0x40 [ 2872.626012] [] ? ip_local_deliver+0x330/0x330 [ 2872.626012] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.626012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.626012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.626012] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.626012] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.626012] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.626012] [] ? process_backlog+0x217/0x650 [ 2872.626012] [] __netif_receive_skb+0x5a/0x190 [ 2872.626012] [] process_backlog+0xd8/0x650 [ 2872.626012] [] ? process_backlog+0x217/0x650 [ 2872.626012] [] net_rx_action+0x655/0xde0 [ 2872.626012] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.626012] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.626012] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.626012] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.626012] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.626012] [] __do_softirq+0x22c/0x99f [ 2872.626012] [] ? cpu_callback+0x850/0x850 [ 2872.626012] [] run_ksoftirqd+0x1f/0x60 [ 2872.626012] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.626012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.626012] [] ? schedule+0x9c/0x1c0 [ 2872.626012] [] ? __kthread_parkme+0xdc/0x200 [ 2872.626012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.626012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.626012] [] kthread+0x20e/0x2d0 [ 2872.626012] [] ? kthread_create_on_node+0x390/0x390 [ 2872.626012] [] ret_from_fork+0x1f/0x40 [ 2872.626012] [] ? kthread_create_on_node+0x390/0x390 [ 2872.626012] Memory state around the buggy address: [ 2872.626012] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.626012] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.626012] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.626012] ^ [ 2872.626012] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.626012] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.626012] ================================================================== [ 2872.692442] ================================================================== [ 2872.693402] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2bbc/0x2ce0 at addr ffff8803795bb035 [ 2872.693431] Read of size 1 by task ksoftirqd/3/28 [ 2872.693431] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.693431] flags: 0x1000000000000000() [ 2872.696426] page dumped because: kasan: bad access detected [ 2872.696426] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.696426] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.696426] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2872.696426] ffff8803795bb035 ffff88038ca17190 ffffffff8151c33e ffff8802f6d6b4f8 [ 2872.696426] ffff8803aee17d00 0000000009400000 0000000000000282 ffffffff822e3d7b [ 2872.696426] Call Trace: [ 2872.696426] [] dump_stack+0x67/0x94 [ 2872.696426] [] kasan_report_error+0x4ae/0x4e0 [ 2872.696426] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2872.696426] [] ? mod_timer+0x56e/0xe30 [ 2872.696426] [] __asan_report_load1_noabort+0x43/0x50 [ 2872.696426] [] ? tcp_clean_rtx_queue+0x2bbc/0x2ce0 [ 2872.696426] [] tcp_clean_rtx_queue+0x2bbc/0x2ce0 [ 2872.696426] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2872.696426] [] tcp_ack+0x1487/0x2e60 [ 2872.696426] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.696426] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.696426] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.696426] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.696426] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.696426] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.696426] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.696426] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.696426] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.696426] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.696426] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.696426] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.696426] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.696426] [] ip_local_deliver+0x24d/0x330 [ 2872.696426] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.696426] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.696426] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.696426] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.696426] [] ip_rcv_finish+0x599/0x1870 [ 2872.696426] [] ip_rcv+0x89b/0x11d0 [ 2872.696426] [] ? ip_local_deliver+0x330/0x330 [ 2872.696426] [] ? inet_del_offload+0x40/0x40 [ 2872.696426] [] ? ip_local_deliver+0x330/0x330 [ 2872.696426] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.696426] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.696426] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.696426] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.696426] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.696426] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.696426] [] ? process_backlog+0x217/0x650 [ 2872.696426] [] __netif_receive_skb+0x5a/0x190 [ 2872.696426] [] process_backlog+0xd8/0x650 [ 2872.696426] [] ? process_backlog+0x217/0x650 [ 2872.696426] [] net_rx_action+0x655/0xde0 [ 2872.696426] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.696426] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.696426] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.696426] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.696426] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.696426] [] __do_softirq+0x22c/0x99f [ 2872.696426] [] ? cpu_callback+0x850/0x850 [ 2872.696426] [] run_ksoftirqd+0x1f/0x60 [ 2872.696426] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.696426] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.696426] [] ? schedule+0x9c/0x1c0 [ 2872.696426] [] ? __kthread_parkme+0xdc/0x200 [ 2872.696426] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.696426] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.696426] [] kthread+0x20e/0x2d0 [ 2872.696426] [] ? kthread_create_on_node+0x390/0x390 [ 2872.696426] [] ret_from_fork+0x1f/0x40 [ 2872.696426] [] ? kthread_create_on_node+0x390/0x390 [ 2872.696426] Memory state around the buggy address: [ 2872.696426] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.696426] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.696426] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.696426] ^ [ 2872.696426] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.696426] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.696426] ================================================================== [ 2872.759975] ================================================================== [ 2872.760968] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2a29/0x2ce0 at addr ffff8803795bb037 [ 2872.760968] Read of size 1 by task ksoftirqd/3/28 [ 2872.760968] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.763047] flags: 0x1000000000000000() [ 2872.763047] page dumped because: kasan: bad access detected [ 2872.763047] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.763047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.763047] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2872.763047] ffff8803795bb037 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2872.763047] ffff880300000000 ffffed006f2b7606 0000000000000282 ffffffff822e3d7b [ 2872.763047] Call Trace: [ 2872.763047] [] dump_stack+0x67/0x94 [ 2872.763047] [] kasan_report_error+0x4ae/0x4e0 [ 2872.763047] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2872.763047] [] __asan_report_load1_noabort+0x43/0x50 [ 2872.763047] [] ? tcp_clean_rtx_queue+0x2a29/0x2ce0 [ 2872.763047] [] tcp_clean_rtx_queue+0x2a29/0x2ce0 [ 2872.763047] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2872.763047] [] tcp_ack+0x1487/0x2e60 [ 2872.763047] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.763047] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.763047] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.763047] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.763047] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.763047] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.763047] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.763047] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.763047] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.763047] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.763047] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.763047] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.763047] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.763047] [] ip_local_deliver+0x24d/0x330 [ 2872.763047] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.763047] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.763047] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.763047] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.763047] [] ip_rcv_finish+0x599/0x1870 [ 2872.763047] [] ip_rcv+0x89b/0x11d0 [ 2872.763047] [] ? ip_local_deliver+0x330/0x330 [ 2872.763047] [] ? inet_del_offload+0x40/0x40 [ 2872.763047] [] ? ip_local_deliver+0x330/0x330 [ 2872.763047] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.763047] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.763047] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.763047] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.763047] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.763047] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.763047] [] ? process_backlog+0x217/0x650 [ 2872.763047] [] __netif_receive_skb+0x5a/0x190 [ 2872.763047] [] process_backlog+0xd8/0x650 [ 2872.763047] [] ? process_backlog+0x217/0x650 [ 2872.763047] [] net_rx_action+0x655/0xde0 [ 2872.763047] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.763047] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.763047] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.763047] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.763047] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.763047] [] __do_softirq+0x22c/0x99f [ 2872.763047] [] ? cpu_callback+0x850/0x850 [ 2872.763047] [] run_ksoftirqd+0x1f/0x60 [ 2872.763047] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.763047] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.763047] [] ? schedule+0x9c/0x1c0 [ 2872.763047] [] ? __kthread_parkme+0xdc/0x200 [ 2872.763047] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.763047] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.763047] [] kthread+0x20e/0x2d0 [ 2872.763047] [] ? kthread_create_on_node+0x390/0x390 [ 2872.763047] [] ret_from_fork+0x1f/0x40 [ 2872.763047] [] ? kthread_create_on_node+0x390/0x390 [ 2872.763047] Memory state around the buggy address: [ 2872.763047] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.763047] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.763047] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.763047] ^ [ 2872.763047] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.763047] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.763047] ================================================================== [ 2872.820134] ================================================================== [ 2872.821127] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2a60/0x2ce0 at addr ffff8803795bb02c [ 2872.821127] Read of size 4 by task ksoftirqd/3/28 [ 2872.821127] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.821127] flags: 0x1000000000000000() [ 2872.821127] page dumped because: kasan: bad access detected [ 2872.821127] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.821127] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.821127] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2872.821127] ffff8803795bb02c ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2872.821127] ffff880300000000 ffffed006f2b7606 0000000000000282 ffffffff822e3d7b [ 2872.821127] Call Trace: [ 2872.821127] [] dump_stack+0x67/0x94 [ 2872.821127] [] kasan_report_error+0x4ae/0x4e0 [ 2872.821127] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2872.821127] [] __asan_report_load4_noabort+0x43/0x50 [ 2872.821127] [] ? tcp_clean_rtx_queue+0x2a60/0x2ce0 [ 2872.821127] [] tcp_clean_rtx_queue+0x2a60/0x2ce0 [ 2872.821127] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2872.821127] [] tcp_ack+0x1487/0x2e60 [ 2872.821127] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.821127] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.821127] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.821127] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.821127] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.821127] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.821127] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.821127] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.821127] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.821127] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.821127] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.821127] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.821127] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.821127] [] ip_local_deliver+0x24d/0x330 [ 2872.821127] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.821127] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.821127] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.821127] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.821127] [] ip_rcv_finish+0x599/0x1870 [ 2872.821127] [] ip_rcv+0x89b/0x11d0 [ 2872.821127] [] ? ip_local_deliver+0x330/0x330 [ 2872.821127] [] ? inet_del_offload+0x40/0x40 [ 2872.821127] [] ? ip_local_deliver+0x330/0x330 [ 2872.821127] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.821127] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.821127] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.821127] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.821127] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.821127] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.821127] [] ? process_backlog+0x217/0x650 [ 2872.821127] [] __netif_receive_skb+0x5a/0x190 [ 2872.821127] [] process_backlog+0xd8/0x650 [ 2872.821127] [] ? process_backlog+0x217/0x650 [ 2872.821127] [] net_rx_action+0x655/0xde0 [ 2872.821127] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.821127] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.821127] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.821127] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.821127] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.821127] [] __do_softirq+0x22c/0x99f [ 2872.821127] [] ? cpu_callback+0x850/0x850 [ 2872.821127] [] run_ksoftirqd+0x1f/0x60 [ 2872.821127] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.821127] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.821127] [] ? schedule+0x9c/0x1c0 [ 2872.821127] [] ? __kthread_parkme+0xdc/0x200 [ 2872.821127] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.821127] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.821127] [] kthread+0x20e/0x2d0 [ 2872.821127] [] ? kthread_create_on_node+0x390/0x390 [ 2872.821127] [] ret_from_fork+0x1f/0x40 [ 2872.821127] [] ? kthread_create_on_node+0x390/0x390 [ 2872.821127] Memory state around the buggy address: [ 2872.821127] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.821127] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.821127] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.821127] ^ [ 2872.821127] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.821127] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.821127] ================================================================== [ 2872.886756] ================================================================== [ 2872.887749] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2c13/0x2ce0 at addr ffff8803795bb000 [ 2872.887749] Read of size 8 by task ksoftirqd/3/28 [ 2872.887749] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.887749] flags: 0x1000000000000000() [ 2872.887749] page dumped because: kasan: bad access detected [ 2872.887749] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.887749] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.887749] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2872.887749] ffff8803795bb000 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2872.887749] ffff880300000000 ffffed006f2b7605 0000000000000282 ffffffff822e3d7b [ 2872.887749] Call Trace: [ 2872.887749] [] dump_stack+0x67/0x94 [ 2872.887749] [] kasan_report_error+0x4ae/0x4e0 [ 2872.887749] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2872.887749] [] __asan_report_load8_noabort+0x43/0x50 [ 2872.887749] [] ? tcp_clean_rtx_queue+0x2c13/0x2ce0 [ 2872.887749] [] tcp_clean_rtx_queue+0x2c13/0x2ce0 [ 2872.887749] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2872.887749] [] tcp_ack+0x1487/0x2e60 [ 2872.887749] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.887749] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.887749] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.887749] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.887749] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.887749] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.887749] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.887749] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.887749] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.887749] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.887749] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.887749] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.887749] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.887749] [] ip_local_deliver+0x24d/0x330 [ 2872.887749] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.887749] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.887749] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.887749] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.887749] [] ip_rcv_finish+0x599/0x1870 [ 2872.887749] [] ip_rcv+0x89b/0x11d0 [ 2872.887749] [] ? ip_local_deliver+0x330/0x330 [ 2872.887749] [] ? inet_del_offload+0x40/0x40 [ 2872.887749] [] ? ip_local_deliver+0x330/0x330 [ 2872.887749] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.887749] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.887749] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.887749] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.887749] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.887749] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.887749] [] ? process_backlog+0x217/0x650 [ 2872.887749] [] __netif_receive_skb+0x5a/0x190 [ 2872.887749] [] process_backlog+0xd8/0x650 [ 2872.887749] [] ? process_backlog+0x217/0x650 [ 2872.887749] [] net_rx_action+0x655/0xde0 [ 2872.887749] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.887749] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.887749] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.887749] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.887749] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.887749] [] __do_softirq+0x22c/0x99f [ 2872.887749] [] ? cpu_callback+0x850/0x850 [ 2872.887749] [] run_ksoftirqd+0x1f/0x60 [ 2872.887749] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.887749] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.887749] [] ? schedule+0x9c/0x1c0 [ 2872.887749] [] ? __kthread_parkme+0xdc/0x200 [ 2872.887749] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.887749] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.887749] [] kthread+0x20e/0x2d0 [ 2872.887749] [] ? kthread_create_on_node+0x390/0x390 [ 2872.887749] [] ret_from_fork+0x1f/0x40 [ 2872.887749] [] ? kthread_create_on_node+0x390/0x390 [ 2872.887749] Memory state around the buggy address: [ 2872.887749] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.887749] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.887749] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.887749] ^ [ 2872.887749] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.887749] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.887749] ================================================================== [ 2872.946259] ================================================================== [ 2872.947215] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1bf1/0x2ce0 at addr ffff8803795bb030 [ 2872.947252] Read of size 2 by task ksoftirqd/3/28 [ 2872.947252] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2872.947252] flags: 0x1000000000000000() [ 2872.947252] page dumped because: kasan: bad access detected [ 2872.947252] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2872.947252] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2872.947252] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2872.947252] ffff8803795bb030 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2872.947252] ffff880300000000 ffffed006f2b7600 0000000000000282 ffffffff822e3d7b [ 2872.947252] Call Trace: [ 2872.947252] [] dump_stack+0x67/0x94 [ 2872.947252] [] kasan_report_error+0x4ae/0x4e0 [ 2872.947252] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2872.947252] [] __asan_report_load2_noabort+0x43/0x50 [ 2872.947252] [] ? tcp_clean_rtx_queue+0x1bf1/0x2ce0 [ 2872.947252] [] tcp_clean_rtx_queue+0x1bf1/0x2ce0 [ 2872.947252] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2872.947252] [] tcp_ack+0x1487/0x2e60 [ 2872.947252] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.947252] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2872.947252] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.947252] [] tcp_rcv_established+0x58c/0x2de0 [ 2872.947252] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2872.947252] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2872.947252] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2872.947252] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2872.947252] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2872.947252] [] tcp_v4_rcv+0x213e/0x3420 [ 2872.947252] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2872.947252] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2872.947252] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2872.947252] [] ip_local_deliver+0x24d/0x330 [ 2872.947252] [] ? ip_call_ra_chain+0x510/0x510 [ 2872.947252] [] ? nf_hook_slow+0x186/0x2a0 [ 2872.947252] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2872.947252] [] ? nf_hook_slow+0x5/0x2a0 [ 2872.947252] [] ip_rcv_finish+0x599/0x1870 [ 2872.947252] [] ip_rcv+0x89b/0x11d0 [ 2872.947252] [] ? ip_local_deliver+0x330/0x330 [ 2872.947252] [] ? inet_del_offload+0x40/0x40 [ 2872.947252] [] ? ip_local_deliver+0x330/0x330 [ 2872.947252] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2872.947252] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.947252] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2872.947252] [] ? net_tx_action+0x9d0/0x9d0 [ 2872.947252] [] ? default_send_IPI_single+0x75/0xa0 [ 2872.947252] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2872.947252] [] ? process_backlog+0x217/0x650 [ 2872.947252] [] __netif_receive_skb+0x5a/0x190 [ 2872.947252] [] process_backlog+0xd8/0x650 [ 2872.947252] [] ? process_backlog+0x217/0x650 [ 2872.947252] [] net_rx_action+0x655/0xde0 [ 2872.947252] [] ? sk_busy_loop+0xb90/0xb90 [ 2872.947252] [] ? trace_hardirqs_on+0xd/0x10 [ 2872.947252] [] ? finish_task_switch+0x1fa/0x5a0 [ 2872.947252] [] ? finish_task_switch+0x1ce/0x5a0 [ 2872.947252] [] ? run_ksoftirqd+0x1f/0x60 [ 2872.947252] [] __do_softirq+0x22c/0x99f [ 2872.947252] [] ? cpu_callback+0x850/0x850 [ 2872.947252] [] run_ksoftirqd+0x1f/0x60 [ 2872.947252] [] smpboot_thread_fn+0x3c4/0x840 [ 2872.947252] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.947252] [] ? schedule+0x9c/0x1c0 [ 2872.947252] [] ? __kthread_parkme+0xdc/0x200 [ 2872.947252] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.947252] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2872.947252] [] kthread+0x20e/0x2d0 [ 2872.947252] [] ? kthread_create_on_node+0x390/0x390 [ 2872.947252] [] ret_from_fork+0x1f/0x40 [ 2872.947252] [] ? kthread_create_on_node+0x390/0x390 [ 2872.947252] Memory state around the buggy address: [ 2872.947252] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.947252] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2872.947252] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.947252] ^ [ 2872.947252] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.947252] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2872.947252] ================================================================== [ 2873.012062] ================================================================== [ 2873.013011] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1ebd/0x2ce0 at addr ffff8803795bb035 [ 2873.013055] Read of size 1 by task ksoftirqd/3/28 [ 2873.013055] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.013055] flags: 0x1000000000000000() [ 2873.013055] page dumped because: kasan: bad access detected [ 2873.013055] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.013055] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.013055] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.013055] ffff8803795bb035 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2873.013055] ffff880300000000 ffffed006f2b7606 0000000000000282 ffffffff822e3d7b [ 2873.013055] Call Trace: [ 2873.013055] [] dump_stack+0x67/0x94 [ 2873.013055] [] kasan_report_error+0x4ae/0x4e0 [ 2873.013055] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2873.013055] [] __asan_report_load1_noabort+0x43/0x50 [ 2873.013055] [] ? tcp_clean_rtx_queue+0x1ebd/0x2ce0 [ 2873.013055] [] tcp_clean_rtx_queue+0x1ebd/0x2ce0 [ 2873.013055] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.013055] [] tcp_ack+0x1487/0x2e60 [ 2873.013055] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.013055] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.013055] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.013055] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.013055] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.013055] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.013055] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.013055] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.013055] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.013055] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.013055] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.013055] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.013055] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.013055] [] ip_local_deliver+0x24d/0x330 [ 2873.013055] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.013055] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.013055] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.013055] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.013055] [] ip_rcv_finish+0x599/0x1870 [ 2873.013055] [] ip_rcv+0x89b/0x11d0 [ 2873.013055] [] ? ip_local_deliver+0x330/0x330 [ 2873.013055] [] ? inet_del_offload+0x40/0x40 [ 2873.013055] [] ? ip_local_deliver+0x330/0x330 [ 2873.013055] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.013055] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.013055] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.013055] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.013055] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.013055] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.013055] [] ? process_backlog+0x217/0x650 [ 2873.013055] [] __netif_receive_skb+0x5a/0x190 [ 2873.013055] [] process_backlog+0xd8/0x650 [ 2873.013055] [] ? process_backlog+0x217/0x650 [ 2873.013055] [] net_rx_action+0x655/0xde0 [ 2873.013055] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.013055] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.013055] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.013055] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.013055] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.013055] [] __do_softirq+0x22c/0x99f [ 2873.013055] [] ? cpu_callback+0x850/0x850 [ 2873.013055] [] run_ksoftirqd+0x1f/0x60 [ 2873.013055] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.013055] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.013055] [] ? schedule+0x9c/0x1c0 [ 2873.013055] [] ? __kthread_parkme+0xdc/0x200 [ 2873.013055] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.013055] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.013055] [] kthread+0x20e/0x2d0 [ 2873.013055] [] ? kthread_create_on_node+0x390/0x390 [ 2873.013055] [] ret_from_fork+0x1f/0x40 [ 2873.013055] [] ? kthread_create_on_node+0x390/0x390 [ 2873.013055] Memory state around the buggy address: [ 2873.013055] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.013055] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.013055] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.013055] ^ [ 2873.013055] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.013055] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.013055] ================================================================== [ 2873.078071] ================================================================== [ 2873.079063] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2803/0x2ce0 at addr ffff8803795bb014 [ 2873.079063] Read of size 4 by task ksoftirqd/3/28 [ 2873.079063] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.079063] flags: 0x1000000000000000() [ 2873.079063] page dumped because: kasan: bad access detected [ 2873.079063] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.079063] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.079063] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.079063] ffff8803795bb014 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2873.079063] ffff880300000000 ffffed006f2b7606 0000000000000282 ffffffff822e3d7b [ 2873.079063] Call Trace: [ 2873.079063] [] dump_stack+0x67/0x94 [ 2873.079063] [] kasan_report_error+0x4ae/0x4e0 [ 2873.079063] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 2873.079063] [] __asan_report_load4_noabort+0x43/0x50 [ 2873.079063] [] ? tcp_clean_rtx_queue+0x2803/0x2ce0 [ 2873.079063] [] tcp_clean_rtx_queue+0x2803/0x2ce0 [ 2873.079063] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.079063] [] tcp_ack+0x1487/0x2e60 [ 2873.079063] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.079063] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.079063] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.079063] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.079063] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.079063] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.079063] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.079063] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.079063] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.079063] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.079063] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.079063] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.079063] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.079063] [] ip_local_deliver+0x24d/0x330 [ 2873.079063] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.079063] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.079063] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.079063] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.079063] [] ip_rcv_finish+0x599/0x1870 [ 2873.079063] [] ip_rcv+0x89b/0x11d0 [ 2873.079063] [] ? ip_local_deliver+0x330/0x330 [ 2873.079063] [] ? inet_del_offload+0x40/0x40 [ 2873.079063] [] ? ip_local_deliver+0x330/0x330 [ 2873.079063] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.079063] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.079063] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.079063] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.079063] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.079063] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.079063] [] ? process_backlog+0x217/0x650 [ 2873.079063] [] __netif_receive_skb+0x5a/0x190 [ 2873.079063] [] process_backlog+0xd8/0x650 [ 2873.079063] [] ? process_backlog+0x217/0x650 [ 2873.079063] [] net_rx_action+0x655/0xde0 [ 2873.079063] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.079063] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.079063] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.079063] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.079063] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.079063] [] __do_softirq+0x22c/0x99f [ 2873.079063] [] ? cpu_callback+0x850/0x850 [ 2873.079063] [] run_ksoftirqd+0x1f/0x60 [ 2873.079063] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.079063] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.079063] [] ? schedule+0x9c/0x1c0 [ 2873.079063] [] ? __kthread_parkme+0xdc/0x200 [ 2873.079063] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.079063] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.079063] [] kthread+0x20e/0x2d0 [ 2873.079063] [] ? kthread_create_on_node+0x390/0x390 [ 2873.079063] [] ret_from_fork+0x1f/0x40 [ 2873.079063] [] ? kthread_create_on_node+0x390/0x390 [ 2873.079063] Memory state around the buggy address: [ 2873.079063] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.079063] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.079063] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.079063] ^ [ 2873.079063] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.079063] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.079063] ================================================================== [ 2873.137511] ================================================================== [ 2873.138505] BUG: KASAN: use-after-free in tcp_rack_advance+0x2c3/0x3a0 at addr ffff8803795bb014 [ 2873.138505] Read of size 4 by task ksoftirqd/3/28 [ 2873.138505] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.138505] flags: 0x1000000000000000() [ 2873.138505] page dumped because: kasan: bad access detected [ 2873.138505] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.138505] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.138505] ffff8802f6d6b748 ffff88038ca170d0 ffffffff8199f263 ffff88038ca17160 [ 2873.138505] ffff8803795bb014 ffff88038ca17150 ffffffff8151c33e 0000000000000282 [ 2873.138505] ffff88038ca17138 ffffed006f2b7630 0000000000000286 ffffffff8151be77 [ 2873.138505] Call Trace: [ 2873.138505] [] dump_stack+0x67/0x94 [ 2873.138505] [] kasan_report_error+0x4ae/0x4e0 [ 2873.138505] [] ? kasan_end_report+0x37/0x50 [ 2873.138505] [] ? kasan_report_error+0x42d/0x4e0 [ 2873.138505] [] __asan_report_load4_noabort+0x43/0x50 [ 2873.138505] [] ? tcp_rack_advance+0x2c3/0x3a0 [ 2873.138505] [] tcp_rack_advance+0x2c3/0x3a0 [ 2873.138505] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 2873.138505] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.138505] [] tcp_ack+0x1487/0x2e60 [ 2873.138505] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.138505] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.138505] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.138505] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.138505] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.138505] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.138505] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.138505] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.138505] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.138505] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.138505] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.138505] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.138505] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.138505] [] ip_local_deliver+0x24d/0x330 [ 2873.138505] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.138505] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.138505] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.138505] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.138505] [] ip_rcv_finish+0x599/0x1870 [ 2873.138505] [] ip_rcv+0x89b/0x11d0 [ 2873.138505] [] ? ip_local_deliver+0x330/0x330 [ 2873.138505] [] ? inet_del_offload+0x40/0x40 [ 2873.138505] [] ? ip_local_deliver+0x330/0x330 [ 2873.138505] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.138505] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.138505] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.138505] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.138505] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.138505] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.138505] [] ? process_backlog+0x217/0x650 [ 2873.138505] [] __netif_receive_skb+0x5a/0x190 [ 2873.138505] [] process_backlog+0xd8/0x650 [ 2873.138505] [] ? process_backlog+0x217/0x650 [ 2873.138505] [] net_rx_action+0x655/0xde0 [ 2873.138505] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.138505] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.138505] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.138505] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.138505] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.138505] [] __do_softirq+0x22c/0x99f [ 2873.138505] [] ? cpu_callback+0x850/0x850 [ 2873.138505] [] run_ksoftirqd+0x1f/0x60 [ 2873.138505] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.138505] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.138505] [] ? schedule+0x9c/0x1c0 [ 2873.138505] [] ? __kthread_parkme+0xdc/0x200 [ 2873.138505] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.138505] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.138505] [] kthread+0x20e/0x2d0 [ 2873.138505] [] ? kthread_create_on_node+0x390/0x390 [ 2873.138505] [] ret_from_fork+0x1f/0x40 [ 2873.138505] [] ? kthread_create_on_node+0x390/0x390 [ 2873.138505] Memory state around the buggy address: [ 2873.138505] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.138505] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.138505] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.138505] ^ [ 2873.138505] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.138505] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.138505] ================================================================== [ 2873.204639] ================================================================== [ 2873.205627] BUG: KASAN: use-after-free in tcp_rack_advance+0x311/0x3a0 at addr ffff8803795bb010 [ 2873.205627] Read of size 4 by task ksoftirqd/3/28 [ 2873.207015] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.207015] flags: 0x1000000000000000() [ 2873.207015] page dumped because: kasan: bad access detected [ 2873.207015] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.207015] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.207015] ffff8802f6d6b748 ffff88038ca170d0 ffffffff8199f263 ffff88038ca17160 [ 2873.207015] ffff8803795bb010 ffff88038ca17150 ffffffff8151c33e ffffed0075df43b8 [ 2873.207015] ffff88038ca17138 ffffffff811af0c3 0000000000000286 ffffffff8151be77 [ 2873.207015] Call Trace: [ 2873.207015] [] dump_stack+0x67/0x94 [ 2873.207015] [] kasan_report_error+0x4ae/0x4e0 [ 2873.207015] [] ? sched_clock_local+0x43/0x120 [ 2873.207015] [] ? kasan_end_report+0x37/0x50 [ 2873.207015] [] __asan_report_load4_noabort+0x43/0x50 [ 2873.207015] [] ? tcp_rack_advance+0x311/0x3a0 [ 2873.207015] [] tcp_rack_advance+0x311/0x3a0 [ 2873.207015] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 2873.207015] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.207015] [] tcp_ack+0x1487/0x2e60 [ 2873.207015] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.207015] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.207015] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.207015] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.207015] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.207015] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.207015] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.207015] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.207015] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.207015] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.207015] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.207015] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.207015] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.207015] [] ip_local_deliver+0x24d/0x330 [ 2873.207015] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.207015] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.207015] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.207015] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.207015] [] ip_rcv_finish+0x599/0x1870 [ 2873.207015] [] ip_rcv+0x89b/0x11d0 [ 2873.207015] [] ? ip_local_deliver+0x330/0x330 [ 2873.207015] [] ? inet_del_offload+0x40/0x40 [ 2873.207015] [] ? ip_local_deliver+0x330/0x330 [ 2873.207015] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.207015] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.207015] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.207015] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.207015] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.207015] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.207015] [] ? process_backlog+0x217/0x650 [ 2873.207015] [] __netif_receive_skb+0x5a/0x190 [ 2873.207015] [] process_backlog+0xd8/0x650 [ 2873.207015] [] ? process_backlog+0x217/0x650 [ 2873.207015] [] net_rx_action+0x655/0xde0 [ 2873.207015] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.207015] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.207015] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.207015] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.207015] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.207015] [] __do_softirq+0x22c/0x99f [ 2873.207015] [] ? cpu_callback+0x850/0x850 [ 2873.207015] [] run_ksoftirqd+0x1f/0x60 [ 2873.207015] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.207015] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.207015] [] ? schedule+0x9c/0x1c0 [ 2873.207015] [] ? __kthread_parkme+0xdc/0x200 [ 2873.207015] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.207015] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.207015] [] kthread+0x20e/0x2d0 [ 2873.207015] [] ? kthread_create_on_node+0x390/0x390 [ 2873.207015] [] ret_from_fork+0x1f/0x40 [ 2873.207015] [] ? kthread_create_on_node+0x390/0x390 [ 2873.207015] Memory state around the buggy address: [ 2873.207015] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.207015] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.207015] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.207015] ^ [ 2873.207015] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.207015] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.207015] ================================================================== [ 2873.265280] ================================================================== [ 2873.266269] BUG: KASAN: use-after-free in tcp_rack_advance+0x326/0x3a0 at addr ffff8803795bb014 [ 2873.267012] Read of size 4 by task ksoftirqd/3/28 [ 2873.267012] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.267012] flags: 0x1000000000000000() [ 2873.267012] page dumped because: kasan: bad access detected [ 2873.267012] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.267012] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.267012] ffff8802f6d6b748 ffff88038ca170d0 ffffffff8199f263 ffff88038ca17160 [ 2873.267012] ffff8803795bb014 ffff88038ca17150 ffffffff8151c33e 0000000000000010 [ 2873.267012] ffff880300000000 ffffed006f2b7602 0000000000000286 ffffffff8151be77 [ 2873.267012] Call Trace: [ 2873.267012] [] dump_stack+0x67/0x94 [ 2873.267012] [] kasan_report_error+0x4ae/0x4e0 [ 2873.267012] [] ? kasan_end_report+0x37/0x50 [ 2873.267012] [] __asan_report_load4_noabort+0x43/0x50 [ 2873.267012] [] ? tcp_rack_advance+0x326/0x3a0 [ 2873.267012] [] tcp_rack_advance+0x326/0x3a0 [ 2873.267012] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 2873.267012] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.267012] [] tcp_ack+0x1487/0x2e60 [ 2873.267012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.267012] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.267012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.267012] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.267012] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.267012] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.267012] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.267012] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.267012] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.267012] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.267012] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.267012] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.267012] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.267012] [] ip_local_deliver+0x24d/0x330 [ 2873.267012] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.267012] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.267012] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.267012] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.267012] [] ip_rcv_finish+0x599/0x1870 [ 2873.267012] [] ip_rcv+0x89b/0x11d0 [ 2873.267012] [] ? ip_local_deliver+0x330/0x330 [ 2873.267012] [] ? inet_del_offload+0x40/0x40 [ 2873.267012] [] ? ip_local_deliver+0x330/0x330 [ 2873.267012] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.267012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.267012] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.267012] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.267012] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.267012] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.267012] [] ? process_backlog+0x217/0x650 [ 2873.267012] [] __netif_receive_skb+0x5a/0x190 [ 2873.267012] [] process_backlog+0xd8/0x650 [ 2873.267012] [] ? process_backlog+0x217/0x650 [ 2873.267012] [] net_rx_action+0x655/0xde0 [ 2873.267012] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.267012] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.267012] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.267012] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.267012] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.267012] [] __do_softirq+0x22c/0x99f [ 2873.267012] [] ? cpu_callback+0x850/0x850 [ 2873.267012] [] run_ksoftirqd+0x1f/0x60 [ 2873.267012] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.267012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.267012] [] ? schedule+0x9c/0x1c0 [ 2873.267012] [] ? __kthread_parkme+0xdc/0x200 [ 2873.267012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.267012] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.267012] [] kthread+0x20e/0x2d0 [ 2873.267012] [] ? kthread_create_on_node+0x390/0x390 [ 2873.267012] [] ret_from_fork+0x1f/0x40 [ 2873.267012] [] ? kthread_create_on_node+0x390/0x390 [ 2873.267012] Memory state around the buggy address: [ 2873.267012] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.267012] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.267012] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.267012] ^ [ 2873.267012] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.267012] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.267012] ================================================================== [ 2873.331289] ================================================================== [ 2873.332283] BUG: KASAN: use-after-free in tcp_rack_advance+0x356/0x3a0 at addr ffff8803795bb010 [ 2873.332283] Read of size 8 by task ksoftirqd/3/28 [ 2873.332283] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.332283] flags: 0x1000000000000000() [ 2873.332283] page dumped because: kasan: bad access detected [ 2873.332283] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.332283] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.332283] ffff8802f6d6b748 ffff88038ca170d0 ffffffff8199f263 ffff88038ca17160 [ 2873.332283] ffff8803795bb010 ffff88038ca17150 ffffffff8151c33e 0000000000000010 [ 2873.332283] ffff880300000000 ffffed006f2b7602 0000000000000286 ffffffff8151be77 [ 2873.332283] Call Trace: [ 2873.332283] [] dump_stack+0x67/0x94 [ 2873.332283] [] kasan_report_error+0x4ae/0x4e0 [ 2873.332283] [] ? kasan_end_report+0x37/0x50 [ 2873.332283] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.332283] [] ? tcp_rack_advance+0x356/0x3a0 [ 2873.332283] [] tcp_rack_advance+0x356/0x3a0 [ 2873.332283] [] tcp_clean_rtx_queue+0x113e/0x2ce0 [ 2873.332283] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.332283] [] tcp_ack+0x1487/0x2e60 [ 2873.332283] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.332283] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.332283] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.332283] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.332283] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.332283] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.332283] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.332283] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.332283] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.332283] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.332283] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.332283] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.332283] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.332283] [] ip_local_deliver+0x24d/0x330 [ 2873.332283] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.332283] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.332283] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.332283] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.332283] [] ip_rcv_finish+0x599/0x1870 [ 2873.332283] [] ip_rcv+0x89b/0x11d0 [ 2873.332283] [] ? ip_local_deliver+0x330/0x330 [ 2873.332283] [] ? inet_del_offload+0x40/0x40 [ 2873.332283] [] ? ip_local_deliver+0x330/0x330 [ 2873.332283] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.332283] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.332283] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.332283] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.332283] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.332283] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.332283] [] ? process_backlog+0x217/0x650 [ 2873.332283] [] __netif_receive_skb+0x5a/0x190 [ 2873.332283] [] process_backlog+0xd8/0x650 [ 2873.332283] [] ? process_backlog+0x217/0x650 [ 2873.332283] [] net_rx_action+0x655/0xde0 [ 2873.332283] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.332283] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.332283] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.332283] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.332283] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.332283] [] __do_softirq+0x22c/0x99f [ 2873.332283] [] ? cpu_callback+0x850/0x850 [ 2873.332283] [] run_ksoftirqd+0x1f/0x60 [ 2873.332283] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.332283] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.332283] [] ? schedule+0x9c/0x1c0 [ 2873.332283] [] ? __kthread_parkme+0xdc/0x200 [ 2873.332283] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.332283] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.332283] [] kthread+0x20e/0x2d0 [ 2873.332283] [] ? kthread_create_on_node+0x390/0x390 [ 2873.332283] [] ret_from_fork+0x1f/0x40 [ 2873.332283] [] ? kthread_create_on_node+0x390/0x390 [ 2873.332283] Memory state around the buggy address: [ 2873.332283] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.332283] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.332283] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.332283] ^ [ 2873.332283] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.332283] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.332283] ================================================================== [ 2873.391354] ================================================================== [ 2873.392299] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2afc/0x2ce0 at addr ffff8803795bb034 [ 2873.392348] Read of size 1 by task ksoftirqd/3/28 [ 2873.392348] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.392348] flags: 0x1000000000000000() [ 2873.392348] page dumped because: kasan: bad access detected [ 2873.392348] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.392348] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.392348] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.392348] ffff8803795bb034 ffff88038ca17190 ffffffff8151c33e 00203a3030316262 [ 2873.392348] ffff8802f6d6af40 0000000100274395 0000000000000282 00000000ab419f9e [ 2873.392348] Call Trace: [ 2873.392348] [] dump_stack+0x67/0x94 [ 2873.392348] [] kasan_report_error+0x4ae/0x4e0 [ 2873.392348] [] ? __asan_report_load8_noabort+0x43/0x50 [ 2873.392348] [] __asan_report_load1_noabort+0x43/0x50 [ 2873.392348] [] ? tcp_clean_rtx_queue+0x2afc/0x2ce0 [ 2873.392348] [] tcp_clean_rtx_queue+0x2afc/0x2ce0 [ 2873.392348] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.392348] [] tcp_ack+0x1487/0x2e60 [ 2873.392348] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.392348] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.392348] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.392348] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.392348] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.392348] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.392348] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.392348] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.392348] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.392348] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.392348] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.392348] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.392348] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.392348] [] ip_local_deliver+0x24d/0x330 [ 2873.392348] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.392348] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.392348] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.392348] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.392348] [] ip_rcv_finish+0x599/0x1870 [ 2873.392348] [] ip_rcv+0x89b/0x11d0 [ 2873.392348] [] ? ip_local_deliver+0x330/0x330 [ 2873.392348] [] ? inet_del_offload+0x40/0x40 [ 2873.392348] [] ? ip_local_deliver+0x330/0x330 [ 2873.392348] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.392348] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.392348] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.392348] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.392348] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.392348] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.392348] [] ? process_backlog+0x217/0x650 [ 2873.392348] [] __netif_receive_skb+0x5a/0x190 [ 2873.392348] [] process_backlog+0xd8/0x650 [ 2873.392348] [] ? process_backlog+0x217/0x650 [ 2873.392348] [] net_rx_action+0x655/0xde0 [ 2873.392348] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.392348] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.392348] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.392348] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.392348] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.392348] [] __do_softirq+0x22c/0x99f [ 2873.392348] [] ? cpu_callback+0x850/0x850 [ 2873.392348] [] run_ksoftirqd+0x1f/0x60 [ 2873.392348] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.392348] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.392348] [] ? schedule+0x9c/0x1c0 [ 2873.392348] [] ? __kthread_parkme+0xdc/0x200 [ 2873.392348] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.392348] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.392348] [] kthread+0x20e/0x2d0 [ 2873.392348] [] ? kthread_create_on_node+0x390/0x390 [ 2873.392348] [] ret_from_fork+0x1f/0x40 [ 2873.392348] [] ? kthread_create_on_node+0x390/0x390 [ 2873.392348] Memory state around the buggy address: [ 2873.392348] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.392348] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.392348] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.392348] ^ [ 2873.392348] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.392348] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.392348] ================================================================== [ 2873.456231] ================================================================== [ 2873.457190] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2c97/0x2ce0 at addr ffff8803795bb000 [ 2873.457225] Read of size 8 by task ksoftirqd/3/28 [ 2873.457225] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.457225] flags: 0x1000000000000000() [ 2873.457225] page dumped because: kasan: bad access detected [ 2873.457225] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.457225] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.457225] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.457225] ffff8803795bb000 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2873.457225] ffff880200000000 ffffed006f2b7606 0000000000000282 ffffffffab419f9e [ 2873.457225] Call Trace: [ 2873.457225] [] dump_stack+0x67/0x94 [ 2873.457225] [] kasan_report_error+0x4ae/0x4e0 [ 2873.457225] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.457225] [] ? tcp_clean_rtx_queue+0x2c97/0x2ce0 [ 2873.457225] [] tcp_clean_rtx_queue+0x2c97/0x2ce0 [ 2873.457225] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.457225] [] tcp_ack+0x1487/0x2e60 [ 2873.457225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.457225] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.457225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.457225] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.457225] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.457225] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.457225] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.457225] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.457225] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.457225] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.457225] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.457225] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.457225] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.457225] [] ip_local_deliver+0x24d/0x330 [ 2873.457225] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.457225] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.457225] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.457225] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.457225] [] ip_rcv_finish+0x599/0x1870 [ 2873.457225] [] ip_rcv+0x89b/0x11d0 [ 2873.457225] [] ? ip_local_deliver+0x330/0x330 [ 2873.457225] [] ? inet_del_offload+0x40/0x40 [ 2873.457225] [] ? ip_local_deliver+0x330/0x330 [ 2873.457225] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.457225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.457225] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.457225] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.457225] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.457225] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.457225] [] ? process_backlog+0x217/0x650 [ 2873.457225] [] __netif_receive_skb+0x5a/0x190 [ 2873.457225] [] process_backlog+0xd8/0x650 [ 2873.457225] [] ? process_backlog+0x217/0x650 [ 2873.457225] [] net_rx_action+0x655/0xde0 [ 2873.457225] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.457225] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.457225] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.457225] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.457225] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.457225] [] __do_softirq+0x22c/0x99f [ 2873.457225] [] ? cpu_callback+0x850/0x850 [ 2873.457225] [] run_ksoftirqd+0x1f/0x60 [ 2873.457225] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.457225] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.457225] [] ? schedule+0x9c/0x1c0 [ 2873.457225] [] ? __kthread_parkme+0xdc/0x200 [ 2873.457225] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.457225] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.457225] [] kthread+0x20e/0x2d0 [ 2873.457225] [] ? kthread_create_on_node+0x390/0x390 [ 2873.457225] [] ret_from_fork+0x1f/0x40 [ 2873.457225] [] ? kthread_create_on_node+0x390/0x390 [ 2873.457225] Memory state around the buggy address: [ 2873.457225] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.457225] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.457225] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.457225] ^ [ 2873.457225] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.457225] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.457225] ================================================================== [ 2873.514810] ================================================================== [ 2873.515772] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x2b73/0x2ce0 at addr ffff8803795bb008 [ 2873.515802] Read of size 8 by task ksoftirqd/3/28 [ 2873.515802] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.515802] flags: 0x1000000000000000() [ 2873.515802] page dumped because: kasan: bad access detected [ 2873.515802] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.515802] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.515802] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.515802] ffff8803795bb008 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2873.515802] ffff880200000000 ffffed006f2b7600 0000000000000282 ffffffffab419f9e [ 2873.515802] Call Trace: [ 2873.515802] [] dump_stack+0x67/0x94 [ 2873.515802] [] kasan_report_error+0x4ae/0x4e0 [ 2873.515802] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.515802] [] ? tcp_clean_rtx_queue+0x2b73/0x2ce0 [ 2873.515802] [] tcp_clean_rtx_queue+0x2b73/0x2ce0 [ 2873.515802] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.515802] [] tcp_ack+0x1487/0x2e60 [ 2873.515802] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.515802] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.515802] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.515802] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.515802] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.515802] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.515802] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.515802] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.515802] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.515802] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.515802] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.515802] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.515802] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.515802] [] ip_local_deliver+0x24d/0x330 [ 2873.515802] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.515802] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.515802] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.515802] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.515802] [] ip_rcv_finish+0x599/0x1870 [ 2873.515802] [] ip_rcv+0x89b/0x11d0 [ 2873.515802] [] ? ip_local_deliver+0x330/0x330 [ 2873.515802] [] ? inet_del_offload+0x40/0x40 [ 2873.515802] [] ? ip_local_deliver+0x330/0x330 [ 2873.515802] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.515802] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.515802] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.515802] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.515802] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.515802] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.515802] [] ? process_backlog+0x217/0x650 [ 2873.515802] [] __netif_receive_skb+0x5a/0x190 [ 2873.515802] [] process_backlog+0xd8/0x650 [ 2873.515802] [] ? process_backlog+0x217/0x650 [ 2873.515802] [] net_rx_action+0x655/0xde0 [ 2873.515802] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.515802] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.515802] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.515802] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.515802] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.515802] [] __do_softirq+0x22c/0x99f [ 2873.515802] [] ? cpu_callback+0x850/0x850 [ 2873.515802] [] run_ksoftirqd+0x1f/0x60 [ 2873.515802] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.515802] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.515802] [] ? schedule+0x9c/0x1c0 [ 2873.515802] [] ? __kthread_parkme+0xdc/0x200 [ 2873.515802] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.515802] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.515802] [] kthread+0x20e/0x2d0 [ 2873.515802] [] ? kthread_create_on_node+0x390/0x390 [ 2873.515802] [] ret_from_fork+0x1f/0x40 [ 2873.515802] [] ? kthread_create_on_node+0x390/0x390 [ 2873.515802] Memory state around the buggy address: [ 2873.515802] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.515802] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.515802] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.515802] ^ [ 2873.515802] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.515802] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.515802] ================================================================== [ 2873.580207] ================================================================== [ 2873.581153] BUG: KASAN: use-after-free in tcp_clean_rtx_queue+0x1ba5/0x2ce0 at addr ffff8803795bb0f0 [ 2873.581200] Read of size 4 by task ksoftirqd/3/28 [ 2873.581200] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.581200] flags: 0x1000000000000000() [ 2873.581200] page dumped because: kasan: bad access detected [ 2873.581200] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.581200] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.581200] dffffc0000000000 ffff88038ca17110 ffffffff8199f263 ffff88038ca171a0 [ 2873.581200] ffff8803795bb0f0 ffff88038ca17190 ffffffff8151c33e 0000000000000010 [ 2873.581200] ffff880200000000 ffffed006f2b7601 0000000000000282 ffffffffab419f9e [ 2873.581200] Call Trace: [ 2873.581200] [] dump_stack+0x67/0x94 [ 2873.581200] [] kasan_report_error+0x4ae/0x4e0 [ 2873.581200] [] __asan_report_load4_noabort+0x43/0x50 [ 2873.581200] [] ? tcp_clean_rtx_queue+0x1ba5/0x2ce0 [ 2873.581200] [] tcp_clean_rtx_queue+0x1ba5/0x2ce0 [ 2873.581200] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.581200] [] tcp_ack+0x1487/0x2e60 [ 2873.581200] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.581200] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.581200] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.581200] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.581200] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.581200] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.581200] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.581200] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.581200] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.581200] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.581200] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.581200] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.581200] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.581200] [] ip_local_deliver+0x24d/0x330 [ 2873.581200] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.581200] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.581200] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.581200] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.581200] [] ip_rcv_finish+0x599/0x1870 [ 2873.581200] [] ip_rcv+0x89b/0x11d0 [ 2873.581200] [] ? ip_local_deliver+0x330/0x330 [ 2873.581200] [] ? inet_del_offload+0x40/0x40 [ 2873.581200] [] ? ip_local_deliver+0x330/0x330 [ 2873.581200] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.581200] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.581200] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.581200] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.581200] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.581200] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.581200] [] ? process_backlog+0x217/0x650 [ 2873.581200] [] __netif_receive_skb+0x5a/0x190 [ 2873.581200] [] process_backlog+0xd8/0x650 [ 2873.581200] [] ? process_backlog+0x217/0x650 [ 2873.581200] [] net_rx_action+0x655/0xde0 [ 2873.581200] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.581200] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.581200] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.581200] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.581200] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.581200] [] __do_softirq+0x22c/0x99f [ 2873.581200] [] ? cpu_callback+0x850/0x850 [ 2873.581200] [] run_ksoftirqd+0x1f/0x60 [ 2873.581200] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.581200] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.581200] [] ? schedule+0x9c/0x1c0 [ 2873.581200] [] ? __kthread_parkme+0xdc/0x200 [ 2873.581200] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.581200] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.581200] [] kthread+0x20e/0x2d0 [ 2873.581200] [] ? kthread_create_on_node+0x390/0x390 [ 2873.581200] [] ret_from_fork+0x1f/0x40 [ 2873.581200] [] ? kthread_create_on_node+0x390/0x390 [ 2873.581200] Memory state around the buggy address: [ 2873.581200] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.581200] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.581200] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.581200] ^ [ 2873.581200] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.581200] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.581200] ================================================================== [ 2873.639254] ================================================================== [ 2873.640248] BUG: KASAN: use-after-free in skb_release_head_state+0x1bc/0x1f0 at addr ffff8803795bb068 [ 2873.640248] Read of size 8 by task ksoftirqd/3/28 [ 2873.640248] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.640248] flags: 0x1000000000000000() [ 2873.640248] page dumped because: kasan: bad access detected [ 2873.640248] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.640248] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.640248] dffffc0000000000 ffff88038ca170c0 ffffffff8199f263 ffff88038ca17150 [ 2873.640248] ffff8803795bb068 ffff88038ca17140 ffffffff8151c33e ffff88038ca170e8 [ 2873.640248] 0000000000000018 0000000000000282 0000000000000286 ffffed006f2b7640 [ 2873.640248] Call Trace: [ 2873.640248] [] dump_stack+0x67/0x94 [ 2873.640248] [] kasan_report_error+0x4ae/0x4e0 [ 2873.640248] [] ? kasan_end_report+0x37/0x50 [ 2873.640248] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.640248] [] ? skb_release_head_state+0x1bc/0x1f0 [ 2873.640248] [] skb_release_head_state+0x1bc/0x1f0 [ 2873.640248] [] skb_release_all+0x12/0x50 [ 2873.640248] [] __kfree_skb+0x12/0x20 [ 2873.640248] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.640248] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.640248] [] tcp_ack+0x1487/0x2e60 [ 2873.640248] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.640248] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.640248] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.640248] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.640248] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.640248] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.640248] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.640248] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.640248] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.640248] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.640248] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.640248] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.640248] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.640248] [] ip_local_deliver+0x24d/0x330 [ 2873.640248] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.640248] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.640248] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.640248] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.640248] [] ip_rcv_finish+0x599/0x1870 [ 2873.640248] [] ip_rcv+0x89b/0x11d0 [ 2873.640248] [] ? ip_local_deliver+0x330/0x330 [ 2873.640248] [] ? inet_del_offload+0x40/0x40 [ 2873.640248] [] ? ip_local_deliver+0x330/0x330 [ 2873.640248] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.640248] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.640248] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.640248] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.640248] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.640248] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.640248] [] ? process_backlog+0x217/0x650 [ 2873.640248] [] __netif_receive_skb+0x5a/0x190 [ 2873.640248] [] process_backlog+0xd8/0x650 [ 2873.640248] [] ? process_backlog+0x217/0x650 [ 2873.640248] [] net_rx_action+0x655/0xde0 [ 2873.640248] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.640248] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.640248] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.640248] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.640248] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.640248] [] __do_softirq+0x22c/0x99f [ 2873.640248] [] ? cpu_callback+0x850/0x850 [ 2873.640248] [] run_ksoftirqd+0x1f/0x60 [ 2873.640248] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.640248] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.640248] [] ? schedule+0x9c/0x1c0 [ 2873.640248] [] ? __kthread_parkme+0xdc/0x200 [ 2873.640248] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.640248] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.640248] [] kthread+0x20e/0x2d0 [ 2873.640248] [] ? kthread_create_on_node+0x390/0x390 [ 2873.640248] [] ret_from_fork+0x1f/0x40 [ 2873.640248] [] ? kthread_create_on_node+0x390/0x390 [ 2873.640248] Memory state around the buggy address: [ 2873.640248] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.640248] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.640248] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.640248] ^ [ 2873.640248] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.640248] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.640248] ================================================================== [ 2873.707447] ================================================================== [ 2873.708394] BUG: KASAN: use-after-free in skb_release_head_state+0x1c6/0x1f0 at addr ffff8803795bb078 [ 2873.708441] Read of size 8 by task ksoftirqd/3/28 [ 2873.708441] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.708441] flags: 0x1000000000000000() [ 2873.708441] page dumped because: kasan: bad access detected [ 2873.708441] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.708441] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.708441] dffffc0000000000 ffff88038ca170c0 ffffffff8199f263 ffff88038ca17150 [ 2873.708441] ffff8803795bb078 ffff88038ca17140 ffffffff8151c33e 0000000000000010 [ 2873.708441] 0000000000000000 ffffed006f2b760d 0000000000000286 ffffffff6f2b7640 [ 2873.708441] Call Trace: [ 2873.708441] [] dump_stack+0x67/0x94 [ 2873.708441] [] kasan_report_error+0x4ae/0x4e0 [ 2873.708441] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.708441] [] ? skb_release_head_state+0x1c6/0x1f0 [ 2873.708441] [] skb_release_head_state+0x1c6/0x1f0 [ 2873.708441] [] skb_release_all+0x12/0x50 [ 2873.708441] [] __kfree_skb+0x12/0x20 [ 2873.708441] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.708441] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.708441] [] tcp_ack+0x1487/0x2e60 [ 2873.708441] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.708441] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.708441] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.708441] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.708441] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.708441] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.708441] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.708441] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.708441] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.708441] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.708441] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.708441] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.708441] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.708441] [] ip_local_deliver+0x24d/0x330 [ 2873.708441] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.708441] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.708441] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.708441] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.708441] [] ip_rcv_finish+0x599/0x1870 [ 2873.708441] [] ip_rcv+0x89b/0x11d0 [ 2873.708441] [] ? ip_local_deliver+0x330/0x330 [ 2873.708441] [] ? inet_del_offload+0x40/0x40 [ 2873.708441] [] ? ip_local_deliver+0x330/0x330 [ 2873.708441] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.708441] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.708441] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.708441] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.708441] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.708441] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.708441] [] ? process_backlog+0x217/0x650 [ 2873.708441] [] __netif_receive_skb+0x5a/0x190 [ 2873.708441] [] process_backlog+0xd8/0x650 [ 2873.708441] [] ? process_backlog+0x217/0x650 [ 2873.708441] [] net_rx_action+0x655/0xde0 [ 2873.708441] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.708441] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.708441] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.708441] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.708441] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.708441] [] __do_softirq+0x22c/0x99f [ 2873.708441] [] ? cpu_callback+0x850/0x850 [ 2873.708441] [] run_ksoftirqd+0x1f/0x60 [ 2873.708441] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.708441] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.708441] [] ? schedule+0x9c/0x1c0 [ 2873.708441] [] ? __kthread_parkme+0xdc/0x200 [ 2873.708441] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.708441] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.708441] [] kthread+0x20e/0x2d0 [ 2873.708441] [] ? kthread_create_on_node+0x390/0x390 [ 2873.708441] [] ret_from_fork+0x1f/0x40 [ 2873.708441] [] ? kthread_create_on_node+0x390/0x390 [ 2873.708441] Memory state around the buggy address: [ 2873.708441] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.708441] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.708441] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.708441] ^ [ 2873.708441] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.708441] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.708441] ================================================================== [ 2873.776175] ================================================================== [ 2873.777128] BUG: KASAN: use-after-free in skb_release_head_state+0x1af/0x1f0 at addr ffff8803795bb070 [ 2873.777168] Read of size 8 by task ksoftirqd/3/28 [ 2873.777168] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.777168] flags: 0x1000000000000000() [ 2873.777168] page dumped because: kasan: bad access detected [ 2873.777168] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.777168] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.777168] dffffc0000000000 ffff88038ca170c0 ffffffff8199f263 ffff88038ca17150 [ 2873.777168] ffff8803795bb070 ffff88038ca17140 ffffffff8151c33e 0000000000000010 [ 2873.777168] 0000000000000000 ffffed006f2b760f 0000000000000286 ffffffff6f2b7640 [ 2873.777168] Call Trace: [ 2873.777168] [] dump_stack+0x67/0x94 [ 2873.777168] [] kasan_report_error+0x4ae/0x4e0 [ 2873.777168] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.777168] [] ? skb_release_head_state+0x1af/0x1f0 [ 2873.777168] [] skb_release_head_state+0x1af/0x1f0 [ 2873.777168] [] skb_release_all+0x12/0x50 [ 2873.777168] [] __kfree_skb+0x12/0x20 [ 2873.777168] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.777168] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.777168] [] tcp_ack+0x1487/0x2e60 [ 2873.777168] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.777168] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.777168] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.777168] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.777168] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.777168] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.777168] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.777168] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.777168] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.777168] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.777168] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.777168] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.777168] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.777168] [] ip_local_deliver+0x24d/0x330 [ 2873.777168] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.777168] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.777168] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.777168] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.777168] [] ip_rcv_finish+0x599/0x1870 [ 2873.777168] [] ip_rcv+0x89b/0x11d0 [ 2873.777168] [] ? ip_local_deliver+0x330/0x330 [ 2873.777168] [] ? inet_del_offload+0x40/0x40 [ 2873.777168] [] ? ip_local_deliver+0x330/0x330 [ 2873.777168] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.777168] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.777168] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.777168] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.777168] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.777168] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.777168] [] ? process_backlog+0x217/0x650 [ 2873.777168] [] __netif_receive_skb+0x5a/0x190 [ 2873.777168] [] process_backlog+0xd8/0x650 [ 2873.777168] [] ? process_backlog+0x217/0x650 [ 2873.777168] [] net_rx_action+0x655/0xde0 [ 2873.777168] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.777168] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.777168] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.777168] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.777168] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.777168] [] __do_softirq+0x22c/0x99f [ 2873.777168] [] ? cpu_callback+0x850/0x850 [ 2873.777168] [] run_ksoftirqd+0x1f/0x60 [ 2873.777168] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.777168] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.777168] [] ? schedule+0x9c/0x1c0 [ 2873.777168] [] ? __kthread_parkme+0xdc/0x200 [ 2873.777168] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.777168] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.777168] [] kthread+0x20e/0x2d0 [ 2873.777168] [] ? kthread_create_on_node+0x390/0x390 [ 2873.777168] [] ret_from_fork+0x1f/0x40 [ 2873.777168] [] ? kthread_create_on_node+0x390/0x390 [ 2873.777168] Memory state around the buggy address: [ 2873.777168] ffff8803795baf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.777168] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.777168] >ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.777168] ^ [ 2873.777168] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.777168] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.777168] ================================================================== [ 2873.837106] ================================================================== [ 2873.838053] BUG: KASAN: use-after-free in skb_release_head_state+0x1da/0x1f0 at addr ffff8803795bb080 [ 2873.838100] Read of size 8 by task ksoftirqd/3/28 [ 2873.838100] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.838100] flags: 0x1000000000000000() [ 2873.838100] page dumped because: kasan: bad access detected [ 2873.838100] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.838100] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.838100] dffffc0000000000 ffff88038ca170c0 ffffffff8199f263 ffff88038ca17150 [ 2873.838100] ffff8803795bb080 ffff88038ca17140 ffffffff8151c33e 0000000000000010 [ 2873.838100] 0000000000000000 ffffed006f2b760e 0000000000000286 ffffffff6f2b7640 [ 2873.838100] Call Trace: [ 2873.838100] [] dump_stack+0x67/0x94 [ 2873.838100] [] kasan_report_error+0x4ae/0x4e0 [ 2873.838100] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.838100] [] ? skb_release_head_state+0x1da/0x1f0 [ 2873.838100] [] skb_release_head_state+0x1da/0x1f0 [ 2873.838100] [] skb_release_all+0x12/0x50 [ 2873.838100] [] __kfree_skb+0x12/0x20 [ 2873.838100] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.838100] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.838100] [] tcp_ack+0x1487/0x2e60 [ 2873.838100] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.838100] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.838100] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.838100] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.838100] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.838100] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.838100] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.838100] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.838100] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.838100] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.838100] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.838100] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.838100] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.838100] [] ip_local_deliver+0x24d/0x330 [ 2873.838100] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.838100] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.838100] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.838100] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.838100] [] ip_rcv_finish+0x599/0x1870 [ 2873.838100] [] ip_rcv+0x89b/0x11d0 [ 2873.838100] [] ? ip_local_deliver+0x330/0x330 [ 2873.838100] [] ? inet_del_offload+0x40/0x40 [ 2873.838100] [] ? ip_local_deliver+0x330/0x330 [ 2873.838100] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.838100] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.838100] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.838100] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.838100] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.838100] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.838100] [] ? process_backlog+0x217/0x650 [ 2873.838100] [] __netif_receive_skb+0x5a/0x190 [ 2873.838100] [] process_backlog+0xd8/0x650 [ 2873.838100] [] ? process_backlog+0x217/0x650 [ 2873.838100] [] net_rx_action+0x655/0xde0 [ 2873.838100] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.838100] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.838100] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.838100] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.838100] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.838100] [] __do_softirq+0x22c/0x99f [ 2873.838100] [] ? cpu_callback+0x850/0x850 [ 2873.838100] [] run_ksoftirqd+0x1f/0x60 [ 2873.838100] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.838100] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.838100] [] ? schedule+0x9c/0x1c0 [ 2873.838100] [] ? __kthread_parkme+0xdc/0x200 [ 2873.838100] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.838100] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.838100] [] kthread+0x20e/0x2d0 [ 2873.838100] [] ? kthread_create_on_node+0x390/0x390 [ 2873.838100] [] ret_from_fork+0x1f/0x40 [ 2873.838100] [] ? kthread_create_on_node+0x390/0x390 [ 2873.838100] Memory state around the buggy address: [ 2873.838100] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.838100] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.838100] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.838100] ^ [ 2873.838100] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.838100] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.838100] ================================================================== [ 2873.904281] ================================================================== [ 2873.905227] BUG: KASAN: use-after-free in skb_release_head_state+0x1d0/0x1f0 at addr ffff8803795bb088 [ 2873.905275] Read of size 8 by task ksoftirqd/3/28 [ 2873.905275] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.905275] flags: 0x1000000000000000() [ 2873.905275] page dumped because: kasan: bad access detected [ 2873.905275] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.905275] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.905275] dffffc0000000000 ffff88038ca170c0 ffffffff8199f263 ffff88038ca17150 [ 2873.905275] ffff8803795bb088 ffff88038ca17140 ffffffff8151c33e 0000000000000010 [ 2873.905275] 0000000000000000 ffffed006f2b7610 0000000000000286 ffffffff6f2b7640 [ 2873.905275] Call Trace: [ 2873.905275] [] dump_stack+0x67/0x94 [ 2873.905275] [] kasan_report_error+0x4ae/0x4e0 [ 2873.905275] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.905275] [] ? skb_release_head_state+0x1d0/0x1f0 [ 2873.905275] [] skb_release_head_state+0x1d0/0x1f0 [ 2873.905275] [] skb_release_all+0x12/0x50 [ 2873.905275] [] __kfree_skb+0x12/0x20 [ 2873.905275] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.905275] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.905275] [] tcp_ack+0x1487/0x2e60 [ 2873.905275] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.905275] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.905275] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.905275] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.905275] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.905275] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.905275] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.905275] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.905275] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.905275] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.905275] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.905275] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.905275] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.905275] [] ip_local_deliver+0x24d/0x330 [ 2873.905275] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.905275] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.905275] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.905275] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.905275] [] ip_rcv_finish+0x599/0x1870 [ 2873.905275] [] ip_rcv+0x89b/0x11d0 [ 2873.905275] [] ? ip_local_deliver+0x330/0x330 [ 2873.905275] [] ? inet_del_offload+0x40/0x40 [ 2873.905275] [] ? ip_local_deliver+0x330/0x330 [ 2873.905275] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.905275] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.905275] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.905275] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.905275] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.905275] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.905275] [] ? process_backlog+0x217/0x650 [ 2873.905275] [] __netif_receive_skb+0x5a/0x190 [ 2873.905275] [] process_backlog+0xd8/0x650 [ 2873.905275] [] ? process_backlog+0x217/0x650 [ 2873.905275] [] net_rx_action+0x655/0xde0 [ 2873.905275] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.905275] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.905275] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.905275] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.905275] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.905275] [] __do_softirq+0x22c/0x99f [ 2873.905275] [] ? cpu_callback+0x850/0x850 [ 2873.905275] [] run_ksoftirqd+0x1f/0x60 [ 2873.905275] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.905275] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.905275] [] ? schedule+0x9c/0x1c0 [ 2873.905275] [] ? __kthread_parkme+0xdc/0x200 [ 2873.905275] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.905275] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.905275] [] kthread+0x20e/0x2d0 [ 2873.905275] [] ? kthread_create_on_node+0x390/0x390 [ 2873.905275] [] ret_from_fork+0x1f/0x40 [ 2873.905275] [] ? kthread_create_on_node+0x390/0x390 [ 2873.905275] Memory state around the buggy address: [ 2873.905275] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.905275] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.905275] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.905275] ^ [ 2873.905275] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.905275] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.905275] ================================================================== [ 2873.967605] ================================================================== [ 2873.968549] BUG: KASAN: use-after-free in skb_release_all+0x4a/0x50 at addr ffff8803795bb0e0 [ 2873.968599] Read of size 8 by task ksoftirqd/3/28 [ 2873.968599] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2873.968599] flags: 0x1000000000000000() [ 2873.968599] page dumped because: kasan: bad access detected [ 2873.968599] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2873.968599] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2873.968599] dffffc0000000000 ffff88038ca170e0 ffffffff8199f263 ffff88038ca17170 [ 2873.968599] ffff8803795bb0e0 ffff88038ca17160 ffffffff8151c33e ffffffff6f2b7640 [ 2873.968599] ffffffffffffffff 66666620ffffffff 0000000000000282 00203a3038316262 [ 2873.968599] Call Trace: [ 2873.968599] [] dump_stack+0x67/0x94 [ 2873.968599] [] kasan_report_error+0x4ae/0x4e0 [ 2873.968599] [] __asan_report_load8_noabort+0x43/0x50 [ 2873.968599] [] ? skb_release_all+0x4a/0x50 [ 2873.968599] [] skb_release_all+0x4a/0x50 [ 2873.968599] [] __kfree_skb+0x12/0x20 [ 2873.968599] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2873.968599] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2873.968599] [] tcp_ack+0x1487/0x2e60 [ 2873.968599] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.968599] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2873.968599] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.968599] [] tcp_rcv_established+0x58c/0x2de0 [ 2873.968599] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2873.968599] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2873.968599] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2873.968599] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2873.968599] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2873.968599] [] tcp_v4_rcv+0x213e/0x3420 [ 2873.968599] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2873.968599] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2873.968599] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2873.968599] [] ip_local_deliver+0x24d/0x330 [ 2873.968599] [] ? ip_call_ra_chain+0x510/0x510 [ 2873.968599] [] ? nf_hook_slow+0x186/0x2a0 [ 2873.968599] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2873.968599] [] ? nf_hook_slow+0x5/0x2a0 [ 2873.968599] [] ip_rcv_finish+0x599/0x1870 [ 2873.968599] [] ip_rcv+0x89b/0x11d0 [ 2873.968599] [] ? ip_local_deliver+0x330/0x330 [ 2873.968599] [] ? inet_del_offload+0x40/0x40 [ 2873.968599] [] ? ip_local_deliver+0x330/0x330 [ 2873.968599] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2873.968599] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.968599] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2873.968599] [] ? net_tx_action+0x9d0/0x9d0 [ 2873.968599] [] ? default_send_IPI_single+0x75/0xa0 [ 2873.968599] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2873.968599] [] ? process_backlog+0x217/0x650 [ 2873.968599] [] __netif_receive_skb+0x5a/0x190 [ 2873.968599] [] process_backlog+0xd8/0x650 [ 2873.968599] [] ? process_backlog+0x217/0x650 [ 2873.968599] [] net_rx_action+0x655/0xde0 [ 2873.968599] [] ? sk_busy_loop+0xb90/0xb90 [ 2873.968599] [] ? trace_hardirqs_on+0xd/0x10 [ 2873.968599] [] ? finish_task_switch+0x1fa/0x5a0 [ 2873.968599] [] ? finish_task_switch+0x1ce/0x5a0 [ 2873.968599] [] ? run_ksoftirqd+0x1f/0x60 [ 2873.968599] [] __do_softirq+0x22c/0x99f [ 2873.968599] [] ? cpu_callback+0x850/0x850 [ 2873.968599] [] run_ksoftirqd+0x1f/0x60 [ 2873.968599] [] smpboot_thread_fn+0x3c4/0x840 [ 2873.968599] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.968599] [] ? schedule+0x9c/0x1c0 [ 2873.968599] [] ? __kthread_parkme+0xdc/0x200 [ 2873.968599] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.968599] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2873.968599] [] kthread+0x20e/0x2d0 [ 2873.968599] [] ? kthread_create_on_node+0x390/0x390 [ 2873.968599] [] ret_from_fork+0x1f/0x40 [ 2873.968599] [] ? kthread_create_on_node+0x390/0x390 [ 2873.968599] Memory state around the buggy address: [ 2873.968599] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2873.968599] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.968599] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.968599] ^ [ 2873.968599] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.968599] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2873.968599] ================================================================== [ 2874.033936] ================================================================== [ 2874.034930] BUG: KASAN: use-after-free in skb_release_data+0x2fb/0x320 at addr ffff8803795bb0dc [ 2874.034930] Read of size 4 by task ksoftirqd/3/28 [ 2874.034930] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.034930] flags: 0x1000000000000000() [ 2874.034930] page dumped because: kasan: bad access detected [ 2874.034930] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.034930] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.034930] dffffc0000000000 ffff88038ca170a0 ffffffff8199f263 ffff88038ca17130 [ 2874.034930] ffff8803795bb0dc ffff88038ca17120 ffffffff8151c33e 0000000000000282 [ 2874.034930] ffff88038ca17108 ffffed006f2b7640 0000000000000282 ffffffff8151be77 [ 2874.034930] Call Trace: [ 2874.034930] [] dump_stack+0x67/0x94 [ 2874.034930] [] kasan_report_error+0x4ae/0x4e0 [ 2874.034930] [] ? kasan_end_report+0x37/0x50 [ 2874.034930] [] ? kasan_report_error+0x42d/0x4e0 [ 2874.034930] [] __asan_report_load4_noabort+0x43/0x50 [ 2874.034930] [] ? skb_release_data+0x2fb/0x320 [ 2874.034930] [] skb_release_data+0x2fb/0x320 [ 2874.034930] [] skb_release_all+0x42/0x50 [ 2874.034930] [] __kfree_skb+0x12/0x20 [ 2874.034930] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.034930] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.034930] [] tcp_ack+0x1487/0x2e60 [ 2874.034930] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.034930] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.034930] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.034930] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.034930] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.034930] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.034930] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.034930] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.034930] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.034930] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.034930] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.034930] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.034930] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.034930] [] ip_local_deliver+0x24d/0x330 [ 2874.034930] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.034930] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.034930] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.034930] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.034930] [] ip_rcv_finish+0x599/0x1870 [ 2874.034930] [] ip_rcv+0x89b/0x11d0 [ 2874.034930] [] ? ip_local_deliver+0x330/0x330 [ 2874.034930] [] ? inet_del_offload+0x40/0x40 [ 2874.034930] [] ? ip_local_deliver+0x330/0x330 [ 2874.034930] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.034930] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.034930] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.034930] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.034930] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.034930] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.034930] [] ? process_backlog+0x217/0x650 [ 2874.034930] [] __netif_receive_skb+0x5a/0x190 [ 2874.034930] [] process_backlog+0xd8/0x650 [ 2874.034930] [] ? process_backlog+0x217/0x650 [ 2874.034930] [] net_rx_action+0x655/0xde0 [ 2874.034930] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.034930] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.034930] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.034930] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.034930] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.034930] [] __do_softirq+0x22c/0x99f [ 2874.034930] [] ? cpu_callback+0x850/0x850 [ 2874.034930] [] run_ksoftirqd+0x1f/0x60 [ 2874.034930] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.034930] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.034930] [] ? schedule+0x9c/0x1c0 [ 2874.034930] [] ? __kthread_parkme+0xdc/0x200 [ 2874.034930] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.034930] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.034930] [] kthread+0x20e/0x2d0 [ 2874.034930] [] ? kthread_create_on_node+0x390/0x390 [ 2874.034930] [] ret_from_fork+0x1f/0x40 [ 2874.034930] [] ? kthread_create_on_node+0x390/0x390 [ 2874.034930] Memory state around the buggy address: [ 2874.034930] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.034930] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.034930] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.034930] ^ [ 2874.034930] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.034930] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.034930] ================================================================== [ 2874.096156] ================================================================== [ 2874.097104] BUG: KASAN: use-after-free in skb_release_data+0x2f1/0x320 at addr ffff8803795bb0e0 [ 2874.097150] Read of size 8 by task ksoftirqd/3/28 [ 2874.097150] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.097150] flags: 0x1000000000000000() [ 2874.097150] page dumped because: kasan: bad access detected [ 2874.097150] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.097150] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.097150] dffffc0000000000 ffff88038ca170a0 ffffffff8199f263 ffff88038ca17130 [ 2874.097150] ffff8803795bb0e0 ffff88038ca17120 ffffffff8151c33e 0000000000000010 [ 2874.097150] ffff880300000000 ffffed006f2b761b 0000000000000282 ffffffff8151be77 [ 2874.097150] Call Trace: [ 2874.097150] [] dump_stack+0x67/0x94 [ 2874.097150] [] kasan_report_error+0x4ae/0x4e0 [ 2874.097150] [] ? kasan_end_report+0x37/0x50 [ 2874.097150] [] __asan_report_load8_noabort+0x43/0x50 [ 2874.097150] [] ? skb_release_data+0x2f1/0x320 [ 2874.097150] [] skb_release_data+0x2f1/0x320 [ 2874.097150] [] skb_release_all+0x42/0x50 [ 2874.097150] [] __kfree_skb+0x12/0x20 [ 2874.097150] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.097150] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.097150] [] tcp_ack+0x1487/0x2e60 [ 2874.097150] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.097150] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.097150] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.097150] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.097150] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.097150] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.097150] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.097150] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.097150] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.097150] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.097150] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.097150] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.097150] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.097150] [] ip_local_deliver+0x24d/0x330 [ 2874.097150] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.097150] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.097150] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.097150] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.097150] [] ip_rcv_finish+0x599/0x1870 [ 2874.097150] [] ip_rcv+0x89b/0x11d0 [ 2874.097150] [] ? ip_local_deliver+0x330/0x330 [ 2874.097150] [] ? inet_del_offload+0x40/0x40 [ 2874.097150] [] ? ip_local_deliver+0x330/0x330 [ 2874.097150] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.097150] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.097150] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.097150] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.097150] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.097150] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.097150] [] ? process_backlog+0x217/0x650 [ 2874.097150] [] __netif_receive_skb+0x5a/0x190 [ 2874.097150] [] process_backlog+0xd8/0x650 [ 2874.097150] [] ? process_backlog+0x217/0x650 [ 2874.097150] [] net_rx_action+0x655/0xde0 [ 2874.097150] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.097150] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.097150] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.097150] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.097150] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.097150] [] __do_softirq+0x22c/0x99f [ 2874.097150] [] ? cpu_callback+0x850/0x850 [ 2874.097150] [] run_ksoftirqd+0x1f/0x60 [ 2874.097150] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.097150] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.097150] [] ? schedule+0x9c/0x1c0 [ 2874.097150] [] ? __kthread_parkme+0xdc/0x200 [ 2874.097150] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.097150] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.097150] [] kthread+0x20e/0x2d0 [ 2874.097150] [] ? kthread_create_on_node+0x390/0x390 [ 2874.097150] [] ret_from_fork+0x1f/0x40 [ 2874.097150] [] ? kthread_create_on_node+0x390/0x390 [ 2874.097150] Memory state around the buggy address: [ 2874.097150] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.097150] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.097150] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.097150] ^ [ 2874.097150] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.097150] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.097150] ================================================================== [ 2874.163818] ================================================================== [ 2874.164764] BUG: KASAN: use-after-free in skb_release_data+0x2d0/0x320 at addr ffff8803795bb09e [ 2874.164812] Read of size 1 by task ksoftirqd/3/28 [ 2874.164812] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.164812] flags: 0x1000000000000000() [ 2874.164812] page dumped because: kasan: bad access detected [ 2874.164812] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.164812] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.164812] dffffc0000000000 ffff88038ca170a0 ffffffff8199f263 ffff88038ca17130 [ 2874.164812] ffff8803795bb09e ffff88038ca17120 ffffffff8151c33e 0000000000000010 [ 2874.164812] ffff880300000000 ffffed006f2b761c 0000000000000282 ffffffff8151be77 [ 2874.164812] Call Trace: [ 2874.164812] [] dump_stack+0x67/0x94 [ 2874.164812] [] kasan_report_error+0x4ae/0x4e0 [ 2874.164812] [] ? kasan_end_report+0x37/0x50 [ 2874.164812] [] __asan_report_load1_noabort+0x43/0x50 [ 2874.164812] [] ? skb_release_data+0x2d0/0x320 [ 2874.164812] [] skb_release_data+0x2d0/0x320 [ 2874.164812] [] skb_release_all+0x42/0x50 [ 2874.164812] [] __kfree_skb+0x12/0x20 [ 2874.164812] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.164812] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.164812] [] tcp_ack+0x1487/0x2e60 [ 2874.164812] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.164812] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.164812] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.164812] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.164812] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.164812] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.164812] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.164812] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.164812] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.164812] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.164812] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.164812] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.164812] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.164812] [] ip_local_deliver+0x24d/0x330 [ 2874.164812] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.164812] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.164812] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.164812] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.164812] [] ip_rcv_finish+0x599/0x1870 [ 2874.164812] [] ip_rcv+0x89b/0x11d0 [ 2874.164812] [] ? ip_local_deliver+0x330/0x330 [ 2874.164812] [] ? inet_del_offload+0x40/0x40 [ 2874.164812] [] ? ip_local_deliver+0x330/0x330 [ 2874.164812] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.164812] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.164812] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.164812] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.164812] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.164812] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.164812] [] ? process_backlog+0x217/0x650 [ 2874.164812] [] __netif_receive_skb+0x5a/0x190 [ 2874.164812] [] process_backlog+0xd8/0x650 [ 2874.164812] [] ? process_backlog+0x217/0x650 [ 2874.164812] [] net_rx_action+0x655/0xde0 [ 2874.164812] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.164812] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.164812] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.164812] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.164812] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.164812] [] __do_softirq+0x22c/0x99f [ 2874.164812] [] ? cpu_callback+0x850/0x850 [ 2874.164812] [] run_ksoftirqd+0x1f/0x60 [ 2874.164812] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.164812] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.164812] [] ? schedule+0x9c/0x1c0 [ 2874.164812] [] ? __kthread_parkme+0xdc/0x200 [ 2874.164812] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.164812] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.164812] [] kthread+0x20e/0x2d0 [ 2874.164812] [] ? kthread_create_on_node+0x390/0x390 [ 2874.164812] [] ret_from_fork+0x1f/0x40 [ 2874.164812] [] ? kthread_create_on_node+0x390/0x390 [ 2874.164812] Memory state around the buggy address: [ 2874.164812] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.164812] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.164812] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.164812] ^ [ 2874.164812] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.164812] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.164812] ================================================================== [ 2874.231765] ================================================================== [ 2874.232758] BUG: KASAN: use-after-free in skb_free_head+0x8a/0x90 at addr ffff8803795bb0e0 [ 2874.232758] Read of size 8 by task ksoftirqd/3/28 [ 2874.232758] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.232758] flags: 0x1000000000000000() [ 2874.232758] page dumped because: kasan: bad access detected [ 2874.232758] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.232758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.232758] 0000000000000004 ffff88038ca17080 ffffffff8199f263 ffff88038ca17110 [ 2874.232758] ffff8803795bb0e0 ffff88038ca17100 ffffffff8151c33e ffffffff8151be77 [ 2874.232758] ffffed006f2b7630 ffff88038ca17120 0000000000000286 0000000000000010 [ 2874.232758] Call Trace: [ 2874.232758] [] dump_stack+0x67/0x94 [ 2874.232758] [] kasan_report_error+0x4ae/0x4e0 [ 2874.232758] [] ? kasan_end_report+0x37/0x50 [ 2874.232758] [] ? kasan_end_report+0x37/0x50 [ 2874.232758] [] __asan_report_load8_noabort+0x43/0x50 [ 2874.232758] [] ? kasan_report_error+0x470/0x4e0 [ 2874.232758] [] ? skb_free_head+0x8a/0x90 [ 2874.232758] [] skb_free_head+0x8a/0x90 [ 2874.232758] [] skb_release_data+0x22c/0x320 [ 2874.232758] [] skb_release_all+0x42/0x50 [ 2874.232758] [] __kfree_skb+0x12/0x20 [ 2874.232758] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.232758] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.232758] [] tcp_ack+0x1487/0x2e60 [ 2874.232758] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.232758] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.232758] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.232758] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.232758] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.232758] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.232758] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.232758] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.232758] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.232758] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.232758] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.232758] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.232758] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.232758] [] ip_local_deliver+0x24d/0x330 [ 2874.232758] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.232758] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.232758] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.232758] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.232758] [] ip_rcv_finish+0x599/0x1870 [ 2874.232758] [] ip_rcv+0x89b/0x11d0 [ 2874.232758] [] ? ip_local_deliver+0x330/0x330 [ 2874.232758] [] ? inet_del_offload+0x40/0x40 [ 2874.232758] [] ? ip_local_deliver+0x330/0x330 [ 2874.232758] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.232758] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.232758] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.232758] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.232758] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.232758] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.232758] [] ? process_backlog+0x217/0x650 [ 2874.232758] [] __netif_receive_skb+0x5a/0x190 [ 2874.232758] [] process_backlog+0xd8/0x650 [ 2874.232758] [] ? process_backlog+0x217/0x650 [ 2874.232758] [] net_rx_action+0x655/0xde0 [ 2874.232758] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.232758] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.232758] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.232758] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.232758] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.232758] [] __do_softirq+0x22c/0x99f [ 2874.232758] [] ? cpu_callback+0x850/0x850 [ 2874.232758] [] run_ksoftirqd+0x1f/0x60 [ 2874.232758] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.232758] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.232758] [] ? schedule+0x9c/0x1c0 [ 2874.232758] [] ? __kthread_parkme+0xdc/0x200 [ 2874.232758] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.232758] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.232758] [] kthread+0x20e/0x2d0 [ 2874.232758] [] ? kthread_create_on_node+0x390/0x390 [ 2874.232758] [] ret_from_fork+0x1f/0x40 [ 2874.232758] [] ? kthread_create_on_node+0x390/0x390 [ 2874.232758] Memory state around the buggy address: [ 2874.232758] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.232758] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.232758] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.232758] ^ [ 2874.232758] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.232758] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.232758] ================================================================== [ 2874.299495] ================================================================== [ 2874.300448] BUG: KASAN: use-after-free in skb_free_head+0x83/0x90 at addr ffff8803795bb09e [ 2874.300487] Read of size 1 by task ksoftirqd/3/28 [ 2874.300487] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.300487] flags: 0x1000000000000000() [ 2874.300487] page dumped because: kasan: bad access detected [ 2874.300487] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.300487] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.300487] 0000000000000004 ffff88038ca17080 ffffffff8199f263 ffff88038ca17110 [ 2874.300487] ffff8803795bb09e ffff88038ca17100 ffffffff8151c33e 0000000000000010 [ 2874.300487] ffffed0000000000 ffffed006f2b761c 0000000000000286 ffffffff00000010 [ 2874.300487] Call Trace: [ 2874.300487] [] dump_stack+0x67/0x94 [ 2874.300487] [] kasan_report_error+0x4ae/0x4e0 [ 2874.300487] [] __asan_report_load1_noabort+0x43/0x50 [ 2874.300487] [] ? kasan_report_error+0x470/0x4e0 [ 2874.300487] [] ? skb_free_head+0x83/0x90 [ 2874.300487] [] skb_free_head+0x83/0x90 [ 2874.300487] [] skb_release_data+0x22c/0x320 [ 2874.300487] [] skb_release_all+0x42/0x50 [ 2874.300487] [] __kfree_skb+0x12/0x20 [ 2874.300487] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.300487] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.300487] [] tcp_ack+0x1487/0x2e60 [ 2874.300487] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.300487] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.300487] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.300487] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.300487] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.300487] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.300487] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.300487] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.300487] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.300487] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.300487] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.300487] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.300487] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.300487] [] ip_local_deliver+0x24d/0x330 [ 2874.300487] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.300487] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.300487] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.300487] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.300487] [] ip_rcv_finish+0x599/0x1870 [ 2874.300487] [] ip_rcv+0x89b/0x11d0 [ 2874.300487] [] ? ip_local_deliver+0x330/0x330 [ 2874.300487] [] ? inet_del_offload+0x40/0x40 [ 2874.300487] [] ? ip_local_deliver+0x330/0x330 [ 2874.300487] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.300487] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.300487] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.300487] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.300487] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.300487] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.300487] [] ? process_backlog+0x217/0x650 [ 2874.300487] [] __netif_receive_skb+0x5a/0x190 [ 2874.300487] [] process_backlog+0xd8/0x650 [ 2874.300487] [] ? process_backlog+0x217/0x650 [ 2874.300487] [] net_rx_action+0x655/0xde0 [ 2874.300487] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.300487] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.300487] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.300487] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.300487] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.300487] [] __do_softirq+0x22c/0x99f [ 2874.300487] [] ? cpu_callback+0x850/0x850 [ 2874.300487] [] run_ksoftirqd+0x1f/0x60 [ 2874.300487] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.300487] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.300487] [] ? schedule+0x9c/0x1c0 [ 2874.300487] [] ? __kthread_parkme+0xdc/0x200 [ 2874.300487] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.300487] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.300487] [] kthread+0x20e/0x2d0 [ 2874.300487] [] ? kthread_create_on_node+0x390/0x390 [ 2874.300487] [] ret_from_fork+0x1f/0x40 [ 2874.300487] [] ? kthread_create_on_node+0x390/0x390 [ 2874.300487] Memory state around the buggy address: [ 2874.300487] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.300487] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.300487] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.300487] ^ [ 2874.300487] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.300487] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.300487] ================================================================== [ 2874.367806] ================================================================== [ 2874.368754] BUG: KASAN: use-after-free in kfree_skbmem+0x2ae/0x330 at addr ffff8803795bb09e [ 2874.368799] Read of size 1 by task ksoftirqd/3/28 [ 2874.368799] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.368799] flags: 0x1000000000000000() [ 2874.368799] page dumped because: kasan: bad access detected [ 2874.368799] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.368799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.368799] dffffc0000000000 ffff88038ca170d8 ffffffff8199f263 ffff88038ca17168 [ 2874.368799] ffff8803795bb09e ffff88038ca17158 ffffffff8151c33e 0000000000000004 [ 2874.368799] dffffc0000000000 dffffc0000000000 0000000000000292 ffffffff8151c3b3 [ 2874.368799] Call Trace: [ 2874.368799] [] dump_stack+0x67/0x94 [ 2874.368799] [] kasan_report_error+0x4ae/0x4e0 [ 2874.368799] [] ? __asan_report_load1_noabort+0x43/0x50 [ 2874.368799] [] ? kasan_report_error+0x470/0x4e0 [ 2874.368799] [] __asan_report_load1_noabort+0x43/0x50 [ 2874.368799] [] ? kfree_skbmem+0x2ae/0x330 [ 2874.368799] [] kfree_skbmem+0x2ae/0x330 [ 2874.368799] [] __kfree_skb+0x1a/0x20 [ 2874.368799] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.368799] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.368799] [] tcp_ack+0x1487/0x2e60 [ 2874.368799] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.368799] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.368799] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.368799] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.368799] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.368799] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.368799] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.368799] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.368799] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.368799] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.368799] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.368799] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.368799] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.368799] [] ip_local_deliver+0x24d/0x330 [ 2874.368799] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.368799] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.368799] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.368799] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.368799] [] ip_rcv_finish+0x599/0x1870 [ 2874.368799] [] ip_rcv+0x89b/0x11d0 [ 2874.368799] [] ? ip_local_deliver+0x330/0x330 [ 2874.368799] [] ? inet_del_offload+0x40/0x40 [ 2874.368799] [] ? ip_local_deliver+0x330/0x330 [ 2874.368799] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.368799] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.368799] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.368799] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.368799] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.368799] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.368799] [] ? process_backlog+0x217/0x650 [ 2874.368799] [] __netif_receive_skb+0x5a/0x190 [ 2874.368799] [] process_backlog+0xd8/0x650 [ 2874.368799] [] ? process_backlog+0x217/0x650 [ 2874.368799] [] net_rx_action+0x655/0xde0 [ 2874.368799] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.368799] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.368799] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.368799] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.368799] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.368799] [] __do_softirq+0x22c/0x99f [ 2874.368799] [] ? cpu_callback+0x850/0x850 [ 2874.368799] [] run_ksoftirqd+0x1f/0x60 [ 2874.368799] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.368799] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.368799] [] ? schedule+0x9c/0x1c0 [ 2874.368799] [] ? __kthread_parkme+0xdc/0x200 [ 2874.368799] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.368799] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.368799] [] kthread+0x20e/0x2d0 [ 2874.368799] [] ? kthread_create_on_node+0x390/0x390 [ 2874.368799] [] ret_from_fork+0x1f/0x40 [ 2874.368799] [] ? kthread_create_on_node+0x390/0x390 [ 2874.368799] Memory state around the buggy address: [ 2874.368799] ffff8803795baf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2874.368799] ffff8803795bb000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.368799] >ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.368799] ^ [ 2874.368799] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.368799] ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.368799] ================================================================== [ 2874.429502] ================================================================== [ 2874.430455] BUG: KASAN: use-after-free in kfree_skbmem+0x2dc/0x330 at addr ffff8803795bb1f0 [ 2874.430496] Read of size 4 by task ksoftirqd/3/28 [ 2874.430496] page:ffffea000de56ec0 count:0 mapcount:0 mapping: (null) index:0x0 [ 2874.430496] flags: 0x1000000000000000() [ 2874.430496] page dumped because: kasan: bad access detected [ 2874.430496] CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G B O 4.8.15-ab+ #5 [ 2874.430496] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 2874.430496] dffffc0000000000 ffff88038ca170d8 ffffffff8199f263 ffff88038ca17168 [ 2874.430496] ffff8803795bb1f0 ffff88038ca17158 ffffffff8151c33e 0000000000000010 [ 2874.430496] dffffc0000000000 ffffed006f2b7613 0000000000000292 ffffffff8151c3b3 [ 2874.430496] Call Trace: [ 2874.430496] [] dump_stack+0x67/0x94 [ 2874.430496] [] kasan_report_error+0x4ae/0x4e0 [ 2874.430496] [] ? __asan_report_load1_noabort+0x43/0x50 [ 2874.430496] [] __asan_report_load4_noabort+0x43/0x50 [ 2874.430496] [] ? kfree_skbmem+0x2dc/0x330 [ 2874.430496] [] kfree_skbmem+0x2dc/0x330 [ 2874.430496] [] __kfree_skb+0x1a/0x20 [ 2874.430496] [] tcp_clean_rtx_queue+0x603/0x2ce0 [ 2874.430496] [] ? tcp_rtt_estimator+0x7f0/0x7f0 [ 2874.430496] [] tcp_ack+0x1487/0x2e60 [ 2874.430496] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.430496] [] ? tcp_fastretrans_alert+0x2f50/0x2f50 [ 2874.430496] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.430496] [] tcp_rcv_established+0x58c/0x2de0 [ 2874.430496] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 2874.430496] [] ? sk_filter_trim_cap+0xd6/0x700 [ 2874.430496] [] ? tcp_data_queue+0x4ed0/0x4ed0 [ 2874.430496] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 2874.430496] [] tcp_v4_do_rcv+0x529/0x8c0 [ 2874.430496] [] tcp_v4_rcv+0x213e/0x3420 [ 2874.430496] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 2874.430496] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 2874.430496] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 2874.430496] [] ip_local_deliver+0x24d/0x330 [ 2874.430496] [] ? ip_call_ra_chain+0x510/0x510 [ 2874.430496] [] ? nf_hook_slow+0x186/0x2a0 [ 2874.430496] [] ? nf_hook_slow+0x1a5/0x2a0 [ 2874.430496] [] ? nf_hook_slow+0x5/0x2a0 [ 2874.430496] [] ip_rcv_finish+0x599/0x1870 [ 2874.430496] [] ip_rcv+0x89b/0x11d0 [ 2874.430496] [] ? ip_local_deliver+0x330/0x330 [ 2874.430496] [] ? inet_del_offload+0x40/0x40 [ 2874.430496] [] ? ip_local_deliver+0x330/0x330 [ 2874.430496] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 2874.430496] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.430496] [] ? debug_check_no_locks_freed+0x280/0x280 [ 2874.430496] [] ? net_tx_action+0x9d0/0x9d0 [ 2874.430496] [] ? default_send_IPI_single+0x75/0xa0 [ 2874.430496] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 2874.430496] [] ? process_backlog+0x217/0x650 [ 2874.430496] [] __netif_receive_skb+0x5a/0x190 [ 2874.430496] [] process_backlog+0xd8/0x650 [ 2874.430496] [] ? process_backlog+0x217/0x650 [ 2874.430496] [] net_rx_action+0x655/0xde0 [ 2874.430496] [] ? sk_busy_loop+0xb90/0xb90 [ 2874.430496] [] ? trace_hardirqs_on+0xd/0x10 [ 2874.430496] [] ? finish_task_switch+0x1fa/0x5a0 [ 2874.430496] [] ? finish_task_switch+0x1ce/0x5a0 [ 2874.430496] [] ? run_ksoftirqd+0x1f/0x60 [ 2874.430496] [] __do_softirq+0x22c/0x99f [ 2874.430496] [] ? cpu_callback+0x850/0x850 [ 2874.430496] [] run_ksoftirqd+0x1f/0x60 [ 2874.430496] [] smpboot_thread_fn+0x3c4/0x840 [ 2874.430496] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.430496] [] ? schedule+0x9c/0x1c0 [ 2874.430496] [] ? __kthread_parkme+0xdc/0x200 [ 2874.430496] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.430496] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 2874.430496] [] kthread+0x20e/0x2d0 [ 2874.430496] [] ? kthread_create_on_node+0x390/0x390 [ 2874.430496] [] ret_from_fork+0x1f/0x40 [ 2874.430496] [] ? kthread_create_on_node+0x390/0x390 [ 2874.430496] Memory state around the buggy address: [ 2874.430496] ffff8803795bb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.430496] ffff8803795bb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.430496] >ffff8803795bb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.430496] ^ [ 2874.430496] ffff8803795bb200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.430496] ffff8803795bb280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 2874.430496] ================================================================== [ 3040.251010] INFO: NMI handler (perf_event_nmi_handler) took too long to run: 12.026 msecs [ 3040.251010] perf: interrupt took too long (108543 > 32442), lowering kernel.perf_event_max_sample_rate to 1000 [ 5278.762292] kasan: CONFIG_KASAN_INLINE enabled [ 5278.762862] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 5278.763872] general protection fault: 0000 [#1] SMP KASAN [ 5278.764503] Modules linked in: tfw_sched_rr(O) tfw_sched_http(O) tfw_sched_hash(O) tempesta_fw(O) tempesta_db(O) tempesta_tls(O) ghash_clmulni_intel aesni_intel ppdev aes_x86_64 glue_helper lrw gf128mul 9pnet_virtio i2c_piix4 i2c_core ablk_helper cryptd acpi_cpufreq 9pnet input_leds led_class pcspkr virtio_balloon parport_pc parport ip_tables ata_generic pata_acpi crc32c_intel virtio_pci e1000 serio_raw virtio_ring virtio floppy ata_piix ipv6 crc_ccitt autofs4 [ 5278.764861] CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G B O 4.8.15-ab+ #5 [ 5278.764861] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 5278.764861] task: ffff88038cff9840 task.stack: ffff88038c878000 [ 5278.764861] RIP: 0010:[] [] tcp_v4_destroy_sock+0x154/0xc90 [ 5278.764861] RSP: 0018:ffff88038c87f3b0 EFLAGS: 00010206 [ 5278.778103] RAX: 3a726f462d646564 RBX: ffff8802d57c0000 RCX: ffff8802c61d0df0 [ 5278.778103] RDX: 1ffffffff05bb09f RSI: 726177726f462d58 RDI: 726177726f462d60 [ 5278.778103] RBP: ffff88038c87f410 R08: 0000000000000001 R09: 0000000000000001 [ 5278.778103] R10: ffff8802c61d0c60 R11: 0e4c2eee4de8c5ac R12: ffff8802c61d0e00 [ 5278.778103] R13: ffff8802c61d0c00 R14: ffff8802c61d0e44 R15: dffffc0000000000 [ 5278.778103] FS: 0000000000000000(0000) GS:ffff8803aee00000(0000) knlGS:0000000000000000 [ 5278.778103] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5278.778103] CR2: 00007fb62cb51000 CR3: 0000000374a4c000 CR4: 00000000001406f0 [ 5278.778103] Stack: [ 5278.778103] ffffc90001d8cdc0 ffff88038c87f400 ffff8802c61d0d98 ffffed0058c3a1b3 [ 5278.778103] dffffc0000000000 ffff8802c61d0c28 ffff8802c61d0c00 ffff8802c61d0c00 [ 5278.778103] ffff8802c61d0c28 ffffffff82d93360 00000000f9937314 ffff8802c61d0c12 [ 5278.778103] Call Trace: [ 5278.778103] [] inet_csk_destroy_sock+0x14b/0x400 [ 5278.778103] [] tcp_done+0x12f/0x210 [ 5278.778103] [] tcp_rcv_state_process+0x271c/0x4e00 [ 5278.778103] [] ? sk_filter_trim_cap+0x283/0x700 [ 5278.778103] [] ? tcp_finish_connect+0x600/0x600 [ 5278.778103] [] ? sk_filter_trim_cap+0x2a2/0x700 [ 5278.778103] [] ? sk_filter_trim_cap+0xd6/0x700 [ 5278.778103] [] ? tcp_v4_rcv+0x1ee0/0x3420 [ 5278.778103] [] tcp_v4_do_rcv+0x2c8/0x8c0 [ 5278.778103] [] tcp_v4_rcv+0x213e/0x3420 [ 5278.778103] [] ? tfw_classify_ipv4+0x5/0x190 [tempesta_fw] [ 5278.778103] [] ip_local_deliver_finish+0x2cb/0x9b0 [ 5278.778103] [] ? ip_local_deliver_finish+0x12a/0x9b0 [ 5278.778103] [] ip_local_deliver+0x24d/0x330 [ 5278.778103] [] ? ip_call_ra_chain+0x510/0x510 [ 5278.778103] [] ? nf_hook_slow+0x186/0x2a0 [ 5278.778103] [] ? nf_hook_slow+0x1a5/0x2a0 [ 5278.778103] [] ? nf_hook_slow+0x5/0x2a0 [ 5278.778103] [] ip_rcv_finish+0x599/0x1870 [ 5278.778103] [] ? ip_queue_xmit+0x823/0x1bc0 [ 5278.778103] [] ? ip_queue_xmit+0x3e/0x1bc0 [ 5278.778103] [] ip_rcv+0x89b/0x11d0 [ 5278.778103] [] ? ip_local_deliver+0x330/0x330 [ 5278.778103] [] ? inet_del_offload+0x40/0x40 [ 5278.778103] [] ? _raw_spin_lock_irqsave+0x4b/0x60 [ 5278.778103] [] ? ip_local_deliver+0x330/0x330 [ 5278.778103] [] __netif_receive_skb_core+0x1690/0x2bc0 [ 5278.778103] [] ? debug_check_no_locks_freed+0x280/0x280 [ 5278.778103] [] ? debug_check_no_locks_freed+0x280/0x280 [ 5278.778103] [] ? net_tx_action+0x9d0/0x9d0 [ 5278.778103] [] ? default_send_IPI_single+0x75/0xa0 [ 5278.778103] [] ? tcp_delack_timer+0x20/0x200 [ 5278.778103] [] ? native_send_call_func_single_ipi+0x60/0x80 [ 5278.778103] [] ? process_backlog+0x217/0x650 [ 5278.778103] [] __netif_receive_skb+0x5a/0x190 [ 5278.778103] [] process_backlog+0xd8/0x650 [ 5278.778103] [] ? process_backlog+0x217/0x650 [ 5278.778103] [] net_rx_action+0x655/0xde0 [ 5278.778103] [] ? sk_busy_loop+0xb90/0xb90 [ 5278.778103] [] ? run_rebalance_domains+0x48a/0x600 [ 5278.778103] [] ? ss_send+0x5b0/0x5b0 [tempesta_fw] [ 5278.778103] [] __do_softirq+0x22c/0x99f [ 5278.778103] [] ? cpu_callback+0x850/0x850 [ 5278.778103] [] run_ksoftirqd+0x1f/0x60 [ 5278.778103] [] smpboot_thread_fn+0x3c4/0x840 [ 5278.778103] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 5278.778103] [] ? schedule+0x9c/0x1c0 [ 5278.778103] [] ? __kthread_parkme+0xdc/0x200 [ 5278.778103] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 5278.778103] [] ? smpboot_update_cpumask_percpu_thread+0x590/0x590 [ 5278.778103] [] kthread+0x20e/0x2d0 [ 5278.778103] [] ? kthread_create_on_node+0x390/0x390 [ 5278.778103] [] ret_from_fork+0x1f/0x40 [ 5278.778103] [] ? kthread_create_on_node+0x390/0x390 [ 5278.778103] Code: e8 03 42 80 3c 38 00 0f 85 54 08 00 00 48 8d 7e 08 48 8b 43 08 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 49 89 fb 49 c1 eb 03 <43> 80 3c 3b 00 0f 85 01 08 00 00 48 89 c7 48 89 46 08 48 c1 ef [ 5278.778103] RIP [] tcp_v4_destroy_sock+0x154/0xc90 [ 5278.778103] RSP