[ 1709.893147] ================================================================== [ 1709.901084] BUG: KASAN: use-after-free in inet_gro_complete+0x352/0x3d0 [ 1709.908437] Read of size 2 at addr ffff88a02973e0d0 by task swapper/49/0 [ 1709.915684] [ 1709.917714] CPU: 49 PID: 0 Comm: swapper/49 Tainted: G E 6.8.1-1.gdc.el9.kasan.x86_64 #1 [ 1709.927727] Hardware name: Dell Inc. PowerEdge R7525/0H3K7P, BIOS 2.14.1 12/17/2023 [ 1709.936226] Call Trace: [ 1709.939364] [ 1709.941930] dump_stack_lvl+0x33/0x50 [ 1709.946103] print_address_description.constprop.0+0x2c/0x3e0 [ 1709.952608] ? inet_gro_complete+0x352/0x3d0 [ 1709.957392] print_report+0xb5/0x270 [ 1709.961850] ? kasan_addr_to_slab+0x9/0xa0 [ 1709.966496] kasan_report+0xac/0xe0 [ 1709.970501] ? inet_gro_complete+0x352/0x3d0 [ 1709.975300] inet_gro_complete+0x352/0x3d0 [ 1709.979909] ? ice_alloc_rx_bufs+0x435/0x860 [ice] [ 1709.985331] napi_gro_complete.constprop.0+0x3cd/0x4c0 [ 1709.991094] napi_gro_flush+0x1ad/0x370 [ 1709.995451] napi_complete_done+0x433/0x710 [ 1710.000259] ? __pfx_napi_complete_done+0x10/0x10 [ 1710.005509] ice_napi_poll+0x23e/0x8b0 [ice] [ 1710.010391] ? __pfx_ice_napi_poll+0x10/0x10 [ice] [ 1710.015790] ? __pfx_load_balance+0x10/0x10 [ 1710.020587] __napi_poll+0xa2/0x500 [ 1710.024581] ? _raw_spin_trylock+0x6e/0x120 [ 1710.029267] net_rx_action+0x421/0xb80 [ 1710.033551] ? __pfx_net_rx_action+0x10/0x10 [ 1710.038331] ? __pfx_sched_clock_cpu+0x10/0x10 [ 1710.043372] ? _raw_spin_lock+0x81/0xe0 [ 1710.047711] __do_softirq+0x19b/0x597 [ 1710.051977] __irq_exit_rcu+0x125/0x170 [ 1710.056459] common_interrupt+0x7d/0xa0 [ 1710.060796] [ 1710.063431] [ 1710.066016] asm_common_interrupt+0x22/0x40 [ 1710.071098] RIP: 0010:cpuidle_enter_state+0x176/0x300 [ 1710.076694] Code: 48 83 3c 03 00 0f 84 2c 01 00 00 83 e9 01 73 e4 48 83 c4 18 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 e4 <0f> 89 5f ff ff ff 4b 8d 44 6d 00 48 c7 43 18 00 00 00 00 48 c1 e0 [ 1710.096873] RSP: 0018:ffff889002017d90 EFLAGS: 00000202 [ 1710.102657] RAX: 0000000000000000 RBX: ffff88b003622800 RCX: 000000000000001f [ 1710.110321] RDX: 1ffff112004c8821 RSI: 0000000000000031 RDI: ffff889002644108 [ 1710.117982] RBP: ffffffffb0a77140 R08: 0000018e1d929ae5 R09: ffffed12004c7df5 [ 1710.125658] R10: ffff88900263efab R11: 071c71c71c71c71c R12: 0000000000000001 [ 1710.133332] R13: 0000000000000001 R14: 0000018e1d929ae5 R15: 0000000000000000 [ 1710.140952] cpuidle_enter+0x4a/0xa0 [ 1710.145209] ? tick_nohz_idle_stop_tick+0x108/0x290 [ 1710.150553] cpuidle_idle_call+0x174/0x1d0 [ 1710.155360] ? __pfx_cpuidle_idle_call+0x10/0x10 [ 1710.160430] ? irqtime_account_process_tick+0x1e1/0x340 [ 1710.166360] do_idle+0xe1/0x150 [ 1710.170127] cpu_startup_entry+0x51/0x60 [ 1710.174482] start_secondary+0x209/0x280 [ 1710.178830] ? __pfx_start_secondary+0x10/0x10 [ 1710.183732] ? soft_restart_cpu+0x15/0x15 [ 1710.188510] secondary_startup_64_no_verify+0x184/0x18b [ 1710.194424] [ 1710.197090] [ 1710.199090] The buggy address belongs to the physical page: [ 1710.205139] page:ffffea0080a5cf80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x202973e [ 1710.215053] flags: 0x57ffffc0000000(node=1|zone=2|lastcpupid=0x1fffff) [ 1710.222219] page_type: 0xffffffff() [ 1710.226182] raw: 0057ffffc0000000 ffffea0043c8c188 ffff889002649650 0000000000000000 [ 1710.234425] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1710.242687] page dumped because: kasan: bad access detected [ 1710.248801] [ 1710.250748] Memory state around the buggy address: [ 1710.256379] ffff88a02973df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1710.264067] ffff88a02973e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1710.271771] >ffff88a02973e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1710.279675] ^ [ 1710.285978] ffff88a02973e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1710.293870] ffff88a02973e180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1710.301579] ================================================================== [ 1710.309286] Disabling lock debugging due to kernel taint ... [ 2362.339090] general protection fault, probably for non-canonical address 0xdffffc000000885c: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 2362.347828] ------------[ cut here ]------------ [ 2362.350474] KASAN: probably user-memory-access in range [0x00000000000442e0-0x00000000000442e7] [ 2362.355092] WARNING: CPU: 19 PID: 0 at kernel/sched/core.c:3389 set_task_cpu+0x62e/0x7c0 [ 2362.363786] CPU: 20 PID: 0 Comm: swapper/20 Tainted: G B E 6.8.1-1.gdc.el9.kasan.x86_64 #1 [ 2362.363839] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __schedule+0x14f0/0x1760