[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 24.144384] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c[ 24.283121] random: sshd: uninitialized urandom read (32 bytes read) . [ 24.560967] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 111.984888] urandom_read: 1 callbacks suppressed [ 111.984894] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts. [ 117.488805] random: sshd: uninitialized urandom read (32 bytes read) 2018/08/28 00:47:17 parsed 1 programs [ 118.568570] random: cc1: uninitialized urandom read (8 bytes read) 2018/08/28 00:47:19 executed programs: 0 [ 119.781668] IPVS: ftp: loaded support on port[0] = 21 [ 119.997214] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.003706] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.010872] device bridge_slave_0 entered promiscuous mode [ 120.027232] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.033588] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.040641] device bridge_slave_1 entered promiscuous mode [ 120.056850] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 120.073856] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 120.117355] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 120.136969] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 120.204108] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 120.212258] team0: Port device team_slave_0 added [ 120.228281] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 120.235516] team0: Port device team_slave_1 added [ 120.251207] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 120.268839] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 120.285525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 120.303922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 120.429103] bridge0: port 2(bridge_slave_1) entered blocking state [ 120.435558] bridge0: port 2(bridge_slave_1) entered forwarding state [ 120.442388] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.448759] bridge0: port 1(bridge_slave_0) entered forwarding state [ 120.906545] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 120.912706] 8021q: adding VLAN 0 to HW filter on device bond0 [ 120.959166] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 120.973848] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 121.013985] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 121.020167] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 121.027835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 121.066668] 8021q: adding VLAN 0 to HW filter on device team0 [ 121.368053] hrtimer: interrupt took 32419 ns [ 121.398151] ================================================================== [ 121.405606] BUG: KASAN: use-after-free in ccid_hc_tx_delete+0xe0/0x100 [ 121.412302] Read of size 8 at addr ffff8801d0be10c0 by task udevd/4732 [ 121.418965] [ 121.420582] CPU: 1 PID: 4732 Comm: udevd Not tainted 4.19.0-rc1+ #212 [ 121.427144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 121.436490] Call Trace: [ 121.439060] [ 121.441299] dump_stack+0x1c9/0x2b4 [ 121.445009] ? dump_stack_print_info.cold.2+0x52/0x52 [ 121.450194] ? printk+0xa7/0xcf [ 121.453463] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 121.458267] ? ccid_hc_tx_delete+0xe0/0x100 [ 121.462592] print_address_description+0x6c/0x20b [ 121.467429] ? ccid_hc_tx_delete+0xe0/0x100 [ 121.471747] kasan_report.cold.7+0x242/0x30d [ 121.476152] __asan_report_load8_noabort+0x14/0x20 [ 121.481078] ccid_hc_tx_delete+0xe0/0x100 [ 121.485227] ? dccp_init_sock+0x4a0/0x4a0 [ 121.489374] dccp_sk_destruct+0x3c/0x80 [ 121.493345] __sk_destruct+0x107/0xa60 [ 121.497223] ? sock_warn_obsolete_bsdism+0xb0/0xb0 [ 121.502149] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 121.507239] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 121.512333] ? lockdep_hardirqs_on+0x19e/0x5c0 [ 121.516906] ? trace_hardirqs_on+0xbd/0x2c0 [ 121.521213] ? kasan_check_read+0x11/0x20 [ 121.525347] ? debug_object_deactivate+0x2eb/0x450 [ 121.530341] ? lock_acquire+0x1e4/0x4f0 [ 121.534483] ? rcu_process_callbacks+0x1065/0x27c0 [ 121.539414] ? lock_release+0x9f0/0x9f0 [ 121.543385] ? debug_stats_show+0x100/0x100 [ 121.547703] ? file_free_rcu+0x6f/0x90 [ 121.551580] ? kmem_cache_free+0x246/0x280 [ 121.555807] ? sock_warn_obsolete_bsdism+0xb0/0xb0 [ 121.560737] rcu_process_callbacks+0xf78/0x27c0 [ 121.565547] ? call_rcu_sched+0x20/0x20 [ 121.569523] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 121.574595] ? find_held_lock+0x36/0x1c0 [ 121.578702] ? mark_held_locks+0xc9/0x160 [ 121.582846] ? _raw_spin_unlock_irq+0x27/0x70 [ 121.587353] ? _raw_spin_unlock_irq+0x27/0x70 [ 121.591838] ? lockdep_hardirqs_on+0x19e/0x5c0 [ 121.596411] ? trace_hardirqs_on+0xbd/0x2c0 [ 121.601027] ? kasan_check_read+0x11/0x20 [ 121.605493] ? __run_timers+0x9c8/0xc60 [ 121.609573] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 121.614788] ? kasan_check_write+0x14/0x20 [ 121.619013] ? do_raw_spin_lock+0xc1/0x200 [ 121.623254] ? _raw_spin_unlock_irq+0x27/0x70 [ 121.627749] ? __run_timers+0x9f6/0xc60 [ 121.631720] ? __bpf_trace_timer_expire_entry+0x30/0x30 [ 121.637080] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 121.642096] ? graph_lock+0x170/0x170 [ 121.645954] ? print_usage_bug+0xc0/0xc0 [ 121.650009] ? lock_release+0x9f0/0x9f0 [ 121.654021] ? hrtimer_update_softirq_timer+0xa0/0xa0 [ 121.659259] ? find_held_lock+0x36/0x1c0 [ 121.663328] ? graph_lock+0x170/0x170 [ 121.667118] ? mark_held_locks+0xc9/0x160 [ 121.671249] ? lock_downgrade+0x8f0/0x8f0 [ 121.675384] ? __do_softirq+0x278/0xa74 [ 121.679356] ? __lock_is_held+0xb5/0x140 [ 121.683429] __do_softirq+0x2eb/0xa74 [ 121.687353] ? __irqentry_text_end+0x1f9f00/0x1f9f00 [ 121.692453] ? trace_hardirqs_off+0xb8/0x2b0 [ 121.696846] ? kasan_check_read+0x11/0x20 [ 121.700982] ? graph_lock+0x170/0x170 [ 121.704775] ? native_apic_msr_write+0x5b/0x80 [ 121.709360] ? lapic_next_event+0x5a/0x90 [ 121.713615] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 121.719161] ? clockevents_program_event+0x140/0x370 [ 121.724260] ? trace_hardirqs_off+0xb8/0x2b0 [ 121.728759] ? trace_hardirqs_on+0x2c0/0x2c0 [ 121.733168] irq_exit+0x1d6/0x210 [ 121.736614] smp_apic_timer_interrupt+0x18e/0x6a0 [ 121.741449] ? smp_call_function_single_interrupt+0x5d0/0x5d0 [ 121.747335] ? interrupt_entry+0xb5/0xf0 [ 121.751573] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 121.756589] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 121.761635] ? trace_hardirqs_off+0xb8/0x2b0 [ 121.766035] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 121.770862] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 121.775866] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 121.780875] ? task_prio+0x50/0x50 [ 121.784415] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 121.789249] apic_timer_interrupt+0xf/0x20 [ 121.793468] [ 121.795695] RIP: 0010:unmap_page_range+0x95f/0x2560 [ 121.800702] Code: 48 8b 38 e8 f3 73 ff ff 48 b9 00 00 00 00 00 ea ff ff 48 c1 e0 06 48 8d 1c 08 48 8d 7b 28 48 89 f8 48 c1 e8 03 42 80 3c 30 00 <0f> 85 89 17 00 00 48 8b b5 58 fc ff ff 48 8b bd 68 fc ff ff 48 8b [ 121.819605] RSP: 0018:ffff8801a98e6ea8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 121.827301] RAX: 1ffffd4000d6df25 RBX: ffffea0006b6f900 RCX: ffffea0000000000 [ 121.834572] RDX: dffffc0000000000 RSI: ffffffff81ac5171 RDI: ffffea0006b6f928 [ 121.841870] RBP: ffff8801a98e7308 R08: ffff8801d6e6a440 R09: ffff8801a98e72a0 [ 121.849136] R10: ffffed003531ce55 R11: ffff8801a98e72af R12: 0000000000000001 [ 121.856403] R13: ffff8801c0cc9430 R14: dffffc0000000000 R15: 00007f7350c00000 [ 121.863686] ? pmd_pfn+0x131/0x1c0 [ 121.867224] ? unmap_page_range+0x93d/0x2560 [ 121.871637] ? vm_normal_page_pmd+0x510/0x510 [ 121.876124] ? free_unref_page_commit.isra.89+0x610/0x610 [ 121.881658] ? print_usage_bug+0xc0/0xc0 [ 121.885712] ? print_usage_bug+0xc0/0xc0 [ 121.889763] ? __lock_acquire+0x7fc/0x5020 [ 121.893990] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 121.898706] ? graph_lock+0x170/0x170 [ 121.902499] ? print_usage_bug+0xc0/0xc0 [ 121.906551] ? find_held_lock+0x36/0x1c0 [ 121.910617] ? mark_held_locks+0xc9/0x160 [ 121.914768] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 121.919863] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 121.924964] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 121.930494] ? uprobe_munmap+0x14c/0x440 [ 121.934541] ? uprobe_mmap+0xd20/0xd20 [ 121.938421] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 121.943521] unmap_single_vma+0x1a0/0x310 [ 121.947660] unmap_vmas+0x125/0x200 [ 121.951358] exit_mmap+0x2c2/0x590 [ 121.954893] ? __ia32_sys_munmap+0x80/0x80 [ 121.959125] mmput+0x265/0x620 [ 121.962304] ? lock_downgrade+0x841/0x8f0 [ 121.966514] ? set_mm_exe_file+0x200/0x200 [ 121.970991] ? kasan_check_read+0x11/0x20 [ 121.975141] ? do_raw_spin_unlock+0xa7/0x2f0 [ 121.979542] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 121.984165] flush_old_exec+0xbaf/0x2110 [ 121.988229] ? ext4_file_read_iter+0x193/0x3c0 [ 121.992862] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 121.998411] ? kernel_read_file_from_fd+0xb0/0xb0 [ 122.003248] ? fsnotify+0xbac/0x14e0 [ 122.007040] ? fsnotify_first_mark+0x350/0x350 [ 122.011622] ? fsnotify+0x14e0/0x14e0 [ 122.015422] ? vfs_read+0x1ce/0x3c0 [ 122.019043] ? kernel_read+0xab/0x120 [ 122.022845] ? load_elf_phdrs+0x1cd/0x260 [ 122.026988] ? writenote+0x3d0/0x3d0 [ 122.030692] ? kernel_read+0xab/0x120 [ 122.034481] load_elf_binary+0xa33/0x5610 [ 122.038622] ? find_held_lock+0x36/0x1c0 [ 122.042764] ? notesize.isra.6+0x80/0x80 [ 122.046823] ? lock_downgrade+0x8f0/0x8f0 [ 122.050968] ? kasan_check_write+0x14/0x20 [ 122.055197] search_binary_handler+0x17d/0x570 [ 122.059771] __do_execve_file.isra.35+0x15ff/0x2460 [ 122.064782] ? prepare_bprm_creds+0x120/0x120 [ 122.069265] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 122.074328] ? __check_object_size+0xa3/0x5d7 [ 122.078818] ? usercopy_warn+0x120/0x120 [ 122.082866] ? kmem_cache_alloc+0x25c/0x710 [ 122.087174] ? kasan_check_read+0x11/0x20 [ 122.091367] ? rcu_is_watching+0x8c/0x150 [ 122.095507] ? trace_hardirqs_on+0xbd/0x2c0 [ 122.099823] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 122.105350] ? strncpy_from_user+0x3be/0x510 [ 122.109745] ? mpi_free.cold.1+0x19/0x19 [ 122.113791] ? do_syscall_64+0x9a/0x820 [ 122.117752] ? lockdep_hardirqs_on+0x421/0x5c0 [ 122.122420] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 122.127954] ? getname_flags+0x26e/0x5a0 [ 122.132005] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 122.137099] __x64_sys_execve+0x8f/0xc0 [ 122.141068] do_syscall_64+0x1b9/0x820 [ 122.144944] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 122.150293] ? syscall_return_slowpath+0x5e0/0x5e0 [ 122.155273] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.160115] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 122.165127] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 122.170132] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 122.175663] ? prepare_exit_to_usermode+0x291/0x3b0 [ 122.180719] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.185564] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 122.190741] RIP: 0033:0x7f73511a2207 [ 122.194445] Code: Bad RIP value. [ 122.197804] RSP: 002b:00007fffd4007f38 EFLAGS: 00000202 ORIG_RAX: 000000000000003b [ 122.205502] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f73511a2207 [ 122.212966] RDX: 000000000107b330 RSI: 00007fffd4008030 RDI: 00007fffd4009040 [ 122.220348] RBP: 0000000000625500 R08: 0000000000001158 R09: 0000000000001158 [ 122.227612] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000107b330 [ 122.234945] R13: 0000000000000007 R14: 0000000001076250 R15: 0000000000000005 [ 122.242305] [ 122.243940] Allocated by task 4729: [ 122.247554] save_stack+0x43/0xd0 [ 122.251103] kasan_kmalloc+0xc4/0xe0 [ 122.254804] kasan_slab_alloc+0x12/0x20 [ 122.258783] kmem_cache_alloc+0x12e/0x710 [ 122.262961] ccid_new+0x25b/0x3e0 [ 122.266434] dccp_hdlr_ccid+0x27/0x150 [ 122.270349] __dccp_feat_activate+0x184/0x270 [ 122.274870] dccp_feat_activate_values+0x3b6/0x839 [ 122.279818] dccp_create_openreq_child+0x47a/0x620 [ 122.285251] dccp_v6_request_recv_sock+0x253/0x2040 [ 122.290286] dccp_check_req+0x46e/0x6c0 [ 122.294286] dccp_v6_rcv+0x88e/0x1d9c [ 122.298108] ip6_input_finish+0x407/0x1a40 [ 122.302359] ip6_input+0xe9/0x600 [ 122.305820] ip6_rcv_finish+0x17a/0x330 [ 122.309810] ipv6_rcv+0x11e/0x650 [ 122.313282] __netif_receive_skb_one_core+0x14d/0x200 [ 122.318522] __netif_receive_skb+0x2c/0x1e0 [ 122.322902] process_backlog+0x219/0x760 [ 122.327195] net_rx_action+0x799/0x1900 [ 122.331187] __do_softirq+0x2eb/0xa74 [ 122.334991] [ 122.336625] Freed by task 4730: [ 122.339923] save_stack+0x43/0xd0 [ 122.343390] __kasan_slab_free+0x11a/0x170 [ 122.347642] kasan_slab_free+0xe/0x10 [ 122.351456] kmem_cache_free+0x86/0x280 [ 122.355446] ccid_hc_tx_delete+0xc3/0x100 [ 122.359613] dccp_hdlr_ccid+0x7d/0x150 [ 122.363512] __dccp_feat_activate+0x184/0x270 [ 122.368023] dccp_feat_activate_values+0x3b6/0x839 [ 122.372977] dccp_create_openreq_child+0x47a/0x620 [ 122.378070] dccp_v6_request_recv_sock+0x253/0x2040 [ 122.383099] dccp_check_req+0x46e/0x6c0 [ 122.387128] dccp_v6_rcv+0x88e/0x1d9c [ 122.390942] ip6_input_finish+0x407/0x1a40 [ 122.395183] ip6_input+0xe9/0x600 [ 122.398672] ip6_rcv_finish+0x17a/0x330 [ 122.402661] ipv6_rcv+0x11e/0x650 [ 122.406131] __netif_receive_skb_one_core+0x14d/0x200 [ 122.411760] __netif_receive_skb+0x2c/0x1e0 [ 122.416385] process_backlog+0x219/0x760 [ 122.420626] net_rx_action+0x799/0x1900 [ 122.424611] __do_softirq+0x2eb/0xa74 [ 122.428416] [ 122.430064] The buggy address belongs to the object at ffff8801d0be10c0 [ 122.430064] which belongs to the cache ccid2_hc_tx_sock of size 1240 [ 122.443292] The buggy address is located 0 bytes inside of [ 122.443292] 1240-byte region [ffff8801d0be10c0, ffff8801d0be1598) [ 122.455107] The buggy address belongs to the page: [ 122.460052] page:ffffea000742f800 count:1 mapcount:0 mapping:ffff8801cd9ab680 index:0x0 compound_mapcount: 0 [ 122.470050] flags: 0x2fffc0000008100(slab|head) [ 122.474929] raw: 02fffc0000008100 ffff8801cd9a1748 ffffea000741b808 ffff8801cd9ab680 [ 122.482834] raw: 0000000000000000 ffff8801d0be0040 0000000100000005 0000000000000000 [ 122.490762] page dumped because: kasan: bad access detected [ 122.496490] [ 122.498131] Memory state around the buggy address: [ 122.503094] ffff8801d0be0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 122.511038] ffff8801d0be1000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 122.519044] >ffff8801d0be1080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 122.526425] ^ [ 122.531903] ffff8801d0be1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.539297] ffff8801d0be1180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.546668] ================================================================== [ 122.554040] Disabling lock debugging due to kernel taint [ 122.559561] Kernel panic - not syncing: panic_on_warn set ... [ 122.559561] [ 122.566958] CPU: 1 PID: 4732 Comm: udevd Tainted: G B 4.19.0-rc1+ #212 [ 122.574977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 122.584349] Call Trace: [ 122.586936] [ 122.589102] dump_stack+0x1c9/0x2b4 [ 122.592750] ? dump_stack_print_info.cold.2+0x52/0x52 [ 122.597954] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 122.602923] panic+0x238/0x4e7 [ 122.606124] ? add_taint.cold.5+0x16/0x16 [ 122.610310] ? trace_hardirqs_on+0xb4/0x2c0 [ 122.614645] ? trace_hardirqs_on+0x9a/0x2c0 [ 122.619918] ? ccid_hc_tx_delete+0xe0/0x100 [ 122.624259] kasan_end_report+0x47/0x4f [ 122.628249] kasan_report.cold.7+0x76/0x30d [ 122.632589] __asan_report_load8_noabort+0x14/0x20 [ 122.637536] ccid_hc_tx_delete+0xe0/0x100 [ 122.641727] ? dccp_init_sock+0x4a0/0x4a0 [ 122.645886] dccp_sk_destruct+0x3c/0x80 [ 122.649885] __sk_destruct+0x107/0xa60 [ 122.653787] ? sock_warn_obsolete_bsdism+0xb0/0xb0 [ 122.658732] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 122.663864] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 122.668982] ? lockdep_hardirqs_on+0x19e/0x5c0 [ 122.673579] ? trace_hardirqs_on+0xbd/0x2c0 [ 122.677920] ? kasan_check_read+0x11/0x20 [ 122.682097] ? debug_object_deactivate+0x2eb/0x450 [ 122.687044] ? lock_acquire+0x1e4/0x4f0 [ 122.691036] ? rcu_process_callbacks+0x1065/0x27c0 [ 122.695977] ? lock_release+0x9f0/0x9f0 [ 122.699969] ? debug_stats_show+0x100/0x100 [ 122.704313] ? file_free_rcu+0x6f/0x90 [ 122.708210] ? kmem_cache_free+0x246/0x280 [ 122.712459] ? sock_warn_obsolete_bsdism+0xb0/0xb0 [ 122.717403] rcu_process_callbacks+0xf78/0x27c0 [ 122.722091] ? call_rcu_sched+0x20/0x20 [ 122.726075] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 122.731104] ? find_held_lock+0x36/0x1c0 [ 122.735174] ? mark_held_locks+0xc9/0x160 [ 122.739336] ? _raw_spin_unlock_irq+0x27/0x70 [ 122.743853] ? _raw_spin_unlock_irq+0x27/0x70 [ 122.748373] ? lockdep_hardirqs_on+0x19e/0x5c0 [ 122.752974] ? trace_hardirqs_on+0xbd/0x2c0 [ 122.757305] ? kasan_check_read+0x11/0x20 [ 122.761461] ? __run_timers+0x9c8/0xc60 [ 122.765446] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 122.770561] ? kasan_check_write+0x14/0x20 [ 122.774810] ? do_raw_spin_lock+0xc1/0x200 [ 122.779061] ? _raw_spin_unlock_irq+0x27/0x70 [ 122.783569] ? __run_timers+0x9f6/0xc60 [ 122.787560] ? __bpf_trace_timer_expire_entry+0x30/0x30 [ 122.792937] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 122.797965] ? graph_lock+0x170/0x170 [ 122.801789] ? print_usage_bug+0xc0/0xc0 [ 122.805865] ? lock_release+0x9f0/0x9f0 [ 122.809861] ? hrtimer_update_softirq_timer+0xa0/0xa0 [ 122.815065] ? find_held_lock+0x36/0x1c0 [ 122.819142] ? graph_lock+0x170/0x170 [ 122.822949] ? mark_held_locks+0xc9/0x160 [ 122.827105] ? lock_downgrade+0x8f0/0x8f0 [ 122.831264] ? __do_softirq+0x278/0xa74 [ 122.835250] ? __lock_is_held+0xb5/0x140 [ 122.839329] __do_softirq+0x2eb/0xa74 [ 122.843147] ? __irqentry_text_end+0x1f9f00/0x1f9f00 [ 122.848294] ? trace_hardirqs_off+0xb8/0x2b0 [ 122.852712] ? kasan_check_read+0x11/0x20 [ 122.856877] ? graph_lock+0x170/0x170 [ 122.860687] ? native_apic_msr_write+0x5b/0x80 [ 122.865278] ? lapic_next_event+0x5a/0x90 [ 122.869444] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 122.874993] ? clockevents_program_event+0x140/0x370 [ 122.880104] ? trace_hardirqs_off+0xb8/0x2b0 [ 122.884521] ? trace_hardirqs_on+0x2c0/0x2c0 [ 122.888949] irq_exit+0x1d6/0x210 [ 122.892411] smp_apic_timer_interrupt+0x18e/0x6a0 [ 122.897582] ? smp_call_function_single_interrupt+0x5d0/0x5d0 [ 122.904104] ? interrupt_entry+0xb5/0xf0 [ 122.908176] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 122.913201] ? trace_hardirqs_off_caller+0xbb/0x2b0 [ 122.918222] ? trace_hardirqs_off+0xb8/0x2b0 [ 122.922645] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.927501] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 122.932522] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 122.937548] ? task_prio+0x50/0x50 [ 122.941112] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.945971] apic_timer_interrupt+0xf/0x20 [ 122.950315] [ 122.952559] RIP: 0010:unmap_page_range+0x95f/0x2560 [ 122.957589] Code: 48 8b 38 e8 f3 73 ff ff 48 b9 00 00 00 00 00 ea ff ff 48 c1 e0 06 48 8d 1c 08 48 8d 7b 28 48 89 f8 48 c1 e8 03 42 80 3c 30 00 <0f> 85 89 17 00 00 48 8b b5 58 fc ff ff 48 8b bd 68 fc ff ff 48 8b [ 122.976538] RSP: 0018:ffff8801a98e6ea8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 122.984269] RAX: 1ffffd4000d6df25 RBX: ffffea0006b6f900 RCX: ffffea0000000000 [ 122.991550] RDX: dffffc0000000000 RSI: ffffffff81ac5171 RDI: ffffea0006b6f928 [ 122.998834] RBP: ffff8801a98e7308 R08: ffff8801d6e6a440 R09: ffff8801a98e72a0 [ 123.006256] R10: ffffed003531ce55 R11: ffff8801a98e72af R12: 0000000000000001 [ 123.013687] R13: ffff8801c0cc9430 R14: dffffc0000000000 R15: 00007f7350c00000 [ 123.021226] ? pmd_pfn+0x131/0x1c0 [ 123.024781] ? unmap_page_range+0x93d/0x2560 [ 123.029211] ? vm_normal_page_pmd+0x510/0x510 [ 123.033878] ? free_unref_page_commit.isra.89+0x610/0x610 [ 123.039533] ? print_usage_bug+0xc0/0xc0 [ 123.043741] ? print_usage_bug+0xc0/0xc0 [ 123.047815] ? __lock_acquire+0x7fc/0x5020 [ 123.052082] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 123.056769] ? graph_lock+0x170/0x170 [ 123.060582] ? print_usage_bug+0xc0/0xc0 [ 123.064782] ? find_held_lock+0x36/0x1c0 [ 123.068869] ? mark_held_locks+0xc9/0x160 [ 123.073029] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 123.078148] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 123.083266] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 123.088824] ? uprobe_munmap+0x14c/0x440 [ 123.092912] ? uprobe_mmap+0xd20/0xd20 [ 123.096814] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 123.101942] unmap_single_vma+0x1a0/0x310 [ 123.106106] unmap_vmas+0x125/0x200 [ 123.109749] exit_mmap+0x2c2/0x590 [ 123.113333] ? __ia32_sys_munmap+0x80/0x80 [ 123.117588] mmput+0x265/0x620 [ 123.120791] ? lock_downgrade+0x841/0x8f0 [ 123.124951] ? set_mm_exe_file+0x200/0x200 [ 123.129197] ? kasan_check_read+0x11/0x20 [ 123.133356] ? do_raw_spin_unlock+0xa7/0x2f0 [ 123.137878] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 123.142480] flush_old_exec+0xbaf/0x2110 [ 123.146552] ? ext4_file_read_iter+0x193/0x3c0 [ 123.151148] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 123.156708] ? kernel_read_file_from_fd+0xb0/0xb0 [ 123.161568] ? fsnotify+0xbac/0x14e0 [ 123.165304] ? fsnotify_first_mark+0x350/0x350 [ 123.169900] ? fsnotify+0x14e0/0x14e0 [ 123.173719] ? vfs_read+0x1ce/0x3c0 [ 123.177556] ? kernel_read+0xab/0x120 [ 123.181523] ? load_elf_phdrs+0x1cd/0x260 [ 123.185686] ? writenote+0x3d0/0x3d0 [ 123.189413] ? kernel_read+0xab/0x120 [ 123.193227] load_elf_binary+0xa33/0x5610 [ 123.197389] ? find_held_lock+0x36/0x1c0 [ 123.201473] ? notesize.isra.6+0x80/0x80 [ 123.205549] ? lock_downgrade+0x8f0/0x8f0 [ 123.209712] ? kasan_check_write+0x14/0x20 [ 123.213965] search_binary_handler+0x17d/0x570 [ 123.218565] __do_execve_file.isra.35+0x15ff/0x2460 [ 123.223597] ? prepare_bprm_creds+0x120/0x120 [ 123.228105] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 123.233239] ? __check_object_size+0xa3/0x5d7 [ 123.237850] ? usercopy_warn+0x120/0x120 [ 123.242403] ? kmem_cache_alloc+0x25c/0x710 [ 123.246740] ? kasan_check_read+0x11/0x20 [ 123.251067] ? rcu_is_watching+0x8c/0x150 [ 123.255633] ? trace_hardirqs_on+0xbd/0x2c0 [ 123.260228] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 123.265779] ? strncpy_from_user+0x3be/0x510 [ 123.270806] ? mpi_free.cold.1+0x19/0x19 [ 123.274888] ? do_syscall_64+0x9a/0x820 [ 123.279136] ? lockdep_hardirqs_on+0x421/0x5c0 [ 123.283758] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 123.289311] ? getname_flags+0x26e/0x5a0 [ 123.293534] ? trace_hardirqs_off_caller+0x2b0/0x2b0 [ 123.299207] __x64_sys_execve+0x8f/0xc0 [ 123.303834] do_syscall_64+0x1b9/0x820 [ 123.307837] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 123.313222] ? syscall_return_slowpath+0x5e0/0x5e0 [ 123.318455] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 123.323549] ? trace_hardirqs_on_caller+0x2b0/0x2b0 [ 123.328833] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 123.333996] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 123.339546] ? prepare_exit_to_usermode+0x291/0x3b0 [ 123.344577] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 123.349615] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 123.355133] RIP: 0033:0x7f73511a2207 [ 123.359082] Code: Bad RIP value. [ 123.362826] RSP: 002b:00007fffd4007f38 EFLAGS: 00000202 ORIG_RAX: 000000000000003b [ 123.370711] RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f73511a2207 [ 123.378475] RDX: 000000000107b330 RSI: 00007fffd4008030 RDI: 00007fffd4009040 [ 123.386219] RBP: 0000000000625500 R08: 0000000000001158 R09: 0000000000001158 [ 123.393494] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000107b330 [ 123.401040] R13: 0000000000000007 R14: 0000000001076250 R15: 0000000000000005 [ 123.408653] Dumping ftrace buffer: [ 123.412200] (ftrace buffer empty) [ 123.415902] Kernel Offset: disabled [ 123.419521] Rebooting in 86400 seconds..