CFI failure at __traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:95 (target: tp_stub_func+0x0/0x10; expected type: 0x8682d211)
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 92 Comm: klogd Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:__traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:95
Code: 8b 3d 40 62 ca 05 4d 85 ff 74 2e 48 89 d3 49 89 f6 49 8b 07 49 8b 7f 08 4c 89 f6 48 89 da 41 ba ef 2d 7d 79 44 03 50 fc 74 02 <0f> 0b ff d0 49 83 7f 18 00 4d 8d 7f 18 75 d8 31 c0 5b 41 5e 41 5f
RSP: 0018:ffffc90000007a38 EFLAGS: 00010213
RAX: ffffffff81713a50 RBX: ffff88816f3c6500 RCX: ffff88811217e540
RDX: ffff88816f3c6500 RSI: ffffffff828a58c3 RDI: ffffc9000079b000
RBP: ffffc90000007a50 R08: 0000000000000004 R09: 0000000000000003
R10: 000000001ebd94fb R11: 1ffff92000000f3c R12: dead000000000122
R13: dffffc0000000000 R14: ffffffff828a58c3 R15: ffff88811db5ff28
FS: 00007f1e5a09cc80(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000012038 CR3: 00000001123f6000 CR4: 00000000003506b0
Call Trace:
trace_kfree include/trace/events/kmem.h:95 [inline]
kfree+0xc9/0xf0 mm/slab_common.c:977
ref_tracker_free+0x4d3/0x7c0 lib/ref_tracker.c:153
netdev_tracker_free include/linux/netdevice.h:4105 [inline]
netdev_put include/linux/netdevice.h:4122 [inline]
dst_destroy+0x12d/0x2e0 net/core/dst.c:117
dst_destroy_rcu+0x19/0x20 net/core/dst.c:137
rcu_do_batch+0x515/0xb90 kernel/rcu/tree.c:2297
rcu_core+0x5a5/0xe70 kernel/rcu/tree.c:2557
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:vprintk_emit+0x148/0x410 kernel/printk/printk.c:2308
Code: 00 00 00 bf 01 00 00 00 e8 95 33 f5 ff e8 50 14 00 00 89 c3 31 ff 89 c6 e8 85 a3 19 00 85 db 4c 8b 2c 24 74 0c e8 58 9f 19 00 d3 02 00 00 eb 45 48 c7 c3 40 ab ee 86 48 c7 c7 40 ab ee 86 be
RSP: 0018:ffffc90000a276c0 EFLAGS: 00000293
RAX: ffffffff81568060 RBX: 0000000000000200 RCX: ffff88811217e540
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000a27768 R08: 0000000000000004 R09: 0000000000000003
R10: fffff52000144ec8 R11: 1ffff92000144ec8 R12: dffffc0000000000
R13: 1ffff92000144edc R14: 00000000ffffffff R15: 0000000000000065
vprintk_default+0x26/0x30 kernel/printk/printk.c:2323
vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
_printk+0xcc/0x118 kernel/printk/printk.c:2333
report_cfi_failure+0x6b/0x80 kernel/cfi.c:14
handle_cfi_failure+0x238/0x290 arch/x86/kernel/cfi.c:-1
handle_bug+0x4b/0x80 arch/x86/kernel/traps.c:325
exc_invalid_op+0x1b/0x50 arch/x86/kernel/traps.c:345
asm_exc_invalid_op+0x1b/0x20 arch/x86/include/asm/idtentry.h:606
RIP: 0010:__traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:95
Code: 8b 3d 40 62 ca 05 4d 85 ff 74 2e 48 89 d3 49 89 f6 49 8b 07 49 8b 7f 08 4c 89 f6 48 89 da 41 ba ef 2d 7d 79 44 03 50 fc 74 02 <0f> 0b ff d0 49 83 7f 18 00 4d 8d 7f 18 75 d8 31 c0 5b 41 5e 41 5f
RSP: 0018:ffffc90000a27b58 EFLAGS: 00010213
RAX: ffffffff81713a50 RBX: ffff888113945800 RCX: ffff88811217e540
RDX: ffff888113945800 RSI: ffffffff8156636b RDI: ffffc9000079b000
RBP: ffffc90000a27b70 R08: dffffc0000000000 R09: fffff52000144f65
R10: 000000001ebd94fb R11: 1ffff92000144f64 R12: 0000000000000044
R13: 00000000000003d4 R14: ffffffff8156636b R15: ffff88811db5ff28
trace_kfree include/trace/events/kmem.h:95 [inline]
kfree+0xc9/0xf0 mm/slab_common.c:977
syslog_print+0x4eb/0x550 kernel/printk/printk.c:1594
do_syslog+0x675/0x730 kernel/printk/printk.c:1681
__do_sys_syslog kernel/printk/printk.c:1773 [inline]
__se_sys_syslog kernel/printk/printk.c:1771 [inline]
__x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1771
x64_sys_call+0x610/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:104
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1e5a266a37
Code: 73 01 c3 48 8b 0d c1 f3 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 67 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 91 f3 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fffbad9c4f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000067
RAX: ffffffffffffffda RBX: 00007f1e5a406490 RCX: 00007f1e5a266a37
RDX: 00000000000003ff RSI: 00007f1e5a406490 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000206 R12: 00007f1e5a406490
R13: 00007f1e5a3e3dfe R14: 00007f1e5a4064d3 R15: 00007f1e5a4064d3
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__traceiter_kfree+0x34/0x50 include/trace/events/kmem.h:95
Code: 8b 3d 40 62 ca 05 4d 85 ff 74 2e 48 89 d3 49 89 f6 49 8b 07 49 8b 7f 08 4c 89 f6 48 89 da 41 ba ef 2d 7d 79 44 03 50 fc 74 02 <0f> 0b ff d0 49 83 7f 18 00 4d 8d 7f 18 75 d8 31 c0 5b 41 5e 41 5f
RSP: 0018:ffffc90000007a38 EFLAGS: 00010213
RAX: ffffffff81713a50 RBX: ffff88816f3c6500 RCX: ffff88811217e540
RDX: ffff88816f3c6500 RSI: ffffffff828a58c3 RDI: ffffc9000079b000
RBP: ffffc90000007a50 R08: 0000000000000004 R09: 0000000000000003
R10: 000000001ebd94fb R11: 1ffff92000000f3c R12: dead000000000122
R13: dffffc0000000000 R14: ffffffff828a58c3 R15: ffff88811db5ff28
FS: 00007f1e5a09cc80(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000012038 CR3: 00000001123f6000 CR4: 00000000003506b0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 bf 01 00 00 00 add %bh,0x1(%rdi)
8: e8 95 33 f5 ff call 0xfff533a2
d: e8 50 14 00 00 call 0x1462
12: 89 c3 mov %eax,%ebx
14: 31 ff xor %edi,%edi
16: 89 c6 mov %eax,%esi
18: e8 85 a3 19 00 call 0x19a3a2
1d: 85 db test %ebx,%ebx
1f: 4c 8b 2c 24 mov (%rsp),%r13
23: 74 0c je 0x31
25: e8 58 9f 19 00 call 0x199f82
* 2a: e8 d3 02 00 00 call 0x302 <-- trapping instruction
2f: eb 45 jmp 0x76
31: 48 c7 c3 40 ab ee 86 mov $0xffffffff86eeab40,%rbx
38: 48 c7 c7 40 ab ee 86 mov $0xffffffff86eeab40,%rdi
3f: be .byte 0xbe