Unknown ioctl 21509 IPVS: fo: UDP 127.0.0.1:0 - no destination available IPVS: fo: UDP 127.0.0.1:0 - no destination available ================================================================== Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable BUG: KASAN: stack-out-of-bounds in do_general_protection+0x2ac/0x2f0 arch/x86/kernel/traps.c:538 Read of size 8 at addr ffff88018e5af3f8 by task syz-executor3/12607 IPVS: fo: UDP 127.0.0.1:0 - no destination available CPU: 1 PID: 12607 Comm: syz-executor3 Not tainted 4.17.0-rc6+ #95 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable print_address_description+0x6c/0x20b mm/kasan/report.c:256 IPVS: fo: UDP 127.0.0.1:0 - no destination available kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 do_general_protection+0x2ac/0x2f0 arch/x86/kernel/traps.c:538 general_protection+0x1e/0x30 arch/x86/entry/entry_64.S:1159 IPVS: fo: UDP 127.0.0.1:0 - no destination available RIP: 0010:msr_write_intercepted arch/x86/kvm/vmx.c:2132 [inline] RIP: 0010:vmx_vcpu_run+0xa12/0x25c0 arch/x86/kvm/vmx.c:9879 RSP: 0018:ffff88018e5af410 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: 0000000010000000 RCX: ffffffff811f7502 RDX: 000000000836b156 RSI: ffffffff811f750f RDI: 0000000000000005 RBP: ffff88018e5af508 R08: ffff88019181a340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 IPVS: fo: UDP 127.0.0.1:0 - no destination available R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable mmu_notifier_release include/linux/mmu_notifier.h:244 [inline] exit_mmap+0xa4/0x5a0 mm/mmap.c:3057 __mmput kernel/fork.c:961 [inline] mmput+0x251/0x610 kernel/fork.c:982 BUG: spinlock bad magic on CPU#0, syz-executor0/12631 kasan: CONFIG_KASAN_INLINE enabled exit_mm kernel/exit.c:544 [inline] do_exit+0xe98/0x2730 kernel/exit.c:852 kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 12631 Comm: syz-executor0 Not tainted 4.17.0-rc6+ #95 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:task_pid_nr include/linux/sched.h:1228 [inline] RIP: 0010:spin_dump+0xcb/0x169 kernel/locking/spinlock_debug.c:65 RSP: 0018:ffff880167b25a00 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: ffffffff8a8be5a8 RCX: 0000000000000000 RDX: 03fffe200639bd52 RSI: ffffffff81610ae1 RDI: 1ffff10031cdea90 RBP: ffff880167b25a20 R08: ffff88018e524440 R09: ffffed003b5c4fc0 R10: ffffed003b5c4fc0 R11: ffff8801dae27e07 R12: 1ffff10031cde600 R13: ffffffff87cb0340 R14: 00000000ffffffff R15: ffff8801612f0000 FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000008091610 CR3: 0000000008c6a000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: spin_bug kernel/locking/spinlock_debug.c:75 [inline] debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline] do_raw_spin_lock.cold.3+0x37/0x3c kernel/locking/spinlock_debug.c:112 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0x9e/0xc0 kernel/locking/spinlock.c:152 __debug_check_no_obj_freed lib/debugobjects.c:774 [inline] debug_check_no_obj_freed+0x159/0x584 lib/debugobjects.c:815 free_pages_prepare mm/page_alloc.c:1030 [inline] __free_pages_ok+0x54a/0x2bd0 mm/page_alloc.c:1248 do_group_exit+0x16f/0x430 kernel/exit.c:968 __do_sys_exit_group kernel/exit.c:979 [inline] __se_sys_exit_group kernel/exit.c:977 [inline] __ia32_sys_exit_group+0x3e/0x50 kernel/exit.c:977 do_syscall_32_irqs_on arch/x86/entry/common.c:323 [inline] do_fast_syscall_32+0x345/0xf9b arch/x86/entry/common.c:394 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f75cb9 RSP: 002b:00000000f5f6b68c EFLAGS: 00000286 ORIG_RAX: 00000000000000fc RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the page: page:ffffea0006396bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 ffffea0006390101 ffff8801cb6e9900 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88018e5af280: 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 f3 00 ffff88018e5af300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88018e5af380: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 f2 f2 ^ free_compound_page+0x5c/0x70 mm/page_alloc.c:566 ffff88018e5af400: f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 free_transhuge_page+0x2ed/0x450 mm/huge_memory.c:2732 ffff88018e5af480: f2 f2 f2 f2 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 ==================================================================