bisecting cause commit starting from e68061375f792af245fefbc13e3e078fa92d3539 building syzkaller on 52e3731913ab2677be27c29ed8142b04e8f28521 testing commit e68061375f792af245fefbc13e3e078fa92d3539 with gcc (GCC) 8.1.0 kernel signature: a4dc5ffcbe06b66be04591b8bd43cb27cfcd870c5d8f59e5c7a4bca1487bd50c run #0: crashed: WARNING: locking bug in call_timer_fn run #1: crashed: WARNING: locking bug in call_timer_fn run #2: crashed: WARNING: locking bug in call_timer_fn run #3: crashed: WARNING: locking bug in call_timer_fn run #4: crashed: WARNING: locking bug in call_timer_fn run #5: crashed: WARNING: locking bug in call_timer_fn run #6: crashed: WARNING: locking bug in call_timer_fn run #7: crashed: WARNING: locking bug in call_timer_fn run #8: crashed: WARNING: locking bug in call_timer_fn run #9: crashed: BUG: Bad page map testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 8.1.0 kernel signature: e508189465d39ffd8a9dcf9ccae50cef7d9bf7cb4686aa21cb801f2c95ce4704 all runs: OK # git bisect start e68061375f792af245fefbc13e3e078fa92d3539 2c85ebc57b3e1817b6ce1a6b703928e113a90442 Bisecting: 7239 revisions left to test after this (roughly 13 steps) [ce51c2b7ceb23a23eb0dc523c80879d8f35e4f38] Merge tag 'mmc-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc testing commit ce51c2b7ceb23a23eb0dc523c80879d8f35e4f38 with gcc (GCC) 8.1.0 kernel signature: 44ebb32756fd1307136083a56fa57a04615b2913fc494debea404fa7fad9c477 all runs: OK # git bisect good ce51c2b7ceb23a23eb0dc523c80879d8f35e4f38 Bisecting: 3611 revisions left to test after this (roughly 12 steps) [ff49c86f27e4726a86f5034543e6e684daf41955] Merge tag 'f2fs-for-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs testing commit ff49c86f27e4726a86f5034543e6e684daf41955 with gcc (GCC) 8.1.0 kernel signature: bb57a01d553ad3ddaba087ab0c4e7f521e43659d214621840fb5065ddae8ae72 all runs: OK # git bisect good ff49c86f27e4726a86f5034543e6e684daf41955 Bisecting: 1805 revisions left to test after this (roughly 11 steps) [c746170d6a48b59d1233b375905f7faef6ce80bc] kasan, mm: untag page address in free_reserved_area testing commit c746170d6a48b59d1233b375905f7faef6ce80bc with gcc (GCC) 8.1.0 kernel signature: 03ea0b057ad206d0d683eeb9291d05ffec3640a3fc9e195b187b0d83a7eb165c all runs: OK # git bisect good c746170d6a48b59d1233b375905f7faef6ce80bc Bisecting: 902 revisions left to test after this (roughly 10 steps) [8a4465368964b4fbaf084760c94c7aabf61059fb] net/smc: use memcpy instead of snprintf to avoid out of bounds read testing commit 8a4465368964b4fbaf084760c94c7aabf61059fb with gcc (GCC) 8.1.0 kernel signature: d81e9794c7dc952a3d28c787ed259d08de3f1d9cac3512c833c248e075dc3c91 all runs: OK # git bisect good 8a4465368964b4fbaf084760c94c7aabf61059fb Bisecting: 451 revisions left to test after this (roughly 9 steps) [2565ff4eef34e03af67b7447c232c858f46b6e3b] Merge branch 'ipv4-ensure-ecn-bits-don-t-influence-source-address-validation' testing commit 2565ff4eef34e03af67b7447c232c858f46b6e3b with gcc (GCC) 8.1.0 kernel signature: e42830dee846435b31ed02179aa64a62af0ac4885305da6eebc699ea0ba24abb all runs: OK # git bisect good 2565ff4eef34e03af67b7447c232c858f46b6e3b Bisecting: 227 revisions left to test after this (roughly 8 steps) [2e4ceed606ba4942f632d097f70696543fe98d8e] Merge tag 'for-linus-5.11-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip testing commit 2e4ceed606ba4942f632d097f70696543fe98d8e with gcc (GCC) 8.1.0 kernel signature: 41961651b9baac4049966f034ec89d81e420fe750f802ee372ed1d505256a69a all runs: OK # git bisect good 2e4ceed606ba4942f632d097f70696543fe98d8e Bisecting: 108 revisions left to test after this (roughly 7 steps) [9887e9af2d58e4021f1015bf804f5f226b3b2b1c] Merge tag 'platform-drivers-x86-v5.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 testing commit 9887e9af2d58e4021f1015bf804f5f226b3b2b1c with gcc (GCC) 8.1.0 kernel signature: f050e620739de1695610a3e112d7011293cd57eb6782606f3f3b63324af11e01 run #0: boot failed: create image operation failed: &{Code:ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS Location: Message:The zone 'projects/syzkaller/zones/us-central1-c' does not have enough resources available to fulfill the request. '(resource type:compute)'. ForceSendFields:[] NullFields:[]}. run #1: boot failed: create image operation failed: &{Code:ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS Location: Message:The zone 'projects/syzkaller/zones/us-central1-c' does not have enough resources available to fulfill the request. '(resource type:compute)'. ForceSendFields:[] NullFields:[]}. run #2: boot failed: create image operation failed: &{Code:ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS Location: Message:The zone 'projects/syzkaller/zones/us-central1-c' does not have enough resources available to fulfill the request. '(resource type:compute)'. ForceSendFields:[] NullFields:[]}. run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in ip_mc_up run #4: crashed: WARNING: locking bug in call_timer_fn run #5: crashed: WARNING: locking bug in call_timer_fn run #6: crashed: WARNING: locking bug in call_timer_fn run #7: crashed: general protection fault in validate_mm_rb run #8: crashed: WARNING: locking bug in call_timer_fn run #9: crashed: WARNING: locking bug in call_timer_fn # git bisect bad 9887e9af2d58e4021f1015bf804f5f226b3b2b1c Bisecting: 51 revisions left to test after this (roughly 6 steps) [120fbdb84f339ca3c358e4ac3fb1ffe663669d28] Merge tag 'sound-5.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 120fbdb84f339ca3c358e4ac3fb1ffe663669d28 with gcc (GCC) 8.1.0 kernel signature: f356127c4930b462a849b49d0125709ae00316537e8e714073fa4e9d03d58994 all runs: OK # git bisect good 120fbdb84f339ca3c358e4ac3fb1ffe663669d28 Bisecting: 27 revisions left to test after this (roughly 5 steps) [06ee38dc2aab3b5a09feb74128cf7326a490b788] Merge tag 'amd-drm-fixes-5.11-2021-01-21' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes testing commit 06ee38dc2aab3b5a09feb74128cf7326a490b788 with gcc (GCC) 8.1.0 kernel signature: 91d7b075cec8d832d2340449fe255f771e98e507c49de908c7c9ed51d0dbf3dc all runs: OK # git bisect good 06ee38dc2aab3b5a09feb74128cf7326a490b788 Bisecting: 13 revisions left to test after this (roughly 4 steps) [83d09ad4b950651a95d37697f1493c00d888d0db] Merge tag 'for-linus' of git://github.com/openrisc/linux testing commit 83d09ad4b950651a95d37697f1493c00d888d0db with gcc (GCC) 8.1.0 kernel signature: f050e620739de1695610a3e112d7011293cd57eb6782606f3f3b63324af11e01 all runs: crashed: WARNING: locking bug in call_timer_fn # git bisect bad 83d09ad4b950651a95d37697f1493c00d888d0db Bisecting: 6 revisions left to test after this (roughly 3 steps) [2561bbbe2e959c966e21ee23de91b9bd4bbf98af] Merge tag 'printk-for-5.11-printk-rework-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux testing commit 2561bbbe2e959c966e21ee23de91b9bd4bbf98af with gcc (GCC) 8.1.0 kernel signature: 6cbe7448c9863739a1027b971102add8d7a134589f5e424b0b28c2366d31a153 run #0: crashed: WARNING: locking bug in call_timer_fn run #1: crashed: WARNING: locking bug in call_timer_fn run #2: crashed: WARNING: locking bug in call_timer_fn run #3: crashed: WARNING: locking bug in call_timer_fn run #4: crashed: WARNING: locking bug in call_timer_fn run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in do_swap_page run #6: crashed: WARNING: locking bug in call_timer_fn run #7: crashed: WARNING: locking bug in call_timer_fn run #8: crashed: WARNING: locking bug in call_timer_fn run #9: crashed: WARNING: locking bug in call_timer_fn # git bisect bad 2561bbbe2e959c966e21ee23de91b9bd4bbf98af Bisecting: 3 revisions left to test after this (roughly 2 steps) [f0e386ee0c0b71ea6f7238506a4d0965a2dbef11] printk: fix buffer overflow potential for print_text() testing commit f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 with gcc (GCC) 8.1.0 kernel signature: 6e81c22ed1670adca862d2e205b781cdf783a935d834c34c417bde55d42ae8dc run #0: crashed: BUG: Bad page map run #1: crashed: WARNING: locking bug in call_timer_fn run #2: crashed: general protection fault in ipv6_get_ifaddr run #3: crashed: WARNING: locking bug in call_timer_fn run #4: crashed: WARNING: locking bug in call_timer_fn run #5: crashed: WARNING: locking bug in call_timer_fn run #6: crashed: general protection fault in ipv6_get_ifaddr run #7: crashed: WARNING: locking bug in call_timer_fn run #8: crashed: BUG: unable to handle kernel paging request in __khugepaged_exit run #9: crashed: INFO: trying to register non-static key in ipv6_get_lladdr # git bisect bad f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 Bisecting: 0 revisions left to test after this (roughly 1 step) [89ccf18f032f26946e2ea6258120472eec6aa745] printk: fix kmsg_dump_get_buffer length calulations testing commit 89ccf18f032f26946e2ea6258120472eec6aa745 with gcc (GCC) 8.1.0 kernel signature: 753d3657bc54498b278b9bec2ad9763e29eb61e5f23174aed4047481b376d5c0 all runs: OK # git bisect good 89ccf18f032f26946e2ea6258120472eec6aa745 f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 is the first bad commit commit f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 Author: John Ogness Date: Thu Jan 14 18:10:12 2021 +0106 printk: fix buffer overflow potential for print_text() Before the commit 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer"), msg_print_text() would only write up to size-1 bytes into the provided buffer. Some callers expect this behavior and append a terminator to returned string. In particular: arch/powerpc/xmon/xmon.c:dump_log_buf() arch/um/kernel/kmsg_dump.c:kmsg_dumper_stdout() msg_print_text() has been replaced by record_print_text(), which currently fills the full size of the buffer. This causes a buffer overflow for the above callers. Change record_print_text() so that it will only use size-1 bytes for text data. Also, for paranoia sakes, add a terminator after the text data. And finally, document this behavior so that it is clear that only size-1 bytes are used and a terminator is added. Fixes: 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer") Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: John Ogness Reviewed-by: Petr Mladek Acked-by: Sergey Senozhatsky Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20210114170412.4819-1-john.ogness@linutronix.de kernel/printk/printk.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) culprit signature: 6e81c22ed1670adca862d2e205b781cdf783a935d834c34c417bde55d42ae8dc parent signature: 753d3657bc54498b278b9bec2ad9763e29eb61e5f23174aed4047481b376d5c0 revisions tested: 15, total time: 3h4m9.964415403s (build: 1h9m40.924274316s, test: 1h53m5.234756634s) first bad commit: f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 printk: fix buffer overflow potential for print_text() recipients (to): ["john.ogness@linutronix.de" "pmladek@suse.com" "sergey.senozhatsky@gmail.com"] recipients (cc): [] crash: INFO: trying to register non-static key in ipv6_get_lladdr INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 0 PID: 8810 Comm: syz-executor.2 Not tainted 5.10.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x77/0x97 lib/dump_stack.c:118 assign_lock_key kernel/locking/lockdep.c:935 [inline] register_lock_class+0x66d/0x680 kernel/locking/lockdep.c:1247 __lock_acquire+0x83/0x22a0 kernel/locking/lockdep.c:4711 lock_acquire+0xd0/0x420 kernel/locking/lockdep.c:5437 __raw_read_lock_bh include/linux/rwlock_api_smp.h:176 [inline] _raw_read_lock_bh+0x3b/0x70 kernel/locking/spinlock.c:247 ipv6_get_lladdr+0x8c/0x210 net/ipv6/addrconf.c:1859 addrconf_rs_timer+0xb9/0x220 net/ipv6/addrconf.c:3872 call_timer_fn+0xa5/0x340 kernel/time/timer.c:1410 expire_timers kernel/time/timer.c:1455 [inline] __run_timers kernel/time/timer.c:1747 [inline] run_timer_softirq+0x259/0x680 kernel/time/timer.c:1760 __do_softirq+0xf0/0x5f1 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x7c/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0xc9/0xf0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x57/0xf0 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline] RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:199 Code: 0f 1f 44 00 00 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 3e 9b 88 fd 48 89 df e8 f6 e9 88 fd e8 61 2c 94 fd fb bf 01 00 00 00 36 34 84 fd 65 8b 05 ff 33 63 7c 85 c0 74 02 5b c3 e8 8b ed 61 RSP: 0018:ffffc90000e53d68 EFLAGS: 00000202 RAX: 00000000017b23b9 RBX: ffff88813bc2c740 RCX: ffffc90000e53d2c RDX: 0000000000000000 RSI: ffffffff84b10071 RDI: 0000000000000001 RBP: ffffc90000e53dc0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88813bc2c740 R13: 0000000000000000 R14: ffff8881015c4bc0 R15: 0000000000000001 finish_lock_switch kernel/sched/core.c:3518 [inline] finish_task_switch+0xc4/0x3b0 kernel/sched/core.c:3618 context_switch kernel/sched/core.c:3782 [inline] __schedule+0x3b7/0x9d0 kernel/sched/core.c:4528 schedule+0x38/0xe0 kernel/sched/core.c:4606 freezable_schedule include/linux/freezer.h:172 [inline] do_nanosleep+0xa7/0x1b0 kernel/time/hrtimer.c:1878 hrtimer_nanosleep+0x8c/0x130 kernel/time/hrtimer.c:1931 __do_sys_nanosleep kernel/time/hrtimer.c:1965 [inline] __se_sys_nanosleep kernel/time/hrtimer.c:1952 [inline] __x64_sys_nanosleep+0x91/0xd0 kernel/time/hrtimer.c:1952 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c6e1 Code: 75 14 b8 23 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 cf fb ff c3 48 83 ec 08 e8 0a 47 00 00 48 89 04 24 b8 23 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 47 00 00 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffd69a13780 EFLAGS: 00000293 ORIG_RAX: 0000000000000023 RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 000000000045c6e1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd69a13790 RBP: 0000000000049547 R08: 0000000000000000 R09: 0000000001aee940 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000004432 R13: 0000000000000000 R14: 0000000000000032 R15: 0000000000049547 BUG: unable to handle page fault for address: ffffffffffffff1a #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4e8b067 P4D 4e8b067 PUD 4e8d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 8810 Comm: syz-executor.2 Not tainted 5.10.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__ipv6_get_lladdr net/ipv6/addrconf.c:1838 [inline] RIP: 0010:ipv6_get_lladdr+0xb5/0x210 net/ipv6/addrconf.c:1860 Code: 00 49 8b 45 10 49 8d 4d 08 48 8d 90 a8 fe ff ff 48 39 c1 75 15 eb 3f 48 8b 82 60 01 00 00 48 8d 90 a8 fe ff ff 48 39 c1 74 2c <0f> b7 80 1a ff ff ff 66 83 f8 20 77 1f 66 83 f8 20 75 da 85 5a 6c RSP: 0018:ffffc90000003df8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff88811e002c08 RDX: fffffffffffffea8 RSI: 0000000000000000 RDI: ffff88811e002d88 RBP: ffffc90000003e20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 3030303030302052 R12: ffffc90000003e30 R13: ffff88811e002c00 R14: ffff88811e002d88 R15: ffffffff83298110 FS: 0000000001aee940(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffff1a CR3: 000000010aab2000 CR4: 0000000000350ef0 Call Trace: addrconf_rs_timer+0xb9/0x220 net/ipv6/addrconf.c:3872 call_timer_fn+0xa5/0x340 kernel/time/timer.c:1410 expire_timers kernel/time/timer.c:1455 [inline] __run_timers kernel/time/timer.c:1747 [inline] run_timer_softirq+0x259/0x680 kernel/time/timer.c:1760 __do_softirq+0xf0/0x5f1 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x7c/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0xc9/0xf0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x57/0xf0 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline] RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:199 Code: 0f 1f 44 00 00 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 3e 9b 88 fd 48 89 df e8 f6 e9 88 fd e8 61 2c 94 fd fb bf 01 00 00 00 36 34 84 fd 65 8b 05 ff 33 63 7c 85 c0 74 02 5b c3 e8 8b ed 61 RSP: 0018:ffffc90000e53d68 EFLAGS: 00000202 RAX: 00000000017b23b9 RBX: ffff88813bc2c740 RCX: ffffc90000e53d2c RDX: 0000000000000000 RSI: ffffffff84b10071 RDI: 0000000000000001 RBP: ffffc90000e53dc0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88813bc2c740 R13: 0000000000000000 R14: ffff8881015c4bc0 R15: 0000000000000001 finish_lock_switch kernel/sched/core.c:3518 [inline] finish_task_switch+0xc4/0x3b0 kernel/sched/core.c:3618 context_switch kernel/sched/core.c:3782 [inline] __schedule+0x3b7/0x9d0 kernel/sched/core.c:4528 schedule+0x38/0xe0 kernel/sched/core.c:4606 freezable_schedule include/linux/freezer.h:172 [inline] do_nanosleep+0xa7/0x1b0 kernel/time/hrtimer.c:1878 hrtimer_nanosleep+0x8c/0x130 kernel/time/hrtimer.c:1931 __do_sys_nanosleep kernel/time/hrtimer.c:1965 [inline] __se_sys_nanosleep kernel/time/hrtimer.c:1952 [inline] __x64_sys_nanosleep+0x91/0xd0 kernel/time/hrtimer.c:1952 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c6e1 Code: 75 14 b8 23 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 cf fb ff c3 48 83 ec 08 e8 0a 47 00 00 48 89 04 24 b8 23 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 47 00 00 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffd69a13780 EFLAGS: 00000293 ORIG_RAX: 0000000000000023 RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 000000000045c6e1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd69a13790 RBP: 0000000000049547 R08: 0000000000000000 R09: 0000000001aee940 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000004432 R13: 0000000000000000 R14: 0000000000000032 R15: 0000000000049547 Modules linked in: CR2: ffffffffffffff1a ---[ end trace 030e61959c57c8e8 ]--- RIP: 0010:__ipv6_get_lladdr net/ipv6/addrconf.c:1838 [inline] RIP: 0010:ipv6_get_lladdr+0xb5/0x210 net/ipv6/addrconf.c:1860 Code: 00 49 8b 45 10 49 8d 4d 08 48 8d 90 a8 fe ff ff 48 39 c1 75 15 eb 3f 48 8b 82 60 01 00 00 48 8d 90 a8 fe ff ff 48 39 c1 74 2c <0f> b7 80 1a ff ff ff 66 83 f8 20 77 1f 66 83 f8 20 75 da 85 5a 6c RSP: 0018:ffffc90000003df8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff88811e002c08 RDX: fffffffffffffea8 RSI: 0000000000000000 RDI: ffff88811e002d88 RBP: ffffc90000003e20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 3030303030302052 R12: ffffc90000003e30 R13: ffff88811e002c00 R14: ffff88811e002d88 R15: ffffffff83298110 FS: 0000000001aee940(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffff1a CR3: 000000010aab2000 CR4: 0000000000350ef0