4.13 kernel panic on kfree (security_sk_free)

[Rafael David Tinoco]

I'm frequently facing this issue with Artful kernels 4.13:

[ 1317.490018] general protection fault: 0000 [#1] SMP NOPTI
[ 1317.491099] Modules linked in: ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter nfsv3 nfs_acl nfs lockd grace fscache edac_mce_amd qemu_fw_cfg pata_acpi sunrpc ip_tables x_tables bridge stp llc virtio_scsi input_leds kvm_amd kvm irqbypass virtio_blk virtio_net mac_hid
[ 1317.494814] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.13.0-32-generic #35-Ubuntu
[ 1317.496199] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[ 1317.497373] task: ffff98a1ad675d00 task.stack: ffffa76dc18f8000
[ 1317.498274] RIP: 0010:kfree+0x53/0x160
[ 1317.498852] RSP: 0018:ffff98a1bfd03768 EFLAGS: 00010207
[ 1317.499620] RAX: 0000000000000000 RBX: 2e6c61636974706f RCX: 0000000000000006
[ 1317.500665] RDX: 00002ecc000030d0 RSI: 0000000000010080 RDI: 0000676200000000
[ 1317.501677] RBP: ffff98a1bfd03780 R08: 0000000000025d80 R09: ffffffffa3bbd839
[ 1317.502704] R10: 00b97c9557a5d1c0 R11: 0000000000000000 R12: ffff98a1a8430800
[ 1317.503736] R13: ffffffffa37a3dbe R14: ffff98a1a8430800 R15: ffff98a1a8430800
[ 1317.504753] FS: 0000000000000000(0000) GS:ffff98a1bfd00000(0000) knlGS:0000000000000000
[ 1317.505888] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1317.506736] CR2: 00007fbf9c9254d0 CR3: 0000000413c0a000 CR4: 00000000000406e0
[ 1317.507753] Call Trace:
[ 1317.508168] <IRQ>
[ 1317.508534] security_sk_free+0x3e/0x50
[ 1317.509135] __sk_destruct+0x108/0x190
[ 1317.509711] sk_destruct+0x20/0x30
[ 1317.510254] __sk_free+0x82/0xa0
[ 1317.510771] sk_free+0x19/0x20
[ 1317.511267] sock_put+0x14/0x20
[ 1317.511763] tcp_v4_rcv+0x94d/0x9d0
[ 1317.512319] ? virtio_pci_probe+0xd0/0x130
[ 1317.513010] ip_local_deliver_finish+0x5c/0x1f0
[ 1317.513800] ip_local_deliver+0x6f/0xe0
[ 1317.514495] ? ip_rcv_finish+0x410/0x410
[ 1317.515440] ip_rcv_finish+0x120/0x410
[ 1317.516193] ip_rcv+0x28c/0x3a0
[ 1317.516944] ? packet_rcv+0x44/0x440
[ 1317.517635] __netif_receive_skb_core+0x39a/0xaa0
[ 1317.518503] ? dev_queue_xmit+0x10/0x20
[ 1317.519279] ? br_dev_queue_push_xmit+0x7a/0x140 [bridge]
[ 1317.520262] __netif_receive_skb+0x18/0x60
[ 1317.520941] ? __netif_receive_skb+0x18/0x60
[ 1317.521638] netif_receive_skb_internal+0x3f/0x3f0
[ 1317.522408] netif_receive_skb+0x1c/0x70
[ 1317.523021] br_netif_receive_skb+0x34/0x50 [bridge]
[ 1317.523771] br_pass_frame_up+0xcd/0x150 [bridge]
[ 1317.524478] ? br_port_flags_change+0x20/0x20 [bridge]
[ 1317.525236] br_handle_frame_finish+0x125/0x540 [bridge]
[ 1317.526020] ? cpumask_next_and+0x2c/0x40
[ 1317.526638] ? br_handle_local_finish+0x40/0x40 [bridge]
[ 1317.527423] br_handle_frame+0x156/0x300 [bridge]
[ 1317.528156] ? csum_partial+0x11/0x20
[ 1317.528725] __netif_receive_skb_core+0x212/0xaa0
[ 1317.529432] ? skb_checksum+0x35/0x50
[ 1317.530012] ? skb_append_datato_frags+0x200/0x200
[ 1317.530729] ? reqsk_fastopen_remove+0x140/0x140
[ 1317.531415] __netif_receive_skb+0x18/0x60
[ 1317.532037] ? __netif_receive_skb+0x18/0x60
[ 1317.532684] netif_receive_skb_internal+0x3f/0x3f0
[ 1317.533394] ? dev_gro_receive+0x2dc/0x480
[ 1317.534029] napi_gro_receive+0xc2/0xe0
[ 1317.534628] receive_buf+0x218/0xf70 [virtio_net]
[ 1317.535332] ? vring_unmap_one+0x1b/0x80
[ 1317.535931] virtnet_poll+0x173/0x268 [virtio_net]
[ 1317.536645] net_rx_action+0x13b/0x380
[ 1317.537224] ? skb_recv_done+0x30/0x40 [virtio_net]
[ 1317.537962] __do_softirq+0xde/0x2a5
[ 1317.538553] irq_exit+0xb6/0xc0
[ 1317.539056] do_IRQ+0x80/0xd0
[ 1317.539530] common_interrupt+0x1af/0x1af
[ 1317.540139] </IRQ>
[ 1317.540500] RIP: 0010:native_safe_halt+0x6/0x10
[ 1317.541178] RSP: 0018:ffffa76dc18fbe70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff8d
[ 1317.542262] RAX: 0000000000000000 RBX: ffff98a1ad675d00 RCX: 0000000000000000
[ 1317.543302] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 1317.544338] RBP: ffffa76dc18fbe70 R08: 0000000000000002 R09: ffff98a1ad6d3400
[ 1317.545410] R10: 0000000000000000 R11: 0000000000000400 R12: 0000000000000002
[ 1317.546654] R13: ffff98a1ad675d00 R14: 0000000000000000 R15: 0000000000000000
[ 1317.547722] default_idle+0x20/0x100
[ 1317.548285] arch_cpu_idle+0xf/0x20
[ 1317.548825] default_idle_call+0x23/0x30
[ 1317.549428] do_idle+0x17d/0x200
[ 1317.549932] cpu_startup_entry+0x73/0x80
[ 1317.550538] start_secondary+0x175/0x1b0
[ 1317.551136] secondary_startup_64+0x9f/0xa0
[ 1317.551768] Code: 00 80 49 01 da 0f 82 1c 01 00 00 48 c7 c7 00 00 00 80 48 2b 3d 2f d2 01 01 49 01 fa 49 c1 ea 0c 49 c1 e2 06 4c 03 15 0d d2 01 01 <49> 8b 42 20 48 8d 50 ff a8 01 4c 0f 45 d2 49 8b 52 20 48 8d 42
[ 1317.554359] RIP: kfree+0x53/0x160 RSP: ffff98a1bfd03768
[ 1317.555171] ---[ end trace fd096fc5140d9c6b ]---
[ 1317.555866] Kernel panic - not syncing: Fatal exception in interrupt
[ 1317.557001] Kernel Offset: 0x22400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 1317.558517] ---[ end Kernel panic - not syncing: Fatal exception in interrupt

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1747909

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.