[ 4305.917507][ C3] ==================================================================
[ 4305.917899][ C3] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280
[ 4305.918190][ C3] Read of size 8 at addr ffff8880143b8c40 by task swapper/3/0
[ 4305.918475][ C3]
[ 4305.918575][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.18.0-virtme #1 PREEMPT(full)
[ 4305.918580][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4305.918582][ C3] Call Trace:
[ 4305.918584][ C3]
[ 4305.918586][ C3] dump_stack_lvl+0x82/0xc0
[ 4305.918593][ C3] print_address_description.constprop.0+0x2c/0x3a0
[ 4305.918599][ C3] ? dst_dev_put+0x214/0x280
[ 4305.918603][ C3] print_report+0xb4/0x270
[ 4305.918607][ C3] ? dst_dev_put+0x214/0x280
[ 4305.918610][ C3] ? kasan_addr_to_slab+0x1d/0x50
[ 4305.918613][ C3] ? dst_dev_put+0x214/0x280
[ 4305.918616][ C3] kasan_report+0xca/0x100
[ 4305.918620][ C3] ? dst_dev_put+0x214/0x280
[ 4305.918625][ C3] dst_dev_put+0x214/0x280
[ 4305.918629][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170
[ 4305.918636][ C3] fib_nh_common_release+0xe6/0x2d0
[ 4305.918640][ C3] free_fib_info_rcu+0x14c/0x380
[ 4305.918644][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0
[ 4305.918648][ C3] rcu_do_batch+0x27e/0x1120
[ 4305.918653][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 4305.918657][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70
[ 4305.918662][ C3] ? lockdep_hardirqs_on+0x7c/0x100
[ 4305.918667][ C3] ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 4305.918672][ C3] rcu_core+0x2bb/0x520
[ 4305.918676][ C3] handle_softirqs+0x1c0/0x820
[ 4305.918683][ C3] __irq_exit_rcu+0x6c/0xe0
[ 4305.918686][ C3] irq_exit_rcu+0xe/0x30
[ 4305.918689][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 4305.918693][ C3]
[ 4305.918694][ C3]
[ 4305.918696][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 4305.918699][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 4305.918703][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
[ 4305.918707][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000202
[ 4305.918710][ C3] RAX: 000000000456b6f7 RBX: 1ffff9200002afbf RCX: ffffffff9720a255
[ 4305.918713][ C3] RDX: 0000000000000000 RSI: ffffffff97bfa925 RDI: ffffffff9766a600
[ 4305.918714][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cdb631a
[ 4305.918716][ C3] R10: ffff888066db18d3 R11: ffff888001ae5090 R12: 0000000000000000
[ 4305.918718][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000
[ 4305.918722][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150
[ 4305.918726][ C3] default_idle+0x9/0x10
[ 4305.918728][ C3] default_idle_call+0x6c/0xa0
[ 4305.918731][ C3] cpuidle_idle_call+0x23b/0x380
[ 4305.918735][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 4305.918739][ C3] ? tsc_verify_tsc_adjust+0x94/0x310
[ 4305.918744][ C3] do_idle+0xe1/0x140
[ 4305.918748][ C3] cpu_startup_entry+0x54/0x60
[ 4305.918751][ C3] start_secondary+0x1fd/0x290
[ 4305.918754][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10
[ 4305.918758][ C3] common_startup_64+0x13e/0x148
[ 4305.918768][ C3]
[ 4305.918769][ C3]
[ 4305.929030][ C3] Allocated by task 7357:
[ 4305.929168][ C3] kasan_save_stack+0x24/0x40
[ 4305.929361][ C3] kasan_save_track+0x14/0x30
[ 4305.929546][ C3] __kasan_slab_alloc+0x55/0x60
[ 4305.929731][ C3] kmem_cache_alloc_noprof+0x291/0x6d0
[ 4305.929918][ C3] dst_alloc+0x7a/0x140
[ 4305.930058][ C3] rt_dst_alloc+0x31/0x3a0
[ 4305.930247][ C3] __mkroute_output+0x425/0x11a0
[ 4305.930435][ C3] ip_route_output_key_hash+0xfa/0x220
[ 4305.930619][ C3] ip_route_output_flow+0x23/0x140
[ 4305.930808][ C3] udp_tunnel_dst_lookup+0x227/0x3a0
[ 4305.930991][ C3] vxlan_xmit_one+0x151a/0x4490 [vxlan]
[ 4305.931189][ C3] vxlan_xmit+0xf6a/0x1870 [vxlan]
[ 4305.931388][ C3] dev_hard_start_xmit+0x132/0x530
[ 4305.931574][ C3] __dev_queue_xmit+0x1406/0x1af0
[ 4305.931758][ C3] packet_snd+0xd0f/0x1a70
[ 4305.931944][ C3] __sys_sendto+0x24b/0x380
[ 4305.932128][ C3] __x64_sys_sendto+0xe0/0x1b0
[ 4305.932312][ C3] do_syscall_64+0xc1/0xfc0
[ 4305.932498][ C3] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 4305.932727][ C3]
[ 4305.932825][ C3] Freed by task 0:
[ 4305.932964][ C3] kasan_save_stack+0x24/0x40
[ 4305.933158][ C3] kasan_save_track+0x14/0x30
[ 4305.933344][ C3] __kasan_save_free_info+0x3b/0x60
[ 4305.933529][ C3] __kasan_slab_free+0x3f/0x60
[ 4305.933713][ C3] kmem_cache_free+0x2e4/0x690
[ 4305.933900][ C3] dst_destroy+0x230/0x350
[ 4305.934085][ C3] rcu_do_batch+0x27e/0x1120
[ 4305.934272][ C3] rcu_core+0x2bb/0x520
[ 4305.934417][ C3] handle_softirqs+0x1c0/0x820
[ 4305.934608][ C3] __irq_exit_rcu+0x6c/0xe0
[ 4305.934792][ C3] irq_exit_rcu+0xe/0x30
[ 4305.934935][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 4305.935121][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 4305.935351][ C3]
[ 4305.935443][ C3] Last potentially related work creation:
[ 4305.935635][ C3] kasan_save_stack+0x24/0x40
[ 4305.935826][ C3] kasan_record_aux_stack+0x8c/0xa0
[ 4305.936015][ C3] __call_rcu_common.constprop.0+0xa9/0x950
[ 4305.936248][ C3] dst_cache_destroy+0xf7/0x200
[ 4305.936439][ C3] vxlan_fdb_free+0x10e/0x1b0 [vxlan]
[ 4305.936638][ C3] rcu_do_batch+0x27e/0x1120
[ 4305.936825][ C3] rcu_core+0x2bb/0x520
[ 4305.936970][ C3] handle_softirqs+0x1c0/0x820
[ 4305.937160][ C3] __irq_exit_rcu+0x6c/0xe0
[ 4305.937346][ C3] irq_exit_rcu+0xe/0x30
[ 4305.937488][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 4305.937675][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 4305.937908][ C3]
[ 4305.938004][ C3] The buggy address belongs to the object at ffff8880143b8c40
[ 4305.938004][ C3] which belongs to the cache rtable of size 184
[ 4305.938462][ C3] The buggy address is located 0 bytes inside of
[ 4305.938462][ C3] freed 184-byte region [ffff8880143b8c40, ffff8880143b8cf8)
[ 4305.938917][ C3]
[ 4305.939011][ C3] The buggy address belongs to the physical page:
[ 4305.939238][ C3] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880143b81c0 pfn:0x143b8
[ 4305.939620][ C3] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 4305.939905][ C3] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 4305.940148][ C3] page_type: f5(slab)
[ 4305.940296][ C3] raw: 0080000000000240 ffff8880049d1e00 ffffea000047ef90 ffff88800266b708
[ 4305.940635][ C3] raw: ffff8880143b81c0 0000000000150005 00000000f5000000 0000000000000000
[ 4305.940969][ C3] head: 0080000000000240 ffff8880049d1e00 ffffea000047ef90 ffff88800266b708
[ 4305.941304][ C3] head: ffff8880143b81c0 0000000000150005 00000000f5000000 0000000000000000
[ 4305.941637][ C3] head: 0080000000000001 ffffea000050ee01 00000000ffffffff 00000000ffffffff
[ 4305.941974][ C3] head: ffff8880143b9f20 0000000000000000 00000000ffffffff 0000000000000000
[ 4305.942308][ C3] page dumped because: kasan: bad access detected
[ 4305.942540][ C3]
[ 4305.942632][ C3] Memory state around the buggy address:
[ 4305.942815][ C3] ffff8880143b8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 4305.943094][ C3] ffff8880143b8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 4305.943371][ C3] >ffff8880143b8c00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 4305.943645][ C3] ^
[ 4305.943871][ C3] ffff8880143b8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 4305.944143][ C3] ffff8880143b8d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 4305.944420][ C3] ==================================================================
[ 4305.944706][ C3] Disabling lock debugging due to kernel taint
[ 4305.944944][ C3] Oops: general protection fault, probably for non-canonical address 0xe01f7c3740000007: 0000 [#1] SMP KASAN
[ 4305.945346][ C3] KASAN: maybe wild-memory-access in range [0x00fc01ba00000038-0x00fc01ba0000003f]
[ 4305.945658][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G B 6.18.0-virtme #1 PREEMPT(full)
[ 4305.946022][ C3] Tainted: [B]=BAD_PAGE
[ 4305.946159][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4305.946384][ C3] RIP: 0010:dst_dev_put+0xa0/0x280
[ 4305.946572][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
[ 4305.947224][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010202
[ 4305.947456][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9688b398
[ 4305.947727][ C3] RDX: 001f803740000007 RSI: 0000000000000008 RDI: 00fc01ba00000038
[ 4305.948001][ C3] RBP: 00fc01ba00000000 R08: 0000000000000001 R09: fffffbfff336a8c4
[ 4305.948278][ C3] R10: ffffffff99b54627 R11: ffffc90000270800 R12: ffff88800bcbde80
[ 4305.948550][ C3] R13: ffff8880143b8c40 R14: 0000000000000003 R15: ffff8880143b8c40
[ 4305.948820][ C3] FS: 0000000000000000(0000) GS:ffff8880cd298000(0000) knlGS:0000000000000000
[ 4305.949132][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4305.949361][ C3] CR2: 00007fc457eb3000 CR3: 0000000071545003 CR4: 0000000000772ef0
[ 4305.949633][ C3] PKRU: 55555554
[ 4305.949768][ C3] Call Trace:
[ 4305.949903][ C3]
[ 4305.949996][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170
[ 4305.950181][ C3] fib_nh_common_release+0xe6/0x2d0
[ 4305.950361][ C3] free_fib_info_rcu+0x14c/0x380
[ 4305.950544][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0
[ 4305.950760][ C3] rcu_do_batch+0x27e/0x1120
[ 4305.950944][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 4305.951124][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70
[ 4305.951350][ C3] ? lockdep_hardirqs_on+0x7c/0x100
[ 4305.951531][ C3] ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 4305.951755][ C3] rcu_core+0x2bb/0x520
[ 4305.951895][ C3] handle_softirqs+0x1c0/0x820
[ 4305.952076][ C3] __irq_exit_rcu+0x6c/0xe0
[ 4305.952256][ C3] irq_exit_rcu+0xe/0x30
[ 4305.952398][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 4305.952578][ C3]
[ 4305.952670][ C3]
[ 4305.952760][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 4305.952981][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 4305.953171][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
[ 4305.953927][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000202
[ 4305.954157][ C3] RAX: 000000000456b6f7 RBX: 1ffff9200002afbf RCX: ffffffff9720a255
[ 4305.954448][ C3] RDX: 0000000000000000 RSI: ffffffff97bfa925 RDI: ffffffff9766a600
[ 4305.954721][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cdb631a
[ 4305.955090][ C3] R10: ffff888066db18d3 R11: ffff888001ae5090 R12: 0000000000000000
[ 4305.955463][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000
[ 4305.955740][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150
[ 4305.956065][ C3] default_idle+0x9/0x10
[ 4305.956199][ C3] default_idle_call+0x6c/0xa0
[ 4305.956479][ C3] cpuidle_idle_call+0x23b/0x380
[ 4305.956659][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 4305.956838][ C3] ? tsc_verify_tsc_adjust+0x94/0x310
[ 4305.957018][ C3] do_idle+0xe1/0x140
[ 4305.957152][ C3] cpu_startup_entry+0x54/0x60
[ 4305.957336][ C3] start_secondary+0x1fd/0x290
[ 4305.957513][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10
[ 4305.957693][ C3] common_startup_64+0x13e/0x148
[ 4305.957975][ C3]
[ 4305.958109][ C3] Modules linked in: sctp sch_etf sch_fq netdevsim psample act_mirred cls_matchall cls_bpf vxcan can_dev xfrm_interface ip6_gre ip_gre gre macsec ipvlan act_gact cls_flower sch_ingress nft_chain_nat xt_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ipt_REJECT nf_reject_ipv4 ip6t_rpfilter nft_compat nf_tables vxlan mpls_gso mpls_iptunnel mpls_router
[ 4305.959224][ C3] ---[ end trace 0000000000000000 ]---
[ 4305.959505][ C3] RIP: 0010:dst_dev_put+0xa0/0x280
[ 4305.959690][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
[ 4305.960333][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010202
[ 4305.960557][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9688b398
[ 4305.960822][ C3] RDX: 001f803740000007 RSI: 0000000000000008 RDI: 00fc01ba00000038
[ 4305.961199][ C3] RBP: 00fc01ba00000000 R08: 0000000000000001 R09: fffffbfff336a8c4
[ 4305.961469][ C3] R10: ffffffff99b54627 R11: ffffc90000270800 R12: ffff88800bcbde80
[ 4305.961838][ C3] R13: ffff8880143b8c40 R14: 0000000000000003 R15: ffff8880143b8c40
[ 4305.962104][ C3] FS: 0000000000000000(0000) GS:ffff8880cd298000(0000) knlGS:0000000000000000
[ 4305.962414][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4305.962743][ C3] CR2: 00007fc457eb3000 CR3: 0000000071545003 CR4: 0000000000772ef0
[ 4305.963011][ C3] PKRU: 55555554
[ 4305.963145][ C3] Kernel panic - not syncing: Fatal exception in interrupt
[ 4305.963703][ C3] Kernel Offset: 0x13800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 4305.964118][ C3] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr