[ 2527.746164][T17650] GACT probability NOT on [ 2535.313236][ C0] ================================================================== [ 2535.313592][ C0] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280 [ 2535.313913][ C0] Read of size 8 at addr ffff888004d3e7c0 by task swapper/0/0 [ 2535.314213][ C0] [ 2535.314319][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 2535.314325][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2535.314328][ C0] Call Trace: [ 2535.314330][ C0] [ 2535.314332][ C0] dump_stack_lvl+0x82/0xc0 [ 2535.314340][ C0] print_address_description.constprop.0+0x2c/0x3a0 [ 2535.314348][ C0] ? dst_dev_put+0x214/0x280 [ 2535.314352][ C0] print_report+0xb4/0x270 [ 2535.314356][ C0] ? dst_dev_put+0x214/0x280 [ 2535.314359][ C0] ? kasan_addr_to_slab+0x1d/0x50 [ 2535.314363][ C0] ? dst_dev_put+0x214/0x280 [ 2535.314365][ C0] kasan_report+0xca/0x100 [ 2535.314370][ C0] ? dst_dev_put+0x214/0x280 [ 2535.314375][ C0] dst_dev_put+0x214/0x280 [ 2535.314378][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2535.314386][ C0] fib_nh_common_release+0xe6/0x2d0 [ 2535.314390][ C0] free_fib_info_rcu+0x14c/0x380 [ 2535.314394][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2535.314398][ C0] rcu_do_batch+0x27e/0x1120 [ 2535.314405][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 2535.314408][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2535.314415][ C0] ? lockdep_hardirqs_on+0x7c/0x100 [ 2535.314421][ C0] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 2535.314429][ C0] rcu_core+0x2bb/0x520 [ 2535.314437][ C0] handle_softirqs+0x1c0/0x820 [ 2535.314451][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2535.314454][ C0] irq_exit_rcu+0xe/0x30 [ 2535.314457][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2535.314461][ C0] [ 2535.314462][ C0] [ 2535.314464][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2535.314468][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2535.314473][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2535.314476][ C0] RSP: 0018:ffffffffbc607de8 EFLAGS: 00000206 [ 2535.314479][ C0] RAX: 0000000002d8c4ff RBX: 1ffffffff78c0fc1 RCX: ffffffffbb40a255 [ 2535.314482][ C0] RDX: 0000000000000000 RSI: ffffffffbbdfa925 RDI: ffffffffbb86a600 [ 2535.314483][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a [ 2535.314485][ C0] R10: ffff888066c318d3 R11: ffffffffbc632e50 R12: 0000000000000000 [ 2535.314487][ C0] R13: ffffffffbc632400 R14: dffffc0000000000 R15: 0000000000014770 [ 2535.314491][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2535.314495][ C0] default_idle+0x9/0x10 [ 2535.314497][ C0] default_idle_call+0x6c/0xa0 [ 2535.314500][ C0] cpuidle_idle_call+0x23b/0x380 [ 2535.314504][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 2535.314508][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2535.314514][ C0] do_idle+0xe1/0x140 [ 2535.314517][ C0] cpu_startup_entry+0x54/0x60 [ 2535.314520][ C0] rest_init+0x14b/0x260 [ 2535.314523][ C0] start_kernel+0x348/0x3f0 [ 2535.314532][ C0] x86_64_start_reservations+0x18/0x30 [ 2535.314536][ C0] x86_64_start_kernel+0xf8/0x150 [ 2535.314540][ C0] common_startup_64+0x13e/0x148 [ 2535.314551][ C0] [ 2535.314552][ C0] [ 2535.326383][ C0] Allocated by task 17751: [ 2535.326592][ C0] kasan_save_stack+0x24/0x40 [ 2535.326819][ C0] kasan_save_track+0x14/0x30 [ 2535.327022][ C0] __kasan_slab_alloc+0x55/0x60 [ 2535.327226][ C0] kmem_cache_alloc_noprof+0x291/0x6d0 [ 2535.327431][ C0] dst_alloc+0x7a/0x140 [ 2535.327589][ C0] rt_dst_alloc+0x31/0x3a0 [ 2535.327815][ C0] __mkroute_output+0x425/0x11a0 [ 2535.328017][ C0] ip_route_output_key_hash+0xfa/0x220 [ 2535.328231][ C0] ip_route_output_flow+0x23/0x140 [ 2535.328434][ C0] udp_tunnel_dst_lookup+0x227/0x3a0 [ 2535.328641][ C0] vxlan_xmit_one+0x151a/0x4490 [vxlan] [ 2535.328885][ C0] vxlan_xmit+0xf6a/0x1870 [vxlan] [ 2535.329098][ C0] dev_hard_start_xmit+0x132/0x530 [ 2535.329307][ C0] __dev_queue_xmit+0x1406/0x1af0 [ 2535.329515][ C0] packet_snd+0xd0f/0x1a70 [ 2535.329731][ C0] __sys_sendto+0x24b/0x380 [ 2535.329937][ C0] __x64_sys_sendto+0xe0/0x1b0 [ 2535.330139][ C0] do_syscall_64+0xc1/0xfc0 [ 2535.330344][ C0] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 2535.330602][ C0] [ 2535.330710][ C0] Freed by task 22: [ 2535.330880][ C0] kasan_save_stack+0x24/0x40 [ 2535.331091][ C0] kasan_save_track+0x14/0x30 [ 2535.331297][ C0] __kasan_save_free_info+0x3b/0x60 [ 2535.331504][ C0] __kasan_slab_free+0x3f/0x60 [ 2535.331709][ C0] kmem_cache_free+0x2e4/0x690 [ 2535.331920][ C0] dst_destroy+0x230/0x350 [ 2535.332123][ C0] rcu_do_batch+0x27e/0x1120 [ 2535.332328][ C0] rcu_core+0x2bb/0x520 [ 2535.332489][ C0] handle_softirqs+0x1c0/0x820 [ 2535.332696][ C0] run_ksoftirqd+0x3b/0x60 [ 2535.332915][ C0] smpboot_thread_fn+0x304/0x950 [ 2535.333125][ C0] kthread+0x37b/0x5f0 [ 2535.333285][ C0] ret_from_fork+0x42f/0x540 [ 2535.333491][ C0] ret_from_fork_asm+0x11/0x20 [ 2535.333700][ C0] [ 2535.333816][ C0] Last potentially related work creation: [ 2535.334026][ C0] kasan_save_stack+0x24/0x40 [ 2535.334235][ C0] kasan_record_aux_stack+0x8c/0xa0 [ 2535.334441][ C0] __call_rcu_common.constprop.0+0xa9/0x950 [ 2535.334699][ C0] dst_cache_destroy+0xf7/0x200 [ 2535.334935][ C0] vxlan_fdb_free+0x10e/0x1b0 [vxlan] [ 2535.335153][ C0] rcu_do_batch+0x27e/0x1120 [ 2535.335358][ C0] rcu_core+0x2bb/0x520 [ 2535.335517][ C0] handle_softirqs+0x1c0/0x820 [ 2535.335728][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2535.335940][ C0] irq_exit_rcu+0xe/0x30 [ 2535.336097][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2535.336303][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2535.336561][ C0] [ 2535.336665][ C0] The buggy address belongs to the object at ffff888004d3e7c0 [ 2535.336665][ C0] which belongs to the cache rtable of size 184 [ 2535.337178][ C0] The buggy address is located 0 bytes inside of [ 2535.337178][ C0] freed 184-byte region [ffff888004d3e7c0, ffff888004d3e878) [ 2535.337677][ C0] [ 2535.337780][ C0] The buggy address belongs to the physical page: [ 2535.338045][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888004d3e640 pfn:0x4d3e [ 2535.338474][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2535.338789][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 2535.339060][ C0] page_type: f5(slab) [ 2535.339219][ C0] raw: 0080000000000240 ffff8880051cde00 ffff88800266f708 ffff88800266f708 [ 2535.339584][ C0] raw: ffff888004d3e640 0000000000150001 00000000f5000000 0000000000000000 [ 2535.339969][ C0] head: 0080000000000240 ffff8880051cde00 ffff88800266f708 ffff88800266f708 [ 2535.340336][ C0] head: ffff888004d3e640 0000000000150001 00000000f5000000 0000000000000000 [ 2535.340702][ C0] head: 0080000000000001 ffffea0000134f81 00000000ffffffff 00000000ffffffff [ 2535.341095][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2535.341457][ C0] page dumped because: kasan: bad access detected [ 2535.341721][ C0] [ 2535.341823][ C0] Memory state around the buggy address: [ 2535.342038][ C0] ffff888004d3e680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2535.342340][ C0] ffff888004d3e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2535.342643][ C0] >ffff888004d3e780: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2535.342956][ C0] ^ [ 2535.343206][ C0] ffff888004d3e800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2535.343628][ C0] ffff888004d3e880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2535.343926][ C0] ================================================================== [ 2535.344362][ C0] Disabling lock debugging due to kernel taint [ 2535.344628][ C0] Oops: general protection fault, probably for non-canonical address 0xe082fc3a00000009: 0000 [#1] SMP KASAN [ 2535.345084][ C0] KASAN: maybe wild-memory-access in range [0x041801d000000048-0x041801d00000004f] [ 2535.345541][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 2535.345934][ C0] Tainted: [B]=BAD_PAGE [ 2535.346219][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2535.346465][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2535.346675][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2535.347519][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010207 [ 2535.347773][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffbaa8b398 [ 2535.348078][ C0] RDX: 0083003a00000009 RSI: 0000000000000008 RDI: 041801d00000004e [ 2535.348388][ C0] RBP: 041801d000000016 R08: 0000000000000001 R09: fffffbfff7baa8c4 [ 2535.348687][ C0] R10: ffffffffbdd54627 R11: ffffc90000007800 R12: ffff88800a652758 [ 2535.349118][ C0] R13: ffff888004d3e7c0 R14: 0000000000000000 R15: ffff888004d3e7c0 [ 2535.349412][ C0] FS: 0000000000000000(0000) GS:ffff8880a8f18000(0000) knlGS:0000000000000000 [ 2535.349880][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2535.350155][ C0] CR2: 00000000004061e9 CR3: 000000007b345001 CR4: 0000000000772ef0 [ 2535.350451][ C0] PKRU: 55555554 [ 2535.350608][ C0] Call Trace: [ 2535.350877][ C0] [ 2535.350979][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2535.351196][ C0] fib_nh_common_release+0xe6/0x2d0 [ 2535.351391][ C0] free_fib_info_rcu+0x14c/0x380 [ 2535.351594][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2535.351843][ C0] rcu_do_batch+0x27e/0x1120 [ 2535.352046][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 2535.352252][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2535.352506][ C0] ? lockdep_hardirqs_on+0x7c/0x100 [ 2535.352707][ C0] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 2535.352953][ C0] rcu_core+0x2bb/0x520 [ 2535.353101][ C0] handle_softirqs+0x1c0/0x820 [ 2535.353561][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2535.353757][ C0] irq_exit_rcu+0xe/0x30 [ 2535.353905][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2535.354103][ C0] [ 2535.354217][ C0] [ 2535.354317][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2535.354562][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2535.354766][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2535.355477][ C0] RSP: 0018:ffffffffbc607de8 EFLAGS: 00000206 [ 2535.355727][ C0] RAX: 0000000002d8c4ff RBX: 1ffffffff78c0fc1 RCX: ffffffffbb40a255 [ 2535.356021][ C0] RDX: 0000000000000000 RSI: ffffffffbbdfa925 RDI: ffffffffbb86a600 [ 2535.356325][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a [ 2535.356741][ C0] R10: ffff888066c318d3 R11: ffffffffbc632e50 R12: 0000000000000000 [ 2535.357029][ C0] R13: ffffffffbc632400 R14: dffffc0000000000 R15: 0000000000014770 [ 2535.357330][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2535.357579][ C0] default_idle+0x9/0x10 [ 2535.357727][ C0] default_idle_call+0x6c/0xa0 [ 2535.357925][ C0] cpuidle_idle_call+0x23b/0x380 [ 2535.358255][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 2535.358452][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2535.358654][ C0] do_idle+0xe1/0x140 [ 2535.358801][ C0] cpu_startup_entry+0x54/0x60 [ 2535.358995][ C0] rest_init+0x14b/0x260 [ 2535.359145][ C0] start_kernel+0x348/0x3f0 [ 2535.359376][ C0] x86_64_start_reservations+0x18/0x30 [ 2535.359583][ C0] x86_64_start_kernel+0xf8/0x150 [ 2535.360010][ C0] common_startup_64+0x13e/0x148 [ 2535.360213][ C0] [ 2535.360374][ C0] Modules linked in: act_gact cls_flower sch_ingress vxlan openvswitch psample nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nsh ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables [ 2535.361149][ C0] ---[ end trace 0000000000000000 ]--- [ 2535.361478][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2535.361679][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2535.362510][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010207 [ 2535.362763][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffbaa8b398 [ 2535.363060][ C0] RDX: 0083003a00000009 RSI: 0000000000000008 RDI: 041801d00000004e [ 2535.363484][ C0] RBP: 041801d000000016 R08: 0000000000000001 R09: fffffbfff7baa8c4 [ 2535.363775][ C0] R10: ffffffffbdd54627 R11: ffffc90000007800 R12: ffff88800a652758 [ 2535.364439][ C0] R13: ffff888004d3e7c0 R14: 0000000000000000 R15: ffff888004d3e7c0 [ 2535.364742][ C0] FS: 0000000000000000(0000) GS:ffff8880a8f18000(0000) knlGS:0000000000000000 [ 2535.365205][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2535.365600][ C0] CR2: 00000000004061e9 CR3: 000000007b345001 CR4: 0000000000772ef0 [ 2535.365901][ C0] PKRU: 55555554 [ 2535.366053][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 2535.366541][ C0] Kernel Offset: 0x37a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 2535.366996][ C0] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr