======================================
| [   17.652136][  T317] ------------[ cut here ]------------
| [   17.652558][  T317] rcuref - imbalanced put()
| [   17.652561][  T317] WARNING: lib/rcuref.c:266 at 0x0, CPU#0: mausezahn/317
| [   17.653233][  T317] Modules linked in: act_gact cls_flower sch_ingress vxlan
[   17.654273][  T317] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   17.654672][  T317] RIP: 0010:rcuref_put_slowpath (lib/rcuref.c:266 (discriminator 1))
[   17.655069][  T317] Code: 07 83 c0 03 38 d0 7c 04 84 d2 75 69 c7 03 00 00 00 a0 31 c0 eb 8b 4c 89 ef e8 47 03 a0 ff e9 6c ff ff ff 48 8d 3d 0b 05 3d 03 <67> 48 0f b9 3a be 04 00 00 00 48 89 df e8 49 0a a0 ff 48 89 d8 48
All code
========
   0:	07                   	(bad)
   1:	83 c0 03             	add    $0x3,%eax
   4:	38 d0                	cmp    %dl,%al
   6:	7c 04                	jl     0xc
   8:	84 d2                	test   %dl,%dl
   a:	75 69                	jne    0x75
   c:	c7 03 00 00 00 a0    	movl   $0xa0000000,(%rbx)
  12:	31 c0                	xor    %eax,%eax
  14:	eb 8b                	jmp    0xffffffffffffffa1
  16:	4c 89 ef             	mov    %r13,%rdi
  19:	e8 47 03 a0 ff       	call   0xffffffffffa00365
  1e:	e9 6c ff ff ff       	jmp    0xffffffffffffff8f
  23:	48 8d 3d 0b 05 3d 03 	lea    0x33d050b(%rip),%rdi        # 0x33d0535
  2a:*	67 48 0f b9 3a       	ud1    (%edx),%rdi		<-- trapping instruction
  2f:	be 04 00 00 00       	mov    $0x4,%esi
  34:	48 89 df             	mov    %rbx,%rdi
  37:	e8 49 0a a0 ff       	call   0xffffffffffa00a85
  3c:	48 89 d8             	mov    %rbx,%rax
  3f:	48                   	rex.W

Code starting with the faulting instruction
===========================================
   0:	67 48 0f b9 3a       	ud1    (%edx),%rdi
   5:	be 04 00 00 00       	mov    $0x4,%esi
   a:	48 89 df             	mov    %rbx,%rdi
   d:	e8 49 0a a0 ff       	call   0xffffffffffa00a5b
  12:	48 89 d8             	mov    %rbx,%rax
  15:	48                   	rex.W
[   17.656296][  T317] RSP: 0018:ffffc90000c17240 EFLAGS: 00010206
[   17.656691][  T317] RAX: 0000000000000000 RBX: ffff88800f962080 RCX: ffffffffb568bb71
[   17.657208][  T317] RDX: ffffed1001f2c411 RSI: 00000000dfffffff RDI: ffffffffb7ebbf20
[   17.657673][  T317] RBP: 1ffff92000182e48 R08: 0000000000000001 R09: ffffed1001f2c410
[   17.658131][  T317] R10: ffff88800f962083 R11: ffff88800f16d090 R12: dffffc0000000000
[   17.658594][  T317] R13: ffff88800f962380 R14: ffff88800e5e3a80 R15: 0000000000000000
[   17.659052][  T317] FS:  00007f94d6b5f740(0000) GS:ffff8880b4718000(0000) knlGS:0000000000000000
[   17.659595][  T317] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   17.659978][  T317] CR2: 00007f94d6cb60b0 CR3: 000000000616e003 CR4: 0000000000772ef0
[   17.660442][  T317] PKRU: 55555554
[   17.660670][  T317] Call Trace:
[   17.660898][  T317]  <TASK>
[   17.661054][  T317]  ? rcuref_get_slowpath (lib/rcuref.c:238)
[   17.661369][  T317]  dst_release (./include/linux/rcuref.h:117 ./include/linux/rcuref.h:173 net/core/dst.c:167)
[   17.661693][  T317]  rt_cache_route (net/ipv4/route.c:1510)
[   17.662000][  T317]  rt_set_nexthop.constprop.0 (net/ipv4/route.c:1622)
[   17.662307][  T317]  __mkroute_output (./include/net/lwtunnel.h:140 net/ipv4/route.c:2682)
[   17.662625][  T317]  ip_route_output_key_hash (net/ipv4/route.c:2705)
[   17.662927][  T317]  ? ip_route_output_key_hash_rcu (net/ipv4/route.c:2693)
[   17.663303][  T317]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[   17.663623][  T317]  ? dst_cache_get_ip4 (./include/linux/local_lock_internal.h:57 net/core/dst_cache.c:98)
[   17.663925][  T317]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   17.664233][  T317]  ip_route_output_flow (net/ipv4/route.c:2934)
[   17.664554][  T317]  udp_tunnel_dst_lookup (net/ipv4/udp_tunnel_core.c:261 net/ipv4/udp_tunnel_core.c:230)
[   17.664860][  T317]  ? udp_tunnel_drop_rx_port (net/ipv4/udp_tunnel_core.c:237)
[   17.665170][  T317]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[   17.665483][  T317] vxlan_xmit_one (drivers/net/vxlan/vxlan_core.c:2472 (discriminator 4)) vxlan
[   17.665802][  T317]  ? __skb_flow_dissect (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/flow_dissector.c:1172)
[   17.666107][  T317]  ? __skb_flow_dissect (net/core/flow_dissector.c:1160 (discriminator 2))
[   17.666432][  T317]  ? vxlan_fdb_delete (drivers/net/vxlan/vxlan_core.c:2337) vxlan
[   17.666746][  T317]  ? vxlan_find_mac_rcu (./include/linux/rhashtable.h:632 ./include/linux/rhashtable.h:670 drivers/net/vxlan/vxlan_core.c:392) vxlan
[   17.667136][  T317]  ? vxlan_remcsum (drivers/net/vxlan/vxlan_core.c:382) vxlan
[   17.667463][  T317]  ? vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan
[   17.667775][  T317] vxlan_xmit (drivers/net/vxlan/vxlan_core.c:2829) vxlan
[   17.668090][  T317]  ? vxlan_xmit_nhid (drivers/net/vxlan/vxlan_core.c:2721) vxlan
[   17.668403][  T317]  ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591)
[   17.668705][  T317]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   17.669007][  T317]  ? dev_queue_xmit_nit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/dev.c:2591)
[   17.669307][  T317]  ? dev_queue_xmit_nit (net/core/dev.c:2592)
[   17.669624][  T317]  dev_hard_start_xmit (./include/linux/netdevice.h:5272 ./include/linux/netdevice.h:5281 net/core/dev.c:3853 net/core/dev.c:3869)
[   17.669934][  T317]  __dev_queue_xmit (net/core/dev.h:381 net/core/dev.c:4818)
[   17.670235][  T317]  ? _copy_from_iter (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 lib/iov_iter.c:67 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272)
[   17.670553][  T317]  ? netdev_core_pick_tx (net/core/dev.c:4725)
[   17.670855][  T317]  ? packet_parse_headers (net/packet/af_packet.c:1933)
[   17.671161][  T317]  ? sock_wmalloc (net/core/sock.c:2968)
[   17.671472][  T317]  ? packet_cached_dev_get (net/packet/af_packet.c:1923)
[   17.671775][  T317]  ? skb_copy_datagram_from_iter (net/core/datagram.c:561)
[   17.672159][  T317]  packet_snd (net/packet/af_packet.c:3076)
[   17.672478][  T317]  ? tpacket_snd (net/packet/af_packet.c:2940)
[   17.672780][  T317]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   17.673088][  T317]  ? __might_fault (mm/memory.c:7129 mm/memory.c:7123)
[   17.673404][  T317]  __sys_sendto (net/socket.c:718 net/socket.c:733 net/socket.c:2222)
[   17.673712][  T317]  ? __ia32_sys_getpeername (net/socket.c:2189)
[   17.674021][  T317]  ? sock_ioctl (net/socket.c:1369)
[   17.674328][  T317]  ? _copy_to_user (./arch/x86/include/asm/smap.h:42 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:147 ./include/linux/uaccess.h:206 lib/usercopy.c:26)
[   17.674648][  T317]  ? ns_to_timespec64 (kernel/time/time.c:905)
[   17.674949][  T317]  ? posix_cpu_clock_get (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/time/posix-cpu-timers.c:375)
[   17.675254][  T317]  ? posix_cpu_clock_get (kernel/time/posix-cpu-timers.c:377)
[   17.675564][  T317]  ? __x64_sys_clock_gettime (kernel/time/posix-timers.c:1146 kernel/time/posix-timers.c:1134 kernel/time/posix-timers.c:1134)
[   17.675871][  T317]  __x64_sys_sendto (net/socket.c:2225)
[   17.676170][  T317]  ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:108 arch/x86/entry/syscall_64.c:90)
[   17.676482][  T317]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[   17.676788][  T317]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   17.677087][  T317]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
[   17.677469][  T317] RIP: 0033:0x7f94d6d7b27a
[   17.677781][  T317] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
All code
========
   0:	d8 64 89 02          	fsubs  0x2(%rcx,%rcx,4)
   4:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   b:	eb b8                	jmp    0xffffffffffffffc5
   d:	0f 1f 00             	nopl   (%rax)
  10:	f3 0f 1e fa          	endbr64
  14:	41 89 ca             	mov    %ecx,%r10d
  17:	64 8b 04 25 18 00 00 	mov    %fs:0x18,%eax
  1e:	00 
  1f:	85 c0                	test   %eax,%eax
  21:	75 15                	jne    0x38
  23:	b8 2c 00 00 00       	mov    $0x2c,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 7e                	ja     0xb0
  32:	c3                   	ret
  33:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  38:	41 54                	push   %r12
  3a:	48 83 ec 30          	sub    $0x30,%rsp
  3e:	44                   	rex.R
  3f:	89                   	.byte 0x89

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 7e                	ja     0x86
   8:	c3                   	ret
   9:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   e:	41 54                	push   %r12
  10:	48 83 ec 30          	sub    $0x30,%rsp
  14:	44                   	rex.R
  15:	89                   	.byte 0x89
[   17.678892][  T317] RSP: 002b:00007ffec56b5a98 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[   17.679350][  T317] RAX: ffffffffffffffda RBX: 00000000122d99d0 RCX: 00007f94d6d7b27a
[   17.679812][  T317] RDX: 0000000000000064 RSI: 00000000122d95c2 RDI: 0000000000000005
[   17.680272][  T317] RBP: 00000000122d95c2 R08: 00007ffec56b5aa0 R09: 0000000000000014
[   17.680738][  T317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   17.681202][  T317] R13: 0000000000000064 R14: 00007ffec56b5aa0 R15: 0000000000000000
| [   18.341716][    C1] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146)
| [   18.341975][    C1] Read of size 8 at addr ffff88800f962340 by task swapper/1/0
| [   18.342226][    C1]
| [   18.342321][    C1] Tainted: [W]=WARN
[   18.342322][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   18.342325][    C1] Call Trace:
[   18.342326][    C1]  <IRQ>
[   18.342329][    C1]  dump_stack_lvl (lib/dump_stack.c:123)
[   18.342335][    C1]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[   18.342341][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   18.342345][    C1]  print_report (mm/kasan/report.c:483)
[   18.342349][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   18.342351][    C1]  ? kasan_addr_to_slab (mm/kasan/../slab.h:178 mm/kasan/common.c:47)
[   18.342355][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   18.342358][    C1]  kasan_report (mm/kasan/report.c:597)
[   18.342362][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   18.342367][    C1]  dst_dev_put (net/core/dst.c:146)
[   18.342373][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[   18.342379][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[   18.342383][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3))
[   18.342387][    C1]  ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223)
[   18.342391][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607)
[   18.342396][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[   18.342400][    C1]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[   18.342406][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[   18.342410][    C1]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)
[   18.342415][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[   18.342419][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[   18.342427][    C1]  __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723)
[   18.342429][    C1]  irq_exit_rcu (kernel/softirq.c:741)
[   18.342432][    C1]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056)
[   18.342436][    C1]  </IRQ>
[   18.342437][    C1]  <TASK>
[   18.342439][    C1]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[   18.342442][    C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[   18.342447][    C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 <c3> 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
All code
========
   0:	48 8b 3d 34 31 90 02 	mov    0x2903134(%rip),%rdi        # 0x290313b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 28 07 a9 00 	sub    0xa90728(%rip),%rax        # 0xa9073b
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d d3 d6 28 00 	verw   0x28d6d3(%rip)        # 0x28d6fb
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	41 54                	push   %r12
  31:	55                   	push   %rbp
  32:	53                   	push   %rbx
  33:	48 89 fb             	mov    %rdi,%rbx
  36:	48 83 ec 10          	sub    $0x10,%rsp
  3a:	8b 17                	mov    (%rdi),%edx
  3c:	83 e2 fe             	and    $0xfffffffe,%edx
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	41 54                	push   %r12
   7:	55                   	push   %rbp
   8:	53                   	push   %rbx
   9:	48 89 fb             	mov    %rdi,%rbx
   c:	48 83 ec 10          	sub    $0x10,%rsp
  10:	8b 17                	mov    (%rdi),%edx
  12:	83 e2 fe             	and    $0xfffffffe,%edx
  15:	41                   	rex.B
[   18.342449][    C1] RSP: 0000:ffffc90000137dd8 EFLAGS: 00000202
[   18.342453][    C1] RAX: 000000000009fc3d RBX: 1ffff92000026fbf RCX: ffffffffb600a255
[   18.342455][    C1] RDX: 0000000000000000 RSI: ffffffffb69fa925 RDI: ffffffffb646a600
[   18.342456][    C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a
[   18.342458][    C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000
[   18.342460][    C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000
[   18.342463][    C1]  ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146)
[   18.342468][    C1]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[   18.342470][    C1]  default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123)
[   18.342472][    C1]  cpuidle_idle_call (kernel/sched/idle.c:192)
[   18.342477][    C1]  ? arch_cpu_idle_exit+0x40/0x40
[   18.342480][    C1]  ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60)
[   18.342485][    C1]  do_idle (kernel/sched/idle.c:332)
[   18.342489][    C1]  cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1))
[   18.342492][    C1]  start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280)
[   18.342495][    C1]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)
[   18.342500][    C1]  common_startup_64 (arch/x86/kernel/head_64.S:419)
| [   18.369287][    C1] Disabling lock debugging due to kernel taint
| [   18.369624][    C1] Oops: general protection fault, probably for non-canonical address 0xe0fabc3860000008: 0000 [#1] SMP KASAN
| [   18.369988][    C1] KASAN: maybe wild-memory-access in range [0x07d601c300000040-0x07d601c300000047]
| [   18.370704][    C1] Tainted: [B]=BAD_PAGE, [W]=WARN
[   18.370880][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   18.371188][    C1] RIP: 0010:dst_dev_put (net/core/dst.c:149)
[   18.371362][    C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 9c 01 00 00 48 b8 	test   %ebx,-0x47b80000(%rcx,%rax,1)
  13:	00 00                	add    %al,(%rax)
  15:	00 00                	add    %al,(%rax)
  17:	00 fc                	add    %bh,%ah
  19:	ff                   	lcall  (bad)
  1a:	df 49 8b             	fisttps -0x75(%rcx)
  1d:	6d                   	insl   (%dx),%es:(%rdi)
  1e:	08 48 8d             	or     %cl,-0x73(%rax)
  21:	7d 38                	jge    0x5b
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
  2a:*	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)		<-- trapping instruction
  2e:	0f 85 6f 01 00 00    	jne    0x1a3
  34:	48 8b 45 38          	mov    0x38(%rbp),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	4c 89 e6             	mov    %r12,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 6f 01 00 00    	jne    0x179
   a:	48 8b 45 38          	mov    0x38(%rbp),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	4c 89 e6             	mov    %r12,%rsi
[   18.372065][    C1] RSP: 0000:ffffc900001c0d48 EFLAGS: 00010203
[   18.372273][    C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffb568b398
[   18.372522][    C1] RDX: 00fac03860000008 RSI: 0000000000000008 RDI: 07d601c300000044
[   18.372869][    C1] RBP: 07d601c30000000c R08: 0000000000000001 R09: fffffbfff712a8c4
[   18.373116][    C1] R10: ffffffffb8954627 R11: ffffc900001c0800 R12: ffff88800b04d9a0
[   18.373476][    C1] R13: ffff88800f962340 R14: 0000000000000000 R15: ffff88800f962340
[   18.373722][    C1] FS:  0000000000000000(0000) GS:ffff8880b4798000(0000) knlGS:0000000000000000
[   18.374010][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   18.374319][    C1] CR2: 00007ff658991444 CR3: 000000001dd45003 CR4: 0000000000772ef0
[   18.374583][    C1] PKRU: 55555554
[   18.374707][    C1] Call Trace:
[   18.374833][    C1]  <IRQ>
[   18.375017][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[   18.375188][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[   18.375355][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3))
[   18.375521][    C1]  ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223)
[   18.375825][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607)
[   18.376000][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[   18.376165][    C1]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[   18.376373][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[   18.376637][    C1]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/preempt.h:104 ./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)
[   18.376844][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[   18.376970][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[   18.377138][    C1]  __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723)
[   18.377410][    C1]  irq_exit_rcu (kernel/softirq.c:741)
[   18.377535][    C1]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056)
[   18.377699][    C1]  </IRQ>
[   18.377785][    C1]  <TASK>
[   18.377868][    C1]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[   18.378172][    C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[   18.378344][    C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 <c3> 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
All code
========
   0:	48 8b 3d 34 31 90 02 	mov    0x2903134(%rip),%rdi        # 0x290313b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 28 07 a9 00 	sub    0xa90728(%rip),%rax        # 0xa9073b
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d d3 d6 28 00 	verw   0x28d6d3(%rip)        # 0x28d6fb
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	41 54                	push   %r12
  31:	55                   	push   %rbp
  32:	53                   	push   %rbx
  33:	48 89 fb             	mov    %rdi,%rbx
  36:	48 83 ec 10          	sub    $0x10,%rsp
  3a:	8b 17                	mov    (%rdi),%edx
  3c:	83 e2 fe             	and    $0xfffffffe,%edx
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	41 54                	push   %r12
   7:	55                   	push   %rbp
   8:	53                   	push   %rbx
   9:	48 89 fb             	mov    %rdi,%rbx
   c:	48 83 ec 10          	sub    $0x10,%rsp
  10:	8b 17                	mov    (%rdi),%edx
  12:	83 e2 fe             	and    $0xfffffffe,%edx
  15:	41                   	rex.B
[   18.379043][    C1] RSP: 0000:ffffc90000137dd8 EFLAGS: 00000202
[   18.379252][    C1] RAX: 000000000009fc3d RBX: 1ffff92000026fbf RCX: ffffffffb600a255
[   18.379501][    C1] RDX: 0000000000000000 RSI: ffffffffb69fa925 RDI: ffffffffb646a600
[   18.379869][    C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a
[   18.380117][    C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000
[   18.380464][    C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000
[   18.380711][    C1]  ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146)
[   18.380917][    C1]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[   18.381048][    C1]  default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123)
[   18.381310][    C1]  cpuidle_idle_call (kernel/sched/idle.c:192)
[   18.381476][    C1]  ? arch_cpu_idle_exit+0x40/0x40
[   18.381642][    C1]  ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60)
[   18.381808][    C1]  do_idle (kernel/sched/idle.c:332)
[   18.382031][    C1]  cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1))
[   18.382195][    C1]  start_secondary (arch/x86/kernel/smpboot.c:200 arch/x86/kernel/smpboot.c:280)
[   18.382359][    C1]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)


Finger prints:
print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu
dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core
rcuref_put_slowpath:dst_release:rt_cache_route:__mkroute_output:ip_route_output_key_hash