[ 1176.853592][ C1] ================================================================== [ 1176.853908][ C1] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280 [ 1176.854174][ C1] Read of size 8 at addr ffff8880027861c0 by task swapper/1/0 [ 1176.854429][ C1] [ 1176.854523][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 1176.854528][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1176.854531][ C1] Call Trace: [ 1176.854533][ C1] [ 1176.854535][ C1] dump_stack_lvl+0x82/0xc0 [ 1176.854543][ C1] print_address_description.constprop.0+0x2c/0x3a0 [ 1176.854552][ C1] ? dst_dev_put+0x214/0x280 [ 1176.854555][ C1] print_report+0xb4/0x270 [ 1176.854559][ C1] ? dst_dev_put+0x214/0x280 [ 1176.854562][ C1] ? kasan_addr_to_slab+0x1d/0x50 [ 1176.854566][ C1] ? dst_dev_put+0x214/0x280 [ 1176.854569][ C1] kasan_report+0xca/0x100 [ 1176.854574][ C1] ? dst_dev_put+0x214/0x280 [ 1176.854579][ C1] dst_dev_put+0x214/0x280 [ 1176.854582][ C1] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 1176.854590][ C1] fib_nh_common_release+0xe6/0x2d0 [ 1176.854594][ C1] free_fib_info_rcu+0x14c/0x380 [ 1176.854598][ C1] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 1176.854601][ C1] rcu_do_batch+0x27e/0x1120 [ 1176.854608][ C1] ? trace_rcu_batch_end+0x270/0x270 [ 1176.854611][ C1] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 1176.854618][ C1] ? lockdep_hardirqs_on+0x7c/0x100 [ 1176.854624][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 1176.854629][ C1] rcu_core+0x2bb/0x520 [ 1176.854633][ C1] handle_softirqs+0x1c0/0x820 [ 1176.854642][ C1] __irq_exit_rcu+0x6c/0xe0 [ 1176.854645][ C1] irq_exit_rcu+0xe/0x30 [ 1176.854648][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 1176.854651][ C1] [ 1176.854652][ C1] [ 1176.854654][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1176.854658][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 1176.854662][ C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 1176.854665][ C1] RSP: 0018:ffffc90000137dd8 EFLAGS: 00000202 [ 1176.854669][ C1] RAX: 0000000002a9a361 RBX: 1ffff92000026fbf RCX: ffffffff8cc0a255 [ 1176.854671][ C1] RDX: 0000000000000000 RSI: ffffffff8d5fa925 RDI: ffffffff8d06a600 [ 1176.854673][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a [ 1176.854675][ C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000 [ 1176.854676][ C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000 [ 1176.854680][ C1] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 1176.854685][ C1] default_idle+0x9/0x10 [ 1176.854687][ C1] default_idle_call+0x6c/0xa0 [ 1176.854689][ C1] cpuidle_idle_call+0x23b/0x380 [ 1176.854694][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 1176.854697][ C1] ? tsc_verify_tsc_adjust+0x94/0x310 [ 1176.854704][ C1] do_idle+0xe1/0x140 [ 1176.854707][ C1] cpu_startup_entry+0x54/0x60 [ 1176.854710][ C1] start_secondary+0x1fd/0x290 [ 1176.854713][ C1] ? set_cpu_sibling_map+0x1e10/0x1e10 [ 1176.854718][ C1] common_startup_64+0x13e/0x148 [ 1176.854728][ C1] [ 1176.854730][ C1] [ 1176.864229][ C1] Allocated by task 13149: [ 1176.864401][ C1] kasan_save_stack+0x24/0x40 [ 1176.864580][ C1] kasan_save_track+0x14/0x30 [ 1176.864752][ C1] __kasan_slab_alloc+0x55/0x60 [ 1176.864925][ C1] kmem_cache_alloc_noprof+0x291/0x6d0 [ 1176.865099][ C1] dst_alloc+0x7a/0x140 [ 1176.865232][ C1] rt_dst_alloc+0x31/0x3a0 [ 1176.865411][ C1] __mkroute_output+0x425/0x11a0 [ 1176.865587][ C1] ip_route_output_key_hash+0xfa/0x220 [ 1176.865760][ C1] ip_route_output_flow+0x23/0x140 [ 1176.865933][ C1] udp_tunnel_dst_lookup+0x227/0x3a0 [ 1176.866105][ C1] vxlan_xmit_one+0x151a/0x4490 [vxlan] [ 1176.866292][ C1] vxlan_xmit+0xf6a/0x1870 [vxlan] [ 1176.866474][ C1] dev_hard_start_xmit+0x132/0x530 [ 1176.866649][ C1] __dev_queue_xmit+0x1406/0x1af0 [ 1176.866825][ C1] packet_snd+0xd0f/0x1a70 [ 1176.867000][ C1] __sys_sendto+0x24b/0x380 [ 1176.867174][ C1] __x64_sys_sendto+0xe0/0x1b0 [ 1176.867348][ C1] do_syscall_64+0xc1/0xfc0 [ 1176.867528][ C1] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 1176.867741][ C1] [ 1176.867830][ C1] Freed by task 12: [ 1176.867964][ C1] kasan_save_stack+0x24/0x40 [ 1176.868141][ C1] kasan_save_track+0x14/0x30 [ 1176.868313][ C1] __kasan_save_free_info+0x3b/0x60 [ 1176.868486][ C1] __kasan_slab_free+0x3f/0x60 [ 1176.868657][ C1] kmem_cache_free+0x2e4/0x690 [ 1176.868830][ C1] dst_destroy+0x230/0x350 [ 1176.869000][ C1] rcu_do_batch+0x27e/0x1120 [ 1176.869173][ C1] rcu_core+0x2bb/0x520 [ 1176.869307][ C1] handle_softirqs+0x1c0/0x820 [ 1176.869481][ C1] do_softirq+0xad/0xe0 [ 1176.869612][ C1] __local_bh_enable_ip+0x101/0x120 [ 1176.869785][ C1] __neigh_ifdown.isra.0+0xdb/0x870 [ 1176.869956][ C1] neigh_ifdown+0x10/0x20 [ 1176.870086][ C1] rt6_disable_ip+0xe7/0x130 [ 1176.870262][ C1] addrconf_ifdown.isra.0+0x102/0x15b0 [ 1176.870441][ C1] addrconf_notify+0xd1/0xd20 [ 1176.870616][ C1] notifier_call_chain+0x9a/0x290 [ 1176.870789][ C1] netif_close_many+0x2d7/0x650 [ 1176.870968][ C1] unregister_netdevice_many_notify+0x4ee/0x2080 [ 1176.871181][ C1] ops_undo_list+0x70f/0x890 [ 1176.871358][ C1] cleanup_net+0x3b2/0x8e0 [ 1176.871531][ C1] process_one_work+0x880/0x1810 [ 1176.871708][ C1] worker_thread+0x591/0xcf0 [ 1176.871886][ C1] kthread+0x37b/0x5f0 [ 1176.872020][ C1] ret_from_fork+0x42f/0x540 [ 1176.872193][ C1] ret_from_fork_asm+0x11/0x20 [ 1176.872369][ C1] [ 1176.872457][ C1] Last potentially related work creation: [ 1176.872632][ C1] kasan_save_stack+0x24/0x40 [ 1176.872808][ C1] kasan_record_aux_stack+0x8c/0xa0 [ 1176.872982][ C1] __call_rcu_common.constprop.0+0xa9/0x950 [ 1176.873204][ C1] dst_cache_destroy+0xf7/0x200 [ 1176.873384][ C1] vxlan_fdb_free+0x10e/0x1b0 [vxlan] [ 1176.873573][ C1] rcu_do_batch+0x27e/0x1120 [ 1176.873748][ C1] rcu_core+0x2bb/0x520 [ 1176.873879][ C1] handle_softirqs+0x1c0/0x820 [ 1176.874056][ C1] __irq_exit_rcu+0x6c/0xe0 [ 1176.874232][ C1] irq_exit_rcu+0xe/0x30 [ 1176.874365][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 1176.874545][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1176.874766][ C1] [ 1176.874856][ C1] The buggy address belongs to the object at ffff8880027861c0 [ 1176.874856][ C1] which belongs to the cache rtable of size 184 [ 1176.875280][ C1] The buggy address is located 0 bytes inside of [ 1176.875280][ C1] freed 184-byte region [ffff8880027861c0, ffff888002786278) [ 1176.875706][ C1] [ 1176.875795][ C1] The buggy address belongs to the physical page: [ 1176.876009][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888002786340 pfn:0x2786 [ 1176.876360][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1176.876625][ C1] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 1176.876855][ C1] page_type: f5(slab) [ 1176.876992][ C1] raw: 0080000000000240 ffff888005029e00 ffffea0000461890 ffff8880025e9708 [ 1176.877308][ C1] raw: ffff888002786340 0000000000150005 00000000f5000000 0000000000000000 [ 1176.877620][ C1] head: 0080000000000240 ffff888005029e00 ffffea0000461890 ffff8880025e9708 [ 1176.877933][ C1] head: ffff888002786340 0000000000150005 00000000f5000000 0000000000000000 [ 1176.878245][ C1] head: 0080000000000001 ffffea000009e181 00000000ffffffff 00000000ffffffff [ 1176.878555][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1176.878863][ C1] page dumped because: kasan: bad access detected [ 1176.879079][ C1] [ 1176.879166][ C1] Memory state around the buggy address: [ 1176.879339][ C1] ffff888002786080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 1176.879596][ C1] ffff888002786100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1176.879848][ C1] >ffff888002786180: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1176.880104][ C1] ^ [ 1176.880317][ C1] ffff888002786200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 1176.880576][ C1] ffff888002786280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1176.880829][ C1] ================================================================== [ 1176.881131][ C1] Disabling lock debugging due to kernel taint [ 1176.881358][ C1] Oops: general protection fault, probably for non-canonical address 0xe0a5fc8640000008: 0000 [#1] SMP KASAN [ 1176.881734][ C1] KASAN: maybe wild-memory-access in range [0x0530043200000040-0x0530043200000047] [ 1176.882014][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 1176.882346][ C1] Tainted: [B]=BAD_PAGE [ 1176.882475][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1176.882685][ C1] RIP: 0010:dst_dev_put+0xa0/0x280 [ 1176.882862][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 1176.883446][ C1] RSP: 0018:ffffc900001c0d48 EFLAGS: 00010203 [ 1176.883662][ C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff8c28b398 [ 1176.883913][ C1] RDX: 00a6008640000008 RSI: 0000000000000008 RDI: 0530043200000044 [ 1176.884159][ C1] RBP: 053004320000000c R08: 0000000000000001 R09: fffffbfff1eaa8c4 [ 1176.884405][ C1] R10: ffffffff8f554627 R11: ffffc900001c0800 R12: ffff888001ebc3b0 [ 1176.884651][ C1] R13: ffff8880027861c0 R14: 0000000000000000 R15: ffff8880027861c0 [ 1176.884906][ C1] FS: 0000000000000000(0000) GS:ffff8880ddb98000(0000) knlGS:0000000000000000 [ 1176.885193][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1176.885403][ C1] CR2: 00007fb2b693f000 CR3: 000000005cf45005 CR4: 0000000000772ef0 [ 1176.885653][ C1] PKRU: 55555554 [ 1176.885777][ C1] Call Trace: [ 1176.885902][ C1] [ 1176.885989][ C1] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 1176.886157][ C1] fib_nh_common_release+0xe6/0x2d0 [ 1176.886325][ C1] free_fib_info_rcu+0x14c/0x380 [ 1176.886490][ C1] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 1176.886697][ C1] rcu_do_batch+0x27e/0x1120 [ 1176.886861][ C1] ? trace_rcu_batch_end+0x270/0x270 [ 1176.887032][ C1] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 1176.887237][ C1] ? lockdep_hardirqs_on+0x7c/0x100 [ 1176.887404][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 1176.887608][ C1] rcu_core+0x2bb/0x520 [ 1176.887732][ C1] handle_softirqs+0x1c0/0x820 [ 1176.887898][ C1] __irq_exit_rcu+0x6c/0xe0 [ 1176.888063][ C1] irq_exit_rcu+0xe/0x30 [ 1176.888185][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 1176.888353][ C1] [ 1176.888437][ C1] [ 1176.888521][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1176.888724][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 1176.888895][ C1] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 1176.889482][ C1] RSP: 0018:ffffc90000137dd8 EFLAGS: 00000202 [ 1176.889694][ C1] RAX: 0000000002a9a361 RBX: 1ffff92000026fbf RCX: ffffffff8cc0a255 [ 1176.889941][ C1] RDX: 0000000000000000 RSI: ffffffff8d5fa925 RDI: ffffffff8d06a600 [ 1176.890187][ C1] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da1631a [ 1176.890438][ C1] R10: ffff88806d0b18d3 R11: ffff888001ae0a90 R12: 0000000000000000 [ 1176.890686][ C1] R13: ffff888001ae0040 R14: dffffc0000000000 R15: 0000000000000000 [ 1176.890938][ C1] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 1176.891143][ C1] default_idle+0x9/0x10 [ 1176.891268][ C1] default_idle_call+0x6c/0xa0 [ 1176.891429][ C1] cpuidle_idle_call+0x23b/0x380 [ 1176.891601][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 1176.891771][ C1] ? tsc_verify_tsc_adjust+0x94/0x310 [ 1176.891939][ C1] do_idle+0xe1/0x140 [ 1176.892063][ C1] cpu_startup_entry+0x54/0x60 [ 1176.892227][ C1] start_secondary+0x1fd/0x290 [ 1176.892392][ C1] ? set_cpu_sibling_map+0x1e10/0x1e10 [ 1176.892558][ C1] common_startup_64+0x13e/0x148 [ 1176.892728][ C1] [ 1176.892855][ C1] Modules linked in: sch_etf sch_fq ipt_rpfilter xt_length act_ct nf_flow_table vxcan can_dev xfrm_interface ipvlan sctp_diag sctp nft_chain_nat xt_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat nf_tables cls_matchall act_gact cls_flower sch_ingress bonding psample xfrm_user macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb [last unloaded: netdevsim] [ 1176.893926][ C1] ---[ end trace 0000000000000000 ]--- [ 1176.894093][ C1] RIP: 0010:dst_dev_put+0xa0/0x280 [ 1176.894265][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 1176.894851][ C1] RSP: 0018:ffffc900001c0d48 EFLAGS: 00010203 [ 1176.895063][ C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff8c28b398 [ 1176.895308][ C1] RDX: 00a6008640000008 RSI: 0000000000000008 RDI: 0530043200000044 [ 1176.895561][ C1] RBP: 053004320000000c R08: 0000000000000001 R09: fffffbfff1eaa8c4 [ 1176.895807][ C1] R10: ffffffff8f554627 R11: ffffc900001c0800 R12: ffff888001ebc3b0 [ 1176.896051][ C1] R13: ffff8880027861c0 R14: 0000000000000000 R15: ffff8880027861c0 [ 1176.896293][ C1] FS: 0000000000000000(0000) GS:ffff8880ddb98000(0000) knlGS:0000000000000000 [ 1176.896579][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1176.896788][ C1] CR2: 00007fb2b693f000 CR3: 000000005cf45005 CR4: 0000000000772ef0 [ 1176.897034][ C1] PKRU: 55555554 [ 1176.897163][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 1176.897599][ C1] Kernel Offset: 0x9200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 1176.897987][ C1] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr