[ 2548.176764][T16505] GACT probability NOT on
[ 2555.821226][ C3] ==================================================================
[ 2555.821610][ C3] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280
[ 2555.821887][ C3] Read of size 8 at addr ffff88800c984340 by task swapper/3/0
[ 2555.822154][ C3]
[ 2555.822247][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.18.0-virtme #1 PREEMPT(full)
[ 2555.822252][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2555.822255][ C3] Call Trace:
[ 2555.822257][ C3]
[ 2555.822260][ C3] dump_stack_lvl+0x82/0xc0
[ 2555.822268][ C3] print_address_description.constprop.0+0x2c/0x3a0
[ 2555.822277][ C3] ? dst_dev_put+0x214/0x280
[ 2555.822280][ C3] print_report+0xb4/0x270
[ 2555.822284][ C3] ? dst_dev_put+0x214/0x280
[ 2555.822287][ C3] ? kasan_addr_to_slab+0x1d/0x50
[ 2555.822291][ C3] ? dst_dev_put+0x214/0x280
[ 2555.822293][ C3] kasan_report+0xca/0x100
[ 2555.822298][ C3] ? dst_dev_put+0x214/0x280
[ 2555.822303][ C3] dst_dev_put+0x214/0x280
[ 2555.822306][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170
[ 2555.822314][ C3] fib_nh_common_release+0xe6/0x2d0
[ 2555.822318][ C3] free_fib_info_rcu+0x14c/0x380
[ 2555.822322][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0
[ 2555.822326][ C3] rcu_do_batch+0x27e/0x1120
[ 2555.822333][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 2555.822336][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70
[ 2555.822343][ C3] ? lockdep_hardirqs_on+0x7c/0x100
[ 2555.822349][ C3] ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 2555.822354][ C3] rcu_core+0x2bb/0x520
[ 2555.822358][ C3] handle_softirqs+0x1c0/0x820
[ 2555.822367][ C3] __irq_exit_rcu+0x6c/0xe0
[ 2555.822369][ C3] irq_exit_rcu+0xe/0x30
[ 2555.822372][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 2555.822376][ C3]
[ 2555.822377][ C3]
[ 2555.822379][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 2555.822383][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 2555.822387][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
[ 2555.822391][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000202
[ 2555.822395][ C3] RAX: 0000000002feee73 RBX: 1ffff9200002afbf RCX: ffffffff87c0a255
[ 2555.822397][ C3] RDX: 0000000000000000 RSI: ffffffff885fa925 RDI: ffffffff8806a600
[ 2555.822399][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cdb631a
[ 2555.822401][ C3] R10: ffff888066db18d3 R11: ffff888001ae5090 R12: 0000000000000000
[ 2555.822403][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000
[ 2555.822407][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150
[ 2555.822412][ C3] default_idle+0x9/0x10
[ 2555.822414][ C3] default_idle_call+0x6c/0xa0
[ 2555.822417][ C3] cpuidle_idle_call+0x23b/0x380
[ 2555.822421][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 2555.822425][ C3] ? tsc_verify_tsc_adjust+0x94/0x310
[ 2555.822431][ C3] do_idle+0xe1/0x140
[ 2555.822434][ C3] cpu_startup_entry+0x54/0x60
[ 2555.822437][ C3] start_secondary+0x1fd/0x290
[ 2555.822440][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10
[ 2555.822445][ C3] common_startup_64+0x13e/0x148
[ 2555.822456][ C3]
[ 2555.822457][ C3]
[ 2555.832080][ C3] Allocated by task 16608:
[ 2555.832254][ C3] kasan_save_stack+0x24/0x40
[ 2555.832435][ C3] kasan_save_track+0x14/0x30
[ 2555.832611][ C3] __kasan_slab_alloc+0x55/0x60
[ 2555.832790][ C3] kmem_cache_alloc_noprof+0x291/0x6d0
[ 2555.832968][ C3] dst_alloc+0x7a/0x140
[ 2555.833103][ C3] rt_dst_alloc+0x31/0x3a0
[ 2555.833280][ C3] __mkroute_output+0x425/0x11a0
[ 2555.833454][ C3] ip_route_output_key_hash+0xfa/0x220
[ 2555.833630][ C3] ip_route_output_flow+0x23/0x140
[ 2555.833814][ C3] udp_tunnel_dst_lookup+0x227/0x3a0
[ 2555.833989][ C3] vxlan_xmit_one+0x151a/0x4490 [vxlan]
[ 2555.834181][ C3] vxlan_xmit+0xf6a/0x1870 [vxlan]
[ 2555.834367][ C3] dev_hard_start_xmit+0x132/0x530
[ 2555.834542][ C3] __dev_queue_xmit+0x1406/0x1af0
[ 2555.834716][ C3] packet_snd+0xd0f/0x1a70
[ 2555.834895][ C3] __sys_sendto+0x24b/0x380
[ 2555.835074][ C3] __x64_sys_sendto+0xe0/0x1b0
[ 2555.835250][ C3] do_syscall_64+0xc1/0xfc0
[ 2555.835426][ C3] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2555.835648][ C3]
[ 2555.835740][ C3] Freed by task 12:
[ 2555.835873][ C3] kasan_save_stack+0x24/0x40
[ 2555.836053][ C3] kasan_save_track+0x14/0x30
[ 2555.836238][ C3] __kasan_save_free_info+0x3b/0x60
[ 2555.836418][ C3] __kasan_slab_free+0x3f/0x60
[ 2555.836600][ C3] kmem_cache_free+0x2e4/0x690
[ 2555.836776][ C3] dst_destroy+0x230/0x350
[ 2555.836953][ C3] rcu_do_batch+0x27e/0x1120
[ 2555.837130][ C3] rcu_core+0x2bb/0x520
[ 2555.837266][ C3] handle_softirqs+0x1c0/0x820
[ 2555.837444][ C3] __irq_exit_rcu+0x6c/0xe0
[ 2555.837620][ C3] irq_exit_rcu+0xe/0x30
[ 2555.837756][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 2555.837933][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 2555.838152][ C3]
[ 2555.838241][ C3] Last potentially related work creation:
[ 2555.838423][ C3] kasan_save_stack+0x24/0x40
[ 2555.838605][ C3] kasan_record_aux_stack+0x8c/0xa0
[ 2555.838785][ C3] __call_rcu_common.constprop.0+0xa9/0x950
[ 2555.839010][ C3] dst_cache_destroy+0xf7/0x200
[ 2555.839192][ C3] vxlan_fdb_free+0x10e/0x1b0 [vxlan]
[ 2555.839378][ C3] rcu_do_batch+0x27e/0x1120
[ 2555.839557][ C3] rcu_core+0x2bb/0x520
[ 2555.839693][ C3] handle_softirqs+0x1c0/0x820
[ 2555.839871][ C3] __irq_exit_rcu+0x6c/0xe0
[ 2555.840048][ C3] irq_exit_rcu+0xe/0x30
[ 2555.840185][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 2555.840367][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 2555.840589][ C3]
[ 2555.840681][ C3] The buggy address belongs to the object at ffff88800c984340
[ 2555.840681][ C3] which belongs to the cache rtable of size 184
[ 2555.841114][ C3] The buggy address is located 0 bytes inside of
[ 2555.841114][ C3] freed 184-byte region [ffff88800c984340, ffff88800c9843f8)
[ 2555.841549][ C3]
[ 2555.841639][ C3] The buggy address belongs to the physical page:
[ 2555.841858][ C3] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800c984040 pfn:0xc984
[ 2555.842220][ C3] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 2555.842494][ C3] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 2555.842729][ C3] page_type: f5(slab)
[ 2555.842870][ C3] raw: 0080000000000240 ffff888004a4de00 ffff8880026ab708 ffff8880026ab708
[ 2555.843193][ C3] raw: ffff88800c984040 0000000000150001 00000000f5000000 0000000000000000
[ 2555.843515][ C3] head: 0080000000000240 ffff888004a4de00 ffff8880026ab708 ffff8880026ab708
[ 2555.843835][ C3] head: ffff88800c984040 0000000000150001 00000000f5000000 0000000000000000
[ 2555.844159][ C3] head: 0080000000000001 ffffea0000326101 00000000ffffffff 00000000ffffffff
[ 2555.844603][ C3] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 2555.844921][ C3] page dumped because: kasan: bad access detected
[ 2555.845153][ C3]
[ 2555.845243][ C3] Memory state around the buggy address:
[ 2555.845525][ C3] ffff88800c984200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 2555.845790][ C3] ffff88800c984280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2555.846053][ C3] >ffff88800c984300: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 2555.846426][ C3] ^
[ 2555.846654][ C3] ffff88800c984380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 2555.846921][ C3] ffff88800c984400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2555.847286][ C3] ==================================================================
[ 2555.847554][ C3] Disabling lock debugging due to kernel taint
[ 2555.847895][ C3] Oops: general protection fault, probably for non-canonical address 0xe083fc3840000008: 0000 [#1] SMP KASAN
[ 2555.848277][ C3] KASAN: maybe wild-memory-access in range [0x042001c200000040-0x042001c200000047]
[ 2555.848662][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G B 6.18.0-virtme #1 PREEMPT(full)
[ 2555.849009][ C3] Tainted: [B]=BAD_PAGE
[ 2555.849142][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2555.849466][ C3] RIP: 0010:dst_dev_put+0xa0/0x280
[ 2555.849749][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
[ 2555.850472][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010203
[ 2555.850695][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff8728b398
[ 2555.850957][ C3] RDX: 0084003840000008 RSI: 0000000000000008 RDI: 042001c200000044
[ 2555.851319][ C3] RBP: 042001c20000000c R08: 0000000000000001 R09: fffffbfff14aa8c4
[ 2555.851573][ C3] R10: ffffffff8a554627 R11: ffffc90000270800 R12: ffff88800a7e3ad8
[ 2555.851836][ C3] R13: ffff88800c984340 R14: 0000000000000003 R15: ffff88800c984340
[ 2555.852297][ C3] FS: 0000000000000000(0000) GS:ffff8880dc898000(0000) knlGS:0000000000000000
[ 2555.852597][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2555.852920][ C3] CR2: 00007fd699c21000 CR3: 0000000078b45004 CR4: 0000000000772ef0
[ 2555.853286][ C3] PKRU: 55555554
[ 2555.853421][ C3] Call Trace:
[ 2555.853550][ C3]
[ 2555.853641][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170
[ 2555.853818][ C3] fib_nh_common_release+0xe6/0x2d0
[ 2555.853989][ C3] free_fib_info_rcu+0x14c/0x380
[ 2555.854160][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0
[ 2555.854475][ C3] rcu_do_batch+0x27e/0x1120
[ 2555.854754][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 2555.855034][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70
[ 2555.855354][ C3] ? lockdep_hardirqs_on+0x7c/0x100
[ 2555.855529][ C3] ? _raw_spin_unlock_irqrestore+0x46/0x70
[ 2555.855849][ C3] rcu_core+0x2bb/0x520
[ 2555.855980][ C3] handle_softirqs+0x1c0/0x820
[ 2555.856153][ C3] __irq_exit_rcu+0x6c/0xe0
[ 2555.856322][ C3] irq_exit_rcu+0xe/0x30
[ 2555.856455][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 2555.856638][ C3]
[ 2555.856727][ C3]
[ 2555.856814][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 2555.857028][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 2555.857209][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
[ 2555.857939][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000202
[ 2555.858159][ C3] RAX: 0000000002feee73 RBX: 1ffff9200002afbf RCX: ffffffff87c0a255
[ 2555.858523][ C3] RDX: 0000000000000000 RSI: ffffffff885fa925 RDI: ffffffff8806a600
[ 2555.858885][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cdb631a
[ 2555.859147][ C3] R10: ffff888066db18d3 R11: ffff888001ae5090 R12: 0000000000000000
[ 2555.859504][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000
[ 2555.859759][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150
[ 2555.860074][ C3] default_idle+0x9/0x10
[ 2555.860203][ C3] default_idle_call+0x6c/0xa0
[ 2555.860477][ C3] cpuidle_idle_call+0x23b/0x380
[ 2555.860651][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 2555.860820][ C3] ? tsc_verify_tsc_adjust+0x94/0x310
[ 2555.860995][ C3] do_idle+0xe1/0x140
[ 2555.861229][ C3] cpu_startup_entry+0x54/0x60
[ 2555.861396][ C3] start_secondary+0x1fd/0x290
[ 2555.861567][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10
[ 2555.861738][ C3] common_startup_64+0x13e/0x148
[ 2555.862020][ C3]
[ 2555.862147][ C3] Modules linked in: vxlan act_gact cls_flower cls_bpf sch_ingress netdevsim psample ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables
[ 2555.862694][ C3] ---[ end trace 0000000000000000 ]---
[ 2555.862876][ C3] RIP: 0010:dst_dev_put+0xa0/0x280
[ 2555.863053][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
[ 2555.863882][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010203
[ 2555.864098][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff8728b398
[ 2555.864351][ C3] RDX: 0084003840000008 RSI: 0000000000000008 RDI: 042001c200000044
[ 2555.864610][ C3] RBP: 042001c20000000c R08: 0000000000000001 R09: fffffbfff14aa8c4
[ 2555.864971][ C3] R10: ffffffff8a554627 R11: ffffc90000270800 R12: ffff88800a7e3ad8
[ 2555.865225][ C3] R13: ffff88800c984340 R14: 0000000000000003 R15: ffff88800c984340
[ 2555.865581][ C3] FS: 0000000000000000(0000) GS:ffff8880dc898000(0000) knlGS:0000000000000000
[ 2555.865887][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2555.866207][ C3] CR2: 00007fd699c21000 CR3: 0000000078b45004 CR4: 0000000000772ef0
[ 2555.866460][ C3] PKRU: 55555554
[ 2555.866598][ C3] Kernel panic - not syncing: Fatal exception in interrupt
[ 2555.867255][ C3] Kernel Offset: 0x4200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 2555.867646][ C3] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr