[ 2840.453888][T24837] GACT probability NOT on [ 2843.585423][ C3] ================================================================== [ 2843.585751][ C3] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280 [ 2843.586040][ C3] Read of size 8 at addr ffff88800e703b40 by task swapper/3/0 [ 2843.586317][ C3] [ 2843.586415][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 2843.586420][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2843.586423][ C3] Call Trace: [ 2843.586425][ C3] [ 2843.586428][ C3] dump_stack_lvl+0x82/0xc0 [ 2843.586436][ C3] print_address_description.constprop.0+0x2c/0x3a0 [ 2843.586444][ C3] ? dst_dev_put+0x214/0x280 [ 2843.586448][ C3] print_report+0xb4/0x270 [ 2843.586452][ C3] ? dst_dev_put+0x214/0x280 [ 2843.586454][ C3] ? kasan_addr_to_slab+0x1d/0x50 [ 2843.586459][ C3] ? dst_dev_put+0x214/0x280 [ 2843.586461][ C3] kasan_report+0xca/0x100 [ 2843.586466][ C3] ? dst_dev_put+0x214/0x280 [ 2843.586471][ C3] dst_dev_put+0x214/0x280 [ 2843.586474][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2843.586482][ C3] fib_nh_common_release+0xe6/0x2d0 [ 2843.586486][ C3] free_fib_info_rcu+0x14c/0x380 [ 2843.586490][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2843.586493][ C3] rcu_do_batch+0x27e/0x1120 [ 2843.586500][ C3] ? trace_rcu_batch_end+0x270/0x270 [ 2843.586503][ C3] ? __lock_release+0x5d/0x160 [ 2843.586509][ C3] ? rcu_is_watching+0x12/0xb0 [ 2843.586514][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2843.586522][ C3] rcu_core+0x2bb/0x520 [ 2843.586526][ C3] handle_softirqs+0x1c0/0x820 [ 2843.586536][ C3] __irq_exit_rcu+0x6c/0xe0 [ 2843.586538][ C3] irq_exit_rcu+0xe/0x30 [ 2843.586541][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2843.586548][ C3] [ 2843.586549][ C3] [ 2843.586551][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2843.586555][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2843.586560][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2843.586563][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000206 [ 2843.586568][ C3] RAX: 0000000003d3684d RBX: 1ffff9200002afbf RCX: ffffffff9f20a255 [ 2843.586570][ C3] RDX: 0000000000000000 RSI: ffffffff9fbfa925 RDI: ffffffff9f66a600 [ 2843.586572][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da3631a [ 2843.586574][ C3] R10: ffff88806d1b18d3 R11: ffff888001ae5090 R12: 0000000000000000 [ 2843.586576][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000 [ 2843.586580][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2843.586585][ C3] default_idle+0x9/0x10 [ 2843.586587][ C3] default_idle_call+0x6c/0xa0 [ 2843.586589][ C3] cpuidle_idle_call+0x23b/0x380 [ 2843.586594][ C3] ? arch_cpu_idle_exit+0x40/0x40 [ 2843.586598][ C3] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2843.586603][ C3] do_idle+0xe1/0x140 [ 2843.586607][ C3] cpu_startup_entry+0x54/0x60 [ 2843.586609][ C3] start_secondary+0x1fd/0x290 [ 2843.586612][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10 [ 2843.586617][ C3] common_startup_64+0x13e/0x148 [ 2843.586625][ C3] [ 2843.586627][ C3] [ 2843.597065][ C3] Allocated by task 24846: [ 2843.597253][ C3] kasan_save_stack+0x24/0x40 [ 2843.597447][ C3] kasan_save_track+0x14/0x30 [ 2843.597633][ C3] __kasan_slab_alloc+0x55/0x60 [ 2843.597826][ C3] kmem_cache_alloc_noprof+0x291/0x6d0 [ 2843.598011][ C3] dst_alloc+0x7a/0x140 [ 2843.598153][ C3] rt_dst_alloc+0x31/0x3a0 [ 2843.598342][ C3] __mkroute_output+0x425/0x11a0 [ 2843.598531][ C3] ip_route_output_key_hash+0xfa/0x220 [ 2843.598723][ C3] ip_route_output_flow+0x23/0x140 [ 2843.598922][ C3] udp_tunnel_dst_lookup+0x227/0x3a0 [ 2843.599112][ C3] vxlan_xmit_one+0x151a/0x4490 [vxlan] [ 2843.599313][ C3] vxlan_xmit+0xf6a/0x1870 [vxlan] [ 2843.599510][ C3] dev_hard_start_xmit+0x132/0x530 [ 2843.599697][ C3] __dev_queue_xmit+0x1406/0x1af0 [ 2843.599884][ C3] packet_snd+0xd0f/0x1a70 [ 2843.600075][ C3] __sys_sendto+0x24b/0x380 [ 2843.600263][ C3] __x64_sys_sendto+0xe0/0x1b0 [ 2843.600456][ C3] do_syscall_64+0xc1/0xfc0 [ 2843.600643][ C3] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 2843.600897][ C3] [ 2843.600993][ C3] Freed by task 12: [ 2843.601137][ C3] kasan_save_stack+0x24/0x40 [ 2843.601325][ C3] kasan_save_track+0x14/0x30 [ 2843.601512][ C3] __kasan_save_free_info+0x3b/0x60 [ 2843.601699][ C3] __kasan_slab_free+0x3f/0x60 [ 2843.601891][ C3] kmem_cache_free+0x2e4/0x690 [ 2843.602080][ C3] dst_destroy+0x230/0x350 [ 2843.602269][ C3] rcu_do_batch+0x27e/0x1120 [ 2843.602455][ C3] rcu_core+0x2bb/0x520 [ 2843.602596][ C3] handle_softirqs+0x1c0/0x820 [ 2843.602785][ C3] __irq_exit_rcu+0x6c/0xe0 [ 2843.602975][ C3] irq_exit_rcu+0xe/0x30 [ 2843.603119][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2843.603310][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2843.603546][ C3] [ 2843.603643][ C3] Last potentially related work creation: [ 2843.603835][ C3] kasan_save_stack+0x24/0x40 [ 2843.604024][ C3] kasan_record_aux_stack+0x8c/0xa0 [ 2843.604218][ C3] __call_rcu_common.constprop.0+0xa9/0x950 [ 2843.604454][ C3] dst_cache_destroy+0xf7/0x200 [ 2843.604652][ C3] vxlan_fdb_free+0x10e/0x1b0 [vxlan] [ 2843.604853][ C3] rcu_do_batch+0x27e/0x1120 [ 2843.605043][ C3] rcu_core+0x2bb/0x520 [ 2843.605192][ C3] handle_softirqs+0x1c0/0x820 [ 2843.605381][ C3] __irq_exit_rcu+0x6c/0xe0 [ 2843.605571][ C3] irq_exit_rcu+0xe/0x30 [ 2843.605715][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2843.605905][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2843.606140][ C3] [ 2843.606241][ C3] The buggy address belongs to the object at ffff88800e703b40 [ 2843.606241][ C3] which belongs to the cache rtable of size 184 [ 2843.606701][ C3] The buggy address is located 0 bytes inside of [ 2843.606701][ C3] freed 184-byte region [ffff88800e703b40, ffff88800e703bf8) [ 2843.607159][ C3] [ 2843.607264][ C3] The buggy address belongs to the physical page: [ 2843.607496][ C3] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800e703540 pfn:0xe702 [ 2843.608004][ C3] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2843.608294][ C3] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 2843.608539][ C3] page_type: f5(slab) [ 2843.608698][ C3] raw: 0080000000000240 ffff888004cebe00 ffffea00004aeb10 ffff888002663708 [ 2843.609049][ C3] raw: ffff88800e703540 0000000000150003 00000000f5000000 0000000000000000 [ 2843.609394][ C3] head: 0080000000000240 ffff888004cebe00 ffffea00004aeb10 ffff888002663708 [ 2843.609737][ C3] head: ffff88800e703540 0000000000150003 00000000f5000000 0000000000000000 [ 2843.610205][ C3] head: 0080000000000001 ffffea000039c081 00000000ffffffff 00000000ffffffff [ 2843.610557][ C3] head: ffff888000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2843.611006][ C3] page dumped because: kasan: bad access detected [ 2843.611252][ C3] [ 2843.611346][ C3] Memory state around the buggy address: [ 2843.611534][ C3] ffff88800e703a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2843.611811][ C3] ffff88800e703a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2843.612096][ C3] >ffff88800e703b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2843.612373][ C3] ^ [ 2843.612706][ C3] ffff88800e703b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2843.613091][ C3] ffff88800e703c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2843.613371][ C3] ================================================================== [ 2843.613658][ C3] Disabling lock debugging due to kernel taint [ 2843.613910][ C3] Oops: general protection fault, probably for non-canonical address 0xe067fc3740000008: 0000 [#1] SMP KASAN [ 2843.614417][ C3] KASAN: maybe wild-memory-access in range [0x034001ba00000040-0x034001ba00000047] [ 2843.614742][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 2843.615105][ C3] Tainted: [B]=BAD_PAGE [ 2843.615246][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2843.615476][ C3] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2843.615670][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2843.616429][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010203 [ 2843.616664][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9e88b398 [ 2843.616941][ C3] RDX: 0068003740000008 RSI: 0000000000000008 RDI: 034001ba00000044 [ 2843.617318][ C3] RBP: 034001ba0000000c R08: 0000000000000001 R09: fffffbfff436a8c4 [ 2843.617692][ C3] R10: ffffffffa1b54627 R11: ffffc90000270800 R12: ffff88800e7039c0 [ 2843.617968][ C3] R13: ffff88800e703b40 R14: 0000000000000002 R15: ffff88800e703b40 [ 2843.618253][ C3] FS: 0000000000000000(0000) GS:ffff8880cb698000(0000) knlGS:0000000000000000 [ 2843.618781][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2843.619023][ C3] CR2: 00007f9869648800 CR3: 000000005e745006 CR4: 0000000000772ef0 [ 2843.619303][ C3] PKRU: 55555554 [ 2843.619441][ C3] Call Trace: [ 2843.619581][ C3] [ 2843.619779][ C3] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2843.619974][ C3] fib_nh_common_release+0xe6/0x2d0 [ 2843.620156][ C3] free_fib_info_rcu+0x14c/0x380 [ 2843.620348][ C3] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2843.620582][ C3] rcu_do_batch+0x27e/0x1120 [ 2843.620769][ C3] ? trace_rcu_batch_end+0x270/0x270 [ 2843.620967][ C3] ? __lock_release+0x5d/0x160 [ 2843.621264][ C3] ? rcu_is_watching+0x12/0xb0 [ 2843.621446][ C3] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2843.621675][ C3] rcu_core+0x2bb/0x520 [ 2843.621814][ C3] handle_softirqs+0x1c0/0x820 [ 2843.622116][ C3] __irq_exit_rcu+0x6c/0xe0 [ 2843.622301][ C3] irq_exit_rcu+0xe/0x30 [ 2843.622437][ C3] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2843.622627][ C3] [ 2843.622722][ C3] [ 2843.622917][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2843.623144][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2843.623354][ C3] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2843.624007][ C3] RSP: 0018:ffffc90000157dd8 EFLAGS: 00000206 [ 2843.624247][ C3] RAX: 0000000003d3684d RBX: 1ffff9200002afbf RCX: ffffffff9f20a255 [ 2843.624731][ C3] RDX: 0000000000000000 RSI: ffffffff9fbfa925 RDI: ffffffff9f66a600 [ 2843.624997][ C3] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da3631a [ 2843.625382][ C3] R10: ffff88806d1b18d3 R11: ffff888001ae5090 R12: 0000000000000000 [ 2843.625765][ C3] R13: ffff888001ae4640 R14: dffffc0000000000 R15: 0000000000000000 [ 2843.626055][ C3] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2843.626287][ C3] default_idle+0x9/0x10 [ 2843.626420][ C3] default_idle_call+0x6c/0xa0 [ 2843.626610][ C3] cpuidle_idle_call+0x23b/0x380 [ 2843.626795][ C3] ? arch_cpu_idle_exit+0x40/0x40 [ 2843.626981][ C3] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2843.627169][ C3] do_idle+0xe1/0x140 [ 2843.627310][ C3] cpu_startup_entry+0x54/0x60 [ 2843.627496][ C3] start_secondary+0x1fd/0x290 [ 2843.627693][ C3] ? set_cpu_sibling_map+0x1e10/0x1e10 [ 2843.627875][ C3] common_startup_64+0x13e/0x148 [ 2843.628064][ C3] [ 2843.628200][ C3] Modules linked in: act_gact sch_ingress xfrm_user openvswitch psample nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nsh geneve vxlan act_csum act_pedit cls_flower sch_prio [ 2843.628822][ C3] ---[ end trace 0000000000000000 ]--- [ 2843.629011][ C3] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2843.629308][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2843.630077][ C3] RSP: 0018:ffffc90000270d48 EFLAGS: 00010203 [ 2843.630413][ C3] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9e88b398 [ 2843.630686][ C3] RDX: 0068003740000008 RSI: 0000000000000008 RDI: 034001ba00000044 [ 2843.631174][ C3] RBP: 034001ba0000000c R08: 0000000000000001 R09: fffffbfff436a8c4 [ 2843.631452][ C3] R10: ffffffffa1b54627 R11: ffffc90000270800 R12: ffff88800e7039c0 [ 2843.631724][ C3] R13: ffff88800e703b40 R14: 0000000000000002 R15: ffff88800e703b40 [ 2843.632103][ C3] FS: 0000000000000000(0000) GS:ffff8880cb698000(0000) knlGS:0000000000000000 [ 2843.632417][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2843.632644][ C3] CR2: 00007f9869648800 CR3: 000000005e745006 CR4: 0000000000772ef0 [ 2843.632921][ C3] PKRU: 55555554 [ 2843.633070][ C3] Kernel panic - not syncing: Fatal exception in interrupt [ 2843.633413][ C3] Kernel Offset: 0x1b800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 2843.633938][ C3] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr