[ 4245.172808][T26744] GACT probability NOT on [ 4253.080800][ C0] ================================================================== [ 4253.081258][ C0] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280 [ 4253.081615][ C0] Read of size 8 at addr ffff88800ca66f40 by task swapper/0/0 [ 4253.081937][ C0] [ 4253.082052][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 4253.082057][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 4253.082059][ C0] Call Trace: [ 4253.082062][ C0] [ 4253.082064][ C0] dump_stack_lvl+0x82/0xc0 [ 4253.082072][ C0] print_address_description.constprop.0+0x2c/0x3a0 [ 4253.082080][ C0] ? dst_dev_put+0x214/0x280 [ 4253.082084][ C0] print_report+0xb4/0x270 [ 4253.082088][ C0] ? dst_dev_put+0x214/0x280 [ 4253.082091][ C0] ? kasan_addr_to_slab+0x1d/0x50 [ 4253.082094][ C0] ? dst_dev_put+0x214/0x280 [ 4253.082097][ C0] kasan_report+0xca/0x100 [ 4253.082102][ C0] ? dst_dev_put+0x214/0x280 [ 4253.082107][ C0] dst_dev_put+0x214/0x280 [ 4253.082110][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 4253.082118][ C0] fib_nh_common_release+0xe6/0x2d0 [ 4253.082122][ C0] free_fib_info_rcu+0x14c/0x380 [ 4253.082126][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 4253.082130][ C0] rcu_do_batch+0x27e/0x1120 [ 4253.082136][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 4253.082140][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 4253.082147][ C0] ? lockdep_hardirqs_on+0x7c/0x100 [ 4253.082152][ C0] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 4253.082158][ C0] rcu_core+0x2bb/0x520 [ 4253.082162][ C0] handle_softirqs+0x1c0/0x820 [ 4253.082171][ C0] __irq_exit_rcu+0x6c/0xe0 [ 4253.082173][ C0] irq_exit_rcu+0xe/0x30 [ 4253.082176][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 4253.082180][ C0] [ 4253.082182][ C0] [ 4253.082184][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 4253.082188][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 4253.082193][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 4253.082197][ C0] RSP: 0018:ffffffffb6207de8 EFLAGS: 00000202 [ 4253.082201][ C0] RAX: 0000000004658f5b RBX: 1ffffffff6c40fc1 RCX: ffffffffb500a255 [ 4253.082203][ C0] RDX: 0000000000000000 RSI: ffffffffb59fa925 RDI: ffffffffb546a600 [ 4253.082205][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da0631a [ 4253.082206][ C0] R10: ffff88806d0318d3 R11: ffffffffb6232e50 R12: 0000000000000000 [ 4253.082208][ C0] R13: ffffffffb6232400 R14: dffffc0000000000 R15: 0000000000014770 [ 4253.082212][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 4253.082216][ C0] default_idle+0x9/0x10 [ 4253.082218][ C0] default_idle_call+0x6c/0xa0 [ 4253.082221][ C0] cpuidle_idle_call+0x23b/0x380 [ 4253.082225][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 4253.082229][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 4253.082235][ C0] do_idle+0xe1/0x140 [ 4253.082238][ C0] cpu_startup_entry+0x54/0x60 [ 4253.082241][ C0] rest_init+0x14b/0x260 [ 4253.082244][ C0] start_kernel+0x348/0x3f0 [ 4253.082253][ C0] x86_64_start_reservations+0x18/0x30 [ 4253.082257][ C0] x86_64_start_kernel+0xf8/0x150 [ 4253.082260][ C0] common_startup_64+0x13e/0x148 [ 4253.082271][ C0] [ 4253.082272][ C0] [ 4253.094016][ C0] Allocated by task 26854: [ 4253.094224][ C0] kasan_save_stack+0x24/0x40 [ 4253.094434][ C0] kasan_save_track+0x14/0x30 [ 4253.094640][ C0] __kasan_slab_alloc+0x55/0x60 [ 4253.094853][ C0] kmem_cache_alloc_noprof+0x291/0x6d0 [ 4253.095065][ C0] dst_alloc+0x7a/0x140 [ 4253.095221][ C0] rt_dst_alloc+0x31/0x3a0 [ 4253.095429][ C0] __mkroute_output+0x425/0x11a0 [ 4253.095630][ C0] ip_route_output_key_hash+0xfa/0x220 [ 4253.095845][ C0] ip_route_output_flow+0x23/0x140 [ 4253.096047][ C0] udp_tunnel_dst_lookup+0x227/0x3a0 [ 4253.096259][ C0] vxlan_xmit_one+0x151a/0x4490 [vxlan] [ 4253.096474][ C0] vxlan_xmit+0xf6a/0x1870 [vxlan] [ 4253.096697][ C0] dev_hard_start_xmit+0x132/0x530 [ 4253.096901][ C0] __dev_queue_xmit+0x1406/0x1af0 [ 4253.097106][ C0] packet_snd+0xd0f/0x1a70 [ 4253.097312][ C0] __sys_sendto+0x24b/0x380 [ 4253.097518][ C0] __x64_sys_sendto+0xe0/0x1b0 [ 4253.097735][ C0] do_syscall_64+0xc1/0xfc0 [ 4253.097942][ C0] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 4253.098198][ C0] [ 4253.098303][ C0] Freed by task 12: [ 4253.098457][ C0] kasan_save_stack+0x24/0x40 [ 4253.098672][ C0] kasan_save_track+0x14/0x30 [ 4253.098874][ C0] __kasan_save_free_info+0x3b/0x60 [ 4253.099077][ C0] __kasan_slab_free+0x3f/0x60 [ 4253.099285][ C0] kmem_cache_free+0x2e4/0x690 [ 4253.099492][ C0] dst_destroy+0x230/0x350 [ 4253.099708][ C0] rcu_do_batch+0x27e/0x1120 [ 4253.099913][ C0] rcu_core+0x2bb/0x520 [ 4253.100068][ C0] handle_softirqs+0x1c0/0x820 [ 4253.100275][ C0] do_softirq+0xad/0xe0 [ 4253.100432][ C0] __local_bh_enable_ip+0x101/0x120 [ 4253.100635][ C0] addrconf_ifdown.isra.0+0x5c2/0x15b0 [ 4253.100853][ C0] addrconf_notify+0xd1/0xd20 [ 4253.101059][ C0] notifier_call_chain+0x9a/0x290 [ 4253.101268][ C0] netif_close_many+0x2d7/0x650 [ 4253.101475][ C0] unregister_netdevice_many_notify+0x4ee/0x2080 [ 4253.101742][ C0] ops_undo_list+0x70f/0x890 [ 4253.101953][ C0] cleanup_net+0x3b2/0x8e0 [ 4253.102164][ C0] process_one_work+0x880/0x1810 [ 4253.102373][ C0] worker_thread+0x591/0xcf0 [ 4253.102585][ C0] kthread+0x37b/0x5f0 [ 4253.102755][ C0] ret_from_fork+0x42f/0x540 [ 4253.102965][ C0] ret_from_fork_asm+0x11/0x20 [ 4253.103173][ C0] [ 4253.103280][ C0] Last potentially related work creation: [ 4253.103493][ C0] kasan_save_stack+0x24/0x40 [ 4253.103716][ C0] kasan_record_aux_stack+0x8c/0xa0 [ 4253.103925][ C0] __call_rcu_common.constprop.0+0xa9/0x950 [ 4253.104189][ C0] dst_cache_destroy+0xf7/0x200 [ 4253.104398][ C0] vxlan_fdb_free+0x10e/0x1b0 [vxlan] [ 4253.104620][ C0] rcu_do_batch+0x27e/0x1120 [ 4253.104836][ C0] rcu_core+0x2bb/0x520 [ 4253.104998][ C0] handle_softirqs+0x1c0/0x820 [ 4253.105217][ C0] __irq_exit_rcu+0x6c/0xe0 [ 4253.105427][ C0] irq_exit_rcu+0xe/0x30 [ 4253.105586][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 4253.105811][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 4253.106068][ C0] [ 4253.106178][ C0] The buggy address belongs to the object at ffff88800ca66f40 [ 4253.106178][ C0] which belongs to the cache rtable of size 184 [ 4253.106692][ C0] The buggy address is located 0 bytes inside of [ 4253.106692][ C0] freed 184-byte region [ffff88800ca66f40, ffff88800ca66ff8) [ 4253.107209][ C0] [ 4253.107314][ C0] The buggy address belongs to the physical page: [ 4253.107570][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800ca66340 pfn:0xca66 [ 4253.108009][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 4253.108326][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 4253.108599][ C0] page_type: f5(slab) [ 4253.108773][ C0] raw: 0080000000000240 ffff888004e1be00 ffffea00002fe010 ffff8880025f7708 [ 4253.109152][ C0] raw: ffff88800ca66340 0000000000150005 00000000f5000000 0000000000000000 [ 4253.109522][ C0] head: 0080000000000240 ffff888004e1be00 ffffea00002fe010 ffff8880025f7708 [ 4253.109913][ C0] head: ffff88800ca66340 0000000000150005 00000000f5000000 0000000000000000 [ 4253.110289][ C0] head: 0080000000000001 ffffea0000329981 00000000ffffffff 00000000ffffffff [ 4253.110662][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 4253.111034][ C0] page dumped because: kasan: bad access detected [ 4253.111292][ C0] [ 4253.111398][ C0] Memory state around the buggy address: [ 4253.111605][ C0] ffff88800ca66e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 4253.111926][ C0] ffff88800ca66e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4253.112232][ C0] >ffff88800ca66f00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 4253.112536][ C0] ^ [ 4253.112798][ C0] ffff88800ca66f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 4253.113110][ C0] ffff88800ca67000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 4253.113415][ C0] ================================================================== [ 4253.113738][ C0] Disabling lock debugging due to kernel taint [ 4253.114010][ C0] Oops: general protection fault, probably for non-canonical address 0xe00fbc8d20000008: 0000 [#1] SMP KASAN [ 4253.114458][ C0] KASAN: maybe wild-memory-access in range [0x007e046900000040-0x007e046900000047] [ 4253.114818][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 4253.115229][ C0] Tainted: [B]=BAD_PAGE [ 4253.115387][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 4253.115649][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 4253.115868][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 4253.116577][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010203 [ 4253.116846][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffb468b398 [ 4253.117157][ C0] RDX: 000fc08d20000008 RSI: 0000000000000008 RDI: 007e046900000044 [ 4253.117461][ C0] RBP: 007e04690000000c R08: 0000000000000001 R09: fffffbfff6f2a8c4 [ 4253.117765][ C0] R10: ffffffffb7954627 R11: ffffc90000007800 R12: ffff88800cc50c38 [ 4253.118066][ C0] R13: ffff88800ca66f40 R14: 0000000000000001 R15: ffff88800ca66f40 [ 4253.118373][ C0] FS: 0000000000000000(0000) GS:ffff8880b5718000(0000) knlGS:0000000000000000 [ 4253.118734][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4253.118984][ C0] CR2: 00007f1d97265000 CR3: 0000000066545002 CR4: 0000000000772ef0 [ 4253.119287][ C0] PKRU: 55555554 [ 4253.119447][ C0] Call Trace: [ 4253.119599][ C0] [ 4253.119716][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 4253.119927][ C0] fib_nh_common_release+0xe6/0x2d0 [ 4253.120128][ C0] free_fib_info_rcu+0x14c/0x380 [ 4253.120329][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 4253.120583][ C0] rcu_do_batch+0x27e/0x1120 [ 4253.120799][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 4253.121003][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 4253.121255][ C0] ? lockdep_hardirqs_on+0x7c/0x100 [ 4253.121461][ C0] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 4253.121716][ C0] rcu_core+0x2bb/0x520 [ 4253.121872][ C0] handle_softirqs+0x1c0/0x820 [ 4253.122074][ C0] __irq_exit_rcu+0x6c/0xe0 [ 4253.122274][ C0] irq_exit_rcu+0xe/0x30 [ 4253.122429][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 4253.122633][ C0] [ 4253.122752][ C0] [ 4253.122854][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 4253.123104][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 4253.123315][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 4253.124034][ C0] RSP: 0018:ffffffffb6207de8 EFLAGS: 00000202 [ 4253.124290][ C0] RAX: 0000000004658f5b RBX: 1ffffffff6c40fc1 RCX: ffffffffb500a255 [ 4253.124596][ C0] RDX: 0000000000000000 RSI: ffffffffb59fa925 RDI: ffffffffb546a600 [ 4253.124913][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100da0631a [ 4253.125231][ C0] R10: ffff88806d0318d3 R11: ffffffffb6232e50 R12: 0000000000000000 [ 4253.125536][ C0] R13: ffffffffb6232400 R14: dffffc0000000000 R15: 0000000000014770 [ 4253.125849][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 4253.126101][ C0] default_idle+0x9/0x10 [ 4253.126253][ C0] default_idle_call+0x6c/0xa0 [ 4253.126461][ C0] cpuidle_idle_call+0x23b/0x380 [ 4253.126668][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 4253.126868][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 4253.127071][ C0] do_idle+0xe1/0x140 [ 4253.127222][ C0] cpu_startup_entry+0x54/0x60 [ 4253.127421][ C0] rest_init+0x14b/0x260 [ 4253.127575][ C0] start_kernel+0x348/0x3f0 [ 4253.127792][ C0] x86_64_start_reservations+0x18/0x30 [ 4253.127995][ C0] x86_64_start_kernel+0xf8/0x150 [ 4253.128192][ C0] common_startup_64+0x13e/0x148 [ 4253.128396][ C0] [ 4253.128545][ C0] Modules linked in: act_gact netdevsim psample ipt_rpfilter pktgen xt_conntrack vxcan can_dev xfrm_interface ip6_gre ip_gre gre macsec ipvlan nft_chain_nat xt_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 vxlan cls_flower sch_prio xt_mark sch_ingress act_mirred cls_basic sch_fq_codel xfrm_user xt_policy xt_HL nft_compat nf_tables amt [ 4253.129874][ C0] ---[ end trace 0000000000000000 ]--- [ 4253.130206][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 4253.130417][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 4253.131130][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010203 [ 4253.131384][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffffb468b398 [ 4253.131804][ C0] RDX: 000fc08d20000008 RSI: 0000000000000008 RDI: 007e046900000044 [ 4253.132097][ C0] RBP: 007e04690000000c R08: 0000000000000001 R09: fffffbfff6f2a8c4 [ 4253.132633][ C0] R10: ffffffffb7954627 R11: ffffc90000007800 R12: ffff88800cc50c38 [ 4253.132941][ C0] R13: ffff88800ca66f40 R14: 0000000000000001 R15: ffff88800ca66f40 [ 4253.133247][ C0] FS: 0000000000000000(0000) GS:ffff8880b5718000(0000) knlGS:0000000000000000 [ 4253.133597][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4253.133866][ C0] CR2: 00007f1d97265000 CR3: 0000000066545002 CR4: 0000000000772ef0 [ 4253.134295][ C0] PKRU: 55555554 [ 4253.134561][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 4253.134951][ C0] Kernel Offset: 0x31600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 4253.135536][ C0] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr