[ 2529.718889][T16500] GACT probability NOT on [ 2532.198417][T16538] ip (16538) used greatest stack depth: 23728 bytes left [ 2537.122762][ C0] ================================================================== [ 2537.123163][ C0] BUG: KASAN: slab-use-after-free in dst_dev_put+0x214/0x280 [ 2537.123460][ C0] Read of size 8 at addr ffff88800e17c1c0 by task swapper/0/0 [ 2537.123743][ C0] [ 2537.123842][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 2537.123846][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2537.123849][ C0] Call Trace: [ 2537.123851][ C0] [ 2537.123852][ C0] dump_stack_lvl+0x82/0xc0 [ 2537.123858][ C0] print_address_description.constprop.0+0x2c/0x3a0 [ 2537.123865][ C0] ? dst_dev_put+0x214/0x280 [ 2537.123869][ C0] print_report+0xb4/0x270 [ 2537.123872][ C0] ? dst_dev_put+0x214/0x280 [ 2537.123875][ C0] ? kasan_addr_to_slab+0x1d/0x50 [ 2537.123879][ C0] ? dst_dev_put+0x214/0x280 [ 2537.123882][ C0] kasan_report+0xca/0x100 [ 2537.123886][ C0] ? dst_dev_put+0x214/0x280 [ 2537.123891][ C0] dst_dev_put+0x214/0x280 [ 2537.123895][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2537.123902][ C0] fib_nh_common_release+0xe6/0x2d0 [ 2537.123906][ C0] free_fib_info_rcu+0x14c/0x380 [ 2537.123910][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2537.123914][ C0] rcu_do_batch+0x27e/0x1120 [ 2537.123920][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 2537.123923][ C0] ? __lock_release+0x5d/0x160 [ 2537.123928][ C0] ? rcu_is_watching+0x12/0xb0 [ 2537.123932][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2537.123939][ C0] rcu_core+0x2bb/0x520 [ 2537.123943][ C0] handle_softirqs+0x1c0/0x820 [ 2537.123950][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2537.123953][ C0] irq_exit_rcu+0xe/0x30 [ 2537.123956][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2537.123961][ C0] [ 2537.123962][ C0] [ 2537.123963][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2537.123967][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2537.123971][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2537.123974][ C0] RSP: 0018:ffffffff98207de8 EFLAGS: 00000206 [ 2537.123977][ C0] RAX: 0000000002ec065f RBX: 1ffffffff3040fc1 RCX: ffffffff9700a255 [ 2537.123980][ C0] RDX: 0000000000000000 RSI: ffffffff979fa925 RDI: ffffffff9746a600 [ 2537.123981][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a [ 2537.123983][ C0] R10: ffff888066c318d3 R11: ffffffff98232e50 R12: 0000000000000000 [ 2537.123985][ C0] R13: ffffffff98232400 R14: dffffc0000000000 R15: 0000000000014770 [ 2537.123989][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2537.123993][ C0] default_idle+0x9/0x10 [ 2537.123996][ C0] default_idle_call+0x6c/0xa0 [ 2537.123998][ C0] cpuidle_idle_call+0x23b/0x380 [ 2537.124002][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 2537.124005][ C0] ? trace_irq_enable.constprop.0+0x2f/0x110 [ 2537.124010][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2537.124016][ C0] do_idle+0xe1/0x140 [ 2537.124019][ C0] cpu_startup_entry+0x54/0x60 [ 2537.124022][ C0] rest_init+0x14b/0x260 [ 2537.124025][ C0] start_kernel+0x348/0x3f0 [ 2537.124032][ C0] x86_64_start_reservations+0x18/0x30 [ 2537.124035][ C0] x86_64_start_kernel+0xf8/0x150 [ 2537.124038][ C0] common_startup_64+0x13e/0x148 [ 2537.124047][ C0] [ 2537.124049][ C0] [ 2537.135024][ C0] Allocated by task 16604: [ 2537.135218][ C0] kasan_save_stack+0x24/0x40 [ 2537.135417][ C0] kasan_save_track+0x14/0x30 [ 2537.135606][ C0] __kasan_slab_alloc+0x55/0x60 [ 2537.135810][ C0] kmem_cache_alloc_noprof+0x291/0x6d0 [ 2537.136002][ C0] dst_alloc+0x7a/0x140 [ 2537.136147][ C0] rt_dst_alloc+0x31/0x3a0 [ 2537.136338][ C0] __mkroute_output+0x425/0x11a0 [ 2537.136529][ C0] ip_route_output_key_hash+0xfa/0x220 [ 2537.136725][ C0] ip_route_output_flow+0x23/0x140 [ 2537.136918][ C0] udp_tunnel_dst_lookup+0x227/0x3a0 [ 2537.137110][ C0] vxlan_xmit_one+0x151a/0x4490 [vxlan] [ 2537.137314][ C0] vxlan_xmit+0xf6a/0x1870 [vxlan] [ 2537.137512][ C0] dev_hard_start_xmit+0x132/0x530 [ 2537.137706][ C0] __dev_queue_xmit+0x1406/0x1af0 [ 2537.137895][ C0] packet_snd+0xd0f/0x1a70 [ 2537.138088][ C0] __sys_sendto+0x24b/0x380 [ 2537.138277][ C0] __x64_sys_sendto+0xe0/0x1b0 [ 2537.138467][ C0] do_syscall_64+0xc1/0xfc0 [ 2537.138662][ C0] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 2537.138899][ C0] [ 2537.138996][ C0] Freed by task 12: [ 2537.139139][ C0] kasan_save_stack+0x24/0x40 [ 2537.139337][ C0] kasan_save_track+0x14/0x30 [ 2537.139535][ C0] __kasan_save_free_info+0x3b/0x60 [ 2537.139727][ C0] __kasan_slab_free+0x3f/0x60 [ 2537.139918][ C0] kmem_cache_free+0x2e4/0x690 [ 2537.140110][ C0] dst_destroy+0x230/0x350 [ 2537.140300][ C0] rcu_do_batch+0x27e/0x1120 [ 2537.140491][ C0] rcu_core+0x2bb/0x520 [ 2537.140640][ C0] handle_softirqs+0x1c0/0x820 [ 2537.140832][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2537.141028][ C0] irq_exit_rcu+0xe/0x30 [ 2537.141173][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2537.141363][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2537.141602][ C0] [ 2537.141699][ C0] Last potentially related work creation: [ 2537.141887][ C0] kasan_save_stack+0x24/0x40 [ 2537.142082][ C0] kasan_record_aux_stack+0x8c/0xa0 [ 2537.142277][ C0] __call_rcu_common.constprop.0+0xa9/0x950 [ 2537.142517][ C0] dst_cache_destroy+0xf7/0x200 [ 2537.142711][ C0] vxlan_fdb_free+0x10e/0x1b0 [vxlan] [ 2537.142911][ C0] rcu_do_batch+0x27e/0x1120 [ 2537.143103][ C0] rcu_core+0x2bb/0x520 [ 2537.143250][ C0] handle_softirqs+0x1c0/0x820 [ 2537.143441][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2537.143634][ C0] irq_exit_rcu+0xe/0x30 [ 2537.143782][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2537.143974][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2537.144214][ C0] [ 2537.144311][ C0] The buggy address belongs to the object at ffff88800e17c1c0 [ 2537.144311][ C0] which belongs to the cache rtable of size 184 [ 2537.144774][ C0] The buggy address is located 0 bytes inside of [ 2537.144774][ C0] freed 184-byte region [ffff88800e17c1c0, ffff88800e17c278) [ 2537.145367][ C0] [ 2537.145464][ C0] The buggy address belongs to the physical page: [ 2537.145706][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800e17c340 pfn:0xe17c [ 2537.146242][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2537.146536][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 2537.146786][ C0] page_type: f5(slab) [ 2537.147063][ C0] raw: 0080000000000240 ffff888002acde00 ffff88800266d708 ffff88800266d708 [ 2537.147403][ C0] raw: ffff88800e17c340 0000000000150001 00000000f5000000 0000000000000000 [ 2537.147747][ C0] head: 0080000000000240 ffff888002acde00 ffff88800266d708 ffff88800266d708 [ 2537.148222][ C0] head: ffff88800e17c340 0000000000150001 00000000f5000000 0000000000000000 [ 2537.148562][ C0] head: 0080000000000001 ffffea0000385f01 00000000ffffffff 00000000ffffffff [ 2537.149031][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2537.149371][ C0] page dumped because: kasan: bad access detected [ 2537.149613][ C0] [ 2537.150068][ C0] Memory state around the buggy address: [ 2537.150256][ C0] ffff88800e17c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2537.150537][ C0] ffff88800e17c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2537.150940][ C0] >ffff88800e17c180: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2537.151226][ C0] ^ [ 2537.151580][ C0] ffff88800e17c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 2537.151980][ C0] ffff88800e17c280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2537.152258][ C0] ================================================================== [ 2537.152668][ C0] Disabling lock debugging due to kernel taint [ 2537.152911][ C0] Oops: general protection fault, probably for non-canonical address 0xe027fc3860000008: 0000 [#1] SMP KASAN [ 2537.153433][ C0] KASAN: maybe wild-memory-access in range [0x014001c300000040-0x014001c300000047] [ 2537.153746][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 2537.154236][ C0] Tainted: [B]=BAD_PAGE [ 2537.154375][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2537.154604][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2537.154914][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2537.155566][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010203 [ 2537.155806][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9668b398 [ 2537.156080][ C0] RDX: 0028003860000008 RSI: 0000000000000008 RDI: 014001c300000044 [ 2537.156354][ C0] RBP: 014001c30000000c R08: 0000000000000001 R09: fffffbfff332a8c4 [ 2537.156630][ C0] R10: ffffffff99954627 R11: ffffc90000007800 R12: ffff88800c85aea8 [ 2537.157024][ C0] R13: ffff88800e17c1c0 R14: 0000000000000000 R15: ffff88800e17c1c0 [ 2537.157413][ C0] FS: 0000000000000000(0000) GS:ffff8880cd318000(0000) knlGS:0000000000000000 [ 2537.157733][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2537.157965][ C0] CR2: 00007fa5611990b0 CR3: 000000007b545001 CR4: 0000000000772ef0 [ 2537.158245][ C0] PKRU: 55555554 [ 2537.158385][ C0] Call Trace: [ 2537.158641][ C0] [ 2537.158737][ C0] rt_fibinfo_free_cpus.part.0+0xd2/0x170 [ 2537.158923][ C0] fib_nh_common_release+0xe6/0x2d0 [ 2537.159106][ C0] free_fib_info_rcu+0x14c/0x380 [ 2537.159288][ C0] ? nexthop_mpath_fill_node.constprop.0+0x2b0/0x2b0 [ 2537.159519][ C0] rcu_do_batch+0x27e/0x1120 [ 2537.159819][ C0] ? trace_rcu_batch_end+0x270/0x270 [ 2537.160000][ C0] ? __lock_release+0x5d/0x160 [ 2537.160189][ C0] ? rcu_is_watching+0x12/0xb0 [ 2537.160375][ C0] ? _raw_spin_unlock_irqrestore+0x59/0x70 [ 2537.160606][ C0] rcu_core+0x2bb/0x520 [ 2537.160743][ C0] handle_softirqs+0x1c0/0x820 [ 2537.160931][ C0] __irq_exit_rcu+0x6c/0xe0 [ 2537.161113][ C0] irq_exit_rcu+0xe/0x30 [ 2537.161252][ C0] sysvec_apic_timer_interrupt+0xa8/0xc0 [ 2537.161438][ C0] [ 2537.161530][ C0] [ 2537.161622][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2537.161847][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 2537.162035][ C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41 [ 2537.162688][ C0] RSP: 0018:ffffffff98207de8 EFLAGS: 00000206 [ 2537.162920][ C0] RAX: 0000000002ec065f RBX: 1ffffffff3040fc1 RCX: ffffffff9700a255 [ 2537.163315][ C0] RDX: 0000000000000000 RSI: ffffffff979fa925 RDI: ffffffff9746a600 [ 2537.163593][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a [ 2537.163869][ C0] R10: ffff888066c318d3 R11: ffffffff98232e50 R12: 0000000000000000 [ 2537.164264][ C0] R13: ffffffff98232400 R14: dffffc0000000000 R15: 0000000000014770 [ 2537.164777][ C0] ? ct_kernel_exit.constprop.0+0x105/0x150 [ 2537.165009][ C0] default_idle+0x9/0x10 [ 2537.165146][ C0] default_idle_call+0x6c/0xa0 [ 2537.165327][ C0] cpuidle_idle_call+0x23b/0x380 [ 2537.165511][ C0] ? arch_cpu_idle_exit+0x40/0x40 [ 2537.165817][ C0] ? trace_irq_enable.constprop.0+0x2f/0x110 [ 2537.166160][ C0] ? tsc_verify_tsc_adjust+0x94/0x310 [ 2537.166344][ C0] do_idle+0xe1/0x140 [ 2537.166482][ C0] cpu_startup_entry+0x54/0x60 [ 2537.166668][ C0] rest_init+0x14b/0x260 [ 2537.166807][ C0] start_kernel+0x348/0x3f0 [ 2537.167108][ C0] x86_64_start_reservations+0x18/0x30 [ 2537.167290][ C0] x86_64_start_kernel+0xf8/0x150 [ 2537.167471][ C0] common_startup_64+0x13e/0x148 [ 2537.167656][ C0] [ 2537.167905][ C0] Modules linked in: vxlan act_gact cls_flower cls_bpf sch_ingress netdevsim psample ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables [ 2537.168379][ C0] ---[ end trace 0000000000000000 ]--- [ 2537.168681][ C0] RIP: 0010:dst_dev_put+0xa0/0x280 [ 2537.168866][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6 [ 2537.169512][ C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010203 [ 2537.169743][ C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9668b398 [ 2537.170011][ C0] RDX: 0028003860000008 RSI: 0000000000000008 RDI: 014001c300000044 [ 2537.170405][ C0] RBP: 014001c30000000c R08: 0000000000000001 R09: fffffbfff332a8c4 [ 2537.170676][ C0] R10: ffffffff99954627 R11: ffffc90000007800 R12: ffff88800c85aea8 [ 2537.170946][ C0] R13: ffff88800e17c1c0 R14: 0000000000000000 R15: ffff88800e17c1c0 [ 2537.171331][ C0] FS: 0000000000000000(0000) GS:ffff8880cd318000(0000) knlGS:0000000000000000 [ 2537.171649][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2537.171991][ C0] CR2: 00007fa5611990b0 CR3: 000000007b545001 CR4: 0000000000772ef0 [ 2537.172259][ C0] PKRU: 55555554 [ 2537.172401][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 2537.172985][ C0] Kernel Offset: 0x13600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 2537.173404][ C0] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr