======================================
| [ 2537.122762][    C0] ==================================================================
| [ 2537.123163][    C0] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146)
| [ 2537.123460][    C0] Read of size 8 at addr ffff88800e17c1c0 by task swapper/0/0
| [ 2537.123743][    C0]
[ 2537.123846][    C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2537.123849][    C0] Call Trace:
[ 2537.123851][    C0]  <IRQ>
[ 2537.123852][    C0]  dump_stack_lvl (lib/dump_stack.c:123)
[ 2537.123858][    C0]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 2537.123865][    C0]  ? dst_dev_put (net/core/dst.c:146)
[ 2537.123869][    C0]  print_report (mm/kasan/report.c:483)
[ 2537.123872][    C0]  ? dst_dev_put (net/core/dst.c:146)
[ 2537.123875][    C0]  ? kasan_addr_to_slab (mm/kasan/../slab.h:178 mm/kasan/common.c:47)
[ 2537.123879][    C0]  ? dst_dev_put (net/core/dst.c:146)
[ 2537.123882][    C0]  kasan_report (mm/kasan/report.c:597)
[ 2537.123886][    C0]  ? dst_dev_put (net/core/dst.c:146)
[ 2537.123891][    C0]  dst_dev_put (net/core/dst.c:146)
[ 2537.123895][    C0]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[ 2537.123902][    C0]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[ 2537.123906][    C0]  free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3))
[ 2537.123910][    C0]  ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223)
[ 2537.123914][    C0]  rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607)
[ 2537.123920][    C0]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[ 2537.123923][    C0]  ? __lock_release (kernel/locking/lockdep.c:5536)
[ 2537.123928][    C0]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2537.123932][    C0]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[ 2537.123939][    C0]  rcu_core (kernel/rcu/tree.c:2859)
[ 2537.123943][    C0]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2537.123950][    C0]  __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723)
[ 2537.123953][    C0]  irq_exit_rcu (kernel/softirq.c:741)
[ 2537.123956][    C0]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056)
[ 2537.123961][    C0]  </IRQ>
[ 2537.123962][    C0]  <TASK>
[ 2537.123963][    C0]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2537.123967][    C0] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[ 2537.123971][    C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 <c3> 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
All code
========
   0:	48 8b 3d 34 31 90 02 	mov    0x2903134(%rip),%rdi        # 0x290313b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 28 07 a9 00 	sub    0xa90728(%rip),%rax        # 0xa9073b
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d d3 d6 28 00 	verw   0x28d6d3(%rip)        # 0x28d6fb
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	41 54                	push   %r12
  31:	55                   	push   %rbp
  32:	53                   	push   %rbx
  33:	48 89 fb             	mov    %rdi,%rbx
  36:	48 83 ec 10          	sub    $0x10,%rsp
  3a:	8b 17                	mov    (%rdi),%edx
  3c:	83 e2 fe             	and    $0xfffffffe,%edx
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	41 54                	push   %r12
   7:	55                   	push   %rbp
   8:	53                   	push   %rbx
   9:	48 89 fb             	mov    %rdi,%rbx
   c:	48 83 ec 10          	sub    $0x10,%rsp
  10:	8b 17                	mov    (%rdi),%edx
  12:	83 e2 fe             	and    $0xfffffffe,%edx
  15:	41                   	rex.B
[ 2537.123974][    C0] RSP: 0018:ffffffff98207de8 EFLAGS: 00000206
[ 2537.123977][    C0] RAX: 0000000002ec065f RBX: 1ffffffff3040fc1 RCX: ffffffff9700a255
[ 2537.123980][    C0] RDX: 0000000000000000 RSI: ffffffff979fa925 RDI: ffffffff9746a600
[ 2537.123981][    C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a
[ 2537.123983][    C0] R10: ffff888066c318d3 R11: ffffffff98232e50 R12: 0000000000000000
[ 2537.123985][    C0] R13: ffffffff98232400 R14: dffffc0000000000 R15: 0000000000014770
[ 2537.123989][    C0]  ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146)
[ 2537.123993][    C0]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[ 2537.123996][    C0]  default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123)
[ 2537.123998][    C0]  cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2537.124002][    C0]  ? arch_cpu_idle_exit+0x40/0x40
[ 2537.124005][    C0]  ? trace_irq_enable.constprop.0 (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/preemptirq.h:40)
[ 2537.124010][    C0]  ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60)
[ 2537.124016][    C0]  do_idle (kernel/sched/idle.c:332)
[ 2537.124019][    C0]  cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1))
[ 2537.124022][    C0]  rest_init (./include/linux/rcupdate.h:868 init/main.c:728)
[ 2537.124025][    C0]  start_kernel (init/main.c:1063 (discriminator 1))
[ 2537.124032][    C0]  x86_64_start_reservations (arch/x86/kernel/head64.c:298)
[ 2537.124035][    C0]  x86_64_start_kernel (arch/x86/kernel/head64.c:234 (discriminator 17))
[ 2537.124038][    C0]  common_startup_64 (arch/x86/kernel/head_64.S:419)
| [ 2537.152668][    C0] Disabling lock debugging due to kernel taint
| [ 2537.152911][    C0] Oops: general protection fault, probably for non-canonical address 0xe027fc3860000008: 0000 [#1] SMP KASAN
| [ 2537.153433][    C0] KASAN: maybe wild-memory-access in range [0x014001c300000040-0x014001c300000047]
| [ 2537.154236][    C0] Tainted: [B]=BAD_PAGE
[ 2537.154375][    C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2537.154604][    C0] RIP: 0010:dst_dev_put (net/core/dst.c:149)
[ 2537.154914][    C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 9c 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6d 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6f 01 00 00 48 8b 45 38 48 85 c0 74 08 4c 89 e6
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 9c 01 00 00 48 b8 	test   %ebx,-0x47b80000(%rcx,%rax,1)
  13:	00 00                	add    %al,(%rax)
  15:	00 00                	add    %al,(%rax)
  17:	00 fc                	add    %bh,%ah
  19:	ff                   	lcall  (bad)
  1a:	df 49 8b             	fisttps -0x75(%rcx)
  1d:	6d                   	insl   (%dx),%es:(%rdi)
  1e:	08 48 8d             	or     %cl,-0x73(%rax)
  21:	7d 38                	jge    0x5b
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
  2a:*	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)		<-- trapping instruction
  2e:	0f 85 6f 01 00 00    	jne    0x1a3
  34:	48 8b 45 38          	mov    0x38(%rbp),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	4c 89 e6             	mov    %r12,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	0f 85 6f 01 00 00    	jne    0x179
   a:	48 8b 45 38          	mov    0x38(%rbp),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	4c 89 e6             	mov    %r12,%rsi
[ 2537.155566][    C0] RSP: 0018:ffffc90000007d48 EFLAGS: 00010203
[ 2537.155806][    C0] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: ffffffff9668b398
[ 2537.156080][    C0] RDX: 0028003860000008 RSI: 0000000000000008 RDI: 014001c300000044
[ 2537.156354][    C0] RBP: 014001c30000000c R08: 0000000000000001 R09: fffffbfff332a8c4
[ 2537.156630][    C0] R10: ffffffff99954627 R11: ffffc90000007800 R12: ffff88800c85aea8
[ 2537.157024][    C0] R13: ffff88800e17c1c0 R14: 0000000000000000 R15: ffff88800e17c1c0
[ 2537.157413][    C0] FS:  0000000000000000(0000) GS:ffff8880cd318000(0000) knlGS:0000000000000000
[ 2537.157733][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2537.157965][    C0] CR2: 00007fa5611990b0 CR3: 000000007b545001 CR4: 0000000000772ef0
[ 2537.158245][    C0] PKRU: 55555554
[ 2537.158385][    C0] Call Trace:
[ 2537.158641][    C0]  <IRQ>
[ 2537.158737][    C0]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[ 2537.158923][    C0]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[ 2537.159106][    C0]  free_fib_info_rcu (./include/net/nexthop.h:480 (discriminator 3) net/ipv4/fib_semantics.c:229 (discriminator 3))
[ 2537.159288][    C0]  ? nexthop_mpath_fill_node.constprop.0 (net/ipv4/fib_semantics.c:223)
[ 2537.159519][    C0]  rcu_do_batch (./include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607)
[ 2537.159819][    C0]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[ 2537.160000][    C0]  ? __lock_release (kernel/locking/lockdep.c:5536)
[ 2537.160189][    C0]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[ 2537.160375][    C0]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[ 2537.160606][    C0]  rcu_core (kernel/rcu/tree.c:2859)
[ 2537.160743][    C0]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2537.160931][    C0]  __irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723)
[ 2537.161113][    C0]  irq_exit_rcu (kernel/softirq.c:741)
[ 2537.161252][    C0]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 arch/x86/kernel/apic/apic.c:1056)
[ 2537.161438][    C0]  </IRQ>
[ 2537.161530][    C0]  <TASK>
[ 2537.161622][    C0]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2537.161847][    C0] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[ 2537.162035][    C0] Code: 48 8b 3d 34 31 90 02 e8 1f 00 00 00 48 2b 05 28 07 a9 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d d3 d6 28 00 fb f4 <c3> 0f 1f 40 d6 41 54 55 53 48 89 fb 48 83 ec 10 8b 17 83 e2 fe 41
All code
========
   0:	48 8b 3d 34 31 90 02 	mov    0x2903134(%rip),%rdi        # 0x290313b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 28 07 a9 00 	sub    0xa90728(%rip),%rax        # 0xa9073b
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d d3 d6 28 00 	verw   0x28d6d3(%rip)        # 0x28d6fb
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	41 54                	push   %r12
  31:	55                   	push   %rbp
  32:	53                   	push   %rbx
  33:	48 89 fb             	mov    %rdi,%rbx
  36:	48 83 ec 10          	sub    $0x10,%rsp
  3a:	8b 17                	mov    (%rdi),%edx
  3c:	83 e2 fe             	and    $0xfffffffe,%edx
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	41 54                	push   %r12
   7:	55                   	push   %rbp
   8:	53                   	push   %rbx
   9:	48 89 fb             	mov    %rdi,%rbx
   c:	48 83 ec 10          	sub    $0x10,%rsp
  10:	8b 17                	mov    (%rdi),%edx
  12:	83 e2 fe             	and    $0xfffffffe,%edx
  15:	41                   	rex.B
[ 2537.162688][    C0] RSP: 0018:ffffffff98207de8 EFLAGS: 00000206
[ 2537.162920][    C0] RAX: 0000000002ec065f RBX: 1ffffffff3040fc1 RCX: ffffffff9700a255
[ 2537.163315][    C0] RDX: 0000000000000000 RSI: ffffffff979fa925 RDI: ffffffff9746a600
[ 2537.163593][    C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed100cd8631a
[ 2537.163869][    C0] R10: ffff888066c318d3 R11: ffffffff98232e50 R12: 0000000000000000
[ 2537.164264][    C0] R13: ffffffff98232400 R14: dffffc0000000000 R15: 0000000000014770
[ 2537.164777][    C0]  ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:146)
[ 2537.165009][    C0]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[ 2537.165146][    C0]  default_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:123)
[ 2537.165327][    C0]  cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2537.165511][    C0]  ? arch_cpu_idle_exit+0x40/0x40
[ 2537.165817][    C0]  ? trace_irq_enable.constprop.0 (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/preemptirq.h:40)
[ 2537.166160][    C0]  ? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:60)
[ 2537.166344][    C0]  do_idle (kernel/sched/idle.c:332)
[ 2537.166482][    C0]  cpu_startup_entry (kernel/sched/idle.c:429 (discriminator 1))
[ 2537.166668][    C0]  rest_init (./include/linux/rcupdate.h:868 init/main.c:728)
[ 2537.166807][    C0]  start_kernel (init/main.c:1063 (discriminator 1))
[ 2537.167108][    C0]  x86_64_start_reservations (arch/x86/kernel/head64.c:298)
[ 2537.167290][    C0]  x86_64_start_kernel (arch/x86/kernel/head64.c:234 (discriminator 17))


Finger prints:
dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core
print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu