======================================
| xx__-> [ 3807.708454][ C2] ==================================================================
| [ 3807.709152][ C2] BUG: KASAN: slab-use-after-free in page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
| [ 3807.709814][ C2] Read of size 1 at addr ffff888012d8caf4 by task kworker/2:1/26699
| [ 3807.710388][ C2]
[ 3807.710584][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 3807.710587][ C2] Workqueue: mld mld_ifc_work
[ 3807.710595][ C2] Call Trace:
[ 3807.710597][ C2]
[ 3807.710600][ C2] dump_stack_lvl (lib/dump_stack.c:123)
[ 3807.710609][ C2] print_address_description.constprop.0 (mm/kasan/report.c:409)
[ 3807.710615][ C2] ? page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
[ 3807.710619][ C2] print_report (mm/kasan/report.c:522)
[ 3807.710621][ C2] ? page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
[ 3807.710624][ C2] ? kasan_addr_to_slab (./include/linux/mm.h:1280 mm/kasan/../slab.h:211 mm/kasan/common.c:38)
[ 3807.710629][ C2] ? page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
[ 3807.710632][ C2] kasan_report (mm/kasan/report.c:636)
[ 3807.710635][ C2] ? page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
[ 3807.710640][ C2] page_pool_put_unrefed_netmem (./include/linux/dma-mapping.h:294 net/core/page_pool.c:465 net/core/page_pool.c:808 net/core/page_pool.c:866)
[ 3807.710644][ C2] napi_pp_put_page (net/core/skbuff.c:998)
[ 3807.710649][ C2] skb_release_data (./include/linux/skbuff_ref.h:40 ./include/linux/skbuff_ref.h:56 net/core/skbuff.c:1079)
[ 3807.710654][ C2] napi_consume_skb (net/core/skbuff.c:1479)
[ 3807.710658][ C2] net_rx_action (net/core/dev.c:6546 net/core/dev.c:6532 net/core/dev.c:7495)
[ 3807.710665][ C2] ? __pfx_net_rx_action (net/core/dev.c:7476)
[ 3807.710667][ C2] ? lockdep_rcu_suspicious (kernel/locking/lockdep.c:6832)
[ 3807.710673][ C2] ? tmigr_handle_remote (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 kernel/time/timer_migration.c:441 kernel/time/timer_migration.c:1074)
[ 3807.710680][ C2] ? __pfx_tmigr_handle_remote (kernel/time/timer_migration.c:1059)
[ 3807.710684][ C2] ? run_timer_softirq (kernel/time/timer.c:2421 kernel/time/timer.c:2435 kernel/time/timer.c:2443)
[ 3807.710690][ C2] ? mark_held_locks (kernel/locking/lockdep.c:4326)
[ 3807.710694][ C2] handle_softirqs (kernel/softirq.c:561)
[ 3807.710701][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:908 net/core/dev.c:4660)
[ 3807.710704][ C2] do_softirq (kernel/softirq.c:462 kernel/softirq.c:449)
[ 3807.710707][ C2]
[ 3807.710708][ C2]
[ 3807.710710][ C2] __local_bh_enable_ip (kernel/softirq.c:389)
[ 3807.710713][ C2] ? __dev_queue_xmit (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:908 net/core/dev.c:4660)
[ 3807.710715][ C2] __dev_queue_xmit (net/core/dev.c:4661)
[ 3807.710718][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5235)
[ 3807.710722][ C2] ? __pfx___dev_queue_xmit (net/core/dev.c:4541)
[ 3807.710726][ C2] ? eth_header (net/ethernet/eth.c:100)
[ 3807.710732][ C2] ? neigh_resolve_output (./include/linux/netdevice.h:3402 net/core/neighbour.c:1507 net/core/neighbour.c:1492)
[ 3807.710738][ C2] ip6_finish_output2 (./include/net/neighbour.h:539 net/ipv6/ip6_output.c:141)
[ 3807.710745][ C2] ip6_finish_output (net/ipv6/ip6_output.c:215 net/ipv6/ip6_output.c:226)
[ 3807.710749][ C2] ip6_output (./include/linux/netfilter.h:303 net/ipv6/ip6_output.c:247)
[ 3807.710752][ C2] ? __pfx_ip6_output (net/ipv6/ip6_output.c:234)
[ 3807.710755][ C2] ? __lock_acquire (kernel/locking/lockdep.c:5235)
[ 3807.710760][ C2] NF_HOOK.constprop.0 (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 ./include/linux/netfilter.h:238 ./include/linux/netfilter.h:312)
[ 3807.710763][ C2] ? __pfx_NF_HOOK.constprop.0 (./include/linux/netfilter.h:308)
[ 3807.710766][ C2] ? __pfx_xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3174)
[ 3807.710772][ C2] ? mark_held_locks (kernel/locking/lockdep.c:4326)
[ 3807.710775][ C2] ? icmp6_dst_alloc (net/ipv6/route.c:3300)
[ 3807.710781][ C2] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 kernel/softirq.c:394)
[ 3807.710784][ C2] ? icmp6_dst_alloc (net/ipv6/route.c:3300)
[ 3807.710788][ C2] mld_sendpack (net/ipv6/mcast.c:1872)
[ 3807.710792][ C2] ? __pfx_mld_sendpack (net/ipv6/mcast.c:1829)
[ 3807.710796][ C2] ? mld_send_cr (net/ipv6/mcast.c:2146 (discriminator 11))
[ 3807.710800][ C2] mld_ifc_work (net/ipv6/mcast.c:2704)
[ 3807.710803][ C2] process_one_work (kernel/workqueue.c:3238)
[ 3807.710810][ C2] ? __pfx_process_one_work (kernel/workqueue.c:3140)
[ 3807.710815][ C2] ? assign_work (kernel/workqueue.c:1200)
[ 3807.710818][ C2] worker_thread (kernel/workqueue.c:3313 kernel/workqueue.c:3400)
[ 3807.710823][ C2] ? __pfx_worker_thread (kernel/workqueue.c:3346)
[ 3807.710826][ C2] kthread (kernel/kthread.c:464)
[ 3807.710830][ C2] ? __pfx_kthread (kernel/kthread.c:413)
[ 3807.710833][ C2] ? ret_from_fork (arch/x86/kernel/process.c:152)
[ 3807.710839][ C2] ? __lock_release (kernel/locking/lockdep.c:5534)
[ 3807.710842][ C2] ? calculate_sigpending (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-atomic.h:28 ./include/linux/thread_info.h:97 ./include/linux/sched.h:2016 kernel/signal.c:191)
[ 3807.710846][ C2] ? __pfx_kthread (kernel/kthread.c:413)
[ 3807.710849][ C2] ret_from_fork (arch/x86/kernel/process.c:153)
[ 3807.710852][ C2] ? __pfx_kthread (kernel/kthread.c:413)
Finger prints:
print_report:kasan_report:page_pool_put_unrefed_netmem:napi_pp_put_page:skb_release_data