======================================
| [ 1108.775728][    C1] ==================================================================
| [ 1108.776075][ C1] BUG: KASAN: slab-out-of-bounds in xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) 
| [ 1108.776392][    C1] Read of size 8 at addr ffff888004ae61c0 by task socat/12329
| [ 1108.776681][    C1]
[ 1108.777067][    C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 1108.777491][    C1] Call Trace:
[ 1108.777645][    C1]  <IRQ>
[ 1108.777742][ C1] dump_stack_lvl (lib/dump_stack.c:123) 
[ 1108.777928][ C1] print_address_description.constprop.0 (mm/kasan/report.c:378) 
[ 1108.778172][ C1] ? xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) 
[ 1108.778358][ C1] print_report (mm/kasan/report.c:489) 
[ 1108.778541][ C1] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) 
[ 1108.778727][ C1] kasan_report (mm/kasan/report.c:603) 
[ 1108.778875][ C1] ? xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) 
[ 1108.779071][ C1] xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) 
[ 1108.779269][ C1] ? __pfx_xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3132) 
[ 1108.779505][ C1] ? l4proto_manip_pkt (./include/net/checksum.h:167 net/netfilter/nf_nat_proto.c:216 net/netfilter/nf_nat_proto.c:342) nf_nat
[ 1108.779749][ C1] nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:684) nf_nat
[ 1108.779948][ C1] ? __pfx_nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:664) nf_nat
[ 1108.780201][ C1] ? nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables
[ 1108.780489][ C1] ? __pfx_nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables
[ 1108.780755][ C1] nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:783 net/netfilter/nf_nat_proto.c:755) nf_nat
[ 1108.780956][ C1] ? __pfx_nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:757) nf_nat
[ 1108.781205][ C1] nf_hook_slow (./include/linux/netfilter.h:154 net/netfilter/core.c:626) 
[ 1108.781402][ C1] nf_hook (./include/linux/netfilter.h:269) 
[ 1108.781552][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.781748][ C1] ? __pfx_nf_hook (./include/linux/netfilter.h:227) 
[ 1108.781940][ C1] ? __ip_append_data (net/ipv4/ip_output.c:1029) 
[ 1108.782137][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.782324][ C1] ip_output (./include/linux/netfilter.h:301 net/ipv4/ip_output.c:434) 
[ 1108.782465][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.782658][ C1] ip_push_pending_frames (./include/net/dst.h:450 net/ipv4/ip_output.c:130 net/ipv4/ip_output.c:1505 net/ipv4/ip_output.c:1525) 
[ 1108.782848][ C1] ip_send_unicast_reply (./include/net/route.h:269 net/ipv4/ip_output.c:1675) 
[ 1108.783046][ C1] ? mark_lock (kernel/locking/lockdep.c:186 kernel/locking/lockdep.c:4731) 
[ 1108.783241][ C1] ? __pfx_ip_send_unicast_reply (net/ipv4/ip_output.c:1605) 
[ 1108.783493][ C1] ? __lock_acquire (kernel/locking/lockdep.c:5202) 
[ 1108.783692][ C1] ? lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5827) 
[ 1108.783892][ C1] ? tcp_v4_send_ack.constprop.0 (./include/linux/local_lock_internal.h:29 net/ipv4/tcp_ipv4.c:1016) 
[ 1108.784159][ C1] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) 
[ 1108.784318][ C1] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) 
[ 1108.784501][ C1] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) 
[ 1108.784689][ C1] tcp_v4_send_ack.constprop.0 (./include/net/net_namespace.h:380 ./include/net/sock.h:661 net/ipv4/tcp_ipv4.c:1030) 
[ 1108.784933][ C1] ? __pfx_tcp_v4_send_ack.constprop.0 (net/ipv4/tcp_ipv4.c:933) 
[ 1108.785189][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.785427][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.785707][ C1] ? tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) 
[ 1108.786010][ C1] tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) 
[ 1108.786302][ C1] ? __pfx_tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2177) 
[ 1108.786583][ C1] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) 
[ 1108.786875][ C1] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 8)) 
[ 1108.787169][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.787471][ C1] ip_local_deliver_finish (./include/linux/rcupdate.h:878 net/ipv4/ip_input.c:234) 
[ 1108.787762][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.788040][ C1] ? __pfx_ip_rcv (net/ipv4/ip_input.c:561) 
[ 1108.788333][ C1] __netif_receive_skb_one_core (net/core/dev.c:5670 (discriminator 4)) 
[ 1108.788697][ C1] ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5663) 
[ 1108.789057][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.789352][ C1] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 1108.789645][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.789952][ C1] process_backlog (./include/linux/rcupdate.h:878 net/core/dev.c:6116) 
[ 1108.790244][ C1] __napi_poll.constprop.0 (net/core/dev.c:6779) 
[ 1108.790539][ C1] net_rx_action (net/core/dev.c:6848 net/core/dev.c:6970) 
[ 1108.790851][ C1] ? __pfx_net_rx_action (net/core/dev.c:6932) 
[ 1108.791168][ C1] ? __lock_release (kernel/locking/lockdep.c:5483) 
[ 1108.791443][ C1] ? rcu_core (kernel/rcu/rcu.h:135 kernel/rcu/tree.c:234 kernel/rcu/tree.c:2810) 
[ 1108.791657][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.791940][ C1] ? trace_rcu_quiescent_state_report (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:570 ./include/linux/cpumask.h:1117 ./include/trace/events/rcu.h:368) 
[ 1108.792317][ C1] ? rcu_report_qs_rnp (kernel/rcu/tree.c:2317 (discriminator 9)) 
[ 1108.792821][ C1] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 1108.793135][ C1] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) 
[ 1108.793365][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.793667][ C1] handle_softirqs (kernel/softirq.c:554) 
[ 1108.794205][ C1] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) 
[ 1108.794514][ C1] do_softirq (kernel/softirq.c:455 kernel/softirq.c:442) 
[ 1108.794742][    C1]  </IRQ>
[ 1108.794905][    C1]  <TASK>
[ 1108.795060][ C1] __local_bh_enable_ip (kernel/softirq.c:382) 
[ 1108.795361][ C1] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) 
[ 1108.795862][ C1] __dev_queue_xmit (net/core/dev.c:4460) 
[ 1108.796131][ C1] ? __lock_release (kernel/locking/lockdep.c:5501) 
[ 1108.796426][ C1] ? ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) 
[ 1108.796643][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.796828][ C1] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 1108.797026][ C1] ? __pfx___dev_queue_xmit (net/core/dev.c:4341) 
[ 1108.797202][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.797384][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) 
[ 1108.797756][ C1] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:757 ./include/net/neighbour.h:496) 
[ 1108.797943][ C1] ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) 
[ 1108.798153][ C1] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) 
[ 1108.798340][ C1] ? __ip_finish_output (./include/linux/skbuff.h:1669 ./include/linux/skbuff.h:5010 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:296) 
[ 1108.798521][ C1] __ip_queue_xmit (net/ipv4/ip_output.c:536 (discriminator 4)) 
[ 1108.798854][ C1] ? __skb_clone (./arch/x86/include/asm/atomic.h:53 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:992 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:436 (discriminator 4) net/core/skbuff.c:1605 (discriminator 4)) 
[ 1108.799044][ C1] __tcp_transmit_skb (net/ipv4/tcp_output.c:1466 (discriminator 4)) 
[ 1108.799251][ C1] ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1287) 
[ 1108.799549][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.799839][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) 
[ 1108.800188][ C1] ? tcp_small_queue_check.isra.0 (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/ipv4/tcp_output.c:2631) 
[ 1108.800732][ C1] tcp_write_xmit (net/ipv4/tcp_output.c:2830) 
[ 1108.801185][ C1] ? tcp_current_mss (./include/net/dst.h:216 net/ipv4/tcp_output.c:1872) 
[ 1108.801475][ C1] ? __pfx_tcp_current_mss (net/ipv4/tcp_output.c:1861) 
[ 1108.801771][ C1] ? __alloc_skb (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 ./include/linux/refcount.h:125 net/core/skbuff.c:702) 
[ 1108.802040][ C1] ? __pfx_tcp_write_xmit (net/ipv4/tcp_output.c:2739) 
[ 1108.802547][ C1] ? tcp_set_state (net/ipv4/tcp.c:2870 (discriminator 53)) 
[ 1108.803053][ C1] ? __pfx_tcp_set_state (net/ipv4/tcp.c:2870) 
[ 1108.803343][ C1] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3015) 
[ 1108.803635][ C1] inet_shutdown (net/ipv4/af_inet.c:925) 
[ 1108.803936][ C1] ? sockfd_lookup_light (net/socket.c:557) 
[ 1108.804417][ C1] __sys_shutdown (net/socket.c:2448 net/socket.c:2460) 
[ 1108.804707][ C1] ? __pfx___sys_shutdown (net/socket.c:2454) 
[ 1108.805198][ C1] ? ksys_read (fs/read_write.c:712) 
[ 1108.805497][ C1] ? __pfx_ksys_read (fs/read_write.c:702) 
[ 1108.805790][ C1] __x64_sys_shutdown (net/socket.c:2466) 
[ 1108.806288][ C1] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 1108.806588][ C1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[ 1108.806950][    C1] RIP: 0033:0x7f647cf76beb
[ 1108.807461][ C1] Code: 73 01 c3 48 8b 0d 15 92 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 30 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e5 91 1b 00 f7 d8 64 89 01 48
All code
========
   0:	73 01                	jae    0x3
   2:	c3                   	ret
   3:	48 8b 0d 15 92 1b 00 	mov    0x1b9215(%rip),%rcx        # 0x1b921f
   a:	f7 d8                	neg    %eax
   c:	64 89 01             	mov    %eax,%fs:(%rcx)
   f:	48 83 c8 ff          	or     $0xffffffffffffffff,%rax
  13:	c3                   	ret
  14:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  1b:	00 00 00 
  1e:	90                   	nop
  1f:	f3 0f 1e fa          	endbr64
  23:	b8 30 00 00 00       	mov    $0x30,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax		<-- trapping instruction
  30:	73 01                	jae    0x33
  32:	c3                   	ret
  33:	48 8b 0d e5 91 1b 00 	mov    0x1b91e5(%rip),%rcx        # 0x1b921f
  3a:	f7 d8                	neg    %eax
  3c:	64 89 01             	mov    %eax,%fs:(%rcx)
  3f:	48                   	rex.W

Code starting with the faulting instruction
===========================================
   0:	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax
   6:	73 01                	jae    0x9
   8:	c3                   	ret
   9:	48 8b 0d e5 91 1b 00 	mov    0x1b91e5(%rip),%rcx        # 0x1b91f5
  10:	f7 d8                	neg    %eax
  12:	64 89 01             	mov    %eax,%fs:(%rcx)
  15:	48                   	rex.W
[ 1108.808479][    C1] RSP: 002b:00007ffef74c0868 EFLAGS: 00000202 ORIG_RAX: 0000000000000030
[ 1108.808914][    C1] RAX: ffffffffffffffda RBX: 0000561db1d1f610 RCX: 00007f647cf76beb
[ 1108.809546][    C1] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000008
[ 1108.809998][    C1] RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000000
[ 1108.810429][    C1] R10: 0000000000000000 R11: 0000000000000202 R12: ffffffffffffffff
[ 1108.811059][    C1] R13: 0000000000000000 R14: 0000561d7ae1f10e R15: 0000000000000001
| [ 1108.824782][    C1] Disabling lock debugging due to kernel taint
| [ 1108.825372][    C1] Oops: general protection fault, probably for non-canonical address 0xeb4b474b4b4b4b93: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [ 1108.826262][    C1] KASAN: maybe wild-memory-access in range [0x5a5a5a5a5a5a5c98-0x5a5a5a5a5a5a5c9f]
| [ 1108.827667][    C1] Tainted: [B]=BAD_PAGE
[ 1108.827867][    C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 1108.828667][ C1] RIP: 0010:xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2218) 
[ 1108.829246][ C1] Code: 48 89 44 24 18 0f b7 44 24 06 89 44 24 28 e9 a9 01 00 00 4d 85 ed 0f 84 2f 02 00 00 49 8d bd 3e 02 00 00 48 89 f8 48 c1 e8 03 <0f> b6 14 18 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 8c
All code
========
   0:	48 89 44 24 18       	mov    %rax,0x18(%rsp)
   5:	0f b7 44 24 06       	movzwl 0x6(%rsp),%eax
   a:	89 44 24 28          	mov    %eax,0x28(%rsp)
   e:	e9 a9 01 00 00       	jmp    0x1bc
  13:	4d 85 ed             	test   %r13,%r13
  16:	0f 84 2f 02 00 00    	je     0x24b
  1c:	49 8d bd 3e 02 00 00 	lea    0x23e(%r13),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx		<-- trapping instruction
  2e:	48 89 f8             	mov    %rdi,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 01             	add    $0x1,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 08                	jl     0x43
  3b:	84 d2                	test   %dl,%dl
  3d:	0f                   	.byte 0xf
  3e:	85                   	.byte 0x85
  3f:	8c                   	.byte 0x8c

Code starting with the faulting instruction
===========================================
   0:	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx
   4:	48 89 f8             	mov    %rdi,%rax
   7:	83 e0 07             	and    $0x7,%eax
   a:	83 c0 01             	add    $0x1,%eax
   d:	38 d0                	cmp    %dl,%al
   f:	7c 08                	jl     0x19
  11:	84 d2                	test   %dl,%dl
  13:	0f                   	.byte 0xf
  14:	85                   	.byte 0x85
  15:	8c                   	.byte 0x8c
[ 1108.830459][    C1] RSP: 0018:ffffc900001e8150 EFLAGS: 00010206
[ 1108.831012][    C1] RAX: 0b4b4b4b4b4b4b93 RBX: dffffc0000000000 RCX: ffffffff8a5177d8
[ 1108.831455][    C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 5a5a5a5a5a5a5c98
[ 1108.832068][    C1] RBP: ffff888004ae6008 R08: 0000000000000000 R09: 0000000000000000
[ 1108.832487][    C1] R10: ffffffff8c573ecf R11: 205d314320202020 R12: 0000000000000000
[ 1108.833123][    C1] R13: 5a5a5a5a5a5a5a5a R14: ffff888004ae6008 R15: ffffc900001e8340
[ 1108.833548][    C1] FS:  00007f647cee8740(0000) GS:ffff888036080000(0000) knlGS:0000000000000000
[ 1108.834050][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1108.834425][    C1] CR2: 0000561db1d25b88 CR3: 0000000005456004 CR4: 0000000000772ef0
[ 1108.834834][    C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1108.835469][    C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1108.836114][    C1] PKRU: 55555554
[ 1108.836345][    C1] Call Trace:
[ 1108.836581][    C1]  <IRQ>
[ 1108.836738][ C1] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) 
[ 1108.836980][ C1] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) 
[ 1108.837494][ C1] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) 
[ 1108.837804][ C1] ? xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2213) 
[ 1108.838090][ C1] ? xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2218) 
[ 1108.838586][ C1] ? __pfx_xfrm_sk_policy_lookup (net/xfrm/xfrm_policy.c:2208) 
[ 1108.839171][ C1] ? xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3145) 
[ 1108.839475][ C1] xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3147) 
[ 1108.839988][ C1] ? __pfx_xfrm_lookup_with_ifid (net/xfrm/xfrm_policy.c:3132) 
[ 1108.840368][ C1] ? l4proto_manip_pkt (./include/net/checksum.h:167 net/netfilter/nf_nat_proto.c:216 net/netfilter/nf_nat_proto.c:342) nf_nat
[ 1108.840741][ C1] nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:684) nf_nat
[ 1108.841227][ C1] ? __pfx_nf_xfrm_me_harder (net/netfilter/nf_nat_proto.c:664) nf_nat
[ 1108.841610][ C1] ? nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables
[ 1108.842029][ C1] ? __pfx_nft_do_chain_ipv4 (net/netfilter/nft_chain_filter.c:17) nf_tables
[ 1108.842457][ C1] nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:783 net/netfilter/nf_nat_proto.c:755) nf_nat
[ 1108.842956][ C1] ? __pfx_nf_nat_ipv4_out (net/netfilter/nf_nat_proto.c:757) nf_nat
[ 1108.843334][ C1] nf_hook_slow (./include/linux/netfilter.h:154 net/netfilter/core.c:626) 
[ 1108.843630][ C1] nf_hook (./include/linux/netfilter.h:269) 
[ 1108.844224][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.844509][ C1] ? __pfx_nf_hook (./include/linux/netfilter.h:227) 
[ 1108.844797][ C1] ? __ip_append_data (net/ipv4/ip_output.c:1029) 
[ 1108.845099][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.845424][ C1] ip_output (./include/linux/netfilter.h:301 net/ipv4/ip_output.c:434) 
[ 1108.845663][ C1] ? __pfx_ip_finish_output (net/ipv4/ip_output.c:318) 
[ 1108.845949][ C1] ip_push_pending_frames (./include/net/dst.h:450 net/ipv4/ip_output.c:130 net/ipv4/ip_output.c:1505 net/ipv4/ip_output.c:1525) 
[ 1108.846427][ C1] ip_send_unicast_reply (./include/net/route.h:269 net/ipv4/ip_output.c:1675) 
[ 1108.846742][ C1] ? mark_lock (kernel/locking/lockdep.c:186 kernel/locking/lockdep.c:4731) 
[ 1108.847245][ C1] ? __pfx_ip_send_unicast_reply (net/ipv4/ip_output.c:1605) 
[ 1108.847838][ C1] ? __lock_acquire (kernel/locking/lockdep.c:5202) 
[ 1108.848136][ C1] ? lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5827) 
[ 1108.848433][ C1] ? tcp_v4_send_ack.constprop.0 (./include/linux/local_lock_internal.h:29 net/ipv4/tcp_ipv4.c:1016) 
[ 1108.848802][ C1] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) 
[ 1108.849214][ C1] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) 
[ 1108.849456][ C1] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) 
[ 1108.849679][ C1] tcp_v4_send_ack.constprop.0 (./include/net/net_namespace.h:380 ./include/net/sock.h:661 net/ipv4/tcp_ipv4.c:1030) 
[ 1108.850046][ C1] ? __pfx_tcp_v4_send_ack.constprop.0 (net/ipv4/tcp_ipv4.c:933) 
[ 1108.850283][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.850498][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.850691][ C1] ? tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) 
[ 1108.850968][ C1] tcp_v4_rcv (net/ipv4/tcp_ipv4.c:1086 net/ipv4/tcp_ipv4.c:2427) 
[ 1108.851156][ C1] ? __pfx_tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2177) 
[ 1108.851473][ C1] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5790) 
[ 1108.851697][ C1] ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207 (discriminator 8)) 
[ 1108.851965][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.852148][ C1] ip_local_deliver_finish (./include/linux/rcupdate.h:878 net/ipv4/ip_input.c:234) 
[ 1108.852365][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.852532][ C1] ? __pfx_ip_rcv (net/ipv4/ip_input.c:561) 
[ 1108.852704][ C1] __netif_receive_skb_one_core (net/core/dev.c:5670 (discriminator 4)) 
[ 1108.852906][ C1] ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5663) 
[ 1108.853104][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.853264][ C1] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 1108.853532][ C1] ? process_backlog (./include/linux/local_lock_internal.h:38 net/core/dev.c:6113) 
[ 1108.853729][ C1] process_backlog (./include/linux/rcupdate.h:878 net/core/dev.c:6116) 
[ 1108.853894][ C1] __napi_poll.constprop.0 (net/core/dev.c:6779) 
[ 1108.854053][ C1] net_rx_action (net/core/dev.c:6848 net/core/dev.c:6970) 
[ 1108.854368][ C1] ? __pfx_net_rx_action (net/core/dev.c:6932) 
[ 1108.854527][ C1] ? __lock_release (kernel/locking/lockdep.c:5483) 
[ 1108.854697][ C1] ? rcu_core (kernel/rcu/rcu.h:135 kernel/rcu/tree.c:234 kernel/rcu/tree.c:2810) 
[ 1108.854820][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.854981][ C1] ? trace_rcu_quiescent_state_report (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:570 ./include/linux/cpumask.h:1117 ./include/trace/events/rcu.h:368) 
[ 1108.855285][ C1] ? rcu_report_qs_rnp (kernel/rcu/tree.c:2317 (discriminator 9)) 
[ 1108.855444][ C1] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 1108.855619][ C1] ? mark_lock (kernel/locking/lockdep.c:4703 (discriminator 3)) 
[ 1108.855822][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.856224][ C1] handle_softirqs (kernel/softirq.c:554) 
[ 1108.856389][ C1] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) 
[ 1108.856551][ C1] do_softirq (kernel/softirq.c:455 kernel/softirq.c:442) 
[ 1108.856687][    C1]  </IRQ>
[ 1108.856775][    C1]  <TASK>
[ 1108.856976][ C1] __local_bh_enable_ip (kernel/softirq.c:382) 
[ 1108.857230][ C1] ? __dev_queue_xmit (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:917 net/core/dev.c:4459) 
[ 1108.857416][ C1] __dev_queue_xmit (net/core/dev.c:4460) 
[ 1108.857597][ C1] ? __lock_release (kernel/locking/lockdep.c:5501) 
[ 1108.857779][ C1] ? ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) 
[ 1108.858054][ C1] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 1108.858231][ C1] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 1108.858514][ C1] ? __pfx___dev_queue_xmit (net/core/dev.c:4341) 
[ 1108.858691][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.858858][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) 
[ 1108.859176][ C1] ? neigh_hh_output (./include/linux/seqlock.h:74 ./include/linux/seqlock.h:757 ./include/net/neighbour.h:496) 
[ 1108.859342][ C1] ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:236) 
[ 1108.859502][ C1] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) 
[ 1108.859881][ C1] ? __ip_finish_output (./include/linux/skbuff.h:1669 ./include/linux/skbuff.h:5010 net/ipv4/ip_output.c:308 net/ipv4/ip_output.c:296) 
[ 1108.860052][ C1] __ip_queue_xmit (net/ipv4/ip_output.c:536 (discriminator 4)) 
[ 1108.860223][ C1] ? __skb_clone (./arch/x86/include/asm/atomic.h:53 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:992 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:436 (discriminator 4) net/core/skbuff.c:1605 (discriminator 4)) 
[ 1108.860393][ C1] __tcp_transmit_skb (net/ipv4/tcp_output.c:1466 (discriminator 4)) 
[ 1108.860562][ C1] ? __pfx___tcp_transmit_skb (net/ipv4/tcp_output.c:1287) 
[ 1108.860737][ C1] ? mark_held_locks (kernel/locking/lockdep.c:4321) 
[ 1108.861012][ C1] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406) 
[ 1108.861218][ C1] ? tcp_small_queue_check.isra.0 (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/ipv4/tcp_output.c:2631) 
[ 1108.861429][ C1] tcp_write_xmit (net/ipv4/tcp_output.c:2830) 
[ 1108.861604][ C1] ? tcp_current_mss (./include/net/dst.h:216 net/ipv4/tcp_output.c:1872) 
[ 1108.861764][ C1] ? __pfx_tcp_current_mss (net/ipv4/tcp_output.c:1861) 
[ 1108.861929][ C1] ? __alloc_skb (./arch/x86/include/asm/atomic.h:28 ./include/linux/atomic/atomic-arch-fallback.h:503 ./include/linux/atomic/atomic-instrumented.h:68 ./include/linux/refcount.h:125 net/core/skbuff.c:702) 
[ 1108.862194][ C1] ? __pfx_tcp_write_xmit (net/ipv4/tcp_output.c:2739) 
[ 1108.862354][ C1] ? tcp_set_state (net/ipv4/tcp.c:2870 (discriminator 53)) 
[ 1108.862523][ C1] ? __pfx_tcp_set_state (net/ipv4/tcp.c:2870) 
[ 1108.862711][ C1] __tcp_push_pending_frames (net/ipv4/tcp_output.c:3015) 
[ 1108.862984][ C1] inet_shutdown (net/ipv4/af_inet.c:925) 
[ 1108.863155][ C1] ? sockfd_lookup_light (net/socket.c:557) 
[ 1108.863320][ C1] __sys_shutdown (net/socket.c:2448 net/socket.c:2460) 
[ 1108.863613][ C1] ? __pfx___sys_shutdown (net/socket.c:2454) 
[ 1108.863803][ C1] ? ksys_read (fs/read_write.c:712) 
[ 1108.863976][ C1] ? __pfx_ksys_read (fs/read_write.c:702) 
[ 1108.864279][ C1] __x64_sys_shutdown (net/socket.c:2466) 
[ 1108.864447][ C1] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 1108.864629][ C1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[ 1108.864963][    C1] RIP: 0033:0x7f647cf76beb
[ 1108.865137][ C1] Code: 73 01 c3 48 8b 0d 15 92 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 30 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e5 91 1b 00 f7 d8 64 89 01 48
All code
========
   0:	73 01                	jae    0x3
   2:	c3                   	ret
   3:	48 8b 0d 15 92 1b 00 	mov    0x1b9215(%rip),%rcx        # 0x1b921f
   a:	f7 d8                	neg    %eax
   c:	64 89 01             	mov    %eax,%fs:(%rcx)
   f:	48 83 c8 ff          	or     $0xffffffffffffffff,%rax
  13:	c3                   	ret
  14:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  1b:	00 00 00 
  1e:	90                   	nop
  1f:	f3 0f 1e fa          	endbr64
  23:	b8 30 00 00 00       	mov    $0x30,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax		<-- trapping instruction
  30:	73 01                	jae    0x33
  32:	c3                   	ret
  33:	48 8b 0d e5 91 1b 00 	mov    0x1b91e5(%rip),%rcx        # 0x1b921f
  3a:	f7 d8                	neg    %eax
  3c:	64 89 01             	mov    %eax,%fs:(%rcx)
  3f:	48                   	rex.W

Code starting with the faulting instruction
===========================================
   0:	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax
   6:	73 01                	jae    0x9
   8:	c3                   	ret
   9:	48 8b 0d e5 91 1b 00 	mov    0x1b91e5(%rip),%rcx        # 0x1b91f5
  10:	f7 d8                	neg    %eax
  12:	64 89 01             	mov    %eax,%fs:(%rcx)
  15:	48                   	rex.W
[ 1108.865862][    C1] RSP: 002b:00007ffef74c0868 EFLAGS: 00000202 ORIG_RAX: 0000000000000030
[ 1108.866243][    C1] RAX: ffffffffffffffda RBX: 0000561db1d1f610 RCX: 00007f647cf76beb
[ 1108.866506][    C1] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000008
[ 1108.866764][    C1] RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000000
[ 1108.867019][    C1] R10: 0000000000000000 R11: 0000000000000202 R12: ffffffffffffffff


Finger prints:
xfrm_sk_policy_lookup:xfrm_lookup_with_ifid:nf_xfrm_me_harder:nf_nat_ipv4_out:nf_hook_slow
print_report:kasan_report:xfrm_lookup_with_ifid:nf_xfrm_me_harder:nf_nat_ipv4_out