======================================
| xx__-> [  749.062640][    C5] ==================================================================
| [  749.062847][    C5] BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0 (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:207)
| [  749.063002][    C5] Read of size 4 at addr ff110000262edd98 by task swapper/5/0
| [  749.063163][    C5]
[  749.063221][    C5] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[  749.063223][    C5] Call Trace:
[  749.063225][    C5]  <IRQ>
[  749.063227][    C5]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[  749.063233][    C5]  print_address_description.constprop.0 (mm/kasan/report.c:378)
[  749.063238][    C5]  print_report (mm/kasan/report.c:482)
[  749.063240][    C5]  ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54)
[  749.063245][    C5]  ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[  749.063247][    C5]  kasan_report (mm/kasan/report.c:595)
[  749.063250][    C5]  ? fbnic_tx_lso.isra.0 (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:207)
[  749.063252][    C5]  ? fbnic_tx_lso.isra.0 (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:207)
[  749.063255][    C5]  fbnic_tx_lso.isra.0 (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:207)
[  749.063257][    C5]  fbnic_xmit_frame (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:277 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:438 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:460)
[  749.063259][    C5]  ? fbnic_ring_csr_base (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:49)
[  749.063262][    C5]  dev_hard_start_xmit (./include/linux/netdevice.h:5387 ./include/linux/netdevice.h:5396 net/core/dev.c:3889 net/core/dev.c:3905)
[  749.063265][    C5]  sch_direct_xmit (net/sched/sch_generic.c:372)
[  749.063270][    C5]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  749.063274][    C5]  ? dequeue_skb (./include/trace/events/qdisc.h:14 (discriminator 19))
[  749.063276][    C5]  ? __rcu_read_lock (kernel/rcu/tree_plugin.h:391 (discriminator 7) kernel/rcu/tree_plugin.h:414 (discriminator 7))
[  749.063285][    C5]  ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5831 (discriminator 22))
[  749.063289][    C5]  __dev_xmit_skb (net/core/dev.c:4211)
[  749.063299][    C5]  ? netdev_pick_tx (./include/linux/skbuff.h:1665 net/core/dev.c:3541 net/core/dev.c:4706)
[  749.063302][    C5]  ? alloc_netdev_dummy (net/core/dev.c:12252)
[  749.063308][    C5]  __dev_queue_xmit (net/core/dev.c:4833)
[  749.063310][    C5]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  749.063314][    C5]  ? netdev_core_pick_tx (net/core/dev.c:4733)
[  749.063317][    C5]  ? __asan_memcpy (mm/kasan/shadow.c:106 (discriminator 1))
[  749.063325][    C5]  ? eth_header (net/ethernet/eth.c:99)
[  749.063329][    C5]  ? neigh_resolve_output.part.0 (./include/linux/netdevice.h:3493 net/core/neighbour.c:1611)
[  749.063335][    C5]  neigh_update_process_arp_queue (net/core/neighbour.c:1339 (discriminator 3))
[  749.063338][    C5]  ? __neigh_notify (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:871 (discriminator 2) net/core/neighbour.c:3582 (discriminator 2))
[  749.063341][    C5]  ? neigh_managed_work (./include/net/neighbour.h:475 net/core/neighbour.c:1666)
[  749.063344][    C5]  __neigh_update (net/core/neighbour.c:1522)
[  749.063346][    C5]  ? rcu_read_lock_any_held (./include/linux/lockdep.h:249 kernel/rcu/update.c:386 kernel/rcu/update.c:380)
[  749.063351][    C5]  arp_process.constprop.0 (net/ipv4/arp.c:936 (discriminator 3))
[  749.063356][    C5]  ? do_xdp_generic (net/core/dev.c:5674)
[  749.063358][    C5]  ? fbnic_run_xdp (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:1058 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:1166)
[  749.063360][    C5]  ? arp_send (./include/linux/skbuff.h:1219)
[  749.063362][    C5]  ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  749.063364][    C5]  ? __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
[  749.063368][    C5]  ? common_interrupt (arch/x86/kernel/irq.c:273 (discriminator 39))
[  749.063371][    C5]  ? pv_native_safe_halt (./arch/x86/include/asm/irqflags.h:48 arch/x86/kernel/paravirt.c:63)
[  749.063374][    C5]  ? default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767)
[  749.063377][    C5]  ? default_idle_call (kernel/sched/idle.c:122)
[  749.063379][    C5]  ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:199)
[  749.063381][    C5]  ? do_idle (kernel/sched/idle.c:355)
[  749.063383][    C5]  ? cpu_startup_entry (kernel/sched/idle.c:454)
[  749.063384][    C5]  ? start_secondary (arch/x86/kernel/smpboot.c:312)
[  749.063386][    C5]  ? common_startup_64 (arch/x86/kernel/head_64.S:418)
[  749.063389][    C5]  ? __asan_memset (mm/kasan/shadow.c:84 (discriminator 1))
[  749.063392][    C5]  __netif_receive_skb_list_core (net/core/dev.c:6254 net/core/dev.c:6238 net/core/dev.c:6296)
[  749.063394][    C5]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  749.063396][    C5]  ? __netif_receive_skb_core.constprop.0 (./include/linux/filter.h:807 (discriminator 1) net/core/dev.c:4520 (discriminator 1) net/core/dev.c:6057 (discriminator 1))
[  749.063398][    C5]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  749.063400][    C5]  ? lock_acquire (./include/trace/events/lock.h:23 (discriminator 22) kernel/locking/lockdep.c:5831 (discriminator 22))
[  749.063402][    C5]  netif_receive_skb_list_internal (net/core/dev.c:6348 net/core/dev.c:6439)
[  749.063404][    C5]  ? process_backlog (./include/linux/skbuff.h:2410)
[  749.063405][    C5]  ? dev_gro_receive (./include/linux/instrumented.h:82 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 net/core/gro.c:570)
[  749.063407][    C5]  ? xdp_build_skb_from_buff (net/core/xdp.c:670)
[  749.063409][    C5]  ? sched_clock_cpu (kernel/sched/clock.c:400)
[  749.063412][    C5]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  749.063414][    C5]  ? gro_receive_skb (./include/trace/events/net.h:307 (discriminator 22) net/core/gro.c:646 (discriminator 22))
[  749.063416][    C5]  napi_complete_done (./include/net/gro.h:523 ./include/net/gro.h:519 ./include/net/gro.h:531 net/core/dev.c:6807)
[  749.063418][    C5]  ? netif_receive_skb_list (net/core/dev.c:6493)
[  749.063419][    C5]  ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 2) kernel/locking/lockdep.c:3821 (discriminator 2) kernel/locking/lockdep.c:3876 (discriminator 2))
[  749.063421][    C5]  fbnic_poll (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:1387)
[  749.063424][    C5]  ? ww_mutex_trylock (kernel/locking/mutex.c:850 (discriminator 16))
[  749.063428][    C5]  ? fbnic_clean_twq0 (./include/linux/netdevice.h:2706 (discriminator 1))
[  749.063431][    C5]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535)
[  749.063434][    C5]  __napi_poll (net/core/dev.c:7729)
[  749.063437][    C5]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  749.063441][    C5]  ? __napi_poll (./include/net/gro.h:507)
[  749.063443][    C5]  ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 2) kernel/locking/lockdep.c:3821 (discriminator 2) kernel/locking/lockdep.c:3876 (discriminator 2))
[  749.063445][    C5]  ? rcu_read_lock_any_held (./include/linux/lockdep.h:249 kernel/rcu/update.c:386 kernel/rcu/update.c:380)
[  749.063447][    C5]  ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 2) kernel/locking/lockdep.c:3821 (discriminator 2) kernel/locking/lockdep.c:3876 (discriminator 2))
[  749.063453][    C5]  ? __rwlock_init (kernel/locking/spinlock_debug.c:48)
[  749.063456][    C5]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  749.063459][    C5]  handle_softirqs (kernel/softirq.c:622)
[  749.063463][    C5]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[  749.063466][    C5]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[  749.063469][    C5]  __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
[  749.063472][    C5]  irq_exit_rcu (kernel/softirq.c:752)
[  749.063474][    C5]  common_interrupt (arch/x86/kernel/irq.c:273 (discriminator 39))
[  749.063477][    C5]  </IRQ>
[  749.063478][    C5]  <TASK>
[  749.063479][    C5]  ? sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 (discriminator 37) arch/x86/kernel/apic/apic.c:1062 (discriminator 37))
[  749.063482][    C5]  asm_common_interrupt (./arch/x86/include/asm/idtentry.h:665)
[  749.063486][    C5] RIP: 0010:pv_native_safe_halt (./arch/x86/include/asm/irqflags.h:48 arch/x86/kernel/paravirt.c:63)
[  749.063490][    C5] Code: 48 8b 3d 84 21 5d 02 e8 1f 00 00 00 48 2b 05 48 d2 99 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 03 69 0d 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d 84 21 5d 02 	mov    0x25d2184(%rip),%rdi        # 0x25d218b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 48 d2 99 00 	sub    0x99d248(%rip),%rax        # 0x99d25b
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 03 69 0d 00 	verw   0xd6903(%rip)        # 0xd692b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[  749.063492][    C5] RSP: 0018:ffa000000018fe00 EFLAGS: 00000282
[  749.063497][    C5] RAX: 00000000011327ab RBX: ff11000001cac6c0 RCX: ffffffffa5100767
[  749.063499][    C5] RDX: ff11000001cac6c0 RSI: ffffffffa80b99e0 RDI: ffffffffa7a79140
[  749.063501][    C5] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  749.063503][    C5] R10: 0000000000000005 R11: 0000000000000001 R12: 1ff4000000031fc3
[  749.063504][    C5] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[  749.063507][    C5]  ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:199)
[  749.063511][    C5]  default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767)
[  749.063514][    C5]  default_idle_call (kernel/sched/idle.c:122)
[  749.063517][    C5]  cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:199)
[  749.063519][    C5]  ? arch_cpu_idle_exit+0x40/0x40
[  749.063522][    C5]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:49)
[  749.063525][    C5]  ? default_idle_call (kernel/sched/idle.c:129)
[  749.063527][    C5]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  749.063531][    C5]  do_idle (kernel/sched/idle.c:355)
[  749.063533][    C5]  cpu_startup_entry (kernel/sched/idle.c:454)
[  749.063536][    C5]  start_secondary (arch/x86/kernel/smpboot.c:312)
[  749.063539][    C5]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:733 (discriminator 4))


Finger prints:
print_report:kasan_report:fbnic_xmit_frame:dev_hard_start_xmit:sch_direct_xmit