[ 9.129772][ T256] GACT probability NOT on [ 9.136999][ T254] tc (254) used greatest stack depth: 24520 bytes left [ 11.149960][ C1] ================================================================== [ 11.150134][ C1] BUG: KASAN: slab-use-after-free in dst_dev_put+0x298/0x300 [ 11.150271][ C1] Read of size 8 at addr ff11000010eb81c0 by task swapper/1/0 [ 11.150399][ C1] [ 11.150446][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 11.150449][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 11.150450][ C1] Call Trace: [ 11.150452][ C1] [ 11.150454][ C1] dump_stack_lvl+0x6f/0xa0 [ 11.150460][ C1] print_address_description.constprop.0+0x6e/0x300 [ 11.150464][ C1] print_report+0xfc/0x1fb [ 11.150465][ C1] ? dst_dev_put+0x298/0x300 [ 11.150467][ C1] ? __virt_addr_valid+0x1da/0x430 [ 11.150471][ C1] ? dst_dev_put+0x298/0x300 [ 11.150473][ C1] kasan_report+0xe8/0x120 [ 11.150477][ C1] ? dst_dev_put+0x298/0x300 [ 11.150479][ C1] dst_dev_put+0x298/0x300 [ 11.150481][ C1] rt_fibinfo_free_cpus.part.0+0xc6/0x160 [ 11.150484][ C1] fib_nh_common_release+0xe6/0x2d0 [ 11.150486][ C1] free_fib_info_rcu+0x159/0x3b0 [ 11.150488][ C1] ? rcu_do_batch+0x289/0xfe0 [ 11.150492][ C1] rcu_do_batch+0x28b/0xfe0 [ 11.150494][ C1] ? rcu_start_this_gp+0x3a7/0x470 [ 11.150496][ C1] ? trace_rcu_batch_end+0x270/0x270 [ 11.150499][ C1] ? trace_irq_enable.constprop.0+0xce/0x100 [ 11.150502][ C1] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 11.150504][ C1] ? lockdep_hardirqs_on+0x84/0x130 [ 11.150508][ C1] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 11.150510][ C1] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 11.150512][ C1] rcu_core+0x2b4/0x5f0 [ 11.150513][ C1] handle_softirqs+0x1d7/0x840 [ 11.150517][ C1] ? tasklet_unlock_wait+0x60/0x60 [ 11.150518][ C1] ? do_raw_spin_unlock+0x59/0x250 [ 11.150520][ C1] irq_exit_rcu+0xa2/0xf0 [ 11.150522][ C1] sysvec_apic_timer_interrupt+0xb1/0xf0 [ 11.150524][ C1] [ 11.150524][ C1] [ 11.150525][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 11.150527][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 11.150530][ C1] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01 [ 11.150532][ C1] RSP: 0018:ffa0000000137de8 EFLAGS: 00000296 [ 11.150535][ C1] RAX: 0000000000083411 RBX: ff11000001ad8040 RCX: ffffffff82a84c3f [ 11.150536][ C1] RDX: ff11000001ad8040 RSI: ffffffff8580ff1e RDI: ffffffff85269f80 [ 11.150537][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 11.150538][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 1ff4000000026fc0 [ 11.150539][ C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 11.150541][ C1] ? cpuidle_idle_call+0x21f/0x340 [ 11.150543][ C1] ? lockdep_hardirqs_on+0x84/0x130 [ 11.150545][ C1] default_idle+0x9/0x10 [ 11.150547][ C1] default_idle_call+0x6c/0xa0 [ 11.150548][ C1] cpuidle_idle_call+0x21f/0x340 [ 11.150550][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 11.150551][ C1] ? mark_tsc_async_resets+0x30/0x30 [ 11.150554][ C1] do_idle+0xd9/0x130 [ 11.150556][ C1] cpu_startup_entry+0x53/0x70 [ 11.150558][ C1] start_secondary+0x200/0x2a0 [ 11.150559][ C1] ? set_cpu_sibling_map+0x1d60/0x1d60 [ 11.150561][ C1] common_startup_64+0x13e/0x148 [ 11.150565][ C1] [ 11.150566][ C1] [ 11.155760][ C1] Allocated by task 360: [ 11.155828][ C1] kasan_save_stack+0x30/0x50 [ 11.155920][ C1] kasan_save_track+0x14/0x30 [ 11.156006][ C1] __kasan_slab_alloc+0x5f/0x70 [ 11.156094][ C1] kmem_cache_alloc_noprof+0x218/0x6e0 [ 11.156184][ C1] dst_alloc+0x79/0x160 [ 11.156251][ C1] rt_dst_alloc+0x35/0x3a0 [ 11.156340][ C1] __mkroute_output+0x456/0x1070 [ 11.156429][ C1] ip_route_output_key_hash+0xfa/0x220 [ 11.156519][ C1] ip_route_output_flow+0x21/0x150 [ 11.156607][ C1] udp_tunnel_dst_lookup+0x22e/0x380 [ 11.156697][ C1] vxlan_xmit_one+0x16ca/0x4230 [vxlan] [ 11.156789][ C1] vxlan_xmit+0x8cb/0x11e0 [vxlan] [ 11.156890][ C1] dev_hard_start_xmit+0xfc/0x540 [ 11.156977][ C1] __dev_queue_xmit+0x155e/0x1a10 [ 11.157065][ C1] packet_snd+0xf93/0x1980 [ 11.157153][ C1] __sys_sendto+0x265/0x390 [ 11.157242][ C1] __x64_sys_sendto+0xe4/0x1f0 [ 11.157337][ C1] do_syscall_64+0xbd/0xfc0 [ 11.157427][ C1] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 11.157534][ C1] [ 11.157580][ C1] Freed by task 12: [ 11.157646][ C1] kasan_save_stack+0x30/0x50 [ 11.157735][ C1] kasan_save_track+0x14/0x30 [ 11.157824][ C1] __kasan_save_free_info+0x3b/0x60 [ 11.157915][ C1] __kasan_slab_free+0x43/0x70 [ 11.158003][ C1] kmem_cache_free+0xfe/0x5e0 [ 11.158090][ C1] dst_destroy+0x221/0x340 [ 11.158176][ C1] rcu_do_batch+0x28b/0xfe0 [ 11.158265][ C1] rcu_core+0x2b4/0x5f0 [ 11.158330][ C1] handle_softirqs+0x1d7/0x840 [ 11.158421][ C1] do_softirq+0xa9/0xe0 [ 11.158490][ C1] __local_bh_enable_ip+0x111/0x140 [ 11.158585][ C1] addrconf_ifdown.isra.0+0x4b7/0x1610 [ 11.158671][ C1] addrconf_notify+0x2c8/0xf20 [ 11.158759][ C1] notifier_call_chain+0x9a/0x290 [ 11.158847][ C1] netif_close_many+0x2c9/0x640 [ 11.158940][ C1] unregister_netdevice_many_notify+0x705/0x20a0 [ 11.159057][ C1] ops_undo_list+0x620/0x8f0 [ 11.159145][ C1] cleanup_net+0x3bc/0x890 [ 11.159234][ C1] process_one_work+0xd57/0x1390 [ 11.159327][ C1] worker_thread+0x4d6/0xd40 [ 11.159412][ C1] kthread+0x355/0x5b0 [ 11.159477][ C1] ret_from_fork+0x3fb/0x510 [ 11.159566][ C1] ret_from_fork_asm+0x11/0x20 [ 11.159655][ C1] [ 11.159700][ C1] Last potentially related work creation: [ 11.159787][ C1] kasan_save_stack+0x30/0x50 [ 11.159883][ C1] kasan_record_aux_stack+0x8c/0xa0 [ 11.159971][ C1] __call_rcu_common.constprop.0+0xa6/0xa00 [ 11.160082][ C1] dst_cache_destroy+0xea/0x1d0 [ 11.160170][ C1] vxlan_fdb_free+0x109/0x1c0 [vxlan] [ 11.160262][ C1] rcu_do_batch+0x28b/0xfe0 [ 11.160350][ C1] rcu_core+0x2b4/0x5f0 [ 11.160416][ C1] handle_softirqs+0x1d7/0x840 [ 11.160501][ C1] irq_exit_rcu+0xa2/0xf0 [ 11.160569][ C1] sysvec_apic_timer_interrupt+0xb1/0xf0 [ 11.160656][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 11.160764][ C1] [ 11.160809][ C1] The buggy address belongs to the object at ff11000010eb81c0 [ 11.160809][ C1] which belongs to the cache rtable of size 184 [ 11.161026][ C1] The buggy address is located 0 bytes inside of [ 11.161026][ C1] freed 184-byte region [ff11000010eb81c0, ff11000010eb8278) [ 11.161241][ C1] [ 11.161287][ C1] The buggy address belongs to the physical page: [ 11.161404][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff11000010eb8040 pfn:0x10eb8 [ 11.161587][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 11.161719][ C1] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 11.161833][ C1] page_type: f5(slab) [ 11.161905][ C1] raw: 0080000000000240 ff11000005377c40 ff110000050c15c8 ff110000050c15c8 [ 11.162066][ C1] raw: ff11000010eb8040 0000000000150001 00000000f5000000 0000000000000000 [ 11.162220][ C1] head: 0080000000000240 ff11000005377c40 ff110000050c15c8 ff110000050c15c8 [ 11.162377][ C1] head: ff11000010eb8040 0000000000150001 00000000f5000000 0000000000000000 [ 11.162530][ C1] head: 0080000000000001 ffd400000043ae01 00000000ffffffff 00000000ffffffff [ 11.162684][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 11.162838][ C1] page dumped because: kasan: bad access detected [ 11.162952][ C1] [ 11.162997][ C1] Memory state around the buggy address: [ 11.163083][ C1] ff11000010eb8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 11.163213][ C1] ff11000010eb8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.163348][ C1] >ff11000010eb8180: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 11.163485][ C1] ^ [ 11.163591][ C1] ff11000010eb8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 11.163720][ C1] ff11000010eb8280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.163850][ C1] ================================================================== [ 11.164037][ C1] Disabling lock debugging due to kernel taint [ 11.164164][ C1] Oops: general protection fault, probably for non-canonical address 0xe0c53c36c0000008: 0000 [#1] SMP KASAN [ 11.164366][ C1] KASAN: maybe wild-memory-access in range [0x062a01b600000040-0x062a01b600000047] [ 11.164558][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 11.164728][ C1] Tainted: [B]=BAD_PAGE [ 11.164796][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 11.164906][ C1] RIP: 0010:dst_dev_put+0x9f/0x300 [ 11.164997][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee [ 11.165343][ C1] RSP: 0018:ffa00000001c0d10 EFLAGS: 00010213 [ 11.165452][ C1] RAX: 062a01b60000000c RBX: ff11000010eb81c0 RCX: 00c54036c0000008 [ 11.165619][ C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 062a01b600000044 [ 11.165747][ C1] RBP: ff11000011933c10 R08: 0000000000000008 R09: fffffbfff0ecc2c4 [ 11.165877][ C1] R10: fffffbfff0ecc2c5 R11: 0000000000000000 R12: 1fe220000218a44d [ 11.166043][ C1] R13: 0000000000000003 R14: 0000000000000001 R15: ff11000010c52270 [ 11.166172][ C1] FS: 0000000000000000(0000) GS:ff110000e4c8b000(0000) knlGS:0000000000000000 [ 11.166360][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 11.166468][ C1] CR2: 00007f0a44f79db4 CR3: 0000000048948003 CR4: 0000000000771ef0 [ 11.166596][ C1] PKRU: 55555554 [ 11.166700][ C1] Call Trace: [ 11.166767][ C1] [ 11.166812][ C1] rt_fibinfo_free_cpus.part.0+0xc6/0x160 [ 11.166908][ C1] fib_nh_common_release+0xe6/0x2d0 [ 11.166994][ C1] free_fib_info_rcu+0x159/0x3b0 [ 11.167125][ C1] ? rcu_do_batch+0x289/0xfe0 [ 11.167216][ C1] rcu_do_batch+0x28b/0xfe0 [ 11.167302][ C1] ? rcu_start_this_gp+0x3a7/0x470 [ 11.167388][ C1] ? trace_rcu_batch_end+0x270/0x270 [ 11.167514][ C1] ? trace_irq_enable.constprop.0+0xce/0x100 [ 11.167621][ C1] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 11.167728][ C1] ? lockdep_hardirqs_on+0x84/0x130 [ 11.167816][ C1] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 11.167927][ C1] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 11.168038][ C1] rcu_core+0x2b4/0x5f0 [ 11.168103][ C1] handle_softirqs+0x1d7/0x840 [ 11.168191][ C1] ? tasklet_unlock_wait+0x60/0x60 [ 11.168277][ C1] ? do_raw_spin_unlock+0x59/0x250 [ 11.168364][ C1] irq_exit_rcu+0xa2/0xf0 [ 11.168429][ C1] sysvec_apic_timer_interrupt+0xb1/0xf0 [ 11.168516][ C1] [ 11.168561][ C1] [ 11.168604][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 11.168709][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 11.168798][ C1] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01 [ 11.169102][ C1] RSP: 0018:ffa0000000137de8 EFLAGS: 00000296 [ 11.169210][ C1] RAX: 0000000000083411 RBX: ff11000001ad8040 RCX: ffffffff82a84c3f [ 11.169337][ C1] RDX: ff11000001ad8040 RSI: ffffffff8580ff1e RDI: ffffffff85269f80 [ 11.169465][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 11.169595][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 1ff4000000026fc0 [ 11.169722][ C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 11.169852][ C1] ? cpuidle_idle_call+0x21f/0x340 [ 11.169942][ C1] ? lockdep_hardirqs_on+0x84/0x130 [ 11.170027][ C1] default_idle+0x9/0x10 [ 11.170094][ C1] default_idle_call+0x6c/0xa0 [ 11.170179][ C1] cpuidle_idle_call+0x21f/0x340 [ 11.170264][ C1] ? arch_cpu_idle_exit+0x40/0x40 [ 11.170353][ C1] ? mark_tsc_async_resets+0x30/0x30 [ 11.170441][ C1] do_idle+0xd9/0x130 [ 11.170506][ C1] cpu_startup_entry+0x53/0x70 [ 11.170596][ C1] start_secondary+0x200/0x2a0 [ 11.170685][ C1] ? set_cpu_sibling_map+0x1d60/0x1d60 [ 11.170774][ C1] common_startup_64+0x13e/0x148 [ 11.170861][ C1] [ 11.170932][ C1] Modules linked in: vxlan act_gact cls_flower sch_ingress [ 11.171078][ C1] ---[ end trace 0000000000000000 ]--- [ 11.171171][ C1] RIP: 0010:dst_dev_put+0x9f/0x300 [ 11.171259][ C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee [ 11.171559][ C1] RSP: 0018:ffa00000001c0d10 EFLAGS: 00010213 [ 11.171668][ C1] RAX: 062a01b60000000c RBX: ff11000010eb81c0 RCX: 00c54036c0000008 [ 11.171801][ C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 062a01b600000044 [ 11.171933][ C1] RBP: ff11000011933c10 R08: 0000000000000008 R09: fffffbfff0ecc2c4 [ 11.172067][ C1] R10: fffffbfff0ecc2c5 R11: 0000000000000000 R12: 1fe220000218a44d [ 11.172194][ C1] R13: 0000000000000003 R14: 0000000000000001 R15: ff11000010c52270 [ 11.172324][ C1] FS: 0000000000000000(0000) GS:ff110000e4c8b000(0000) knlGS:0000000000000000 [ 11.172476][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 11.172590][ C1] CR2: 00007f0a44f79db4 CR3: 0000000048948003 CR4: 0000000000771ef0 [ 11.172718][ C1] PKRU: 55555554 [ 11.173016][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 11.173231][ C1] Kernel Offset: 0x1200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 11.173428][ C1] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr