======================================
| [   10.385241][    C1] ==================================================================
| [   10.385408][    C1] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146)
| [   10.385545][    C1] Read of size 8 at addr ff1100000bf10040 by task ksoftirqd/1/22
| [   10.385673][    C1]
[   10.385722][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   10.385723][    C1] Call Trace:
[   10.385725][    C1]  <TASK>
[   10.385726][    C1]  dump_stack_lvl (lib/dump_stack.c:122)
[   10.385733][    C1]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[   10.385737][    C1]  print_report (mm/kasan/report.c:483)
[   10.385738][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   10.385740][    C1]  ? __virt_addr_valid (./include/linux/rcupdate.h:981 (discriminator 3) ./include/linux/mmzone.h:2197 (discriminator 3) arch/x86/mm/physaddr.c:54 (discriminator 3))
[   10.385745][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   10.385747][    C1]  kasan_report (mm/kasan/report.c:597)
[   10.385751][    C1]  ? dst_dev_put (net/core/dst.c:146)
[   10.385753][    C1]  dst_dev_put (net/core/dst.c:146)
[   10.385755][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[   10.385759][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[   10.385761][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 net/ipv4/fib_semantics.c:229)
[   10.385763][    C1]  ? rcu_do_batch (kernel/rcu/tree.c:2605)
[   10.385767][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 (discriminator 1) kernel/rcu/tree.c:2607 (discriminator 1))
[   10.385769][    C1]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[   10.385771][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.385774][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[   10.385775][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[   10.385777][    C1]  ? trace_x86_fpu_regs_deactivated (./arch/x86/include/asm/trace/fpu.h:52 (discriminator 33))
[   10.385780][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.385782][    C1]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 33))
[   10.385785][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[   10.385786][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[   10.385790][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[   10.385792][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[   10.385796][    C1]  ? tasklet_unlock_wait (kernel/softirq.c:580)
[   10.385798][    C1]  run_ksoftirqd (kernel/softirq.c:479 kernel/softirq.c:1064 kernel/softirq.c:1055)
[   10.385799][    C1]  smpboot_thread_fn (kernel/smpboot.c:160)
[   10.385803][    C1]  ? sort_range (kernel/smpboot.c:103)
[   10.385804][    C1]  kthread (kernel/kthread.c:463)
[   10.385807][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)
[   10.385808][    C1]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[   10.385810][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.385811][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)
[   10.385813][    C1]  ret_from_fork (arch/x86/kernel/process.c:164)
[   10.385815][    C1]  ? arch_exit_to_user_mode_prepare.isra.0 (arch/x86/entry/syscall_64.c:37)
[   10.385817][    C1]  ? __switch_to (./include/linux/thread_info.h:140 (discriminator 2) arch/x86/kernel/process.h:16 (discriminator 2) arch/x86/kernel/process_64.c:676 (discriminator 2))
[   10.385819][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)
[   10.385820][    C1]  ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
| [   10.397723][    C1] Disabling lock debugging due to kernel taint
| [   10.397862][    C1] Oops: general protection fault, probably for non-canonical address 0xe0e1bc3460000008: 0000 [#1] SMP KASAN
| [   10.398061][    C1] KASAN: maybe wild-memory-access in range [0x070e01a300000040-0x070e01a300000047]
| [   10.398373][    C1] Tainted: [B]=BAD_PAGE
[   10.398436][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   10.398574][    C1] RIP: 0010:dst_dev_put (net/core/dst.c:149)
[   10.398661][    C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 2c 02             	test   %ebp,(%rdx,%rax,1)
   f:	00 00                	add    %al,(%rax)
  11:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  18:	fc ff df 
  1b:	48 8b 43 08          	mov    0x8(%rbx),%rax
  1f:	48 8d 78 38          	lea    0x38(%rax),%rdi
  23:	48 89 f9             	mov    %rdi,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)		<-- trapping instruction
  2e:	0f 85 d8 01 00 00    	jne    0x20c
  34:	48 8b 40 38          	mov    0x38(%rax),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	48 89 ee             	mov    %rbp,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)
   4:	0f 85 d8 01 00 00    	jne    0x1e2
   a:	48 8b 40 38          	mov    0x38(%rax),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	48 89 ee             	mov    %rbp,%rsi
[   10.398989][    C1] RSP: 0018:ffa0000000197ad8 EFLAGS: 00010213
[   10.399092][    C1] RAX: 070e01a30000000c RBX: ff1100000bf10040 RCX: 00e1c03460000008
[   10.399212][    C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 070e01a300000044
[   10.399372][    C1] RBP: ff11000010d8fae4 R08: 0000000000000008 R09: fffffbfff470c2c4
[   10.399494][    C1] R10: fffffbfff470c2c5 R11: 0000000000000000 R12: 1fe2200001660b2d
[   10.399655][    C1] R13: 0000000000000000 R14: 0000000000000001 R15: ff1100000b305970
[   10.399782][    C1] FS:  0000000000000000(0000) GS:ff110000c8a8b000(0000) knlGS:0000000000000000
[   10.399927][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   10.400072][    C1] CR2: 00007ffe0b056db8 CR3: 000000001327c001 CR4: 0000000000771ef0
[   10.400198][    C1] PKRU: 55555554
[   10.400260][    C1] Call Trace:
[   10.400322][    C1]  <TASK>
[   10.400401][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[   10.400488][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[   10.400568][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 net/ipv4/fib_semantics.c:229)
[   10.400649][    C1]  ? rcu_do_batch (kernel/rcu/tree.c:2605)
[   10.400766][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 (discriminator 1) kernel/rcu/tree.c:2607 (discriminator 1))
[   10.400851][    C1]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[   10.400936][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.401018][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[   10.401098][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[   10.401202][    C1]  ? trace_x86_fpu_regs_deactivated (./arch/x86/include/asm/trace/fpu.h:52 (discriminator 33))
[   10.401302][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.401383][    C1]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 33))
[   10.401525][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[   10.401624][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[   10.401714][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[   10.401779][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[   10.401896][    C1]  ? tasklet_unlock_wait (kernel/softirq.c:580)
[   10.401979][    C1]  run_ksoftirqd (kernel/softirq.c:479 kernel/softirq.c:1064 kernel/softirq.c:1055)
[   10.402058][    C1]  smpboot_thread_fn (kernel/smpboot.c:160)
[   10.402146][    C1]  ? sort_range (kernel/smpboot.c:103)
[   10.402242][    C1]  kthread (kernel/kthread.c:463)
[   10.402303][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)
[   10.402384][    C1]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[   10.402465][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:751 (discriminator 1))
[   10.402579][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)
[   10.402659][    C1]  ret_from_fork (arch/x86/kernel/process.c:164)
[   10.402743][    C1]  ? arch_exit_to_user_mode_prepare.isra.0 (arch/x86/entry/syscall_64.c:37)
[   10.402849][    C1]  ? __switch_to (./include/linux/thread_info.h:140 (discriminator 2) arch/x86/kernel/process.h:16 (discriminator 2) arch/x86/kernel/process_64.c:676 (discriminator 2))
[   10.402972][    C1]  ? kthread_is_per_cpu (kernel/kthread.c:412)


Finger prints:
print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu
dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core