[ 983.406727][ C2] ================================================================== [ 983.406920][ C2] BUG: KASAN: slab-use-after-free in dst_dev_put+0x298/0x300 [ 983.407063][ C2] Read of size 8 at addr ff1100000b7704c0 by task swapper/2/0 [ 983.407196][ C2] [ 983.407246][ C2] CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.18.0-virtme #1 PREEMPT(full) [ 983.407249][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 983.407251][ C2] Call Trace: [ 983.407253][ C2] [ 983.407254][ C2] dump_stack_lvl+0x6f/0xa0 [ 983.407260][ C2] print_address_description.constprop.0+0x6e/0x300 [ 983.407265][ C2] print_report+0xfc/0x1fb [ 983.407266][ C2] ? dst_dev_put+0x298/0x300 [ 983.407268][ C2] ? __virt_addr_valid+0x1da/0x430 [ 983.407273][ C2] ? dst_dev_put+0x298/0x300 [ 983.407274][ C2] kasan_report+0xe8/0x120 [ 983.407278][ C2] ? dst_dev_put+0x298/0x300 [ 983.407280][ C2] dst_dev_put+0x298/0x300 [ 983.407282][ C2] rt_fibinfo_free_cpus.part.0+0xc6/0x160 [ 983.407286][ C2] fib_nh_common_release+0xe6/0x2d0 [ 983.407288][ C2] free_fib_info_rcu+0x159/0x3b0 [ 983.407290][ C2] ? rcu_do_batch+0x289/0xfe0 [ 983.407294][ C2] rcu_do_batch+0x28b/0xfe0 [ 983.407297][ C2] ? trace_rcu_batch_end+0x270/0x270 [ 983.407299][ C2] ? trace_irq_enable.constprop.0+0xce/0x100 [ 983.407302][ C2] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 983.407304][ C2] ? lockdep_hardirqs_on+0x84/0x130 [ 983.407308][ C2] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 983.407310][ C2] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 983.407312][ C2] rcu_core+0x2b4/0x5f0 [ 983.407314][ C2] handle_softirqs+0x1d7/0x840 [ 983.407318][ C2] ? tasklet_unlock_wait+0x60/0x60 [ 983.407319][ C2] ? __flush_smp_call_function_queue+0x449/0x6d0 [ 983.407323][ C2] irq_exit_rcu+0xa2/0xf0 [ 983.407324][ C2] sysvec_apic_timer_interrupt+0xb1/0xf0 [ 983.407326][ C2] [ 983.407327][ C2] [ 983.407328][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 983.407330][ C2] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 983.407333][ C2] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01 [ 983.407335][ C2] RSP: 0018:ffa0000000147de8 EFLAGS: 00000296 [ 983.407338][ C2] RAX: 0000000002ed7735 RBX: ff11000001ada2c0 RCX: ffffffffa7284c3f [ 983.407339][ C2] RDX: ff11000001ada2c0 RSI: ffffffffaa00ff26 RDI: ffffffffa9a69f80 [ 983.407340][ C2] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 983.407341][ C2] R10: 0000000000000002 R11: 0000000000000001 R12: 1ff4000000028fc0 [ 983.407342][ C2] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 983.407344][ C2] ? cpuidle_idle_call+0x21f/0x340 [ 983.407347][ C2] ? lockdep_hardirqs_on+0x84/0x130 [ 983.407348][ C2] default_idle+0x9/0x10 [ 983.407350][ C2] default_idle_call+0x6c/0xa0 [ 983.407352][ C2] cpuidle_idle_call+0x21f/0x340 [ 983.407353][ C2] ? arch_cpu_idle_exit+0x40/0x40 [ 983.407354][ C2] ? mark_tsc_async_resets+0x30/0x30 [ 983.407357][ C2] ? trace_irq_enable.constprop.0+0xce/0x100 [ 983.407359][ C2] do_idle+0xd9/0x130 [ 983.407360][ C2] cpu_startup_entry+0x53/0x70 [ 983.407362][ C2] start_secondary+0x200/0x2a0 [ 983.407364][ C2] ? set_cpu_sibling_map+0x1d60/0x1d60 [ 983.407366][ C2] common_startup_64+0x13e/0x148 [ 983.407371][ C2] [ 983.407371][ C2] [ 983.412660][ C2] Allocated by task 25591: [ 983.412753][ C2] kasan_save_stack+0x30/0x50 [ 983.412847][ C2] kasan_save_track+0x14/0x30 [ 983.412933][ C2] __kasan_slab_alloc+0x5f/0x70 [ 983.413023][ C2] kmem_cache_alloc_noprof+0x218/0x6e0 [ 983.413117][ C2] dst_alloc+0x79/0x160 [ 983.413187][ C2] rt_dst_alloc+0x35/0x3a0 [ 983.413281][ C2] __mkroute_output+0x456/0x1070 [ 983.413373][ C2] ip_route_output_key_hash+0xfa/0x220 [ 983.413465][ C2] ip_route_output_flow+0x21/0x150 [ 983.413557][ C2] udp_tunnel_dst_lookup+0x22e/0x380 [ 983.413654][ C2] vxlan_xmit_one+0x16ca/0x4230 [vxlan] [ 983.413749][ C2] vxlan_xmit+0x8cb/0x11e0 [vxlan] [ 983.413843][ C2] dev_hard_start_xmit+0xfc/0x540 [ 983.413933][ C2] __dev_queue_xmit+0x155e/0x1a10 [ 983.414022][ C2] packet_snd+0xf93/0x1980 [ 983.414113][ C2] __sys_sendto+0x265/0x390 [ 983.414202][ C2] __x64_sys_sendto+0xe4/0x1f0 [ 983.414297][ C2] do_syscall_64+0xbd/0xfc0 [ 983.414390][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 983.414498][ C2] [ 983.414544][ C2] Freed by task 12: [ 983.414612][ C2] kasan_save_stack+0x30/0x50 [ 983.414705][ C2] kasan_save_track+0x14/0x30 [ 983.414798][ C2] __kasan_save_free_info+0x3b/0x60 [ 983.414886][ C2] __kasan_slab_free+0x43/0x70 [ 983.414976][ C2] kmem_cache_free+0xfe/0x5e0 [ 983.415064][ C2] dst_destroy+0x221/0x340 [ 983.415155][ C2] rcu_do_batch+0x28b/0xfe0 [ 983.415253][ C2] rcu_core+0x2b4/0x5f0 [ 983.415319][ C2] handle_softirqs+0x1d7/0x840 [ 983.415409][ C2] do_softirq+0xa9/0xe0 [ 983.415478][ C2] __local_bh_enable_ip+0x111/0x140 [ 983.415569][ C2] addrconf_ifdown.isra.0+0xa73/0x1610 [ 983.415659][ C2] addrconf_notify+0x2c8/0xf20 [ 983.415751][ C2] notifier_call_chain+0x9a/0x290 [ 983.415851][ C2] netif_close_many+0x2c9/0x640 [ 983.415945][ C2] unregister_netdevice_many_notify+0x705/0x20a0 [ 983.416053][ C2] ops_undo_list+0x620/0x8f0 [ 983.416140][ C2] cleanup_net+0x3bc/0x890 [ 983.416227][ C2] process_one_work+0xd57/0x1390 [ 983.416314][ C2] worker_thread+0x4d6/0xd40 [ 983.416400][ C2] kthread+0x355/0x5b0 [ 983.416466][ C2] ret_from_fork+0x3fb/0x510 [ 983.416552][ C2] ret_from_fork_asm+0x11/0x20 [ 983.416642][ C2] [ 983.416686][ C2] Last potentially related work creation: [ 983.416777][ C2] kasan_save_stack+0x30/0x50 [ 983.416867][ C2] kasan_record_aux_stack+0x8c/0xa0 [ 983.416955][ C2] __call_rcu_common.constprop.0+0xa6/0xa00 [ 983.417064][ C2] dst_cache_destroy+0xea/0x1d0 [ 983.417153][ C2] vxlan_fdb_free+0x109/0x1c0 [vxlan] [ 983.417245][ C2] rcu_do_batch+0x28b/0xfe0 [ 983.417333][ C2] rcu_core+0x2b4/0x5f0 [ 983.417399][ C2] handle_softirqs+0x1d7/0x840 [ 983.417485][ C2] run_ksoftirqd+0x39/0x60 [ 983.417572][ C2] smpboot_thread_fn+0x2fb/0x9b0 [ 983.417660][ C2] kthread+0x355/0x5b0 [ 983.417726][ C2] ret_from_fork+0x3fb/0x510 [ 983.417818][ C2] ret_from_fork_asm+0x11/0x20 [ 983.417909][ C2] [ 983.417954][ C2] The buggy address belongs to the object at ff1100000b7704c0 [ 983.417954][ C2] which belongs to the cache rtable of size 184 [ 983.418171][ C2] The buggy address is located 0 bytes inside of [ 983.418171][ C2] freed 184-byte region [ff1100000b7704c0, ff1100000b770578) [ 983.418388][ C2] [ 983.418435][ C2] The buggy address belongs to the physical page: [ 983.418549][ C2] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff1100000b7707c0 pfn:0xb770 [ 983.418727][ C2] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 983.418865][ C2] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 983.418977][ C2] page_type: f5(slab) [ 983.419046][ C2] raw: 0080000000000240 ff1100000542fc40 ffd4000000429410 ff110000051b75c8 [ 983.419208][ C2] raw: ff1100000b7707c0 0000000000150005 00000000f5000000 0000000000000000 [ 983.419364][ C2] head: 0080000000000240 ff1100000542fc40 ffd4000000429410 ff110000051b75c8 [ 983.419520][ C2] head: ff1100000b7707c0 0000000000150005 00000000f5000000 0000000000000000 [ 983.419673][ C2] head: 0080000000000001 ffd40000002ddc01 00000000ffffffff 00000000ffffffff [ 983.419833][ C2] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 983.419988][ C2] page dumped because: kasan: bad access detected [ 983.420097][ C2] [ 983.420142][ C2] Memory state around the buggy address: [ 983.420230][ C2] ff1100000b770380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 983.420362][ C2] ff1100000b770400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 983.420491][ C2] >ff1100000b770480: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 983.420620][ C2] ^ [ 983.420729][ C2] ff1100000b770500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 983.420866][ C2] ff1100000b770580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 983.420997][ C2] ================================================================== [ 983.421183][ C2] Disabling lock debugging due to kernel taint [ 983.421351][ C2] Oops: general protection fault, probably for non-canonical address 0xe0bf3c6b20000008: 0000 [#1] SMP KASAN [ 983.421558][ C2] KASAN: maybe wild-memory-access in range [0x05fa035900000040-0x05fa035900000047] [ 983.421712][ C2] CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Tainted: G B 6.18.0-virtme #1 PREEMPT(full) [ 983.421889][ C2] Tainted: [B]=BAD_PAGE [ 983.421955][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 983.422064][ C2] RIP: 0010:dst_dev_put+0x9f/0x300 [ 983.422156][ C2] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee [ 983.422505][ C2] RSP: 0018:ffa0000000218d10 EFLAGS: 00010213 [ 983.422617][ C2] RAX: 05fa03590000000c RBX: ff1100000b7704c0 RCX: 00bf406b20000008 [ 983.422746][ C2] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 05fa035900000044 [ 983.422919][ C2] RBP: ff1100000f000d70 R08: 0000000000000008 R09: fffffbfff57cc2c4 [ 983.423048][ C2] R10: fffffbfff57cc2c5 R11: 0000000000000000 R12: 1fe220000193d74d [ 983.423176][ C2] R13: 0000000000000003 R14: 0000000000000001 R15: ff1100000c9eba70 [ 983.423347][ C2] FS: 0000000000000000(0000) GS:ff110000c050b000(0000) knlGS:0000000000000000 [ 983.423510][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 983.423659][ C2] CR2: 000055f17cee3818 CR3: 0000000012828002 CR4: 0000000000771ef0 [ 983.423794][ C2] PKRU: 55555554 [ 983.423859][ C2] Call Trace: [ 983.423925][ C2] [ 983.423971][ C2] rt_fibinfo_free_cpus.part.0+0xc6/0x160 [ 983.424102][ C2] fib_nh_common_release+0xe6/0x2d0 [ 983.424190][ C2] free_fib_info_rcu+0x159/0x3b0 [ 983.424276][ C2] ? rcu_do_batch+0x289/0xfe0 [ 983.424363][ C2] rcu_do_batch+0x28b/0xfe0 [ 983.424490][ C2] ? trace_rcu_batch_end+0x270/0x270 [ 983.424577][ C2] ? trace_irq_enable.constprop.0+0xce/0x100 [ 983.424687][ C2] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 983.424840][ C2] ? lockdep_hardirqs_on+0x84/0x130 [ 983.424927][ C2] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 983.425034][ C2] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 983.425142][ C2] rcu_core+0x2b4/0x5f0 [ 983.425249][ C2] handle_softirqs+0x1d7/0x840 [ 983.425337][ C2] ? tasklet_unlock_wait+0x60/0x60 [ 983.425424][ C2] ? __flush_smp_call_function_queue+0x449/0x6d0 [ 983.425535][ C2] irq_exit_rcu+0xa2/0xf0 [ 983.425640][ C2] sysvec_apic_timer_interrupt+0xb1/0xf0 [ 983.425727][ C2] [ 983.425775][ C2] [ 983.425821][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 983.425929][ C2] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 983.426062][ C2] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01 [ 983.426398][ C2] RSP: 0018:ffa0000000147de8 EFLAGS: 00000296 [ 983.426507][ C2] RAX: 0000000002ed7735 RBX: ff11000001ada2c0 RCX: ffffffffa7284c3f [ 983.426638][ C2] RDX: ff11000001ada2c0 RSI: ffffffffaa00ff26 RDI: ffffffffa9a69f80 [ 983.426818][ C2] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 983.426946][ C2] R10: 0000000000000002 R11: 0000000000000001 R12: 1ff4000000028fc0 [ 983.427075][ C2] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 983.427242][ C2] ? cpuidle_idle_call+0x21f/0x340 [ 983.427329][ C2] ? lockdep_hardirqs_on+0x84/0x130 [ 983.427416][ C2] default_idle+0x9/0x10 [ 983.427480][ C2] default_idle_call+0x6c/0xa0 [ 983.427646][ C2] cpuidle_idle_call+0x21f/0x340 [ 983.427733][ C2] ? arch_cpu_idle_exit+0x40/0x40 [ 983.427821][ C2] ? mark_tsc_async_resets+0x30/0x30 [ 983.427906][ C2] ? trace_irq_enable.constprop.0+0xce/0x100 [ 983.428052][ C2] do_idle+0xd9/0x130 [ 983.428117][ C2] cpu_startup_entry+0x53/0x70 [ 983.428205][ C2] start_secondary+0x200/0x2a0 [ 983.428290][ C2] ? set_cpu_sibling_map+0x1d60/0x1d60 [ 983.428415][ C2] common_startup_64+0x13e/0x148 [ 983.428506][ C2] [ 983.428571][ C2] Modules linked in: sch_etf sch_fq ip6t_rpfilter act_mirred act_tunnel_key bareudp mpls_gso mpls_iptunnel mpls_router act_gact cls_flower sch_ingress xt_conntrack nf_conntrack nf_defrag_ipv4 nft_compat nf_tables nf_defrag_ipv6 vxlan [last unloaded: psample] [ 983.429051][ C2] ---[ end trace 0000000000000000 ]--- [ 983.429223][ C2] RIP: 0010:dst_dev_put+0x9f/0x300 [ 983.429359][ C2] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee [ 983.429714][ C2] RSP: 0018:ffa0000000218d10 EFLAGS: 00010213 [ 983.429876][ C2] RAX: 05fa03590000000c RBX: ff1100000b7704c0 RCX: 00bf406b20000008 [ 983.430049][ C2] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 05fa035900000044 [ 983.430264][ C2] RBP: ff1100000f000d70 R08: 0000000000000008 R09: fffffbfff57cc2c4 [ 983.430443][ C2] R10: fffffbfff57cc2c5 R11: 0000000000000000 R12: 1fe220000193d74d [ 983.430629][ C2] R13: 0000000000000003 R14: 0000000000000001 R15: ff1100000c9eba70 [ 983.430808][ C2] FS: 0000000000000000(0000) GS:ff110000c050b000(0000) knlGS:0000000000000000 [ 983.431008][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 983.431204][ C2] CR2: 000055f17cee3818 CR3: 0000000012828002 CR4: 0000000000771ef0 [ 983.431384][ C2] PKRU: 55555554 [ 983.431494][ C2] Kernel panic - not syncing: Fatal exception in interrupt [ 983.431821][ C2] Kernel Offset: 0x25a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 983.432021][ C2] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr WAIT TIMEOUT stderr