[ 805.952065][T11679] GACT probability NOT on
[ 808.007067][ C3] ==================================================================
[ 808.007255][ C3] BUG: KASAN: slab-use-after-free in dst_dev_put+0x298/0x300
[ 808.007419][ C3] Read of size 8 at addr ff1100000ec12940 by task swapper/3/0
[ 808.007572][ C3]
[ 808.007624][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.18.0-virtme #1 PREEMPT(full)
[ 808.007627][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 808.007629][ C3] Call Trace:
[ 808.007631][ C3]
[ 808.007632][ C3] dump_stack_lvl+0x6f/0xa0
[ 808.007639][ C3] print_address_description.constprop.0+0x6e/0x300
[ 808.007643][ C3] print_report+0xfc/0x1fb
[ 808.007645][ C3] ? dst_dev_put+0x298/0x300
[ 808.007647][ C3] ? __virt_addr_valid+0x1da/0x430
[ 808.007651][ C3] ? dst_dev_put+0x298/0x300
[ 808.007653][ C3] kasan_report+0xe8/0x120
[ 808.007657][ C3] ? dst_dev_put+0x298/0x300
[ 808.007659][ C3] dst_dev_put+0x298/0x300
[ 808.007661][ C3] rt_fibinfo_free_cpus.part.0+0xc6/0x160
[ 808.007665][ C3] fib_nh_common_release+0xe6/0x2d0
[ 808.007667][ C3] free_fib_info_rcu+0x159/0x3b0
[ 808.007669][ C3] ? rcu_do_batch+0x289/0xfe0
[ 808.007672][ C3] rcu_do_batch+0x28b/0xfe0
[ 808.007675][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 808.007678][ C3] ? trace_irq_enable.constprop.0+0xce/0x100
[ 808.007681][ C3] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160
[ 808.007683][ C3] ? lockdep_hardirqs_on+0x84/0x130
[ 808.007687][ C3] ? _raw_spin_unlock_irqrestore+0x53/0x80
[ 808.007689][ C3] ? _raw_spin_unlock_irqrestore+0x40/0x80
[ 808.007691][ C3] rcu_core+0x2b4/0x5f0
[ 808.007692][ C3] handle_softirqs+0x1d7/0x840
[ 808.007696][ C3] ? tasklet_unlock_wait+0x60/0x60
[ 808.007697][ C3] ? __flush_smp_call_function_queue+0x449/0x6d0
[ 808.007701][ C3] irq_exit_rcu+0xa2/0xf0
[ 808.007703][ C3] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 808.007705][ C3]
[ 808.007705][ C3]
[ 808.007706][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 808.007709][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 808.007712][ C3] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
[ 808.007714][ C3] RSP: 0018:ffa0000000157de8 EFLAGS: 00000296
[ 808.007717][ C3] RAX: 0000000001b0da8b RBX: ff11000001adc540 RCX: ffffffff94084c3f
[ 808.007718][ C3] RDX: ff11000001adc540 RSI: ffffffff96e0ff26 RDI: ffffffff96869f80
[ 808.007719][ C3] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 808.007720][ C3] R10: 0000000000000003 R11: 0000000000000001 R12: 1ff400000002afc0
[ 808.007721][ C3] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 808.007723][ C3] ? cpuidle_idle_call+0x21f/0x340
[ 808.007726][ C3] ? lockdep_hardirqs_on+0x84/0x130
[ 808.007728][ C3] default_idle+0x9/0x10
[ 808.007730][ C3] default_idle_call+0x6c/0xa0
[ 808.007732][ C3] cpuidle_idle_call+0x21f/0x340
[ 808.007733][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 808.007734][ C3] ? mark_tsc_async_resets+0x30/0x30
[ 808.007737][ C3] ? trace_irq_enable.constprop.0+0xce/0x100
[ 808.007739][ C3] do_idle+0xd9/0x130
[ 808.007741][ C3] cpu_startup_entry+0x53/0x70
[ 808.007742][ C3] start_secondary+0x200/0x2a0
[ 808.007744][ C3] ? set_cpu_sibling_map+0x1d60/0x1d60
[ 808.007746][ C3] common_startup_64+0x13e/0x148
[ 808.007751][ C3]
[ 808.007752][ C3]
[ 808.013363][ C3] Allocated by task 11785:
[ 808.013456][ C3] kasan_save_stack+0x30/0x50
[ 808.013556][ C3] kasan_save_track+0x14/0x30
[ 808.013652][ C3] __kasan_slab_alloc+0x5f/0x70
[ 808.013743][ C3] kmem_cache_alloc_noprof+0x218/0x6e0
[ 808.013836][ C3] dst_alloc+0x79/0x160
[ 808.013907][ C3] rt_dst_alloc+0x35/0x3a0
[ 808.014000][ C3] __mkroute_output+0x456/0x1070
[ 808.014095][ C3] ip_route_output_key_hash+0xfa/0x220
[ 808.014189][ C3] ip_route_output_flow+0x21/0x150
[ 808.014286][ C3] udp_tunnel_dst_lookup+0x22e/0x380
[ 808.014379][ C3] vxlan_xmit_one+0x16ca/0x4230 [vxlan]
[ 808.014476][ C3] vxlan_xmit+0x8cb/0x11e0 [vxlan]
[ 808.014567][ C3] dev_hard_start_xmit+0xfc/0x540
[ 808.014660][ C3] __dev_queue_xmit+0x155e/0x1a10
[ 808.014752][ C3] packet_snd+0xf93/0x1980
[ 808.014845][ C3] __sys_sendto+0x265/0x390
[ 808.014939][ C3] __x64_sys_sendto+0xe4/0x1f0
[ 808.015031][ C3] do_syscall_64+0xbd/0xfc0
[ 808.015124][ C3] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 808.015241][ C3]
[ 808.015293][ C3] Freed by task 70:
[ 808.015365][ C3] kasan_save_stack+0x30/0x50
[ 808.015460][ C3] kasan_save_track+0x14/0x30
[ 808.015555][ C3] __kasan_save_free_info+0x3b/0x60
[ 808.015649][ C3] __kasan_slab_free+0x43/0x70
[ 808.015740][ C3] kmem_cache_free+0xfe/0x5e0
[ 808.015832][ C3] dst_destroy+0x221/0x340
[ 808.015925][ C3] rcu_do_batch+0x28b/0xfe0
[ 808.016018][ C3] rcu_core+0x2b4/0x5f0
[ 808.016088][ C3] handle_softirqs+0x1d7/0x840
[ 808.016180][ C3] do_softirq+0xa9/0xe0
[ 808.016249][ C3] __local_bh_enable_ip+0x111/0x140
[ 808.016345][ C3] addrconf_ifdown.isra.0+0x4b7/0x1610
[ 808.016436][ C3] addrconf_notify+0x2c8/0xf20
[ 808.016529][ C3] notifier_call_chain+0x9a/0x290
[ 808.016627][ C3] netif_close_many+0x2c9/0x640
[ 808.016719][ C3] unregister_netdevice_many_notify+0x705/0x20a0
[ 808.016834][ C3] ops_undo_list+0x620/0x8f0
[ 808.016928][ C3] cleanup_net+0x3bc/0x890
[ 808.017023][ C3] process_one_work+0xd57/0x1390
[ 808.017119][ C3] worker_thread+0x4d6/0xd40
[ 808.017213][ C3] kthread+0x355/0x5b0
[ 808.017333][ C3] ret_from_fork+0x3fb/0x510
[ 808.017427][ C3] ret_from_fork_asm+0x11/0x20
[ 808.017520][ C3]
[ 808.017567][ C3] Last potentially related work creation:
[ 808.017704][ C3] kasan_save_stack+0x30/0x50
[ 808.017844][ C3] kasan_record_aux_stack+0x8c/0xa0
[ 808.017938][ C3] __call_rcu_common.constprop.0+0xa6/0xa00
[ 808.018098][ C3] dst_cache_destroy+0xea/0x1d0
[ 808.018235][ C3] vxlan_fdb_free+0x109/0x1c0 [vxlan]
[ 808.018334][ C3] rcu_do_batch+0x28b/0xfe0
[ 808.018470][ C3] rcu_core+0x2b4/0x5f0
[ 808.018583][ C3] handle_softirqs+0x1d7/0x840
[ 808.018679][ C3] run_ksoftirqd+0x39/0x60
[ 808.018778][ C3] smpboot_thread_fn+0x2fb/0x9b0
[ 808.018869][ C3] kthread+0x355/0x5b0
[ 808.018938][ C3] ret_from_fork+0x3fb/0x510
[ 808.019029][ C3] ret_from_fork_asm+0x11/0x20
[ 808.019122][ C3]
[ 808.019170][ C3] The buggy address belongs to the object at ff1100000ec12940
[ 808.019170][ C3] which belongs to the cache rtable of size 184
[ 808.019401][ C3] The buggy address is located 0 bytes inside of
[ 808.019401][ C3] freed 184-byte region [ff1100000ec12940, ff1100000ec129f8)
[ 808.019633][ C3]
[ 808.019679][ C3] The buggy address belongs to the physical page:
[ 808.019794][ C3] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff1100000ec13e40 pfn:0xec12
[ 808.019985][ C3] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 808.020175][ C3] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 808.020298][ C3] page_type: f5(slab)
[ 808.020371][ C3] raw: 0080000000000240 ff11000004cfbc40 ffd4000000349e10 ff11000002a875c8
[ 808.020540][ C3] raw: ff1100000ec13e40 0000000000150001 00000000f5000000 0000000000000000
[ 808.020702][ C3] head: 0080000000000240 ff11000004cfbc40 ffd4000000349e10 ff11000002a875c8
[ 808.020866][ C3] head: ff1100000ec13e40 0000000000150001 00000000f5000000 0000000000000000
[ 808.021027][ C3] head: 0080000000000001 ffd40000003b0481 00000000ffffffff 00000000ffffffff
[ 808.021186][ C3] head: ff1100000ec13e68 0000000000000000 00000000ffffffff 0000000000000000
[ 808.021406][ C3] page dumped because: kasan: bad access detected
[ 808.021520][ C3]
[ 808.021566][ C3] Memory state around the buggy address:
[ 808.021660][ C3] ff1100000ec12800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 808.021840][ C3] ff1100000ec12880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 808.021976][ C3] >ff1100000ec12900: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 808.022112][ C3] ^
[ 808.022269][ C3] ff1100000ec12980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 808.022403][ C3] ff1100000ec12a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 808.022537][ C3] ==================================================================
[ 808.022727][ C3] Disabling lock debugging due to kernel taint
[ 808.022851][ C3] Oops: general protection fault, probably for non-canonical address 0xe03cbc478000000f: 0000 [#1] SMP KASAN
[ 808.023093][ C3] KASAN: maybe wild-memory-access in range [0x01e6023c00000078-0x01e6023c0000007f]
[ 808.023248][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Tainted: G B 6.18.0-virtme #1 PREEMPT(full)
[ 808.023476][ C3] Tainted: [B]=BAD_PAGE
[ 808.023545][ C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 808.023658][ C3] RIP: 0010:dst_dev_put+0x9f/0x300
[ 808.023751][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
[ 808.024113][ C3] RSP: 0018:ffa0000000270d10 EFLAGS: 00010217
[ 808.024276][ C3] RAX: 01e6023c00000046 RBX: ff1100000ec12940 RCX: 003cc0478000000f
[ 808.024416][ C3] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 01e6023c0000007e
[ 808.024547][ C3] RBP: ff110000127f19a0 R08: 0000000000000008 R09: fffffbfff318c2c4
[ 808.024722][ C3] R10: fffffbfff318c2c5 R11: 0000000000000000 R12: 1fe220000185facd
[ 808.024857][ C3] R13: 0000000000000000 R14: 0000000000000001 R15: ff1100000c2fd670
[ 808.024991][ C3] FS: 0000000000000000(0000) GS:ff110000cd18b000(0000) knlGS:0000000000000000
[ 808.025190][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 808.025306][ C3] CR2: 00007ffc360b0818 CR3: 0000000001ef8004 CR4: 0000000000771ef0
[ 808.025481][ C3] PKRU: 55555554
[ 808.025550][ C3] Call Trace:
[ 808.025619][ C3]
[ 808.025666][ C3] rt_fibinfo_free_cpus.part.0+0xc6/0x160
[ 808.025757][ C3] fib_nh_common_release+0xe6/0x2d0
[ 808.025890][ C3] free_fib_info_rcu+0x159/0x3b0
[ 808.025981][ C3] ? rcu_do_batch+0x289/0xfe0
[ 808.026072][ C3] rcu_do_batch+0x28b/0xfe0
[ 808.026165][ C3] ? trace_rcu_batch_end+0x270/0x270
[ 808.026298][ C3] ? trace_irq_enable.constprop.0+0xce/0x100
[ 808.026411][ C3] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160
[ 808.026527][ C3] ? lockdep_hardirqs_on+0x84/0x130
[ 808.026618][ C3] ? _raw_spin_unlock_irqrestore+0x53/0x80
[ 808.026773][ C3] ? _raw_spin_unlock_irqrestore+0x40/0x80
[ 808.026890][ C3] rcu_core+0x2b4/0x5f0
[ 808.026960][ C3] handle_softirqs+0x1d7/0x840
[ 808.027050][ C3] ? tasklet_unlock_wait+0x60/0x60
[ 808.027182][ C3] ? __flush_smp_call_function_queue+0x449/0x6d0
[ 808.027298][ C3] irq_exit_rcu+0xa2/0xf0
[ 808.027370][ C3] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 808.027459][ C3]
[ 808.027547][ C3]
[ 808.027604][ C3] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 808.027715][ C3] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 808.027809][ C3] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
[ 808.028168][ C3] RSP: 0018:ffa0000000157de8 EFLAGS: 00000296
[ 808.028286][ C3] RAX: 0000000001b0da8b RBX: ff11000001adc540 RCX: ffffffff94084c3f
[ 808.028464][ C3] RDX: ff11000001adc540 RSI: ffffffff96e0ff26 RDI: ffffffff96869f80
[ 808.028599][ C3] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 808.028777][ C3] R10: 0000000000000003 R11: 0000000000000001 R12: 1ff400000002afc0
[ 808.028912][ C3] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 808.029046][ C3] ? cpuidle_idle_call+0x21f/0x340
[ 808.029177][ C3] ? lockdep_hardirqs_on+0x84/0x130
[ 808.029269][ C3] default_idle+0x9/0x10
[ 808.029340][ C3] default_idle_call+0x6c/0xa0
[ 808.029433][ C3] cpuidle_idle_call+0x21f/0x340
[ 808.029563][ C3] ? arch_cpu_idle_exit+0x40/0x40
[ 808.029654][ C3] ? mark_tsc_async_resets+0x30/0x30
[ 808.029744][ C3] ? trace_irq_enable.constprop.0+0xce/0x100
[ 808.029860][ C3] do_idle+0xd9/0x130
[ 808.029969][ C3] cpu_startup_entry+0x53/0x70
[ 808.030059][ C3] start_secondary+0x200/0x2a0
[ 808.030147][ C3] ? set_cpu_sibling_map+0x1d60/0x1d60
[ 808.030237][ C3] common_startup_64+0x13e/0x148
[ 808.030375][ C3]
[ 808.030446][ C3] Modules linked in: vxlan act_gact cls_flower sch_ingress ipt_REJECT nf_reject_ipv4 nft_compat nf_tables
[ 808.030642][ C3] ---[ end trace 0000000000000000 ]---
[ 808.030733][ C3] RIP: 0010:dst_dev_put+0x9f/0x300
[ 808.030870][ C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
[ 808.031227][ C3] RSP: 0018:ffa0000000270d10 EFLAGS: 00010217
[ 808.031346][ C3] RAX: 01e6023c00000046 RBX: ff1100000ec12940 RCX: 003cc0478000000f
[ 808.031490][ C3] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 01e6023c0000007e
[ 808.031668][ C3] RBP: ff110000127f19a0 R08: 0000000000000008 R09: fffffbfff318c2c4
[ 808.031802][ C3] R10: fffffbfff318c2c5 R11: 0000000000000000 R12: 1fe220000185facd
[ 808.031936][ C3] R13: 0000000000000000 R14: 0000000000000001 R15: ff1100000c2fd670
[ 808.032113][ C3] FS: 0000000000000000(0000) GS:ff110000cd18b000(0000) knlGS:0000000000000000
[ 808.032276][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 808.032438][ C3] CR2: 00007ffc360b0818 CR3: 0000000001ef8004 CR4: 0000000000771ef0
[ 808.032576][ C3] PKRU: 55555554
[ 808.032644][ C3] Kernel panic - not syncing: Fatal exception in interrupt
[ 808.032918][ C3] Kernel Offset: 0x12800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 808.033170][ C3] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr