[ 884.907421][T14596] GACT probability NOT on
[ 887.039241][ C0] ==================================================================
[ 887.039450][ C0] BUG: KASAN: slab-use-after-free in dst_dev_put+0x298/0x300
[ 887.039617][ C0] Read of size 8 at addr ff11000014132040 by task swapper/0/0
[ 887.039768][ C0]
[ 887.039824][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-virtme #1 PREEMPT(full)
[ 887.039828][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 887.039830][ C0] Call Trace:
[ 887.039831][ C0]
[ 887.039833][ C0] dump_stack_lvl+0x6f/0xa0
[ 887.039839][ C0] print_address_description.constprop.0+0x6e/0x300
[ 887.039843][ C0] print_report+0xfc/0x1fb
[ 887.039845][ C0] ? dst_dev_put+0x298/0x300
[ 887.039847][ C0] ? __virt_addr_valid+0x1da/0x430
[ 887.039851][ C0] ? dst_dev_put+0x298/0x300
[ 887.039853][ C0] kasan_report+0xe8/0x120
[ 887.039856][ C0] ? dst_dev_put+0x298/0x300
[ 887.039859][ C0] dst_dev_put+0x298/0x300
[ 887.039861][ C0] rt_fibinfo_free_cpus.part.0+0xc6/0x160
[ 887.039864][ C0] fib_nh_common_release+0xe6/0x2d0
[ 887.039866][ C0] free_fib_info_rcu+0x159/0x3b0
[ 887.039868][ C0] ? rcu_do_batch+0x289/0xfe0
[ 887.039872][ C0] rcu_do_batch+0x28b/0xfe0
[ 887.039874][ C0] ? rcu_start_this_gp+0x2f9/0x470
[ 887.039877][ C0] ? trace_rcu_batch_end+0x270/0x270
[ 887.039879][ C0] ? trace_irq_enable.constprop.0+0xce/0x100
[ 887.039882][ C0] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160
[ 887.039884][ C0] ? lockdep_hardirqs_on+0x84/0x130
[ 887.039888][ C0] ? _raw_spin_unlock_irqrestore+0x53/0x80
[ 887.039891][ C0] ? _raw_spin_unlock_irqrestore+0x40/0x80
[ 887.039893][ C0] rcu_core+0x2b4/0x5f0
[ 887.039894][ C0] handle_softirqs+0x1d7/0x840
[ 887.039898][ C0] ? tasklet_unlock_wait+0x60/0x60
[ 887.039899][ C0] ? __flush_smp_call_function_queue+0x449/0x6d0
[ 887.039903][ C0] irq_exit_rcu+0xa2/0xf0
[ 887.039905][ C0] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 887.039906][ C0]
[ 887.039907][ C0]
[ 887.039908][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 887.039911][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 887.039913][ C0] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
[ 887.039915][ C0] RSP: 0018:ffffffff99e07e00 EFLAGS: 00000282
[ 887.039918][ C0] RAX: 000000000221fa29 RBX: ffffffff99e32580 RCX: ffffffff96884c3f
[ 887.039920][ C0] RDX: ffffffff99e32580 RSI: ffffffff9960ff26 RDI: ffffffff99069f80
[ 887.039921][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 887.039922][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 1ffffffff33c0fc3
[ 887.039923][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000014770
[ 887.039924][ C0] ? cpuidle_idle_call+0x21f/0x340
[ 887.039927][ C0] default_idle+0x9/0x10
[ 887.039929][ C0] default_idle_call+0x6c/0xa0
[ 887.039931][ C0] cpuidle_idle_call+0x21f/0x340
[ 887.039933][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 887.039934][ C0] ? mark_tsc_async_resets+0x30/0x30
[ 887.039937][ C0] ? trace_irq_enable.constprop.0+0xce/0x100
[ 887.039939][ C0] do_idle+0xd9/0x130
[ 887.039940][ C0] cpu_startup_entry+0x53/0x70
[ 887.039942][ C0] rest_init+0x1f7/0x200
[ 887.039944][ C0] start_kernel+0x3aa/0x3b0
[ 887.039948][ C0] x86_64_start_reservations+0x24/0x30
[ 887.039950][ C0] x86_64_start_kernel+0x122/0x130
[ 887.039952][ C0] common_startup_64+0x13e/0x148
[ 887.039957][ C0]
[ 887.039958][ C0]
[ 887.046257][ C0] Allocated by task 14701:
[ 887.046359][ C0] kasan_save_stack+0x30/0x50
[ 887.046466][ C0] kasan_save_track+0x14/0x30
[ 887.046564][ C0] __kasan_slab_alloc+0x5f/0x70
[ 887.046663][ C0] kmem_cache_alloc_noprof+0x218/0x6e0
[ 887.046766][ C0] dst_alloc+0x79/0x160
[ 887.046846][ C0] rt_dst_alloc+0x35/0x3a0
[ 887.046945][ C0] __mkroute_output+0x456/0x1070
[ 887.047056][ C0] ip_route_output_key_hash+0xfa/0x220
[ 887.047165][ C0] ip_route_output_flow+0x21/0x150
[ 887.047266][ C0] udp_tunnel_dst_lookup+0x22e/0x380
[ 887.047370][ C0] vxlan_xmit_one+0x16ca/0x4230 [vxlan]
[ 887.047480][ C0] vxlan_xmit+0x8cb/0x11e0 [vxlan]
[ 887.047580][ C0] dev_hard_start_xmit+0xfc/0x540
[ 887.047684][ C0] __dev_queue_xmit+0x155e/0x1a10
[ 887.047789][ C0] packet_snd+0xf93/0x1980
[ 887.047889][ C0] __sys_sendto+0x265/0x390
[ 887.047991][ C0] __x64_sys_sendto+0xe4/0x1f0
[ 887.048095][ C0] do_syscall_64+0xbd/0xfc0
[ 887.048197][ C0] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 887.048329][ C0]
[ 887.048377][ C0] Freed by task 12:
[ 887.048461][ C0] kasan_save_stack+0x30/0x50
[ 887.048565][ C0] kasan_save_track+0x14/0x30
[ 887.048664][ C0] __kasan_save_free_info+0x3b/0x60
[ 887.048764][ C0] __kasan_slab_free+0x43/0x70
[ 887.048862][ C0] kmem_cache_free+0xfe/0x5e0
[ 887.048962][ C0] dst_destroy+0x221/0x340
[ 887.049066][ C0] rcu_do_batch+0x28b/0xfe0
[ 887.049166][ C0] rcu_core+0x2b4/0x5f0
[ 887.049242][ C0] handle_softirqs+0x1d7/0x840
[ 887.049341][ C0] irq_exit_rcu+0xa2/0xf0
[ 887.049421][ C0] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 887.049522][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 887.049647][ C0]
[ 887.049699][ C0] Last potentially related work creation:
[ 887.049801][ C0] kasan_save_stack+0x30/0x50
[ 887.049906][ C0] kasan_record_aux_stack+0x8c/0xa0
[ 887.050014][ C0] __call_rcu_common.constprop.0+0xa6/0xa00
[ 887.050143][ C0] dst_cache_destroy+0xea/0x1d0
[ 887.050247][ C0] vxlan_fdb_free+0x109/0x1c0 [vxlan]
[ 887.050351][ C0] rcu_do_batch+0x28b/0xfe0
[ 887.050458][ C0] rcu_core+0x2b4/0x5f0
[ 887.050584][ C0] handle_softirqs+0x1d7/0x840
[ 887.050687][ C0] irq_exit_rcu+0xa2/0xf0
[ 887.050764][ C0] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 887.050914][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 887.051040][ C0]
[ 887.051093][ C0] The buggy address belongs to the object at ff11000014132040
[ 887.051093][ C0] which belongs to the cache rtable of size 184
[ 887.051413][ C0] The buggy address is located 0 bytes inside of
[ 887.051413][ C0] freed 184-byte region [ff11000014132040, ff110000141320f8)
[ 887.051659][ C0]
[ 887.051710][ C0] The buggy address belongs to the physical page:
[ 887.051833][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff110000141321c0 pfn:0x14132
[ 887.052040][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 887.052194][ C0] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 887.052324][ C0] page_type: f5(slab)
[ 887.052407][ C0] raw: 0080000000000240 ff110000051d1c40 ff11000001dd95c8 ff11000001dd95c8
[ 887.052587][ C0] raw: ff110000141321c0 0000000000150001 00000000f5000000 0000000000000000
[ 887.052768][ C0] head: 0080000000000240 ff110000051d1c40 ff11000001dd95c8 ff11000001dd95c8
[ 887.052945][ C0] head: ff110000141321c0 0000000000150001 00000000f5000000 0000000000000000
[ 887.053121][ C0] head: 0080000000000001 ffd4000000504c81 00000000ffffffff 00000000ffffffff
[ 887.053295][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 887.053476][ C0] page dumped because: kasan: bad access detected
[ 887.053599][ C0]
[ 887.053650][ C0] Memory state around the buggy address:
[ 887.053746][ C0] ff11000014131f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 887.053896][ C0] ff11000014131f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 887.054041][ C0] >ff11000014132000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 887.054189][ C0] ^
[ 887.054315][ C0] ff11000014132080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ 887.054460][ C0] ff11000014132100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 887.054604][ C0] ==================================================================
[ 887.054756][ C0] Disabling lock debugging due to kernel taint
[ 887.054893][ C0] Oops: general protection fault, probably for non-canonical address 0xe0d57c3580000008: 0000 [#1] SMP KASAN
[ 887.055110][ C0] KASAN: maybe wild-memory-access in range [0x06ac01ac00000040-0x06ac01ac00000047]
[ 887.055277][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.18.0-virtme #1 PREEMPT(full)
[ 887.055479][ C0] Tainted: [B]=BAD_PAGE
[ 887.055554][ C0] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 887.055677][ C0] RIP: 0010:dst_dev_put+0x9f/0x300
[ 887.055778][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
[ 887.056114][ C0] RSP: 0018:ffa0000000007d10 EFLAGS: 00010213
[ 887.056504][ C0] RAX: 06ac01ac0000000c RBX: ff11000014132040 RCX: 00d5803580000008
[ 887.056646][ C0] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 06ac01ac00000044
[ 887.056791][ C0] RBP: ff1100000f522ea8 R08: 0000000000000008 R09: fffffbfff368c2c4
[ 887.056936][ C0] R10: fffffbfff368c2c5 R11: 0000000000000000 R12: 1fe22000014f014d
[ 887.057077][ C0] R13: 0000000000000002 R14: 0000000000000001 R15: ff1100000a780a70
[ 887.057268][ C0] FS: 0000000000000000(0000) GS:ff110000d0e0b000(0000) knlGS:0000000000000000
[ 887.057454][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 887.057573][ C0] CR2: 0000560f15e700c0 CR3: 000000001b748004 CR4: 0000000000771ef0
[ 887.057769][ C0] PKRU: 55555554
[ 887.057845][ C0] Call Trace:
[ 887.057917][ C0]
[ 887.057966][ C0] rt_fibinfo_free_cpus.part.0+0xc6/0x160
[ 887.058068][ C0] fib_nh_common_release+0xe6/0x2d0
[ 887.058209][ C0] free_fib_info_rcu+0x159/0x3b0
[ 887.058304][ C0] ? rcu_do_batch+0x289/0xfe0
[ 887.058406][ C0] rcu_do_batch+0x28b/0xfe0
[ 887.058501][ C0] ? rcu_start_this_gp+0x2f9/0x470
[ 887.058686][ C0] ? trace_rcu_batch_end+0x270/0x270
[ 887.058782][ C0] ? trace_irq_enable.constprop.0+0xce/0x100
[ 887.058899][ C0] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160
[ 887.059016][ C0] ? lockdep_hardirqs_on+0x84/0x130
[ 887.059111][ C0] ? _raw_spin_unlock_irqrestore+0x53/0x80
[ 887.059234][ C0] ? _raw_spin_unlock_irqrestore+0x40/0x80
[ 887.059350][ C0] rcu_core+0x2b4/0x5f0
[ 887.059473][ C0] handle_softirqs+0x1d7/0x840
[ 887.059568][ C0] ? tasklet_unlock_wait+0x60/0x60
[ 887.059662][ C0] ? __flush_smp_call_function_queue+0x449/0x6d0
[ 887.059781][ C0] irq_exit_rcu+0xa2/0xf0
[ 887.059898][ C0] sysvec_apic_timer_interrupt+0xb1/0xf0
[ 887.059994][ C0]
[ 887.060043][ C0]
[ 887.060089][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 887.060208][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10
[ 887.060353][ C0] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
[ 887.060742][ C0] RSP: 0018:ffffffff99e07e00 EFLAGS: 00000282
[ 887.060860][ C0] RAX: 000000000221fa29 RBX: ffffffff99e32580 RCX: ffffffff96884c3f
[ 887.061002][ C0] RDX: ffffffff99e32580 RSI: ffffffff9960ff26 RDI: ffffffff99069f80
[ 887.061189][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 887.061339][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 1ffffffff33c0fc3
[ 887.061486][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000014770
[ 887.061677][ C0] ? cpuidle_idle_call+0x21f/0x340
[ 887.061772][ C0] default_idle+0x9/0x10
[ 887.061845][ C0] default_idle_call+0x6c/0xa0
[ 887.061938][ C0] cpuidle_idle_call+0x21f/0x340
[ 887.062037][ C0] ? arch_cpu_idle_exit+0x40/0x40
[ 887.062132][ C0] ? mark_tsc_async_resets+0x30/0x30
[ 887.062226][ C0] ? trace_irq_enable.constprop.0+0xce/0x100
[ 887.062343][ C0] do_idle+0xd9/0x130
[ 887.062465][ C0] cpu_startup_entry+0x53/0x70
[ 887.062562][ C0] rest_init+0x1f7/0x200
[ 887.062633][ C0] start_kernel+0x3aa/0x3b0
[ 887.062728][ C0] x86_64_start_reservations+0x24/0x30
[ 887.062870][ C0] x86_64_start_kernel+0x122/0x130
[ 887.062963][ C0] common_startup_64+0x13e/0x148
[ 887.063059][ C0]
[ 887.063128][ C0] Modules linked in: vxlan act_gact cls_flower sch_ingress ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables
[ 887.063456][ C0] ---[ end trace 0000000000000000 ]---
[ 887.063558][ C0] RIP: 0010:dst_dev_put+0x9f/0x300
[ 887.063666][ C0] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
[ 887.064043][ C0] RSP: 0018:ffa0000000007d10 EFLAGS: 00010213
[ 887.064209][ C0] RAX: 06ac01ac0000000c RBX: ff11000014132040 RCX: 00d5803580000008
[ 887.064355][ C0] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 06ac01ac00000044
[ 887.064506][ C0] RBP: ff1100000f522ea8 R08: 0000000000000008 R09: fffffbfff368c2c4
[ 887.064697][ C0] R10: fffffbfff368c2c5 R11: 0000000000000000 R12: 1fe22000014f014d
[ 887.064884][ C0] R13: 0000000000000002 R14: 0000000000000001 R15: ff1100000a780a70
[ 887.065042][ C0] FS: 0000000000000000(0000) GS:ff110000d0e0b000(0000) knlGS:0000000000000000
[ 887.065253][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 887.065373][ C0] CR2: 0000560f15e700c0 CR3: 000000001b748004 CR4: 0000000000771ef0
[ 887.065565][ C0] PKRU: 55555554
[ 887.065641][ C0] Kernel panic - not syncing: Fatal exception in interrupt
[ 887.065933][ C0] Kernel Offset: 0x15000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 887.066198][ C0] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr