======================================
| [ 2118.447271][    C1] ==================================================================
| [ 2118.447463][    C1] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:146)
| [ 2118.447601][    C1] Read of size 8 at addr ff11000013307b40 by task swapper/1/0
| [ 2118.447736][    C1]
[ 2118.447787][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2118.447789][    C1] Call Trace:
[ 2118.447790][    C1]  <IRQ>
[ 2118.447792][    C1]  dump_stack_lvl (lib/dump_stack.c:122)
[ 2118.447798][    C1]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 2118.447803][    C1]  print_report (mm/kasan/report.c:483)
[ 2118.447804][    C1]  ? dst_dev_put (net/core/dst.c:146)
[ 2118.447806][    C1]  ? __virt_addr_valid (./include/linux/rcupdate.h:981 (discriminator 3) ./include/linux/mmzone.h:2197 (discriminator 3) arch/x86/mm/physaddr.c:54 (discriminator 3))
[ 2118.447810][    C1]  ? dst_dev_put (net/core/dst.c:146)
[ 2118.447812][    C1]  kasan_report (mm/kasan/report.c:597)
[ 2118.447815][    C1]  ? dst_dev_put (net/core/dst.c:146)
[ 2118.447818][    C1]  dst_dev_put (net/core/dst.c:146)
[ 2118.447820][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[ 2118.447823][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[ 2118.447825][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 net/ipv4/fib_semantics.c:229)
[ 2118.447827][    C1]  ? rcu_do_batch (kernel/rcu/tree.c:2605)
[ 2118.447831][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 (discriminator 1) kernel/rcu/tree.c:2607 (discriminator 1))
[ 2118.447833][    C1]  ? rcu_start_this_gp (kernel/rcu/tree.c:1018)
[ 2118.447836][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[ 2118.447838][    C1]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 33))
[ 2118.447841][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[ 2118.447843][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2118.447847][    C1]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:151 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[ 2118.447849][    C1]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:152 (discriminator 3) kernel/locking/spinlock.c:194 (discriminator 3))
[ 2118.447851][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[ 2118.447853][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2118.447856][    C1]  ? tasklet_unlock_wait (kernel/softirq.c:580)
[ 2118.447858][    C1]  ? do_raw_spin_unlock (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 2118.447860][    C1]  irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723 kernel/softirq.c:739)
[ 2118.447861][    C1]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 (discriminator 47) arch/x86/kernel/apic/apic.c:1056 (discriminator 47))
[ 2118.447863][    C1]  </IRQ>
[ 2118.447864][    C1]  <TASK>
[ 2118.447865][    C1]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2118.447867][    C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[ 2118.447870][    C1] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d c4 ac 71 02 	mov    0x271acc4(%rip),%rdi        # 0x271accb
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 b8 22 9b 00 	sub    0x9b22b8(%rip),%rax        # 0x9b22cb
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 23 83 19 00 	verw   0x198323(%rip)        # 0x19834b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[ 2118.447872][    C1] RSP: 0018:ffa0000000137de8 EFLAGS: 00000296
[ 2118.447875][    C1] RAX: 000000000420304b RBX: ff11000001ad8040 RCX: ffffffffac284c3f
[ 2118.447876][    C1] RDX: ff11000001ad8040 RSI: ffffffffaf00ff26 RDI: ffffffffaea69f80
[ 2118.447877][    C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 2118.447878][    C1] R10: 0000000000000001 R11: 0000000000000001 R12: 1ff4000000026fc0
[ 2118.447879][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 2118.447880][    C1]  ? cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2118.447883][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2118.447885][    C1]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[ 2118.447886][    C1]  default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
[ 2118.447888][    C1]  cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2118.447889][    C1]  ? arch_cpu_idle_exit+0x40/0x40
[ 2118.447891][    C1]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52)
[ 2118.447893][    C1]  ? trace_sched_exit_tp (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/sched.h:886)
[ 2118.447896][    C1]  do_idle (kernel/sched/idle.c:332)
[ 2118.447897][    C1]  cpu_startup_entry (kernel/sched/idle.c:429)
[ 2118.447899][    C1]  start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 16) arch/x86/kernel/smpboot.c:280 (discriminator 16))
[ 2118.447901][    C1]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)
[ 2118.447903][    C1]  common_startup_64 (arch/x86/kernel/head_64.S:419)
| [ 2118.460744][    C1] Disabling lock debugging due to kernel taint
| [ 2118.460881][    C1] Oops: general protection fault, probably for non-canonical address 0xe0fc3c3480000008: 0000 [#1] SMP KASAN
| [ 2118.461075][    C1] KASAN: maybe wild-memory-access in range [0x07e201a400000040-0x07e201a400000047]
| [ 2118.461407][    C1] Tainted: [B]=BAD_PAGE
[ 2118.461475][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2118.461583][    C1] RIP: 0010:dst_dev_put (net/core/dst.c:149)
[ 2118.461674][    C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 2c 02             	test   %ebp,(%rdx,%rax,1)
   f:	00 00                	add    %al,(%rax)
  11:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  18:	fc ff df 
  1b:	48 8b 43 08          	mov    0x8(%rbx),%rax
  1f:	48 8d 78 38          	lea    0x38(%rax),%rdi
  23:	48 89 f9             	mov    %rdi,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)		<-- trapping instruction
  2e:	0f 85 d8 01 00 00    	jne    0x20c
  34:	48 8b 40 38          	mov    0x38(%rax),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	48 89 ee             	mov    %rbp,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)
   4:	0f 85 d8 01 00 00    	jne    0x1e2
   a:	48 8b 40 38          	mov    0x38(%rax),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	48 89 ee             	mov    %rbp,%rsi
[ 2118.461983][    C1] RSP: 0018:ffa00000001c0d10 EFLAGS: 00010213
[ 2118.462095][    C1] RAX: 07e201a40000000c RBX: ff11000013307b40 RCX: 00fc403480000008
[ 2118.462229][    C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 07e201a400000044
[ 2118.462365][    C1] RBP: ff1100000c55bc10 R08: 0000000000000008 R09: fffffbfff61cc2c4
[ 2118.462495][    C1] R10: fffffbfff61cc2c5 R11: 0000000000000000 R12: 1fe22000017ff56d
[ 2118.462623][    C1] R13: 0000000000000000 R14: 0000000000000001 R15: ff1100000bffab70
[ 2118.462753][    C1] FS:  0000000000000000(0000) GS:ff110000bb48b000(0000) knlGS:0000000000000000
[ 2118.462907][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2118.463015][    C1] CR2: 00007ff4d09fe000 CR3: 000000005f948004 CR4: 0000000000771ef0
[ 2118.463144][    C1] PKRU: 55555554
[ 2118.463209][    C1] Call Trace:
[ 2118.463275][    C1]  <IRQ>
[ 2118.463321][    C1]  rt_fibinfo_free_cpus.part.0 (net/ipv4/fib_semantics.c:196)
[ 2118.463414][    C1]  fib_nh_common_release (net/ipv4/fib_semantics.c:141 net/ipv4/fib_semantics.c:207)
[ 2118.463502][    C1]  free_fib_info_rcu (./include/net/nexthop.h:480 net/ipv4/fib_semantics.c:229)
[ 2118.463587][    C1]  ? rcu_do_batch (kernel/rcu/tree.c:2605)
[ 2118.463674][    C1]  rcu_do_batch (./include/linux/rcupdate.h:341 (discriminator 1) kernel/rcu/tree.c:2607 (discriminator 1))
[ 2118.463760][    C1]  ? rcu_start_this_gp (kernel/rcu/tree.c:1018)
[ 2118.463847][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2529)
[ 2118.463933][    C1]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 33))
[ 2118.464041][    C1]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:4411 (discriminator 6))
[ 2118.464149][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2118.464236][    C1]  ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:151 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)
[ 2118.464342][    C1]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:152 (discriminator 3) kernel/locking/spinlock.c:194 (discriminator 3))
[ 2118.464456][    C1]  rcu_core (kernel/rcu/tree.c:2859)
[ 2118.464522][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2118.464609][    C1]  ? tasklet_unlock_wait (kernel/softirq.c:580)
[ 2118.464698][    C1]  ? do_raw_spin_unlock (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 2118.464787][    C1]  irq_exit_rcu (kernel/softirq.c:657 kernel/softirq.c:496 kernel/softirq.c:723 kernel/softirq.c:739)
[ 2118.464852][    C1]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1056 (discriminator 47) arch/x86/kernel/apic/apic.c:1056 (discriminator 47))
[ 2118.464938][    C1]  </IRQ>
[ 2118.464984][    C1]  <TASK>
[ 2118.465028][    C1]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2118.465137][    C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:82)
[ 2118.465228][    C1] Code: 48 8b 3d c4 ac 71 02 e8 1f 00 00 00 48 2b 05 b8 22 9b 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 23 83 19 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d c4 ac 71 02 	mov    0x271acc4(%rip),%rdi        # 0x271accb
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 b8 22 9b 00 	sub    0x9b22b8(%rip),%rax        # 0x9b22cb
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 23 83 19 00 	verw   0x198323(%rip)        # 0x19834b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[ 2118.465531][    C1] RSP: 0018:ffa0000000137de8 EFLAGS: 00000296
[ 2118.465641][    C1] RAX: 000000000420304b RBX: ff11000001ad8040 RCX: ffffffffac284c3f
[ 2118.465770][    C1] RDX: ff11000001ad8040 RSI: ffffffffaf00ff26 RDI: ffffffffaea69f80
[ 2118.465901][    C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
[ 2118.466030][    C1] R10: 0000000000000001 R11: 0000000000000001 R12: 1ff4000000026fc0
[ 2118.466159][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 2118.466287][    C1]  ? cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2118.466382][    C1]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2118.466473][    C1]  default_idle (./arch/x86/include/asm/paravirt.h:107 arch/x86/kernel/process.c:767)
[ 2118.466539][    C1]  default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
[ 2118.466625][    C1]  cpuidle_idle_call (kernel/sched/idle.c:192)
[ 2118.466715][    C1]  ? arch_cpu_idle_exit+0x40/0x40
[ 2118.466800][    C1]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52)
[ 2118.466890][    C1]  ? trace_sched_exit_tp (./arch/x86/include/asm/bitops.h:222 ./arch/x86/include/asm/bitops.h:233 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/cpumask.h:647 ./include/linux/cpumask.h:1229 ./include/trace/events/sched.h:886)
[ 2118.466979][    C1]  do_idle (kernel/sched/idle.c:332)
[ 2118.467045][    C1]  cpu_startup_entry (kernel/sched/idle.c:429)
[ 2118.467129][    C1]  start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 16) arch/x86/kernel/smpboot.c:280 (discriminator 16))
[ 2118.467216][    C1]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)


Finger prints:
print_report:kasan_report:dst_dev_put:fib_nh_common_release:free_fib_info_rcu
dst_dev_put:fib_nh_common_release:free_fib_info_rcu:rcu_do_batch:rcu_core