======================================
| [    8.935470][   T12] ==================================================================
| [    8.935624][   T12] BUG: KASAN: slab-use-after-free in __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5))
| [    8.935783][   T12] Read of size 8 at addr ff1100000d70e0d0 by task kworker/u16:0/12
| [    8.935916][   T12]
[    8.935969][   T12] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    8.935971][   T12] Workqueue: netns cleanup_net
[    8.935977][   T12] Call Trace:
[    8.935979][   T12]  <TASK>
[    8.935980][   T12]  dump_stack_lvl (lib/dump_stack.c:122)
[    8.935986][   T12]  print_address_description.constprop.0 (mm/kasan/report.c:379 (discriminator 1))
[    8.935991][   T12]  print_report (mm/kasan/report.c:483)
[    8.935993][   T12]  ? __virt_addr_valid (./include/linux/rcupdate.h:937 (discriminator 1) ./include/linux/mmzone.h:2197 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[    8.935997][   T12]  ? __virt_addr_valid (./include/linux/rcupdate.h:963 (discriminator 4) ./include/linux/mmzone.h:2207 (discriminator 4) arch/x86/mm/physaddr.c:54 (discriminator 4))
[    8.935999][   T12]  kasan_report (mm/kasan/report.c:597)
[    8.936002][   T12]  ? __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5))
[    8.936004][   T12]  ? __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5))
[    8.936007][   T12]  __fib6_drop_pcpu_from.part.0 (net/ipv6/ip6_fib.c:1004 (discriminator 5))
[    8.936009][   T12]  fib6_purge_rt (net/ipv6/ip6_fib.c:1037 net/ipv6/ip6_fib.c:1038 net/ipv6/ip6_fib.c:1049)
[    8.936011][   T12]  fib6_del_route (net/ipv6/ip6_fib.c:2052)
[    8.936014][   T12]  ? fib6_purge_rt (net/ipv6/ip6_fib.c:1972)
[    8.936017][   T12]  ? ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
[    8.936019][   T12]  fib6_del (net/ipv6/ip6_fib.c:2096)
[    8.936021][   T12]  ? validate_chain (kernel/locking/lockdep.c:3801 (discriminator 3) kernel/locking/lockdep.c:3821 (discriminator 3) kernel/locking/lockdep.c:3876 (discriminator 3))
[    8.936025][   T12]  fib6_clean_node (net/ipv6/ip6_fib.c:2258)
[    8.936027][   T12]  ? fib6_del (net/ipv6/ip6_fib.c:2234)
[    8.936029][   T12]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2))
[    8.936031][   T12]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[    8.936033][   T12]  fib6_walk_continue (net/ipv6/ip6_fib.c:2180)
[    8.936035][   T12]  ? mark_held_locks (kernel/locking/lockdep.c:4325 (discriminator 1))
[    8.936037][   T12]  ? fib6_ifup (net/ipv6/route.c:4963)
[    8.936038][   T12]  ? fib6_ifup (net/ipv6/route.c:4963)
[    8.936040][   T12]  fib6_walk (net/ipv6/ip6_fib.c:2227)
[    8.936042][   T12]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[    8.936044][   T12]  fib6_clean_tree (net/ipv6/ip6_fib.c:2293)
[    8.936045][   T12]  ? fib6_walk (net/ipv6/ip6_fib.c:2293)
[    8.936048][   T12]  ? fib6_del (net/ipv6/ip6_fib.c:2234)
[    8.936049][   T12]  ? fib6_ifup (net/ipv6/route.c:4963)
[    8.936051][   T12]  ? fib6_ifup (net/ipv6/route.c:4963)
[    8.936053][   T12]  __fib6_clean_all (./include/linux/spinlock.h:396 net/ipv6/ip6_fib.c:2325)
[    8.936055][   T12]  rt6_disable_ip (net/ipv6/route.c:5018 net/ipv6/route.c:5023)
[    8.936057][   T12]  ? rt6_sync_down_dev (net/ipv6/route.c:5022)
[    8.936058][   T12]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 11) kernel/locking/lockdep.c:4411 (discriminator 11))
[    8.936060][   T12]  ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:179 (discriminator 4) kernel/locking/spinlock.c:198 (discriminator 4))
[    8.936064][   T12]  addrconf_ifdown.isra.0 (./include/net/addrconf.h:348 (discriminator 4) net/ipv6/addrconf.c:3873 (discriminator 4))
[    8.936068][   T12]  ? __timer_delete_sync (kernel/time/timer.c:1603 (discriminator 2))
[    8.936070][   T12]  ? __timer_delete_sync (kernel/time/timer.c:1623 (discriminator 1))
[    8.936071][   T12]  ? __neigh_ifdown.isra.0 (net/core/neighbour.c:479 (discriminator 1))
[    8.936074][   T12]  ? addrconf_dad_run (net/ipv6/addrconf.c:3858)
[    8.936076][   T12]  ? netkit_xmit (drivers/net/netkit.c:1186)
[    8.936080][   T12]  addrconf_notify (net/ipv6/addrconf.c:3828)
[    8.936082][   T12]  ? team_port_get_rtnl (drivers/net/team/team_core.c:42 (discriminator 4))
[    8.936085][   T12]  notifier_call_chain (kernel/notifier.c:87)
[    8.936088][   T12]  netif_close_many (net/core/dev.c:1806)
[    8.936091][   T12]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.936093][   T12]  ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24))
[    8.936095][   T12]  ? __dev_close_many (net/core/dev.c:1793)
[    8.936097][   T12]  ? netif_close_many_and_unlock (net/core/dev.c:12322 (discriminator 1))
[    8.936098][   T12]  ? __mutex_lock (./arch/x86/include/asm/preempt.h:104 kernel/locking/mutex.c:784 kernel/locking/mutex.c:806)
[    8.936101][   T12]  unregister_netdevice_many_notify (net/core/dev.c:12397 (discriminator 1))
[    8.936104][   T12]  ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:48 kernel/locking/mutex.c:65)
[    8.936105][   T12]  ? rtnl_is_locked (net/core/rtnetlink.c:169 (discriminator 1))
[    8.936107][   T12]  ? default_device_exit_net (net/core/dev.c:13024 (discriminator 3))
[    8.936108][   T12]  ? unregister_netdevice_queued (net/core/dev.c:12351)
[    8.936111][   T12]  ? perf_trace_sched_switch (kernel/sched/core.c:9112)
[    8.936114][   T12]  default_device_exit_batch (net/core/dev.c:13081)
[    8.936116][   T12]  ? unregister_netdev (net/core/dev.c:13056)
[    8.936118][   T12]  ? perf_trace_sched_switch (kernel/sched/core.c:9112)
[    8.936119][   T12]  ? fou_exit_net (net/ipv4/fou_core.c:1232 (discriminator 1))
[    8.936122][   T12]  ops_undo_list (net/core/net_namespace.c:251 (discriminator 3))
[    8.936124][   T12]  ? netns_install (net/core/net_namespace.c:223)
[    8.936126][   T12]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[    8.936128][   T12]  cleanup_net (net/core/net_namespace.c:704)
[    8.936130][   T12]  ? net_passive_dec (net/core/net_namespace.c:663)
[    8.936131][   T12]  ? process_one_work (kernel/workqueue.c:3264 (discriminator 2))
[    8.936134][   T12]  ? lock_acquire (./include/trace/events/lock.h:24 (discriminator 24) kernel/locking/lockdep.c:5831 (discriminator 24))
[    8.936136][   T12]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.936138][   T12]  process_one_work (kernel/workqueue.c:3293)
[    8.936140][   T12]  ? pwq_dec_nr_in_flight (kernel/workqueue.c:3189)
[    8.936142][   T12]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 (discriminator 2) kernel/locking/lockdep.c:5870 (discriminator 2))
[    8.936145][   T12]  worker_thread (kernel/workqueue.c:3365 (discriminator 5) kernel/workqueue.c:3452 (discriminator 5))
[    8.936148][   T12]  ? rescuer_thread (kernel/workqueue.c:3398)
[    8.936149][   T12]  kthread (kernel/kthread.c:436)
[    8.936151][   T12]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[    8.936154][   T12]  ? kthread_affine_node (kernel/kthread.c:381)
[    8.936155][   T12]  ret_from_fork (arch/x86/kernel/process.c:164)
[    8.936159][   T12]  ? arch_exit_to_user_mode_prepare.isra.0 (arch/x86/entry/syscall_64.c:37)
[    8.936161][   T12]  ? __switch_to (./arch/x86/include/asm/cpufeature.h:101 (discriminator 1) arch/x86/kernel/process_64.c:377 (discriminator 1) arch/x86/kernel/process_64.c:665 (discriminator 1))
[    8.936164][   T12]  ? kthread_affine_node (kernel/kthread.c:381)
[    8.936165][   T12]  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
| [    8.950325][   T12] Disabling lock debugging due to kernel taint
| [    8.958560][    C1] Oops: general protection fault, probably for non-canonical address 0xe0cffc3440000007: 0000 [#1] SMP KASAN
| [    8.958756][    C1] KASAN: maybe wild-memory-access in range [0x068001a200000038-0x068001a20000003f]
| [    8.959054][    C1] Tainted: [B]=BAD_PAGE
[    8.959112][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    8.959214][    C1] RIP: 0010:dst_dev_put (net/core/dst.c:150)
[    8.959299][    C1] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 2c 02             	test   %ebp,(%rdx,%rax,1)
   f:	00 00                	add    %al,(%rax)
  11:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  18:	fc ff df 
  1b:	48 8b 43 08          	mov    0x8(%rbx),%rax
  1f:	48 8d 78 38          	lea    0x38(%rax),%rdi
  23:	48 89 f9             	mov    %rdi,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)		<-- trapping instruction
  2e:	0f 85 d8 01 00 00    	jne    0x20c
  34:	48 8b 40 38          	mov    0x38(%rax),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	48 89 ee             	mov    %rbp,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)
   4:	0f 85 d8 01 00 00    	jne    0x1e2
   a:	48 8b 40 38          	mov    0x38(%rax),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	48 89 ee             	mov    %rbp,%rsi
[    8.959587][    C1] RSP: 0018:ffa00000001d0d48 EFLAGS: 00010212
[    8.959686][    C1] RAX: 068001a200000000 RBX: ff1100000d70e040 RCX: 00d0003440000007
[    8.959800][    C1] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 068001a200000038
[    8.959913][    C1] RBP: ff1100000264b5f8 R08: ffffffff84b2c4fc R09: 1ffa3ffffffb0bd0
[    8.960027][    C1] R10: fffa3bfffffb0bd1 R11: fffa3bfffffb0bd1 R12: ff11000009a04400
[    8.960140][    C1] R13: fffffbfff0b2684c R14: ff11000009a044c8 R15: 0000000000000007
[    8.960255][    C1] FS:  0000000000000000(0000) GS:ff110000e4b4c000(0000) knlGS:0000000000000000
[    8.960391][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.960489][    C1] CR2: 00007fef95060f98 CR3: 000000005854e004 CR4: 0000000000771ef0
[    8.960607][    C1] PKRU: 55555554
[    8.960666][    C1] Call Trace:
[    8.960725][    C1]  <IRQ>
[    8.960765][    C1]  fib6_nh_release_dsts.part.0 (net/ipv6/route.c:3748)
[    8.960844][    C1]  fib6_nh_release (net/ipv6/route.c:3729)
[    8.960924][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.961005][    C1]  fib6_info_destroy_rcu (net/ipv6/ip6_fib.c:177)
[    8.961082][    C1]  ? rcu_do_batch (kernel/rcu/tree.c:2617)
[    8.961158][    C1]  ? rcu_do_batch (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/rcu.h:597 kernel/rcu/tree.c:2612)
[    8.961234][    C1]  rcu_do_batch (./include/linux/rcupdate.h:310 (discriminator 2) kernel/rcu/tree.c:2619 (discriminator 2))
[    8.961311][    C1]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2541)
[    8.961393][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.961484][    C1]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[    8.961581][    C1]  ? trace_irq_disable.constprop.0 (./include/trace/events/preemptirq.h:36 (discriminator 24))
[    8.961675][    C1]  rcu_core (kernel/rcu/tree.c:2871)
[    8.961734][    C1]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[    8.961815][    C1]  ? clockevents_tick_resume (kernel/time/clockevents.c:337)
[    8.961893][    C1]  ? _local_bh_enable (kernel/softirq.c:580)
[    8.961974][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.962049][    C1]  ? lock_release (./include/trace/events/lock.h:69 (discriminator 24) kernel/locking/lockdep.c:5879 (discriminator 24))
[    8.962128][    C1]  __irq_exit_rcu (kernel/softirq.c:496 (discriminator 1) kernel/softirq.c:735 (discriminator 1))
[    8.962209][    C1]  irq_exit_rcu (kernel/softirq.c:754)
[    8.962267][    C1]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 37) arch/x86/kernel/apic/apic.c:1061 (discriminator 37))
[    8.962345][    C1]  </IRQ>
[    8.962385][    C1]  <TASK>
[    8.962423][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.962502][    C1]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[    8.962598][    C1] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:63)
[    8.962683][    C1] Code: 48 8b 3d 54 63 60 02 e8 1f 00 00 00 48 2b 05 d8 21 9e 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 13 54 14 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d 54 63 60 02 	mov    0x2606354(%rip),%rdi        # 0x260635b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 d8 21 9e 00 	sub    0x9e21d8(%rip),%rax        # 0x9e21eb
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 13 54 14 00 	verw   0x145413(%rip)        # 0x14543b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[    8.962963][    C1] RSP: 0018:ffa0000000147de8 EFLAGS: 00000246
[    8.963061][    C1] RAX: 0000000000000001 RBX: ff11000001b9a340 RCX: 0000000000000001
[    8.963176][    C1] RDX: 0000000000000001 RSI: ffffffff852719c0 RDI: ffffffff828df5db
[    8.963291][    C1] RBP: 0000000000000000 R08: ffffffff84f534f1 R09: 1fe220000d81639a
[    8.963413][    C1] R10: 0000000000000001 R11: 0000000000000000 R12: 1ff4000000028fc0
[    8.963545][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[    8.963661][    C1]  ? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:126)
[    8.963755][    C1]  ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[    8.963857][    C1]  default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767)
[    8.963916][    C1]  default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
[    8.963991][    C1]  cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[    8.964087][    C1]  ? arch_cpu_idle_exit+0x40/0x40
[    8.964163][    C1]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52)
[    8.964245][    C1]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[    8.964322][    C1]  do_idle (kernel/sched/idle.c:352)
[    8.964380][    C1]  cpu_startup_entry (kernel/sched/idle.c:450 (discriminator 1))
[    8.964461][    C1]  start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 11) arch/x86/kernel/smpboot.c:280 (discriminator 11))
[    8.964539][    C1]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)


Finger prints:
dst_dev_put:fib6_nh_release:fib6_info_destroy_rcu:rcu_do_batch:rcu_core
print_report:kasan_report:fib6_purge_rt:fib6_del_route:fib6_del