======================================
| [ 2327.170612][    C3] ==================================================================
| [ 2327.170786][    C3] BUG: KASAN: slab-use-after-free in dst_dev_put (net/core/dst.c:147)
| [ 2327.170921][    C3] Read of size 8 at addr ff1100000fa51540 by task swapper/3/0
| [ 2327.171044][    C3]
[ 2327.171097][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2327.171099][    C3] Call Trace:
[ 2327.171101][    C3]  <IRQ>
[ 2327.171102][    C3]  dump_stack_lvl (lib/dump_stack.c:122)
[ 2327.171109][    C3]  print_address_description.constprop.0 (mm/kasan/report.c:379 (discriminator 1))
[ 2327.171114][    C3]  print_report (mm/kasan/report.c:483)
[ 2327.171116][    C3]  ? __virt_addr_valid (./include/linux/rcupdate.h:937 (discriminator 1) ./include/linux/mmzone.h:2197 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[ 2327.171119][    C3]  ? __virt_addr_valid (./include/linux/rcupdate.h:963 (discriminator 4) ./include/linux/mmzone.h:2207 (discriminator 4) arch/x86/mm/physaddr.c:54 (discriminator 4))
[ 2327.171121][    C3]  kasan_report (mm/kasan/report.c:597)
[ 2327.171125][    C3]  ? dst_dev_put (net/core/dst.c:147)
[ 2327.171127][    C3]  ? dst_dev_put (net/core/dst.c:147)
[ 2327.171129][    C3]  dst_dev_put (net/core/dst.c:147)
[ 2327.171130][    C3]  fib6_nh_release_dsts.part.0 (net/ipv6/route.c:3748)
[ 2327.171134][    C3]  fib6_nh_release (net/ipv6/route.c:3729)
[ 2327.171136][    C3]  fib6_info_destroy_rcu (net/ipv6/ip6_fib.c:177)
[ 2327.171139][    C3]  ? rcu_do_batch (kernel/rcu/tree.c:2617)
[ 2327.171142][    C3]  ? rcu_do_batch (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/rcu.h:597 kernel/rcu/tree.c:2612)
[ 2327.171144][    C3]  rcu_do_batch (./include/linux/rcupdate.h:310 (discriminator 2) kernel/rcu/tree.c:2619 (discriminator 2))
[ 2327.171146][    C3]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2541)
[ 2327.171148][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.171150][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[ 2327.171153][    C3]  ? trace_irq_disable.constprop.0 (./include/trace/events/preemptirq.h:36 (discriminator 24))
[ 2327.171154][    C3]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 11) kernel/locking/lockdep.c:4411 (discriminator 11))
[ 2327.171157][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2327.171161][    C3]  rcu_core (kernel/rcu/tree.c:2871)
[ 2327.171163][    C3]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2327.171166][    C3]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 2327.171169][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[ 2327.171171][    C3]  ? _local_bh_enable (kernel/softirq.c:580)
[ 2327.171173][    C3]  __irq_exit_rcu (kernel/softirq.c:496 (discriminator 1) kernel/softirq.c:735 (discriminator 1))
[ 2327.171175][    C3]  irq_exit_rcu (kernel/softirq.c:754)
[ 2327.171178][    C3]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 37) arch/x86/kernel/apic/apic.c:1061 (discriminator 37))
[ 2327.171180][    C3]  </IRQ>
[ 2327.171180][    C3]  <TASK>
[ 2327.171181][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.171182][    C3]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2327.171185][    C3] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:63)
[ 2327.171188][    C3] Code: 48 8b 3d 54 53 60 02 e8 1f 00 00 00 48 2b 05 d8 11 9e 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 13 44 14 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d 54 53 60 02 	mov    0x2605354(%rip),%rdi        # 0x260535b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 d8 11 9e 00 	sub    0x9e11d8(%rip),%rax        # 0x9e11eb
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 13 44 14 00 	verw   0x144413(%rip)        # 0x14443b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[ 2327.171190][    C3] RSP: 0018:ffa0000000167de8 EFLAGS: 00000296
[ 2327.171193][    C3] RAX: 0000000003ff03cd RBX: ff11000001c78040 RCX: ffffffff972df5db
[ 2327.171195][    C3] RDX: ff11000001c78040 RSI: ffffffff9a29008a RDI: ffffffff99c71a40
[ 2327.171196][    C3] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 2327.171196][    C3] R10: 0000000000000003 R11: 0000000000000001 R12: 1ff400000002cfc0
[ 2327.171197][    C3] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 2327.171199][    C3]  ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[ 2327.171203][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2327.171204][    C3]  default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767)
[ 2327.171206][    C3]  default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
[ 2327.171207][    C3]  cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[ 2327.171209][    C3]  ? arch_cpu_idle_exit+0x40/0x40
[ 2327.171211][    C3]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52)
[ 2327.171214][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[ 2327.171216][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.171217][    C3]  do_idle (kernel/sched/idle.c:352)
[ 2327.171219][    C3]  cpu_startup_entry (kernel/sched/idle.c:450 (discriminator 1))
[ 2327.171221][    C3]  start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 11) arch/x86/kernel/smpboot.c:280 (discriminator 11))
[ 2327.171224][    C3]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)
[ 2327.171226][    C3]  common_startup_64 (arch/x86/kernel/head_64.S:419)
| [ 2327.183887][    C3] Disabling lock debugging due to kernel taint
| [ 2327.184000][    C3] Oops: general protection fault, probably for non-canonical address 0xe05a7c3540000007: 0000 [#1] SMP KASAN
| [ 2327.184217][    C3] KASAN: maybe wild-memory-access in range [0x02d401aa00000038-0x02d401aa0000003f]
| [ 2327.184568][    C3] Tainted: [B]=BAD_PAGE
[ 2327.184631][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2327.184743][    C3] RIP: 0010:dst_dev_put (net/core/dst.c:150)
[ 2327.184829][    C3] Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 2c 02 00 00 48 ba 00 00 00 00 00 fc ff df 48 8b 43 08 48 8d 78 38 48 89 f9 48 c1 e9 03 <80> 3c 11 00 0f 85 d8 01 00 00 48 8b 40 38 48 85 c0 74 08 48 89 ee
All code
========
   0:	fc                   	cld
   1:	ff                   	lcall  (bad)
   2:	df 48 c1             	fisttps -0x3f(%rax)
   5:	ea                   	(bad)
   6:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   c:	85 2c 02             	test   %ebp,(%rdx,%rax,1)
   f:	00 00                	add    %al,(%rax)
  11:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  18:	fc ff df 
  1b:	48 8b 43 08          	mov    0x8(%rbx),%rax
  1f:	48 8d 78 38          	lea    0x38(%rax),%rdi
  23:	48 89 f9             	mov    %rdi,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)		<-- trapping instruction
  2e:	0f 85 d8 01 00 00    	jne    0x20c
  34:	48 8b 40 38          	mov    0x38(%rax),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	74 08                	je     0x45
  3d:	48 89 ee             	mov    %rbp,%rsi

Code starting with the faulting instruction
===========================================
   0:	80 3c 11 00          	cmpb   $0x0,(%rcx,%rdx,1)
   4:	0f 85 d8 01 00 00    	jne    0x1e2
   a:	48 8b 40 38          	mov    0x38(%rax),%rax
   e:	48 85 c0             	test   %rax,%rax
  11:	74 08                	je     0x1b
  13:	48 89 ee             	mov    %rbp,%rsi
[ 2327.185200][    C3] RSP: 0018:ffa0000000280d48 EFLAGS: 00010212
[ 2327.185346][    C3] RAX: 02d401aa00000000 RBX: ff1100000fa51540 RCX: 005a803540000007
[ 2327.185464][    C3] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 02d401aa00000038
[ 2327.185588][    C3] RBP: ff1100000c360d70 R08: ffffffff971a8e0a R09: 1ffffffff37f42e8
[ 2327.185710][    C3] R10: fffffbfff37f42e9 R11: fffffbfff37f42e9 R12: ff11000016e81400
[ 2327.185838][    C3] R13: fffffbfff346684c R14: ff11000016e814c8 R15: 000000000000000f
[ 2327.185962][    C3] FS:  0000000000000000(0000) GS:ff110000d024c000(0000) knlGS:0000000000000000
[ 2327.186105][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2327.186208][    C3] CR2: 00007fb06e35e388 CR3: 000000001244a004 CR4: 0000000000771ef0
[ 2327.186333][    C3] PKRU: 55555554
[ 2327.186392][    C3] Call Trace:
[ 2327.186452][    C3]  <IRQ>
[ 2327.186495][    C3]  fib6_nh_release_dsts.part.0 (net/ipv6/route.c:3748)
[ 2327.186588][    C3]  fib6_nh_release (net/ipv6/route.c:3729)
[ 2327.186671][    C3]  fib6_info_destroy_rcu (net/ipv6/ip6_fib.c:177)
[ 2327.186757][    C3]  ? rcu_do_batch (kernel/rcu/tree.c:2617)
[ 2327.186835][    C3]  ? rcu_do_batch (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/rcu.h:597 kernel/rcu/tree.c:2612)
[ 2327.186917][    C3]  rcu_do_batch (./include/linux/rcupdate.h:310 (discriminator 2) kernel/rcu/tree.c:2619 (discriminator 2))
[ 2327.186997][    C3]  ? trace_rcu_batch_end (kernel/rcu/tree.c:2541)
[ 2327.187076][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.187159][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[ 2327.187263][    C3]  ? trace_irq_disable.constprop.0 (./include/trace/events/preemptirq.h:36 (discriminator 24))
[ 2327.187363][    C3]  ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:470 (discriminator 11) kernel/locking/lockdep.c:4411 (discriminator 11))
[ 2327.187466][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2327.187554][    C3]  rcu_core (kernel/rcu/tree.c:2871)
[ 2327.187619][    C3]  handle_softirqs (./arch/x86/include/asm/jump_label.h:37 ./include/trace/events/irq.h:142 kernel/softirq.c:623)
[ 2327.187699][    C3]  ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 2327.187782][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5536)
[ 2327.187862][    C3]  ? _local_bh_enable (kernel/softirq.c:580)
[ 2327.187948][    C3]  __irq_exit_rcu (kernel/softirq.c:496 (discriminator 1) kernel/softirq.c:735 (discriminator 1))
[ 2327.188026][    C3]  irq_exit_rcu (kernel/softirq.c:754)
[ 2327.188086][    C3]  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 37) arch/x86/kernel/apic/apic.c:1061 (discriminator 37))
[ 2327.188165][    C3]  </IRQ>
[ 2327.188207][    C3]  <TASK>
[ 2327.188247][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.188324][    C3]  asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:697)
[ 2327.188425][    C3] RIP: 0010:pv_native_safe_halt (arch/x86/kernel/paravirt.c:63)
[ 2327.188508][    C3] Code: 48 8b 3d 54 53 60 02 e8 1f 00 00 00 48 2b 05 d8 11 9e 00 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa eb 07 0f 00 2d 13 44 14 00 fb f4 <c3> 0f 1f 40 d6 48 83 ec 20 8b 17 49 89 f8 83 e2 fe 41 89 d2 0f 01
All code
========
   0:	48 8b 3d 54 53 60 02 	mov    0x2605354(%rip),%rdi        # 0x260535b
   7:	e8 1f 00 00 00       	call   0x2b
   c:	48 2b 05 d8 11 9e 00 	sub    0x9e11d8(%rip),%rax        # 0x9e11eb
  13:	c3                   	ret
  14:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  1b:	f3 0f 1e fa          	endbr64
  1f:	eb 07                	jmp    0x28
  21:	0f 00 2d 13 44 14 00 	verw   0x144413(%rip)        # 0x14443b
  28:	fb                   	sti
  29:	f4                   	hlt
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	0f 1f 40 d6          	nopl   -0x2a(%rax)
  2f:	48 83 ec 20          	sub    $0x20,%rsp
  33:	8b 17                	mov    (%rdi),%edx
  35:	49 89 f8             	mov    %rdi,%r8
  38:	83 e2 fe             	and    $0xfffffffe,%edx
  3b:	41 89 d2             	mov    %edx,%r10d
  3e:	0f                   	.byte 0xf
  3f:	01                   	.byte 0x1

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	0f 1f 40 d6          	nopl   -0x2a(%rax)
   5:	48 83 ec 20          	sub    $0x20,%rsp
   9:	8b 17                	mov    (%rdi),%edx
   b:	49 89 f8             	mov    %rdi,%r8
   e:	83 e2 fe             	and    $0xfffffffe,%edx
  11:	41 89 d2             	mov    %edx,%r10d
  14:	0f                   	.byte 0xf
  15:	01                   	.byte 0x1
[ 2327.188794][    C3] RSP: 0018:ffa0000000167de8 EFLAGS: 00000296
[ 2327.188897][    C3] RAX: 0000000003ff03cd RBX: ff11000001c78040 RCX: ffffffff972df5db
[ 2327.189019][    C3] RDX: ff11000001c78040 RSI: ffffffff9a29008a RDI: ffffffff99c71a40
[ 2327.189143][    C3] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 2327.189270][    C3] R10: 0000000000000003 R11: 0000000000000001 R12: 1ff400000002cfc0
[ 2327.189399][    C3] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
[ 2327.189520][    C3]  ? cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[ 2327.189625][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
[ 2327.189707][    C3]  default_idle (./arch/x86/include/asm/paravirt.h:62 arch/x86/kernel/process.c:767)
[ 2327.189772][    C3]  default_idle_call (./include/linux/cpuidle.h:143 (discriminator 1) kernel/sched/idle.c:123 (discriminator 1))
[ 2327.189852][    C3]  cpuidle_idle_call.constprop.0 (kernel/sched/idle.c:200)
[ 2327.189958][    C3]  ? arch_cpu_idle_exit+0x40/0x40
[ 2327.190047][    C3]  ? mark_tsc_async_resets (arch/x86/kernel/tsc_sync.c:52)
[ 2327.190125][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 24))
[ 2327.190227][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 2327.190370][    C3]  do_idle (kernel/sched/idle.c:352)
[ 2327.190432][    C3]  cpu_startup_entry (kernel/sched/idle.c:450 (discriminator 1))
[ 2327.190515][    C3]  start_secondary (arch/x86/kernel/smpboot.c:200 (discriminator 11) arch/x86/kernel/smpboot.c:280 (discriminator 11))
[ 2327.190594][    C3]  ? set_cpu_sibling_map (arch/x86/kernel/smpboot.c:230)


Finger prints:
print_report:kasan_report:dst_dev_put:fib6_nh_release:fib6_info_destroy_rcu
dst_dev_put:fib6_nh_release:fib6_info_destroy_rcu:rcu_do_batch:rcu_core