[ 1387.768708][T26809] gre: GRE over IPv4 demultiplexer driver
[ 1388.221966][T26832] ip_gre: GRE over IPv4 tunneling driver
[ 1389.851682][ C2] ==================================================================
[ 1389.851851][ C2] BUG: KASAN: slab-use-after-free in fib_rules_lookup+0xc66/0xc80
[ 1389.851988][ C2] Read of size 8 at addr ff11000010486fc0 by task kworker/2:3/24632
[ 1389.852116][ C2]
[ 1389.852162][ C2] CPU: 2 UID: 0 PID: 24632 Comm: kworker/2:3 Not tainted 7.1.0-rc7-virtme #1 PREEMPT(full)
[ 1389.852166][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1389.852168][ C2] Workqueue: mld mld_ifc_work
[ 1389.852174][ C2] Call Trace:
[ 1389.852175][ C2]
[ 1389.852177][ C2] dump_stack_lvl+0x6f/0xa0
[ 1389.852183][ C2] print_address_description.constprop.0+0x56/0x2d0
[ 1389.852188][ C2] print_report+0xfc/0x1fa
[ 1389.852190][ C2] ? __virt_addr_valid+0x102/0x440
[ 1389.852194][ C2] ? __virt_addr_valid+0x1da/0x440
[ 1389.852196][ C2] kasan_report+0x108/0x130
[ 1389.852200][ C2] ? fib_rules_lookup+0xc66/0xc80
[ 1389.852202][ C2] ? fib_rules_lookup+0xc66/0xc80
[ 1389.852204][ C2] fib_rules_lookup+0xc66/0xc80
[ 1389.852206][ C2] ? fib_nl_delrule+0x80/0x80
[ 1389.852207][ C2] ? l3mdev_update_flow+0xf8/0x550
[ 1389.852210][ C2] ? dev_get_by_index_rcu+0xe6/0x180
[ 1389.852213][ C2] __fib_lookup+0xdb/0x130
[ 1389.852216][ C2] ? fib4_rule_nlmsg_payload+0x10/0x10
[ 1389.852218][ C2] ? mark_usage+0x61/0x170
[ 1389.852221][ C2] ? __lock_acquire+0x508/0xc10
[ 1389.852223][ C2] ip_route_input_slow+0x5eb/0x2400
[ 1389.852226][ C2] ? fib_multipath_hash+0x11b0/0x11b0
[ 1389.852231][ C2] ? rcu_is_watching+0x15/0xd0
[ 1389.852234][ C2] ? lock_acquire+0x134/0x160
[ 1389.852236][ C2] ip_route_input_noref+0x114/0x250
[ 1389.852238][ C2] ? ip_route_input_slow+0x2400/0x2400
[ 1389.852240][ C2] ? __lock_release.isra.0+0x6b/0x1a0
[ 1389.852243][ C2] ip_rcv_finish_core+0x553/0x14c0
[ 1389.852245][ C2] ip_rcv_finish+0xee/0x250
[ 1389.852248][ C2] ? process_backlog+0x561/0x1490
[ 1389.852250][ C2] ip_rcv+0xdc/0x3d0
[ 1389.852252][ C2] ? ip_local_deliver+0x4c0/0x4c0
[ 1389.852254][ C2] ? validate_chain+0x38b/0xc20
[ 1389.852256][ C2] ? rcu_is_watching+0x15/0xd0
[ 1389.852258][ C2] ? mark_usage+0x61/0x170
[ 1389.852259][ C2] ? __lock_acquire+0x508/0xc10
[ 1389.852261][ C2] __netif_receive_skb_one_core+0xfc/0x180
[ 1389.852263][ C2] ? lock_acquire.part.0+0xbc/0x260
[ 1389.852265][ C2] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 1389.852267][ C2] ? rcu_is_watching+0x15/0xd0
[ 1389.852269][ C2] process_backlog+0x2bc/0x1490
[ 1389.852272][ C2] __napi_poll+0xa7/0x3b0
[ 1389.852274][ C2] net_rx_action+0x513/0xf50
[ 1389.852277][ C2] ? __napi_poll+0x3b0/0x3b0
[ 1389.852278][ C2] ? reacquire_held_locks+0x1b0/0x210
[ 1389.852280][ C2] ? __lock_release.isra.0+0x6b/0x1a0
[ 1389.852282][ C2] ? do_raw_spin_unlock+0x59/0x250
[ 1389.852284][ C2] ? _raw_spin_unlock_irqrestore+0x40/0x80
[ 1389.852288][ C2] ? mark_held_locks+0x40/0x70
[ 1389.852290][ C2] handle_softirqs+0x1d8/0x940
[ 1389.852293][ C2] ? _local_bh_enable+0xd0/0xd0
[ 1389.852295][ C2] ? _local_bh_enable+0xd0/0xd0
[ 1389.852297][ C2] do_softirq+0xa9/0xe0
[ 1389.852299][ C2]
[ 1389.852299][ C2]
[ 1389.852300][ C2] ? __dev_queue_xmit+0x956/0x1b70
[ 1389.852301][ C2] __local_bh_enable_ip+0x113/0x140
[ 1389.852303][ C2] __dev_queue_xmit+0x96b/0x1b70
[ 1389.852305][ C2] ? __lock_acquire+0x508/0xc10
[ 1389.852307][ C2] ? netdev_core_pick_tx+0x2c0/0x2c0
[ 1389.852309][ C2] ? eth_header+0x140/0x180
[ 1389.852311][ C2] ? vlan_dev_hard_header+0xf8/0x4d0
[ 1389.852314][ C2] ? mark_held_locks+0x40/0x70
[ 1389.852316][ C2] ? neigh_connected_output+0x2cf/0x5a0
[ 1389.852319][ C2] ip6_finish_output2+0x488/0x1310
[ 1389.852323][ C2] ? ip6_xmit+0x2130/0x2130
[ 1389.852324][ C2] ? find_held_lock+0x2b/0x80
[ 1389.852326][ C2] ? __lock_release.isra.0+0x6b/0x1a0
[ 1389.852327][ C2] ? ip6_mtu+0x174/0x410
[ 1389.852330][ C2] ip6_finish_output+0x701/0xe80
[ 1389.852333][ C2] ip6_output+0x23f/0x7f0
[ 1389.852335][ C2] ? ip6_finish_output+0xe80/0xe80
[ 1389.852336][ C2] ? __lock_release.isra.0+0x6b/0x1a0
[ 1389.852338][ C2] ? xfrm_bundle_lookup.constprop.0+0xba0/0xba0
[ 1389.852340][ C2] ? mark_held_locks+0x40/0x70
[ 1389.852342][ C2] ? __local_bh_enable_ip+0xa5/0x140
[ 1389.852343][ C2] ? __local_bh_enable_ip+0xa5/0x140
[ 1389.852344][ C2] ? icmp6_dst_alloc+0x317/0x4d0
[ 1389.852347][ C2] mld_sendpack+0x9d6/0xec0
[ 1389.852349][ C2] ? find_held_lock+0x2b/0x80
[ 1389.852351][ C2] ? nf_hook.constprop.0+0x340/0x340
[ 1389.852354][ C2] ? mld_send_cr+0x50f/0x820
[ 1389.852356][ C2] mld_ifc_work+0x36/0x190
[ 1389.852357][ C2] ? process_one_work+0xdb7/0x1410
[ 1389.852360][ C2] process_one_work+0xdf8/0x1410
[ 1389.852363][ C2] ? pwq_dec_nr_in_flight+0x710/0x710
[ 1389.852364][ C2] ? lock_acquire.part.0+0xbc/0x260
[ 1389.852367][ C2] worker_thread+0x4f1/0xd60
[ 1389.852370][ C2] ? rescuer_thread+0x1320/0x1320
[ 1389.852371][ C2] ? __kthread_parkme+0xbd/0x210
[ 1389.852374][ C2] ? rescuer_thread+0x1320/0x1320
[ 1389.852376][ C2] kthread+0x367/0x460
[ 1389.852377][ C2] ? trace_irq_enable.constprop.0+0x9b/0x180
[ 1389.852381][ C2] ? kthread_affine_node+0x330/0x330
[ 1389.852383][ C2] ret_from_fork+0x474/0x6b0
[ 1389.852386][ C2] ? arch_exit_to_user_mode_prepare.isra.0+0x120/0x120
[ 1389.852388][ C2] ? __switch_to+0x5a3/0xe00
[ 1389.852391][ C2] ? kthread_affine_node+0x330/0x330
[ 1389.852392][ C2] ret_from_fork_asm+0x11/0x20
[ 1389.852397][ C2]
[ 1389.852397][ C2]
[ 1389.860762][ C2] Allocated by task 26873:
[ 1389.860850][ C2] kasan_save_stack+0x2f/0x50
[ 1389.860938][ C2] kasan_save_track+0x14/0x30
[ 1389.861022][ C2] __kasan_kmalloc+0x7b/0x90
[ 1389.861106][ C2] __kmalloc_node_track_caller_noprof+0x2d6/0x7b0
[ 1389.861212][ C2] kmemdup_noprof+0x25/0x40
[ 1389.861300][ C2] fib_rules_register+0x30/0x590
[ 1389.861385][ C2] fib4_rules_init+0x21/0x140
[ 1389.861471][ C2] fib_net_init+0x165/0x350
[ 1389.861558][ C2] ops_init+0x187/0x560
[ 1389.861623][ C2] setup_net+0x11b/0x3b0
[ 1389.861691][ C2] copy_net_ns+0x383/0x660
[ 1389.861775][ C2] create_new_namespaces+0x371/0xa10
[ 1389.861860][ C2] unshare_nsproxy_namespaces+0xa5/0x1d0
[ 1389.861944][ C2] ksys_unshare+0x353/0x880
[ 1389.862030][ C2] __x64_sys_unshare+0x34/0x50
[ 1389.862114][ C2] do_syscall_64+0x117/0x590
[ 1389.862201][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1389.862306][ C2]
[ 1389.862351][ C2] Freed by task 37:
[ 1389.862417][ C2] kasan_save_stack+0x2f/0x50
[ 1389.862502][ C2] kasan_save_track+0x14/0x30
[ 1389.862586][ C2] kasan_save_free_info+0x3b/0x60
[ 1389.862673][ C2] __kasan_slab_free+0x43/0x70
[ 1389.862758][ C2] kmem_cache_free_bulk.part.0+0x1e3/0x480
[ 1389.862864][ C2] kvfree_rcu_bulk+0x1f1/0x240
[ 1389.862950][ C2] kfree_rcu_work+0x130/0x1b0
[ 1389.863036][ C2] process_one_work+0xdf8/0x1410
[ 1389.863121][ C2] worker_thread+0x4f1/0xd60
[ 1389.863206][ C2] kthread+0x367/0x460
[ 1389.863270][ C2] ret_from_fork+0x474/0x6b0
[ 1389.863354][ C2] ret_from_fork_asm+0x11/0x20
[ 1389.863439][ C2]
[ 1389.863482][ C2] Last potentially related work creation:
[ 1389.863569][ C2] kasan_save_stack+0x2f/0x50
[ 1389.863655][ C2] kasan_record_aux_stack+0x9b/0xc0
[ 1389.863743][ C2] kvfree_call_rcu+0x7e/0x5b0
[ 1389.863827][ C2] ops_undo_list+0x5be/0x8f0
[ 1389.863912][ C2] cleanup_net+0x431/0x940
[ 1389.863998][ C2] process_one_work+0xdf8/0x1410
[ 1389.864082][ C2] worker_thread+0x4f1/0xd60
[ 1389.864167][ C2] kthread+0x367/0x460
[ 1389.864231][ C2] ret_from_fork+0x474/0x6b0
[ 1389.864316][ C2] ret_from_fork_asm+0x11/0x20
[ 1389.864400][ C2]
[ 1389.864444][ C2] The buggy address belongs to the object at ff11000010486f40
[ 1389.864444][ C2] which belongs to the cache kmalloc-192 of size 192
[ 1389.864652][ C2] The buggy address is located 128 bytes inside of
[ 1389.864652][ C2] freed 192-byte region [ff11000010486f40, ff11000010487000)
[ 1389.864862][ C2]
[ 1389.864905][ C2] The buggy address belongs to the physical page:
[ 1389.865010][ C2] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff11000010487e40 pfn:0x10486
[ 1389.865186][ C2] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1389.865317][ C2] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 1389.865430][ C2] page_type: f5(slab)
[ 1389.865498][ C2] raw: 0080000000000240 ff1100000103c4c0 ffd4000000146b10 ffd40000002ad690
[ 1389.865652][ C2] raw: ff11000010487e40 0000000000150012 00000000f5000000 0000000000000000
[ 1389.865803][ C2] head: 0080000000000240 ff1100000103c4c0 ffd4000000146b10 ffd40000002ad690
[ 1389.865956][ C2] head: ff11000010487e40 0000000000150012 00000000f5000000 0000000000000000
[ 1389.866105][ C2] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 1389.866255][ C2] head: ff11000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 1389.866406][ C2] page dumped because: kasan: bad access detected
[ 1389.866513][ C2]
[ 1389.866556][ C2] Memory state around the buggy address:
[ 1389.866640][ C2] ff11000010486e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1389.866772][ C2] ff11000010486f00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 1389.866896][ C2] >ff11000010486f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1389.867019][ C2] ^
[ 1389.867123][ C2] ff11000010487000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1389.867247][ C2] ff11000010487080: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 1389.867369][ C2] ==================================================================
[ 1389.867541][ C2] Disabling lock debugging due to kernel taint
[ 1400.238926][T27403] ip6_gre: GRE over IPv6 tunneling driver
[ 1407.586980][ C2] ip6_tunnel: tep0 xmit: Local address not yet configured!
[ 1409.187978][ C3] ip6_tunnel: tep0 xmit: Local address not yet configured!
[ 1410.723980][ C3] ip6_tunnel: tep0 xmit: Local address not yet configured!
[ 1412.322987][ C2] ip6_tunnel: tep0 xmit: Local address not yet configured!