[ 8.711173][ T203] ------------[ cut here ]------------
[ 8.711389][ T203] WARNING: ./include/linux/skbuff.h:3094 at geneve_udp_encap_recv+0x933/0xc68 [geneve], CPU#3: tun/203
[ 8.711670][ T203] Modules linked in: geneve
[ 8.711847][ T203] CPU: 3 UID: 0 PID: 203 Comm: tun Not tainted 7.1.0-virtme #1 PREEMPT(full)
[ 8.712141][ T203] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 8.712317][ T203] RIP: 0010:geneve_udp_encap_recv+0x933/0xc68 [geneve]
[ 8.712500][ T203] Code: df 48 c1 ee 03 0f b6 34 06 48 89 f8 83 e0 07 83 c0 03 40 38 f0 7c 09 40 84 f6 0f 85 f9 02 00 00 41 8b 76 0c e9 13 fd ff ff 90 <0f> 0b 90 e9 1b fc ff ff 90 0f 0b 90 e9 66 fe ff ff 48 8d b9 a0 00
[ 8.712989][ T203] RSP: 0018:ffa00000008b73c0 EFLAGS: 00010246
[ 8.713163][ T203] RAX: 0000000000000007 RBX: ff1100000ce68000 RCX: 0000000000000001
[ 8.713414][ T203] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ff1100000d67e7c1
[ 8.713616][ T203] RBP: ffa00000008b7490 R08: ffffffff8faf86bb R09: 1fe2200000a1b8d0
[ 8.713815][ T203] R10: ffe21c0000a1b8d1 R11: ffe21c0000a1b8d1 R12: 0000000000000000
[ 8.714019][ T203] R13: 000000000000ffff R14: ff1100000e0d4e80 R15: ff1100000d67e740
[ 8.714222][ T203] FS: 00007f8d666ba740(0000) GS:ff110000d9630000(0000) knlGS:0000000000000000
[ 8.714457][ T203] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.714625][ T203] CR2: 00007fff304869c0 CR3: 000000000c2bf005 CR4: 0000000000771ef0
[ 8.714826][ T203] PKRU: 55555554
[ 8.714930][ T203] Call Trace:
[ 8.715037][ T203]
[ 8.715106][ T203] ? udp_lib_lport_inuse2+0x3d0/0x3d0
[ 8.715245][ T203] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 8.715416][ T203] ? __udp4_lib_lookup+0x5f1/0x820
[ 8.715550][ T203] ? __xfrm_policy_check2.constprop.0+0x36/0x5f0
[ 8.715716][ T203] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 8.715883][ T203] udp_queue_rcv_one_skb+0x645/0xb00
[ 8.716020][ T203] ? lock_acquire.part.0+0xbc/0x260
[ 8.716155][ T203] ? hlock_conflict+0xb2/0xd0
[ 8.716289][ T203] udp_unicast_rcv_skb+0x366/0x450
[ 8.716424][ T203] ? udp_rcv+0xce3/0x1e30
[ 8.716525][ T203] udp_rcv+0xd01/0x1e30
[ 8.716629][ T203] ? udp_sk_rx_dst_set+0x90/0x90
[ 8.716766][ T203] ? lock_acquire.part.0+0xbc/0x260
[ 8.716899][ T203] ? ip_local_deliver_finish+0x2ba/0x610
[ 8.717039][ T203] ip_protocol_deliver_rcu+0x82/0x350
[ 8.717174][ T203] ip_local_deliver_finish+0x36f/0x610
[ 8.717307][ T203] ? __lock_acquire+0x518/0xc20
[ 8.717446][ T203] ip_local_deliver+0x184/0x4c0
[ 8.717578][ T203] ? ip_local_deliver_finish+0x610/0x610
[ 8.717715][ T203] ? ip_rcv_finish_core+0x553/0x14c0
[ 8.717855][ T203] ip_rcv+0xdc/0x3d0
[ 8.717956][ T203] ? ip_local_deliver+0x4c0/0x4c0
[ 8.718095][ T203] ? rcu_read_lock_any_held+0x3c/0x90
[ 8.718229][ T203] ? validate_chain+0x38b/0xc20
[ 8.718367][ T203] ? mark_usage+0x61/0x170
[ 8.718501][ T203] ? lock_acquire.part.0+0xbc/0x260
[ 8.718635][ T203] ? find_held_lock+0x2b/0x80
[ 8.718768][ T203] ? __lock_acquire+0x518/0xc20
[ 8.718902][ T203] __netif_receive_skb_one_core+0xfc/0x180
[ 8.719072][ T203] ? lock_acquire.part.0+0xbc/0x260
[ 8.719206][ T203] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 8.719377][ T203] ? rcu_is_watching+0x15/0xd0
[ 8.719513][ T203] netif_receive_skb_internal+0xb0/0x330
[ 8.719647][ T203] ? __might_fault+0x97/0x140
[ 8.719783][ T203] ? __netif_receive_skb+0x150/0x150
[ 8.719917][ T203] ? _copy_from_iter+0x1bb/0x1810
[ 8.720057][ T203] ? __alloc_skb+0x342/0x5f0
[ 8.720191][ T203] ? __alloc_skb+0x4c2/0x5f0
[ 8.720324][ T203] netif_receive_skb+0x56/0x340
[ 8.720460][ T203] ? __local_bh_disable_ip+0x82/0x110
[ 8.720594][ T203] tun_rx_batched.isra.0+0x3d5/0x790
[ 8.720730][ T203] ? mark_usage+0x61/0x170
[ 8.720865][ T203] ? tun_setup+0x2d0/0x2d0
[ 8.721005][ T203] ? rcu_is_watching+0x15/0xd0
[ 8.721137][ T203] ? sock_alloc_send_pskb+0x33b/0x3f0
[ 8.721271][ T203] ? lock_acquire+0x13c/0x160
[ 8.721411][ T203] tun_get_user+0x1688/0x2650
[ 8.721547][ T203] ? tun_build_skb+0x1500/0x1500
[ 8.721682][ T203] ? ref_tracker_dir_print+0x100/0x100
[ 8.721821][ T203] ? find_held_lock+0x2b/0x80
[ 8.721955][ T203] ? __lock_release.isra.0+0x6b/0x1a0
[ 8.722093][ T203] ? tun_get_user+0x2650/0x2650
[ 8.722226][ T203] ? tun_get+0x106/0x240
[ 8.722327][ T203] tun_chr_write_iter+0xb5/0x1a0
[ 8.722464][ T203] ? tun_get_user+0x2650/0x2650
[ 8.722599][ T203] new_sync_write+0x33e/0x760
[ 8.722734][ T203] ? __handle_mm_fault+0x5ed/0x840
[ 8.722869][ T203] ? new_sync_read+0x750/0x750
[ 8.723008][ T203] ? __pmd_alloc+0x840/0x840
[ 8.723141][ T203] ? __lock_downgrade.isra.0+0xbd/0x200
[ 8.723277][ T203] ? __up_read+0x25f/0x9c0
[ 8.723414][ T203] ? __up_read+0x345/0x9c0
[ 8.723547][ T203] vfs_write+0x6a4/0xbe0
[ 8.723648][ T203] ? down_write_nested+0x200/0x200
[ 8.723782][ T203] ? __lock_release.isra.0+0x6b/0x1a0
[ 8.723919][ T203] ksys_write+0x116/0x250
[ 8.724025][ T203] ? __ia32_sys_read+0xc0/0xc0
[ 8.724159][ T203] ? rcu_is_watching+0x15/0xd0
[ 8.724291][ T203] ? rcu_is_watching+0x15/0xd0
[ 8.724429][ T203] do_syscall_64+0x117/0x590
[ 8.724564][ T203] ? trace_hardirqs_off+0xd/0x30
[ 8.724698][ T203] ? exc_page_fault+0xee/0x100
[ 8.724832][ T203] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 8.725006][ T203] RIP: 0033:0x7f8d6672c64e
[ 8.725151][ T203] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 8.725625][ T203] RSP: 002b:00007fff30487380 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 8.725830][ T203] RAX: ffffffffffffffda RBX: 0000000000000075 RCX: 00007f8d6672c64e
[ 8.726039][ T203] RDX: 0000000000000075 RSI: 00007fff304873f0 RDI: 0000000000000005
[ 8.726240][ T203] RBP: 00007fff30487390 R08: 0000000000000000 R09: 0000000000000000
[ 8.726444][ T203] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000075
[ 8.726645][ T203] R13: 0000000000427fa0 R14: 0000000000000002 R15: 00007f8d666b4000
[ 8.726854][ T203]
[ 8.726955][ T203] irq event stamp: 37462
[ 8.727060][ T203] hardirqs last enabled at (37472): [] __up_console_sem+0x5a/0x70
[ 8.727396][ T203] hardirqs last disabled at (37479): [] __up_console_sem+0x3f/0x70
[ 8.727629][ T203] softirqs last enabled at (36558): [] tun_get_user+0x1570/0x2650
[ 8.727861][ T203] softirqs last disabled at (36560): [] tun_rx_batched.isra.0+0x436/0x790
[ 8.728134][ T203] ---[ end trace 0000000000000000 ]---
[ 19.455304][ T226] ==================================================================
[ 19.455487][ T226] BUG: KASAN: use-after-free in geneve_rx+0x160e/0x1f80 [geneve]
[ 19.455624][ T226] Read of size 1 at addr ff1100001519d008 by task tun/226
[ 19.455732][ T226]
[ 19.455777][ T226] CPU: 3 UID: 0 PID: 226 Comm: tun Tainted: G W 7.1.0-virtme #1 PREEMPT(full)
[ 19.455781][ T226] Tainted: [W]=WARN
[ 19.455782][ T226] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 19.455784][ T226] Call Trace:
[ 19.455786][ T226]
[ 19.455787][ T226] dump_stack_lvl+0x6f/0xa0
[ 19.455793][ T226] print_address_description.constprop.0+0x56/0x2d0
[ 19.455798][ T226] print_report+0xfc/0x1fa
[ 19.455800][ T226] ? __virt_addr_valid+0x102/0x440
[ 19.455803][ T226] ? __virt_addr_valid+0x1da/0x440
[ 19.455805][ T226] kasan_report+0x108/0x130
[ 19.455809][ T226] ? geneve_rx+0x160e/0x1f80 [geneve]
[ 19.455811][ T226] ? geneve_rx+0x160e/0x1f80 [geneve]
[ 19.455814][ T226] geneve_rx+0x160e/0x1f80 [geneve]
[ 19.455815][ T226] ? geneve_udp_encap_recv+0x933/0xc68 [geneve]
[ 19.455818][ T226] ? exc_invalid_op+0x1d/0x60
[ 19.455822][ T226] ? geneve_gro_receive+0x1630/0x1630 [geneve]
[ 19.455824][ T226] ? INET_ECN_decapsulate+0x9a0/0x9a0 [geneve]
[ 19.455826][ T226] ? dst_release+0x3b/0x250
[ 19.455831][ T226] geneve_udp_encap_recv+0x5b1/0xc68 [geneve]
[ 19.455833][ T226] ? udp_lib_lport_inuse2+0x3d0/0x3d0
[ 19.455836][ T226] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 19.455838][ T226] ? __udp4_lib_lookup+0x5f1/0x820
[ 19.455840][ T226] ? __xfrm_policy_check2.constprop.0+0x36/0x5f0
[ 19.455842][ T226] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 19.455844][ T226] udp_queue_rcv_one_skb+0x645/0xb00
[ 19.455845][ T226] ? lock_acquire.part.0+0xbc/0x260
[ 19.455849][ T226] ? hlock_conflict+0xb2/0xd0
[ 19.455851][ T226] udp_unicast_rcv_skb+0x366/0x450
[ 19.455853][ T226] ? udp_rcv+0xce3/0x1e30
[ 19.455855][ T226] udp_rcv+0xd01/0x1e30
[ 19.455857][ T226] ? udp_sk_rx_dst_set+0x90/0x90
[ 19.455859][ T226] ? lock_acquire.part.0+0xbc/0x260
[ 19.455861][ T226] ? ip_local_deliver_finish+0x2ba/0x610
[ 19.455864][ T226] ip_protocol_deliver_rcu+0x82/0x350
[ 19.455866][ T226] ip_local_deliver_finish+0x36f/0x610
[ 19.455868][ T226] ip_local_deliver+0x184/0x4c0
[ 19.455870][ T226] ? kasan_save_track+0x14/0x30
[ 19.455872][ T226] ? ip_local_deliver_finish+0x610/0x610
[ 19.455873][ T226] ? ip_rcv_finish_core+0x553/0x14c0
[ 19.455876][ T226] ip_rcv+0xdc/0x3d0
[ 19.455880][ T226] ? ip_local_deliver+0x4c0/0x4c0
[ 19.455882][ T226] ? rcu_read_lock_any_held+0x3c/0x90
[ 19.455885][ T226] ? validate_chain+0x38b/0xc20
[ 19.455887][ T226] ? mark_usage+0x61/0x170
[ 19.455889][ T226] ? __lock_acquire+0x518/0xc20
[ 19.455891][ T226] __netif_receive_skb_one_core+0xfc/0x180
[ 19.455893][ T226] ? lock_acquire.part.0+0xbc/0x260
[ 19.455895][ T226] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 19.455896][ T226] ? rcu_is_watching+0x15/0xd0
[ 19.455899][ T226] netif_receive_skb_internal+0xb0/0x330
[ 19.455900][ T226] ? __might_fault+0x97/0x140
[ 19.455903][ T226] ? __netif_receive_skb+0x150/0x150
[ 19.455905][ T226] ? _copy_from_iter+0x1bb/0x1810
[ 19.455909][ T226] ? __alloc_skb+0x342/0x5f0
[ 19.455911][ T226] ? __alloc_skb+0x4c2/0x5f0
[ 19.455913][ T226] netif_receive_skb+0x56/0x340
[ 19.455914][ T226] ? __local_bh_disable_ip+0x82/0x110
[ 19.455917][ T226] tun_rx_batched.isra.0+0x3d5/0x790
[ 19.455920][ T226] ? mark_usage+0x61/0x170
[ 19.455922][ T226] ? tun_setup+0x2d0/0x2d0
[ 19.455924][ T226] ? rcu_is_watching+0x15/0xd0
[ 19.455926][ T226] ? sock_alloc_send_pskb+0x33b/0x3f0
[ 19.455928][ T226] ? lock_acquire+0x13c/0x160
[ 19.455930][ T226] tun_get_user+0x1688/0x2650
[ 19.455933][ T226] ? tun_build_skb+0x1500/0x1500
[ 19.455935][ T226] ? ref_tracker_dir_print+0x100/0x100
[ 19.455939][ T226] ? find_held_lock+0x2b/0x80
[ 19.455941][ T226] ? __lock_release.isra.0+0x6b/0x1a0
[ 19.455943][ T226] ? tun_get_user+0x2650/0x2650
[ 19.455944][ T226] ? tun_get+0x106/0x240
[ 19.455946][ T226] tun_chr_write_iter+0xb5/0x1a0
[ 19.455948][ T226] ? tun_get_user+0x2650/0x2650
[ 19.455949][ T226] new_sync_write+0x33e/0x760
[ 19.455952][ T226] ? __handle_mm_fault+0x5ed/0x840
[ 19.455954][ T226] ? new_sync_read+0x750/0x750
[ 19.455956][ T226] ? __pmd_alloc+0x840/0x840
[ 19.455957][ T226] ? __lock_downgrade.isra.0+0xbd/0x200
[ 19.455960][ T226] ? __up_read+0x25f/0x9c0
[ 19.455961][ T226] ? __up_read+0x345/0x9c0
[ 19.455963][ T226] vfs_write+0x6a4/0xbe0
[ 19.455964][ T226] ? down_write_nested+0x200/0x200
[ 19.455966][ T226] ? __lock_release.isra.0+0x6b/0x1a0
[ 19.455968][ T226] ksys_write+0x116/0x250
[ 19.455970][ T226] ? __ia32_sys_read+0xc0/0xc0
[ 19.455972][ T226] ? rcu_is_watching+0x15/0xd0
[ 19.455973][ T226] ? rcu_is_watching+0x15/0xd0
[ 19.455974][ T226] do_syscall_64+0x117/0x590
[ 19.455976][ T226] ? trace_hardirqs_off+0xd/0x30
[ 19.455979][ T226] ? exc_page_fault+0xee/0x100
[ 19.455982][ T226] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 19.455984][ T226] RIP: 0033:0x7f8d6672c64e
[ 19.455987][ T226] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 19.455988][ T226] RSP: 002b:00007fff30487380 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 19.455992][ T226] RAX: ffffffffffffffda RBX: 0000000000000602 RCX: 00007f8d6672c64e
[ 19.455994][ T226] RDX: 0000000000000602 RSI: 00007fff304873f0 RDI: 0000000000000005
[ 19.455995][ T226] RBP: 00007fff30487390 R08: 0000000000000000 R09: 0000000000000000
[ 19.455995][ T226] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000602
[ 19.455996][ T226] R13: 0000000000427f80 R14: 0000000000000002 R15: 00007f8d666b4000
[ 19.455999][ T226]
[ 19.455999][ T226]
[ 19.465206][ T226] The buggy address belongs to the physical page:
[ 19.465319][ T226] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1519d
[ 19.465474][ T226] flags: 0x80000000000000(node=0|zone=1)
[ 19.465565][ T226] raw: 0080000000000000 ffd4000000546748 ffd4000000546748 0000000000000000
[ 19.465718][ T226] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 19.465868][ T226] page dumped because: kasan: bad access detected
[ 19.465974][ T226]
[ 19.466018][ T226] Memory state around the buggy address:
[ 19.466103][ T226] ff1100001519cf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 19.466229][ T226] ff1100001519cf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 19.466358][ T226] >ff1100001519d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 19.466487][ T226] ^
[ 19.466555][ T226] ff1100001519d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 19.466684][ T226] ff1100001519d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 19.466808][ T226] ==================================================================
[ 19.466950][ T226] Disabling lock debugging due to kernel taint