[ 1479.062303][T26024] ------------[ cut here ]------------
[ 1479.062542][T26024] WARNING: ./include/linux/skbuff.h:3094 at geneve_udp_encap_recv+0x933/0xc68 [geneve], CPU#1: tun/26024
[ 1479.062945][T26024] Modules linked in: geneve ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 nft_compat nf_tables
[ 1479.063336][T26024] CPU: 1 UID: 0 PID: 26024 Comm: tun Not tainted 7.1.0-virtme #1 PREEMPT(full)
[ 1479.063594][T26024] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1479.063772][T26024] RIP: 0010:geneve_udp_encap_recv+0x933/0xc68 [geneve]
[ 1479.063955][T26024] Code: df 48 c1 ee 03 0f b6 34 06 48 89 f8 83 e0 07 83 c0 03 40 38 f0 7c 09 40 84 f6 0f 85 f9 02 00 00 41 8b 76 0c e9 13 fd ff ff 90 <0f> 0b 90 e9 1b fc ff ff 90 0f 0b 90 e9 66 fe ff ff 48 8d b9 a0 00
[ 1479.064525][T26024] RSP: 0018:ffa00000010f73c0 EFLAGS: 00010246
[ 1479.064703][T26024] RAX: 0000000000000007 RBX: ff11000015340000 RCX: 0000000000000001
[ 1479.064911][T26024] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ff110000099ab781
[ 1479.065230][T26024] RBP: ffa00000010f7490 R08: ffffffffbaef86bb R09: 1fe220000170dae0
[ 1479.065541][T26024] R10: ffe21c000170dae1 R11: ffe21c000170dae1 R12: 0000000000000000
[ 1479.065842][T26024] R13: 000000000000ffff R14: ff11000012734e80 R15: ff110000099ab700
[ 1479.066051][T26024] FS: 00007f10f039a740(0000) GS:ff110000ae130000(0000) knlGS:0000000000000000
[ 1479.066398][T26024] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1479.066578][T26024] CR2: 00007fffe67d7d00 CR3: 000000000277e001 CR4: 0000000000771ef0
[ 1479.066787][T26024] PKRU: 55555554
[ 1479.066987][T26024] Call Trace:
[ 1479.067094][T26024]
[ 1479.067167][T26024] ? udp_lib_lport_inuse2+0x3d0/0x3d0
[ 1479.067319][T26024] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 1479.067498][T26024] ? __udp4_lib_lookup+0x5f1/0x820
[ 1479.067736][T26024] ? __xfrm_policy_check2.constprop.0+0x36/0x5f0
[ 1479.067910][T26024] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 1479.068083][T26024] udp_queue_rcv_one_skb+0x645/0xb00
[ 1479.068325][T26024] ? lock_acquire.part.0+0xbc/0x260
[ 1479.068476][T26024] ? hlock_conflict+0xb2/0xd0
[ 1479.068624][T26024] udp_unicast_rcv_skb+0x366/0x450
[ 1479.068765][T26024] ? udp_rcv+0xce3/0x1e30
[ 1479.068869][T26024] udp_rcv+0xd01/0x1e30
[ 1479.069071][T26024] ? udp_sk_rx_dst_set+0x90/0x90
[ 1479.069234][T26024] ? lock_acquire.part.0+0xbc/0x260
[ 1479.069373][T26024] ? ip_local_deliver_finish+0x2ba/0x610
[ 1479.069539][T26024] ip_protocol_deliver_rcu+0x82/0x350
[ 1479.069775][T26024] ip_local_deliver_finish+0x36f/0x610
[ 1479.069914][T26024] ? __lock_acquire+0x518/0xc20
[ 1479.070052][T26024] ip_local_deliver+0x184/0x4c0
[ 1479.070189][T26024] ? ip_local_deliver_finish+0x610/0x610
[ 1479.070338][T26024] ? ip_rcv_finish_core+0x553/0x14c0
[ 1479.070485][T26024] ip_rcv+0xdc/0x3d0
[ 1479.070589][T26024] ? ip_local_deliver+0x4c0/0x4c0
[ 1479.070727][T26024] ? __lock_acquire+0x518/0xc20
[ 1479.070869][T26024] ? update_group_capacity+0x375/0x660
[ 1479.071008][T26024] ? mark_usage+0x61/0x170
[ 1479.071147][T26024] ? __lock_acquire+0x518/0xc20
[ 1479.071295][T26024] ? mutex_spin_on_owner+0x157/0x2f0
[ 1479.071436][T26024] __netif_receive_skb_one_core+0xfc/0x180
[ 1479.071609][T26024] ? lock_acquire.part.0+0xbc/0x260
[ 1479.071748][T26024] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 1479.071921][T26024] ? rcu_is_watching+0x15/0xd0
[ 1479.072061][T26024] netif_receive_skb_internal+0xb0/0x330
[ 1479.072199][T26024] ? __netif_receive_skb+0x150/0x150
[ 1479.072339][T26024] ? find_held_lock+0x2b/0x80
[ 1479.072482][T26024] ? __lock_release.isra.0+0x6b/0x1a0
[ 1479.072621][T26024] netif_receive_skb+0x56/0x340
[ 1479.072759][T26024] ? __local_bh_disable_ip+0x82/0x110
[ 1479.072900][T26024] tun_rx_batched.isra.0+0x3d5/0x790
[ 1479.073041][T26024] ? mark_usage+0x61/0x170
[ 1479.073178][T26024] ? lockdep_hardirqs_on+0x8c/0x130
[ 1479.073324][T26024] ? tun_setup+0x2d0/0x2d0
[ 1479.073473][T26024] ? rcu_is_watching+0x15/0xd0
[ 1479.073611][T26024] ? lock_acquire+0x13c/0x160
[ 1479.073750][T26024] tun_get_user+0x1688/0x2650
[ 1479.073892][T26024] ? tun_build_skb+0x1500/0x1500
[ 1479.074031][T26024] ? ref_tracker_dir_print+0x100/0x100
[ 1479.074172][T26024] ? find_held_lock+0x2b/0x80
[ 1479.074325][T26024] ? __lock_release.isra.0+0x6b/0x1a0
[ 1479.074468][T26024] ? tun_get_user+0x2650/0x2650
[ 1479.074604][T26024] ? tun_get+0x106/0x240
[ 1479.074709][T26024] tun_chr_write_iter+0xb5/0x1a0
[ 1479.074848][T26024] ? tun_get_user+0x2650/0x2650
[ 1479.074987][T26024] new_sync_write+0x33e/0x760
[ 1479.075127][T26024] ? __handle_mm_fault+0x5ed/0x840
[ 1479.075275][T26024] ? new_sync_read+0x750/0x750
[ 1479.075413][T26024] ? __pmd_alloc+0x840/0x840
[ 1479.075558][T26024] ? __lock_downgrade.isra.0+0xbd/0x200
[ 1479.075699][T26024] ? __up_read+0x25f/0x9c0
[ 1479.075835][T26024] ? __up_read+0x345/0x9c0
[ 1479.075976][T26024] vfs_write+0x6a4/0xbe0
[ 1479.076080][T26024] ? down_write_nested+0x200/0x200
[ 1479.076218][T26024] ? __lock_release.isra.0+0x6b/0x1a0
[ 1479.076363][T26024] ksys_write+0x116/0x250
[ 1479.076471][T26024] ? __ia32_sys_read+0xc0/0xc0
[ 1479.076610][T26024] ? rcu_is_watching+0x15/0xd0
[ 1479.076747][T26024] ? rcu_is_watching+0x15/0xd0
[ 1479.076884][T26024] do_syscall_64+0x117/0x590
[ 1479.077120][T26024] ? trace_hardirqs_off+0xd/0x30
[ 1479.077265][T26024] ? exc_page_fault+0xee/0x100
[ 1479.077403][T26024] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1479.077577][T26024] RIP: 0033:0x7f10f040c64e
[ 1479.077821][T26024] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 1479.078416][T26024] RSP: 002b:00007fffe67d86c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 1479.078631][T26024] RAX: ffffffffffffffda RBX: 0000000000000075 RCX: 00007f10f040c64e
[ 1479.078838][T26024] RDX: 0000000000000075 RSI: 00007fffe67d8730 RDI: 0000000000000005
[ 1479.079046][T26024] RBP: 00007fffe67d86d0 R08: 0000000000000000 R09: 0000000000000000
[ 1479.079262][T26024] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000075
[ 1479.079473][T26024] R13: 0000000000427fa0 R14: 0000000000000002 R15: 00007f10f0394000
[ 1479.079686][T26024]
[ 1479.079792][T26024] irq event stamp: 36174
[ 1479.079896][T26024] hardirqs last enabled at (36182): [] __up_console_sem+0x5a/0x70
[ 1479.080236][T26024] hardirqs last disabled at (36191): [] __up_console_sem+0x3f/0x70
[ 1479.080577][T26024] softirqs last enabled at (35246): [] tun_get_user+0x1570/0x2650
[ 1479.080915][T26024] softirqs last disabled at (35252): [] tun_rx_batched.isra.0+0x436/0x790
[ 1479.081187][T26024] ---[ end trace 0000000000000000 ]---
[ 1490.069067][T26052] ==================================================================
[ 1490.069243][T26052] BUG: KASAN: use-after-free in geneve_rx+0x160e/0x1f80 [geneve]
[ 1490.069380][T26052] Read of size 1 at addr ff11000019f9b808 by task tun/26052
[ 1490.069516][T26052]
[ 1490.069564][T26052] CPU: 0 UID: 0 PID: 26052 Comm: tun Tainted: G W 7.1.0-virtme #1 PREEMPT(full)
[ 1490.069568][T26052] Tainted: [W]=WARN
[ 1490.069569][T26052] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1490.069571][T26052] Call Trace:
[ 1490.069572][T26052]
[ 1490.069573][T26052] dump_stack_lvl+0x6f/0xa0
[ 1490.069580][T26052] print_address_description.constprop.0+0x56/0x2d0
[ 1490.069585][T26052] print_report+0xfc/0x1fa
[ 1490.069588][T26052] ? __virt_addr_valid+0x102/0x440
[ 1490.069591][T26052] ? __virt_addr_valid+0x1da/0x440
[ 1490.069592][T26052] kasan_report+0x108/0x130
[ 1490.069596][T26052] ? geneve_rx+0x160e/0x1f80 [geneve]
[ 1490.069599][T26052] ? geneve_rx+0x160e/0x1f80 [geneve]
[ 1490.069601][T26052] geneve_rx+0x160e/0x1f80 [geneve]
[ 1490.069603][T26052] ? geneve_udp_encap_recv+0x933/0xc68 [geneve]
[ 1490.069605][T26052] ? exc_invalid_op+0x1d/0x60
[ 1490.069610][T26052] ? geneve_gro_receive+0x1630/0x1630 [geneve]
[ 1490.069613][T26052] ? INET_ECN_decapsulate+0x9a0/0x9a0 [geneve]
[ 1490.069615][T26052] ? dst_release+0x3b/0x250
[ 1490.069619][T26052] geneve_udp_encap_recv+0x5b1/0xc68 [geneve]
[ 1490.069621][T26052] ? udp_lib_lport_inuse2+0x3d0/0x3d0
[ 1490.069625][T26052] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 1490.069627][T26052] ? __udp4_lib_lookup+0x5f1/0x820
[ 1490.069629][T26052] ? __xfrm_policy_check2.constprop.0+0x36/0x5f0
[ 1490.069631][T26052] ? geneve_udp_encap_err_lookup+0x920/0x920 [geneve]
[ 1490.069633][T26052] udp_queue_rcv_one_skb+0x645/0xb00
[ 1490.069634][T26052] ? lock_acquire.part.0+0xbc/0x260
[ 1490.069637][T26052] ? hlock_conflict+0xb2/0xd0
[ 1490.069639][T26052] udp_unicast_rcv_skb+0x366/0x450
[ 1490.069641][T26052] ? udp_rcv+0xce3/0x1e30
[ 1490.069643][T26052] udp_rcv+0xd01/0x1e30
[ 1490.069646][T26052] ? udp_sk_rx_dst_set+0x90/0x90
[ 1490.069648][T26052] ? lock_acquire.part.0+0xbc/0x260
[ 1490.069650][T26052] ? ip_local_deliver_finish+0x2ba/0x610
[ 1490.069653][T26052] ip_protocol_deliver_rcu+0x82/0x350
[ 1490.069655][T26052] ip_local_deliver_finish+0x36f/0x610
[ 1490.069657][T26052] ip_local_deliver+0x184/0x4c0
[ 1490.069659][T26052] ? kasan_save_track+0x14/0x30
[ 1490.069661][T26052] ? ip_local_deliver_finish+0x610/0x610
[ 1490.069663][T26052] ? ip_rcv_finish_core+0x553/0x14c0
[ 1490.069666][T26052] ip_rcv+0xdc/0x3d0
[ 1490.069668][T26052] ? ip_local_deliver+0x4c0/0x4c0
[ 1490.069669][T26052] ? rcu_read_lock_any_held+0x3c/0x90
[ 1490.069672][T26052] ? validate_chain+0x38b/0xc20
[ 1490.069674][T26052] ? mark_usage+0x61/0x170
[ 1490.069676][T26052] ? __lock_acquire+0x518/0xc20
[ 1490.069678][T26052] __netif_receive_skb_one_core+0xfc/0x180
[ 1490.069680][T26052] ? lock_acquire.part.0+0xbc/0x260
[ 1490.069682][T26052] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 1490.069684][T26052] ? rcu_is_watching+0x15/0xd0
[ 1490.069686][T26052] netif_receive_skb_internal+0xb0/0x330
[ 1490.069688][T26052] ? __might_fault+0x97/0x140
[ 1490.069692][T26052] ? __netif_receive_skb+0x150/0x150
[ 1490.069694][T26052] ? _copy_from_iter+0x1bb/0x1810
[ 1490.069698][T26052] ? __alloc_skb+0x342/0x5f0
[ 1490.069700][T26052] ? __alloc_skb+0x4c2/0x5f0
[ 1490.069702][T26052] netif_receive_skb+0x56/0x340
[ 1490.069704][T26052] ? __local_bh_disable_ip+0x82/0x110
[ 1490.069706][T26052] tun_rx_batched.isra.0+0x3d5/0x790
[ 1490.069710][T26052] ? mark_usage+0x61/0x170
[ 1490.069712][T26052] ? tun_setup+0x2d0/0x2d0
[ 1490.069714][T26052] ? rcu_is_watching+0x15/0xd0
[ 1490.069715][T26052] ? sock_alloc_send_pskb+0x33b/0x3f0
[ 1490.069718][T26052] ? lock_acquire+0x13c/0x160
[ 1490.069720][T26052] tun_get_user+0x1688/0x2650
[ 1490.069723][T26052] ? tun_build_skb+0x1500/0x1500
[ 1490.069725][T26052] ? ref_tracker_dir_print+0x100/0x100
[ 1490.069728][T26052] ? find_held_lock+0x2b/0x80
[ 1490.069730][T26052] ? __lock_release.isra.0+0x6b/0x1a0
[ 1490.069732][T26052] ? tun_get_user+0x2650/0x2650
[ 1490.069734][T26052] ? tun_get+0x106/0x240
[ 1490.069736][T26052] tun_chr_write_iter+0xb5/0x1a0
[ 1490.069737][T26052] ? tun_get_user+0x2650/0x2650
[ 1490.069739][T26052] new_sync_write+0x33e/0x760
[ 1490.069742][T26052] ? __handle_mm_fault+0x5ed/0x840
[ 1490.069744][T26052] ? new_sync_read+0x750/0x750
[ 1490.069746][T26052] ? __pmd_alloc+0x840/0x840
[ 1490.069747][T26052] ? __lock_downgrade.isra.0+0xbd/0x200
[ 1490.069750][T26052] ? __up_read+0x25f/0x9c0
[ 1490.069752][T26052] ? __up_read+0x345/0x9c0
[ 1490.069753][T26052] vfs_write+0x6a4/0xbe0
[ 1490.069755][T26052] ? down_write_nested+0x200/0x200
[ 1490.069757][T26052] ? __lock_release.isra.0+0x6b/0x1a0
[ 1490.069759][T26052] ksys_write+0x116/0x250
[ 1490.069761][T26052] ? __ia32_sys_read+0xc0/0xc0
[ 1490.069763][T26052] ? rcu_is_watching+0x15/0xd0
[ 1490.069764][T26052] ? rcu_is_watching+0x15/0xd0
[ 1490.069766][T26052] do_syscall_64+0x117/0x590
[ 1490.069768][T26052] ? trace_hardirqs_off+0xd/0x30
[ 1490.069770][T26052] ? exc_page_fault+0xee/0x100
[ 1490.069773][T26052] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1490.069775][T26052] RIP: 0033:0x7f10f040c64e
[ 1490.069778][T26052] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 1490.069780][T26052] RSP: 002b:00007fffe67d86c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 1490.069784][T26052] RAX: ffffffffffffffda RBX: 0000000000000602 RCX: 00007f10f040c64e
[ 1490.069785][T26052] RDX: 0000000000000602 RSI: 00007fffe67d8730 RDI: 0000000000000005
[ 1490.069787][T26052] RBP: 00007fffe67d86d0 R08: 0000000000000000 R09: 0000000000000000
[ 1490.069787][T26052] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000602
[ 1490.069788][T26052] R13: 0000000000427f80 R14: 0000000000000002 R15: 00007f10f0394000
[ 1490.069791][T26052]
[ 1490.069792][T26052]
[ 1490.079424][T26052] The buggy address belongs to the physical page:
[ 1490.079588][T26052] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19f9b
[ 1490.079742][T26052] flags: 0x80000000000000(node=0|zone=1)
[ 1490.079836][T26052] raw: 0080000000000000 ffd400000067e6c8 ffd400000067e6c8 0000000000000000
[ 1490.079990][T26052] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 1490.080142][T26052] page dumped because: kasan: bad access detected
[ 1490.080249][T26052]
[ 1490.080294][T26052] Memory state around the buggy address:
[ 1490.080378][T26052] ff11000019f9b700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 1490.080508][T26052] ff11000019f9b780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 1490.080686][T26052] >ff11000019f9b800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 1490.080818][T26052] ^
[ 1490.080884][T26052] ff11000019f9b880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 1490.081117][T26052] ff11000019f9b900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 1490.081248][T26052] ==================================================================
[ 1490.081382][T26052] Disabling lock debugging due to kernel taint