======================================
| [ 1695.609168][  T401] br0: port 1(swp1) entered disabled state
| [ 1695.736226][    C2] ------------[ cut here ]------------
| [ 1695.736520][    C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa92/0x1060, CPU#2: mausezahn/3273
| [ 1695.737073][    C2] Modules linked in: act_gact bonding psample xfrm_user macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb chacha libchacha chacha20poly1305 libpoly1305 tls cls_flower sch_prio xt_mark sch_ingress act_mirred cls_basic sch_fq_codel xt_HL nft_compat nf_tables amt [last unloaded: netdevsim]
[ 1695.738351][    C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1695.738577][    C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:217 (discriminator 4))
[ 1695.738795][    C2] Code: 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 <0f> 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9 a7 fa ff ff 44 89 44 24 18
All code
========
   0:	24 18                	and    $0x18,%al
   2:	4c 89 44 24 20       	mov    %r8,0x20(%rsp)
   7:	e8 4c 6b 74 fe       	call   0xfffffffffe746b58
   c:	4c 8b 44 24 20       	mov    0x20(%rsp),%r8
  11:	49 0f ba 28 08       	btsq   $0x8,(%r8)
  16:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  1b:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9e0
  20:	90                   	nop
  21:	0f 0b                	ud2
  23:	90                   	nop
  24:	e9 7d fb ff ff       	jmp    0xfffffffffffffba6
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa23
  32:	90                   	nop
  33:	0f 0b                	ud2
  35:	90                   	nop
  36:	e9 a7 fa ff ff       	jmp    0xfffffffffffffae2
  3b:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 f1 f9 ff ff       	jmp    0xfffffffffffff9f9
   8:	90                   	nop
   9:	0f 0b                	ud2
   b:	90                   	nop
   c:	e9 a7 fa ff ff       	jmp    0xfffffffffffffab8
  11:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
[ 1695.739350][    C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246
[ 1695.739577][    C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000000
[ 1695.739951][    C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff110000181a5824
[ 1695.740243][    C2] RBP: ffa00000002286a0 R08: ff11000017b8cac8 R09: ff1100000ff52c80
[ 1695.740503][    C2] R10: ffe21c0002f7195c R11: ffe21c0002f7195c R12: ff11000017b8cadc
[ 1695.740784][    C2] R13: ff11000017b8cada R14: ff1100000ff52d36 R15: ff11000017b8ca00
[ 1695.741051][    C2] FS:  00007f18f92dbc80(0000) GS:ff110000defb0000(0000) knlGS:0000000000000000
[ 1695.741491][    C2] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1695.741729][    C2] CR2: 00007f18f94e8c00 CR3: 0000000015e6d003 CR4: 0000000000771ef0
[ 1695.741991][    C2] PKRU: 55555554
[ 1695.742152][    C2] Call Trace:
[ 1695.742311][    C2]  <IRQ>
[ 1695.742435][    C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan
[ 1695.742638][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.742822][    C2]  ? ip_rcv_finish (net/ipv4/ip_input.c:490)
[ 1695.743013][    C2]  ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.743174][    C2]  ? __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.743394][    C2]  ? process_backlog (net/core/dev.c:6670)
[ 1695.743577][    C2]  ? __napi_poll (net/core/dev.c:7729)
[ 1695.743780][    C2]  ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.743972][    C2]  ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215)
[ 1695.744172][    C2]  ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21))
[ 1695.744361][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.744599][    C2]  ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1))
[ 1695.744789][    C2]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[ 1695.744982][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.745219][    C2]  ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.745405][    C2]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.745602][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.745787][    C2]  ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2))
[ 1695.745981][    C2]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[ 1695.746178][    C2]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[ 1695.746331][    C2]  udp_rcv (net/ipv4/udp.c:2651)
[ 1695.746488][    C2]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[ 1695.746691][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.746879][    C2]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[ 1695.747150][    C2]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[ 1695.747424][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.747716][    C2]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[ 1695.748004][    C2]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[ 1695.748285][    C2]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[ 1695.748500][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.748701][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.748886][    C2]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.749050][    C2]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[ 1695.749241][    C2]  ? mark_usage (kernel/locking/lockdep.c:4674)
[ 1695.749430][    C2]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 1695.749634][    C2]  ? __dev_queue_xmit (net/core/dev.c:4821)
[ 1695.749819][    C2]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.750048][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.750236][    C2]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[ 1695.750455][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.750658][    C2]  process_backlog (net/core/dev.c:6670)
[ 1695.750846][    C2]  __napi_poll (net/core/dev.c:7729)
[ 1695.751011][    C2]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.751211][    C2]  ? __napi_poll (./include/net/gro.h:507)
[ 1695.751403][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.751602][    C2]  handle_softirqs (kernel/softirq.c:622)
[ 1695.751790][    C2]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[ 1695.751979][    C2]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 1695.752176][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.752362][    C2]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[ 1695.752518][    C2]  </IRQ>
[ 1695.752650][    C2]  <TASK>
[ 1695.752766][    C2]  ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.752968][    C2]  __local_bh_enable_ip (kernel/softirq.c:450)
[ 1695.753190][    C2]  __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.753376][    C2]  ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272)
[ 1695.753565][    C2]  ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112)
[ 1695.753797][    C2]  ? stats_show (lib/stackdepot.c:861 (discriminator 5))
[ 1695.753958][    C2]  ? netdev_core_pick_tx (net/core/dev.c:4733)
[ 1695.754156][    C2]  ? packet_release (net/packet/af_packet.c:3171)
[ 1695.754345][    C2]  packet_snd (net/packet/af_packet.c:3082)
[ 1695.754534][    C2]  ? tpacket_snd (net/packet/af_packet.c:2685)
[ 1695.754731][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.754922][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.755121][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.755309][    C2]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[ 1695.755500][    C2]  ? __ia32_sys_getpeername (net/socket.c:2206)
[ 1695.755701][    C2]  ? sock_ioctl (net/socket.c:1421)
[ 1695.755890][    C2]  ? __sys_setsockopt (net/socket.c:2393)
[ 1695.756094][    C2]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 1695.756280][    C2]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[ 1695.756499][    C2]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[ 1695.756700][    C2]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[ 1695.756885][    C2]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1695.757090][    C2]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[ 1695.757279][    C2]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[ 1695.757466][    C2]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1695.757701][    C2] RIP: 0033:0x7f18f949964e
[ 1695.757896][    C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[ 1695.758450][    C2] RSP: 002b:00007ffef893a960 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 1695.758723][    C2] RAX: ffffffffffffffda RBX: 000055d5ac0c8b42 RCX: 00007f18f949964e
[ 1695.758980][    C2] RDX: 0000000000000086 RSI: 000055d5ac0c8b42 RDI: 0000000000000005
[ 1695.759241][    C2] RBP: 00007ffef893a970 R08: 00007ffef893a9c0 R09: 0000000000000014
[ 1695.759499][    C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d5ac0c8830
[ 1695.759765][    C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055d5ac0c8830
| [ 1695.762375][    C2] BUG: KASAN: use-after-free in udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
| [ 1695.762505][    C2] Read of size 2 at addr ff110000181b57ff by task mausezahn/3273
| [ 1695.762640][    C2]
| [ 1695.762690][    C2] Tainted: [W]=WARN
[ 1695.762691][    C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1695.762692][    C2] Call Trace:
[ 1695.762693][    C2]  <IRQ>
[ 1695.762694][    C2]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 1695.762698][    C2]  print_address_description.constprop.0 (mm/kasan/report.c:378)
[ 1695.762703][    C2]  print_report (mm/kasan/report.c:482)
[ 1695.762705][    C2]  ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54)
[ 1695.762708][    C2]  ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[ 1695.762709][    C2]  kasan_report (mm/kasan/report.c:595)
[ 1695.762712][    C2]  ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[ 1695.762714][    C2]  ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[ 1695.762717][    C2]  udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[ 1695.762719][    C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan
[ 1695.762724][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.762726][    C2]  ? ip_rcv_finish (net/ipv4/ip_input.c:490)
[ 1695.762727][    C2]  ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.762728][    C2]  ? __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.762730][    C2]  ? process_backlog (net/core/dev.c:6670)
[ 1695.762731][    C2]  ? __napi_poll (net/core/dev.c:7729)
[ 1695.762733][    C2]  ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.762734][    C2]  ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215)
[ 1695.762736][    C2]  ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21))
[ 1695.762738][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.762742][    C2]  ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1))
[ 1695.762745][    C2]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[ 1695.762747][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.762750][    C2]  ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.762751][    C2]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.762753][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.762755][    C2]  ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2))
[ 1695.762757][    C2]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[ 1695.762759][    C2]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[ 1695.762760][    C2]  udp_rcv (net/ipv4/udp.c:2651)
[ 1695.762763][    C2]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[ 1695.762765][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.762767][    C2]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[ 1695.762769][    C2]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[ 1695.762771][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.762772][    C2]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[ 1695.762774][    C2]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[ 1695.762776][    C2]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[ 1695.762778][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.762780][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.762782][    C2]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.762783][    C2]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[ 1695.762785][    C2]  ? mark_usage (kernel/locking/lockdep.c:4674)
[ 1695.762787][    C2]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 1695.762789][    C2]  ? __dev_queue_xmit (net/core/dev.c:4821)
[ 1695.762791][    C2]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.762792][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.762794][    C2]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[ 1695.762795][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.762798][    C2]  process_backlog (net/core/dev.c:6670)
[ 1695.762800][    C2]  __napi_poll (net/core/dev.c:7729)
[ 1695.762802][    C2]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.762804][    C2]  ? __napi_poll (./include/net/gro.h:507)
[ 1695.762808][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.762809][    C2]  handle_softirqs (kernel/softirq.c:622)
[ 1695.762812][    C2]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[ 1695.762813][    C2]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 1695.762815][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.762817][    C2]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[ 1695.762819][    C2]  </IRQ>
[ 1695.762819][    C2]  <TASK>
[ 1695.762820][    C2]  ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.762821][    C2]  __local_bh_enable_ip (kernel/softirq.c:450)
[ 1695.762823][    C2]  __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.762824][    C2]  ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272)
[ 1695.762828][    C2]  ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112)
[ 1695.762830][    C2]  ? stats_show (lib/stackdepot.c:861 (discriminator 5))
[ 1695.762832][    C2]  ? netdev_core_pick_tx (net/core/dev.c:4733)
[ 1695.762835][    C2]  ? packet_release (net/packet/af_packet.c:3171)
[ 1695.762838][    C2]  packet_snd (net/packet/af_packet.c:3082)
[ 1695.762840][    C2]  ? tpacket_snd (net/packet/af_packet.c:2685)
[ 1695.762842][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.762845][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.762847][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.762849][    C2]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[ 1695.762850][    C2]  ? __ia32_sys_getpeername (net/socket.c:2206)
[ 1695.762853][    C2]  ? sock_ioctl (net/socket.c:1421)
[ 1695.762855][    C2]  ? __sys_setsockopt (net/socket.c:2393)
[ 1695.762857][    C2]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 1695.762859][    C2]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[ 1695.762861][    C2]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[ 1695.762863][    C2]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[ 1695.762864][    C2]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1695.762865][    C2]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[ 1695.762867][    C2]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[ 1695.762869][    C2]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1695.762871][    C2] RIP: 0033:0x7f18f949964e
[ 1695.762873][    C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[ 1695.762874][    C2] RSP: 002b:00007ffef893a960 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 1695.762877][    C2] RAX: ffffffffffffffda RBX: 000055d5ac0c8b42 RCX: 00007f18f949964e
[ 1695.762878][    C2] RDX: 0000000000000086 RSI: 000055d5ac0c8b42 RDI: 0000000000000005
[ 1695.762879][    C2] RBP: 00007ffef893a970 R08: 00007ffef893a9c0 R09: 0000000000000014
[ 1695.762880][    C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d5ac0c8830
[ 1695.762881][    C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055d5ac0c8830
| [ 1695.774925][    C2] ------------[ cut here ]------------
| [ 1695.775068][    C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa9b/0x1060, CPU#2: mausezahn/3273
| [ 1695.775337][    C2] Modules linked in: act_gact bonding psample xfrm_user macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb chacha libchacha chacha20poly1305 libpoly1305 tls cls_flower sch_prio xt_mark sch_ingress act_mirred cls_basic sch_fq_codel xt_HL nft_compat nf_tables amt [last unloaded: netdevsim]
| [ 1695.776111][    C2] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 1695.776292][    C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1695.776442][    C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:218 (discriminator 4))
[ 1695.776578][    C2] Code: 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 <0f> 0b 90 e9 a7 fa ff ff 44 89 44 24 18 89 74 24 20 4c 89 4c 24 28
All code
========
   0:	6b 74 fe 4c 8b       	imul   $0xffffff8b,0x4c(%rsi,%rdi,8),%esi
   5:	44 24 20             	rex.R and $0x20,%al
   8:	49 0f ba 28 08       	btsq   $0x8,(%r8)
   d:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  12:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9d7
  17:	90                   	nop
  18:	0f 0b                	ud2
  1a:	90                   	nop
  1b:	e9 7d fb ff ff       	jmp    0xfffffffffffffb9d
  20:	90                   	nop
  21:	0f 0b                	ud2
  23:	90                   	nop
  24:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa1a
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 a7 fa ff ff       	jmp    0xfffffffffffffad9
  32:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
  37:	89 74 24 20          	mov    %esi,0x20(%rsp)
  3b:	4c 89 4c 24 28       	mov    %r9,0x28(%rsp)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 a7 fa ff ff       	jmp    0xfffffffffffffaaf
   8:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
   d:	89 74 24 20          	mov    %esi,0x20(%rsp)
  11:	4c 89 4c 24 28       	mov    %r9,0x28(%rsp)
[ 1695.776994][    C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246
[ 1695.777156][    C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000001
[ 1695.777380][    C2] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8d1bc6a0
[ 1695.777552][    C2] RBP: ffa00000002286a0 R08: ff11000017b8cac8 R09: ff1100000ff52c80
[ 1695.777786][    C2] R10: fffffbfff1a378d5 R11: fffffbfff1a378d5 R12: ff11000017b8cadc
[ 1695.777965][    C2] R13: ff11000017b8cada R14: ff1100000ff52d36 R15: ff11000017b8ca00
[ 1695.778149][    C2] FS:  00007f18f92dbc80(0000) GS:ff110000defb0000(0000) knlGS:0000000000000000
[ 1695.778392][    C2] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1695.778548][    C2] CR2: 00007f18f94e8c00 CR3: 0000000015e6d003 CR4: 0000000000771ef0
[ 1695.778733][    C2] PKRU: 55555554
[ 1695.778890][    C2] Call Trace:
[ 1695.779010][    C2]  <IRQ>
[ 1695.779108][    C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan
[ 1695.779243][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.779373][    C2]  ? ip_rcv_finish (net/ipv4/ip_input.c:490)
[ 1695.779555][    C2]  ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.779674][    C2]  ? __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.779864][    C2]  ? process_backlog (net/core/dev.c:6670)
[ 1695.780019][    C2]  ? __napi_poll (net/core/dev.c:7729)
[ 1695.780273][    C2]  ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.780448][    C2]  ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215)
[ 1695.780636][    C2]  ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21))
[ 1695.780816][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.781126][    C2]  ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1))
[ 1695.781305][    C2]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[ 1695.781477][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.781781][    C2]  ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.781957][    C2]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.782130][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.782306][    C2]  ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2))
[ 1695.782560][    C2]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[ 1695.782749][    C2]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[ 1695.782891][    C2]  udp_rcv (net/ipv4/udp.c:2651)
[ 1695.783042][    C2]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[ 1695.783216][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.783470][    C2]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[ 1695.783661][    C2]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[ 1695.783834][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.784011][    C2]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[ 1695.784266][    C2]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[ 1695.784438][    C2]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[ 1695.784622][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.784796][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.785056][    C2]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.785196][    C2]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[ 1695.785361][    C2]  ? mark_usage (kernel/locking/lockdep.c:4674)
[ 1695.785526][    C2]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 1695.785792][    C2]  ? __dev_queue_xmit (net/core/dev.c:4821)
[ 1695.785972][    C2]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.786175][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.786347][    C2]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[ 1695.786649][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.786828][    C2]  process_backlog (net/core/dev.c:6670)
[ 1695.787012][    C2]  __napi_poll (net/core/dev.c:7729)
[ 1695.787154][    C2]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.787410][    C2]  ? __napi_poll (./include/net/gro.h:507)
[ 1695.787603][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.787779][    C2]  handle_softirqs (kernel/softirq.c:622)
[ 1695.787963][    C2]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[ 1695.788225][    C2]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 1695.788405][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.788579][    C2]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[ 1695.788707][    C2]  </IRQ>
[ 1695.788795][    C2]  <TASK>
[ 1695.788939][    C2]  ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.789087][    C2]  __local_bh_enable_ip (kernel/softirq.c:450)
[ 1695.789219][    C2]  __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.789355][    C2]  ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272)
[ 1695.789535][    C2]  ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112)
[ 1695.789698][    C2]  ? stats_show (lib/stackdepot.c:861 (discriminator 5))
[ 1695.789809][    C2]  ? netdev_core_pick_tx (net/core/dev.c:4733)
[ 1695.789947][    C2]  ? packet_release (net/packet/af_packet.c:3171)
[ 1695.790138][    C2]  packet_snd (net/packet/af_packet.c:3082)
[ 1695.790271][    C2]  ? tpacket_snd (net/packet/af_packet.c:2685)
[ 1695.790404][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.790537][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.790728][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.790859][    C2]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[ 1695.790997][    C2]  ? __ia32_sys_getpeername (net/socket.c:2206)
[ 1695.791136][    C2]  ? sock_ioctl (net/socket.c:1421)
[ 1695.791315][    C2]  ? __sys_setsockopt (net/socket.c:2393)
[ 1695.791446][    C2]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 1695.791592][    C2]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[ 1695.791743][    C2]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[ 1695.791923][    C2]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[ 1695.792067][    C2]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1695.792198][    C2]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[ 1695.792328][    C2]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[ 1695.792507][    C2]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1695.792668][    C2] RIP: 0033:0x7f18f949964e
[ 1695.792806][    C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[ 1695.793226][    C2] RSP: 002b:00007ffef893a960 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 1695.793400][    C2] RAX: ffffffffffffffda RBX: 000055d5ac0c8b42 RCX: 00007f18f949964e
[ 1695.793648][    C2] RDX: 0000000000000086 RSI: 000055d5ac0c8b42 RDI: 0000000000000005
[ 1695.793819][    C2] RBP: 00007ffef893a970 R08: 00007ffef893a9c0 R09: 0000000000000014
[ 1695.794045][    C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d5ac0c8830
[ 1695.794221][    C2] R13: 0000000000000086 R14: 0000000000000005 R15: 000055d5ac0c8830
| [ 1695.795716][    C2] ------------[ cut here ]------------
| [ 1695.795844][    C2] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa89/0x1060, CPU#2: mausezahn/3273
| [ 1695.796070][    C2] Modules linked in: act_gact bonding psample xfrm_user macsec vxlan ip6_gre ip_gre gre cls_u32 sch_htb chacha libchacha chacha20poly1305 libpoly1305 tls cls_flower sch_prio xt_mark sch_ingress act_mirred cls_basic sch_fq_codel xt_HL nft_compat nf_tables amt [last unloaded: netdevsim]
| [ 1695.796876][    C2] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 1695.797018][    C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1695.797239][    C2] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:219 (discriminator 4))
[ 1695.797375][    C2] Code: c7 be 08 00 00 00 4c 89 4c 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 <0f> 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9
All code
========
   0:	c7                   	(bad)
   1:	be 08 00 00 00       	mov    $0x8,%esi
   6:	4c 89 4c 24 18       	mov    %r9,0x18(%rsp)
   b:	4c 89 44 24 20       	mov    %r8,0x20(%rsp)
  10:	e8 4c 6b 74 fe       	call   0xfffffffffe746b61
  15:	4c 8b 44 24 20       	mov    0x20(%rsp),%r8
  1a:	49 0f ba 28 08       	btsq   $0x8,(%r8)
  1f:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  24:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9e9
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 7d fb ff ff       	jmp    0xfffffffffffffbaf
  32:	90                   	nop
  33:	0f 0b                	ud2
  35:	90                   	nop
  36:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa2c
  3b:	90                   	nop
  3c:	0f 0b                	ud2
  3e:	90                   	nop
  3f:	e9                   	.byte 0xe9

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 7d fb ff ff       	jmp    0xfffffffffffffb85
   8:	90                   	nop
   9:	0f 0b                	ud2
   b:	90                   	nop
   c:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa02
  11:	90                   	nop
  12:	0f 0b                	ud2
  14:	90                   	nop
  15:	e9                   	.byte 0xe9
[ 1695.797780][    C2] RSP: 0018:ffa0000000228648 EFLAGS: 00010246
[ 1695.797938][    C2] RAX: 0000000000000007 RBX: 000000000000ffff RCX: ffffffff8a631c3e
[ 1695.798166][    C2] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
[ 1695.798337][    C2] RBP: ffa00000002286a0 R08: ff11000017b8cac8 R09: ff1100000ff52c80
[ 1695.798508][    C2] R10: fffffbfff1a378d5 R11: fffffbfff1a378d5 R12: ff11000017b8cadc
[ 1695.798692][    C2] R13: ff11000017b8cada R14: ff1100000ff52d36 R15: ff11000017b8ca00
[ 1695.798869][    C2] FS:  00007f18f92dbc80(0000) GS:ff110000defb0000(0000) knlGS:0000000000000000
[ 1695.799127][    C2] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1695.799281][    C2] CR2: 00007f18f94e8c00 CR3: 0000000015e6d003 CR4: 0000000000771ef0
[ 1695.799457][    C2] PKRU: 55555554
[ 1695.799565][    C2] Call Trace:
[ 1695.799734][    C2]  <IRQ>
[ 1695.799824][    C2] vxlan_rcv (drivers/net/vxlan/vxlan_core.c:1729 (discriminator 2)) vxlan
[ 1695.799963][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.800103][    C2]  ? ip_rcv_finish (net/ipv4/ip_input.c:490)
[ 1695.800234][    C2]  ? ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.800393][    C2]  ? __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.800547][    C2]  ? process_backlog (net/core/dev.c:6670)
[ 1695.800690][    C2]  ? __napi_poll (net/core/dev.c:7729)
[ 1695.800821][    C2]  ? net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.801008][    C2]  ? wait_task_zombie (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:252 ./include/linux/refcount.h:283 ./include/linux/refcount.h:366 ./include/linux/refcount.h:383 ./include/linux/sched/task.h:116 kernel/exit.c:1215)
[ 1695.801148][    C2]  ? __local_bh_enable_ip (kernel/softirq.c:430 (discriminator 21))
[ 1695.801281][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.801480][    C2]  ? udp4_lib_lookup2 (./include/net/net_namespace.h:419 (discriminator 1) ./include/net/sock.h:713 (discriminator 1) net/ipv4/udp.c:370 (discriminator 1) net/ipv4/udp.c:474 (discriminator 1))
[ 1695.801628][    C2]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[ 1695.801759][    C2]  ? encap_bypass_if_local (drivers/net/vxlan/vxlan_core.c:2327) vxlan
[ 1695.801915][    C2]  ? udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.802116][    C2]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[ 1695.802290][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.802466][    C2]  ? hlock_conflict (kernel/locking/lockdep.c:2000 (discriminator 2))
[ 1695.802658][    C2]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[ 1695.802920][    C2]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[ 1695.803076][    C2]  udp_rcv (net/ipv4/udp.c:2651)
[ 1695.803225][    C2]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[ 1695.803400][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.803550][    C2]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[ 1695.803742][    C2]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[ 1695.803873][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.804014][    C2]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[ 1695.804152][    C2]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[ 1695.804331][    C2]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[ 1695.804468][    C2]  ? ip_rcv_finish_core (net/ipv4/ip_input.c:407 (discriminator 1))
[ 1695.804610][    C2]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[ 1695.804741][    C2]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[ 1695.804901][    C2]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[ 1695.805045][    C2]  ? mark_usage (kernel/locking/lockdep.c:4674)
[ 1695.805180][    C2]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[ 1695.805311][    C2]  ? __dev_queue_xmit (net/core/dev.c:4821)
[ 1695.805498][    C2]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[ 1695.805715][    C2]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[ 1695.805888][    C2]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[ 1695.806192][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.806379][    C2]  process_backlog (net/core/dev.c:6670)
[ 1695.806556][    C2]  __napi_poll (net/core/dev.c:7729)
[ 1695.806716][    C2]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[ 1695.806895][    C2]  ? __napi_poll (./include/net/gro.h:507)
[ 1695.807162][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.807340][    C2]  handle_softirqs (kernel/softirq.c:622)
[ 1695.807519][    C2]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[ 1695.807793][    C2]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[ 1695.807944][    C2]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[ 1695.808105][    C2]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[ 1695.808245][    C2]  </IRQ>
[ 1695.808348][    C2]  <TASK>
[ 1695.808456][    C2]  ? __dev_queue_xmit (./include/linux/rcupdate.h:310 (discriminator 2) ./include/linux/rcupdate.h:911 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.808718][    C2]  __local_bh_enable_ip (kernel/softirq.c:450)
[ 1695.808897][    C2]  __dev_queue_xmit (./include/linux/bottom_half.h:33 (discriminator 2) ./include/linux/rcupdate.h:914 (discriminator 2) net/core/dev.c:4907 (discriminator 2))
[ 1695.809075][    C2]  ? _copy_from_iter (./include/linux/instrumented.h:146 lib/iov_iter.c:66 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:261 lib/iov_iter.c:272)
[ 1695.809251][    C2]  ? _copy_from_iter_flushcache (./include/linux/iov_iter.h:112)
[ 1695.809538][    C2]  ? stats_show (lib/stackdepot.c:861 (discriminator 5))
[ 1695.809697][    C2]  ? netdev_core_pick_tx (net/core/dev.c:4733)
[ 1695.809877][    C2]  ? packet_release (net/packet/af_packet.c:3171)
[ 1695.810065][    C2]  packet_snd (net/packet/af_packet.c:3082)
[ 1695.810330][    C2]  ? tpacket_snd (net/packet/af_packet.c:2685)
[ 1695.810506][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.810699][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.810880][    C2]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[ 1695.811150][    C2]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[ 1695.811334][    C2]  ? __ia32_sys_getpeername (net/socket.c:2206)
[ 1695.811513][    C2]  ? sock_ioctl (net/socket.c:1421)
[ 1695.811700][    C2]  ? __sys_setsockopt (net/socket.c:2393)
[ 1695.811967][    C2]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 1695.812146][    C2]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[ 1695.812348][    C2]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[ 1695.812525][    C2]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[ 1695.812799][    C2]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1695.812978][    C2]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[ 1695.813146][    C2]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[ 1695.813321][    C2]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1695.813613][    C2] RIP: 0033:0x7f18f949964e
[ 1695.813784][    C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[ 1695.814345][    C2] RSP: 002b:00007ffef893a960 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[ 1695.814577][    C2] RAX: ffffffffffffffda RBX: 000055d5ac0c8b42 RCX: 00007f18f949964e
[ 1695.814903][    C2] RDX: 0000000000000086 RSI: 000055d5ac0c8b42 RDI: 0000000000000005
[ 1695.815148][    C2] RBP: 00007ffef893a970 R08: 00007ffef893a9c0 R09: 0000000000000014
[ 1695.815387][    C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d5ac0c8830


Finger prints:
print_report:kasan_report:udp_tun_rx_dst:vxlan_rcv:udp_queue_rcv_one_skb
udp_tun_rx_dst:vxlan_rcv:udp_queue_rcv_one_skb:udp_unicast_rcv_skb:udp_rcv