======================================
| [  506.082802][ T6546] Mirror/redirect action on
| [  506.159275][    C3] ------------[ cut here ]------------
| [  506.159670][    C3] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa92/0x1060, CPU#3: ping/6548
| [  506.160018][    C3] Modules linked in: act_mirred act_tunnel_key bareudp mpls_gso mpls_iptunnel mpls_router pktgen act_gact xt_length nft_compat act_ct nf_flow_table nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 cls_flower sch_ingress vxlan nf_tables [last unloaded: ila]
[  506.161089][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  506.161273][    C3] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:217 (discriminator 4))
[  506.161431][    C3] Code: 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 <0f> 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9 a7 fa ff ff 44 89 44 24 18
All code
========
   0:	24 18                	and    $0x18,%al
   2:	4c 89 44 24 20       	mov    %r8,0x20(%rsp)
   7:	e8 4c 6b 74 fe       	call   0xfffffffffe746b58
   c:	4c 8b 44 24 20       	mov    0x20(%rsp),%r8
  11:	49 0f ba 28 08       	btsq   $0x8,(%r8)
  16:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  1b:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9e0
  20:	90                   	nop
  21:	0f 0b                	ud2
  23:	90                   	nop
  24:	e9 7d fb ff ff       	jmp    0xfffffffffffffba6
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa23
  32:	90                   	nop
  33:	0f 0b                	ud2
  35:	90                   	nop
  36:	e9 a7 fa ff ff       	jmp    0xfffffffffffffae2
  3b:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 f1 f9 ff ff       	jmp    0xfffffffffffff9f9
   8:	90                   	nop
   9:	0f 0b                	ud2
   b:	90                   	nop
   c:	e9 a7 fa ff ff       	jmp    0xfffffffffffffab8
  11:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
[  506.161939][    C3] RSP: 0018:ffa0000000280718 EFLAGS: 00010246
[  506.162123][    C3] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000000
[  506.162342][    C3] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000014f2343a
[  506.162561][    C3] RBP: ffa0000000280770 R08: ff110000099987c8 R09: ff110000128bb8c0
[  506.162778][    C3] R10: ffe21c00013330fc R11: ffe21c00013330fc R12: ff110000099987dc
[  506.162999][    C3] R13: ff110000099987da R14: ff110000128bb976 R15: ff11000009998700
[  506.163222][    C3] FS:  00007f60b0e804c0(0000) GS:ff110000bce30000(0000) knlGS:0000000000000000
[  506.163481][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  506.163666][    C3] CR2: 00005591d231b0a8 CR3: 000000000c3fa005 CR4: 0000000000771ef0
[  506.163885][    C3] PKRU: 55555554
[  506.163995][    C3] Call Trace:
[  506.164105][    C3]  <IRQ>
[  506.164187][    C3] bareudp_udp_encap_recv (drivers/net/bareudp.c:145) bareudp
[  506.164371][    C3]  ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1))
[  506.164523][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.164704][    C3]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[  506.164850][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.165031][    C3]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[  506.165180][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.165325][    C3]  ? print_irq_inversion_bug.part.0 (kernel/locking/lockdep.c:809 (discriminator 4) kernel/locking/lockdep.c:4084 (discriminator 4))
[  506.165509][    C3]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[  506.165651][    C3]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[  506.165759][    C3]  udp_rcv (net/ipv4/udp.c:2651)
[  506.165873][    C3]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[  506.166020][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.166166][    C3]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[  506.166311][    C3]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[  506.166462][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.166608][    C3]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[  506.166750][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535)
[  506.166896][    C3]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[  506.167041][    C3]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[  506.167189][    C3]  ? ip_rcv_finish_core (./include/linux/skbuff.h:1164 (discriminator 2) ./include/net/route.h:88 (discriminator 2) net/ipv4/ip_input.c:435 (discriminator 2))
[  506.167337][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.167485][    C3]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[  506.167594][    C3]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[  506.167740][    C3]  ? mark_usage (kernel/locking/lockdep.c:4674)
[  506.167883][    C3]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  506.168031][    C3]  ? __dev_queue_xmit (net/core/dev.c:4821)
[  506.168180][    C3]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[  506.168357][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.168505][    C3]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[  506.168684][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.168831][    C3]  process_backlog (net/core/dev.c:6670)
[  506.168977][    C3]  __napi_poll (net/core/dev.c:7729)
[  506.169087][    C3]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  506.169235][    C3]  ? __napi_poll (./include/net/gro.h:507)
[  506.169385][    C3]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[  506.169536][    C3]  handle_softirqs (kernel/softirq.c:622)
[  506.169683][    C3]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[  506.169826][    C3]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[  506.169971][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.170115][    C3]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[  506.170229][    C3]  </IRQ>
[  506.170304][    C3]  <TASK>
[  506.170376][    C3]  __local_bh_enable_ip (kernel/softirq.c:450)
[  506.170524][    C3]  __neigh_event_send (./include/linux/bottom_half.h:33 (discriminator 2) net/core/neighbour.c:1276 (discriminator 2))
[  506.170669][    C3]  ? lockdep_hardirqs_on (./arch/x86/include/asm/current.h:23 kernel/locking/lockdep.c:4417)
[  506.170816][    C3]  ? sync_exp_reset_tree_hotplug (kernel/rcu/tree_exp.h:96)
[  506.170997][    C3]  neigh_resolve_output (./include/net/neighbour.h:480 ./include/net/neighbour.h:486 ./include/net/neighbour.h:484 net/core/neighbour.c:1600)
[  506.171142][    C3]  ip_finish_output2 (./include/net/neighbour.h:560 (discriminator 3) net/ipv4/ip_output.c:236 (discriminator 3))
[  506.171290][    C3]  ? ip_dst_mtu_maybe_forward (./include/linux/rcupdate.h:873 ./include/net/ip.h:504)
[  506.171441][    C3]  ? ip4_dst_hoplimit (./include/net/dst.h:582 (discriminator 4) ./include/net/dst.h:587 (discriminator 4) ./include/net/route.h:393 (discriminator 4))
[  506.171584][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.171730][    C3]  ip_output (./include/linux/netfilter.h:307 net/ipv4/ip_output.c:437)
[  506.171839][    C3]  ? ip_finish_output (./include/linux/cgroup.h:847)
[  506.171985][    C3]  ? __ip_make_skb (net/ipv4/ip_output.c:1386 net/ipv4/ip_output.c:1497)
[  506.172134][    C3]  ip_push_pending_frames (./include/net/dst.h:470 (discriminator 4) net/ipv4/ip_output.c:131 (discriminator 4) net/ipv4/ip_output.c:1506 (discriminator 4) net/ipv4/ip_output.c:1526 (discriminator 4))
[  506.172284][    C3]  raw_sendmsg (net/ipv4/raw.c:657)
[  506.172432][    C3]  ? mark_lock (kernel/locking/lockdep.c:154 (discriminator 16) kernel/locking/lockdep.c:150 (discriminator 16) kernel/locking/lockdep.c:191 (discriminator 16) kernel/locking/lockdep.c:4759 (discriminator 16))
[  506.172579][    C3]  ? raw_send_hdrinc (./include/net/ip.h:581 (discriminator 1))
[  506.172722][    C3]  ? folio_add_lru_vma (mm/swap.c:536)
[  506.172867][    C3]  ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4069 (discriminator 3) kernel/rcu/tree.c:4061 (discriminator 3))
[  506.173048][    C3]  ? rcu_read_unlock (./include/linux/rcupdate.h:869 (discriminator 5))
[  506.173199][    C3]  ? wp_page_copy (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/page_ref.h:67 ./include/linux/mm.h:1766 ./include/linux/mm.h:1772 ./include/linux/mm.h:2089 mm/memory.c:3989)
[  506.173345][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.173494][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.173641][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.173784][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.173929][    C3]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[  506.174075][    C3]  ? __ia32_sys_getpeername (net/socket.c:2206)
[  506.174223][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5574)
[  506.174375][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1479 arch/x86/mm/fault.c:1532)
[  506.174524][    C3]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[  506.174667][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[  506.174847][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[  506.174990][    C3]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[  506.175133][    C3]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  506.175280][    C3]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[  506.175427][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[  506.175572][    C3]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[  506.175751][    C3] RIP: 0033:0x7f60b109e64e
[  506.175902][    C3] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[  506.176420][    C3] RSP: 002b:00007ffe5046e1b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  506.176641][    C3] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f60b109e64e
[  506.176855][    C3] RDX: 0000000000000040 RSI: 00005591d230b0a4 RDI: 0000000000000005
[  506.177073][    C3] RBP: 00007ffe5046e1c0 R08: 00005591d231d320 R09: 0000000000000010
[  506.177293][    C3] R10: 0000000000000000 R11: 0000000000000202 R12: 431bde82d7b634db
[  506.177516][    C3] R13: 0000000000000000 R14: 00005591d231e3e0 R15: 00005591d230b0a0
| [  506.179258][    C3] BUG: KASAN: use-after-free in udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
| [  506.179391][    C3] Read of size 2 at addr ff11000014f333ff by task ping/6548
| [  506.179528][    C3]
| [  506.179579][    C3] Tainted: [W]=WARN
[  506.179579][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  506.179580][    C3] Call Trace:
[  506.179581][    C3]  <IRQ>
[  506.179582][    C3]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[  506.179585][    C3]  print_address_description.constprop.0 (mm/kasan/report.c:378)
[  506.179590][    C3]  print_report (mm/kasan/report.c:482)
[  506.179592][    C3]  ? __virt_addr_valid (./include/linux/rcupdate.h:939 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54)
[  506.179594][    C3]  ? __virt_addr_valid (./include/linux/rcupdate.h:965 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[  506.179596][    C3]  kasan_report (mm/kasan/report.c:595)
[  506.179599][    C3]  ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[  506.179601][    C3]  ? udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[  506.179604][    C3]  udp_tun_rx_dst (net/ipv4/udp_tunnel_core.c:217 (discriminator 1))
[  506.179606][    C3] bareudp_udp_encap_recv (drivers/net/bareudp.c:145) bareudp
[  506.179609][    C3]  ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1))
[  506.179611][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.179613][    C3]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[  506.179615][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.179616][    C3]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[  506.179618][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.179620][    C3]  ? print_irq_inversion_bug.part.0 (kernel/locking/lockdep.c:809 (discriminator 4) kernel/locking/lockdep.c:4084 (discriminator 4))
[  506.179622][    C3]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[  506.179624][    C3]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[  506.179625][    C3]  udp_rcv (net/ipv4/udp.c:2651)
[  506.179628][    C3]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[  506.179630][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.179632][    C3]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[  506.179634][    C3]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[  506.179636][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.179638][    C3]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[  506.179639][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535)
[  506.179641][    C3]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[  506.179643][    C3]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[  506.179645][    C3]  ? ip_rcv_finish_core (./include/linux/skbuff.h:1164 (discriminator 2) ./include/net/route.h:88 (discriminator 2) net/ipv4/ip_input.c:435 (discriminator 2))
[  506.179648][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.179649][    C3]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[  506.179651][    C3]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[  506.179653][    C3]  ? mark_usage (kernel/locking/lockdep.c:4674)
[  506.179655][    C3]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  506.179656][    C3]  ? __dev_queue_xmit (net/core/dev.c:4821)
[  506.179658][    C3]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[  506.179660][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.179662][    C3]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[  506.179663][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.179666][    C3]  process_backlog (net/core/dev.c:6670)
[  506.179668][    C3]  __napi_poll (net/core/dev.c:7729)
[  506.179670][    C3]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  506.179672][    C3]  ? __napi_poll (./include/net/gro.h:507)
[  506.179676][    C3]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[  506.179678][    C3]  handle_softirqs (kernel/softirq.c:622)
[  506.179681][    C3]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[  506.179682][    C3]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[  506.179684][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.179686][    C3]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[  506.179687][    C3]  </IRQ>
[  506.179688][    C3]  <TASK>
[  506.179689][    C3]  __local_bh_enable_ip (kernel/softirq.c:450)
[  506.179690][    C3]  __neigh_event_send (./include/linux/bottom_half.h:33 (discriminator 2) net/core/neighbour.c:1276 (discriminator 2))
[  506.179692][    C3]  ? lockdep_hardirqs_on (./arch/x86/include/asm/current.h:23 kernel/locking/lockdep.c:4417)
[  506.179694][    C3]  ? sync_exp_reset_tree_hotplug (kernel/rcu/tree_exp.h:96)
[  506.179696][    C3]  neigh_resolve_output (./include/net/neighbour.h:480 ./include/net/neighbour.h:486 ./include/net/neighbour.h:484 net/core/neighbour.c:1600)
[  506.179698][    C3]  ip_finish_output2 (./include/net/neighbour.h:560 (discriminator 3) net/ipv4/ip_output.c:236 (discriminator 3))
[  506.179700][    C3]  ? ip_dst_mtu_maybe_forward (./include/linux/rcupdate.h:873 ./include/net/ip.h:504)
[  506.179702][    C3]  ? ip4_dst_hoplimit (./include/net/dst.h:582 (discriminator 4) ./include/net/dst.h:587 (discriminator 4) ./include/net/route.h:393 (discriminator 4))
[  506.179703][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.179705][    C3]  ip_output (./include/linux/netfilter.h:307 net/ipv4/ip_output.c:437)
[  506.179707][    C3]  ? ip_finish_output (./include/linux/cgroup.h:847)
[  506.179709][    C3]  ? __ip_make_skb (net/ipv4/ip_output.c:1386 net/ipv4/ip_output.c:1497)
[  506.179712][    C3]  ip_push_pending_frames (./include/net/dst.h:470 (discriminator 4) net/ipv4/ip_output.c:131 (discriminator 4) net/ipv4/ip_output.c:1506 (discriminator 4) net/ipv4/ip_output.c:1526 (discriminator 4))
[  506.179714][    C3]  raw_sendmsg (net/ipv4/raw.c:657)
[  506.179716][    C3]  ? mark_lock (kernel/locking/lockdep.c:154 (discriminator 16) kernel/locking/lockdep.c:150 (discriminator 16) kernel/locking/lockdep.c:191 (discriminator 16) kernel/locking/lockdep.c:4759 (discriminator 16))
[  506.179718][    C3]  ? raw_send_hdrinc (./include/net/ip.h:581 (discriminator 1))
[  506.179719][    C3]  ? folio_add_lru_vma (mm/swap.c:536)
[  506.179721][    C3]  ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4069 (discriminator 3) kernel/rcu/tree.c:4061 (discriminator 3))
[  506.179723][    C3]  ? rcu_read_unlock (./include/linux/rcupdate.h:869 (discriminator 5))
[  506.179725][    C3]  ? wp_page_copy (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/page_ref.h:67 ./include/linux/mm.h:1766 ./include/linux/mm.h:1772 ./include/linux/mm.h:2089 mm/memory.c:3989)
[  506.179727][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.179729][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.179731][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.179733][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.179735][    C3]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[  506.179737][    C3]  ? __ia32_sys_getpeername (net/socket.c:2206)
[  506.179738][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5574)
[  506.179742][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1479 arch/x86/mm/fault.c:1532)
[  506.179745][    C3]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[  506.179746][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[  506.179748][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[  506.179750][    C3]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[  506.179751][    C3]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  506.179753][    C3]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[  506.179754][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[  506.179756][    C3]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[  506.179757][    C3] RIP: 0033:0x7f60b109e64e
[  506.179759][    C3] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[  506.179760][    C3] RSP: 002b:00007ffe5046e1b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  506.179761][    C3] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f60b109e64e
[  506.179762][    C3] RDX: 0000000000000040 RSI: 00005591d230b0a4 RDI: 0000000000000005
[  506.179763][    C3] RBP: 00007ffe5046e1c0 R08: 00005591d231d320 R09: 0000000000000010
[  506.179764][    C3] R10: 0000000000000000 R11: 0000000000000202 R12: 431bde82d7b634db
[  506.179764][    C3] R13: 0000000000000000 R14: 00005591d231e3e0 R15: 00005591d230b0a0
| [  506.191288][    C3] ------------[ cut here ]------------
| [  506.191377][    C3] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa9b/0x1060, CPU#3: ping/6548
| [  506.191533][    C3] Modules linked in: act_mirred act_tunnel_key bareudp mpls_gso mpls_iptunnel mpls_router pktgen act_gact xt_length nft_compat act_ct nf_flow_table nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 cls_flower sch_ingress vxlan nf_tables [last unloaded: ila]
| [  506.192113][    C3] Tainted: [B]=BAD_PAGE, [W]=WARN
[  506.192208][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  506.192319][    C3] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:218 (discriminator 4))
[  506.192411][    C3] Code: 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 0f 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 <0f> 0b 90 e9 a7 fa ff ff 44 89 44 24 18 89 74 24 20 4c 89 4c 24 28
All code
========
   0:	6b 74 fe 4c 8b       	imul   $0xffffff8b,0x4c(%rsi,%rdi,8),%esi
   5:	44 24 20             	rex.R and $0x20,%al
   8:	49 0f ba 28 08       	btsq   $0x8,(%r8)
   d:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  12:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9d7
  17:	90                   	nop
  18:	0f 0b                	ud2
  1a:	90                   	nop
  1b:	e9 7d fb ff ff       	jmp    0xfffffffffffffb9d
  20:	90                   	nop
  21:	0f 0b                	ud2
  23:	90                   	nop
  24:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa1a
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 a7 fa ff ff       	jmp    0xfffffffffffffad9
  32:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
  37:	89 74 24 20          	mov    %esi,0x20(%rsp)
  3b:	4c 89 4c 24 28       	mov    %r9,0x28(%rsp)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 a7 fa ff ff       	jmp    0xfffffffffffffaaf
   8:	44 89 44 24 18       	mov    %r8d,0x18(%rsp)
   d:	89 74 24 20          	mov    %esi,0x20(%rsp)
  11:	4c 89 4c 24 28       	mov    %r9,0x28(%rsp)
[  506.192727][    C3] RSP: 0018:ffa0000000280718 EFLAGS: 00010246
[  506.192839][    C3] RAX: 0000000000000007 RBX: 000000000000ffff RCX: 0000000000000001
[  506.192971][    C3] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffffaf3bc6a0
[  506.193103][    C3] RBP: ffa0000000280770 R08: ff110000099987c8 R09: ff110000128bb8c0
[  506.193238][    C3] R10: fffffbfff5e778d5 R11: fffffbfff5e778d5 R12: ff110000099987dc
[  506.193370][    C3] R13: ff110000099987da R14: ff110000128bb976 R15: ff11000009998700
[  506.193507][    C3] FS:  00007f60b0e804c0(0000) GS:ff110000bce30000(0000) knlGS:0000000000000000
[  506.193661][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  506.193772][    C3] CR2: 00005591d231b0a8 CR3: 000000000c3fa005 CR4: 0000000000771ef0
[  506.193906][    C3] PKRU: 55555554
[  506.193972][    C3] Call Trace:
[  506.194038][    C3]  <IRQ>
[  506.194137][    C3] bareudp_udp_encap_recv (drivers/net/bareudp.c:145) bareudp
[  506.194253][    C3]  ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1))
[  506.194341][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.194510][    C3]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[  506.194599][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.194707][    C3]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[  506.194794][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.194934][    C3]  ? print_irq_inversion_bug.part.0 (kernel/locking/lockdep.c:809 (discriminator 4) kernel/locking/lockdep.c:4084 (discriminator 4))
[  506.195043][    C3]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[  506.195131][    C3]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[  506.195200][    C3]  udp_rcv (net/ipv4/udp.c:2651)
[  506.195268][    C3]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[  506.195405][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.195496][    C3]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[  506.195586][    C3]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[  506.195676][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.195816][    C3]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[  506.195904][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535)
[  506.195992][    C3]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[  506.196081][    C3]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[  506.196222][    C3]  ? ip_rcv_finish_core (./include/linux/skbuff.h:1164 (discriminator 2) ./include/net/route.h:88 (discriminator 2) net/ipv4/ip_input.c:435 (discriminator 2))
[  506.196310][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.196399][    C3]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[  506.196469][    C3]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[  506.196606][    C3]  ? mark_usage (kernel/locking/lockdep.c:4674)
[  506.196693][    C3]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  506.196779][    C3]  ? __dev_queue_xmit (net/core/dev.c:4821)
[  506.196866][    C3]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[  506.197025][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.197113][    C3]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[  506.197224][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.197361][    C3]  process_backlog (net/core/dev.c:6670)
[  506.197454][    C3]  __napi_poll (net/core/dev.c:7729)
[  506.197521][    C3]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  506.197609][    C3]  ? __napi_poll (./include/net/gro.h:507)
[  506.197698][    C3]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[  506.197786][    C3]  handle_softirqs (kernel/softirq.c:622)
[  506.197875][    C3]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[  506.197964][    C3]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[  506.198053][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.198140][    C3]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[  506.198211][    C3]  </IRQ>
[  506.198256][    C3]  <TASK>
[  506.198300][    C3]  __local_bh_enable_ip (kernel/softirq.c:450)
[  506.198389][    C3]  __neigh_event_send (./include/linux/bottom_half.h:33 (discriminator 2) net/core/neighbour.c:1276 (discriminator 2))
[  506.198482][    C3]  ? lockdep_hardirqs_on (./arch/x86/include/asm/current.h:23 kernel/locking/lockdep.c:4417)
[  506.198572][    C3]  ? sync_exp_reset_tree_hotplug (kernel/rcu/tree_exp.h:96)
[  506.198682][    C3]  neigh_resolve_output (./include/net/neighbour.h:480 ./include/net/neighbour.h:486 ./include/net/neighbour.h:484 net/core/neighbour.c:1600)
[  506.198770][    C3]  ip_finish_output2 (./include/net/neighbour.h:560 (discriminator 3) net/ipv4/ip_output.c:236 (discriminator 3))
[  506.198859][    C3]  ? ip_dst_mtu_maybe_forward (./include/linux/rcupdate.h:873 ./include/net/ip.h:504)
[  506.198947][    C3]  ? ip4_dst_hoplimit (./include/net/dst.h:582 (discriminator 4) ./include/net/dst.h:587 (discriminator 4) ./include/net/route.h:393 (discriminator 4))
[  506.199034][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.199123][    C3]  ip_output (./include/linux/netfilter.h:307 net/ipv4/ip_output.c:437)
[  506.199196][    C3]  ? ip_finish_output (./include/linux/cgroup.h:847)
[  506.199284][    C3]  ? __ip_make_skb (net/ipv4/ip_output.c:1386 net/ipv4/ip_output.c:1497)
[  506.199374][    C3]  ip_push_pending_frames (./include/net/dst.h:470 (discriminator 4) net/ipv4/ip_output.c:131 (discriminator 4) net/ipv4/ip_output.c:1506 (discriminator 4) net/ipv4/ip_output.c:1526 (discriminator 4))
[  506.199466][    C3]  raw_sendmsg (net/ipv4/raw.c:657)
[  506.199553][    C3]  ? mark_lock (kernel/locking/lockdep.c:154 (discriminator 16) kernel/locking/lockdep.c:150 (discriminator 16) kernel/locking/lockdep.c:191 (discriminator 16) kernel/locking/lockdep.c:4759 (discriminator 16))
[  506.199642][    C3]  ? raw_send_hdrinc (./include/net/ip.h:581 (discriminator 1))
[  506.199729][    C3]  ? folio_add_lru_vma (mm/swap.c:536)
[  506.199819][    C3]  ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4069 (discriminator 3) kernel/rcu/tree.c:4061 (discriminator 3))
[  506.199928][    C3]  ? rcu_read_unlock (./include/linux/rcupdate.h:869 (discriminator 5))
[  506.200016][    C3]  ? wp_page_copy (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/page_ref.h:67 ./include/linux/mm.h:1766 ./include/linux/mm.h:1772 ./include/linux/mm.h:2089 mm/memory.c:3989)
[  506.200103][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.200196][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.200284][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.200372][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.200465][    C3]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[  506.200555][    C3]  ? __ia32_sys_getpeername (net/socket.c:2206)
[  506.200643][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5574)
[  506.200733][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1479 arch/x86/mm/fault.c:1532)
[  506.200821][    C3]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[  506.200909][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[  506.201020][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[  506.201108][    C3]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[  506.201200][    C3]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  506.201288][    C3]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[  506.201376][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[  506.201466][    C3]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[  506.201575][    C3] RIP: 0033:0x7f60b109e64e
[  506.201665][    C3] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[  506.201975][    C3] RSP: 002b:00007ffe5046e1b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  506.202108][    C3] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f60b109e64e
[  506.202243][    C3] RDX: 0000000000000040 RSI: 00005591d230b0a4 RDI: 0000000000000005
[  506.202375][    C3] RBP: 00007ffe5046e1c0 R08: 00005591d231d320 R09: 0000000000000010
[  506.202510][    C3] R10: 0000000000000000 R11: 0000000000000202 R12: 431bde82d7b634db
[  506.202638][    C3] R13: 0000000000000000 R14: 00005591d231e3e0 R15: 00005591d230b0a0
| [  506.203647][    C3] ------------[ cut here ]------------
| [  506.203733][    C3] WARNING: ./include/linux/skbuff.h:3094 at udp_tun_rx_dst+0xa89/0x1060, CPU#3: ping/6548
| [  506.203885][    C3] Modules linked in: act_mirred act_tunnel_key bareudp mpls_gso mpls_iptunnel mpls_router pktgen act_gact xt_length nft_compat act_ct nf_flow_table nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 cls_flower sch_ingress vxlan nf_tables [last unloaded: ila]
| [  506.204469][    C3] Tainted: [B]=BAD_PAGE, [W]=WARN
[  506.204557][    C3] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  506.204666][    C3] RIP: 0010:udp_tun_rx_dst (./include/linux/skbuff.h:3094 (discriminator 4) ./include/linux/udp.h:23 (discriminator 4) net/ipv4/udp_tunnel_core.c:219 (discriminator 4))
[  506.204757][    C3] Code: c7 be 08 00 00 00 4c 89 4c 24 18 4c 89 44 24 20 e8 4c 6b 74 fe 4c 8b 44 24 20 49 0f ba 28 08 4c 8b 4c 24 18 e9 c0 f9 ff ff 90 <0f> 0b 90 e9 7d fb ff ff 90 0f 0b 90 e9 f1 f9 ff ff 90 0f 0b 90 e9
All code
========
   0:	c7                   	(bad)
   1:	be 08 00 00 00       	mov    $0x8,%esi
   6:	4c 89 4c 24 18       	mov    %r9,0x18(%rsp)
   b:	4c 89 44 24 20       	mov    %r8,0x20(%rsp)
  10:	e8 4c 6b 74 fe       	call   0xfffffffffe746b61
  15:	4c 8b 44 24 20       	mov    0x20(%rsp),%r8
  1a:	49 0f ba 28 08       	btsq   $0x8,(%r8)
  1f:	4c 8b 4c 24 18       	mov    0x18(%rsp),%r9
  24:	e9 c0 f9 ff ff       	jmp    0xfffffffffffff9e9
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	e9 7d fb ff ff       	jmp    0xfffffffffffffbaf
  32:	90                   	nop
  33:	0f 0b                	ud2
  35:	90                   	nop
  36:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa2c
  3b:	90                   	nop
  3c:	0f 0b                	ud2
  3e:	90                   	nop
  3f:	e9                   	.byte 0xe9

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	e9 7d fb ff ff       	jmp    0xfffffffffffffb85
   8:	90                   	nop
   9:	0f 0b                	ud2
   b:	90                   	nop
   c:	e9 f1 f9 ff ff       	jmp    0xfffffffffffffa02
  11:	90                   	nop
  12:	0f 0b                	ud2
  14:	90                   	nop
  15:	e9                   	.byte 0xe9
[  506.205066][    C3] RSP: 0018:ffa0000000280718 EFLAGS: 00010246
[  506.205178][    C3] RAX: 0000000000000007 RBX: 000000000000ffff RCX: ffffffffac831c3e
[  506.205310][    C3] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
[  506.205446][    C3] RBP: ffa0000000280770 R08: ff110000099987c8 R09: ff110000128bb8c0
[  506.205577][    C3] R10: fffffbfff5e778d5 R11: fffffbfff5e778d5 R12: ff110000099987dc
[  506.205710][    C3] R13: ff110000099987da R14: ff110000128bb976 R15: ff11000009998700
[  506.205842][    C3] FS:  00007f60b0e804c0(0000) GS:ff110000bce30000(0000) knlGS:0000000000000000
[  506.205998][    C3] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  506.206108][    C3] CR2: 00005591d231b0a8 CR3: 000000000c3fa005 CR4: 0000000000771ef0
[  506.206244][    C3] PKRU: 55555554
[  506.206311][    C3] Call Trace:
[  506.206377][    C3]  <IRQ>
[  506.206425][    C3] bareudp_udp_encap_recv (drivers/net/bareudp.c:145) bareudp
[  506.206535][    C3]  ? udp_lib_lport_inuse2 (net/ipv4/udp.c:178 (discriminator 1))
[  506.206623][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.206735][    C3]  ? __udp4_lib_lookup (net/ipv4/udp.c:713)
[  506.206825][    C3]  ? bareudp_newlink (./include/linux/list.h:164 (discriminator 2)) bareudp
[  506.206932][    C3]  udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
[  506.207019][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.207105][    C3]  ? print_irq_inversion_bug.part.0 (kernel/locking/lockdep.c:809 (discriminator 4) kernel/locking/lockdep.c:4084 (discriminator 4))
[  506.207217][    C3]  udp_unicast_rcv_skb (net/ipv4/udp.c:2574)
[  506.207304][    C3]  ? udp_rcv (net/ipv4/udp.c:741 (discriminator 3) net/ipv4/udp.c:2649 (discriminator 3))
[  506.207369][    C3]  udp_rcv (net/ipv4/udp.c:2651)
[  506.207441][    C3]  ? udp_sk_rx_dst_set (net/ipv4/udp.c:2451 (discriminator 1))
[  506.207527][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.207613][    C3]  ? ip_local_deliver_finish (./include/linux/rcupdate.h:300 (discriminator 2) ./include/linux/rcupdate.h:840 (discriminator 2) net/ipv4/ip_input.c:240 (discriminator 2))
[  506.207699][    C3]  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
[  506.207787][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.207872][    C3]  ip_local_deliver_finish (net/ipv4/ip_input.c:241 (discriminator 1))
[  506.207960][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5535)
[  506.208047][    C3]  ip_local_deliver (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:262)
[  506.208134][    C3]  ? ip_local_deliver_finish (net/ipv4/ip_input.c:232 (discriminator 42))
[  506.208224][    C3]  ? ip_rcv_finish_core (./include/linux/skbuff.h:1164 (discriminator 2) ./include/net/route.h:88 (discriminator 2) net/ipv4/ip_input.c:435 (discriminator 2))
[  506.208311][    C3]  ? process_backlog (./include/linux/local_lock_internal.h:62 (discriminator 2) net/core/dev.c:6668 (discriminator 2))
[  506.208512][    C3]  ip_rcv (./include/linux/netfilter.h:318 ./include/linux/netfilter.h:312 net/ipv4/ip_input.c:612)
[  506.208577][    C3]  ? ip_local_deliver (./include/linux/rcupdate.h:869 (discriminator 3))
[  506.208665][    C3]  ? mark_usage (kernel/locking/lockdep.c:4674)
[  506.208751][    C3]  ? __lock_acquire (kernel/locking/lockdep.c:5237)
[  506.208837][    C3]  ? __dev_queue_xmit (net/core/dev.c:4821)
[  506.208923][    C3]  __netif_receive_skb_one_core (net/core/dev.c:6206)
[  506.209030][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.209117][    C3]  ? __netif_receive_skb_list_core (net/core/dev.c:6252 (discriminator 2))
[  506.209230][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.209315][    C3]  process_backlog (net/core/dev.c:6670)
[  506.209401][    C3]  __napi_poll (net/core/dev.c:7729)
[  506.209469][    C3]  net_rx_action (net/core/dev.c:7792 net/core/dev.c:7949)
[  506.209609][    C3]  ? __napi_poll (./include/net/gro.h:507)
[  506.209696][    C3]  ? mark_held_locks (kernel/locking/lockdep.c:4325)
[  506.209782][    C3]  handle_softirqs (kernel/softirq.c:622)
[  506.209872][    C3]  ? _local_bh_enable (kernel/softirq.c:405 (discriminator 1))
[  506.210007][    C3]  ? do_raw_spin_unlock (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141)
[  506.210093][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.210182][    C3]  do_softirq (kernel/softirq.c:523 (discriminator 19) kernel/softirq.c:510 (discriminator 19))
[  506.210247][    C3]  </IRQ>
[  506.210290][    C3]  <TASK>
[  506.210382][    C3]  __local_bh_enable_ip (kernel/softirq.c:450)
[  506.210477][    C3]  __neigh_event_send (./include/linux/bottom_half.h:33 (discriminator 2) net/core/neighbour.c:1276 (discriminator 2))
[  506.210566][    C3]  ? lockdep_hardirqs_on (./arch/x86/include/asm/current.h:23 kernel/locking/lockdep.c:4417)
[  506.210652][    C3]  ? sync_exp_reset_tree_hotplug (kernel/rcu/tree_exp.h:96)
[  506.210808][    C3]  neigh_resolve_output (./include/net/neighbour.h:480 ./include/net/neighbour.h:486 ./include/net/neighbour.h:484 net/core/neighbour.c:1600)
[  506.210895][    C3]  ip_finish_output2 (./include/net/neighbour.h:560 (discriminator 3) net/ipv4/ip_output.c:236 (discriminator 3))
[  506.210982][    C3]  ? ip_dst_mtu_maybe_forward (./include/linux/rcupdate.h:873 ./include/net/ip.h:504)
[  506.211068][    C3]  ? ip4_dst_hoplimit (./include/net/dst.h:582 (discriminator 4) ./include/net/dst.h:587 (discriminator 4) ./include/net/route.h:393 (discriminator 4))
[  506.211209][    C3]  ? rcu_is_watching (./include/linux/context_tracking.h:128 (discriminator 3) kernel/rcu/tree.c:752 (discriminator 3))
[  506.211296][    C3]  ip_output (./include/linux/netfilter.h:307 net/ipv4/ip_output.c:437)
[  506.211361][    C3]  ? ip_finish_output (./include/linux/cgroup.h:847)
[  506.211451][    C3]  ? __ip_make_skb (net/ipv4/ip_output.c:1386 net/ipv4/ip_output.c:1497)
[  506.211588][    C3]  ip_push_pending_frames (./include/net/dst.h:470 (discriminator 4) net/ipv4/ip_output.c:131 (discriminator 4) net/ipv4/ip_output.c:1506 (discriminator 4) net/ipv4/ip_output.c:1526 (discriminator 4))
[  506.211675][    C3]  raw_sendmsg (net/ipv4/raw.c:657)
[  506.211761][    C3]  ? mark_lock (kernel/locking/lockdep.c:154 (discriminator 16) kernel/locking/lockdep.c:150 (discriminator 16) kernel/locking/lockdep.c:191 (discriminator 16) kernel/locking/lockdep.c:4759 (discriminator 16))
[  506.211848][    C3]  ? raw_send_hdrinc (./include/net/ip.h:581 (discriminator 1))
[  506.211984][    C3]  ? folio_add_lru_vma (mm/swap.c:536)
[  506.212070][    C3]  ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4069 (discriminator 3) kernel/rcu/tree.c:4061 (discriminator 3))
[  506.212187][    C3]  ? rcu_read_unlock (./include/linux/rcupdate.h:869 (discriminator 5))
[  506.212273][    C3]  ? wp_page_copy (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/page_ref.h:67 ./include/linux/mm.h:1766 ./include/linux/mm.h:1772 ./include/linux/mm.h:2089 mm/memory.c:3989)
[  506.212408][    C3]  ? lock_acquire.part.0 (kernel/locking/lockdep.c:5868 (discriminator 1))
[  506.212499][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.212586][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.212671][    C3]  ? __might_fault (mm/memory.c:7340 (discriminator 5))
[  506.212807][    C3]  __sys_sendto (net/socket.c:775 (discriminator 4) net/socket.c:790 (discriminator 4) net/socket.c:2252 (discriminator 4))
[  506.212892][    C3]  ? __ia32_sys_getpeername (net/socket.c:2206)
[  506.212978][    C3]  ? __lock_release.isra.0 (kernel/locking/lockdep.c:5574)
[  506.213068][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1479 arch/x86/mm/fault.c:1532)
[  506.213213][    C3]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[  506.213300][    C3]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[  506.213406][    C3]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[  506.213498][    C3]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[  506.213632][    C3]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  506.213718][    C3]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[  506.213804][    C3]  ? exc_page_fault (arch/x86/mm/fault.c:1485 (discriminator 3) arch/x86/mm/fault.c:1532 (discriminator 3))
[  506.213889][    C3]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[  506.214045][    C3] RIP: 0033:0x7f60b109e64e
[  506.214132][    C3] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 b4 bd 00 00       	call   0xbdbc
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[  506.214490][    C3] RSP: 002b:00007ffe5046e1b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
[  506.214619][    C3] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f60b109e64e
[  506.214797][    C3] RDX: 0000000000000040 RSI: 00005591d230b0a4 RDI: 0000000000000005
[  506.214926][    C3] RBP: 00007ffe5046e1c0 R08: 00005591d231d320 R09: 0000000000000010
[  506.215056][    C3] R10: 0000000000000000 R11: 0000000000000202 R12: 431bde82d7b634db


Finger prints:
udp_tun_rx_dst:bareudp_udp_encap_recv:udp_queue_rcv_one_skb:udp_unicast_rcv_skb:udp_rcv
print_report:kasan_report:udp_tun_rx_dst:bareudp_udp_encap_recv:udp_queue_rcv_one_skb