==================================================================
BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:389 [inline]
BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a9/0x330 kernel/bpf/devmap.c:403
Read of size 8 at addr ffff888098b81e48 by task kworker/1:4/7846

CPU: 1 PID: 7846 Comm: kworker/1:4 Not tainted 4.20.0+ #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events iterate_cleanup_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 dev_map_flush_old kernel/bpf/devmap.c:389 [inline]
 __dev_map_entry_free+0x2a9/0x330 kernel/bpf/devmap.c:403
 __rcu_reclaim kernel/rcu/rcu.h:240 [inline]
 rcu_do_batch kernel/rcu/tree.c:2452 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2773 [inline]
 rcu_process_callbacks+0xc4a/0x1680 kernel/rcu/tree.c:2754
 __do_softirq+0x30b/0xb11 kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027
 </IRQ>
 do_softirq.part.0+0x11a/0x170 kernel/softirq.c:337
 do_softirq kernel/softirq.c:329 [inline]
 __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 get_next_corpse net/netfilter/nf_conntrack_core.c:1892 [inline]
 nf_ct_iterate_cleanup+0x299/0x5c0 net/netfilter/nf_conntrack_core.c:1915
 nf_ct_iterate_cleanup_net+0x232/0x2d0 net/netfilter/nf_conntrack_core.c:2000
 iterate_cleanup_work+0x4a/0xe0 net/ipv6/netfilter/nf_nat_masquerade_ipv6.c:113
 process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
 worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

Allocated by task 23726:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
 kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3620
 kmalloc include/linux/slab.h:546 [inline]
 kzalloc include/linux/slab.h:741 [inline]
 dev_map_alloc kernel/bpf/devmap.c:102 [inline]
 dev_map_alloc+0x205/0x800 kernel/bpf/devmap.c:88
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create kernel/bpf/syscall.c:510 [inline]
 __do_sys_bpf+0x6df/0x4410 kernel/bpf/syscall.c:2603
 __se_sys_bpf kernel/bpf/syscall.c:2580 [inline]
 __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2580
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8733:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3817
 dev_map_free+0x522/0x6b0 kernel/bpf/devmap.c:192
 bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:290
 process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
 worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff888098b81d40
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
 512-byte region [ffff888098b81d40, ffff888098b81f40)
The buggy address belongs to the page:
page:ffffea000262e040 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0xffff888098b81ac0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea0002573588 ffffea0002752c08 ffff88812c3f0940
raw: ffff888098b81ac0 ffff888098b810c0 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888098b81d00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff888098b81d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888098b81e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff888098b81e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888098b81f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================