==================================================================
BUG: KASAN: use-after-free in dst_dev_put+0x217/0x280 net/core/dst.c:156
Read of size 8 at addr ffff888095285989 by task ksoftirqd/1/16

CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.2.0-rc1+ #26
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
 dst_dev_put+0x217/0x280 net/core/dst.c:156
 rt_fibinfo_free_cpus.part.0+0xdb/0x130 net/ipv4/fib_semantics.c:202
 rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:194 [inline]
 fib_nh_common_release+0x107/0x280 net/ipv4/fib_semantics.c:215
 fib_nh_release net/ipv4/fib_semantics.c:227 [inline]
 free_fib_info_rcu+0x117/0x210 net/ipv4/fib_semantics.c:236
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch kernel/rcu/tree.c:2092 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline]
 rcu_core+0xba5/0x1500 kernel/rcu/tree.c:2291
 __do_softirq+0x25c/0x94c kernel/softirq.c:293
 run_ksoftirqd kernel/softirq.c:604 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:596
 smpboot_thread_fn+0x6a3/0xa30 kernel/smpboot.c:165
 kthread+0x354/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 7126:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc mm/kasan/common.c:489 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497
 slab_post_alloc_hook mm/slab.h:437 [inline]
 slab_alloc mm/slab.c:3326 [inline]
 kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3488
 dst_alloc+0x10e/0x200 net/core/dst.c:93
 rt_dst_alloc+0x83/0x3f0 net/ipv4/route.c:1628
 __mkroute_output net/ipv4/route.c:2341 [inline]
 ip_route_output_key_hash_rcu+0x8f3/0x2d50 net/ipv4/route.c:2568
 ip_route_output_key_hash+0x1ef/0x360 net/ipv4/route.c:2397
 __ip_route_output_key include/net/route.h:129 [inline]
 ip_route_output_flow+0x28/0xc0 net/ipv4/route.c:2655
 udp_sendmsg+0x1ae9/0x2820 net/ipv4/udp.c:1154
 udpv6_sendmsg+0x13a4/0x28d0 net/ipv6/udp.c:1290
 inet_sendmsg+0x141/0x5d0 net/ipv4/af_inet.c:802
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xd7/0x130 net/socket.c:671
 ___sys_sendmsg+0x3e2/0x920 net/socket.c:2292
 __sys_sendmmsg+0x1bf/0x4d0 net/socket.c:2387
 __do_sys_sendmmsg net/socket.c:2416 [inline]
 __se_sys_sendmmsg net/socket.c:2413 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2413
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 9:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
 __cache_free mm/slab.c:3432 [inline]
 kmem_cache_free+0x86/0x260 mm/slab.c:3698
 dst_destroy+0x29e/0x3c0 net/core/dst.c:129
 dst_destroy_rcu+0x16/0x19 net/core/dst.c:142
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch kernel/rcu/tree.c:2092 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline]
 rcu_core+0xba5/0x1500 kernel/rcu/tree.c:2291
 __do_softirq+0x25c/0x94c kernel/softirq.c:293

The buggy address belongs to the object at ffff888095285900
 which belongs to the cache ip_dst_cache of size 176
The buggy address is located 137 bytes inside of
 176-byte region [ffff888095285900, ffff8880952859b0)
The buggy address belongs to the page:
page:ffffea000254a140 refcount:1 mapcount:0 mapping:ffff8880a6640780 index:0x0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea0002638fc8 ffffea0002a6cfc8 ffff8880a6640780
raw: 0000000000000000 ffff888095285000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888095285880: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff888095285900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888095285980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff888095285a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888095285a80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
==================================================================