[ 14.990437][ T273] ip (273) used greatest stack depth: 24688 bytes left
[ 15.328171][ T278] fab-br0: port 1(fbond) entered blocking state
[ 15.328755][ T278] fab-br0: port 1(fbond) entered disabled state
[ 15.329432][ T278] fbond: entered allmulticast mode
[ 15.333561][ T278] fbond: entered promiscuous mode
[ 15.516095][ T281] veth1-bond: entered promiscuous mode
[ 15.516964][ T281] veth1-bond: entered allmulticast mode
[ 15.518352][ T281] fbond: (slave veth1-bond): Enslaving as a backup interface with a down link
[ 15.653388][ T282] veth2-bond: entered promiscuous mode
[ 15.653966][ T282] veth2-bond: entered allmulticast mode
[ 15.654782][ T282] fbond: (slave veth2-bond): Enslaving as a backup interface with a down link
[ 15.850781][ T12] fbond: Warning: No 802.3ad response from the link partner for any adapters in the bond
[ 15.947216][ T12] fbond: (slave veth1-bond): link status definitely up, 10000 Mbps full duplex
[ 15.948065][ T12] fbond: (slave veth2-bond): link status definitely up, 10000 Mbps full duplex
[ 15.948602][ T12] fbond: active interface up!
[ 16.014796][ T285] fab-br0: port 1(fbond) entered blocking state
[ 16.015529][ T285] fab-br0: port 1(fbond) entered forwarding state
[ 16.029025][ T285] ip (285) used greatest stack depth: 24416 bytes left
[ 18.307700][ T317] fbond: left allmulticast mode
[ 18.308050][ T317] veth1-bond: left allmulticast mode
[ 18.308327][ T317] veth2-bond: left allmulticast mode
[ 18.308608][ T317] fbond: left promiscuous mode
[ 18.308918][ T317] veth1-bond: left promiscuous mode
[ 18.309386][ T317] veth2-bond: left promiscuous mode
[ 18.310027][ T317] fab-br0: port 1(fbond) entered disabled state
[ 18.359038][ T317] ==================================================================
[ 18.359327][ T317] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 18.359605][ T317] Read of size 1 at addr ffff88800abda69c by task ip/317
[ 18.359823][ T317]
[ 18.359937][ T317] CPU: 1 UID: 0 PID: 317 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 18.359942][ T317] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 18.359944][ T317] Call Trace:
[ 18.359946][ T317]
[ 18.359947][ T317] dump_stack_lvl+0x82/0xc0
[ 18.359952][ T317] print_address_description.constprop.0+0x2c/0x3a0
[ 18.359958][ T317] ? kobject_put+0xbb/0xd0
[ 18.359961][ T317] print_report+0xb4/0x270
[ 18.359964][ T317] ? kobject_put+0xbb/0xd0
[ 18.359967][ T317] ? kasan_addr_to_slab+0x21/0x70
[ 18.359970][ T317] ? kobject_put+0xbb/0xd0
[ 18.359972][ T317] kasan_report+0xca/0x100
[ 18.359975][ T317] ? kobject_put+0xbb/0xd0
[ 18.359980][ T317] kobject_put+0xbb/0xd0
[ 18.359983][ T317] netdev_run_todo+0x5f0/0xc60
[ 18.359988][ T317] ? dev_ingress_queue_create+0x190/0x190
[ 18.359991][ T317] ? generic_xdp_install+0x410/0x410
[ 18.359995][ T317] ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.359999][ T317] ? mutex_is_locked+0x1c/0x50
[ 18.360005][ T317] rtnl_dellink+0x350/0xa30
[ 18.360010][ T317] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 18.360029][ T317] ? find_held_lock+0x2b/0x80
[ 18.360034][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.360039][ T317] ? find_held_lock+0x2b/0x80
[ 18.360043][ T317] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 18.360046][ T317] ? __lock_release+0x5d/0x170
[ 18.360050][ T317] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 18.360053][ T317] rtnetlink_rcv_msg+0x709/0xc00
[ 18.360057][ T317] ? rtnl_port_fill+0x850/0x850
[ 18.360060][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.360067][ T317] netlink_rcv_skb+0x121/0x340
[ 18.360070][ T317] ? rtnl_port_fill+0x850/0x850
[ 18.360074][ T317] ? netlink_ack+0xdd0/0xdd0
[ 18.360080][ T317] ? netlink_deliver_tap+0x13e/0x340
[ 18.360085][ T317] ? netlink_deliver_tap+0xc3/0x340
[ 18.360089][ T317] netlink_unicast+0x4aa/0x780
[ 18.360093][ T317] ? netlink_attachskb+0x810/0x810
[ 18.360097][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.360102][ T317] netlink_sendmsg+0x714/0xbd0
[ 18.360106][ T317] ? netlink_unicast+0x780/0x780
[ 18.360109][ T317] ? __import_iovec+0x230/0x3b0
[ 18.360116][ T317] ? netlink_unicast+0x780/0x780
[ 18.360119][ T317] ____sys_sendmsg+0x3dd/0x890
[ 18.360126][ T317] ? get_timestamp.constprop.0+0x380/0x380
[ 18.360129][ T317] ? __copy_msghdr+0x3c0/0x3c0
[ 18.360136][ T317] ___sys_sendmsg+0xed/0x170
[ 18.360138][ T317] ? kasan_record_aux_stack+0x8c/0xa0
[ 18.360141][ T317] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 18.360148][ T317] ? copy_msghdr_from_user+0x110/0x110
[ 18.360152][ T317] ? find_held_lock+0x2b/0x80
[ 18.360156][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.360161][ T317] ? find_held_lock+0x2b/0x80
[ 18.360165][ T317] ? __virt_addr_valid+0x22a/0x450
[ 18.360168][ T317] ? __lock_release+0x5d/0x170
[ 18.360174][ T317] __sys_sendmsg+0x10b/0x1a0
[ 18.360176][ T317] ? __call_rcu_common.constprop.0+0x318/0x630
[ 18.360180][ T317] ? __sys_sendmsg_sock+0x20/0x20
[ 18.360186][ T317] ? rcu_is_watching+0x12/0xb0
[ 18.360190][ T317] do_syscall_64+0xc1/0xfd0
[ 18.360195][ T317] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.360197][ T317] RIP: 0033:0x7f4b852841d7
[ 18.360202][ T317] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 18.360204][ T317] RSP: 002b:00007ffeb18b7148 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 18.360209][ T317] RAX: ffffffffffffffda RBX: 00007ffeb18b7870 RCX: 00007f4b852841d7
[ 18.360211][ T317] RDX: 0000000000000000 RSI: 00007ffeb18b71b0 RDI: 0000000000000005
[ 18.360212][ T317] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078
[ 18.360214][ T317] R10: 00007f4b85180f60 R11: 0000000000000246 R12: 0000000000000001
[ 18.360216][ T317] R13: 00000000690dfe30 R14: 0000000000499600 R15: 0000000000000000
[ 18.360222][ T317]
[ 18.360223][ T317]
[ 18.373132][ T317] Allocated by task 256:
[ 18.373275][ T317] kasan_save_stack+0x24/0x40
[ 18.373472][ T317] kasan_save_track+0x14/0x30
[ 18.373659][ T317] __kasan_kmalloc+0x7b/0x90
[ 18.373846][ T317] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 18.374032][ T317] alloc_netdev_mqs+0x7d/0x1310
[ 18.374221][ T317] rtnl_create_link+0xa9e/0xe20
[ 18.374408][ T317] rtnl_newlink_create+0x203/0x8f0
[ 18.374598][ T317] __rtnl_newlink+0x231/0xa30
[ 18.374784][ T317] rtnl_newlink+0x693/0xa60
[ 18.374972][ T317] rtnetlink_rcv_msg+0x709/0xc00
[ 18.375159][ T317] netlink_rcv_skb+0x121/0x340
[ 18.375346][ T317] netlink_unicast+0x4aa/0x780
[ 18.375538][ T317] netlink_sendmsg+0x714/0xbd0
[ 18.375733][ T317] ____sys_sendmsg+0x3dd/0x890
[ 18.375917][ T317] ___sys_sendmsg+0xed/0x170
[ 18.376092][ T317] __sys_sendmsg+0x10b/0x1a0
[ 18.376272][ T317] do_syscall_64+0xc1/0xfd0
[ 18.376461][ T317] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.376689][ T317]
[ 18.376794][ T317] Freed by task 317:
[ 18.376930][ T317] kasan_save_stack+0x24/0x40
[ 18.377116][ T317] kasan_save_track+0x14/0x30
[ 18.377302][ T317] __kasan_save_free_info+0x3b/0x60
[ 18.377493][ T317] __kasan_slab_free+0x3f/0x60
[ 18.377674][ T317] kfree+0x21d/0x540
[ 18.377813][ T317] device_release+0x9c/0x210
[ 18.377989][ T317] kobject_cleanup+0xfe/0x360
[ 18.378179][ T317] netdev_run_todo+0x81f/0xc60
[ 18.378362][ T317] rtnl_dellink+0x350/0xa30
[ 18.378551][ T317] rtnetlink_rcv_msg+0x709/0xc00
[ 18.378738][ T317] netlink_rcv_skb+0x121/0x340
[ 18.378922][ T317] netlink_unicast+0x4aa/0x780
[ 18.379104][ T317] netlink_sendmsg+0x714/0xbd0
[ 18.379288][ T317] ____sys_sendmsg+0x3dd/0x890
[ 18.379475][ T317] ___sys_sendmsg+0xed/0x170
[ 18.379652][ T317] __sys_sendmsg+0x10b/0x1a0
[ 18.379827][ T317] do_syscall_64+0xc1/0xfd0
[ 18.380002][ T317] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.380219][ T317]
[ 18.380315][ T317] Last potentially related work creation:
[ 18.380499][ T317] kasan_save_stack+0x24/0x40
[ 18.380677][ T317] kasan_record_aux_stack+0x8c/0xa0
[ 18.380853][ T317] insert_work+0x34/0x230
[ 18.380990][ T317] __queue_work+0x5fd/0xab0
[ 18.381156][ T317] queue_work_on+0x84/0x90
[ 18.381339][ T317] br_multicast_dev_del+0xeb/0x240
[ 18.381540][ T317] br_dev_uninit+0x19/0x40
[ 18.381729][ T317] unregister_netdevice_many_notify+0xa7d/0x1c90
[ 18.381955][ T317] rtnl_dellink+0x344/0xa30
[ 18.382123][ T317] rtnetlink_rcv_msg+0x709/0xc00
[ 18.382298][ T317] netlink_rcv_skb+0x121/0x340
[ 18.382488][ T317] netlink_unicast+0x4aa/0x780
[ 18.382652][ T317] netlink_sendmsg+0x714/0xbd0
[ 18.382831][ T317] ____sys_sendmsg+0x3dd/0x890
[ 18.383000][ T317] ___sys_sendmsg+0xed/0x170
[ 18.383164][ T317] __sys_sendmsg+0x10b/0x1a0
[ 18.383340][ T317] do_syscall_64+0xc1/0xfd0
[ 18.383518][ T317] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.383721][ T317]
[ 18.383822][ T317] Second to last potentially related work creation:
[ 18.384037][ T317] kasan_save_stack+0x24/0x40
[ 18.384225][ T317] kasan_record_aux_stack+0x8c/0xa0
[ 18.384399][ T317] insert_work+0x34/0x230
[ 18.384535][ T317] __queue_work+0x5fd/0xab0
[ 18.384700][ T317] queue_work_on+0x84/0x90
[ 18.384869][ T317] br_multicast_group_expired+0x13e/0x180
[ 18.385036][ T317] call_timer_fn+0x13a/0x220
[ 18.385212][ T317] __run_timers+0x53f/0x810
[ 18.385374][ T317] run_timer_softirq+0xa3/0xf0
[ 18.385543][ T317] handle_softirqs+0x215/0x610
[ 18.385709][ T317] run_ksoftirqd+0x3b/0x60
[ 18.385889][ T317] smpboot_thread_fn+0x304/0x950
[ 18.386067][ T317] kthread+0x37b/0x5f0
[ 18.386192][ T317] ret_from_fork+0x1db/0x270
[ 18.386371][ T317] ret_from_fork_asm+0x11/0x20
[ 18.386548][ T317]
[ 18.386647][ T317] The buggy address belongs to the object at ffff88800abda000
[ 18.386647][ T317] which belongs to the cache kmalloc-8k of size 8192
[ 18.387063][ T317] The buggy address is located 1692 bytes inside of
[ 18.387063][ T317] freed 8192-byte region [ffff88800abda000, ffff88800abdc000)
[ 18.387468][ T317]
[ 18.387558][ T317] The buggy address belongs to the physical page:
[ 18.387757][ T317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xabd8
[ 18.388065][ T317] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 18.388342][ T317] flags: 0x80000000000040(head|node=0|zone=1)
[ 18.388558][ T317] page_type: f5(slab)
[ 18.388701][ T317] raw: 0080000000000040 ffff8880010438c0 ffffea0000236010 ffffea000025fa10
[ 18.389018][ T317] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 18.389327][ T317] head: 0080000000000040 ffff8880010438c0 ffffea0000236010 ffffea000025fa10
[ 18.389640][ T317] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 18.390064][ T317] head: 0080000000000003 ffffea00002af601 00000000ffffffff 00000000ffffffff
[ 18.390358][ T317] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 18.390789][ T317] page dumped because: kasan: bad access detected
[ 18.391018][ T317]
[ 18.391106][ T317] Memory state around the buggy address:
[ 18.391288][ T317] ffff88800abda580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 18.391662][ T317] ffff88800abda600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 18.391927][ T317] >ffff88800abda680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 18.392174][ T317] ^
[ 18.392426][ T317] ffff88800abda700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 18.392678][ T317] ffff88800abda780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 18.392929][ T317] ==================================================================
[ 18.393711][ T317] Disabling lock debugging due to kernel taint
[ 18.393963][ T317] ------------[ cut here ]------------
[ 18.394127][ T317] refcount_t: underflow; use-after-free.
[ 18.394345][ T317] WARNING: CPU: 3 PID: 317 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 18.394652][ T317] Modules linked in:
[ 18.394810][ T317] CPU: 3 UID: 0 PID: 317 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 18.395186][ T317] Tainted: [B]=BAD_PAGE
[ 18.395321][ T317] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 18.395542][ T317] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 18.395777][ T317] Code: a2 b5 02 80 fb 01 0f 87 db 6e d8 fe 83 e3 01 0f 85 51 ff ff ff c6 05 c2 a2 b5 02 01 90 48 c7 c7 60 a8 e5 93 e8 72 c3 17 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 20 69 a0 ff e9 ba fe ff ff
[ 18.396400][ T317] RSP: 0018:ffffc90000d871f0 EFLAGS: 00010286
[ 18.396620][ T317] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 18.396895][ T317] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 18.397146][ T317] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff28fe134
[ 18.397414][ T317] R10: 0000000000000003 R11: ffffc90000d86d80 R12: 0000000000000001
[ 18.397685][ T317] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 18.397956][ T317] FS: 00007f4b850b6800(0000) GS:ffff8880a0701000(0000) knlGS:0000000000000000
[ 18.398278][ T317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 18.398499][ T317] CR2: 0000563974d64dec CR3: 000000000c755003 CR4: 0000000000772ef0
[ 18.398772][ T317] PKRU: 55555554
[ 18.398907][ T317] Call Trace:
[ 18.399045][ T317]
[ 18.399136][ T317] netdev_run_todo+0x5f0/0xc60
[ 18.399318][ T317] ? dev_ingress_queue_create+0x190/0x190
[ 18.399497][ T317] ? generic_xdp_install+0x410/0x410
[ 18.399683][ T317] ? entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.399908][ T317] ? mutex_is_locked+0x1c/0x50
[ 18.400090][ T317] rtnl_dellink+0x350/0xa30
[ 18.400271][ T317] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 18.400504][ T317] ? find_held_lock+0x2b/0x80
[ 18.400690][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.400872][ T317] ? find_held_lock+0x2b/0x80
[ 18.401032][ T317] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 18.401205][ T317] ? __lock_release+0x5d/0x170
[ 18.401368][ T317] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 18.401584][ T317] rtnetlink_rcv_msg+0x709/0xc00
[ 18.401751][ T317] ? rtnl_port_fill+0x850/0x850
[ 18.401910][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.402086][ T317] netlink_rcv_skb+0x121/0x340
[ 18.402245][ T317] ? rtnl_port_fill+0x850/0x850
[ 18.402409][ T317] ? netlink_ack+0xdd0/0xdd0
[ 18.402573][ T317] ? netlink_deliver_tap+0x13e/0x340
[ 18.402738][ T317] ? netlink_deliver_tap+0xc3/0x340
[ 18.402902][ T317] netlink_unicast+0x4aa/0x780
[ 18.403061][ T317] ? netlink_attachskb+0x810/0x810
[ 18.403221][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.403392][ T317] netlink_sendmsg+0x714/0xbd0
[ 18.403552][ T317] ? netlink_unicast+0x780/0x780
[ 18.403719][ T317] ? __import_iovec+0x230/0x3b0
[ 18.403902][ T317] ? netlink_unicast+0x780/0x780
[ 18.404061][ T317] ____sys_sendmsg+0x3dd/0x890
[ 18.404243][ T317] ? get_timestamp.constprop.0+0x380/0x380
[ 18.404440][ T317] ? __copy_msghdr+0x3c0/0x3c0
[ 18.404612][ T317] ___sys_sendmsg+0xed/0x170
[ 18.404795][ T317] ? kasan_record_aux_stack+0x8c/0xa0
[ 18.404961][ T317] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 18.405175][ T317] ? copy_msghdr_from_user+0x110/0x110
[ 18.405341][ T317] ? find_held_lock+0x2b/0x80
[ 18.405515][ T317] ? __lock_acquire+0x449/0x7e0
[ 18.405686][ T317] ? find_held_lock+0x2b/0x80
[ 18.405855][ T317] ? __virt_addr_valid+0x22a/0x450
[ 18.406023][ T317] ? __lock_release+0x5d/0x170
[ 18.406189][ T317] __sys_sendmsg+0x10b/0x1a0
[ 18.406350][ T317] ? __call_rcu_common.constprop.0+0x318/0x630
[ 18.406562][ T317] ? __sys_sendmsg_sock+0x20/0x20
[ 18.406732][ T317] ? rcu_is_watching+0x12/0xb0
[ 18.406907][ T317] do_syscall_64+0xc1/0xfd0
[ 18.407087][ T317] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 18.407471][ T317] RIP: 0033:0x7f4b852841d7
[ 18.407638][ T317] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 18.408346][ T317] RSP: 002b:00007ffeb18b7148 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 18.408602][ T317] RAX: ffffffffffffffda RBX: 00007ffeb18b7870 RCX: 00007f4b852841d7
[ 18.408875][ T317] RDX: 0000000000000000 RSI: 00007ffeb18b71b0 RDI: 0000000000000005
[ 18.409325][ T317] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078
[ 18.409577][ T317] R10: 00007f4b85180f60 R11: 0000000000000246 R12: 0000000000000001
[ 18.409950][ T317] R13: 00000000690dfe30 R14: 0000000000499600 R15: 0000000000000000
[ 18.410203][ T317]
[ 18.410336][ T317] irq event stamp: 43313
[ 18.410558][ T317] hardirqs last enabled at (43313): [] irqentry_exit+0x3b/0x80
[ 18.410859][ T317] hardirqs last disabled at (43312): [] sysvec_call_function_single+0xf/0xc0
[ 18.411198][ T317] softirqs last enabled at (43128): [] handle_softirqs+0x352/0x610
[ 18.411579][ T317] softirqs last disabled at (43121): [] irq_exit_rcu+0xab/0x100
[ 18.412069][ T317] ---[ end trace 0000000000000000 ]---
[ 18.417092][ T317] ip (317) used greatest stack depth: 24232 bytes left
[ 18.488475][ T318] fbond (unregistering): (slave veth1-bond): Removing an active aggregator
[ 18.489072][ T318] fbond (unregistering): (slave veth1-bond): Releasing backup interface
[ 18.494568][ T318] fbond (unregistering): (slave veth2-bond): Removing an active aggregator
[ 18.495420][ T318] fbond (unregistering): (slave veth2-bond): Releasing backup interface
[ 18.502319][ T318] fbond (unregistering): Released all slaves