[ 19.817316][ T276] fab-br0: port 1(fbond) entered blocking state
[ 19.818298][ T276] fab-br0: port 1(fbond) entered disabled state
[ 19.819001][ T276] fbond: entered allmulticast mode
[ 19.824463][ T276] fbond: entered promiscuous mode
[ 20.022645][ T279] veth1-bond: entered promiscuous mode
[ 20.023925][ T279] veth1-bond: entered allmulticast mode
[ 20.026395][ T279] fbond: (slave veth1-bond): Enslaving as a backup interface with a down link
[ 20.239683][ T280] veth2-bond: entered promiscuous mode
[ 20.240664][ T280] veth2-bond: entered allmulticast mode
[ 20.242106][ T280] fbond: (slave veth2-bond): Enslaving as a backup interface with a down link
[ 20.375636][ T12] fbond: (slave veth1-bond): link status definitely up, 10000 Mbps full duplex
[ 20.376435][ T12] fbond: Warning: No 802.3ad response from the link partner for any adapters in the bond
[ 20.378307][ T12] fbond: active interface up!
[ 20.583604][ T12] fbond: (slave veth2-bond): link status definitely up, 10000 Mbps full duplex
[ 20.640890][ T284] fab-br0: port 1(fbond) entered blocking state
[ 20.641515][ T284] fab-br0: port 1(fbond) entered forwarding state
[ 23.224055][ T309] fbond: left allmulticast mode
[ 23.224547][ T309] veth1-bond: left allmulticast mode
[ 23.224844][ T309] veth2-bond: left allmulticast mode
[ 23.225160][ T309] fbond: left promiscuous mode
[ 23.225448][ T309] veth1-bond: left promiscuous mode
[ 23.225975][ T309] veth2-bond: left promiscuous mode
[ 23.226754][ T309] fab-br0: port 1(fbond) entered disabled state
[ 23.286070][ T309] ==================================================================
[ 23.286654][ T309] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 23.287147][ T309] Read of size 1 at addr ffff888004eaa69c by task ip/309
[ 23.287546][ T309]
[ 23.287708][ T309] CPU: 2 UID: 0 PID: 309 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 23.287717][ T309] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 23.287721][ T309] Call Trace:
[ 23.287724][ T309]
[ 23.287728][ T309] dump_stack_lvl+0x82/0xc0
[ 23.287737][ T309] print_address_description.constprop.0+0x2c/0x3a0
[ 23.287747][ T309] ? kobject_put+0xbb/0xd0
[ 23.287753][ T309] print_report+0xb4/0x270
[ 23.287758][ T309] ? kobject_put+0xbb/0xd0
[ 23.287762][ T309] ? kasan_addr_to_slab+0x21/0x70
[ 23.287768][ T309] ? kobject_put+0xbb/0xd0
[ 23.287772][ T309] kasan_report+0xca/0x100
[ 23.287779][ T309] ? kobject_put+0xbb/0xd0
[ 23.287788][ T309] kobject_put+0xbb/0xd0
[ 23.287793][ T309] netdev_run_todo+0x5f0/0xc60
[ 23.287805][ T309] ? dev_ingress_queue_create+0x190/0x190
[ 23.287811][ T309] ? generic_xdp_install+0x410/0x410
[ 23.287815][ T309] ? kernfs_put.part.0+0x12d/0x480
[ 23.287827][ T309] ? unregister_netdevice_many+0x20/0x20
[ 23.287835][ T309] ? br_dev_delete+0x10d/0x190
[ 23.287844][ T309] rtnl_dellink+0x350/0xa30
[ 23.287854][ T309] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 23.287894][ T309] ? find_held_lock+0x2b/0x80
[ 23.287905][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.287916][ T309] ? find_held_lock+0x2b/0x80
[ 23.287923][ T309] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 23.287927][ T309] ? __lock_release+0x5d/0x170
[ 23.287935][ T309] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 23.287942][ T309] rtnetlink_rcv_msg+0x709/0xc00
[ 23.287949][ T309] ? rtnl_port_fill+0x850/0x850
[ 23.287954][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.287968][ T309] netlink_rcv_skb+0x121/0x340
[ 23.287974][ T309] ? rtnl_port_fill+0x850/0x850
[ 23.287981][ T309] ? netlink_ack+0xdd0/0xdd0
[ 23.287994][ T309] ? netlink_deliver_tap+0x13e/0x340
[ 23.288002][ T309] ? netlink_deliver_tap+0xc3/0x340
[ 23.288010][ T309] netlink_unicast+0x4aa/0x780
[ 23.288018][ T309] ? netlink_attachskb+0x810/0x810
[ 23.288024][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.288034][ T309] netlink_sendmsg+0x714/0xbd0
[ 23.288042][ T309] ? netlink_unicast+0x780/0x780
[ 23.288048][ T309] ? __import_iovec+0x230/0x3b0
[ 23.288060][ T309] ? netlink_unicast+0x780/0x780
[ 23.288066][ T309] ____sys_sendmsg+0x3dd/0x890
[ 23.288077][ T309] ? get_timestamp.constprop.0+0x380/0x380
[ 23.288082][ T309] ? __copy_msghdr+0x3c0/0x3c0
[ 23.288095][ T309] ___sys_sendmsg+0xed/0x170
[ 23.288100][ T309] ? kasan_record_aux_stack+0x8c/0xa0
[ 23.288104][ T309] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 23.288113][ T309] ? copy_msghdr_from_user+0x110/0x110
[ 23.288121][ T309] ? find_held_lock+0x2b/0x80
[ 23.288128][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.288139][ T309] ? find_held_lock+0x2b/0x80
[ 23.288145][ T309] ? __virt_addr_valid+0x22a/0x450
[ 23.288153][ T309] ? __lock_release+0x5d/0x170
[ 23.288165][ T309] __sys_sendmsg+0x10b/0x1a0
[ 23.288169][ T309] ? __call_rcu_common.constprop.0+0x318/0x630
[ 23.288175][ T309] ? __sys_sendmsg_sock+0x20/0x20
[ 23.288189][ T309] ? rcu_is_watching+0x12/0xb0
[ 23.288196][ T309] do_syscall_64+0xc1/0xfd0
[ 23.288205][ T309] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 23.288212][ T309] RIP: 0033:0x7faf745d61d7
[ 23.288220][ T309] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 23.288226][ T309] RSP: 002b:00007ffc904fdd08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 23.288233][ T309] RAX: ffffffffffffffda RBX: 00007ffc904fe430 RCX: 00007faf745d61d7
[ 23.288237][ T309] RDX: 0000000000000000 RSI: 00007ffc904fdd70 RDI: 0000000000000005
[ 23.288240][ T309] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078
[ 23.288243][ T309] R10: 00007faf744d2f60 R11: 0000000000000246 R12: 0000000000000001
[ 23.288247][ T309] R13: 00000000690dee3d R14: 0000000000499600 R15: 0000000000000000
[ 23.288260][ T309]
[ 23.288262][ T309]
[ 23.311321][ T309] Allocated by task 254:
[ 23.311552][ T309] kasan_save_stack+0x24/0x40
[ 23.311884][ T309] kasan_save_track+0x14/0x30
[ 23.312206][ T309] __kasan_kmalloc+0x7b/0x90
[ 23.312499][ T309] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 23.312815][ T309] alloc_netdev_mqs+0x7d/0x1310
[ 23.313143][ T309] rtnl_create_link+0xa9e/0xe20
[ 23.313446][ T309] rtnl_newlink_create+0x203/0x8f0
[ 23.313766][ T309] __rtnl_newlink+0x231/0xa30
[ 23.314103][ T309] rtnl_newlink+0x693/0xa60
[ 23.314442][ T309] rtnetlink_rcv_msg+0x709/0xc00
[ 23.314746][ T309] netlink_rcv_skb+0x121/0x340
[ 23.315049][ T309] netlink_unicast+0x4aa/0x780
[ 23.315337][ T309] netlink_sendmsg+0x714/0xbd0
[ 23.315659][ T309] ____sys_sendmsg+0x3dd/0x890
[ 23.315984][ T309] ___sys_sendmsg+0xed/0x170
[ 23.316283][ T309] __sys_sendmsg+0x10b/0x1a0
[ 23.316567][ T309] do_syscall_64+0xc1/0xfd0
[ 23.316886][ T309] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 23.317272][ T309]
[ 23.317417][ T309] Freed by task 309:
[ 23.317645][ T309] kasan_save_stack+0x24/0x40
[ 23.317979][ T309] kasan_save_track+0x14/0x30
[ 23.318273][ T309] __kasan_save_free_info+0x3b/0x60
[ 23.318583][ T309] __kasan_slab_free+0x3f/0x60
[ 23.318874][ T309] kfree+0x21d/0x540
[ 23.319120][ T309] device_release+0x9c/0x210
[ 23.319435][ T309] kobject_cleanup+0xfe/0x360
[ 23.319720][ T309] netdev_run_todo+0x81f/0xc60
[ 23.320020][ T309] rtnl_dellink+0x350/0xa30
[ 23.320314][ T309] rtnetlink_rcv_msg+0x709/0xc00
[ 23.320607][ T309] netlink_rcv_skb+0x121/0x340
[ 23.320902][ T309] netlink_unicast+0x4aa/0x780
[ 23.321205][ T309] netlink_sendmsg+0x714/0xbd0
[ 23.321488][ T309] ____sys_sendmsg+0x3dd/0x890
[ 23.321785][ T309] ___sys_sendmsg+0xed/0x170
[ 23.322104][ T309] __sys_sendmsg+0x10b/0x1a0
[ 23.322391][ T309] do_syscall_64+0xc1/0xfd0
[ 23.322680][ T309] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 23.323036][ T309]
[ 23.323195][ T309] Last potentially related work creation:
[ 23.323486][ T309] kasan_save_stack+0x24/0x40
[ 23.323791][ T309] kasan_record_aux_stack+0x8c/0xa0
[ 23.324107][ T309] insert_work+0x34/0x230
[ 23.324337][ T309] __queue_work+0x5fd/0xab0
[ 23.324635][ T309] queue_work_on+0x84/0x90
[ 23.324936][ T309] br_multicast_dev_del+0xeb/0x240
[ 23.325241][ T309] br_dev_uninit+0x19/0x40
[ 23.325544][ T309] unregister_netdevice_many_notify+0xa7d/0x1c90
[ 23.325905][ T309] rtnl_dellink+0x344/0xa30
[ 23.326220][ T309] rtnetlink_rcv_msg+0x709/0xc00
[ 23.326513][ T309] netlink_rcv_skb+0x121/0x340
[ 23.326806][ T309] netlink_unicast+0x4aa/0x780
[ 23.327110][ T309] netlink_sendmsg+0x714/0xbd0
[ 23.327402][ T309] ____sys_sendmsg+0x3dd/0x890
[ 23.327716][ T309] ___sys_sendmsg+0xed/0x170
[ 23.328031][ T309] __sys_sendmsg+0x10b/0x1a0
[ 23.328335][ T309] do_syscall_64+0xc1/0xfd0
[ 23.328644][ T309] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 23.329029][ T309]
[ 23.329206][ T309] Second to last potentially related work creation:
[ 23.329562][ T309] kasan_save_stack+0x24/0x40
[ 23.329874][ T309] kasan_record_aux_stack+0x8c/0xa0
[ 23.330175][ T309] insert_work+0x34/0x230
[ 23.330395][ T309] __queue_work+0x5fd/0xab0
[ 23.330707][ T309] queue_work_on+0x84/0x90
[ 23.331035][ T309] br_multicast_group_expired+0x13e/0x180
[ 23.331335][ T309] call_timer_fn+0x13a/0x220
[ 23.331651][ T309] __run_timers+0x53f/0x810
[ 23.331963][ T309] run_timer_softirq+0xa3/0xf0
[ 23.332257][ T309] handle_softirqs+0x215/0x610
[ 23.332550][ T309] irq_exit_rcu+0xab/0x100
[ 23.332839][ T309] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 23.333140][ T309] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 23.333561][ T309]
[ 23.333716][ T309] The buggy address belongs to the object at ffff888004eaa000
[ 23.333716][ T309] which belongs to the cache kmalloc-8k of size 8192
[ 23.334429][ T309] The buggy address is located 1692 bytes inside of
[ 23.334429][ T309] freed 8192-byte region [ffff888004eaa000, ffff888004eac000)
[ 23.335190][ T309]
[ 23.335334][ T309] The buggy address belongs to the physical page:
[ 23.335710][ T309] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ea8
[ 23.336267][ T309] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 23.336727][ T309] flags: 0x80000000000040(head|node=0|zone=1)
[ 23.337107][ T309] page_type: f5(slab)
[ 23.337359][ T309] raw: 0080000000000040 ffff8880010438c0 ffffea000021b810 ffffea0000301a10
[ 23.337896][ T309] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 23.338421][ T309] head: 0080000000000040 ffff8880010438c0 ffffea000021b810 ffffea0000301a10
[ 23.338958][ T309] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 23.339486][ T309] head: 0080000000000003 ffffea000013aa01 00000000ffffffff 00000000ffffffff
[ 23.340035][ T309] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 23.340548][ T309] page dumped because: kasan: bad access detected
[ 23.340949][ T309]
[ 23.341099][ T309] Memory state around the buggy address:
[ 23.341376][ T309] ffff888004eaa580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.341816][ T309] ffff888004eaa600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.342243][ T309] >ffff888004eaa680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.342679][ T309] ^
[ 23.342968][ T309] ffff888004eaa700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.343382][ T309] ffff888004eaa780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 23.343825][ T309] ==================================================================
[ 23.346557][ T309] Disabling lock debugging due to kernel taint
[ 23.347014][ T309] ------------[ cut here ]------------
[ 23.347538][ T309] refcount_t: underflow; use-after-free.
[ 23.347909][ T309] WARNING: CPU: 2 PID: 309 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 23.348527][ T309] Modules linked in:
[ 23.348811][ T309] CPU: 2 UID: 0 PID: 309 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 23.349438][ T309] Tainted: [B]=BAD_PAGE
[ 23.349692][ T309] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 23.350079][ T309] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 23.350514][ T309] Code: a2 b5 02 80 fb 01 0f 87 db 6e d8 fe 83 e3 01 0f 85 51 ff ff ff c6 05 c2 a2 b5 02 01 90 48 c7 c7 60 a8 c5 a2 e8 72 c3 17 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 20 69 a0 ff e9 ba fe ff ff
[ 23.351657][ T309] RSP: 0018:ffffc90000da71f0 EFLAGS: 00010286
[ 23.352067][ T309] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 23.352557][ T309] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 23.353080][ T309] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff46be134
[ 23.353567][ T309] R10: 0000000000000003 R11: ffffc90000da6d80 R12: 0000000000000001
[ 23.354061][ T309] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 23.354565][ T309] FS: 00007faf74408800(0000) GS:ffff888091881000(0000) knlGS:0000000000000000
[ 23.355169][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.355572][ T309] CR2: 00007f5db9df4930 CR3: 000000000cd90006 CR4: 0000000000772ef0
[ 23.356089][ T309] PKRU: 55555554
[ 23.356805][ T309] Call Trace:
[ 23.357091][ T309]
[ 23.357299][ T309] netdev_run_todo+0x5f0/0xc60
[ 23.357670][ T309] ? dev_ingress_queue_create+0x190/0x190
[ 23.358003][ T309] ? generic_xdp_install+0x410/0x410
[ 23.358329][ T309] ? kernfs_put.part.0+0x12d/0x480
[ 23.358651][ T309] ? unregister_netdevice_many+0x20/0x20
[ 23.358968][ T309] ? br_dev_delete+0x10d/0x190
[ 23.359312][ T309] rtnl_dellink+0x350/0xa30
[ 23.359641][ T309] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 23.360089][ T309] ? find_held_lock+0x2b/0x80
[ 23.360425][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.360755][ T309] ? find_held_lock+0x2b/0x80
[ 23.361076][ T309] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 23.361396][ T309] ? __lock_release+0x5d/0x170
[ 23.361732][ T309] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 23.362159][ T309] rtnetlink_rcv_msg+0x709/0xc00
[ 23.362491][ T309] ? rtnl_port_fill+0x850/0x850
[ 23.362819][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.363163][ T309] netlink_rcv_skb+0x121/0x340
[ 23.363496][ T309] ? rtnl_port_fill+0x850/0x850
[ 23.363825][ T309] ? netlink_ack+0xdd0/0xdd0
[ 23.365656][ T309] ? netlink_deliver_tap+0x13e/0x340
[ 23.366011][ T309] ? netlink_deliver_tap+0xc3/0x340
[ 23.366400][ T309] netlink_unicast+0x4aa/0x780
[ 23.366717][ T309] ? netlink_attachskb+0x810/0x810
[ 23.367040][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.367370][ T309] netlink_sendmsg+0x714/0xbd0
[ 23.367689][ T309] ? netlink_unicast+0x780/0x780
[ 23.368006][ T309] ? __import_iovec+0x230/0x3b0
[ 23.368364][ T309] ? netlink_unicast+0x780/0x780
[ 23.368691][ T309] ____sys_sendmsg+0x3dd/0x890
[ 23.374975][ T309] ? get_timestamp.constprop.0+0x380/0x380
[ 23.375398][ T309] ? __copy_msghdr+0x3c0/0x3c0
[ 23.375738][ T309] ___sys_sendmsg+0xed/0x170
[ 23.376063][ T309] ? kasan_record_aux_stack+0x8c/0xa0
[ 23.376467][ T309] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 23.376878][ T309] ? copy_msghdr_from_user+0x110/0x110
[ 23.377214][ T309] ? find_held_lock+0x2b/0x80
[ 23.377579][ T309] ? __lock_acquire+0x449/0x7e0
[ 23.377903][ T309] ? find_held_lock+0x2b/0x80
[ 23.378240][ T309] ? __virt_addr_valid+0x22a/0x450
[ 23.378565][ T309] ? __lock_release+0x5d/0x170
[ 23.378902][ T309] __sys_sendmsg+0x10b/0x1a0
[ 23.379243][ T309] ? __call_rcu_common.constprop.0+0x318/0x630
[ 23.379646][ T309] ? __sys_sendmsg_sock+0x20/0x20
[ 23.379986][ T309] ? rcu_is_watching+0x12/0xb0
[ 23.380342][ T309] do_syscall_64+0xc1/0xfd0
[ 23.380673][ T309] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 23.381093][ T309] RIP: 0033:0x7faf745d61d7
[ 23.389375][ T309] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 23.390577][ T309] RSP: 002b:00007ffc904fdd08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 23.391083][ T309] RAX: ffffffffffffffda RBX: 00007ffc904fe430 RCX: 00007faf745d61d7
[ 23.391571][ T309] RDX: 0000000000000000 RSI: 00007ffc904fdd70 RDI: 0000000000000005
[ 23.392049][ T309] RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000078
[ 23.392535][ T309] R10: 00007faf744d2f60 R11: 0000000000000246 R12: 0000000000000001
[ 23.393019][ T309] R13: 00000000690dee3d R14: 0000000000499600 R15: 0000000000000000
[ 23.393559][ T309]
[ 23.393828][ T309] irq event stamp: 41375
[ 23.394099][ T309] hardirqs last enabled at (41375): [] finish_task_switch.isra.0+0x245/0x960
[ 23.394772][ T309] hardirqs last disabled at (41374): [] __schedule+0x94a/0x1b10
[ 23.395419][ T309] softirqs last enabled at (41004): [] handle_softirqs+0x352/0x610
[ 23.396011][ T309] softirqs last disabled at (40919): [] irq_exit_rcu+0xab/0x100
[ 23.396801][ T309] ---[ end trace 0000000000000000 ]---
[ 23.522432][ T311] fbond (unregistering): (slave veth1-bond): Removing an active aggregator
[ 23.523256][ T311] fbond (unregistering): (slave veth1-bond): Releasing backup interface
[ 23.541507][ T311] fbond (unregistering): (slave veth2-bond): Removing an active aggregator
[ 23.542375][ T311] fbond (unregistering): (slave veth2-bond): Releasing backup interface
[ 23.548046][ T311] fbond (unregistering): Released all slaves