[ 10.521058][ T245] eth0: renamed from lag1 [ 10.634248][ T250] eth0: renamed from lag1-end [ 10.742985][ T251] ip (251) used greatest stack depth: 23664 bytes left [ 10.882621][ T254] eth1: renamed from lag1 [ 10.996198][ T261] eth1: renamed from lag1-end [ 11.347045][ T263] br0: port 1(eth0) entered blocking state [ 11.348268][ T263] br0: port 1(eth0) entered disabled state [ 11.348646][ T263] eth0: entered allmulticast mode [ 11.350003][ T263] eth0: entered promiscuous mode [ 11.493914][ T264] br0: port 2(eth1) entered blocking state [ 11.494250][ T264] br0: port 2(eth1) entered disabled state [ 11.494542][ T264] eth1: entered allmulticast mode [ 11.495757][ T264] eth1: entered promiscuous mode [ 12.258805][ T270] bond0: (slave eth0): making interface the new active one [ 12.259452][ T270] bond0: (slave eth0): Enslaving as an active interface with an up link [ 12.261338][ T40] br0: port 1(eth0) entered blocking state [ 12.261698][ T40] br0: port 1(eth0) entered forwarding state [ 12.415917][ T272] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 12.416973][ T40] br0: port 2(eth1) entered blocking state [ 12.417244][ T40] br0: port 2(eth1) entered forwarding state [ 14.066650][ T278] br0: port 1(eth0) entered disabled state [ 14.133452][ T67] bond0: (slave eth0): link status definitely down, disabling slave [ 14.134013][ T67] bond0: (slave eth1): making interface the new active one [ 16.294210][ T155] br0: port 1(eth0) entered blocking state [ 16.294617][ T155] br0: port 1(eth0) entered forwarding state [ 16.316796][ T67] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 16.459663][ T281] br0: port 2(eth1) entered disabled state [ 16.526079][ T67] bond0: (slave eth1): link status definitely down, disabling slave [ 16.526405][ T67] bond0: (slave eth0): making interface the new active one [ 18.111520][ T285] bond0 (unregistering): (slave eth0): Releasing backup interface [ 18.135195][ T285] bond0 (unregistering): (slave eth1): Releasing backup interface [ 18.153507][ T285] bond0 (unregistering): Released all slaves [ 18.162269][ T37] br0: port 1(eth0) entered disabled state [ 19.104873][ T292] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 19.105566][ T155] br0: port 1(eth0) entered blocking state [ 19.105811][ T155] br0: port 1(eth0) entered forwarding state [ 19.254641][ T293] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 19.255903][ T37] br0: port 2(eth1) entered blocking state [ 19.256154][ T37] br0: port 2(eth1) entered forwarding state [ 19.390857][ T67] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 19.391200][ T67] bond0: (slave eth0): making interface the new active one [ 19.399406][ T67] bond0: active interface up! [ 19.500707][ T271] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 20.891077][ T298] br0: port 1(eth0) entered disabled state [ 20.956919][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 20.957270][ T271] bond0: (slave eth1): making interface the new active one [ 23.101062][ T40] br0: port 1(eth0) entered blocking state [ 23.101368][ T40] br0: port 1(eth0) entered forwarding state [ 23.141478][ T271] bond0: (slave eth0): link status up, enabling it in 200 ms [ 23.141987][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 23.239985][ T301] br0: port 2(eth1) entered disabled state [ 23.244892][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 23.245203][ T271] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 24.875846][ T305] bond0 (unregistering): (slave eth0): Releasing backup interface [ 24.896438][ T305] bond0 (unregistering): (slave eth1): Releasing backup interface [ 24.915283][ T305] bond0 (unregistering): Released all slaves [ 24.923326][ T40] br0: port 1(eth0) entered disabled state [ 25.828696][ T312] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 25.829288][ T40] br0: port 1(eth0) entered blocking state [ 25.829561][ T40] br0: port 1(eth0) entered forwarding state [ 25.972493][ T313] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 25.973896][ T37] br0: port 2(eth1) entered blocking state [ 25.974175][ T37] br0: port 2(eth1) entered forwarding state [ 26.126026][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 26.126389][ T271] bond0: (slave eth0): making interface the new active one [ 26.127149][ T271] bond0: active interface up! [ 26.540840][ T271] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 27.669642][ T318] br0: port 1(eth0) entered disabled state [ 27.685778][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 27.686027][ T271] bond0: (slave eth1): making interface the new active one [ 29.872065][ T40] br0: port 1(eth0) entered blocking state [ 29.872412][ T40] br0: port 1(eth0) entered forwarding state [ 29.972448][ T271] bond0: (slave eth0): link status up, enabling it in 500 ms [ 29.972817][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 30.019916][ T321] br0: port 2(eth1) entered disabled state [ 30.077743][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 30.078073][ T271] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 31.707010][ T325] bond0 (unregistering): (slave eth0): Releasing backup interface [ 31.731628][ T325] bond0 (unregistering): (slave eth1): Releasing backup interface [ 31.745155][ T325] bond0 (unregistering): Released all slaves [ 31.761901][ T37] br0: port 1(eth0) entered disabled state [ 32.747280][ T332] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 32.748020][ T44] br0: port 1(eth0) entered blocking state [ 32.748296][ T44] br0: port 1(eth0) entered forwarding state [ 32.905747][ T333] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 32.906772][ T40] br0: port 2(eth1) entered blocking state [ 32.906999][ T40] br0: port 2(eth1) entered forwarding state [ 33.056838][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 33.057247][ T271] bond0: (slave eth0): making interface the new active one [ 33.058053][ T271] bond0: active interface up! [ 33.996891][ T271] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 34.550404][ T338] br0: port 1(eth0) entered disabled state [ 34.620899][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 34.621240][ T271] bond0: (slave eth1): making interface the new active one [ 36.733443][ T40] br0: port 1(eth0) entered blocking state [ 36.733725][ T40] br0: port 1(eth0) entered forwarding state [ 36.804459][ T271] bond0: (slave eth0): link status up, enabling it in 1000 ms [ 36.804935][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 36.885969][ T341] br0: port 2(eth1) entered disabled state [ 36.909849][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 36.910178][ T271] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 38.488014][ T345] bond0 (unregistering): (slave eth0): Releasing backup interface [ 38.506051][ T345] bond0 (unregistering): (slave eth1): Releasing backup interface [ 38.532488][ T345] bond0 (unregistering): Released all slaves [ 38.540743][ T40] br0: port 1(eth0) entered disabled state [ 39.466008][ T352] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 39.466681][ T155] br0: port 1(eth0) entered blocking state [ 39.466921][ T155] br0: port 1(eth0) entered forwarding state [ 39.609095][ T353] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 39.610242][ T155] br0: port 2(eth1) entered blocking state [ 39.610500][ T155] br0: port 2(eth1) entered forwarding state [ 39.774783][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 39.775115][ T271] bond0: (slave eth0): making interface the new active one [ 39.776018][ T271] bond0: active interface up! [ 41.259045][ T358] br0: port 1(eth0) entered disabled state [ 41.332807][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 41.333168][ T271] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 43.455846][ T155] br0: port 1(eth0) entered blocking state [ 43.456173][ T155] br0: port 1(eth0) entered forwarding state [ 43.517503][ T271] bond0: (slave eth0): link status up, enabling it in 2000 ms [ 43.517974][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 43.627868][ T361] br0: port 2(eth1) entered disabled state [ 43.724923][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 43.725288][ T271] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 45.282996][ T365] bond0 (unregistering): (slave eth0): Releasing backup interface [ 45.300854][ T365] bond0 (unregistering): (slave eth1): Releasing backup interface [ 45.313509][ T365] bond0 (unregistering): Released all slaves [ 45.322598][ T40] br0: port 1(eth0) entered disabled state [ 46.285652][ T372] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 46.286262][ T40] br0: port 1(eth0) entered blocking state [ 46.286549][ T40] br0: port 1(eth0) entered forwarding state [ 46.462323][ T373] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 46.463464][ T37] br0: port 2(eth1) entered blocking state [ 46.463719][ T37] br0: port 2(eth1) entered forwarding state [ 46.628941][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 46.629304][ T271] bond0: (slave eth0): making interface the new active one [ 46.630090][ T271] bond0: active interface up! [ 48.167188][ T378] br0: port 1(eth0) entered disabled state [ 48.188759][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 48.189040][ T271] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 50.399136][ T40] br0: port 1(eth0) entered blocking state [ 50.399481][ T40] br0: port 1(eth0) entered forwarding state [ 50.478437][ T271] bond0: (slave eth0): link status up, enabling it in 5000 ms [ 50.478905][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 50.536257][ T381] br0: port 2(eth1) entered disabled state [ 50.580808][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 50.581105][ T271] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 52.231976][ T385] bond0 (unregistering): (slave eth0): Releasing backup interface [ 52.256729][ T385] bond0 (unregistering): (slave eth1): Releasing backup interface [ 52.280378][ T385] bond0 (unregistering): Released all slaves [ 52.288834][ T155] br0: port 1(eth0) entered disabled state [ 53.177177][ T392] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 53.177855][ T37] br0: port 1(eth0) entered blocking state [ 53.178109][ T37] br0: port 1(eth0) entered forwarding state [ 53.312628][ T393] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 53.313667][ T40] br0: port 2(eth1) entered blocking state [ 53.313959][ T40] br0: port 2(eth1) entered forwarding state [ 53.466004][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 53.466415][ T271] bond0: (slave eth0): making interface the new active one [ 53.467189][ T271] bond0: active interface up! [ 54.974649][ T398] br0: port 1(eth0) entered disabled state [ 55.028743][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 55.029065][ T271] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 57.195080][ T155] br0: port 1(eth0) entered blocking state [ 57.195376][ T155] br0: port 1(eth0) entered forwarding state [ 57.212404][ T271] bond0: (slave eth0): link status up, enabling it in 10000 ms [ 57.212804][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 57.344885][ T401] br0: port 2(eth1) entered disabled state [ 57.420943][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 57.421433][ T271] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 58.875884][ T405] bond0 (unregistering): (slave eth0): Releasing backup interface [ 58.903676][ T405] bond0 (unregistering): (slave eth1): Releasing backup interface [ 58.922922][ T405] bond0 (unregistering): Released all slaves [ 58.936813][ T40] br0: port 1(eth0) entered disabled state [ 59.361697][ T271] eth1: left allmulticast mode [ 59.362017][ T271] eth1: left promiscuous mode [ 59.362429][ T271] br0: port 2(eth1) entered disabled state [ 59.363956][ T271] eth0: left allmulticast mode [ 59.364233][ T271] eth0: left promiscuous mode [ 59.364733][ T271] br0: port 1(eth0) entered disabled state [ 59.855765][ T271] ================================================================== [ 59.856056][ T271] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 59.856278][ T271] Read of size 8 at addr ffff88800b8500f8 by task kworker/u16:2/271 [ 59.856497][ T271] [ 59.856576][ T271] CPU: 0 UID: 0 PID: 271 Comm: kworker/u16:2 Not tainted 6.12.0-virtme #1 [ 59.856799][ T271] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 59.856988][ T271] Workqueue: netns cleanup_net [ 59.857142][ T271] Call Trace: [ 59.857255][ T271] [ 59.857332][ T271] dump_stack_lvl+0x82/0xd0 [ 59.857481][ T271] print_address_description.constprop.0+0x2c/0x3b0 [ 59.857668][ T271] ? cleanup_net+0x932/0xa40 [ 59.857822][ T271] print_report+0xb4/0x270 [ 59.857966][ T271] ? kasan_addr_to_slab+0x25/0x80 [ 59.858105][ T271] kasan_report+0xbd/0xf0 [ 59.858223][ T271] ? cleanup_net+0x932/0xa40 [ 59.858372][ T271] cleanup_net+0x932/0xa40 [ 59.858525][ T271] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 59.858672][ T271] ? __pfx_cleanup_net+0x10/0x10 [ 59.858818][ T271] ? trace_lock_acquire+0x148/0x1f0 [ 59.858971][ T271] ? lock_acquire+0x32/0xc0 [ 59.859114][ T271] ? process_one_work+0xe0b/0x16d0 [ 59.859268][ T271] process_one_work+0xe55/0x16d0 [ 59.859415][ T271] ? __pfx___lock_release+0x10/0x10 [ 59.859560][ T271] ? __pfx_process_one_work+0x10/0x10 [ 59.859704][ T271] ? assign_work+0x16c/0x240 [ 59.859854][ T271] worker_thread+0x58c/0xce0 [ 59.860001][ T271] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 59.860181][ T271] ? __pfx_worker_thread+0x10/0x10 [ 59.860333][ T271] ? __pfx_worker_thread+0x10/0x10 [ 59.860485][ T271] kthread+0x28a/0x350 [ 59.860600][ T271] ? __pfx_kthread+0x10/0x10 [ 59.860761][ T271] ret_from_fork+0x31/0x70 [ 59.860916][ T271] ? __pfx_kthread+0x10/0x10 [ 59.861071][ T271] ret_from_fork_asm+0x1a/0x30 [ 59.861220][ T271] [ 59.861342][ T271] [ 59.861441][ T271] Allocated by task 241: [ 59.861554][ T271] kasan_save_stack+0x24/0x50 [ 59.861707][ T271] kasan_save_track+0x14/0x30 [ 59.861861][ T271] __kasan_slab_alloc+0x59/0x70 [ 59.862008][ T271] kmem_cache_alloc_noprof+0x10b/0x350 [ 59.862172][ T271] copy_net_ns+0xc6/0x340 [ 59.862278][ T271] create_new_namespaces+0x35f/0x920 [ 59.862423][ T271] unshare_nsproxy_namespaces+0x8d/0x130 [ 59.862566][ T271] ksys_unshare+0x2a9/0x660 [ 59.862704][ T271] __x64_sys_unshare+0x31/0x40 [ 59.862871][ T271] do_syscall_64+0xc1/0x1d0 [ 59.863018][ T271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.863223][ T271] [ 59.863302][ T271] Freed by task 271: [ 59.863410][ T271] kasan_save_stack+0x24/0x50 [ 59.863563][ T271] kasan_save_track+0x14/0x30 [ 59.863715][ T271] kasan_save_free_info+0x3b/0x60 [ 59.863871][ T271] __kasan_slab_free+0x38/0x50 [ 59.864025][ T271] kmem_cache_free+0xf8/0x330 [ 59.864187][ T271] cleanup_net+0x5a8/0xa40 [ 59.864333][ T271] process_one_work+0xe55/0x16d0 [ 59.864477][ T271] worker_thread+0x58c/0xce0 [ 59.864641][ T271] kthread+0x28a/0x350 [ 59.864752][ T271] ret_from_fork+0x31/0x70 [ 59.864904][ T271] ret_from_fork_asm+0x1a/0x30 [ 59.865057][ T271] [ 59.865130][ T271] Last potentially related work creation: [ 59.865287][ T271] kasan_save_stack+0x24/0x50 [ 59.865458][ T271] __kasan_record_aux_stack+0x8e/0xa0 [ 59.865609][ T271] insert_work+0x34/0x230 [ 59.865725][ T271] __queue_work+0x5fd/0xa40 [ 59.865877][ T271] queue_delayed_work_on+0x8c/0xa0 [ 59.866047][ T271] __inet_insert_ifa+0x751/0xb10 [ 59.866197][ T271] inet_rtm_newaddr+0x833/0xbd0 [ 59.866349][ T271] rtnetlink_rcv_msg+0x712/0xc10 [ 59.866516][ T271] netlink_rcv_skb+0x130/0x360 [ 59.866685][ T271] netlink_unicast+0x44b/0x710 [ 59.866844][ T271] netlink_sendmsg+0x723/0xbe0 [ 59.867011][ T271] ____sys_sendmsg+0x7ac/0xa10 [ 59.867173][ T271] ___sys_sendmsg+0xee/0x170 [ 59.867335][ T271] __sys_sendmsg+0x109/0x1a0 [ 59.867491][ T271] do_syscall_64+0xc1/0x1d0 [ 59.867640][ T271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.867842][ T271] [ 59.867926][ T271] The buggy address belongs to the object at ffff88800b850040 [ 59.867926][ T271] which belongs to the cache net_namespace of size 5696 [ 59.868338][ T271] The buggy address is located 184 bytes inside of [ 59.868338][ T271] freed 5696-byte region [ffff88800b850040, ffff88800b851680) [ 59.868689][ T271] [ 59.868764][ T271] The buggy address belongs to the physical page: [ 59.868955][ T271] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800b852fc0 pfn:0xb850 [ 59.869263][ T271] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 59.869492][ T271] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 59.869676][ T271] page_type: f5(slab) [ 59.869794][ T271] raw: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 59.870063][ T271] raw: ffff88800b852fc0 0000000000050002 00000001f5000000 0000000000000000 [ 59.870339][ T271] head: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 59.870612][ T271] head: ffff88800b852fc0 0000000000050002 00000001f5000000 0000000000000000 [ 59.870873][ T271] head: 0080000000000003 ffffea00002e1401 ffffffffffffffff 0000000000000000 [ 59.871132][ T271] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 59.871391][ T271] page dumped because: kasan: bad access detected [ 59.871565][ T271] [ 59.871635][ T271] Memory state around the buggy address: [ 59.871774][ T271] ffff88800b84ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.871987][ T271] ffff88800b850000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 59.872197][ T271] >ffff88800b850080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.872409][ T271] ^ [ 59.872616][ T271] ffff88800b850100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.872836][ T271] ffff88800b850180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.873056][ T271] ================================================================== [ 59.873289][ T271] Disabling lock debugging due to kernel taint