[ 12.040411][ T243] eth0: renamed from lag1 [ 12.166538][ T248] eth0: renamed from lag1-end [ 12.451224][ T254] eth1: renamed from lag1 [ 12.562139][ T261] eth1: renamed from lag1-end [ 12.571005][ T261] ip (261) used greatest stack depth: 24304 bytes left [ 12.944539][ T263] br0: port 1(eth0) entered blocking state [ 12.944969][ T263] br0: port 1(eth0) entered disabled state [ 12.945304][ T263] eth0: entered allmulticast mode [ 12.946737][ T263] eth0: entered promiscuous mode [ 13.106682][ T264] br0: port 2(eth1) entered blocking state [ 13.106968][ T264] br0: port 2(eth1) entered disabled state [ 13.107211][ T264] eth1: entered allmulticast mode [ 13.108744][ T264] eth1: entered promiscuous mode [ 14.063671][ T270] bond0: (slave eth0): making interface the new active one [ 14.064375][ T270] bond0: (slave eth0): Enslaving as an active interface with an up link [ 14.065902][ T38] br0: port 1(eth0) entered blocking state [ 14.066248][ T38] br0: port 1(eth0) entered forwarding state [ 14.270245][ T273] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 14.271775][ T39] br0: port 2(eth1) entered blocking state [ 14.272012][ T39] br0: port 2(eth1) entered forwarding state [ 16.000319][ T278] br0: port 1(eth0) entered disabled state [ 16.099723][ T11] bond0: (slave eth0): link status definitely down, disabling slave [ 16.100474][ T11] bond0: (slave eth1): making interface the new active one [ 18.260994][ T128] br0: port 1(eth0) entered blocking state [ 18.261599][ T128] br0: port 1(eth0) entered forwarding state [ 18.290716][ T11] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 18.463702][ T282] br0: port 2(eth1) entered disabled state [ 18.498839][ T11] bond0: (slave eth1): link status definitely down, disabling slave [ 18.499151][ T11] bond0: (slave eth0): making interface the new active one [ 20.156776][ T286] bond0 (unregistering): (slave eth0): Releasing backup interface [ 20.170113][ T286] bond0 (unregistering): (slave eth1): Releasing backup interface [ 20.194762][ T286] bond0 (unregistering): Released all slaves [ 20.205983][ T153] br0: port 1(eth0) entered disabled state [ 21.308228][ T293] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 21.308995][ T153] br0: port 1(eth0) entered blocking state [ 21.309279][ T153] br0: port 1(eth0) entered forwarding state [ 21.493173][ T294] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 21.494732][ T37] br0: port 2(eth1) entered blocking state [ 21.495101][ T37] br0: port 2(eth1) entered forwarding state [ 21.663044][ T11] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 21.663610][ T11] bond0: (slave eth0): making interface the new active one [ 21.664843][ T11] bond0: active interface up! [ 21.770626][ T11] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 23.268489][ T299] br0: port 1(eth0) entered disabled state [ 23.330877][ T11] bond0: (slave eth0): link status definitely down, disabling slave [ 23.331293][ T11] bond0: (slave eth1): making interface the new active one [ 25.555250][ T55] br0: port 1(eth0) entered blocking state [ 25.555720][ T55] br0: port 1(eth0) entered forwarding state [ 25.618510][ T11] bond0: (slave eth0): link status up, enabling it in 200 ms [ 25.619164][ T11] bond0: (slave eth0): invalid new link 3 on slave [ 25.716649][ T302] br0: port 2(eth1) entered disabled state [ 25.723817][ T11] bond0: (slave eth1): link status definitely down, disabling slave [ 25.724141][ T11] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 27.397126][ T306] bond0 (unregistering): (slave eth0): Releasing backup interface [ 27.415843][ T306] bond0 (unregistering): (slave eth1): Releasing backup interface [ 27.439673][ T306] bond0 (unregistering): Released all slaves [ 27.449033][ T37] br0: port 1(eth0) entered disabled state [ 28.541812][ T313] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 28.542431][ T55] br0: port 1(eth0) entered blocking state [ 28.542669][ T55] br0: port 1(eth0) entered forwarding state [ 28.752169][ T314] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 28.753717][ T37] br0: port 2(eth1) entered blocking state [ 28.754104][ T37] br0: port 2(eth1) entered forwarding state [ 28.926926][ T11] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 28.927364][ T11] bond0: (slave eth0): making interface the new active one [ 28.928351][ T11] bond0: active interface up! [ 29.346769][ T11] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 30.512267][ T319] br0: port 1(eth0) entered disabled state [ 30.594837][ T11] bond0: (slave eth0): link status definitely down, disabling slave [ 30.595185][ T11] bond0: (slave eth1): making interface the new active one [ 32.755284][ T39] br0: port 1(eth0) entered blocking state [ 32.755612][ T39] br0: port 1(eth0) entered forwarding state [ 32.778405][ T11] bond0: (slave eth0): link status up, enabling it in 500 ms [ 32.779011][ T11] bond0: (slave eth0): invalid new link 3 on slave [ 32.919430][ T322] br0: port 2(eth1) entered disabled state [ 32.987210][ T11] bond0: (slave eth1): link status definitely down, disabling slave [ 32.988197][ T11] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 34.656952][ T326] bond0 (unregistering): (slave eth0): Releasing backup interface [ 34.675420][ T326] bond0 (unregistering): (slave eth1): Releasing backup interface [ 34.699344][ T326] bond0 (unregistering): Released all slaves [ 34.708781][ T37] br0: port 1(eth0) entered disabled state [ 35.787747][ T333] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 35.788347][ T39] br0: port 1(eth0) entered blocking state [ 35.788571][ T39] br0: port 1(eth0) entered forwarding state [ 35.957793][ T335] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 35.958878][ T55] br0: port 2(eth1) entered blocking state [ 35.959127][ T55] br0: port 2(eth1) entered forwarding state [ 36.140946][ T11] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 36.141274][ T11] bond0: (slave eth0): making interface the new active one [ 36.142199][ T11] bond0: active interface up! [ 37.082725][ T11] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 37.708244][ T340] br0: port 1(eth0) entered disabled state [ 37.810892][ T11] bond0: (slave eth0): link status definitely down, disabling slave [ 37.811231][ T11] bond0: (slave eth1): making interface the new active one [ 39.923004][ T37] br0: port 1(eth0) entered blocking state [ 39.923258][ T37] br0: port 1(eth0) entered forwarding state [ 39.994995][ T11] bond0: (slave eth0): link status up, enabling it in 1000 ms [ 39.995395][ T11] bond0: (slave eth0): invalid new link 3 on slave [ 40.090108][ T343] br0: port 2(eth1) entered disabled state [ 40.098754][ T11] bond0: (slave eth1): link status definitely down, disabling slave [ 40.099036][ T11] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 41.850956][ T347] bond0 (unregistering): (slave eth0): Releasing backup interface [ 41.875672][ T347] bond0 (unregistering): (slave eth1): Releasing backup interface [ 41.906113][ T347] bond0 (unregistering): Released all slaves [ 41.915469][ T334] br0: port 1(eth0) entered disabled state [ 42.970963][ T354] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 42.971643][ T55] br0: port 1(eth0) entered blocking state [ 42.971887][ T55] br0: port 1(eth0) entered forwarding state [ 43.139059][ T355] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 43.140396][ T334] br0: port 2(eth1) entered blocking state [ 43.140669][ T334] br0: port 2(eth1) entered forwarding state [ 43.294071][ T11] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 43.294639][ T11] bond0: (slave eth0): making interface the new active one [ 43.295789][ T11] bond0: active interface up! [ 44.832812][ T360] br0: port 1(eth0) entered disabled state [ 44.841532][ T360] ip (360) used greatest stack depth: 24272 bytes left [ 44.859761][ T272] bond0: (slave eth0): link status definitely down, disabling slave [ 44.860029][ T272] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 47.035818][ T334] br0: port 1(eth0) entered blocking state [ 47.036108][ T334] br0: port 1(eth0) entered forwarding state [ 47.043367][ T272] bond0: (slave eth0): link status up, enabling it in 2000 ms [ 47.043776][ T272] bond0: (slave eth0): invalid new link 3 on slave [ 47.179562][ T363] br0: port 2(eth1) entered disabled state [ 47.250868][ T272] bond0: (slave eth1): link status definitely down, disabling slave [ 47.251186][ T272] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 48.845992][ T367] bond0 (unregistering): (slave eth0): Releasing backup interface [ 48.864656][ T367] bond0 (unregistering): (slave eth1): Releasing backup interface [ 48.884266][ T367] bond0 (unregistering): Released all slaves [ 48.899831][ T37] br0: port 1(eth0) entered disabled state [ 49.916185][ T374] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 49.924760][ T153] br0: port 1(eth0) entered blocking state [ 49.924999][ T153] br0: port 1(eth0) entered forwarding state [ 50.081405][ T375] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 50.083017][ T37] br0: port 2(eth1) entered blocking state [ 50.083436][ T37] br0: port 2(eth1) entered forwarding state [ 50.252819][ T272] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 50.253154][ T272] bond0: (slave eth0): making interface the new active one [ 50.253949][ T272] bond0: active interface up! [ 51.797922][ T380] br0: port 1(eth0) entered disabled state [ 51.811763][ T11] bond0: (slave eth0): link status definitely down, disabling slave [ 51.812077][ T11] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 54.020980][ T334] br0: port 1(eth0) entered blocking state [ 54.021243][ T334] br0: port 1(eth0) entered forwarding state [ 54.098401][ T272] bond0: (slave eth0): link status up, enabling it in 5000 ms [ 54.098951][ T272] bond0: (slave eth0): invalid new link 3 on slave [ 54.183604][ T383] br0: port 2(eth1) entered disabled state [ 54.203781][ T272] bond0: (slave eth1): link status definitely down, disabling slave [ 54.204077][ T272] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 55.904290][ T387] bond0 (unregistering): (slave eth0): Releasing backup interface [ 55.918283][ T387] bond0 (unregistering): (slave eth1): Releasing backup interface [ 55.938301][ T387] bond0 (unregistering): Released all slaves [ 55.955479][ T153] br0: port 1(eth0) entered disabled state [ 57.037565][ T394] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 57.038164][ T153] br0: port 1(eth0) entered blocking state [ 57.038490][ T153] br0: port 1(eth0) entered forwarding state [ 57.199741][ T395] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 57.200836][ T334] br0: port 2(eth1) entered blocking state [ 57.201082][ T334] br0: port 2(eth1) entered forwarding state [ 57.349987][ T272] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 57.350391][ T272] bond0: (slave eth0): making interface the new active one [ 57.351288][ T272] bond0: active interface up! [ 58.867277][ T400] br0: port 1(eth0) entered disabled state [ 58.915750][ T272] bond0: (slave eth0): link status definitely down, disabling slave [ 58.916009][ T272] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 61.080913][ T334] br0: port 1(eth0) entered blocking state [ 61.081175][ T334] br0: port 1(eth0) entered forwarding state [ 61.098373][ T272] bond0: (slave eth0): link status up, enabling it in 10000 ms [ 61.098746][ T272] bond0: (slave eth0): invalid new link 3 on slave [ 61.279555][ T403] br0: port 2(eth1) entered disabled state [ 61.306752][ T272] bond0: (slave eth1): link status definitely down, disabling slave [ 61.307015][ T272] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 62.827441][ T407] bond0 (unregistering): (slave eth0): Releasing backup interface [ 62.843922][ T407] bond0 (unregistering): (slave eth1): Releasing backup interface [ 62.852311][ T407] bond0 (unregistering): Released all slaves [ 62.871751][ T153] br0: port 1(eth0) entered disabled state [ 63.334198][ T272] eth1: left allmulticast mode [ 63.334586][ T272] eth1: left promiscuous mode [ 63.335004][ T272] br0: port 2(eth1) entered disabled state [ 63.339313][ T272] eth0: left allmulticast mode [ 63.339589][ T272] eth0: left promiscuous mode [ 63.339929][ T272] br0: port 1(eth0) entered disabled state [ 63.613895][ T272] ================================================================== [ 63.614357][ T272] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 63.614623][ T272] Read of size 8 at addr ffff8880099f00f8 by task kworker/u16:2/272 [ 63.614892][ T272] [ 63.614989][ T272] CPU: 2 UID: 0 PID: 272 Comm: kworker/u16:2 Not tainted 6.12.0-virtme #1 [ 63.615323][ T272] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 63.615674][ T272] Workqueue: netns cleanup_net [ 63.615970][ T272] Call Trace: [ 63.616145][ T272] [ 63.616280][ T272] dump_stack_lvl+0x82/0xd0 [ 63.616576][ T272] print_address_description.constprop.0+0x2c/0x3b0 [ 63.616928][ T272] ? cleanup_net+0x932/0xa40 [ 63.617192][ T272] print_report+0xb4/0x270 [ 63.617488][ T272] ? kasan_addr_to_slab+0x25/0x80 [ 63.617738][ T272] kasan_report+0xbd/0xf0 [ 63.617928][ T272] ? cleanup_net+0x932/0xa40 [ 63.618199][ T272] cleanup_net+0x932/0xa40 [ 63.618467][ T272] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 63.618723][ T272] ? __pfx_cleanup_net+0x10/0x10 [ 63.618982][ T272] ? trace_lock_acquire+0x148/0x1f0 [ 63.619187][ T272] ? lock_acquire+0x32/0xc0 [ 63.619394][ T272] ? process_one_work+0xe0b/0x16d0 [ 63.619586][ T272] process_one_work+0xe55/0x16d0 [ 63.619808][ T272] ? __pfx___lock_release+0x10/0x10 [ 63.620021][ T272] ? __pfx_process_one_work+0x10/0x10 [ 63.620228][ T272] ? assign_work+0x16c/0x240 [ 63.620443][ T272] worker_thread+0x58c/0xce0 [ 63.620657][ T272] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 63.620928][ T272] ? __pfx_worker_thread+0x10/0x10 [ 63.621134][ T272] ? __pfx_worker_thread+0x10/0x10 [ 63.621340][ T272] kthread+0x28a/0x350 [ 63.621496][ T272] ? __pfx_kthread+0x10/0x10 [ 63.621708][ T272] ret_from_fork+0x31/0x70 [ 63.621917][ T272] ? __pfx_kthread+0x10/0x10 [ 63.622126][ T272] ret_from_fork_asm+0x1a/0x30 [ 63.622343][ T272] [ 63.622503][ T272] [ 63.622612][ T272] Allocated by task 240: [ 63.622767][ T272] kasan_save_stack+0x24/0x50 [ 63.622972][ T272] kasan_save_track+0x14/0x30 [ 63.623179][ T272] __kasan_slab_alloc+0x59/0x70 [ 63.623399][ T272] kmem_cache_alloc_noprof+0x10b/0x350 [ 63.623617][ T272] copy_net_ns+0xc6/0x340 [ 63.623775][ T272] create_new_namespaces+0x35f/0x920 [ 63.623982][ T272] unshare_nsproxy_namespaces+0x8d/0x130 [ 63.624184][ T272] ksys_unshare+0x2a9/0x660 [ 63.624391][ T272] __x64_sys_unshare+0x31/0x40 [ 63.624601][ T272] do_syscall_64+0xc1/0x1d0 [ 63.624844][ T272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.625143][ T272] [ 63.625269][ T272] Freed by task 272: [ 63.625451][ T272] kasan_save_stack+0x24/0x50 [ 63.625699][ T272] kasan_save_track+0x14/0x30 [ 63.625953][ T272] kasan_save_free_info+0x3b/0x60 [ 63.626220][ T272] __kasan_slab_free+0x38/0x50 [ 63.626442][ T272] kmem_cache_free+0xf8/0x330 [ 63.626666][ T272] cleanup_net+0x5a8/0xa40 [ 63.626883][ T272] process_one_work+0xe55/0x16d0 [ 63.627095][ T272] worker_thread+0x58c/0xce0 [ 63.627312][ T272] kthread+0x28a/0x350 [ 63.627469][ T272] ret_from_fork+0x31/0x70 [ 63.627686][ T272] ret_from_fork_asm+0x1a/0x30 [ 63.627902][ T272] [ 63.628014][ T272] Last potentially related work creation: [ 63.628229][ T272] kasan_save_stack+0x24/0x50 [ 63.628450][ T272] __kasan_record_aux_stack+0x8e/0xa0 [ 63.628678][ T272] insert_work+0x34/0x230 [ 63.628842][ T272] __queue_work+0x5fd/0xa40 [ 63.629057][ T272] queue_delayed_work_on+0x8c/0xa0 [ 63.629272][ T272] __inet_insert_ifa+0x751/0xb10 [ 63.629496][ T272] inet_rtm_newaddr+0x833/0xbd0 [ 63.629729][ T272] rtnetlink_rcv_msg+0x712/0xc10 [ 63.629949][ T272] netlink_rcv_skb+0x130/0x360 [ 63.630168][ T272] netlink_unicast+0x44b/0x710 [ 63.630420][ T272] netlink_sendmsg+0x723/0xbe0 [ 63.630694][ T272] ____sys_sendmsg+0x7ac/0xa10 [ 63.630952][ T272] ___sys_sendmsg+0xee/0x170 [ 63.631241][ T272] __sys_sendmsg+0x109/0x1a0 [ 63.631524][ T272] do_syscall_64+0xc1/0x1d0 [ 63.631830][ T272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.632171][ T272] [ 63.632312][ T272] The buggy address belongs to the object at ffff8880099f0040 [ 63.632312][ T272] which belongs to the cache net_namespace of size 5696 [ 63.633076][ T272] The buggy address is located 184 bytes inside of [ 63.633076][ T272] freed 5696-byte region [ffff8880099f0040, ffff8880099f1680) [ 63.633583][ T272] [ 63.633687][ T272] The buggy address belongs to the physical page: [ 63.633948][ T272] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880099f2fc0 pfn:0x99f0 [ 63.634358][ T272] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 63.634689][ T272] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 63.634968][ T272] page_type: f5(slab) [ 63.635132][ T272] raw: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 63.635525][ T272] raw: ffff8880099f2fc0 0000000000050002 00000001f5000000 0000000000000000 [ 63.635935][ T272] head: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 63.636334][ T272] head: ffff8880099f2fc0 0000000000050002 00000001f5000000 0000000000000000 [ 63.636704][ T272] head: 0080000000000003 ffffea0000267c01 ffffffffffffffff 0000000000000000 [ 63.637156][ T272] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 63.637599][ T272] page dumped because: kasan: bad access detected [ 63.637867][ T272] [ 63.637981][ T272] Memory state around the buggy address: [ 63.638199][ T272] ffff8880099eff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.638529][ T272] ffff8880099f0000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 63.638845][ T272] >ffff8880099f0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.639154][ T272] ^ [ 63.639495][ T272] ffff8880099f0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.639827][ T272] ffff8880099f0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.640185][ T272] ================================================================== [ 63.640777][ T272] Disabling lock debugging due to kernel taint