[ 11.368333][ T243] ip (243) used greatest stack depth: 23280 bytes left [ 11.486407][ T244] eth0: renamed from lag1 [ 11.649973][ T249] eth0: renamed from lag1-end [ 11.915240][ T258] eth1: renamed from lag1 [ 12.069616][ T261] eth1: renamed from lag1-end [ 12.405608][ T263] br0: port 1(eth0) entered blocking state [ 12.406077][ T263] br0: port 1(eth0) entered disabled state [ 12.406390][ T263] eth0: entered allmulticast mode [ 12.407737][ T263] eth0: entered promiscuous mode [ 12.570688][ T264] br0: port 2(eth1) entered blocking state [ 12.570979][ T264] br0: port 2(eth1) entered disabled state [ 12.571262][ T264] eth1: entered allmulticast mode [ 12.572634][ T264] eth1: entered promiscuous mode [ 13.441005][ T270] bond0: (slave eth0): making interface the new active one [ 13.441636][ T270] bond0: (slave eth0): Enslaving as an active interface with an up link [ 13.443134][ T40] br0: port 1(eth0) entered blocking state [ 13.443519][ T40] br0: port 1(eth0) entered forwarding state [ 13.607612][ T273] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 13.609085][ T45] br0: port 2(eth1) entered blocking state [ 13.609472][ T45] br0: port 2(eth1) entered forwarding state [ 15.315241][ T278] br0: port 1(eth0) entered disabled state [ 15.341982][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 15.342371][ T271] bond0: (slave eth1): making interface the new active one [ 17.537959][ T71] br0: port 1(eth0) entered blocking state [ 17.538223][ T71] br0: port 1(eth0) entered forwarding state [ 17.629510][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 17.697826][ T281] br0: port 2(eth1) entered disabled state [ 17.732656][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 17.733005][ T271] bond0: (slave eth0): making interface the new active one [ 19.400034][ T285] bond0 (unregistering): (slave eth0): Releasing backup interface [ 19.424791][ T285] bond0 (unregistering): (slave eth1): Releasing backup interface [ 19.441361][ T285] bond0 (unregistering): Released all slaves [ 19.450689][ T71] br0: port 1(eth0) entered disabled state [ 20.572064][ T292] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 20.572593][ T45] br0: port 1(eth0) entered blocking state [ 20.572816][ T45] br0: port 1(eth0) entered forwarding state [ 20.729018][ T293] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 20.730172][ T45] br0: port 2(eth1) entered blocking state [ 20.730489][ T45] br0: port 2(eth1) entered forwarding state [ 20.881603][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 20.881937][ T271] bond0: (slave eth0): making interface the new active one [ 20.882750][ T271] bond0: active interface up! [ 21.092513][ T271] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 22.460513][ T298] br0: port 1(eth0) entered disabled state [ 22.548792][ T271] bond0: (slave eth0): link status definitely down, disabling slave [ 22.549196][ T271] bond0: (slave eth1): making interface the new active one [ 24.670091][ T71] br0: port 1(eth0) entered blocking state [ 24.670417][ T71] br0: port 1(eth0) entered forwarding state [ 24.732325][ T271] bond0: (slave eth0): link status up, enabling it in 200 ms [ 24.732713][ T271] bond0: (slave eth0): invalid new link 3 on slave [ 24.821246][ T301] br0: port 2(eth1) entered disabled state [ 24.837898][ T271] bond0: (slave eth1): link status definitely down, disabling slave [ 24.838267][ T271] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 26.519879][ T305] bond0 (unregistering): (slave eth0): Releasing backup interface [ 26.537899][ T305] bond0 (unregistering): (slave eth1): Releasing backup interface [ 26.562318][ T305] bond0 (unregistering): Released all slaves [ 26.571260][ T272] br0: port 1(eth0) entered disabled state [ 27.659600][ T312] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 27.660379][ T45] br0: port 1(eth0) entered blocking state [ 27.660668][ T45] br0: port 1(eth0) entered forwarding state [ 27.849648][ T313] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 27.850755][ T39] br0: port 2(eth1) entered blocking state [ 27.851010][ T39] br0: port 2(eth1) entered forwarding state [ 28.026967][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 28.027533][ T271] bond0: (slave eth0): making interface the new active one [ 28.028713][ T271] bond0: active interface up! [ 28.340518][ T69] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 29.554679][ T318] br0: port 1(eth0) entered disabled state [ 29.588768][ T69] bond0: (slave eth0): link status definitely down, disabling slave [ 29.589224][ T69] bond0: (slave eth1): making interface the new active one [ 31.777857][ T272] br0: port 1(eth0) entered blocking state [ 31.778142][ T272] br0: port 1(eth0) entered forwarding state [ 31.876299][ T69] bond0: (slave eth0): link status up, enabling it in 500 ms [ 31.876716][ T69] bond0: (slave eth0): invalid new link 3 on slave [ 31.943549][ T321] br0: port 2(eth1) entered disabled state [ 31.980667][ T69] bond0: (slave eth1): link status definitely down, disabling slave [ 31.980974][ T69] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 33.707697][ T325] bond0 (unregistering): (slave eth0): Releasing backup interface [ 33.732457][ T325] bond0 (unregistering): (slave eth1): Releasing backup interface [ 33.756819][ T325] bond0 (unregistering): Released all slaves [ 33.782781][ T37] br0: port 1(eth0) entered disabled state [ 34.886101][ T332] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 34.887091][ T39] br0: port 1(eth0) entered blocking state [ 34.887531][ T39] br0: port 1(eth0) entered forwarding state [ 35.046530][ T333] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 35.047747][ T272] br0: port 2(eth1) entered blocking state [ 35.047967][ T272] br0: port 2(eth1) entered forwarding state [ 35.214859][ T69] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 35.215939][ T69] bond0: (slave eth0): making interface the new active one [ 35.216976][ T69] bond0: active interface up! [ 36.156575][ T69] bond0: (slave eth1): link status definitely up, 10000 Mbps full duplex [ 36.762727][ T338] br0: port 1(eth0) entered disabled state [ 36.782726][ T69] bond0: (slave eth0): link status definitely down, disabling slave [ 36.783153][ T69] bond0: (slave eth1): making interface the new active one [ 38.994364][ T39] br0: port 1(eth0) entered blocking state [ 38.994747][ T39] br0: port 1(eth0) entered forwarding state [ 39.076293][ T69] bond0: (slave eth0): link status up, enabling it in 1000 ms [ 39.076935][ T69] bond0: (slave eth0): invalid new link 3 on slave [ 39.185995][ T341] br0: port 2(eth1) entered disabled state [ 39.284817][ T69] bond0: (slave eth1): link status definitely down, disabling slave [ 39.285404][ T69] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 40.967853][ T345] bond0 (unregistering): (slave eth0): Releasing backup interface [ 40.987064][ T345] bond0 (unregistering): (slave eth1): Releasing backup interface [ 41.006860][ T345] bond0 (unregistering): Released all slaves [ 41.018970][ T272] br0: port 1(eth0) entered disabled state [ 42.192058][ T352] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 42.192749][ T39] br0: port 1(eth0) entered blocking state [ 42.193068][ T39] br0: port 1(eth0) entered forwarding state [ 42.389074][ T353] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 42.390436][ T71] br0: port 2(eth1) entered blocking state [ 42.390701][ T71] br0: port 2(eth1) entered forwarding state [ 42.559818][ T271] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 42.560292][ T271] bond0: (slave eth0): making interface the new active one [ 42.561168][ T271] bond0: active interface up! [ 44.179320][ T358] br0: port 1(eth0) entered disabled state [ 44.228815][ T69] bond0: (slave eth0): link status definitely down, disabling slave [ 44.229187][ T69] bond0: (slave eth1): making interface the new active one 1800 ms earlier [ 46.450714][ T272] br0: port 1(eth0) entered blocking state [ 46.451011][ T272] br0: port 1(eth0) entered forwarding state [ 46.516305][ T69] bond0: (slave eth0): link status up, enabling it in 2000 ms [ 46.516845][ T69] bond0: (slave eth0): invalid new link 3 on slave [ 46.617988][ T361] br0: port 2(eth1) entered disabled state [ 46.620771][ T69] bond0: (slave eth1): link status definitely down, disabling slave [ 46.621186][ T69] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 48.184878][ T365] bond0 (unregistering): (slave eth0): Releasing backup interface [ 48.198898][ T365] bond0 (unregistering): (slave eth1): Releasing backup interface [ 48.219102][ T365] bond0 (unregistering): Released all slaves [ 48.233541][ T272] br0: port 1(eth0) entered disabled state [ 49.460292][ T372] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 49.461535][ T71] br0: port 1(eth0) entered blocking state [ 49.461807][ T71] br0: port 1(eth0) entered forwarding state [ 49.621579][ T373] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 49.622701][ T272] br0: port 2(eth1) entered blocking state [ 49.622965][ T272] br0: port 2(eth1) entered forwarding state [ 49.778683][ T69] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 49.779035][ T69] bond0: (slave eth0): making interface the new active one [ 49.780131][ T69] bond0: active interface up! [ 51.315274][ T378] br0: port 1(eth0) entered disabled state [ 51.340948][ T69] bond0: (slave eth0): link status definitely down, disabling slave [ 51.341232][ T69] bond0: (slave eth1): making interface the new active one 1700 ms earlier [ 53.564387][ T39] br0: port 1(eth0) entered blocking state [ 53.564744][ T39] br0: port 1(eth0) entered forwarding state [ 53.628256][ T69] bond0: (slave eth0): link status up, enabling it in 5000 ms [ 53.628718][ T69] bond0: (slave eth0): invalid new link 3 on slave [ 53.725964][ T381] br0: port 2(eth1) entered disabled state [ 53.732685][ T69] bond0: (slave eth1): link status definitely down, disabling slave [ 53.732974][ T69] bond0: (slave eth0): making interface the new active one 200 ms earlier [ 55.496906][ T385] bond0 (unregistering): (slave eth0): Releasing backup interface [ 55.521730][ T385] bond0 (unregistering): (slave eth1): Releasing backup interface [ 55.542721][ T385] bond0 (unregistering): Released all slaves [ 55.556635][ T39] br0: port 1(eth0) entered disabled state [ 56.647068][ T392] bond0: (slave eth0): Enslaving as a backup interface with an up link [ 56.648961][ T272] br0: port 1(eth0) entered blocking state [ 56.649260][ T272] br0: port 1(eth0) entered forwarding state [ 56.806794][ T393] bond0: (slave eth1): Enslaving as a backup interface with an up link [ 56.807902][ T64] br0: port 2(eth1) entered blocking state [ 56.808234][ T64] br0: port 2(eth1) entered forwarding state [ 57.002676][ T69] bond0: (slave eth0): link status definitely up, 10000 Mbps full duplex [ 57.003012][ T69] bond0: (slave eth0): making interface the new active one [ 57.003795][ T69] bond0: active interface up! [ 58.586194][ T398] br0: port 1(eth0) entered disabled state [ 58.668727][ T69] bond0: (slave eth0): link status definitely down, disabling slave [ 58.669014][ T69] bond0: (slave eth1): making interface the new active one 1900 ms earlier [ 60.841547][ T39] br0: port 1(eth0) entered blocking state [ 60.841824][ T39] br0: port 1(eth0) entered forwarding state [ 60.852250][ T69] bond0: (slave eth0): link status up, enabling it in 10000 ms [ 60.852639][ T69] bond0: (slave eth0): invalid new link 3 on slave [ 61.034275][ T401] br0: port 2(eth1) entered disabled state [ 61.060826][ T69] bond0: (slave eth1): link status definitely down, disabling slave [ 61.061181][ T69] bond0: (slave eth0): making interface the new active one 300 ms earlier [ 62.746114][ T405] bond0 (unregistering): (slave eth0): Releasing backup interface [ 62.764023][ T405] bond0 (unregistering): (slave eth1): Releasing backup interface [ 62.788520][ T405] bond0 (unregistering): Released all slaves [ 62.801608][ T64] br0: port 1(eth0) entered disabled state [ 63.280432][ T69] eth1: left allmulticast mode [ 63.280808][ T69] eth1: left promiscuous mode [ 63.281247][ T69] br0: port 2(eth1) entered disabled state [ 63.284855][ T69] eth0: left allmulticast mode [ 63.285097][ T69] eth0: left promiscuous mode [ 63.285453][ T69] br0: port 1(eth0) entered disabled state [ 63.694130][ T69] ================================================================== [ 63.694502][ T69] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 63.694772][ T69] Read of size 8 at addr ffff8880058c80f8 by task kworker/u16:1/69 [ 63.695033][ T69] [ 63.695118][ T69] CPU: 3 UID: 0 PID: 69 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 63.695372][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 63.695595][ T69] Workqueue: netns cleanup_net [ 63.695786][ T69] Call Trace: [ 63.695933][ T69] [ 63.696018][ T69] dump_stack_lvl+0x82/0xd0 [ 63.696201][ T69] print_address_description.constprop.0+0x2c/0x3b0 [ 63.696424][ T69] ? cleanup_net+0x932/0xa40 [ 63.696609][ T69] print_report+0xb4/0x270 [ 63.696814][ T69] ? kasan_addr_to_slab+0x25/0x80 [ 63.696989][ T69] kasan_report+0xbd/0xf0 [ 63.697133][ T69] ? cleanup_net+0x932/0xa40 [ 63.697305][ T69] cleanup_net+0x932/0xa40 [ 63.697494][ T69] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 63.697675][ T69] ? __pfx_cleanup_net+0x10/0x10 [ 63.697852][ T69] ? trace_lock_acquire+0x148/0x1f0 [ 63.698058][ T69] ? lock_acquire+0x32/0xc0 [ 63.698240][ T69] ? process_one_work+0xe0b/0x16d0 [ 63.698442][ T69] process_one_work+0xe55/0x16d0 [ 63.698626][ T69] ? __pfx___lock_release+0x10/0x10 [ 63.698809][ T69] ? __pfx_process_one_work+0x10/0x10 [ 63.699006][ T69] ? assign_work+0x16c/0x240 [ 63.699186][ T69] worker_thread+0x58c/0xce0 [ 63.699379][ T69] ? __pfx_worker_thread+0x10/0x10 [ 63.699555][ T69] kthread+0x28a/0x350 [ 63.699694][ T69] ? __pfx_kthread+0x10/0x10 [ 63.699885][ T69] ret_from_fork+0x31/0x70 [ 63.700048][ T69] ? __pfx_kthread+0x10/0x10 [ 63.700224][ T69] ret_from_fork_asm+0x1a/0x30 [ 63.700405][ T69] [ 63.700540][ T69] [ 63.700647][ T69] Allocated by task 241: [ 63.700779][ T69] kasan_save_stack+0x24/0x50 [ 63.700955][ T69] kasan_save_track+0x14/0x30 [ 63.701124][ T69] __kasan_slab_alloc+0x59/0x70 [ 63.701303][ T69] kmem_cache_alloc_noprof+0x10b/0x350 [ 63.701477][ T69] copy_net_ns+0xc6/0x340 [ 63.701624][ T69] create_new_namespaces+0x35f/0x920 [ 63.701810][ T69] unshare_nsproxy_namespaces+0x8d/0x130 [ 63.701987][ T69] ksys_unshare+0x2a9/0x660 [ 63.702146][ T69] __x64_sys_unshare+0x31/0x40 [ 63.702352][ T69] do_syscall_64+0xc1/0x1d0 [ 63.702539][ T69] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.702756][ T69] [ 63.702861][ T69] Freed by task 69: [ 63.702992][ T69] kasan_save_stack+0x24/0x50 [ 63.703167][ T69] kasan_save_track+0x14/0x30 [ 63.703355][ T69] kasan_save_free_info+0x3b/0x60 [ 63.703532][ T69] __kasan_slab_free+0x38/0x50 [ 63.703730][ T69] kmem_cache_free+0xf8/0x330 [ 63.703941][ T69] cleanup_net+0x5a8/0xa40 [ 63.704157][ T69] process_one_work+0xe55/0x16d0 [ 63.704354][ T69] worker_thread+0x58c/0xce0 [ 63.704570][ T69] kthread+0x28a/0x350 [ 63.704748][ T69] ret_from_fork+0x31/0x70 [ 63.704942][ T69] ret_from_fork_asm+0x1a/0x30 [ 63.705142][ T69] [ 63.705252][ T69] Last potentially related work creation: [ 63.705458][ T69] kasan_save_stack+0x24/0x50 [ 63.705700][ T69] __kasan_record_aux_stack+0x8e/0xa0 [ 63.705891][ T69] insert_work+0x34/0x230 [ 63.706051][ T69] __queue_work+0x5fd/0xa40 [ 63.706268][ T69] queue_delayed_work_on+0x8c/0xa0 [ 63.706480][ T69] __inet_insert_ifa+0x751/0xb10 [ 63.706704][ T69] inet_rtm_newaddr+0x833/0xbd0 [ 63.706917][ T69] rtnetlink_rcv_msg+0x712/0xc10 [ 63.707125][ T69] netlink_rcv_skb+0x130/0x360 [ 63.707319][ T69] netlink_unicast+0x44b/0x710 [ 63.707529][ T69] netlink_sendmsg+0x723/0xbe0 [ 63.707765][ T69] ____sys_sendmsg+0x7ac/0xa10 [ 63.707992][ T69] ___sys_sendmsg+0xee/0x170 [ 63.708213][ T69] __sys_sendmsg+0x109/0x1a0 [ 63.708422][ T69] do_syscall_64+0xc1/0x1d0 [ 63.708616][ T69] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 63.708892][ T69] [ 63.708995][ T69] The buggy address belongs to the object at ffff8880058c8040 [ 63.708995][ T69] which belongs to the cache net_namespace of size 5696 [ 63.709545][ T69] The buggy address is located 184 bytes inside of [ 63.709545][ T69] freed 5696-byte region [ffff8880058c8040, ffff8880058c9680) [ 63.710118][ T69] [ 63.710206][ T69] The buggy address belongs to the physical page: [ 63.710458][ T69] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880058cafc0 pfn:0x58c8 [ 63.710903][ T69] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 63.711241][ T69] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 63.711470][ T69] page_type: f5(slab) [ 63.711638][ T69] raw: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 63.712009][ T69] raw: ffff8880058cafc0 0000000000050002 00000001f5000000 0000000000000000 [ 63.712377][ T69] head: 0080000000000240 ffff888001965240 ffff88800196a088 ffff88800196a088 [ 63.712782][ T69] head: ffff8880058cafc0 0000000000050002 00000001f5000000 0000000000000000 [ 63.713153][ T69] head: 0080000000000003 ffffea0000163201 ffffffffffffffff 0000000000000000 [ 63.713524][ T69] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 63.713913][ T69] page dumped because: kasan: bad access detected [ 63.714172][ T69] [ 63.714270][ T69] Memory state around the buggy address: [ 63.714447][ T69] ffff8880058c7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 63.714755][ T69] ffff8880058c8000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 63.715062][ T69] >ffff8880058c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.715325][ T69] ^ [ 63.715578][ T69] ffff8880058c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.715852][ T69] ffff8880058c8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.716117][ T69] ================================================================== [ 63.716410][ T69] Disabling lock debugging due to kernel taint