[   17.593471][  T273] ip (273) used greatest stack depth: 23888 bytes left
[   24.044838][  T329] gre: GRE over IPv4 demultiplexer driver
[   24.063593][  T329] ip_gre: GRE over IPv4 tunneling driver
[   26.693544][  T352] 8021q: 802.1Q VLAN Support v1.8
[   31.266181][  T390] GACT probability NOT on
[ 1743.064065][T17289] ==================================================================
[ 1743.064546][T17289] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 1743.064967][T17289] Read of size 1 at addr ffff88800879c6ac by task ip/17289
[ 1743.065369][T17289] 
[ 1743.065512][T17289] CPU: 0 UID: 0 PID: 17289 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full) 
[ 1743.065522][T17289] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1743.065526][T17289] Call Trace:
[ 1743.065529][T17289]  <TASK>
[ 1743.065532][T17289]  dump_stack_lvl+0x82/0xc0
[ 1743.065541][T17289]  print_address_description.constprop.0+0x2c/0x3a0
[ 1743.065557][T17289]  ? kobject_put+0xbb/0xd0
[ 1743.065564][T17289]  print_report+0xb4/0x270
[ 1743.065569][T17289]  ? kobject_put+0xbb/0xd0
[ 1743.065574][T17289]  ? kasan_addr_to_slab+0x21/0x70
[ 1743.065580][T17289]  ? kobject_put+0xbb/0xd0
[ 1743.065585][T17289]  kasan_report+0xca/0x100
[ 1743.065592][T17289]  ? kobject_put+0xbb/0xd0
[ 1743.065602][T17289]  kobject_put+0xbb/0xd0
[ 1743.065607][T17289]  netdev_run_todo+0x5f0/0xc60
[ 1743.065615][T17289]  ? dev_ingress_queue_create+0x190/0x190
[ 1743.065621][T17289]  ? generic_xdp_install+0x410/0x410
[ 1743.065627][T17289]  ? vrf_dellink+0xff/0x150 [vrf]
[ 1743.065638][T17289]  ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 1743.065646][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.065665][T17289]  rtnl_dellink+0x350/0xa30
[ 1743.065673][T17289]  ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 1743.065713][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.065721][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.065732][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.065739][T17289]  ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 1743.065743][T17289]  ? __lock_release+0x5d/0x170
[ 1743.065751][T17289]  ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 1743.065757][T17289]  rtnetlink_rcv_msg+0x709/0xc00
[ 1743.065765][T17289]  ? rtnl_port_fill+0x850/0x850
[ 1743.065770][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.065782][T17289]  netlink_rcv_skb+0x121/0x340
[ 1743.065788][T17289]  ? rtnl_port_fill+0x850/0x850
[ 1743.065793][T17289]  ? netlink_ack+0xdd0/0xdd0
[ 1743.065807][T17289]  ? netlink_deliver_tap+0x13e/0x340
[ 1743.065812][T17289]  ? netlink_deliver_tap+0xc3/0x340
[ 1743.065819][T17289]  netlink_unicast+0x4aa/0x780
[ 1743.065827][T17289]  ? netlink_attachskb+0x810/0x810
[ 1743.065833][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.065843][T17289]  netlink_sendmsg+0x714/0xbd0
[ 1743.065851][T17289]  ? netlink_unicast+0x780/0x780
[ 1743.065857][T17289]  ? __import_iovec+0x230/0x3b0
[ 1743.065868][T17289]  ? netlink_unicast+0x780/0x780
[ 1743.065874][T17289]  ____sys_sendmsg+0x3dd/0x890
[ 1743.065883][T17289]  ? get_timestamp.constprop.0+0x380/0x380
[ 1743.065888][T17289]  ? __copy_msghdr+0x3c0/0x3c0
[ 1743.065901][T17289]  ___sys_sendmsg+0xed/0x170
[ 1743.065906][T17289]  ? kasan_record_aux_stack+0x8c/0xa0
[ 1743.065911][T17289]  ? __call_rcu_common.constprop.0+0xa8/0x630
[ 1743.065925][T17289]  ? copy_msghdr_from_user+0x110/0x110
[ 1743.065935][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.065943][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.065953][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.065960][T17289]  ? __virt_addr_valid+0x22a/0x450
[ 1743.065974][T17289]  ? __lock_release+0x5d/0x170
[ 1743.065984][T17289]  __sys_sendmsg+0x10b/0x1a0
[ 1743.065989][T17289]  ? __call_rcu_common.constprop.0+0x318/0x630
[ 1743.065995][T17289]  ? __sys_sendmsg_sock+0x20/0x20
[ 1743.066009][T17289]  ? rcu_is_watching+0x12/0xb0
[ 1743.066017][T17289]  do_syscall_64+0xc1/0xfd0
[ 1743.066024][T17289]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1743.066035][T17289] RIP: 0033:0x7fa97cd9a1d7
[ 1743.066041][T17289] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 1743.066046][T17289] RSP: 002b:00007fffb00e36d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1743.066053][T17289] RAX: ffffffffffffffda RBX: 00007fffb00e3e00 RCX: 00007fa97cd9a1d7
[ 1743.066056][T17289] RDX: 0000000000000000 RSI: 00007fffb00e3740 RDI: 0000000000000005
[ 1743.066060][T17289] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 1743.066062][T17289] R10: 00007fa97cc96f60 R11: 0000000000000246 R12: 0000000000000002
[ 1743.066064][T17289] R13: 00000000690df92a R14: 0000000000499600 R15: 0000000000000000
[ 1743.066077][T17289]  </TASK>
[ 1743.066079][T17289] 
[ 1743.087244][T17289] Allocated by task 413:
[ 1743.087460][T17289]  kasan_save_stack+0x24/0x40
[ 1743.087750][T17289]  kasan_save_track+0x14/0x30
[ 1743.088031][T17289]  __kasan_kmalloc+0x7b/0x90
[ 1743.088314][T17289]  __kvmalloc_node_noprof+0x2e5/0x8e0
[ 1743.088616][T17289]  alloc_netdev_mqs+0x7d/0x1370
[ 1743.088900][T17289]  rtnl_create_link+0xa9e/0xe20
[ 1743.089181][T17289]  rtnl_newlink_create+0x203/0x770
[ 1743.089464][T17289]  __rtnl_newlink+0x231/0xa30
[ 1743.089741][T17289]  rtnl_newlink+0x693/0xa60
[ 1743.090023][T17289]  rtnetlink_rcv_msg+0x709/0xc00
[ 1743.090203][T17289]  netlink_rcv_skb+0x121/0x340
[ 1743.090471][T17289]  netlink_unicast+0x4aa/0x780
[ 1743.090641][T17289]  netlink_sendmsg+0x714/0xbd0
[ 1743.090805][T17289]  ____sys_sendmsg+0x3dd/0x890
[ 1743.090983][T17289]  ___sys_sendmsg+0xed/0x170
[ 1743.091269][T17289]  __sys_sendmsg+0x10b/0x1a0
[ 1743.091452][T17289]  do_syscall_64+0xc1/0xfd0
[ 1743.091617][T17289]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1743.091821][T17289] 
[ 1743.091914][T17289] Freed by task 17289:
[ 1743.092138][T17289]  kasan_save_stack+0x24/0x40
[ 1743.092309][T17289]  kasan_save_track+0x14/0x30
[ 1743.092475][T17289]  __kasan_save_free_info+0x3b/0x60
[ 1743.092638][T17289]  __kasan_slab_free+0x3f/0x60
[ 1743.092913][T17289]  kfree+0x21d/0x540
[ 1743.093038][T17289]  device_release+0x9c/0x210
[ 1743.093207][T17289]  kobject_cleanup+0xfe/0x360
[ 1743.093379][T17289]  netdev_run_todo+0x81f/0xc60
[ 1743.093650][T17289]  rtnl_dellink+0x350/0xa30
[ 1743.093814][T17289]  rtnetlink_rcv_msg+0x709/0xc00
[ 1743.094065][T17289]  netlink_rcv_skb+0x121/0x340
[ 1743.094268][T17289]  netlink_unicast+0x4aa/0x780
[ 1743.094536][T17289]  netlink_sendmsg+0x714/0xbd0
[ 1743.094700][T17289]  ____sys_sendmsg+0x3dd/0x890
[ 1743.094871][T17289]  ___sys_sendmsg+0xed/0x170
[ 1743.095040][T17289]  __sys_sendmsg+0x10b/0x1a0
[ 1743.095312][T17289]  do_syscall_64+0xc1/0xfd0
[ 1743.095482][T17289]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1743.095686][T17289] 
[ 1743.095773][T17289] The buggy address belongs to the object at ffff88800879c000
[ 1743.095773][T17289]  which belongs to the cache kmalloc-4k of size 4096
[ 1743.096276][T17289] The buggy address is located 1708 bytes inside of
[ 1743.096276][T17289]  freed 4096-byte region [ffff88800879c000, ffff88800879d000)
[ 1743.096783][T17289] 
[ 1743.096874][T17289] The buggy address belongs to the physical page:
[ 1743.097079][T17289] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8798
[ 1743.097374][T17289] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1743.097732][T17289] flags: 0x80000000000040(head|node=0|zone=1)
[ 1743.098018][T17289] page_type: f5(slab)
[ 1743.098239][T17289] raw: 0080000000000040 ffff888001043700 ffffea0000218410 ffffea000026ea10
[ 1743.098955][T17289] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 1743.099303][T17289] head: 0080000000000040 ffff888001043700 ffffea0000218410 ffffea000026ea10
[ 1743.099698][T17289] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 1743.100008][T17289] head: 0080000000000003 ffffea000021e601 00000000ffffffff 00000000ffffffff
[ 1743.100303][T17289] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 1743.100696][T17289] page dumped because: kasan: bad access detected
[ 1743.100913][T17289] 
[ 1743.100998][T17289] Memory state around the buggy address:
[ 1743.101284][T17289]  ffff88800879c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1743.101532][T17289]  ffff88800879c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1743.101768][T17289] >ffff88800879c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1743.102109][T17289]                                   ^
[ 1743.102270][T17289]  ffff88800879c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1743.102518][T17289]  ffff88800879c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1743.102845][T17289] ==================================================================
[ 1743.103211][T17289] Disabling lock debugging due to kernel taint
[ 1743.103426][T17289] ------------[ cut here ]------------
[ 1743.103669][T17289] refcount_t: underflow; use-after-free.
[ 1743.103862][T17289] WARNING: CPU: 0 PID: 17289 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 1743.104153][T17289] Modules linked in: act_gact cls_flower sch_ingress 8021q ip_gre gre vrf veth
[ 1743.104566][T17289] CPU: 0 UID: 0 PID: 17289 Comm: ip Tainted: G    B               6.18.0-rc4-virtme #1 PREEMPT(full) 
[ 1743.104905][T17289] Tainted: [B]=BAD_PAGE
[ 1743.105037][T17289] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1743.105341][T17289] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 1743.105560][T17289] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d a5 a5 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 1743.106136][T17289] RSP: 0018:ffffc9000cb871f0 EFLAGS: 00010286
[ 1743.106351][T17289] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 1743.106625][T17289] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 1743.106875][T17289] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff4c7e134
[ 1743.107128][T17289] R10: 0000000000000003 R11: ffffc9000cb86d80 R12: 0000000000000001
[ 1743.107382][T17289] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 1743.107646][T17289] FS:  00007fa97cbcc800(0000) GS:ffff88808e9f2000(0000) knlGS:0000000000000000
[ 1743.108038][T17289] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1743.108247][T17289] CR2: 00000000004e7458 CR3: 0000000010b08006 CR4: 0000000000772ef0
[ 1743.108510][T17289] PKRU: 55555554
[ 1743.108645][T17289] Call Trace:
[ 1743.108876][T17289]  <TASK>
[ 1743.108963][T17289]  netdev_run_todo+0x5f0/0xc60
[ 1743.109128][T17289]  ? dev_ingress_queue_create+0x190/0x190
[ 1743.109293][T17289]  ? generic_xdp_install+0x410/0x410
[ 1743.109567][T17289]  ? vrf_dellink+0xff/0x150 [vrf]
[ 1743.109755][T17289]  ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 1743.109974][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.110142][T17289]  rtnl_dellink+0x350/0xa30
[ 1743.110414][T17289]  ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 1743.110652][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.110818][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.110995][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.111265][T17289]  ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 1743.111441][T17289]  ? __lock_release+0x5d/0x170
[ 1743.111623][T17289]  ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 1743.111826][T17289]  rtnetlink_rcv_msg+0x709/0xc00
[ 1743.112089][T17289]  ? rtnl_port_fill+0x850/0x850
[ 1743.112247][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.112429][T17289]  netlink_rcv_skb+0x121/0x340
[ 1743.112598][T17289]  ? rtnl_port_fill+0x850/0x850
[ 1743.112853][T17289]  ? netlink_ack+0xdd0/0xdd0
[ 1743.113030][T17289]  ? netlink_deliver_tap+0x13e/0x340
[ 1743.113192][T17289]  ? netlink_deliver_tap+0xc3/0x340
[ 1743.113352][T17289]  netlink_unicast+0x4aa/0x780
[ 1743.113528][T17289]  ? netlink_attachskb+0x810/0x810
[ 1743.113703][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.113876][T17289]  netlink_sendmsg+0x714/0xbd0
[ 1743.114042][T17289]  ? netlink_unicast+0x780/0x780
[ 1743.114201][T17289]  ? __import_iovec+0x230/0x3b0
[ 1743.114374][T17289]  ? netlink_unicast+0x780/0x780
[ 1743.114544][T17289]  ____sys_sendmsg+0x3dd/0x890
[ 1743.114730][T17289]  ? get_timestamp.constprop.0+0x380/0x380
[ 1743.115037][T17289]  ? __copy_msghdr+0x3c0/0x3c0
[ 1743.115208][T17289]  ___sys_sendmsg+0xed/0x170
[ 1743.115372][T17289]  ? kasan_record_aux_stack+0x8c/0xa0
[ 1743.115658][T17289]  ? __call_rcu_common.constprop.0+0xa8/0x630
[ 1743.115879][T17289]  ? copy_msghdr_from_user+0x110/0x110
[ 1743.116040][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.116202][T17289]  ? __lock_acquire+0x449/0x7e0
[ 1743.116467][T17289]  ? find_held_lock+0x2b/0x80
[ 1743.116642][T17289]  ? __virt_addr_valid+0x22a/0x450
[ 1743.116803][T17289]  ? __lock_release+0x5d/0x170
[ 1743.116979][T17289]  __sys_sendmsg+0x10b/0x1a0
[ 1743.117139][T17289]  ? __call_rcu_common.constprop.0+0x318/0x630
[ 1743.117345][T17289]  ? __sys_sendmsg_sock+0x20/0x20
[ 1743.117519][T17289]  ? rcu_is_watching+0x12/0xb0
[ 1743.117680][T17289]  do_syscall_64+0xc1/0xfd0
[ 1743.117948][T17289]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 1743.118145][T17289] RIP: 0033:0x7fa97cd9a1d7
[ 1743.118320][T17289] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 1743.119005][T17289] RSP: 002b:00007fffb00e36d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1743.119255][T17289] RAX: ffffffffffffffda RBX: 00007fffb00e3e00 RCX: 00007fa97cd9a1d7
[ 1743.119605][T17289] RDX: 0000000000000000 RSI: 00007fffb00e3740 RDI: 0000000000000005
[ 1743.119848][T17289] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 1743.120099][T17289] R10: 00007fa97cc96f60 R11: 0000000000000246 R12: 0000000000000002
[ 1743.120344][T17289] R13: 00000000690df92a R14: 0000000000499600 R15: 0000000000000000
[ 1743.120595][T17289]  </TASK>
[ 1743.120720][T17289] irq event stamp: 49495
[ 1743.120952][T17289] hardirqs last  enabled at (49495): [<ffffffffa5793e8b>] irqentry_exit+0x3b/0x80
[ 1743.121247][T17289] hardirqs last disabled at (49494): [<ffffffffa365b23f>] handle_softirqs+0x47f/0x610
[ 1743.121548][T17289] softirqs last  enabled at (49402): [<ffffffffa365b112>] handle_softirqs+0x352/0x610
[ 1743.121828][T17289] softirqs last disabled at (49395): [<ffffffffa365b97b>] irq_exit_rcu+0xab/0x100
[ 1743.122121][T17289] ---[ end trace 0000000000000000 ]---