[ 26.262533][ T325] gre: GRE over IPv4 demultiplexer driver
[ 26.354071][ T325] ip6_gre: GRE over IPv6 tunneling driver
[ 26.608414][ T12] ip6_tunnel: g1 xmit: Local address not yet configured!
[ 26.778599][ T12] ip6_tunnel: g1 xmit: Local address not yet configured!
[ 29.132323][ T346] 8021q: 802.1Q VLAN Support v1.8
[ 34.625986][ T384] GACT probability NOT on
[ 36.633723][ T12] ip6_tunnel: g2 xmit: Local address not yet configured!
[ 36.797377][ T12] ip6_tunnel: g2 xmit: Local address not yet configured!
[ 153.875335][ C0] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1325295311 wd_nsec: 1325295147
[ 246.752181][ T575] ==================================================================
[ 246.752558][ T575] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 246.752864][ T575] Read of size 1 at addr ffff88800cb916ac by task ip/575
[ 246.753124][ T575]
[ 246.753249][ T575] CPU: 1 UID: 0 PID: 575 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 246.753255][ T575] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 246.753257][ T575] Call Trace:
[ 246.753261][ T575]
[ 246.753263][ T575] dump_stack_lvl+0x82/0xc0
[ 246.753271][ T575] print_address_description.constprop.0+0x2c/0x3a0
[ 246.753285][ T575] ? kobject_put+0xbb/0xd0
[ 246.753290][ T575] print_report+0xb4/0x270
[ 246.753294][ T575] ? kobject_put+0xbb/0xd0
[ 246.753299][ T575] ? kasan_addr_to_slab+0x21/0x70
[ 246.753303][ T575] ? kobject_put+0xbb/0xd0
[ 246.753307][ T575] kasan_report+0xca/0x100
[ 246.753316][ T575] ? kobject_put+0xbb/0xd0
[ 246.753324][ T575] kobject_put+0xbb/0xd0
[ 246.753328][ T575] netdev_run_todo+0x5f0/0xc60
[ 246.753337][ T575] ? dev_ingress_queue_create+0x190/0x190
[ 246.753340][ T575] ? generic_xdp_install+0x410/0x410
[ 246.753346][ T575] ? vrf_dellink+0xff/0x150 [vrf]
[ 246.753353][ T575] ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 246.753357][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.753371][ T575] rtnl_dellink+0x350/0xa30
[ 246.753381][ T575] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 246.753408][ T575] ? find_held_lock+0x2b/0x80
[ 246.753413][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.753419][ T575] ? find_held_lock+0x2b/0x80
[ 246.753423][ T575] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 246.753425][ T575] ? __lock_release+0x5d/0x170
[ 246.753430][ T575] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 246.753433][ T575] rtnetlink_rcv_msg+0x709/0xc00
[ 246.753437][ T575] ? rtnl_port_fill+0x850/0x850
[ 246.753440][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.753447][ T575] netlink_rcv_skb+0x121/0x340
[ 246.753452][ T575] ? rtnl_port_fill+0x850/0x850
[ 246.753455][ T575] ? netlink_ack+0xdd0/0xdd0
[ 246.753462][ T575] ? netlink_deliver_tap+0x13e/0x340
[ 246.753465][ T575] ? netlink_deliver_tap+0xc3/0x340
[ 246.753469][ T575] netlink_unicast+0x4aa/0x780
[ 246.753473][ T575] ? netlink_attachskb+0x810/0x810
[ 246.753477][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.753482][ T575] netlink_sendmsg+0x714/0xbd0
[ 246.753487][ T575] ? netlink_unicast+0x780/0x780
[ 246.753490][ T575] ? __import_iovec+0x230/0x3b0
[ 246.753498][ T575] ? netlink_unicast+0x780/0x780
[ 246.753501][ T575] ____sys_sendmsg+0x3dd/0x890
[ 246.753511][ T575] ? get_timestamp.constprop.0+0x380/0x380
[ 246.753514][ T575] ? __copy_msghdr+0x3c0/0x3c0
[ 246.753522][ T575] ___sys_sendmsg+0xed/0x170
[ 246.753525][ T575] ? kasan_record_aux_stack+0x8c/0xa0
[ 246.753529][ T575] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 246.753539][ T575] ? copy_msghdr_from_user+0x110/0x110
[ 246.753545][ T575] ? find_held_lock+0x2b/0x80
[ 246.753549][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.753555][ T575] ? find_held_lock+0x2b/0x80
[ 246.753558][ T575] ? __virt_addr_valid+0x22a/0x450
[ 246.753568][ T575] ? __lock_release+0x5d/0x170
[ 246.753574][ T575] __sys_sendmsg+0x10b/0x1a0
[ 246.753577][ T575] ? __call_rcu_common.constprop.0+0x318/0x630
[ 246.753581][ T575] ? __sys_sendmsg_sock+0x20/0x20
[ 246.753589][ T575] ? rcu_is_watching+0x12/0xb0
[ 246.753593][ T575] do_syscall_64+0xc1/0xfd0
[ 246.753600][ T575] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 246.753607][ T575] RIP: 0033:0x7fabc95631d7
[ 246.753612][ T575] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 246.753615][ T575] RSP: 002b:00007ffd886f1b48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 246.753619][ T575] RAX: ffffffffffffffda RBX: 00007ffd886f2270 RCX: 00007fabc95631d7
[ 246.753621][ T575] RDX: 0000000000000000 RSI: 00007ffd886f1bb0 RDI: 0000000000000005
[ 246.753623][ T575] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 246.753625][ T575] R10: 00007fabc945ff60 R11: 0000000000000246 R12: 0000000000000002
[ 246.753626][ T575] R13: 00000000690de922 R14: 0000000000499600 R15: 0000000000000000
[ 246.753633][ T575]
[ 246.753634][ T575]
[ 246.768190][ T575] Allocated by task 405:
[ 246.768330][ T575] kasan_save_stack+0x24/0x40
[ 246.768510][ T575] kasan_save_track+0x14/0x30
[ 246.768697][ T575] __kasan_kmalloc+0x7b/0x90
[ 246.768880][ T575] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 246.769077][ T575] alloc_netdev_mqs+0x7d/0x1370
[ 246.769263][ T575] rtnl_create_link+0xa9e/0xe20
[ 246.769434][ T575] rtnl_newlink_create+0x203/0x770
[ 246.769598][ T575] __rtnl_newlink+0x231/0xa30
[ 246.769788][ T575] rtnl_newlink+0x693/0xa60
[ 246.769977][ T575] rtnetlink_rcv_msg+0x709/0xc00
[ 246.770165][ T575] netlink_rcv_skb+0x121/0x340
[ 246.770336][ T575] netlink_unicast+0x4aa/0x780
[ 246.770517][ T575] netlink_sendmsg+0x714/0xbd0
[ 246.770680][ T575] ____sys_sendmsg+0x3dd/0x890
[ 246.770870][ T575] ___sys_sendmsg+0xed/0x170
[ 246.771065][ T575] __sys_sendmsg+0x10b/0x1a0
[ 246.771242][ T575] do_syscall_64+0xc1/0xfd0
[ 246.771414][ T575] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 246.771649][ T575]
[ 246.771749][ T575] Freed by task 575:
[ 246.771907][ T575] kasan_save_stack+0x24/0x40
[ 246.772103][ T575] kasan_save_track+0x14/0x30
[ 246.772298][ T575] __kasan_save_free_info+0x3b/0x60
[ 246.772484][ T575] __kasan_slab_free+0x3f/0x60
[ 246.772669][ T575] kfree+0x21d/0x540
[ 246.772850][ T575] device_release+0x9c/0x210
[ 246.773067][ T575] kobject_cleanup+0xfe/0x360
[ 246.773252][ T575] netdev_run_todo+0x81f/0xc60
[ 246.773437][ T575] rtnl_dellink+0x350/0xa30
[ 246.773599][ T575] rtnetlink_rcv_msg+0x709/0xc00
[ 246.773785][ T575] netlink_rcv_skb+0x121/0x340
[ 246.774005][ T575] netlink_unicast+0x4aa/0x780
[ 246.774183][ T575] netlink_sendmsg+0x714/0xbd0
[ 246.774361][ T575] ____sys_sendmsg+0x3dd/0x890
[ 246.774539][ T575] ___sys_sendmsg+0xed/0x170
[ 246.774713][ T575] __sys_sendmsg+0x10b/0x1a0
[ 246.774927][ T575] do_syscall_64+0xc1/0xfd0
[ 246.775127][ T575] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 246.775351][ T575]
[ 246.775445][ T575] The buggy address belongs to the object at ffff88800cb91000
[ 246.775445][ T575] which belongs to the cache kmalloc-4k of size 4096
[ 246.775867][ T575] The buggy address is located 1708 bytes inside of
[ 246.775867][ T575] freed 4096-byte region [ffff88800cb91000, ffff88800cb92000)
[ 246.776313][ T575]
[ 246.776436][ T575] The buggy address belongs to the physical page:
[ 246.776671][ T575] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xcb90
[ 246.777032][ T575] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 246.777331][ T575] flags: 0x80000000000040(head|node=0|zone=1)
[ 246.777576][ T575] page_type: f5(slab)
[ 246.777722][ T575] raw: 0080000000000040 ffff888001043700 ffffea000020b010 ffffea0000166610
[ 246.778080][ T575] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 246.778415][ T575] head: 0080000000000040 ffff888001043700 ffffea000020b010 ffffea0000166610
[ 246.778762][ T575] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 246.779107][ T575] head: 0080000000000003 ffffea000032e401 00000000ffffffff 00000000ffffffff
[ 246.779444][ T575] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 246.779778][ T575] page dumped because: kasan: bad access detected
[ 246.780016][ T575]
[ 246.780131][ T575] Memory state around the buggy address:
[ 246.780318][ T575] ffff88800cb91580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 246.780613][ T575] ffff88800cb91600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 246.780893][ T575] >ffff88800cb91680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 246.781184][ T575] ^
[ 246.781373][ T575] ffff88800cb91700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 246.781640][ T575] ffff88800cb91780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 246.781906][ T575] ==================================================================
[ 246.782976][ T575] Disabling lock debugging due to kernel taint
[ 246.783448][ T575] ------------[ cut here ]------------
[ 246.783733][ T575] refcount_t: underflow; use-after-free.
[ 246.784119][ T575] WARNING: CPU: 0 PID: 575 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 246.784625][ T575] Modules linked in: act_gact cls_flower sch_ingress 8021q ip6_gre ip6_tunnel tunnel6 gre vrf veth
[ 246.785342][ T575] CPU: 0 UID: 0 PID: 575 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 246.785966][ T575] Tainted: [B]=BAD_PAGE
[ 246.786275][ T575] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 246.786671][ T575] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 246.787056][ T575] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d e5 95 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 246.788201][ T575] RSP: 0000:ffffc90000eef1f0 EFLAGS: 00010286
[ 246.788600][ T575] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 246.789051][ T575] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 246.789521][ T575] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff2cfe134
[ 246.789969][ T575] R10: 0000000000000003 R11: ffffc90000eeed80 R12: 0000000000000001
[ 246.790550][ T575] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 246.791008][ T575] FS: 00007fabc9395800(0000) GS:ffff88809e5f2000(0000) knlGS:0000000000000000
[ 246.791548][ T575] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 246.791910][ T575] CR2: 00007f24d3972b30 CR3: 000000000c25e002 CR4: 0000000000772ef0
[ 246.792338][ T575] PKRU: 55555554
[ 246.792558][ T575] Call Trace:
[ 246.792771][ T575]
[ 246.792916][ T575] netdev_run_todo+0x5f0/0xc60
[ 246.793222][ T575] ? dev_ingress_queue_create+0x190/0x190
[ 246.793509][ T575] ? generic_xdp_install+0x410/0x410
[ 246.793794][ T575] ? vrf_dellink+0xff/0x150 [vrf]
[ 246.794116][ T575] ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 246.794474][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.794762][ T575] rtnl_dellink+0x350/0xa30
[ 246.795056][ T575] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 246.795431][ T575] ? find_held_lock+0x2b/0x80
[ 246.795702][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.795991][ T575] ? find_held_lock+0x2b/0x80
[ 246.796291][ T575] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 246.796573][ T575] ? __lock_release+0x5d/0x170
[ 246.796852][ T575] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 246.797283][ T575] rtnetlink_rcv_msg+0x709/0xc00
[ 246.797560][ T575] ? rtnl_port_fill+0x850/0x850
[ 246.797822][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.798123][ T575] netlink_rcv_skb+0x121/0x340
[ 246.798442][ T575] ? rtnl_port_fill+0x850/0x850
[ 246.798724][ T575] ? netlink_ack+0xdd0/0xdd0
[ 246.798996][ T575] ? netlink_deliver_tap+0x13e/0x340
[ 246.799276][ T575] ? netlink_deliver_tap+0xc3/0x340
[ 246.799565][ T575] netlink_unicast+0x4aa/0x780
[ 246.799885][ T575] ? netlink_attachskb+0x810/0x810
[ 246.800218][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.800538][ T575] netlink_sendmsg+0x714/0xbd0
[ 246.800838][ T575] ? netlink_unicast+0x780/0x780
[ 246.801150][ T575] ? __import_iovec+0x230/0x3b0
[ 246.801449][ T575] ? netlink_unicast+0x780/0x780
[ 246.801714][ T575] ____sys_sendmsg+0x3dd/0x890
[ 246.801977][ T575] ? get_timestamp.constprop.0+0x380/0x380
[ 246.802351][ T575] ? __copy_msghdr+0x3c0/0x3c0
[ 246.802668][ T575] ___sys_sendmsg+0xed/0x170
[ 246.802976][ T575] ? kasan_record_aux_stack+0x8c/0xa0
[ 246.803262][ T575] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 246.803642][ T575] ? copy_msghdr_from_user+0x110/0x110
[ 246.803930][ T575] ? find_held_lock+0x2b/0x80
[ 246.804243][ T575] ? __lock_acquire+0x449/0x7e0
[ 246.804541][ T575] ? find_held_lock+0x2b/0x80
[ 246.804786][ T575] ? __virt_addr_valid+0x22a/0x450
[ 246.805081][ T575] ? __lock_release+0x5d/0x170
[ 246.805355][ T575] __sys_sendmsg+0x10b/0x1a0
[ 246.805619][ T575] ? __call_rcu_common.constprop.0+0x318/0x630
[ 246.805964][ T575] ? __sys_sendmsg_sock+0x20/0x20
[ 246.806262][ T575] ? rcu_is_watching+0x12/0xb0
[ 246.806542][ T575] do_syscall_64+0xc1/0xfd0
[ 246.806811][ T575] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 246.807168][ T575] RIP: 0033:0x7fabc95631d7
[ 246.807480][ T575] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 246.808487][ T575] RSP: 002b:00007ffd886f1b48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 246.808908][ T575] RAX: ffffffffffffffda RBX: 00007ffd886f2270 RCX: 00007fabc95631d7
[ 246.809339][ T575] RDX: 0000000000000000 RSI: 00007ffd886f1bb0 RDI: 0000000000000005
[ 246.809781][ T575] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 246.810251][ T575] R10: 00007fabc945ff60 R11: 0000000000000246 R12: 0000000000000002
[ 246.810693][ T575] R13: 00000000690de922 R14: 0000000000499600 R15: 0000000000000000
[ 246.811162][ T575]
[ 246.811372][ T575] irq event stamp: 41409
[ 246.811580][ T575] hardirqs last enabled at (41409): [] kasan_quarantine_put+0xf9/0x210
[ 246.812056][ T575] hardirqs last disabled at (41408): [] kasan_quarantine_put+0xac/0x210
[ 246.812528][ T575] softirqs last enabled at (40804): [] handle_softirqs+0x352/0x610
[ 246.813085][ T575] softirqs last disabled at (40797): [] irq_exit_rcu+0xab/0x100
[ 246.813590][ T575] ---[ end trace 0000000000000000 ]---