[ 15.213351][ T251] ip (251) used greatest stack depth: 24080 bytes left
[ 16.281827][ T273] ip (273) used greatest stack depth: 24064 bytes left
[ 20.775273][ T313] gre: GRE over IPv4 demultiplexer driver
[ 20.791810][ T313] ip_gre: GRE over IPv4 tunneling driver
[ 21.821186][ T323] GACT probability NOT on
[ 22.096951][ T325] ip6_gre: GRE over IPv6 tunneling driver
[ 22.328878][ T194] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 22.355045][ T194] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 22.479798][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 22.493901][ T194] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 22.598640][ T194] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 23.502208][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 23.672055][ T340] br1: port 1(veth1) entered blocking state
[ 23.672679][ T340] br1: port 1(veth1) entered disabled state
[ 23.673217][ T340] veth1: entered allmulticast mode
[ 23.677490][ T340] veth1: entered promiscuous mode
[ 23.788910][ T70] br1: port 1(veth1) entered blocking state
[ 23.789540][ T70] br1: port 1(veth1) entered forwarding state
[ 23.912813][ T342] br1: port 2(veth2) entered blocking state
[ 23.913248][ T342] br1: port 2(veth2) entered disabled state
[ 23.913684][ T342] veth2: entered allmulticast mode
[ 23.917309][ T342] veth2: entered promiscuous mode
[ 24.029548][ T70] br1: port 2(veth2) entered blocking state
[ 24.029997][ T70] br1: port 2(veth2) entered forwarding state
[ 24.525989][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 24.527194][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 24.706697][ T62] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 24.989968][ T12] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 28.621827][ C2] ip6_tnl_xmit_ctl: 5 callbacks suppressed
[ 28.621843][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 31.756370][ T377] Mirror/redirect action on
[ 36.814704][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 53.710701][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 91.598640][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 118.307322][ T796] ==================================================================
[ 118.307899][ T796] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 118.308352][ T796] Read of size 1 at addr ffff88800e2946ac by task ip/796
[ 118.308717][ T796]
[ 118.308866][ T796] CPU: 3 UID: 0 PID: 796 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 118.308877][ T796] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 118.308882][ T796] Call Trace:
[ 118.308887][ T796]
[ 118.308890][ T796] dump_stack_lvl+0x82/0xc0
[ 118.308902][ T796] print_address_description.constprop.0+0x2c/0x3a0
[ 118.308924][ T796] ? kobject_put+0xbb/0xd0
[ 118.308930][ T796] print_report+0xb4/0x270
[ 118.308936][ T796] ? kobject_put+0xbb/0xd0
[ 118.308940][ T796] ? kasan_addr_to_slab+0x21/0x70
[ 118.308948][ T796] ? kobject_put+0xbb/0xd0
[ 118.308953][ T796] kasan_report+0xca/0x100
[ 118.308960][ T796] ? kobject_put+0xbb/0xd0
[ 118.308969][ T796] kobject_put+0xbb/0xd0
[ 118.308975][ T796] netdev_run_todo+0x5f0/0xc60
[ 118.308990][ T796] ? dev_ingress_queue_create+0x190/0x190
[ 118.308995][ T796] ? generic_xdp_install+0x410/0x410
[ 118.309000][ T796] ? unregister_netdevice_many+0x20/0x20
[ 118.309006][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.309024][ T796] rtnl_dellink+0x350/0xa30
[ 118.309034][ T796] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 118.309070][ T796] ? find_held_lock+0x2b/0x80
[ 118.309078][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.309089][ T796] ? find_held_lock+0x2b/0x80
[ 118.309095][ T796] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 118.309099][ T796] ? __lock_release+0x5d/0x170
[ 118.309106][ T796] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 118.309112][ T796] rtnetlink_rcv_msg+0x709/0xc00
[ 118.309118][ T796] ? rtnl_port_fill+0x850/0x850
[ 118.309123][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.309136][ T796] netlink_rcv_skb+0x121/0x340
[ 118.309144][ T796] ? rtnl_port_fill+0x850/0x850
[ 118.309150][ T796] ? netlink_ack+0xdd0/0xdd0
[ 118.309162][ T796] ? netlink_deliver_tap+0x13e/0x340
[ 118.309167][ T796] ? netlink_deliver_tap+0xc3/0x340
[ 118.309174][ T796] netlink_unicast+0x4aa/0x780
[ 118.309182][ T796] ? netlink_attachskb+0x810/0x810
[ 118.309189][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.309198][ T796] netlink_sendmsg+0x714/0xbd0
[ 118.309207][ T796] ? netlink_unicast+0x780/0x780
[ 118.309212][ T796] ? __import_iovec+0x230/0x3b0
[ 118.309235][ T796] ? netlink_unicast+0x780/0x780
[ 118.309240][ T796] ____sys_sendmsg+0x3dd/0x890
[ 118.309256][ T796] ? get_timestamp.constprop.0+0x380/0x380
[ 118.309261][ T796] ? __copy_msghdr+0x3c0/0x3c0
[ 118.309278][ T796] ___sys_sendmsg+0xed/0x170
[ 118.309283][ T796] ? kasan_record_aux_stack+0x8c/0xa0
[ 118.309288][ T796] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 118.309305][ T796] ? copy_msghdr_from_user+0x110/0x110
[ 118.309313][ T796] ? find_held_lock+0x2b/0x80
[ 118.309320][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.309330][ T796] ? find_held_lock+0x2b/0x80
[ 118.309337][ T796] ? __virt_addr_valid+0x22a/0x450
[ 118.309356][ T796] ? __lock_release+0x5d/0x170
[ 118.309368][ T796] __sys_sendmsg+0x10b/0x1a0
[ 118.309373][ T796] ? __call_rcu_common.constprop.0+0x318/0x630
[ 118.309381][ T796] ? __sys_sendmsg_sock+0x20/0x20
[ 118.309396][ T796] ? rcu_is_watching+0x12/0xb0
[ 118.309402][ T796] do_syscall_64+0xc1/0xfd0
[ 118.309414][ T796] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 118.309427][ T796] RIP: 0033:0x7ffbb279f1d7
[ 118.309437][ T796] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 118.309444][ T796] RSP: 002b:00007ffef9812888 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 118.309451][ T796] RAX: ffffffffffffffda RBX: 00007ffef9812fb0 RCX: 00007ffbb279f1d7
[ 118.309454][ T796] RDX: 0000000000000000 RSI: 00007ffef98128f0 RDI: 0000000000000005
[ 118.309459][ T796] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 118.309462][ T796] R10: 00007ffbb269bf60 R11: 0000000000000246 R12: 0000000000000002
[ 118.309465][ T796] R13: 00000000690df580 R14: 0000000000499600 R15: 0000000000000000
[ 118.309478][ T796]
[ 118.309480][ T796]
[ 118.331810][ T796] Allocated by task 348:
[ 118.332038][ T796] kasan_save_stack+0x24/0x40
[ 118.332354][ T796] kasan_save_track+0x14/0x30
[ 118.332643][ T796] __kasan_kmalloc+0x7b/0x90
[ 118.332956][ T796] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 118.333488][ T796] alloc_netdev_mqs+0x7d/0x1370
[ 118.333819][ T796] rtnl_create_link+0xa9e/0xe20
[ 118.334123][ T796] rtnl_newlink_create+0x203/0x770
[ 118.334422][ T796] __rtnl_newlink+0x231/0xa30
[ 118.334909][ T796] rtnl_newlink+0x693/0xa60
[ 118.335413][ T796] rtnetlink_rcv_msg+0x709/0xc00
[ 118.335884][ T796] netlink_rcv_skb+0x121/0x340
[ 118.336185][ T796] netlink_unicast+0x4aa/0x780
[ 118.336485][ T796] netlink_sendmsg+0x714/0xbd0
[ 118.336783][ T796] ____sys_sendmsg+0x3dd/0x890
[ 118.337272][ T796] ___sys_sendmsg+0xed/0x170
[ 118.337571][ T796] __sys_sendmsg+0x10b/0x1a0
[ 118.337861][ T796] do_syscall_64+0xc1/0xfd0
[ 118.338166][ T796] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 118.338527][ T796]
[ 118.338694][ T796] Freed by task 796:
[ 118.338928][ T796] kasan_save_stack+0x24/0x40
[ 118.339240][ T796] kasan_save_track+0x14/0x30
[ 118.339524][ T796] __kasan_save_free_info+0x3b/0x60
[ 118.340008][ T796] __kasan_slab_free+0x3f/0x60
[ 118.340304][ T796] kfree+0x21d/0x540
[ 118.340529][ T796] device_release+0x9c/0x210
[ 118.340840][ T796] kobject_cleanup+0xfe/0x360
[ 118.341323][ T796] netdev_run_todo+0x81f/0xc60
[ 118.341612][ T796] rtnl_dellink+0x350/0xa30
[ 118.341919][ T796] rtnetlink_rcv_msg+0x709/0xc00
[ 118.342214][ T796] netlink_rcv_skb+0x121/0x340
[ 118.342509][ T796] netlink_unicast+0x4aa/0x780
[ 118.342805][ T796] netlink_sendmsg+0x714/0xbd0
[ 118.343102][ T796] ____sys_sendmsg+0x3dd/0x890
[ 118.343404][ T796] ___sys_sendmsg+0xed/0x170
[ 118.343720][ T796] __sys_sendmsg+0x10b/0x1a0
[ 118.344212][ T796] do_syscall_64+0xc1/0xfd0
[ 118.344700][ T796] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 118.345083][ T796]
[ 118.345427][ T796] The buggy address belongs to the object at ffff88800e294000
[ 118.345427][ T796] which belongs to the cache kmalloc-4k of size 4096
[ 118.346354][ T796] The buggy address is located 1708 bytes inside of
[ 118.346354][ T796] freed 4096-byte region [ffff88800e294000, ffff88800e295000)
[ 118.347260][ T796]
[ 118.347412][ T796] The buggy address belongs to the physical page:
[ 118.347799][ T796] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe290
[ 118.348515][ T796] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 118.348980][ T796] flags: 0x80000000000040(head|node=0|zone=1)
[ 118.349362][ T796] page_type: f5(slab)
[ 118.349785][ T796] raw: 0080000000000040 ffff888001043700 ffffea0000078c10 ffffea000027b810
[ 118.350348][ T796] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 118.350899][ T796] head: 0080000000000040 ffff888001043700 ffffea0000078c10 ffffea000027b810
[ 118.351685][ T796] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 118.352215][ T796] head: 0080000000000003 ffffea000038a401 00000000ffffffff 00000000ffffffff
[ 118.352955][ T796] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 118.353477][ T796] page dumped because: kasan: bad access detected
[ 118.353830][ T796]
[ 118.354161][ T796] Memory state around the buggy address:
[ 118.354447][ T796] ffff88800e294580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 118.354882][ T796] ffff88800e294600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 118.355487][ T796] >ffff88800e294680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 118.355905][ T796] ^
[ 118.356190][ T796] ffff88800e294700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 118.356780][ T796] ffff88800e294780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 118.357191][ T796] ==================================================================
[ 118.357621][ T796] Disabling lock debugging due to kernel taint
[ 118.358147][ T796] ------------[ cut here ]------------
[ 118.358433][ T796] refcount_t: underflow; use-after-free.
[ 118.358842][ T796] WARNING: CPU: 3 PID: 796 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 118.359551][ T796] Modules linked in: cls_flower act_mirred bridge stp llc ip6_gre ip6_tunnel tunnel6 act_gact cls_matchall ip_gre gre sch_ingress vrf veth
[ 118.360198][ T796] CPU: 3 UID: 0 PID: 796 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 118.360561][ T796] Tainted: [B]=BAD_PAGE
[ 118.360718][ T796] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 118.360936][ T796] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 118.361272][ T796] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 65 92 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 118.362311][ T796] RSP: 0018:ffffc9000155f1f0 EFLAGS: 00010286
[ 118.362688][ T796] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 118.363122][ T796] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 118.363644][ T796] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff25fe134
[ 118.363997][ T796] R10: 0000000000000003 R11: ffffc9000155ed80 R12: 0000000000000001
[ 118.364258][ T796] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 118.364513][ T796] FS: 00007ffbb25d1800(0000) GS:ffff8880a1f72000(0000) knlGS:0000000000000000
[ 118.364859][ T796] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 118.365091][ T796] CR2: 00000000004e5530 CR3: 000000000bfc1002 CR4: 0000000000772ef0
[ 118.365471][ T796] PKRU: 55555554
[ 118.365613][ T796] Call Trace:
[ 118.365749][ T796]
[ 118.365841][ T796] netdev_run_todo+0x5f0/0xc60
[ 118.366104][ T796] ? dev_ingress_queue_create+0x190/0x190
[ 118.366281][ T796] ? generic_xdp_install+0x410/0x410
[ 118.366461][ T796] ? unregister_netdevice_many+0x20/0x20
[ 118.366639][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.366939][ T796] rtnl_dellink+0x350/0xa30
[ 118.367119][ T796] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 118.367343][ T796] ? find_held_lock+0x2b/0x80
[ 118.367517][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.367782][ T796] ? find_held_lock+0x2b/0x80
[ 118.368065][ T796] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 118.368351][ T796] ? __lock_release+0x5d/0x170
[ 118.368671][ T796] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 118.369068][ T796] rtnetlink_rcv_msg+0x709/0xc00
[ 118.369357][ T796] ? rtnl_port_fill+0x850/0x850
[ 118.369642][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.369933][ T796] netlink_rcv_skb+0x121/0x340
[ 118.370411][ T796] ? rtnl_port_fill+0x850/0x850
[ 118.370686][ T796] ? netlink_ack+0xdd0/0xdd0
[ 118.370965][ T796] ? netlink_deliver_tap+0x13e/0x340
[ 118.371241][ T796] ? netlink_deliver_tap+0xc3/0x340
[ 118.371725][ T796] netlink_unicast+0x4aa/0x780
[ 118.371969][ T796] ? netlink_attachskb+0x810/0x810
[ 118.372131][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.372292][ T796] netlink_sendmsg+0x714/0xbd0
[ 118.372579][ T796] ? netlink_unicast+0x780/0x780
[ 118.372764][ T796] ? __import_iovec+0x230/0x3b0
[ 118.372948][ T796] ? netlink_unicast+0x780/0x780
[ 118.373117][ T796] ____sys_sendmsg+0x3dd/0x890
[ 118.373388][ T796] ? get_timestamp.constprop.0+0x380/0x380
[ 118.373595][ T796] ? __copy_msghdr+0x3c0/0x3c0
[ 118.373881][ T796] ___sys_sendmsg+0xed/0x170
[ 118.374160][ T796] ? kasan_record_aux_stack+0x8c/0xa0
[ 118.374632][ T796] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 118.374943][ T796] ? copy_msghdr_from_user+0x110/0x110
[ 118.375118][ T796] ? find_held_lock+0x2b/0x80
[ 118.375371][ T796] ? __lock_acquire+0x449/0x7e0
[ 118.375549][ T796] ? find_held_lock+0x2b/0x80
[ 118.375718][ T796] ? __virt_addr_valid+0x22a/0x450
[ 118.375878][ T796] ? __lock_release+0x5d/0x170
[ 118.376140][ T796] __sys_sendmsg+0x10b/0x1a0
[ 118.376300][ T796] ? __call_rcu_common.constprop.0+0x318/0x630
[ 118.376533][ T796] ? __sys_sendmsg_sock+0x20/0x20
[ 118.376710][ T796] ? rcu_is_watching+0x12/0xb0
[ 118.376964][ T796] do_syscall_64+0xc1/0xfd0
[ 118.377127][ T796] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 118.377323][ T796] RIP: 0033:0x7ffbb279f1d7
[ 118.377504][ T796] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 118.378202][ T796] RSP: 002b:00007ffef9812888 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 118.378552][ T796] RAX: ffffffffffffffda RBX: 00007ffef9812fb0 RCX: 00007ffbb279f1d7
[ 118.378879][ T796] RDX: 0000000000000000 RSI: 00007ffef98128f0 RDI: 0000000000000005
[ 118.379126][ T796] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 118.379481][ T796] R10: 00007ffbb269bf60 R11: 0000000000000246 R12: 0000000000000002
[ 118.379741][ T796] R13: 00000000690df580 R14: 0000000000499600 R15: 0000000000000000
[ 118.380091][ T796]
[ 118.380219][ T796] irq event stamp: 51281
[ 118.380347][ T796] hardirqs last enabled at (51281): [] irqentry_exit+0x3b/0x80
[ 118.380665][ T796] hardirqs last disabled at (51280): [] handle_softirqs+0x47f/0x610
[ 118.381046][ T796] softirqs last enabled at (51202): [] handle_softirqs+0x352/0x610
[ 118.381332][ T796] softirqs last disabled at (51197): [] irq_exit_rcu+0xab/0x100
[ 118.381727][ T796] ---[ end trace 0000000000000000 ]---
[ 118.668017][ T801] br1: port 1(veth1) entered disabled state
[ 118.752464][ T802] br1: port 2(veth2) entered disabled state
[ 118.838892][ T803] veth2: left allmulticast mode
[ 118.839129][ T803] veth2: left promiscuous mode
[ 118.839461][ T803] br1: port 2(veth2) entered disabled state
[ 118.840654][ T803] veth1: left allmulticast mode
[ 118.840858][ T803] veth1: left promiscuous mode
[ 118.841188][ T803] br1: port 1(veth1) entered disabled state