[ 28.203975][ T325] veth2: entered promiscuous mode [ 48.012566][ T352] 8021q: 802.1Q VLAN Support v1.8 [ 72.863513][ T396] ================================================================== [ 72.863872][ T396] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0 [ 72.864159][ T396] Read of size 1 at addr ffff8880119c96ac by task ip/396 [ 72.864385][ T396] [ 72.864484][ T396] CPU: 2 UID: 0 PID: 396 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full) [ 72.864490][ T396] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 72.864492][ T396] Call Trace: [ 72.864495][ T396] [ 72.864496][ T396] dump_stack_lvl+0x82/0xc0 [ 72.864503][ T396] print_address_description.constprop.0+0x2c/0x3a0 [ 72.864515][ T396] ? kobject_put+0xbb/0xd0 [ 72.864519][ T396] print_report+0xb4/0x270 [ 72.864522][ T396] ? kobject_put+0xbb/0xd0 [ 72.864525][ T396] ? kasan_addr_to_slab+0x21/0x70 [ 72.864528][ T396] ? kobject_put+0xbb/0xd0 [ 72.864532][ T396] kasan_report+0xca/0x100 [ 72.864535][ T396] ? kobject_put+0xbb/0xd0 [ 72.864540][ T396] kobject_put+0xbb/0xd0 [ 72.864544][ T396] netdev_run_todo+0x5f0/0xc60 [ 72.864550][ T396] ? dev_ingress_queue_create+0x190/0x190 [ 72.864554][ T396] ? generic_xdp_install+0x410/0x410 [ 72.864558][ T396] ? vrf_dellink+0xff/0x150 [vrf] [ 72.864564][ T396] ? vrf_map_unregister_dev+0x480/0x480 [vrf] [ 72.864569][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.864581][ T396] rtnl_dellink+0x350/0xa30 [ 72.864587][ T396] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.864606][ T396] ? find_held_lock+0x2b/0x80 [ 72.864610][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.864616][ T396] ? find_held_lock+0x2b/0x80 [ 72.864620][ T396] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 72.864623][ T396] ? __lock_release+0x5d/0x170 [ 72.864628][ T396] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.864631][ T396] rtnetlink_rcv_msg+0x709/0xc00 [ 72.864635][ T396] ? rtnl_port_fill+0x850/0x850 [ 72.864638][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.864645][ T396] netlink_rcv_skb+0x121/0x340 [ 72.864650][ T396] ? rtnl_port_fill+0x850/0x850 [ 72.864654][ T396] ? netlink_ack+0xdd0/0xdd0 [ 72.864664][ T396] ? netlink_deliver_tap+0x13e/0x340 [ 72.864668][ T396] ? netlink_deliver_tap+0xc3/0x340 [ 72.864675][ T396] netlink_unicast+0x4aa/0x780 [ 72.864682][ T396] ? netlink_attachskb+0x810/0x810 [ 72.864688][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.864693][ T396] netlink_sendmsg+0x714/0xbd0 [ 72.864698][ T396] ? netlink_unicast+0x780/0x780 [ 72.864701][ T396] ? __import_iovec+0x230/0x3b0 [ 72.864709][ T396] ? netlink_unicast+0x780/0x780 [ 72.864712][ T396] ____sys_sendmsg+0x3dd/0x890 [ 72.864719][ T396] ? get_timestamp.constprop.0+0x380/0x380 [ 72.864723][ T396] ? __copy_msghdr+0x3c0/0x3c0 [ 72.864731][ T396] ___sys_sendmsg+0xed/0x170 [ 72.864734][ T396] ? kasan_record_aux_stack+0x8c/0xa0 [ 72.864738][ T396] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 72.864746][ T396] ? copy_msghdr_from_user+0x110/0x110 [ 72.864751][ T396] ? find_held_lock+0x2b/0x80 [ 72.864756][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.864761][ T396] ? find_held_lock+0x2b/0x80 [ 72.864765][ T396] ? __virt_addr_valid+0x22a/0x450 [ 72.864774][ T396] ? __lock_release+0x5d/0x170 [ 72.864781][ T396] __sys_sendmsg+0x10b/0x1a0 [ 72.864784][ T396] ? __call_rcu_common.constprop.0+0x318/0x630 [ 72.864788][ T396] ? __sys_sendmsg_sock+0x20/0x20 [ 72.864796][ T396] ? rcu_is_watching+0x12/0xb0 [ 72.864800][ T396] do_syscall_64+0xc1/0xfd0 [ 72.864807][ T396] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.864811][ T396] RIP: 0033:0x7f4a745241d7 [ 72.864818][ T396] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 72.864821][ T396] RSP: 002b:00007ffd09fae9c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.864826][ T396] RAX: ffffffffffffffda RBX: 00007ffd09faf0f0 RCX: 00007f4a745241d7 [ 72.864828][ T396] RDX: 0000000000000000 RSI: 00007ffd09faea30 RDI: 0000000000000005 [ 72.864830][ T396] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 72.864832][ T396] R10: 00007f4a74420f60 R11: 0000000000000246 R12: 0000000000000002 [ 72.864834][ T396] R13: 00000000690df04b R14: 0000000000499600 R15: 0000000000000000 [ 72.864840][ T396] [ 72.864841][ T396] [ 72.881104][ T396] Allocated by task 357: [ 72.881248][ T396] kasan_save_stack+0x24/0x40 [ 72.881447][ T396] kasan_save_track+0x14/0x30 [ 72.881730][ T396] __kasan_kmalloc+0x7b/0x90 [ 72.881908][ T396] __kvmalloc_node_noprof+0x2e5/0x8e0 [ 72.882088][ T396] alloc_netdev_mqs+0x7d/0x1370 [ 72.882278][ T396] rtnl_create_link+0xa9e/0xe20 [ 72.882472][ T396] rtnl_newlink_create+0x203/0x770 [ 72.882655][ T396] __rtnl_newlink+0x231/0xa30 [ 72.882849][ T396] rtnl_newlink+0x693/0xa60 [ 72.883030][ T396] rtnetlink_rcv_msg+0x709/0xc00 [ 72.883313][ T396] netlink_rcv_skb+0x121/0x340 [ 72.883497][ T396] netlink_unicast+0x4aa/0x780 [ 72.883686][ T396] netlink_sendmsg+0x714/0xbd0 [ 72.883875][ T396] ____sys_sendmsg+0x3dd/0x890 [ 72.884067][ T396] ___sys_sendmsg+0xed/0x170 [ 72.884252][ T396] __sys_sendmsg+0x10b/0x1a0 [ 72.884433][ T396] do_syscall_64+0xc1/0xfd0 [ 72.884621][ T396] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.884957][ T396] [ 72.885056][ T396] Freed by task 396: [ 72.885193][ T396] kasan_save_stack+0x24/0x40 [ 72.885372][ T396] kasan_save_track+0x14/0x30 [ 72.885662][ T396] __kasan_save_free_info+0x3b/0x60 [ 72.885856][ T396] __kasan_slab_free+0x3f/0x60 [ 72.886036][ T396] kfree+0x21d/0x540 [ 72.886173][ T396] device_release+0x9c/0x210 [ 72.886357][ T396] kobject_cleanup+0xfe/0x360 [ 72.886642][ T396] netdev_run_todo+0x81f/0xc60 [ 72.886852][ T396] rtnl_dellink+0x350/0xa30 [ 72.887037][ T396] rtnetlink_rcv_msg+0x709/0xc00 [ 72.887227][ T396] netlink_rcv_skb+0x121/0x340 [ 72.887407][ T396] netlink_unicast+0x4aa/0x780 [ 72.887588][ T396] netlink_sendmsg+0x714/0xbd0 [ 72.887778][ T396] ____sys_sendmsg+0x3dd/0x890 [ 72.887957][ T396] ___sys_sendmsg+0xed/0x170 [ 72.888138][ T396] __sys_sendmsg+0x10b/0x1a0 [ 72.888319][ T396] do_syscall_64+0xc1/0xfd0 [ 72.888507][ T396] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.888950][ T396] [ 72.889048][ T396] The buggy address belongs to the object at ffff8880119c9000 [ 72.889048][ T396] which belongs to the cache kmalloc-4k of size 4096 [ 72.889491][ T396] The buggy address is located 1708 bytes inside of [ 72.889491][ T396] freed 4096-byte region [ffff8880119c9000, ffff8880119ca000) [ 72.889943][ T396] [ 72.890052][ T396] The buggy address belongs to the physical page: [ 72.890270][ T396] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119c8 [ 72.890709][ T396] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.890989][ T396] flags: 0x80000000000040(head|node=0|zone=1) [ 72.891222][ T396] page_type: f5(slab) [ 72.891460][ T396] raw: 0080000000000040 ffff888001043700 ffffea00001bfc10 ffffea0000095e10 [ 72.891813][ T396] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 72.892228][ T396] head: 0080000000000040 ffff888001043700 ffffea00001bfc10 ffffea0000095e10 [ 72.892545][ T396] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 72.892872][ T396] head: 0080000000000003 ffffea0000467201 00000000ffffffff 00000000ffffffff [ 72.893287][ T396] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 72.893606][ T396] page dumped because: kasan: bad access detected [ 72.893937][ T396] [ 72.894025][ T396] Memory state around the buggy address: [ 72.894199][ T396] ffff8880119c9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.894459][ T396] ffff8880119c9600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.894829][ T396] >ffff8880119c9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.895105][ T396] ^ [ 72.895284][ T396] ffff8880119c9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.895632][ T396] ffff8880119c9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.895898][ T396] ================================================================== [ 72.896356][ T396] Disabling lock debugging due to kernel taint [ 72.896616][ T396] ------------[ cut here ]------------ [ 72.896831][ T396] refcount_t: underflow; use-after-free. [ 72.897064][ T396] WARNING: CPU: 2 PID: 396 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0 [ 72.897436][ T396] Modules linked in: 8021q vrf veth [ 72.897769][ T396] CPU: 2 UID: 0 PID: 396 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full) [ 72.898936][ T396] Tainted: [B]=BAD_PAGE [ 72.899108][ T396] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 72.899369][ T396] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0 [ 72.899636][ T396] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 25 8d e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff [ 72.900338][ T396] RSP: 0018:ffffc900005e71f0 EFLAGS: 00010286 [ 72.900597][ T396] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 72.900913][ T396] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 72.901209][ T396] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff1b7e134 [ 72.901528][ T396] R10: 0000000000000003 R11: ffffc900005e6d80 R12: 0000000000000001 [ 72.901842][ T396] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 72.902142][ T396] FS: 00007f4a74356800(0000) GS:ffff8880a72f2000(0000) knlGS:0000000000000000 [ 72.902499][ T396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.902763][ T396] CR2: 00000000004e6680 CR3: 0000000004b64003 CR4: 0000000000772ef0 [ 72.903069][ T396] PKRU: 55555554 [ 72.903232][ T396] Call Trace: [ 72.903402][ T396] [ 72.903520][ T396] netdev_run_todo+0x5f0/0xc60 [ 72.903765][ T396] ? dev_ingress_queue_create+0x190/0x190 [ 72.903979][ T396] ? generic_xdp_install+0x410/0x410 [ 72.904295][ T396] ? vrf_dellink+0xff/0x150 [vrf] [ 72.904515][ T396] ? vrf_map_unregister_dev+0x480/0x480 [vrf] [ 72.904805][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.905021][ T396] rtnl_dellink+0x350/0xa30 [ 72.905333][ T396] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.905594][ T396] ? find_held_lock+0x2b/0x80 [ 72.905803][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.906008][ T396] ? find_held_lock+0x2b/0x80 [ 72.906229][ T396] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 72.906446][ T396] ? __lock_release+0x5d/0x170 [ 72.906653][ T396] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.907033][ T396] rtnetlink_rcv_msg+0x709/0xc00 [ 72.907248][ T396] ? rtnl_port_fill+0x850/0x850 [ 72.907465][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.907683][ T396] netlink_rcv_skb+0x121/0x340 [ 72.907997][ T396] ? rtnl_port_fill+0x850/0x850 [ 72.908210][ T396] ? netlink_ack+0xdd0/0xdd0 [ 72.908429][ T396] ? netlink_deliver_tap+0x13e/0x340 [ 72.908636][ T396] ? netlink_deliver_tap+0xc3/0x340 [ 72.908960][ T396] netlink_unicast+0x4aa/0x780 [ 72.909169][ T396] ? netlink_attachskb+0x810/0x810 [ 72.909384][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.909591][ T396] netlink_sendmsg+0x714/0xbd0 [ 72.909909][ T396] ? netlink_unicast+0x780/0x780 [ 72.910117][ T396] ? __import_iovec+0x230/0x3b0 [ 72.910335][ T396] ? netlink_unicast+0x780/0x780 [ 72.910544][ T396] ____sys_sendmsg+0x3dd/0x890 [ 72.910857][ T396] ? get_timestamp.constprop.0+0x380/0x380 [ 72.911110][ T396] ? __copy_msghdr+0x3c0/0x3c0 [ 72.911326][ T396] ___sys_sendmsg+0xed/0x170 [ 72.911531][ T396] ? kasan_record_aux_stack+0x8c/0xa0 [ 72.911847][ T396] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 72.912102][ T396] ? copy_msghdr_from_user+0x110/0x110 [ 72.912315][ T396] ? find_held_lock+0x2b/0x80 [ 72.912518][ T396] ? __lock_acquire+0x449/0x7e0 [ 72.912849][ T396] ? find_held_lock+0x2b/0x80 [ 72.913049][ T396] ? __virt_addr_valid+0x22a/0x450 [ 72.913253][ T396] ? __lock_release+0x5d/0x170 [ 72.913473][ T396] __sys_sendmsg+0x10b/0x1a0 [ 72.913783][ T396] ? __call_rcu_common.constprop.0+0x318/0x630 [ 72.914027][ T396] ? __sys_sendmsg_sock+0x20/0x20 [ 72.914229][ T396] ? rcu_is_watching+0x12/0xb0 [ 72.914538][ T396] do_syscall_64+0xc1/0xfd0 [ 72.914748][ T396] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.914987][ T396] RIP: 0033:0x7f4a745241d7 [ 72.915201][ T396] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 72.915881][ T396] RSP: 002b:00007ffd09fae9c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.916281][ T396] RAX: ffffffffffffffda RBX: 00007ffd09faf0f0 RCX: 00007f4a745241d7 [ 72.916579][ T396] RDX: 0000000000000000 RSI: 00007ffd09faea30 RDI: 0000000000000005 [ 72.916908][ T396] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 72.917203][ T396] R10: 00007f4a74420f60 R11: 0000000000000246 R12: 0000000000000002 [ 72.917504][ T396] R13: 00000000690df04b R14: 0000000000499600 R15: 0000000000000000 [ 72.917813][ T396] [ 72.918073][ T396] irq event stamp: 44737 [ 72.918229][ T396] hardirqs last enabled at (44737): [] __schedule+0x13c7/0x1b10 [ 72.918575][ T396] hardirqs last disabled at (44736): [] __schedule+0x94a/0x1b10 [ 72.919009][ T396] softirqs last enabled at (43952): [] handle_softirqs+0x352/0x610 [ 72.919360][ T396] softirqs last disabled at (43913): [] irq_exit_rcu+0xab/0x100 [ 72.919792][ T396] ---[ end trace 0000000000000000 ]--- WAIT TIMEOUT stderr Ctrl-C stderr Ctrl-C stderr [ 373.989443][ T325] veth2: left promiscuous mode WAIT TIMEOUT stderr