[ 22.866208][ T298] 8021q: 802.1Q VLAN Support v1.8
[ 29.826002][ T345] gre: GRE over IPv4 demultiplexer driver
[ 29.858073][ T345] ip_gre: GRE over IPv4 tunneling driver
[ 31.866581][ T362] lag: Mode changed to "loadbalance"
[ 32.225942][ T366] lag: Port device veth2 added
[ 32.724331][ T370] lag: Port device veth4 added
[ 32.991028][ T372] 8021q: adding VLAN 0 to HW filter on device lag
[ 33.117660][ T373] br1: port 1(lag) entered blocking state
[ 33.118044][ T373] br1: port 1(lag) entered disabled state
[ 33.118945][ T373] lag: entered allmulticast mode
[ 33.119305][ T373] veth2: entered allmulticast mode
[ 33.119641][ T373] veth4: entered allmulticast mode
[ 33.124644][ T373] veth2: entered promiscuous mode
[ 33.125263][ T373] veth4: entered promiscuous mode
[ 33.264871][ T374] br1: port 1(lag) entered blocking state
[ 33.265452][ T374] br1: port 1(lag) entered forwarding state
[ 34.354847][ T383] GACT probability NOT on
[ 42.182912][ T410] Mirror/redirect action on
[ 57.793186][ T71] br1: port 1(lag) entered disabled state
[ 64.625405][ T45] br1: port 1(lag) entered blocking state
[ 64.625803][ T45] br1: port 1(lag) entered forwarding state
[ 81.096239][ T37] br1: port 1(lag) entered disabled state
[ 87.757977][ T96] br1: port 1(lag) entered blocking state
[ 87.758513][ T96] br1: port 1(lag) entered forwarding state
[ 89.107003][ T514] lag: left allmulticast mode
[ 89.108415][ T514] veth2: left allmulticast mode
[ 89.108999][ T514] veth4: left allmulticast mode
[ 89.109713][ T514] veth2: left promiscuous mode
[ 89.110346][ T514] veth4: left promiscuous mode
[ 89.110918][ T514] br1: port 1(lag) entered disabled state
[ 89.295428][ T362] lag: Port device veth4 removed
[ 89.322221][ T362] lag: Port device veth2 removed
[ 89.427316][ T362] ==================================================================
[ 89.427670][ T362] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 89.428001][ T362] Read of size 1 at addr ffff888007bb16ac by task teamd/362
[ 89.428342][ T362]
[ 89.428454][ T362] CPU: 3 UID: 0 PID: 362 Comm: teamd Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 89.428461][ T362] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 89.428466][ T362] Call Trace:
[ 89.428469][ T362]
[ 89.428471][ T362] dump_stack_lvl+0x82/0xc0
[ 89.428482][ T362] print_address_description.constprop.0+0x2c/0x3a0
[ 89.428501][ T362] ? kobject_put+0xbb/0xd0
[ 89.428506][ T362] print_report+0xb4/0x270
[ 89.428511][ T362] ? kobject_put+0xbb/0xd0
[ 89.428516][ T362] ? kasan_addr_to_slab+0x21/0x70
[ 89.428520][ T362] ? kobject_put+0xbb/0xd0
[ 89.428523][ T362] kasan_report+0xca/0x100
[ 89.428527][ T362] ? kobject_put+0xbb/0xd0
[ 89.428535][ T362] kobject_put+0xbb/0xd0
[ 89.428538][ T362] netdev_run_todo+0x5f0/0xc60
[ 89.428546][ T362] ? dev_ingress_queue_create+0x190/0x190
[ 89.428550][ T362] ? generic_xdp_install+0x410/0x410
[ 89.428553][ T362] ? unregister_netdevice_many+0x20/0x20
[ 89.428556][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.428571][ T362] rtnl_dellink+0x350/0xa30
[ 89.428577][ T362] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 89.428595][ T362] ? find_held_lock+0x2b/0x80
[ 89.428600][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.428606][ T362] ? find_held_lock+0x2b/0x80
[ 89.428609][ T362] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 89.428612][ T362] ? __lock_release+0x5d/0x170
[ 89.428616][ T362] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 89.428619][ T362] rtnetlink_rcv_msg+0x709/0xc00
[ 89.428623][ T362] ? rtnl_port_fill+0x850/0x850
[ 89.428626][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.428633][ T362] netlink_rcv_skb+0x121/0x340
[ 89.428639][ T362] ? rtnl_port_fill+0x850/0x850
[ 89.428643][ T362] ? netlink_ack+0xdd0/0xdd0
[ 89.428649][ T362] ? netlink_deliver_tap+0x13e/0x340
[ 89.428652][ T362] ? netlink_deliver_tap+0xc3/0x340
[ 89.428656][ T362] netlink_unicast+0x4aa/0x780
[ 89.428660][ T362] ? netlink_attachskb+0x810/0x810
[ 89.428664][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.428669][ T362] netlink_sendmsg+0x714/0xbd0
[ 89.428674][ T362] ? netlink_unicast+0x780/0x780
[ 89.428677][ T362] ? __import_iovec+0x230/0x3b0
[ 89.428689][ T362] ? netlink_unicast+0x780/0x780
[ 89.428693][ T362] ____sys_sendmsg+0x3dd/0x890
[ 89.428703][ T362] ? get_timestamp.constprop.0+0x380/0x380
[ 89.428706][ T362] ? __copy_msghdr+0x3c0/0x3c0
[ 89.428713][ T362] ___sys_sendmsg+0xed/0x170
[ 89.428716][ T362] ? kasan_record_aux_stack+0x8c/0xa0
[ 89.428719][ T362] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 89.428731][ T362] ? copy_msghdr_from_user+0x110/0x110
[ 89.428736][ T362] ? find_held_lock+0x2b/0x80
[ 89.428741][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.428746][ T362] ? find_held_lock+0x2b/0x80
[ 89.428750][ T362] ? __virt_addr_valid+0x22a/0x450
[ 89.428763][ T362] ? __lock_release+0x5d/0x170
[ 89.428774][ T362] __sys_sendmsg+0x10b/0x1a0
[ 89.428779][ T362] ? __call_rcu_common.constprop.0+0x318/0x630
[ 89.428784][ T362] ? __sys_sendmsg_sock+0x20/0x20
[ 89.428794][ T362] ? rcu_is_watching+0x12/0xb0
[ 89.428798][ T362] do_syscall_64+0xc1/0xfd0
[ 89.428808][ T362] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 89.428816][ T362] RIP: 0033:0x7f8598df31d7
[ 89.428824][ T362] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 89.428829][ T362] RSP: 002b:00007ffd47567968 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 89.428836][ T362] RAX: ffffffffffffffda RBX: 0000000011b95320 RCX: 00007f8598df31d7
[ 89.428838][ T362] RDX: 0000000000000000 RSI: 00007ffd475679a0 RDI: 0000000000000005
[ 89.428840][ T362] RBP: 0000000011b95230 R08: 0000000000000003 R09: 0000000000000000
[ 89.428842][ T362] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000011bba830
[ 89.428844][ T362] R13: 00007ffd475679a0 R14: 0000000000000000 R15: 00007ffd47567b00
[ 89.428850][ T362]
[ 89.428851][ T362]
[ 89.443847][ T362] Allocated by task 362:
[ 89.444084][ T362] kasan_save_stack+0x24/0x40
[ 89.444274][ T362] kasan_save_track+0x14/0x30
[ 89.444442][ T362] __kasan_kmalloc+0x7b/0x90
[ 89.444642][ T362] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 89.444930][ T362] alloc_netdev_mqs+0x7d/0x1370
[ 89.445103][ T362] rtnl_create_link+0xa9e/0xe20
[ 89.445308][ T362] rtnl_newlink_create+0x203/0x770
[ 89.445509][ T362] __rtnl_newlink+0x231/0xa30
[ 89.445788][ T362] rtnl_newlink+0x693/0xa60
[ 89.445954][ T362] rtnetlink_rcv_msg+0x709/0xc00
[ 89.446122][ T362] netlink_rcv_skb+0x121/0x340
[ 89.446319][ T362] netlink_unicast+0x4aa/0x780
[ 89.446609][ T362] netlink_sendmsg+0x714/0xbd0
[ 89.446784][ T362] ____sys_sendmsg+0x3dd/0x890
[ 89.446963][ T362] ___sys_sendmsg+0xed/0x170
[ 89.447144][ T362] __sys_sendmsg+0x10b/0x1a0
[ 89.447417][ T362] do_syscall_64+0xc1/0xfd0
[ 89.447599][ T362] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 89.447820][ T362]
[ 89.447910][ T362] Freed by task 362:
[ 89.448138][ T362] kasan_save_stack+0x24/0x40
[ 89.448324][ T362] kasan_save_track+0x14/0x30
[ 89.448502][ T362] __kasan_save_free_info+0x3b/0x60
[ 89.448684][ T362] __kasan_slab_free+0x3f/0x60
[ 89.448953][ T362] kfree+0x21d/0x540
[ 89.449085][ T362] device_release+0x9c/0x210
[ 89.449292][ T362] kobject_cleanup+0xfe/0x360
[ 89.449474][ T362] netdev_run_todo+0x81f/0xc60
[ 89.449698][ T362] rtnl_dellink+0x350/0xa30
[ 89.449979][ T362] rtnetlink_rcv_msg+0x709/0xc00
[ 89.450164][ T362] netlink_rcv_skb+0x121/0x340
[ 89.450343][ T362] netlink_unicast+0x4aa/0x780
[ 89.450546][ T362] netlink_sendmsg+0x714/0xbd0
[ 89.450819][ T362] ____sys_sendmsg+0x3dd/0x890
[ 89.450993][ T362] ___sys_sendmsg+0xed/0x170
[ 89.451184][ T362] __sys_sendmsg+0x10b/0x1a0
[ 89.451373][ T362] do_syscall_64+0xc1/0xfd0
[ 89.451672][ T362] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 89.451891][ T362]
[ 89.451981][ T362] The buggy address belongs to the object at ffff888007bb1000
[ 89.451981][ T362] which belongs to the cache kmalloc-4k of size 4096
[ 89.452544][ T362] The buggy address is located 1708 bytes inside of
[ 89.452544][ T362] freed 4096-byte region [ffff888007bb1000, ffff888007bb2000)
[ 89.452971][ T362]
[ 89.453169][ T362] The buggy address belongs to the physical page:
[ 89.453501][ T362] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bb0
[ 89.453822][ T362] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 89.454205][ T362] flags: 0x80000000000040(head|node=0|zone=1)
[ 89.454460][ T362] page_type: f5(slab)
[ 89.454627][ T362] raw: 0080000000000040 ffff888001043700 ffffea00001f8210 ffffea0000091610
[ 89.455046][ T362] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 89.455381][ T362] head: 0080000000000040 ffff888001043700 ffffea00001f8210 ffffea0000091610
[ 89.455717][ T362] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 89.456135][ T362] head: 0080000000000003 ffffea00001eec01 00000000ffffffff 00000000ffffffff
[ 89.456466][ T362] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 89.456883][ T362] page dumped because: kasan: bad access detected
[ 89.457102][ T362]
[ 89.457203][ T362] Memory state around the buggy address:
[ 89.457382][ T362] ffff888007bb1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.457753][ T362] ffff888007bb1600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.458002][ T362] >ffff888007bb1680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.458382][ T362] ^
[ 89.458561][ T362] ffff888007bb1700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.458819][ T362] ffff888007bb1780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.459190][ T362] ==================================================================
[ 89.459906][ T362] Disabling lock debugging due to kernel taint
[ 89.460274][ T362] ------------[ cut here ]------------
[ 89.460448][ T362] refcount_t: underflow; use-after-free.
[ 89.461044][ T362] WARNING: CPU: 3 PID: 362 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 89.461392][ T362] Modules linked in: act_mirred act_gact cls_flower bridge stp llc ip_gre gre sch_ingress 8021q vrf veth
[ 89.461786][ T362] CPU: 3 UID: 0 PID: 362 Comm: teamd Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 89.462171][ T362] Tainted: [B]=BAD_PAGE
[ 89.462357][ T362] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 89.462614][ T362] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 89.462855][ T362] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 25 97 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 89.463551][ T362] RSP: 0018:ffffc900005e71f0 EFLAGS: 00010286
[ 89.463787][ T362] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 89.464046][ T362] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 89.464350][ T362] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff2f7e134
[ 89.464790][ T362] R10: 0000000000000003 R11: ffffc900005e6d80 R12: 0000000000000001
[ 89.465067][ T362] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 89.465357][ T362] FS: 00007f8598cb2b80(0000) GS:ffff888097772000(0000) knlGS:0000000000000000
[ 89.465749][ T362] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 89.465973][ T362] CR2: 00007f8598d01204 CR3: 000000000ba6f002 CR4: 0000000000772ef0
[ 89.466266][ T362] PKRU: 55555554
[ 89.466404][ T362] Call Trace:
[ 89.466621][ T362]
[ 89.466713][ T362] netdev_run_todo+0x5f0/0xc60
[ 89.466905][ T362] ? dev_ingress_queue_create+0x190/0x190
[ 89.467085][ T362] ? generic_xdp_install+0x410/0x410
[ 89.467286][ T362] ? unregister_netdevice_many+0x20/0x20
[ 89.467672][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.467873][ T362] rtnl_dellink+0x350/0xa30
[ 89.468054][ T362] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 89.468318][ T362] ? find_held_lock+0x2b/0x80
[ 89.468586][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.468764][ T362] ? find_held_lock+0x2b/0x80
[ 89.468945][ T362] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 89.469125][ T362] ? __lock_release+0x5d/0x170
[ 89.469333][ T362] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 89.469734][ T362] rtnetlink_rcv_msg+0x709/0xc00
[ 89.469915][ T362] ? rtnl_port_fill+0x850/0x850
[ 89.470093][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.470297][ T362] netlink_rcv_skb+0x121/0x340
[ 89.470564][ T362] ? rtnl_port_fill+0x850/0x850
[ 89.470738][ T362] ? netlink_ack+0xdd0/0xdd0
[ 89.470919][ T362] ? netlink_deliver_tap+0x13e/0x340
[ 89.471114][ T362] ? netlink_deliver_tap+0xc3/0x340
[ 89.471306][ T362] netlink_unicast+0x4aa/0x780
[ 89.471667][ T362] ? netlink_attachskb+0x810/0x810
[ 89.471849][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.472025][ T362] netlink_sendmsg+0x714/0xbd0
[ 89.472229][ T362] ? netlink_unicast+0x780/0x780
[ 89.472412][ T362] ? __import_iovec+0x230/0x3b0
[ 89.472675][ T362] ? netlink_unicast+0x780/0x780
[ 89.472859][ T362] ____sys_sendmsg+0x3dd/0x890
[ 89.473035][ T362] ? get_timestamp.constprop.0+0x380/0x380
[ 89.473279][ T362] ? __copy_msghdr+0x3c0/0x3c0
[ 89.473468][ T362] ___sys_sendmsg+0xed/0x170
[ 89.473733][ T362] ? kasan_record_aux_stack+0x8c/0xa0
[ 89.473912][ T362] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 89.474149][ T362] ? copy_msghdr_from_user+0x110/0x110
[ 89.474343][ T362] ? find_held_lock+0x2b/0x80
[ 89.474614][ T362] ? __lock_acquire+0x449/0x7e0
[ 89.474798][ T362] ? find_held_lock+0x2b/0x80
[ 89.474969][ T362] ? __virt_addr_valid+0x22a/0x450
[ 89.475269][ T362] ? __lock_release+0x5d/0x170
[ 89.475458][ T362] __sys_sendmsg+0x10b/0x1a0
[ 89.475710][ T362] ? __call_rcu_common.constprop.0+0x318/0x630
[ 89.475940][ T362] ? __sys_sendmsg_sock+0x20/0x20
[ 89.476133][ T362] ? rcu_is_watching+0x12/0xb0
[ 89.476337][ T362] do_syscall_64+0xc1/0xfd0
[ 89.476701][ T362] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 89.476926][ T362] RIP: 0033:0x7f8598df31d7
[ 89.477120][ T362] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 89.477873][ T362] RSP: 002b:00007ffd47567968 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 89.478157][ T362] RAX: ffffffffffffffda RBX: 0000000011b95320 RCX: 00007f8598df31d7
[ 89.478449][ T362] RDX: 0000000000000000 RSI: 00007ffd475679a0 RDI: 0000000000000005
[ 89.478812][ T362] RBP: 0000000011b95230 R08: 0000000000000003 R09: 0000000000000000
[ 89.479081][ T362] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000011bba830
[ 89.479381][ T362] R13: 00007ffd475679a0 R14: 0000000000000000 R15: 00007ffd47567b00
[ 89.479725][ T362]
[ 89.479871][ T362] irq event stamp: 122023
[ 89.480010][ T362] hardirqs last enabled at (122023): [] finish_task_switch.isra.0+0x245/0x960
[ 89.480591][ T362] hardirqs last disabled at (122022): [] __schedule+0x94a/0x1b10
[ 89.480914][ T362] softirqs last enabled at (121938): [] handle_softirqs+0x352/0x610
[ 89.481253][ T362] softirqs last disabled at (121933): [] irq_exit_rcu+0xab/0x100
[ 89.481651][ T362] ---[ end trace 0000000000000000 ]---