[ 17.588029][ T250] ip (250) used greatest stack depth: 23592 bytes left
[ 25.901045][ T326] br1: port 1(vx10) entered blocking state
[ 25.902328][ T326] br1: port 1(vx10) entered disabled state
[ 25.903305][ T326] vx10: entered allmulticast mode
[ 25.911026][ T326] vx10: entered promiscuous mode
[ 25.912587][ T326] br1: port 1(vx10) entered blocking state
[ 25.913461][ T326] br1: port 1(vx10) entered forwarding state
[ 26.644019][ T331] br1: port 2(vx20) entered blocking state
[ 26.644818][ T331] br1: port 2(vx20) entered disabled state
[ 26.645669][ T331] vx20: entered allmulticast mode
[ 26.654029][ T331] vx20: entered promiscuous mode
[ 26.655974][ T331] br1: port 2(vx20) entered blocking state
[ 26.656767][ T331] br1: port 2(vx20) entered forwarding state
[ 27.015906][ T333] br1: port 3(veth1) entered blocking state
[ 27.016483][ T333] br1: port 3(veth1) entered disabled state
[ 27.017505][ T333] veth1: entered allmulticast mode
[ 27.021829][ T333] veth1: entered promiscuous mode
[ 27.151711][ T56] br1: port 3(veth1) entered blocking state
[ 27.152407][ T56] br1: port 3(veth1) entered forwarding state
[ 27.443148][ T336] br1: port 4(veth2) entered blocking state
[ 27.443707][ T336] br1: port 4(veth2) entered disabled state
[ 27.444187][ T336] veth2: entered allmulticast mode
[ 27.448379][ T336] veth2: entered promiscuous mode
[ 27.622663][ T56] br1: port 4(veth2) entered blocking state
[ 27.623181][ T56] br1: port 4(veth2) entered forwarding state
[ 29.006860][ T346] 8021q: 802.1Q VLAN Support v1.8
[ 29.552262][ T349] br1: entered promiscuous mode
[ 29.556365][ T349] br1: left promiscuous mode
[ 29.564680][ T349] br1: entered promiscuous mode
[ 38.473805][ T428] br1: port 1(vx10) entered blocking state
[ 38.474299][ T428] br1: port 1(vx10) entered disabled state
[ 38.474790][ T428] vx10: entered allmulticast mode
[ 38.479066][ T428] vx10: entered promiscuous mode
[ 38.480534][ T428] br1: port 1(vx10) entered blocking state
[ 38.481183][ T428] br1: port 1(vx10) entered forwarding state
[ 39.021408][ T432] br1: port 2(vx20) entered blocking state
[ 39.022218][ T432] br1: port 2(vx20) entered disabled state
[ 39.022978][ T432] vx20: entered allmulticast mode
[ 39.029004][ T432] vx20: entered promiscuous mode
[ 39.030495][ T432] br1: port 2(vx20) entered blocking state
[ 39.031240][ T432] br1: port 2(vx20) entered forwarding state
[ 39.345338][ T434] br1: port 3(w1) entered blocking state
[ 39.345775][ T434] br1: port 3(w1) entered disabled state
[ 39.346128][ T434] w1: entered allmulticast mode
[ 39.350263][ T434] w1: entered promiscuous mode
[ 39.506498][ T38] br1: port 3(w1) entered blocking state
[ 39.506975][ T38] br1: port 3(w1) entered forwarding state
[ 39.754213][ T437] br1: port 4(w3) entered blocking state
[ 39.754670][ T437] br1: port 4(w3) entered disabled state
[ 39.755080][ T437] w3: entered allmulticast mode
[ 39.758677][ T437] w3: entered promiscuous mode
[ 39.905975][ T56] br1: port 4(w3) entered blocking state
[ 39.906648][ T56] br1: port 4(w3) entered forwarding state
[ 41.297181][ T447] br1: entered promiscuous mode
[ 41.301532][ T447] br1: left promiscuous mode
[ 41.308684][ T447] br1: entered promiscuous mode
[ 42.294253][ C2] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 42.437860][ C2] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 42.870498][ C1] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 42.873300][ C1] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 42.874156][ C1] IPv6: vlan20-v: IPv6 duplicate address fe80::200:5eff:fe00:101 used by 00:00:5e:00:01:01 detected!
[ 43.063043][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 43.065143][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 43.381390][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 47.030145][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 55.287109][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 71.671200][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 73.237082][ T671] GACT probability NOT on
[ 81.126463][ T71] w3: left allmulticast mode
[ 81.127788][ T71] w3: left promiscuous mode
[ 81.128571][ T71] br1: port 4(w3) entered disabled state
[ 81.132171][ T71] w1: left allmulticast mode
[ 81.132803][ T71] w1: left promiscuous mode
[ 81.133342][ T71] br1: port 3(w1) entered disabled state
[ 81.136604][ T71] vx20: left allmulticast mode
[ 81.137032][ T71] vx20: left promiscuous mode
[ 81.137589][ T71] br1: port 2(vx20) entered disabled state
[ 81.161862][ T71] vx10: left allmulticast mode
[ 81.162583][ T71] vx10: left promiscuous mode
[ 81.163777][ T71] br1: port 1(vx10) entered disabled state
[ 81.306045][ T71] ==================================================================
[ 81.306446][ T71] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 81.306831][ T71] Read of size 1 at addr ffff88800a1696ac by task kworker/u16:1/71
[ 81.307092][ T71]
[ 81.307191][ T71] CPU: 3 UID: 0 PID: 71 Comm: kworker/u16:1 Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 81.307196][ T71] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 81.307200][ T71] Workqueue: netns cleanup_net
[ 81.307212][ T71] Call Trace:
[ 81.307216][ T71]
[ 81.307220][ T71] dump_stack_lvl+0x82/0xc0
[ 81.307228][ T71] print_address_description.constprop.0+0x2c/0x3a0
[ 81.307243][ T71] ? kobject_put+0xbb/0xd0
[ 81.307249][ T71] print_report+0xb4/0x270
[ 81.307253][ T71] ? kobject_put+0xbb/0xd0
[ 81.307258][ T71] ? kasan_addr_to_slab+0x21/0x70
[ 81.307263][ T71] ? kobject_put+0xbb/0xd0
[ 81.307268][ T71] kasan_report+0xca/0x100
[ 81.307273][ T71] ? kobject_put+0xbb/0xd0
[ 81.307279][ T71] kobject_put+0xbb/0xd0
[ 81.307284][ T71] netdev_run_todo+0x5f0/0xc60
[ 81.307296][ T71] ? rtnl_is_locked+0x15/0x20
[ 81.307304][ T71] ? dev_ingress_queue_create+0x190/0x190
[ 81.307307][ T71] ? generic_xdp_install+0x410/0x410
[ 81.307313][ T71] ops_undo_list+0x714/0x890
[ 81.307318][ T71] ? netns_get+0x110/0x110
[ 81.307321][ T71] ? cleanup_net+0x2d6/0x830
[ 81.307327][ T71] cleanup_net+0x3b2/0x830
[ 81.307332][ T71] ? net_passive_dec+0x190/0x190
[ 81.307336][ T71] ? rcu_is_watching+0x12/0xb0
[ 81.307344][ T71] process_one_work+0xe35/0x1650
[ 81.307356][ T71] ? pwq_dec_nr_in_flight+0x550/0x550
[ 81.307362][ T71] ? assign_work+0x168/0x240
[ 81.307366][ T71] worker_thread+0x591/0xcf0
[ 81.307372][ T71] ? rescuer_thread+0xd10/0xd10
[ 81.307375][ T71] kthread+0x37b/0x5f0
[ 81.307382][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.307385][ T71] ? ret_from_fork+0x1b/0x270
[ 81.307389][ T71] ? __lock_release+0x5d/0x170
[ 81.307397][ T71] ? rcu_is_watching+0x12/0xb0
[ 81.307400][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.307404][ T71] ret_from_fork+0x1db/0x270
[ 81.307406][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.307409][ T71] ret_from_fork_asm+0x11/0x20
[ 81.307419][ T71]
[ 81.307420][ T71]
[ 81.314989][ T71] Allocated by task 447:
[ 81.315125][ T71] kasan_save_stack+0x24/0x40
[ 81.315354][ T71] kasan_save_track+0x14/0x30
[ 81.315541][ T71] __kasan_kmalloc+0x7b/0x90
[ 81.315740][ T71] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 81.315942][ T71] alloc_netdev_mqs+0x7d/0x1370
[ 81.316133][ T71] rtnl_create_link+0xa9e/0xe20
[ 81.316341][ T71] rtnl_newlink_create+0x203/0x770
[ 81.316532][ T71] __rtnl_newlink+0x231/0xa30
[ 81.316715][ T71] rtnl_newlink+0x693/0xa60
[ 81.316914][ T71] rtnetlink_rcv_msg+0x709/0xc00
[ 81.317088][ T71] netlink_rcv_skb+0x121/0x340
[ 81.317271][ T71] netlink_unicast+0x4aa/0x780
[ 81.317458][ T71] netlink_sendmsg+0x714/0xbd0
[ 81.317655][ T71] ____sys_sendmsg+0x3dd/0x890
[ 81.317866][ T71] ___sys_sendmsg+0xed/0x170
[ 81.318046][ T71] __sys_sendmsg+0x10b/0x1a0
[ 81.318224][ T71] do_syscall_64+0xc1/0xfd0
[ 81.318429][ T71] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 81.318662][ T71]
[ 81.318763][ T71] Freed by task 71:
[ 81.318908][ T71] kasan_save_stack+0x24/0x40
[ 81.319107][ T71] kasan_save_track+0x14/0x30
[ 81.319305][ T71] __kasan_save_free_info+0x3b/0x60
[ 81.319485][ T71] __kasan_slab_free+0x3f/0x60
[ 81.319671][ T71] kfree+0x21d/0x540
[ 81.319821][ T71] device_release+0x9c/0x210
[ 81.320018][ T71] kobject_cleanup+0xfe/0x360
[ 81.320196][ T71] netdev_run_todo+0x81f/0xc60
[ 81.320395][ T71] ops_undo_list+0x714/0x890
[ 81.320624][ T71] cleanup_net+0x3b2/0x830
[ 81.320816][ T71] process_one_work+0xe35/0x1650
[ 81.321005][ T71] worker_thread+0x591/0xcf0
[ 81.321179][ T71] kthread+0x37b/0x5f0
[ 81.321334][ T71] ret_from_fork+0x1db/0x270
[ 81.321536][ T71] ret_from_fork_asm+0x11/0x20
[ 81.321721][ T71]
[ 81.321826][ T71] The buggy address belongs to the object at ffff88800a169000
[ 81.321826][ T71] which belongs to the cache kmalloc-4k of size 4096
[ 81.322279][ T71] The buggy address is located 1708 bytes inside of
[ 81.322279][ T71] freed 4096-byte region [ffff88800a169000, ffff88800a16a000)
[ 81.322742][ T71]
[ 81.322850][ T71] The buggy address belongs to the physical page:
[ 81.323076][ T71] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa168
[ 81.323439][ T71] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 81.323729][ T71] flags: 0x80000000000040(head|node=0|zone=1)
[ 81.323983][ T71] page_type: f5(slab)
[ 81.324125][ T71] raw: 0080000000000040 ffff888001043700 ffffea0000236810 ffffea0000331410
[ 81.324505][ T71] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 81.324876][ T71] head: 0080000000000040 ffff888001043700 ffffea0000236810 ffffea0000331410
[ 81.325198][ T71] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 81.325591][ T71] head: 0080000000000003 ffffea0000285a01 00000000ffffffff 00000000ffffffff
[ 81.325953][ T71] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 81.326369][ T71] page dumped because: kasan: bad access detected
[ 81.326603][ T71]
[ 81.326694][ T71] Memory state around the buggy address:
[ 81.326914][ T71] ffff88800a169580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.327176][ T71] ffff88800a169600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.327481][ T71] >ffff88800a169680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.327764][ T71] ^
[ 81.327947][ T71] ffff88800a169700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.328205][ T71] ffff88800a169780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 81.328466][ T71] ==================================================================
[ 81.328911][ T71] Disabling lock debugging due to kernel taint
[ 81.329179][ T71] ------------[ cut here ]------------
[ 81.329367][ T71] refcount_t: underflow; use-after-free.
[ 81.329588][ T71] WARNING: CPU: 3 PID: 71 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 81.329978][ T71] Modules linked in: act_gact cls_flower sch_ingress macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel bridge stp llc vrf veth
[ 81.330495][ T71] CPU: 3 UID: 0 PID: 71 Comm: kworker/u16:1 Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 81.331480][ T71] Tainted: [B]=BAD_PAGE
[ 81.331649][ T71] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 81.331900][ T71] Workqueue: netns cleanup_net
[ 81.332103][ T71] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 81.332364][ T71] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d c5 a9 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 81.333035][ T71] RSP: 0018:ffffc900004c7a08 EFLAGS: 00010282
[ 81.333272][ T71] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 81.333569][ T71] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 81.333859][ T71] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff54be134
[ 81.334124][ T71] R10: 0000000000000003 R11: ffffc900004c7580 R12: 0000000000000001
[ 81.334415][ T71] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 81.334698][ T71] FS: 0000000000000000(0000) GS:ffff88808a972000(0000) knlGS:0000000000000000
[ 81.335038][ T71] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 81.335276][ T71] CR2: 00007ffcfc0b3f90 CR3: 00000000023e4005 CR4: 0000000000772ef0
[ 81.335569][ T71] PKRU: 55555554
[ 81.335716][ T71] Call Trace:
[ 81.335881][ T71]
[ 81.335991][ T71] netdev_run_todo+0x5f0/0xc60
[ 81.336177][ T71] ? rtnl_is_locked+0x15/0x20
[ 81.336374][ T71] ? dev_ingress_queue_create+0x190/0x190
[ 81.336568][ T71] ? generic_xdp_install+0x410/0x410
[ 81.336765][ T71] ops_undo_list+0x714/0x890
[ 81.336953][ T71] ? netns_get+0x110/0x110
[ 81.337130][ T71] ? cleanup_net+0x2d6/0x830
[ 81.337327][ T71] cleanup_net+0x3b2/0x830
[ 81.337521][ T71] ? net_passive_dec+0x190/0x190
[ 81.337698][ T71] ? rcu_is_watching+0x12/0xb0
[ 81.337906][ T71] process_one_work+0xe35/0x1650
[ 81.338086][ T71] ? pwq_dec_nr_in_flight+0x550/0x550
[ 81.338281][ T71] ? assign_work+0x168/0x240
[ 81.338499][ T71] worker_thread+0x591/0xcf0
[ 81.338725][ T71] ? rescuer_thread+0xd10/0xd10
[ 81.338956][ T71] kthread+0x37b/0x5f0
[ 81.339101][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.339345][ T71] ? ret_from_fork+0x1b/0x270
[ 81.339530][ T71] ? __lock_release+0x5d/0x170
[ 81.339743][ T71] ? rcu_is_watching+0x12/0xb0
[ 81.339974][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.340152][ T71] ret_from_fork+0x1db/0x270
[ 81.340353][ T71] ? kthread_is_per_cpu+0xc0/0xc0
[ 81.340559][ T71] ret_from_fork_asm+0x11/0x20
[ 81.340756][ T71]
[ 81.340903][ T71] irq event stamp: 89545
[ 81.341040][ T71] hardirqs last enabled at (89545): [] finish_task_switch.isra.0+0x245/0x960
[ 81.341431][ T71] hardirqs last disabled at (89544): [] __schedule+0x94a/0x1b10
[ 81.341770][ T71] softirqs last enabled at (89388): [] handle_softirqs+0x352/0x610
[ 81.342087][ T71] softirqs last disabled at (89381): [] irq_exit_rcu+0xab/0x100
[ 81.342461][ T71] ---[ end trace 0000000000000000 ]---
[ 82.887171][ T803] br1: left promiscuous mode
[ 83.471161][ T810] br1: port 4(veth2) entered disabled state
[ 83.577360][ T811] veth2: left allmulticast mode
[ 83.577646][ T811] veth2: left promiscuous mode
[ 83.578020][ T811] br1: port 4(veth2) entered disabled state
[ 83.751271][ T813] br1: port 3(veth1) entered disabled state
[ 83.828253][ T814] veth1: left allmulticast mode
[ 83.828518][ T814] veth1: left promiscuous mode
[ 83.828893][ T814] br1: port 3(veth1) entered disabled state
[ 84.011379][ T816] vx20: left allmulticast mode
[ 84.011697][ T816] vx20: left promiscuous mode
[ 84.013440][ T816] br1: port 2(vx20) entered disabled state
[ 84.395632][ T820] vx10: left allmulticast mode
[ 84.396434][ T820] vx10: left promiscuous mode
[ 84.397002][ T820] br1: port 1(vx10) entered disabled state