[ 14.712678][ T252] ip (252) used greatest stack depth: 23376 bytes left [ 17.903663][ T294] 8021q: 802.1Q VLAN Support v1.8 [ 20.346194][ T319] lag2: Mode changed to "loadbalance" [ 20.592017][ T322] lag2: Port device veth3 added [ 20.985630][ T327] lag2: Port device veth5 added [ 21.211322][ T329] 8021q: adding VLAN 0 to HW filter on device lag2 [ 21.351663][ T330] 8021q: adding VLAN 0 to HW filter on device lag2 [ 21.913142][ T335] gre: GRE over IPv4 demultiplexer driver [ 21.931140][ T335] ip_gre: GRE over IPv4 tunneling driver [ 24.520518][ T362] lag1: Mode changed to "loadbalance" [ 24.822183][ T365] lag1: Port device veth2 added [ 25.180231][ T368] lag1: Port device veth4 added [ 25.398089][ T370] 8021q: adding VLAN 0 to HW filter on device lag1 [ 32.361917][ T398] Mirror/redirect action on [ 32.648417][ T401] GACT probability NOT on [ 32.787638][ T402] lag2: Port device veth5 removed [ 37.119255][ T412] lag2: Port device veth3 removed [ 42.333164][ T319] ================================================================== [ 42.333561][ T319] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0 [ 42.333827][ T319] Read of size 1 at addr ffff888008fe46ac by task teamd/319 [ 42.334066][ T319] [ 42.334157][ T319] CPU: 3 UID: 0 PID: 319 Comm: teamd Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full) [ 42.334162][ T319] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 42.334164][ T319] Call Trace: [ 42.334166][ T319] [ 42.334167][ T319] dump_stack_lvl+0x82/0xc0 [ 42.334173][ T319] print_address_description.constprop.0+0x2c/0x3a0 [ 42.334180][ T319] ? kobject_put+0xbb/0xd0 [ 42.334184][ T319] print_report+0xb4/0x270 [ 42.334187][ T319] ? kobject_put+0xbb/0xd0 [ 42.334190][ T319] ? kasan_addr_to_slab+0x21/0x70 [ 42.334193][ T319] ? kobject_put+0xbb/0xd0 [ 42.334196][ T319] kasan_report+0xca/0x100 [ 42.334200][ T319] ? kobject_put+0xbb/0xd0 [ 42.334205][ T319] kobject_put+0xbb/0xd0 [ 42.334209][ T319] netdev_run_todo+0x5f0/0xc60 [ 42.334214][ T319] ? dev_ingress_queue_create+0x190/0x190 [ 42.334217][ T319] ? generic_xdp_install+0x410/0x410 [ 42.334220][ T319] ? unregister_netdevice_many+0x20/0x20 [ 42.334223][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.334230][ T319] rtnl_dellink+0x350/0xa30 [ 42.334235][ T319] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 42.334254][ T319] ? find_held_lock+0x2b/0x80 [ 42.334261][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.334271][ T319] ? find_held_lock+0x2b/0x80 [ 42.334278][ T319] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 42.334282][ T319] ? __lock_release+0x5d/0x170 [ 42.334290][ T319] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 42.334296][ T319] rtnetlink_rcv_msg+0x709/0xc00 [ 42.334302][ T319] ? rtnl_port_fill+0x850/0x850 [ 42.334307][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.334319][ T319] netlink_rcv_skb+0x121/0x340 [ 42.334326][ T319] ? rtnl_port_fill+0x850/0x850 [ 42.334332][ T319] ? netlink_ack+0xdd0/0xdd0 [ 42.334344][ T319] ? netlink_deliver_tap+0x13e/0x340 [ 42.334349][ T319] ? netlink_deliver_tap+0xc3/0x340 [ 42.334356][ T319] netlink_unicast+0x4aa/0x780 [ 42.334364][ T319] ? netlink_attachskb+0x810/0x810 [ 42.334370][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.334379][ T319] netlink_sendmsg+0x714/0xbd0 [ 42.334387][ T319] ? netlink_unicast+0x780/0x780 [ 42.334392][ T319] ? __import_iovec+0x230/0x3b0 [ 42.334402][ T319] ? netlink_unicast+0x780/0x780 [ 42.334407][ T319] ____sys_sendmsg+0x3dd/0x890 [ 42.334414][ T319] ? get_timestamp.constprop.0+0x380/0x380 [ 42.334418][ T319] ? __copy_msghdr+0x3c0/0x3c0 [ 42.334425][ T319] ___sys_sendmsg+0xed/0x170 [ 42.334430][ T319] ? copy_msghdr_from_user+0x110/0x110 [ 42.334434][ T319] ? do_pte_missing+0xec0/0xec0 [ 42.334438][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.334444][ T319] ? __handle_mm_fault+0x3fc/0x5d0 [ 42.334448][ T319] ? __pmd_alloc+0x700/0x700 [ 42.334454][ T319] ? lock_vma_under_rcu+0x2d/0x3d0 [ 42.334456][ T319] ? lock_vma_under_rcu+0x138/0x3d0 [ 42.334460][ T319] __sys_sendmsg+0x10b/0x1a0 [ 42.334464][ T319] ? __sys_sendmsg_sock+0x20/0x20 [ 42.334467][ T319] ? exc_page_fault+0x65/0xd0 [ 42.334474][ T319] ? do_user_addr_fault+0x955/0xe00 [ 42.334480][ T319] ? rcu_is_watching+0x12/0xb0 [ 42.334485][ T319] do_syscall_64+0xc1/0xfd0 [ 42.334490][ T319] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.334494][ T319] RIP: 0033:0x7f226d08f1d7 [ 42.334499][ T319] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 42.334502][ T319] RSP: 002b:00007ffc61ee6de8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 42.334506][ T319] RAX: ffffffffffffffda RBX: 0000000034256320 RCX: 00007f226d08f1d7 [ 42.334508][ T319] RDX: 0000000000000000 RSI: 00007ffc61ee6e20 RDI: 0000000000000005 [ 42.334510][ T319] RBP: 0000000034256230 R08: 0000000000000003 R09: 0000000000000000 [ 42.334511][ T319] R10: 0000000000000200 R11: 0000000000000246 R12: 0000000034256690 [ 42.334513][ T319] R13: 00007ffc61ee6e20 R14: 0000000000000000 R15: 00007ffc61ee6f80 [ 42.334519][ T319] [ 42.334521][ T319] [ 42.348649][ T319] Allocated by task 319: [ 42.348776][ T319] kasan_save_stack+0x24/0x40 [ 42.348950][ T319] kasan_save_track+0x14/0x30 [ 42.349219][ T319] __kasan_kmalloc+0x7b/0x90 [ 42.349398][ T319] __kvmalloc_node_noprof+0x2e5/0x8e0 [ 42.349587][ T319] alloc_netdev_mqs+0x7d/0x1370 [ 42.349858][ T319] rtnl_create_link+0xa9e/0xe20 [ 42.350025][ T319] rtnl_newlink_create+0x203/0x770 [ 42.350188][ T319] __rtnl_newlink+0x231/0xa30 [ 42.350507][ T319] rtnl_newlink+0x693/0xa60 [ 42.350781][ T319] rtnetlink_rcv_msg+0x709/0xc00 [ 42.350953][ T319] netlink_rcv_skb+0x121/0x340 [ 42.351120][ T319] netlink_unicast+0x4aa/0x780 [ 42.351283][ T319] netlink_sendmsg+0x714/0xbd0 [ 42.351453][ T319] ____sys_sendmsg+0x3dd/0x890 [ 42.351625][ T319] ___sys_sendmsg+0xed/0x170 [ 42.351905][ T319] __sys_sendmsg+0x10b/0x1a0 [ 42.352084][ T319] do_syscall_64+0xc1/0xfd0 [ 42.352253][ T319] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.352476][ T319] [ 42.352559][ T319] Freed by task 319: [ 42.352680][ T319] kasan_save_stack+0x24/0x40 [ 42.352946][ T319] kasan_save_track+0x14/0x30 [ 42.353111][ T319] __kasan_save_free_info+0x3b/0x60 [ 42.353372][ T319] __kasan_slab_free+0x3f/0x60 [ 42.353555][ T319] kfree+0x21d/0x540 [ 42.353681][ T319] device_release+0x9c/0x210 [ 42.353854][ T319] kobject_cleanup+0xfe/0x360 [ 42.354120][ T319] netdev_run_todo+0x81f/0xc60 [ 42.354300][ T319] rtnl_dellink+0x350/0xa30 [ 42.354477][ T319] rtnetlink_rcv_msg+0x709/0xc00 [ 42.354644][ T319] netlink_rcv_skb+0x121/0x340 [ 42.354908][ T319] netlink_unicast+0x4aa/0x780 [ 42.355079][ T319] netlink_sendmsg+0x714/0xbd0 [ 42.355249][ T319] ____sys_sendmsg+0x3dd/0x890 [ 42.355426][ T319] ___sys_sendmsg+0xed/0x170 [ 42.355693][ T319] __sys_sendmsg+0x10b/0x1a0 [ 42.355858][ T319] do_syscall_64+0xc1/0xfd0 [ 42.356025][ T319] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.356229][ T319] [ 42.356313][ T319] The buggy address belongs to the object at ffff888008fe4000 [ 42.356313][ T319] which belongs to the cache kmalloc-4k of size 4096 [ 42.356817][ T319] The buggy address is located 1708 bytes inside of [ 42.356817][ T319] freed 4096-byte region [ffff888008fe4000, ffff888008fe5000) [ 42.357307][ T319] [ 42.357398][ T319] The buggy address belongs to the physical page: [ 42.357614][ T319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8fe0 [ 42.358027][ T319] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 42.358338][ T319] flags: 0x80000000000040(head|node=0|zone=1) [ 42.358602][ T319] page_type: f5(slab) [ 42.358735][ T319] raw: 0080000000000040 ffff888001043700 ffffea00001d0010 ffffea0000202610 [ 42.359229][ T319] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 42.359608][ T319] head: 0080000000000040 ffff888001043700 ffffea00001d0010 ffffea0000202610 [ 42.360014][ T319] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 42.360339][ T319] head: 0080000000000003 ffffea000023f801 00000000ffffffff 00000000ffffffff [ 42.360793][ T319] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 42.361162][ T319] page dumped because: kasan: bad access detected [ 42.361367][ T319] [ 42.361521][ T319] Memory state around the buggy address: [ 42.361706][ T319] ffff888008fe4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.362041][ T319] ffff888008fe4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.362377][ T319] >ffff888008fe4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.362719][ T319] ^ [ 42.362891][ T319] ffff888008fe4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.363219][ T319] ffff888008fe4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.363494][ T319] ================================================================== [ 42.364386][ T319] Disabling lock debugging due to kernel taint [ 42.365261][ T319] ------------[ cut here ]------------ [ 42.365449][ T319] refcount_t: underflow; use-after-free. [ 42.365671][ T319] WARNING: CPU: 3 PID: 319 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0 [ 42.366017][ T319] Modules linked in: act_gact act_mirred cls_flower sch_ingress ip_gre gre 8021q vrf veth [ 42.366401][ T319] CPU: 3 UID: 0 PID: 319 Comm: teamd Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full) [ 42.367722][ T319] Tainted: [B]=BAD_PAGE [ 42.367879][ T319] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 42.368159][ T319] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0 [ 42.368375][ T319] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 45 9c e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff [ 42.369235][ T319] RSP: 0018:ffffc900006c71f0 EFLAGS: 00010286 [ 42.369531][ T319] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 42.369777][ T319] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 42.370015][ T319] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff39be134 [ 42.370258][ T319] R10: 0000000000000003 R11: ffffc900006c6d80 R12: 0000000000000001 [ 42.370675][ T319] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 42.370991][ T319] FS: 00007f226cf4eb80(0000) GS:ffff888098172000(0000) knlGS:0000000000000000 [ 42.371273][ T319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.371704][ T319] CR2: 00007fcf15b9f000 CR3: 00000000142da002 CR4: 0000000000772ef0 [ 42.371990][ T319] PKRU: 55555554 [ 42.372114][ T319] Call Trace: [ 42.372234][ T319] [ 42.372326][ T319] netdev_run_todo+0x5f0/0xc60 [ 42.372576][ T319] ? dev_ingress_queue_create+0x190/0x190 [ 42.372738][ T319] ? generic_xdp_install+0x410/0x410 [ 42.372898][ T319] ? unregister_netdevice_many+0x20/0x20 [ 42.373069][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.373235][ T319] rtnl_dellink+0x350/0xa30 [ 42.373406][ T319] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 42.373691][ T319] ? find_held_lock+0x2b/0x80 [ 42.373854][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.374019][ T319] ? find_held_lock+0x2b/0x80 [ 42.374176][ T319] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 42.374334][ T319] ? __lock_release+0x5d/0x170 [ 42.374591][ T319] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 42.374792][ T319] rtnetlink_rcv_msg+0x709/0xc00 [ 42.374953][ T319] ? rtnl_port_fill+0x850/0x850 [ 42.375148][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.375419][ T319] netlink_rcv_skb+0x121/0x340 [ 42.375829][ T319] ? rtnl_port_fill+0x850/0x850 [ 42.376098][ T319] ? netlink_ack+0xdd0/0xdd0 [ 42.376374][ T319] ? netlink_deliver_tap+0x13e/0x340 [ 42.376672][ T319] ? netlink_deliver_tap+0xc3/0x340 [ 42.376850][ T319] netlink_unicast+0x4aa/0x780 [ 42.377028][ T319] ? netlink_attachskb+0x810/0x810 [ 42.377249][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.377548][ T319] netlink_sendmsg+0x714/0xbd0 [ 42.377746][ T319] ? netlink_unicast+0x780/0x780 [ 42.377954][ T319] ? __import_iovec+0x230/0x3b0 [ 42.378165][ T319] ? netlink_unicast+0x780/0x780 [ 42.378356][ T319] ____sys_sendmsg+0x3dd/0x890 [ 42.378656][ T319] ? get_timestamp.constprop.0+0x380/0x380 [ 42.378921][ T319] ? __copy_msghdr+0x3c0/0x3c0 [ 42.379103][ T319] ___sys_sendmsg+0xed/0x170 [ 42.379281][ T319] ? copy_msghdr_from_user+0x110/0x110 [ 42.379565][ T319] ? do_pte_missing+0xec0/0xec0 [ 42.379747][ T319] ? __lock_acquire+0x449/0x7e0 [ 42.379936][ T319] ? __handle_mm_fault+0x3fc/0x5d0 [ 42.380111][ T319] ? __pmd_alloc+0x700/0x700 [ 42.380290][ T319] ? lock_vma_under_rcu+0x2d/0x3d0 [ 42.380547][ T319] ? lock_vma_under_rcu+0x138/0x3d0 [ 42.380724][ T319] __sys_sendmsg+0x10b/0x1a0 [ 42.380903][ T319] ? __sys_sendmsg_sock+0x20/0x20 [ 42.381080][ T319] ? exc_page_fault+0x65/0xd0 [ 42.381264][ T319] ? do_user_addr_fault+0x955/0xe00 [ 42.381522][ T319] ? rcu_is_watching+0x12/0xb0 [ 42.381704][ T319] do_syscall_64+0xc1/0xfd0 [ 42.381896][ T319] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.382116][ T319] RIP: 0033:0x7f226d08f1d7 [ 42.382300][ T319] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 42.383038][ T319] RSP: 002b:00007ffc61ee6de8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 42.383309][ T319] RAX: ffffffffffffffda RBX: 0000000034256320 RCX: 00007f226d08f1d7 [ 42.383817][ T319] RDX: 0000000000000000 RSI: 00007ffc61ee6e20 RDI: 0000000000000005 [ 42.384088][ T319] RBP: 0000000034256230 R08: 0000000000000003 R09: 0000000000000000 [ 42.384374][ T319] R10: 0000000000000200 R11: 0000000000000246 R12: 0000000034256690 [ 42.384712][ T319] R13: 00007ffc61ee6e20 R14: 0000000000000000 R15: 00007ffc61ee6f80 [ 42.385001][ T319] [ 42.385135][ T319] irq event stamp: 119627 [ 42.385287][ T319] hardirqs last enabled at (119627): [] finish_task_switch.isra.0+0x245/0x960 [ 42.385741][ T319] hardirqs last disabled at (119626): [] __schedule+0x94a/0x1b10 [ 42.386021][ T319] softirqs last enabled at (119170): [] handle_softirqs+0x352/0x610 [ 42.386313][ T319] softirqs last disabled at (119161): [] irq_exit_rcu+0xab/0x100 [ 42.386875][ T319] ---[ end trace 0000000000000000 ]--- [ 42.752165][ T442] lag2: Mode changed to "loadbalance" [ 42.896461][ T445] lag2: Port device veth3 added [ 43.171830][ T450] lag2: Port device veth5 added [ 43.310519][ T452] 8021q: adding VLAN 0 to HW filter on device lag2 [ 43.402383][ T453] 8021q: adding VLAN 0 to HW filter on device lag2 [ 49.678851][ T487] lag2: Port device veth3 removed [ 53.688876][ T497] lag2: Port device veth5 removed [ 58.635931][ T527] lag2: Mode changed to "loadbalance" [ 58.826766][ T530] lag2: Port device veth3 added [ 59.099885][ T535] lag2: Port device veth5 added [ 59.233940][ T537] 8021q: adding VLAN 0 to HW filter on device lag2 [ 59.315757][ T538] 8021q: adding VLAN 0 to HW filter on device lag2 [ 65.547069][ T362] lag1: Port device veth4 removed [ 65.558642][ T362] lag1: Port device veth2 removed [ 66.917619][ T527] lag2: Port device veth5 removed [ 66.920073][ T527] lag2: Port device veth3 removed