[ 19.616143][ T305] br1: port 1(veth1) entered blocking state
[ 19.616743][ T305] br1: port 1(veth1) entered disabled state
[ 19.617367][ T305] veth1: entered allmulticast mode
[ 19.620898][ T305] veth1: entered promiscuous mode
[ 19.716716][ T38] br1: port 1(veth1) entered blocking state
[ 19.717269][ T38] br1: port 1(veth1) entered forwarding state
[ 19.847671][ T309] br1: port 2(veth2) entered blocking state
[ 19.848097][ T309] br1: port 2(veth2) entered disabled state
[ 19.848494][ T309] veth2: entered allmulticast mode
[ 19.851877][ T309] veth2: entered promiscuous mode
[ 19.985525][ T38] br1: port 2(veth2) entered blocking state
[ 19.986001][ T38] br1: port 2(veth2) entered forwarding state
[ 28.340265][ T346] GACT probability NOT on
[ 31.684253][ C2] tc action pedit unable to extract header offset for header type (0x5)
[ 33.732212][ C3] tc action pedit unable to extract header offset for header type (0x5)
[ 51.651285][ C0] tc action pedit unable to extract header offset for header type (0x4)
[ 66.379447][ T737] br1: port 2(veth2) entered disabled state
[ 66.512601][ T738] veth2: left allmulticast mode
[ 66.512996][ T738] veth2: left promiscuous mode
[ 66.513504][ T738] br1: port 2(veth2) entered disabled state
[ 66.665452][ T739] br1: port 1(veth1) entered disabled state
[ 66.787814][ T740] veth1: left allmulticast mode
[ 66.788170][ T740] veth1: left promiscuous mode
[ 66.788658][ T740] br1: port 1(veth1) entered disabled state
[ 66.984059][ T741] ==================================================================
[ 66.984516][ T741] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 66.984929][ T741] Read of size 1 at addr ffff88800b4d26ac by task ip/741
[ 66.985222][ T741]
[ 66.985355][ T741] CPU: 3 UID: 0 PID: 741 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 66.985361][ T741] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 66.985364][ T741] Call Trace:
[ 66.985367][ T741]
[ 66.985369][ T741] dump_stack_lvl+0x82/0xc0
[ 66.985376][ T741] print_address_description.constprop.0+0x2c/0x3a0
[ 66.985386][ T741] ? kobject_put+0xbb/0xd0
[ 66.985392][ T741] print_report+0xb4/0x270
[ 66.985397][ T741] ? kobject_put+0xbb/0xd0
[ 66.985401][ T741] ? kasan_addr_to_slab+0x21/0x70
[ 66.985405][ T741] ? kobject_put+0xbb/0xd0
[ 66.985409][ T741] kasan_report+0xca/0x100
[ 66.985415][ T741] ? kobject_put+0xbb/0xd0
[ 66.985423][ T741] kobject_put+0xbb/0xd0
[ 66.985428][ T741] netdev_run_todo+0x5f0/0xc60
[ 66.985446][ T741] ? dev_ingress_queue_create+0x190/0x190
[ 66.985450][ T741] ? generic_xdp_install+0x410/0x410
[ 66.985454][ T741] ? kernfs_put.part.0+0x12d/0x480
[ 66.985463][ T741] ? unregister_netdevice_many+0x20/0x20
[ 66.985471][ T741] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 66.985526][ T741] rtnl_dellink+0x350/0xa30
[ 66.985535][ T741] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 66.985567][ T741] ? find_held_lock+0x2b/0x80
[ 66.985577][ T741] ? __lock_acquire+0x449/0x7e0
[ 66.985586][ T741] ? find_held_lock+0x2b/0x80
[ 66.985591][ T741] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 66.985595][ T741] ? __lock_release+0x5d/0x170
[ 66.985601][ T741] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 66.985606][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 66.985612][ T741] ? rtnl_port_fill+0x850/0x850
[ 66.985616][ T741] ? __lock_acquire+0x449/0x7e0
[ 66.985626][ T741] netlink_rcv_skb+0x121/0x340
[ 66.985631][ T741] ? rtnl_port_fill+0x850/0x850
[ 66.985637][ T741] ? netlink_ack+0xdd0/0xdd0
[ 66.985647][ T741] ? netlink_deliver_tap+0x13e/0x340
[ 66.985651][ T741] ? netlink_deliver_tap+0xc3/0x340
[ 66.985657][ T741] netlink_unicast+0x4aa/0x780
[ 66.985663][ T741] ? netlink_attachskb+0x810/0x810
[ 66.985669][ T741] ? __lock_acquire+0x449/0x7e0
[ 66.985677][ T741] netlink_sendmsg+0x714/0xbd0
[ 66.985684][ T741] ? netlink_unicast+0x780/0x780
[ 66.985689][ T741] ? __import_iovec+0x230/0x3b0
[ 66.985699][ T741] ? netlink_unicast+0x780/0x780
[ 66.985704][ T741] ____sys_sendmsg+0x3dd/0x890
[ 66.985711][ T741] ? get_timestamp.constprop.0+0x380/0x380
[ 66.985715][ T741] ? __copy_msghdr+0x3c0/0x3c0
[ 66.985726][ T741] ___sys_sendmsg+0xed/0x170
[ 66.985730][ T741] ? kasan_record_aux_stack+0x8c/0xa0
[ 66.985734][ T741] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 66.985744][ T741] ? copy_msghdr_from_user+0x110/0x110
[ 66.985752][ T741] ? find_held_lock+0x2b/0x80
[ 66.985758][ T741] ? __lock_acquire+0x449/0x7e0
[ 66.985767][ T741] ? find_held_lock+0x2b/0x80
[ 66.985772][ T741] ? __virt_addr_valid+0x22a/0x450
[ 66.985779][ T741] ? __lock_release+0x5d/0x170
[ 66.985789][ T741] __sys_sendmsg+0x10b/0x1a0
[ 66.985793][ T741] ? __call_rcu_common.constprop.0+0x318/0x630
[ 66.985798][ T741] ? __sys_sendmsg_sock+0x20/0x20
[ 66.985810][ T741] ? rcu_is_watching+0x12/0xb0
[ 66.985816][ T741] do_syscall_64+0xc1/0xfd0
[ 66.985823][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 66.985830][ T741] RIP: 0033:0x7f90111f11d7
[ 66.985836][ T741] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 66.985842][ T741] RSP: 002b:00007ffc6df770a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 66.985851][ T741] RAX: ffffffffffffffda RBX: 00007ffc6df777d0 RCX: 00007f90111f11d7
[ 66.985855][ T741] RDX: 0000000000000000 RSI: 00007ffc6df77110 RDI: 0000000000000005
[ 66.985857][ T741] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 66.985859][ T741] R10: 00007f90110edf60 R11: 0000000000000246 R12: 0000000000000002
[ 66.985862][ T741] R13: 00000000690df7f3 R14: 0000000000499600 R15: 0000000000000000
[ 66.985873][ T741]
[ 66.985874][ T741]
[ 67.004365][ T741] Allocated by task 303:
[ 67.004556][ T741] kasan_save_stack+0x24/0x40
[ 67.004825][ T741] kasan_save_track+0x14/0x30
[ 67.005074][ T741] __kasan_kmalloc+0x7b/0x90
[ 67.005320][ T741] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 67.005632][ T741] alloc_netdev_mqs+0x7d/0x1370
[ 67.005904][ T741] rtnl_create_link+0xa9e/0xe20
[ 67.006170][ T741] rtnl_newlink_create+0x203/0x770
[ 67.006434][ T741] __rtnl_newlink+0x231/0xa30
[ 67.006702][ T741] rtnl_newlink+0x693/0xa60
[ 67.006976][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 67.007220][ T741] netlink_rcv_skb+0x121/0x340
[ 67.007464][ T741] netlink_unicast+0x4aa/0x780
[ 67.007756][ T741] netlink_sendmsg+0x714/0xbd0
[ 67.008021][ T741] ____sys_sendmsg+0x3dd/0x890
[ 67.008286][ T741] ___sys_sendmsg+0xed/0x170
[ 67.008550][ T741] __sys_sendmsg+0x10b/0x1a0
[ 67.008812][ T741] do_syscall_64+0xc1/0xfd0
[ 67.009079][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 67.009407][ T741]
[ 67.009546][ T741] Freed by task 741:
[ 67.009751][ T741] kasan_save_stack+0x24/0x40
[ 67.010017][ T741] kasan_save_track+0x14/0x30
[ 67.010283][ T741] __kasan_save_free_info+0x3b/0x60
[ 67.010552][ T741] __kasan_slab_free+0x3f/0x60
[ 67.010817][ T741] kfree+0x21d/0x540
[ 67.011020][ T741] device_release+0x9c/0x210
[ 67.011292][ T741] kobject_cleanup+0xfe/0x360
[ 67.011557][ T741] netdev_run_todo+0x81f/0xc60
[ 67.011835][ T741] rtnl_dellink+0x350/0xa30
[ 67.012098][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 67.012363][ T741] netlink_rcv_skb+0x121/0x340
[ 67.012625][ T741] netlink_unicast+0x4aa/0x780
[ 67.012892][ T741] netlink_sendmsg+0x714/0xbd0
[ 67.013157][ T741] ____sys_sendmsg+0x3dd/0x890
[ 67.013421][ T741] ___sys_sendmsg+0xed/0x170
[ 67.013686][ T741] __sys_sendmsg+0x10b/0x1a0
[ 67.013956][ T741] do_syscall_64+0xc1/0xfd0
[ 67.014228][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 67.014561][ T741]
[ 67.014696][ T741] Last potentially related work creation:
[ 67.014963][ T741] kasan_save_stack+0x24/0x40
[ 67.015244][ T741] kasan_record_aux_stack+0x8c/0xa0
[ 67.015510][ T741] insert_work+0x34/0x230
[ 67.015655][ T741] __queue_work+0x5fd/0xab0
[ 67.015851][ T741] queue_work_on+0x84/0x90
[ 67.016046][ T741] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 67.016323][ T741] br_dev_uninit+0x19/0x40 [bridge]
[ 67.016519][ T741] unregister_netdevice_many_notify+0xa80/0x1b30
[ 67.016736][ T741] rtnl_dellink+0x344/0xa30
[ 67.016916][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 67.017088][ T741] netlink_rcv_skb+0x121/0x340
[ 67.017262][ T741] netlink_unicast+0x4aa/0x780
[ 67.017440][ T741] netlink_sendmsg+0x714/0xbd0
[ 67.017611][ T741] ____sys_sendmsg+0x3dd/0x890
[ 67.017790][ T741] ___sys_sendmsg+0xed/0x170
[ 67.017962][ T741] __sys_sendmsg+0x10b/0x1a0
[ 67.018130][ T741] do_syscall_64+0xc1/0xfd0
[ 67.018297][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 67.018518][ T741]
[ 67.018606][ T741] Second to last potentially related work creation:
[ 67.018816][ T741] kasan_save_stack+0x24/0x40
[ 67.018999][ T741] kasan_record_aux_stack+0x8c/0xa0
[ 67.019178][ T741] insert_work+0x34/0x230
[ 67.019305][ T741] __queue_work+0x5fd/0xab0
[ 67.019479][ T741] queue_work_on+0x84/0x90
[ 67.019648][ T741] br_multicast_del_mdb_entry+0x95d/0xfe0 [bridge]
[ 67.019885][ T741] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 67.020125][ T741] br_dev_uninit+0x19/0x40 [bridge]
[ 67.020335][ T741] unregister_netdevice_many_notify+0xa80/0x1b30
[ 67.020544][ T741] rtnl_dellink+0x344/0xa30
[ 67.020713][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 67.020879][ T741] netlink_rcv_skb+0x121/0x340
[ 67.021065][ T741] netlink_unicast+0x4aa/0x780
[ 67.021232][ T741] netlink_sendmsg+0x714/0xbd0
[ 67.021409][ T741] ____sys_sendmsg+0x3dd/0x890
[ 67.021576][ T741] ___sys_sendmsg+0xed/0x170
[ 67.021743][ T741] __sys_sendmsg+0x10b/0x1a0
[ 67.021912][ T741] do_syscall_64+0xc1/0xfd0
[ 67.022081][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 67.022290][ T741]
[ 67.022376][ T741] The buggy address belongs to the object at ffff88800b4d2000
[ 67.022376][ T741] which belongs to the cache kmalloc-8k of size 8192
[ 67.022782][ T741] The buggy address is located 1708 bytes inside of
[ 67.022782][ T741] freed 8192-byte region [ffff88800b4d2000, ffff88800b4d4000)
[ 67.023190][ T741]
[ 67.023280][ T741] The buggy address belongs to the physical page:
[ 67.023486][ T741] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb4d0
[ 67.023793][ T741] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 67.024048][ T741] flags: 0x80000000000040(head|node=0|zone=1)
[ 67.024269][ T741] page_type: f5(slab)
[ 67.024401][ T741] raw: 0080000000000040 ffff8880010438c0 ffffea00002d5010 ffff888001041228
[ 67.024705][ T741] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 67.025003][ T741] head: 0080000000000040 ffff8880010438c0 ffffea00002d5010 ffff888001041228
[ 67.025307][ T741] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 67.025623][ T741] head: 0080000000000003 ffffea00002d3401 00000000ffffffff 00000000ffffffff
[ 67.025920][ T741] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 67.026216][ T741] page dumped because: kasan: bad access detected
[ 67.026427][ T741]
[ 67.026512][ T741] Memory state around the buggy address:
[ 67.026680][ T741] ffff88800b4d2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 67.026940][ T741] ffff88800b4d2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 67.027179][ T741] >ffff88800b4d2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 67.027428][ T741] ^
[ 67.027594][ T741] ffff88800b4d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 67.027837][ T741] ffff88800b4d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 67.028076][ T741] ==================================================================
[ 67.028377][ T741] Disabling lock debugging due to kernel taint
[ 67.028585][ T741] ------------[ cut here ]------------
[ 67.028758][ T741] refcount_t: underflow; use-after-free.
[ 67.028967][ T741] WARNING: CPU: 3 PID: 741 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 67.029261][ T741] Modules linked in: act_gact act_pedit cls_flower bridge stp llc sch_ingress vrf veth
[ 67.029582][ T741] CPU: 3 UID: 0 PID: 741 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 67.030050][ T741] Tainted: [B]=BAD_PAGE
[ 67.030183][ T741] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 67.030389][ T741] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 67.030596][ T741] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 25 96 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 67.031198][ T741] RSP: 0018:ffffc900013cf1f0 EFLAGS: 00010286
[ 67.031409][ T741] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 67.031758][ T741] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 67.032015][ T741] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff2d7e134
[ 67.032367][ T741] R10: 0000000000000003 R11: ffffc900013ced80 R12: 0000000000000001
[ 67.032613][ T741] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 67.032860][ T741] FS: 00007f9011023800(0000) GS:ffff88809e372000(0000) knlGS:0000000000000000
[ 67.033156][ T741] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 67.033367][ T741] CR2: 00000000004e68d0 CR3: 000000000db9a005 CR4: 0000000000772ef0
[ 67.033631][ T741] PKRU: 55555554
[ 67.033904][ T741] Call Trace:
[ 67.034056][ T741]
[ 67.034175][ T741] netdev_run_todo+0x5f0/0xc60
[ 67.034353][ T741] ? dev_ingress_queue_create+0x190/0x190
[ 67.034525][ T741] ? generic_xdp_install+0x410/0x410
[ 67.034700][ T741] ? kernfs_put.part.0+0x12d/0x480
[ 67.034983][ T741] ? unregister_netdevice_many+0x20/0x20
[ 67.035156][ T741] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 67.035355][ T741] rtnl_dellink+0x350/0xa30
[ 67.035663][ T741] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 67.035918][ T741] ? find_held_lock+0x2b/0x80
[ 67.036124][ T741] ? __lock_acquire+0x449/0x7e0
[ 67.036316][ T741] ? find_held_lock+0x2b/0x80
[ 67.036503][ T741] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 67.036693][ T741] ? __lock_release+0x5d/0x170
[ 67.036985][ T741] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 67.037221][ T741] rtnetlink_rcv_msg+0x709/0xc00
[ 67.037408][ T741] ? rtnl_port_fill+0x850/0x850
[ 67.037700][ T741] ? __lock_acquire+0x449/0x7e0
[ 67.037895][ T741] netlink_rcv_skb+0x121/0x340
[ 67.038182][ T741] ? rtnl_port_fill+0x850/0x850
[ 67.038369][ T741] ? netlink_ack+0xdd0/0xdd0
[ 67.038563][ T741] ? netlink_deliver_tap+0x13e/0x340
[ 67.038745][ T741] ? netlink_deliver_tap+0xc3/0x340
[ 67.039034][ T741] netlink_unicast+0x4aa/0x780
[ 67.039223][ T741] ? netlink_attachskb+0x810/0x810
[ 67.039415][ T741] ? __lock_acquire+0x449/0x7e0
[ 67.039613][ T741] netlink_sendmsg+0x714/0xbd0
[ 67.039791][ T741] ? netlink_unicast+0x780/0x780
[ 67.039980][ T741] ? __import_iovec+0x230/0x3b0
[ 67.040167][ T741] ? netlink_unicast+0x780/0x780
[ 67.040355][ T741] ____sys_sendmsg+0x3dd/0x890
[ 67.040639][ T741] ? get_timestamp.constprop.0+0x380/0x380
[ 67.040876][ T741] ? __copy_msghdr+0x3c0/0x3c0
[ 67.041067][ T741] ___sys_sendmsg+0xed/0x170
[ 67.041253][ T741] ? kasan_record_aux_stack+0x8c/0xa0
[ 67.041539][ T741] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 67.041777][ T741] ? copy_msghdr_from_user+0x110/0x110
[ 67.041982][ T741] ? find_held_lock+0x2b/0x80
[ 67.042171][ T741] ? __lock_acquire+0x449/0x7e0
[ 67.042459][ T741] ? find_held_lock+0x2b/0x80
[ 67.042655][ T741] ? __virt_addr_valid+0x22a/0x450
[ 67.042847][ T741] ? __lock_release+0x5d/0x170
[ 67.043145][ T741] __sys_sendmsg+0x10b/0x1a0
[ 67.043339][ T741] ? __call_rcu_common.constprop.0+0x318/0x630
[ 67.043577][ T741] ? __sys_sendmsg_sock+0x20/0x20
[ 67.043765][ T741] ? rcu_is_watching+0x12/0xb0
[ 67.043960][ T741] do_syscall_64+0xc1/0xfd0
[ 67.044160][ T741] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 67.044395][ T741] RIP: 0033:0x7f90111f11d7
[ 67.044596][ T741] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 67.045378][ T741] RSP: 002b:00007ffc6df770a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 67.045790][ T741] RAX: ffffffffffffffda RBX: 00007ffc6df777d0 RCX: 00007f90111f11d7
[ 67.046090][ T741] RDX: 0000000000000000 RSI: 00007ffc6df77110 RDI: 0000000000000005
[ 67.046382][ T741] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 67.046761][ T741] R10: 00007f90110edf60 R11: 0000000000000246 R12: 0000000000000002
[ 67.047055][ T741] R13: 00000000690df7f3 R14: 0000000000499600 R15: 0000000000000000
[ 67.047346][ T741]
[ 67.047586][ T741] irq event stamp: 51161
[ 67.047730][ T741] hardirqs last enabled at (51161): [] irqentry_exit+0x3b/0x80
[ 67.048069][ T741] hardirqs last disabled at (51160): [] handle_softirqs+0x47f/0x610
[ 67.048501][ T741] softirqs last enabled at (51042): [] handle_softirqs+0x352/0x610
[ 67.048826][ T741] softirqs last disabled at (51035): [] irq_exit_rcu+0xab/0x100
[ 67.049251][ T741] ---[ end trace 0000000000000000 ]---