[ 22.812111][ T302] br1: port 1(veth1) entered blocking state
[ 22.812717][ T302] br1: port 1(veth1) entered disabled state
[ 22.813303][ T302] veth1: entered allmulticast mode
[ 22.817230][ T302] veth1: entered promiscuous mode
[ 22.956961][ T113] br1: port 1(veth1) entered blocking state
[ 22.957598][ T113] br1: port 1(veth1) entered forwarding state
[ 23.128369][ T306] br1: port 2(veth2) entered blocking state
[ 23.128968][ T306] br1: port 2(veth2) entered disabled state
[ 23.129441][ T306] veth2: entered allmulticast mode
[ 23.133309][ T306] veth2: entered promiscuous mode
[ 23.312692][ T35] br1: port 2(veth2) entered blocking state
[ 23.313293][ T35] br1: port 2(veth2) entered forwarding state
[ 32.306155][ T343] GACT probability NOT on
[ 35.363687][ C2] tc action pedit unable to extract header offset for header type (0x5)
[ 78.235053][ T734] br1: port 2(veth2) entered disabled state
[ 78.359703][ T735] veth2: left allmulticast mode
[ 78.360119][ T735] veth2: left promiscuous mode
[ 78.360719][ T735] br1: port 2(veth2) entered disabled state
[ 78.491562][ T736] br1: port 1(veth1) entered disabled state
[ 78.611708][ T737] veth1: left allmulticast mode
[ 78.612134][ T737] veth1: left promiscuous mode
[ 78.612689][ T737] br1: port 1(veth1) entered disabled state
[ 78.855738][ T738] ==================================================================
[ 78.856313][ T738] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 78.856789][ T738] Read of size 1 at addr ffff88800b8026ac by task ip/738
[ 78.857217][ T738]
[ 78.857396][ T738] CPU: 0 UID: 0 PID: 738 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 78.857405][ T738] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 78.857409][ T738] Call Trace:
[ 78.857415][ T738]
[ 78.857418][ T738] dump_stack_lvl+0x82/0xc0
[ 78.857432][ T738] print_address_description.constprop.0+0x2c/0x3a0
[ 78.857454][ T738] ? kobject_put+0xbb/0xd0
[ 78.857460][ T738] print_report+0xb4/0x270
[ 78.857466][ T738] ? kobject_put+0xbb/0xd0
[ 78.857471][ T738] ? kasan_addr_to_slab+0x21/0x70
[ 78.857477][ T738] ? kobject_put+0xbb/0xd0
[ 78.857482][ T738] kasan_report+0xca/0x100
[ 78.857488][ T738] ? kobject_put+0xbb/0xd0
[ 78.857499][ T738] kobject_put+0xbb/0xd0
[ 78.857505][ T738] netdev_run_todo+0x5f0/0xc60
[ 78.857513][ T738] ? dev_ingress_queue_create+0x190/0x190
[ 78.857519][ T738] ? generic_xdp_install+0x410/0x410
[ 78.857522][ T738] ? kernfs_put.part.0+0x12d/0x480
[ 78.857530][ T738] ? unregister_netdevice_many+0x20/0x20
[ 78.857540][ T738] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 78.857602][ T738] rtnl_dellink+0x350/0xa30
[ 78.857611][ T738] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 78.857651][ T738] ? find_held_lock+0x2b/0x80
[ 78.857668][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.857680][ T738] ? find_held_lock+0x2b/0x80
[ 78.857686][ T738] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 78.857690][ T738] ? __lock_release+0x5d/0x170
[ 78.857699][ T738] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 78.857705][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.857712][ T738] ? rtnl_port_fill+0x850/0x850
[ 78.857717][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.857730][ T738] netlink_rcv_skb+0x121/0x340
[ 78.857738][ T738] ? rtnl_port_fill+0x850/0x850
[ 78.857745][ T738] ? netlink_ack+0xdd0/0xdd0
[ 78.857758][ T738] ? netlink_deliver_tap+0x13e/0x340
[ 78.857762][ T738] ? netlink_deliver_tap+0xc3/0x340
[ 78.857770][ T738] netlink_unicast+0x4aa/0x780
[ 78.857778][ T738] ? netlink_attachskb+0x810/0x810
[ 78.857784][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.857794][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.857803][ T738] ? netlink_unicast+0x780/0x780
[ 78.857809][ T738] ? __import_iovec+0x230/0x3b0
[ 78.857822][ T738] ? netlink_unicast+0x780/0x780
[ 78.857829][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.857839][ T738] ? get_timestamp.constprop.0+0x380/0x380
[ 78.857846][ T738] ? __copy_msghdr+0x3c0/0x3c0
[ 78.857860][ T738] ___sys_sendmsg+0xed/0x170
[ 78.857865][ T738] ? kasan_record_aux_stack+0x8c/0xa0
[ 78.857871][ T738] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 78.857886][ T738] ? copy_msghdr_from_user+0x110/0x110
[ 78.857893][ T738] ? find_held_lock+0x2b/0x80
[ 78.857899][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.857906][ T738] ? find_held_lock+0x2b/0x80
[ 78.857911][ T738] ? __virt_addr_valid+0x22a/0x450
[ 78.857926][ T738] ? __lock_release+0x5d/0x170
[ 78.857937][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.857948][ T738] ? __call_rcu_common.constprop.0+0x318/0x630
[ 78.857964][ T738] ? __sys_sendmsg_sock+0x20/0x20
[ 78.857978][ T738] ? rcu_is_watching+0x12/0xb0
[ 78.857987][ T738] do_syscall_64+0xc1/0xfd0
[ 78.857996][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.858009][ T738] RIP: 0033:0x7fe2ff4d51d7
[ 78.858017][ T738] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 78.858023][ T738] RSP: 002b:00007fff9a1fc108 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 78.858032][ T738] RAX: ffffffffffffffda RBX: 00007fff9a1fc830 RCX: 00007fe2ff4d51d7
[ 78.858036][ T738] RDX: 0000000000000000 RSI: 00007fff9a1fc170 RDI: 0000000000000005
[ 78.858040][ T738] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 78.858042][ T738] R10: 00007fe2ff3d1f60 R11: 0000000000000246 R12: 0000000000000002
[ 78.858045][ T738] R13: 00000000690decad R14: 0000000000499600 R15: 0000000000000000
[ 78.858057][ T738]
[ 78.858059][ T738]
[ 78.882615][ T738] Allocated by task 300:
[ 78.882919][ T738] kasan_save_stack+0x24/0x40
[ 78.883439][ T738] kasan_save_track+0x14/0x30
[ 78.883740][ T738] __kasan_kmalloc+0x7b/0x90
[ 78.884031][ T738] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 78.884323][ T738] alloc_netdev_mqs+0x7d/0x1370
[ 78.884800][ T738] rtnl_create_link+0xa9e/0xe20
[ 78.885080][ T738] rtnl_newlink_create+0x203/0x770
[ 78.885427][ T738] __rtnl_newlink+0x231/0xa30
[ 78.885713][ T738] rtnl_newlink+0x693/0xa60
[ 78.886021][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.886343][ T738] netlink_rcv_skb+0x121/0x340
[ 78.886674][ T738] netlink_unicast+0x4aa/0x780
[ 78.886971][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.887506][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.887838][ T738] ___sys_sendmsg+0xed/0x170
[ 78.888173][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.888500][ T738] do_syscall_64+0xc1/0xfd0
[ 78.889052][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.889478][ T738]
[ 78.889616][ T738] Freed by task 738:
[ 78.889823][ T738] kasan_save_stack+0x24/0x40
[ 78.890390][ T738] kasan_save_track+0x14/0x30
[ 78.890692][ T738] __kasan_save_free_info+0x3b/0x60
[ 78.891199][ T738] __kasan_slab_free+0x3f/0x60
[ 78.891560][ T738] kfree+0x21d/0x540
[ 78.891998][ T738] device_release+0x9c/0x210
[ 78.892349][ T738] kobject_cleanup+0xfe/0x360
[ 78.892646][ T738] netdev_run_todo+0x81f/0xc60
[ 78.892961][ T738] rtnl_dellink+0x350/0xa30
[ 78.893489][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.893781][ T738] netlink_rcv_skb+0x121/0x340
[ 78.894106][ T738] netlink_unicast+0x4aa/0x780
[ 78.894410][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.894720][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.895041][ T738] ___sys_sendmsg+0xed/0x170
[ 78.895334][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.895644][ T738] do_syscall_64+0xc1/0xfd0
[ 78.896163][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.896564][ T738]
[ 78.896722][ T738] Last potentially related work creation:
[ 78.897048][ T738] kasan_save_stack+0x24/0x40
[ 78.897386][ T738] kasan_record_aux_stack+0x8c/0xa0
[ 78.898028][ T738] insert_work+0x34/0x230
[ 78.898262][ T738] __queue_work+0x5fd/0xab0
[ 78.898559][ T738] queue_work_on+0x84/0x90
[ 78.898897][ T738] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 78.899556][ T738] br_dev_uninit+0x19/0x40 [bridge]
[ 78.899954][ T738] unregister_netdevice_many_notify+0xa80/0x1b30
[ 78.900381][ T738] rtnl_dellink+0x344/0xa30
[ 78.900902][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.901239][ T738] netlink_rcv_skb+0x121/0x340
[ 78.901544][ T738] netlink_unicast+0x4aa/0x780
[ 78.901865][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.902437][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.902758][ T738] ___sys_sendmsg+0xed/0x170
[ 78.903112][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.903452][ T738] do_syscall_64+0xc1/0xfd0
[ 78.903781][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.904205][ T738]
[ 78.904380][ T738] Second to last potentially related work creation:
[ 78.904769][ T738] kasan_save_stack+0x24/0x40
[ 78.905135][ T738] kasan_record_aux_stack+0x8c/0xa0
[ 78.905471][ T738] insert_work+0x34/0x230
[ 78.905916][ T738] __queue_work+0x5fd/0xab0
[ 78.906213][ T738] queue_work_on+0x84/0x90
[ 78.906513][ T738] br_multicast_del_mdb_entry+0x95d/0xfe0 [bridge]
[ 78.907160][ T738] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 78.907606][ T738] br_dev_uninit+0x19/0x40 [bridge]
[ 78.907954][ T738] unregister_netdevice_many_notify+0xa80/0x1b30
[ 78.908572][ T738] rtnl_dellink+0x344/0xa30
[ 78.908881][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.909153][ T738] netlink_rcv_skb+0x121/0x340
[ 78.909473][ T738] netlink_unicast+0x4aa/0x780
[ 78.910004][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.910346][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.910684][ T738] ___sys_sendmsg+0xed/0x170
[ 78.910979][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.911508][ T738] do_syscall_64+0xc1/0xfd0
[ 78.911820][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.912225][ T738]
[ 78.912425][ T738] The buggy address belongs to the object at ffff88800b802000
[ 78.912425][ T738] which belongs to the cache kmalloc-8k of size 8192
[ 78.913404][ T738] The buggy address is located 1708 bytes inside of
[ 78.913404][ T738] freed 8192-byte region [ffff88800b802000, ffff88800b804000)
[ 78.914371][ T738]
[ 78.914525][ T738] The buggy address belongs to the physical page:
[ 78.914970][ T738] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb800
[ 78.915543][ T738] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.916250][ T738] flags: 0x80000000000040(head|node=0|zone=1)
[ 78.916658][ T738] page_type: f5(slab)
[ 78.916919][ T738] raw: 0080000000000040 ffff8880010438c0 ffffea0000139810 ffff888001041228
[ 78.917747][ T738] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 78.918354][ T738] head: 0080000000000040 ffff8880010438c0 ffffea0000139810 ffff888001041228
[ 78.918904][ T738] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 78.919470][ T738] head: 0080000000000003 ffffea00002e0001 00000000ffffffff 00000000ffffffff
[ 78.920235][ T738] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 78.920774][ T738] page dumped because: kasan: bad access detected
[ 78.921109][ T738]
[ 78.921298][ T738] Memory state around the buggy address:
[ 78.921765][ T738] ffff88800b802580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.922428][ T738] ffff88800b802600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.922883][ T738] >ffff88800b802680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.923306][ T738] ^
[ 78.923569][ T738] ffff88800b802700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.924034][ T738] ffff88800b802780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.924493][ T738] ==================================================================
[ 78.925722][ T738] Disabling lock debugging due to kernel taint
[ 78.926249][ T738] ------------[ cut here ]------------
[ 78.926489][ T738] refcount_t: underflow; use-after-free.
[ 78.928001][ T738] WARNING: CPU: 3 PID: 738 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 78.928433][ T738] Modules linked in: act_gact act_pedit cls_flower bridge stp llc sch_ingress vrf veth
[ 78.928970][ T738] CPU: 3 UID: 0 PID: 738 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 78.929341][ T738] Tainted: [B]=BAD_PAGE
[ 78.929470][ T738] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 78.929760][ T738] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 78.930062][ T738] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d c5 a0 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 78.930825][ T738] RSP: 0018:ffffc900013bf1f0 EFLAGS: 00010286
[ 78.931085][ T738] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 78.931393][ T738] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 78.931697][ T738] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff42be134
[ 78.931992][ T738] R10: 0000000000000003 R11: ffffc900013bed80 R12: 0000000000000001
[ 78.932311][ T738] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 78.932580][ T738] FS: 00007fe2ff307800(0000) GS:ffff888093972000(0000) knlGS:0000000000000000
[ 78.932958][ T738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 78.933210][ T738] CR2: 00007f8a55457760 CR3: 0000000004fb9003 CR4: 0000000000772ef0
[ 78.933502][ T738] PKRU: 55555554
[ 78.933680][ T738] Call Trace:
[ 78.933830][ T738]
[ 78.933939][ T738] netdev_run_todo+0x5f0/0xc60
[ 78.934192][ T738] ? dev_ingress_queue_create+0x190/0x190
[ 78.934424][ T738] ? generic_xdp_install+0x410/0x410
[ 78.934621][ T738] ? kernfs_put.part.0+0x12d/0x480
[ 78.934823][ T738] ? unregister_netdevice_many+0x20/0x20
[ 78.935015][ T738] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 78.935256][ T738] rtnl_dellink+0x350/0xa30
[ 78.935499][ T738] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 78.935881][ T738] ? find_held_lock+0x2b/0x80
[ 78.936143][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.936464][ T738] ? find_held_lock+0x2b/0x80
[ 78.936747][ T738] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 78.937055][ T738] ? __lock_release+0x5d/0x170
[ 78.937344][ T738] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 78.937699][ T738] rtnetlink_rcv_msg+0x709/0xc00
[ 78.937993][ T738] ? rtnl_port_fill+0x850/0x850
[ 78.938291][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.938623][ T738] netlink_rcv_skb+0x121/0x340
[ 78.938933][ T738] ? rtnl_port_fill+0x850/0x850
[ 78.939253][ T738] ? netlink_ack+0xdd0/0xdd0
[ 78.939541][ T738] ? netlink_deliver_tap+0x13e/0x340
[ 78.939791][ T738] ? netlink_deliver_tap+0xc3/0x340
[ 78.940086][ T738] netlink_unicast+0x4aa/0x780
[ 78.940368][ T738] ? netlink_attachskb+0x810/0x810
[ 78.940685][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.940974][ T738] netlink_sendmsg+0x714/0xbd0
[ 78.941282][ T738] ? netlink_unicast+0x780/0x780
[ 78.941570][ T738] ? __import_iovec+0x230/0x3b0
[ 78.941863][ T738] ? netlink_unicast+0x780/0x780
[ 78.942155][ T738] ____sys_sendmsg+0x3dd/0x890
[ 78.942447][ T738] ? get_timestamp.constprop.0+0x380/0x380
[ 78.942826][ T738] ? __copy_msghdr+0x3c0/0x3c0
[ 78.943044][ T738] ___sys_sendmsg+0xed/0x170
[ 78.943222][ T738] ? kasan_record_aux_stack+0x8c/0xa0
[ 78.943459][ T738] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 78.943718][ T738] ? copy_msghdr_from_user+0x110/0x110
[ 78.943897][ T738] ? find_held_lock+0x2b/0x80
[ 78.944129][ T738] ? __lock_acquire+0x449/0x7e0
[ 78.944309][ T738] ? find_held_lock+0x2b/0x80
[ 78.944494][ T738] ? __virt_addr_valid+0x22a/0x450
[ 78.944684][ T738] ? __lock_release+0x5d/0x170
[ 78.944868][ T738] __sys_sendmsg+0x10b/0x1a0
[ 78.945094][ T738] ? __call_rcu_common.constprop.0+0x318/0x630
[ 78.945320][ T738] ? __sys_sendmsg_sock+0x20/0x20
[ 78.945516][ T738] ? rcu_is_watching+0x12/0xb0
[ 78.945717][ T738] do_syscall_64+0xc1/0xfd0
[ 78.945909][ T738] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 78.946181][ T738] RIP: 0033:0x7fe2ff4d51d7
[ 78.946397][ T738] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 78.947044][ T738] RSP: 002b:00007fff9a1fc108 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 78.947318][ T738] RAX: ffffffffffffffda RBX: 00007fff9a1fc830 RCX: 00007fe2ff4d51d7
[ 78.947591][ T738] RDX: 0000000000000000 RSI: 00007fff9a1fc170 RDI: 0000000000000005
[ 78.947862][ T738] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 78.948131][ T738] R10: 00007fe2ff3d1f60 R11: 0000000000000246 R12: 0000000000000002
[ 78.948409][ T738] R13: 00000000690decad R14: 0000000000499600 R15: 0000000000000000
[ 78.948749][ T738]
[ 78.948943][ T738] irq event stamp: 48749
[ 78.949136][ T738] hardirqs last enabled at (48749): [] finish_task_switch.isra.0+0x245/0x960
[ 78.949626][ T738] hardirqs last disabled at (48748): [] __schedule+0x94a/0x1b10
[ 78.950099][ T738] softirqs last enabled at (48680): [] handle_softirqs+0x352/0x610
[ 78.950520][ T738] softirqs last disabled at (48675): [] irq_exit_rcu+0xab/0x100
[ 78.950903][ T738] ---[ end trace 0000000000000000 ]---