[ 18.598981][ T253] ip (253) used greatest stack depth: 24256 bytes left
[ 27.419297][ T329] br1: port 1(vx10) entered blocking state
[ 27.420327][ T329] br1: port 1(vx10) entered disabled state
[ 27.421254][ T329] vx10: entered allmulticast mode
[ 27.428368][ T329] vx10: entered promiscuous mode
[ 27.429962][ T329] br1: port 1(vx10) entered blocking state
[ 27.430829][ T329] br1: port 1(vx10) entered forwarding state
[ 28.016575][ T334] br1: port 2(vx20) entered blocking state
[ 28.017092][ T334] br1: port 2(vx20) entered disabled state
[ 28.017742][ T334] vx20: entered allmulticast mode
[ 28.021930][ T334] vx20: entered promiscuous mode
[ 28.023204][ T334] br1: port 2(vx20) entered blocking state
[ 28.023886][ T334] br1: port 2(vx20) entered forwarding state
[ 28.305916][ T336] br1: port 3(veth1) entered blocking state
[ 28.306509][ T336] br1: port 3(veth1) entered disabled state
[ 28.307035][ T336] veth1: entered allmulticast mode
[ 28.311106][ T336] veth1: entered promiscuous mode
[ 28.479115][ T71] br1: port 3(veth1) entered blocking state
[ 28.480159][ T71] br1: port 3(veth1) entered forwarding state
[ 28.635407][ T338] br1: port 4(veth2) entered blocking state
[ 28.636123][ T338] br1: port 4(veth2) entered disabled state
[ 28.637082][ T338] veth2: entered allmulticast mode
[ 28.642940][ T338] veth2: entered promiscuous mode
[ 28.779699][ T38] br1: port 4(veth2) entered blocking state
[ 28.780291][ T38] br1: port 4(veth2) entered forwarding state
[ 29.264699][ T343] br1: port 5(vx4001) entered blocking state
[ 29.265517][ T343] br1: port 5(vx4001) entered disabled state
[ 29.266218][ T343] vx4001: entered allmulticast mode
[ 29.271323][ T343] vx4001: entered promiscuous mode
[ 29.272624][ T343] br1: port 5(vx4001) entered blocking state
[ 29.273213][ T343] br1: port 5(vx4001) entered forwarding state
[ 30.464539][ T352] 8021q: 802.1Q VLAN Support v1.8
[ 31.049545][ T355] br1: entered promiscuous mode
[ 31.054305][ T355] br1: left promiscuous mode
[ 31.063198][ T355] br1: entered promiscuous mode
[ 37.582889][ T408] ip (408) used greatest stack depth: 23424 bytes left
[ 41.701731][ T434] br1: port 1(vx10) entered blocking state
[ 41.702403][ T434] br1: port 1(vx10) entered disabled state
[ 41.702975][ T434] vx10: entered allmulticast mode
[ 41.707776][ T434] vx10: entered promiscuous mode
[ 41.709567][ T434] br1: port 1(vx10) entered blocking state
[ 41.710168][ T434] br1: port 1(vx10) entered forwarding state
[ 42.433105][ T438] br1: port 2(vx20) entered blocking state
[ 42.433863][ T438] br1: port 2(vx20) entered disabled state
[ 42.434602][ T438] vx20: entered allmulticast mode
[ 42.440996][ T438] vx20: entered promiscuous mode
[ 42.443650][ T438] br1: port 2(vx20) entered blocking state
[ 42.444429][ T438] br1: port 2(vx20) entered forwarding state
[ 43.091597][ T442] br1: port 3(vx4001) entered blocking state
[ 43.092101][ T442] br1: port 3(vx4001) entered disabled state
[ 43.092656][ T442] vx4001: entered allmulticast mode
[ 43.096496][ T442] vx4001: entered promiscuous mode
[ 43.097365][ T442] br1: port 3(vx4001) entered blocking state
[ 43.097848][ T442] br1: port 3(vx4001) entered forwarding state
[ 43.411393][ T444] br1: port 4(w1) entered blocking state
[ 43.411983][ T444] br1: port 4(w1) entered disabled state
[ 43.412598][ T444] w1: entered allmulticast mode
[ 43.419095][ T444] w1: entered promiscuous mode
[ 43.580031][ T35] br1: port 4(w1) entered blocking state
[ 43.580492][ T35] br1: port 4(w1) entered forwarding state
[ 43.915723][ T447] br1: port 5(w3) entered blocking state
[ 43.916337][ T447] br1: port 5(w3) entered disabled state
[ 43.916904][ T447] w3: entered allmulticast mode
[ 43.923365][ T447] w3: entered promiscuous mode
[ 44.098673][ T46] br1: port 5(w3) entered blocking state
[ 44.099426][ T46] br1: port 5(w3) entered forwarding state
[ 45.712498][ T457] br1: entered promiscuous mode
[ 45.716224][ T457] br1: left promiscuous mode
[ 45.722252][ T457] br1: entered promiscuous mode
[ 46.902996][ C3] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 47.263023][ C2] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 47.269022][ C2] IPv6: vlan20-v: IPv6 duplicate address 2001:db8:2::3 used by 00:00:5e:00:01:01 detected!
[ 47.775019][ C3] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 47.777747][ C3] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 48.478145][ C3] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 48.919667][ C2] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 48.925678][ C0] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 48.936078][ C0] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20)
[ 49.398141][ C2] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10)
[ 72.301220][ T70] w3: left allmulticast mode
[ 72.301961][ T70] w3: left promiscuous mode
[ 72.302891][ T70] br1: port 5(w3) entered disabled state
[ 72.308025][ T70] w1: left allmulticast mode
[ 72.309503][ T70] w1: left promiscuous mode
[ 72.310395][ T70] br1: port 4(w1) entered disabled state
[ 72.319067][ T70] vx4001: left allmulticast mode
[ 72.320335][ T70] vx4001: left promiscuous mode
[ 72.322622][ T70] br1: port 3(vx4001) entered disabled state
[ 72.329449][ T70] vx20: left allmulticast mode
[ 72.329995][ T70] vx20: left promiscuous mode
[ 72.330882][ T70] br1: port 2(vx20) entered disabled state
[ 72.336727][ T70] vx10: left allmulticast mode
[ 72.337421][ T70] vx10: left promiscuous mode
[ 72.338265][ T70] br1: port 1(vx10) entered disabled state
[ 72.572566][ T70] ==================================================================
[ 72.573087][ T70] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 72.573659][ T70] Read of size 1 at addr ffff888008d246ac by task kworker/u16:1/70
[ 72.574057][ T70]
[ 72.574206][ T70] CPU: 3 UID: 0 PID: 70 Comm: kworker/u16:1 Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 72.574213][ T70] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 72.574218][ T70] Workqueue: netns cleanup_net
[ 72.574239][ T70] Call Trace:
[ 72.574245][ T70]
[ 72.574249][ T70] dump_stack_lvl+0x82/0xc0
[ 72.574260][ T70] print_address_description.constprop.0+0x2c/0x3a0
[ 72.574270][ T70] ? kobject_put+0xbb/0xd0
[ 72.574277][ T70] print_report+0xb4/0x270
[ 72.574282][ T70] ? kobject_put+0xbb/0xd0
[ 72.574288][ T70] ? kasan_addr_to_slab+0x21/0x70
[ 72.574293][ T70] ? kobject_put+0xbb/0xd0
[ 72.574298][ T70] kasan_report+0xca/0x100
[ 72.574305][ T70] ? kobject_put+0xbb/0xd0
[ 72.574314][ T70] kobject_put+0xbb/0xd0
[ 72.574320][ T70] netdev_run_todo+0x5f0/0xc60
[ 72.574330][ T70] ? rtnl_is_locked+0x15/0x20
[ 72.574341][ T70] ? dev_ingress_queue_create+0x190/0x190
[ 72.574346][ T70] ? generic_xdp_install+0x410/0x410
[ 72.574358][ T70] ops_undo_list+0x714/0x890
[ 72.574368][ T70] ? netns_get+0x110/0x110
[ 72.574372][ T70] ? cleanup_net+0x2d6/0x830
[ 72.574382][ T70] cleanup_net+0x3b2/0x830
[ 72.574389][ T70] ? net_passive_dec+0x190/0x190
[ 72.574396][ T70] ? rcu_is_watching+0x12/0xb0
[ 72.574409][ T70] process_one_work+0xe35/0x1650
[ 72.574423][ T70] ? pwq_dec_nr_in_flight+0x550/0x550
[ 72.574434][ T70] ? assign_work+0x168/0x240
[ 72.574442][ T70] worker_thread+0x591/0xcf0
[ 72.574452][ T70] ? rescuer_thread+0xd10/0xd10
[ 72.574459][ T70] kthread+0x37b/0x5f0
[ 72.574466][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.574470][ T70] ? ret_from_fork+0x1b/0x270
[ 72.574479][ T70] ? __lock_release+0x5d/0x170
[ 72.574490][ T70] ? rcu_is_watching+0x12/0xb0
[ 72.574495][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.574501][ T70] ret_from_fork+0x1db/0x270
[ 72.574506][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.574511][ T70] ret_from_fork_asm+0x11/0x20
[ 72.574527][ T70]
[ 72.574530][ T70]
[ 72.585917][ T70] Allocated by task 457:
[ 72.586139][ T70] kasan_save_stack+0x24/0x40
[ 72.586442][ T70] kasan_save_track+0x14/0x30
[ 72.586728][ T70] __kasan_kmalloc+0x7b/0x90
[ 72.587011][ T70] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 72.587303][ T70] alloc_netdev_mqs+0x7d/0x1370
[ 72.587603][ T70] rtnl_create_link+0xa9e/0xe20
[ 72.587904][ T70] rtnl_newlink_create+0x203/0x770
[ 72.588193][ T70] __rtnl_newlink+0x231/0xa30
[ 72.588492][ T70] rtnl_newlink+0x693/0xa60
[ 72.588752][ T70] rtnetlink_rcv_msg+0x709/0xc00
[ 72.589028][ T70] netlink_rcv_skb+0x121/0x340
[ 72.589353][ T70] netlink_unicast+0x4aa/0x780
[ 72.589676][ T70] netlink_sendmsg+0x714/0xbd0
[ 72.590011][ T70] ____sys_sendmsg+0x3dd/0x890
[ 72.590306][ T70] ___sys_sendmsg+0xed/0x170
[ 72.590639][ T70] __sys_sendmsg+0x10b/0x1a0
[ 72.590923][ T70] do_syscall_64+0xc1/0xfd0
[ 72.591235][ T70] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 72.591588][ T70]
[ 72.591737][ T70] Freed by task 70:
[ 72.591942][ T70] kasan_save_stack+0x24/0x40
[ 72.592225][ T70] kasan_save_track+0x14/0x30
[ 72.592534][ T70] __kasan_save_free_info+0x3b/0x60
[ 72.592802][ T70] __kasan_slab_free+0x3f/0x60
[ 72.593129][ T70] kfree+0x21d/0x540
[ 72.593344][ T70] device_release+0x9c/0x210
[ 72.593807][ T70] kobject_cleanup+0xfe/0x360
[ 72.594290][ T70] netdev_run_todo+0x81f/0xc60
[ 72.594620][ T70] ops_undo_list+0x714/0x890
[ 72.594921][ T70] cleanup_net+0x3b2/0x830
[ 72.595227][ T70] process_one_work+0xe35/0x1650
[ 72.595496][ T70] worker_thread+0x591/0xcf0
[ 72.595994][ T70] kthread+0x37b/0x5f0
[ 72.596215][ T70] ret_from_fork+0x1db/0x270
[ 72.596502][ T70] ret_from_fork_asm+0x11/0x20
[ 72.596799][ T70]
[ 72.597010][ T70] The buggy address belongs to the object at ffff888008d24000
[ 72.597010][ T70] which belongs to the cache kmalloc-4k of size 4096
[ 72.597788][ T70] The buggy address is located 1708 bytes inside of
[ 72.597788][ T70] freed 4096-byte region [ffff888008d24000, ffff888008d25000)
[ 72.598496][ T70]
[ 72.598637][ T70] The buggy address belongs to the physical page:
[ 72.599007][ T70] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8d20
[ 72.599523][ T70] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 72.600000][ T70] flags: 0x80000000000040(head|node=0|zone=1)
[ 72.600357][ T70] page_type: f5(slab)
[ 72.600755][ T70] raw: 0080000000000040 ffff888001043700 ffffea000029ca10 ffffea00001d4810
[ 72.601265][ T70] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 72.601786][ T70] head: 0080000000000040 ffff888001043700 ffffea000029ca10 ffffea00001d4810
[ 72.602517][ T70] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 72.603241][ T70] head: 0080000000000003 ffffea0000234801 00000000ffffffff 00000000ffffffff
[ 72.603927][ T70] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 72.604484][ T70] page dumped because: kasan: bad access detected
[ 72.604809][ T70]
[ 72.604941][ T70] Memory state around the buggy address:
[ 72.605212][ T70] ffff888008d24580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.605628][ T70] ffff888008d24600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.606286][ T70] >ffff888008d24680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.606786][ T70] ^
[ 72.607052][ T70] ffff888008d24700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.607464][ T70] ffff888008d24780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.607853][ T70] ==================================================================
[ 72.609719][ T70] Disabling lock debugging due to kernel taint
[ 72.611088][ T70] ------------[ cut here ]------------
[ 72.611399][ T70] refcount_t: underflow; use-after-free.
[ 72.611751][ T70] WARNING: CPU: 3 PID: 70 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 72.612303][ T70] Modules linked in: macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel bridge stp llc vrf veth
[ 72.612909][ T70] CPU: 3 UID: 0 PID: 70 Comm: kworker/u16:1 Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 72.613634][ T70] Tainted: [B]=BAD_PAGE
[ 72.613851][ T70] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 72.614204][ T70] Workqueue: netns cleanup_net
[ 72.614511][ T70] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 72.614882][ T70] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d a5 8f e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 72.615989][ T70] RSP: 0000:ffffc900004b7a08 EFLAGS: 00010282
[ 72.616380][ T70] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 72.616789][ T70] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 72.617297][ T70] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff207e134
[ 72.617757][ T70] R10: 0000000000000003 R11: ffffc900004b7580 R12: 0000000000000001
[ 72.618236][ T70] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 72.618628][ T70] FS: 0000000000000000(0000) GS:ffff8880a4b72000(0000) knlGS:0000000000000000
[ 72.619339][ T70] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 72.619693][ T70] CR2: 00007f60135e4f40 CR3: 000000000a645003 CR4: 0000000000772ef0
[ 72.620155][ T70] PKRU: 55555554
[ 72.620545][ T70] Call Trace:
[ 72.620786][ T70]
[ 72.620983][ T70] netdev_run_todo+0x5f0/0xc60
[ 72.621275][ T70] ? rtnl_is_locked+0x15/0x20
[ 72.621567][ T70] ? dev_ingress_queue_create+0x190/0x190
[ 72.621990][ T70] ? generic_xdp_install+0x410/0x410
[ 72.622273][ T70] ops_undo_list+0x714/0x890
[ 72.622591][ T70] ? netns_get+0x110/0x110
[ 72.622861][ T70] ? cleanup_net+0x2d6/0x830
[ 72.623318][ T70] cleanup_net+0x3b2/0x830
[ 72.623598][ T70] ? net_passive_dec+0x190/0x190
[ 72.623876][ T70] ? rcu_is_watching+0x12/0xb0
[ 72.624184][ T70] process_one_work+0xe35/0x1650
[ 72.624649][ T70] ? pwq_dec_nr_in_flight+0x550/0x550
[ 72.624923][ T70] ? assign_work+0x168/0x240
[ 72.625211][ T70] worker_thread+0x591/0xcf0
[ 72.625489][ T70] ? rescuer_thread+0xd10/0xd10
[ 72.625921][ T70] kthread+0x37b/0x5f0
[ 72.626127][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.626441][ T70] ? ret_from_fork+0x1b/0x270
[ 72.626753][ T70] ? __lock_release+0x5d/0x170
[ 72.627202][ T70] ? rcu_is_watching+0x12/0xb0
[ 72.627491][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.627757][ T70] ret_from_fork+0x1db/0x270
[ 72.628037][ T70] ? kthread_is_per_cpu+0xc0/0xc0
[ 72.628321][ T70] ret_from_fork_asm+0x11/0x20
[ 72.628598][ T70]
[ 72.628805][ T70] irq event stamp: 109259
[ 72.629013][ T70] hardirqs last enabled at (109259): [] finish_task_switch.isra.0+0x245/0x960
[ 72.629767][ T70] hardirqs last disabled at (109258): [] __schedule+0x94a/0x1b10
[ 72.630266][ T70] softirqs last enabled at (109170): [] handle_softirqs+0x352/0x610
[ 72.630783][ T70] softirqs last disabled at (109159): [] irq_exit_rcu+0xab/0x100
[ 72.631287][ T70] ---[ end trace 0000000000000000 ]---
[ 74.428565][ T654] br1: left promiscuous mode
[ 75.100913][ T660] br1: port 4(veth2) entered disabled state
[ 75.192089][ T661] veth2: left allmulticast mode
[ 75.192372][ T661] veth2: left promiscuous mode
[ 75.192701][ T661] br1: port 4(veth2) entered disabled state
[ 75.362301][ T663] br1: port 3(veth1) entered disabled state
[ 75.469429][ T664] veth1: left allmulticast mode
[ 75.469865][ T664] veth1: left promiscuous mode
[ 75.470409][ T664] br1: port 3(veth1) entered disabled state
[ 75.650105][ T666] vx4001: left allmulticast mode
[ 75.650405][ T666] vx4001: left promiscuous mode
[ 75.650787][ T666] br1: port 5(vx4001) entered disabled state
[ 76.001652][ T670] vx20: left allmulticast mode
[ 76.002009][ T670] vx20: left promiscuous mode
[ 76.002790][ T670] br1: port 2(vx20) entered disabled state
[ 76.347785][ T674] vx10: left allmulticast mode
[ 76.348038][ T674] vx10: left promiscuous mode
[ 76.348848][ T674] br1: port 1(vx10) entered disabled state