[ 28.636379][ T338] 8021q: 802.1Q VLAN Support v1.8 [ 29.226252][ T343] gre: GRE over IPv4 demultiplexer driver [ 29.298334][ T343] ip6_gre: GRE over IPv6 tunneling driver [ 42.756953][ T421] GACT probability NOT on [ 72.487035][ T637] ================================================================== [ 72.487637][ T637] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0 [ 72.488109][ T637] Read of size 1 at addr ffff8880081d96ac by task ip/637 [ 72.488469][ T637] [ 72.488621][ T637] CPU: 1 UID: 0 PID: 637 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full) [ 72.488629][ T637] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 72.488633][ T637] Call Trace: [ 72.488635][ T637] [ 72.488639][ T637] dump_stack_lvl+0x82/0xc0 [ 72.488648][ T637] print_address_description.constprop.0+0x2c/0x3a0 [ 72.488661][ T637] ? kobject_put+0xbb/0xd0 [ 72.488668][ T637] print_report+0xb4/0x270 [ 72.488673][ T637] ? kobject_put+0xbb/0xd0 [ 72.488678][ T637] ? kasan_addr_to_slab+0x21/0x70 [ 72.488683][ T637] ? kobject_put+0xbb/0xd0 [ 72.488689][ T637] kasan_report+0xca/0x100 [ 72.488694][ T637] ? kobject_put+0xbb/0xd0 [ 72.488704][ T637] kobject_put+0xbb/0xd0 [ 72.488710][ T637] netdev_run_todo+0x5f0/0xc60 [ 72.488718][ T637] ? dev_ingress_queue_create+0x190/0x190 [ 72.488723][ T637] ? generic_xdp_install+0x410/0x410 [ 72.488729][ T637] ? unregister_netdevice_many+0x20/0x20 [ 72.488737][ T637] ? net_generic+0xbb/0x1f0 [ip6_gre] [ 72.488751][ T637] rtnl_dellink+0x350/0xa30 [ 72.488759][ T637] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.488796][ T637] ? find_held_lock+0x2b/0x80 [ 72.488806][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.488818][ T637] ? find_held_lock+0x2b/0x80 [ 72.488824][ T637] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 72.488828][ T637] ? __lock_release+0x5d/0x170 [ 72.488836][ T637] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.488842][ T637] rtnetlink_rcv_msg+0x709/0xc00 [ 72.488849][ T637] ? rtnl_port_fill+0x850/0x850 [ 72.488854][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.488867][ T637] netlink_rcv_skb+0x121/0x340 [ 72.488874][ T637] ? rtnl_port_fill+0x850/0x850 [ 72.488881][ T637] ? netlink_ack+0xdd0/0xdd0 [ 72.488894][ T637] ? netlink_deliver_tap+0x13e/0x340 [ 72.488898][ T637] ? netlink_deliver_tap+0xc3/0x340 [ 72.488903][ T637] netlink_unicast+0x4aa/0x780 [ 72.488911][ T637] ? netlink_attachskb+0x810/0x810 [ 72.488917][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.488928][ T637] netlink_sendmsg+0x714/0xbd0 [ 72.488936][ T637] ? netlink_unicast+0x780/0x780 [ 72.488943][ T637] ? __import_iovec+0x230/0x3b0 [ 72.488956][ T637] ? netlink_unicast+0x780/0x780 [ 72.488962][ T637] ____sys_sendmsg+0x3dd/0x890 [ 72.488972][ T637] ? get_timestamp.constprop.0+0x380/0x380 [ 72.488977][ T637] ? __copy_msghdr+0x3c0/0x3c0 [ 72.488991][ T637] ___sys_sendmsg+0xed/0x170 [ 72.488996][ T637] ? kasan_record_aux_stack+0x8c/0xa0 [ 72.489001][ T637] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 72.489013][ T637] ? copy_msghdr_from_user+0x110/0x110 [ 72.489022][ T637] ? find_held_lock+0x2b/0x80 [ 72.489030][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.489040][ T637] ? find_held_lock+0x2b/0x80 [ 72.489047][ T637] ? __virt_addr_valid+0x22a/0x450 [ 72.489054][ T637] ? __lock_release+0x5d/0x170 [ 72.489067][ T637] __sys_sendmsg+0x10b/0x1a0 [ 72.489072][ T637] ? __call_rcu_common.constprop.0+0x318/0x630 [ 72.489078][ T637] ? __sys_sendmsg_sock+0x20/0x20 [ 72.489093][ T637] ? rcu_is_watching+0x12/0xb0 [ 72.489100][ T637] do_syscall_64+0xc1/0xfd0 [ 72.489108][ T637] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.489115][ T637] RIP: 0033:0x7f175a1481d7 [ 72.489122][ T637] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 72.489126][ T637] RSP: 002b:00007ffcef55e678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.489132][ T637] RAX: ffffffffffffffda RBX: 00007ffcef55eda0 RCX: 00007f175a1481d7 [ 72.489136][ T637] RDX: 0000000000000000 RSI: 00007ffcef55e6e0 RDI: 0000000000000005 [ 72.489139][ T637] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 72.489142][ T637] R10: 00007f175a044f60 R11: 0000000000000246 R12: 0000000000000002 [ 72.489145][ T637] R13: 00000000690ded30 R14: 0000000000499600 R15: 0000000000000000 [ 72.489157][ T637] [ 72.489159][ T637] [ 72.511759][ T637] Allocated by task 372: [ 72.511974][ T637] kasan_save_stack+0x24/0x40 [ 72.512296][ T637] kasan_save_track+0x14/0x30 [ 72.512613][ T637] __kasan_kmalloc+0x7b/0x90 [ 72.512905][ T637] __kvmalloc_node_noprof+0x2e5/0x8e0 [ 72.513188][ T637] alloc_netdev_mqs+0x7d/0x1370 [ 72.513491][ T637] rtnl_create_link+0xa9e/0xe20 [ 72.513789][ T637] rtnl_newlink_create+0x203/0x770 [ 72.514113][ T637] __rtnl_newlink+0x231/0xa30 [ 72.514439][ T637] rtnl_newlink+0x693/0xa60 [ 72.514725][ T637] rtnetlink_rcv_msg+0x709/0xc00 [ 72.515019][ T637] netlink_rcv_skb+0x121/0x340 [ 72.515350][ T637] netlink_unicast+0x4aa/0x780 [ 72.515653][ T637] netlink_sendmsg+0x714/0xbd0 [ 72.515915][ T637] ____sys_sendmsg+0x3dd/0x890 [ 72.516202][ T637] ___sys_sendmsg+0xed/0x170 [ 72.516491][ T637] __sys_sendmsg+0x10b/0x1a0 [ 72.516804][ T637] do_syscall_64+0xc1/0xfd0 [ 72.517138][ T637] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.517549][ T637] [ 72.517707][ T637] Freed by task 637: [ 72.517921][ T637] kasan_save_stack+0x24/0x40 [ 72.518252][ T637] kasan_save_track+0x14/0x30 [ 72.518551][ T637] __kasan_save_free_info+0x3b/0x60 [ 72.518843][ T637] __kasan_slab_free+0x3f/0x60 [ 72.519133][ T637] kfree+0x21d/0x540 [ 72.519359][ T637] device_release+0x9c/0x210 [ 72.519675][ T637] kobject_cleanup+0xfe/0x360 [ 72.519974][ T637] netdev_run_todo+0x81f/0xc60 [ 72.520275][ T637] rtnl_dellink+0x350/0xa30 [ 72.520577][ T637] rtnetlink_rcv_msg+0x709/0xc00 [ 72.520882][ T637] netlink_rcv_skb+0x121/0x340 [ 72.521183][ T637] netlink_unicast+0x4aa/0x780 [ 72.521485][ T637] netlink_sendmsg+0x714/0xbd0 [ 72.521763][ T637] ____sys_sendmsg+0x3dd/0x890 [ 72.522075][ T637] ___sys_sendmsg+0xed/0x170 [ 72.522363][ T637] __sys_sendmsg+0x10b/0x1a0 [ 72.522650][ T637] do_syscall_64+0xc1/0xfd0 [ 72.522938][ T637] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.523301][ T637] [ 72.523455][ T637] The buggy address belongs to the object at ffff8880081d9000 [ 72.523455][ T637] which belongs to the cache kmalloc-4k of size 4096 [ 72.524188][ T637] The buggy address is located 1708 bytes inside of [ 72.524188][ T637] freed 4096-byte region [ffff8880081d9000, ffff8880081da000) [ 72.524912][ T637] [ 72.525064][ T637] The buggy address belongs to the physical page: [ 72.525426][ T637] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81d8 [ 72.525959][ T637] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.526415][ T637] flags: 0x80000000000040(head|node=0|zone=1) [ 72.526791][ T637] page_type: f5(slab) [ 72.527022][ T637] raw: 0080000000000040 ffff888001043700 ffffea00001bb010 ffffea0000202c10 [ 72.527738][ T637] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 72.528271][ T637] head: 0080000000000040 ffff888001043700 ffffea00001bb010 ffffea0000202c10 [ 72.528813][ T637] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 72.529345][ T637] head: 0080000000000003 ffffea0000207601 00000000ffffffff 00000000ffffffff [ 72.529879][ T637] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 72.530624][ T637] page dumped because: kasan: bad access detected [ 72.531015][ T637] [ 72.531159][ T637] Memory state around the buggy address: [ 72.531441][ T637] ffff8880081d9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.532047][ T637] ffff8880081d9600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.532475][ T637] >ffff8880081d9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.532918][ T637] ^ [ 72.533225][ T637] ffff8880081d9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.533657][ T637] ffff8880081d9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.534295][ T637] ================================================================== [ 72.534883][ T637] Disabling lock debugging due to kernel taint [ 72.535313][ T637] ------------[ cut here ]------------ [ 72.535646][ T637] refcount_t: underflow; use-after-free. [ 72.536025][ T637] WARNING: CPU: 2 PID: 637 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0 [ 72.536566][ T637] Modules linked in: act_gact cls_flower sch_ingress ip6_gre ip6_tunnel tunnel6 gre 8021q vrf veth [ 72.537314][ T637] CPU: 2 UID: 0 PID: 637 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full) [ 72.537955][ T637] Tainted: [B]=BAD_PAGE [ 72.538222][ T637] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 72.538612][ T637] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0 [ 72.539039][ T637] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d e5 90 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff [ 72.540129][ T637] RSP: 0018:ffffc90000f471f0 EFLAGS: 00010286 [ 72.540534][ T637] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 72.541027][ T637] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 72.541493][ T637] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff22fe134 [ 72.542188][ T637] R10: 0000000000000003 R11: ffffc90000f46d80 R12: 0000000000000001 [ 72.542653][ T637] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 72.543140][ T637] FS: 00007f1759f7a800(0000) GS:ffff8880a36f2000(0000) knlGS:0000000000000000 [ 72.543668][ T637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.544087][ T637] CR2: 00007f3a0582ceb0 CR3: 0000000008d28002 CR4: 0000000000772ef0 [ 72.544749][ T637] PKRU: 55555554 [ 72.545016][ T637] Call Trace: [ 72.545441][ T637] [ 72.545628][ T637] netdev_run_todo+0x5f0/0xc60 [ 72.545954][ T637] ? dev_ingress_queue_create+0x190/0x190 [ 72.546472][ T637] ? generic_xdp_install+0x410/0x410 [ 72.546822][ T637] ? unregister_netdevice_many+0x20/0x20 [ 72.547150][ T637] ? net_generic+0xbb/0x1f0 [ip6_gre] [ 72.547477][ T637] rtnl_dellink+0x350/0xa30 [ 72.547798][ T637] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.548212][ T637] ? find_held_lock+0x2b/0x80 [ 72.548712][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.549055][ T637] ? find_held_lock+0x2b/0x80 [ 72.549374][ T637] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 72.549689][ T637] ? __lock_release+0x5d/0x170 [ 72.550214][ T637] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 72.550597][ T637] rtnetlink_rcv_msg+0x709/0xc00 [ 72.550928][ T637] ? rtnl_port_fill+0x850/0x850 [ 72.551412][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.551738][ T637] netlink_rcv_skb+0x121/0x340 [ 72.552075][ T637] ? rtnl_port_fill+0x850/0x850 [ 72.552400][ T637] ? netlink_ack+0xdd0/0xdd0 [ 72.552924][ T637] ? netlink_deliver_tap+0x13e/0x340 [ 72.553273][ T637] ? netlink_deliver_tap+0xc3/0x340 [ 72.553599][ T637] netlink_unicast+0x4aa/0x780 [ 72.553923][ T637] ? netlink_attachskb+0x810/0x810 [ 72.554409][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.554729][ T637] netlink_sendmsg+0x714/0xbd0 [ 72.555057][ T637] ? netlink_unicast+0x780/0x780 [ 72.555378][ T637] ? __import_iovec+0x230/0x3b0 [ 72.555898][ T637] ? netlink_unicast+0x780/0x780 [ 72.556211][ T637] ____sys_sendmsg+0x3dd/0x890 [ 72.556542][ T637] ? get_timestamp.constprop.0+0x380/0x380 [ 72.556951][ T637] ? __copy_msghdr+0x3c0/0x3c0 [ 72.557268][ T637] ___sys_sendmsg+0xed/0x170 [ 72.557585][ T637] ? kasan_record_aux_stack+0x8c/0xa0 [ 72.557926][ T637] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 72.558322][ T637] ? copy_msghdr_from_user+0x110/0x110 [ 72.558663][ T637] ? find_held_lock+0x2b/0x80 [ 72.559181][ T637] ? __lock_acquire+0x449/0x7e0 [ 72.559537][ T637] ? find_held_lock+0x2b/0x80 [ 72.559866][ T637] ? __virt_addr_valid+0x22a/0x450 [ 72.560556][ T637] ? __lock_release+0x5d/0x170 [ 72.560893][ T637] __sys_sendmsg+0x10b/0x1a0 [ 72.561218][ T637] ? __call_rcu_common.constprop.0+0x318/0x630 [ 72.561617][ T637] ? __sys_sendmsg_sock+0x20/0x20 [ 72.561952][ T637] ? rcu_is_watching+0x12/0xb0 [ 72.562271][ T637] do_syscall_64+0xc1/0xfd0 [ 72.562600][ T637] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 72.563028][ T637] RIP: 0033:0x7f175a1481d7 [ 72.563354][ T637] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 72.564426][ T637] RSP: 002b:00007ffcef55e678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 72.564926][ T637] RAX: ffffffffffffffda RBX: 00007ffcef55eda0 RCX: 00007f175a1481d7 [ 72.565405][ T637] RDX: 0000000000000000 RSI: 00007ffcef55e6e0 RDI: 0000000000000005 [ 72.566017][ T637] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 72.566484][ T637] R10: 00007f175a044f60 R11: 0000000000000246 R12: 0000000000000002 [ 72.567172][ T637] R13: 00000000690ded30 R14: 0000000000499600 R15: 0000000000000000 [ 72.567656][ T637] [ 72.567915][ T637] irq event stamp: 40025 [ 72.568164][ T637] hardirqs last enabled at (40025): [] finish_task_switch.isra.0+0x245/0x960 [ 72.569141][ T637] hardirqs last disabled at (40024): [] __schedule+0x94a/0x1b10 [ 72.569687][ T637] softirqs last enabled at (39942): [] handle_softirqs+0x352/0x610 [ 72.570221][ T637] softirqs last disabled at (39809): [] irq_exit_rcu+0xab/0x100 [ 72.571156][ T637] ---[ end trace 0000000000000000 ]---