[ 20.518698][ T289] 8021q: 802.1Q VLAN Support v1.8
[ 25.515028][ T325] br1: port 1(veth1) entered blocking state
[ 25.515736][ T325] br1: port 1(veth1) entered disabled state
[ 25.516403][ T325] veth1: entered allmulticast mode
[ 25.520556][ T325] veth1: entered promiscuous mode
[ 25.646924][ T36] br1: port 1(veth1) entered blocking state
[ 25.647751][ T36] br1: port 1(veth1) entered forwarding state
[ 61.222682][ T504] br1: port 1(veth1) entered disabled state
[ 61.353709][ T505] veth1: left allmulticast mode
[ 61.354109][ T505] veth1: left promiscuous mode
[ 61.354715][ T505] br1: port 1(veth1) entered disabled state
[ 61.560503][ T506] ==================================================================
[ 61.560936][ T506] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 61.561349][ T506] Read of size 1 at addr ffff88800eff26ac by task ip/506
[ 61.561699][ T506]
[ 61.561841][ T506] CPU: 1 UID: 0 PID: 506 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 61.561848][ T506] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 61.561851][ T506] Call Trace:
[ 61.561853][ T506]
[ 61.561856][ T506] dump_stack_lvl+0x82/0xc0
[ 61.561863][ T506] print_address_description.constprop.0+0x2c/0x3a0
[ 61.561871][ T506] ? kobject_put+0xbb/0xd0
[ 61.561876][ T506] print_report+0xb4/0x270
[ 61.561880][ T506] ? kobject_put+0xbb/0xd0
[ 61.561883][ T506] ? kasan_addr_to_slab+0x21/0x70
[ 61.561888][ T506] ? kobject_put+0xbb/0xd0
[ 61.561894][ T506] kasan_report+0xca/0x100
[ 61.561899][ T506] ? kobject_put+0xbb/0xd0
[ 61.561908][ T506] kobject_put+0xbb/0xd0
[ 61.561914][ T506] netdev_run_todo+0x5f0/0xc60
[ 61.561920][ T506] ? dev_ingress_queue_create+0x190/0x190
[ 61.561926][ T506] ? generic_xdp_install+0x410/0x410
[ 61.561930][ T506] ? kernfs_put.part.0+0x12d/0x480
[ 61.561938][ T506] ? unregister_netdevice_many+0x20/0x20
[ 61.561947][ T506] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 61.561995][ T506] rtnl_dellink+0x350/0xa30
[ 61.562001][ T506] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 61.562028][ T506] ? find_held_lock+0x2b/0x80
[ 61.562035][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.562044][ T506] ? find_held_lock+0x2b/0x80
[ 61.562050][ T506] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 61.562054][ T506] ? __lock_release+0x5d/0x170
[ 61.562062][ T506] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 61.562067][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.562074][ T506] ? rtnl_port_fill+0x850/0x850
[ 61.562079][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.562091][ T506] netlink_rcv_skb+0x121/0x340
[ 61.562099][ T506] ? rtnl_port_fill+0x850/0x850
[ 61.562105][ T506] ? netlink_ack+0xdd0/0xdd0
[ 61.562116][ T506] ? netlink_deliver_tap+0x13e/0x340
[ 61.562119][ T506] ? netlink_deliver_tap+0xc3/0x340
[ 61.562125][ T506] netlink_unicast+0x4aa/0x780
[ 61.562133][ T506] ? netlink_attachskb+0x810/0x810
[ 61.562140][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.562149][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.562157][ T506] ? netlink_unicast+0x780/0x780
[ 61.562164][ T506] ? __import_iovec+0x230/0x3b0
[ 61.562173][ T506] ? netlink_unicast+0x780/0x780
[ 61.562179][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.562186][ T506] ? get_timestamp.constprop.0+0x380/0x380
[ 61.562190][ T506] ? __copy_msghdr+0x3c0/0x3c0
[ 61.562200][ T506] ___sys_sendmsg+0xed/0x170
[ 61.562204][ T506] ? kasan_record_aux_stack+0x8c/0xa0
[ 61.562208][ T506] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 61.562216][ T506] ? copy_msghdr_from_user+0x110/0x110
[ 61.562223][ T506] ? find_held_lock+0x2b/0x80
[ 61.562229][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.562236][ T506] ? find_held_lock+0x2b/0x80
[ 61.562241][ T506] ? __virt_addr_valid+0x22a/0x450
[ 61.562248][ T506] ? __lock_release+0x5d/0x170
[ 61.562256][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.562261][ T506] ? __call_rcu_common.constprop.0+0x318/0x630
[ 61.562267][ T506] ? __sys_sendmsg_sock+0x20/0x20
[ 61.562278][ T506] ? rcu_is_watching+0x12/0xb0
[ 61.562284][ T506] do_syscall_64+0xc1/0xfd0
[ 61.562292][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.562298][ T506] RIP: 0033:0x7f648aca11d7
[ 61.562305][ T506] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 61.562309][ T506] RSP: 002b:00007fff8c6ece68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 61.562316][ T506] RAX: ffffffffffffffda RBX: 00007fff8c6ed590 RCX: 00007f648aca11d7
[ 61.562320][ T506] RDX: 0000000000000000 RSI: 00007fff8c6eced0 RDI: 0000000000000005
[ 61.562323][ T506] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 61.562325][ T506] R10: 00007f648ab9df60 R11: 0000000000000246 R12: 0000000000000002
[ 61.562328][ T506] R13: 00000000690ded86 R14: 0000000000499600 R15: 0000000000000000
[ 61.562340][ T506]
[ 61.562342][ T506]
[ 61.580782][ T506] Allocated by task 320:
[ 61.581028][ T506] kasan_save_stack+0x24/0x40
[ 61.581284][ T506] kasan_save_track+0x14/0x30
[ 61.581526][ T506] __kasan_kmalloc+0x7b/0x90
[ 61.581785][ T506] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 61.582048][ T506] alloc_netdev_mqs+0x7d/0x1370
[ 61.582307][ T506] rtnl_create_link+0xa9e/0xe20
[ 61.582557][ T506] rtnl_newlink_create+0x203/0x770
[ 61.582817][ T506] __rtnl_newlink+0x231/0xa30
[ 61.583066][ T506] rtnl_newlink+0x693/0xa60
[ 61.583285][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.583536][ T506] netlink_rcv_skb+0x121/0x340
[ 61.583788][ T506] netlink_unicast+0x4aa/0x780
[ 61.584070][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.584302][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.584547][ T506] ___sys_sendmsg+0xed/0x170
[ 61.584804][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.585074][ T506] do_syscall_64+0xc1/0xfd0
[ 61.585329][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.585636][ T506]
[ 61.585764][ T506] Freed by task 506:
[ 61.585946][ T506] kasan_save_stack+0x24/0x40
[ 61.586207][ T506] kasan_save_track+0x14/0x30
[ 61.586440][ T506] __kasan_save_free_info+0x3b/0x60
[ 61.586696][ T506] __kasan_slab_free+0x3f/0x60
[ 61.586922][ T506] kfree+0x21d/0x540
[ 61.587117][ T506] device_release+0x9c/0x210
[ 61.587359][ T506] kobject_cleanup+0xfe/0x360
[ 61.587618][ T506] netdev_run_todo+0x81f/0xc60
[ 61.587871][ T506] rtnl_dellink+0x350/0xa30
[ 61.588135][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.588382][ T506] netlink_rcv_skb+0x121/0x340
[ 61.588624][ T506] netlink_unicast+0x4aa/0x780
[ 61.588896][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.589142][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.589405][ T506] ___sys_sendmsg+0xed/0x170
[ 61.589650][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.589900][ T506] do_syscall_64+0xc1/0xfd0
[ 61.590146][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.590470][ T506]
[ 61.590599][ T506] Last potentially related work creation:
[ 61.590879][ T506] kasan_save_stack+0x24/0x40
[ 61.591132][ T506] kasan_record_aux_stack+0x8c/0xa0
[ 61.591375][ T506] insert_work+0x34/0x230
[ 61.591568][ T506] __queue_work+0x5fd/0xab0
[ 61.591807][ T506] queue_work_on+0x84/0x90
[ 61.592068][ T506] br_multicast_del_mdb_entry+0x95d/0xfe0 [bridge]
[ 61.592434][ T506] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 61.592817][ T506] br_dev_uninit+0x19/0x40 [bridge]
[ 61.593144][ T506] unregister_netdevice_many_notify+0xa80/0x1b30
[ 61.593579][ T506] rtnl_dellink+0x344/0xa30
[ 61.593830][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.594036][ T506] netlink_rcv_skb+0x121/0x340
[ 61.594256][ T506] netlink_unicast+0x4aa/0x780
[ 61.594455][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.594698][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.594873][ T506] ___sys_sendmsg+0xed/0x170
[ 61.595061][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.595265][ T506] do_syscall_64+0xc1/0xfd0
[ 61.595447][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.595715][ T506]
[ 61.595814][ T506] Second to last potentially related work creation:
[ 61.596044][ T506] kasan_save_stack+0x24/0x40
[ 61.596223][ T506] kasan_record_aux_stack+0x8c/0xa0
[ 61.596406][ T506] insert_work+0x34/0x230
[ 61.596567][ T506] __queue_work+0x5fd/0xab0
[ 61.596752][ T506] queue_work_on+0x84/0x90
[ 61.596921][ T506] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 61.597201][ T506] br_dev_uninit+0x19/0x40 [bridge]
[ 61.597441][ T506] unregister_netdevice_many_notify+0xa80/0x1b30
[ 61.597678][ T506] rtnl_dellink+0x344/0xa30
[ 61.597863][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.598072][ T506] netlink_rcv_skb+0x121/0x340
[ 61.598263][ T506] netlink_unicast+0x4aa/0x780
[ 61.598451][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.598647][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.598832][ T506] ___sys_sendmsg+0xed/0x170
[ 61.599012][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.599199][ T506] do_syscall_64+0xc1/0xfd0
[ 61.599409][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.599756][ T506]
[ 61.599847][ T506] The buggy address belongs to the object at ffff88800eff2000
[ 61.599847][ T506] which belongs to the cache kmalloc-8k of size 8192
[ 61.600302][ T506] The buggy address is located 1708 bytes inside of
[ 61.600302][ T506] freed 8192-byte region [ffff88800eff2000, ffff88800eff4000)
[ 61.600816][ T506]
[ 61.600906][ T506] The buggy address belongs to the physical page:
[ 61.601153][ T506] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xeff0
[ 61.601558][ T506] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 61.601817][ T506] flags: 0x80000000000040(head|node=0|zone=1)
[ 61.602175][ T506] page_type: f5(slab)
[ 61.602331][ T506] raw: 0080000000000040 ffff8880010438c0 ffffea0000313e10 ffff888001041228
[ 61.602647][ T506] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 61.603061][ T506] head: 0080000000000040 ffff8880010438c0 ffffea0000313e10 ffff888001041228
[ 61.603373][ T506] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 61.603789][ T506] head: 0080000000000003 ffffea00003bfc01 00000000ffffffff 00000000ffffffff
[ 61.604101][ T506] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 61.604402][ T506] page dumped because: kasan: bad access detected
[ 61.604770][ T506]
[ 61.604895][ T506] Memory state around the buggy address:
[ 61.605108][ T506] ffff88800eff2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.605510][ T506] ffff88800eff2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.606017][ T506] >ffff88800eff2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.606287][ T506] ^
[ 61.606471][ T506] ffff88800eff2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.606809][ T506] ffff88800eff2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 61.607077][ T506] ==================================================================
[ 61.607634][ T506] Disabling lock debugging due to kernel taint
[ 61.608025][ T506] ------------[ cut here ]------------
[ 61.608268][ T506] refcount_t: underflow; use-after-free.
[ 61.608551][ T506] WARNING: CPU: 2 PID: 506 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 61.609933][ T506] Modules linked in: bridge stp llc 8021q vrf veth
[ 61.610308][ T506] CPU: 2 UID: 0 PID: 506 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 61.610820][ T506] Tainted: [B]=BAD_PAGE
[ 61.611014][ T506] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 61.611341][ T506] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 61.611707][ T506] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 05 9e e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 61.612575][ T506] RSP: 0018:ffffc90000ce71f0 EFLAGS: 00010286
[ 61.612932][ T506] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 61.613350][ T506] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 61.613766][ T506] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff3d3e134
[ 61.614144][ T506] R10: 0000000000000003 R11: ffffc90000ce6d80 R12: 0000000000000001
[ 61.614511][ T506] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 61.614902][ T506] FS: 00007f648aad3800(0000) GS:ffff8880964f2000(0000) knlGS:0000000000000000
[ 61.615519][ T506] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 61.615849][ T506] CR2: 00007f657dc10248 CR3: 0000000008c45002 CR4: 0000000000772ef0
[ 61.616257][ T506] PKRU: 55555554
[ 61.616639][ T506] Call Trace:
[ 61.616851][ T506]
[ 61.616991][ T506] netdev_run_todo+0x5f0/0xc60
[ 61.617260][ T506] ? dev_ingress_queue_create+0x190/0x190
[ 61.617506][ T506] ? generic_xdp_install+0x410/0x410
[ 61.617781][ T506] ? kernfs_put.part.0+0x12d/0x480
[ 61.618040][ T506] ? unregister_netdevice_many+0x20/0x20
[ 61.618350][ T506] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 61.618666][ T506] rtnl_dellink+0x350/0xa30
[ 61.619073][ T506] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 61.619427][ T506] ? find_held_lock+0x2b/0x80
[ 61.619732][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.620007][ T506] ? find_held_lock+0x2b/0x80
[ 61.620410][ T506] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 61.620694][ T506] ? __lock_release+0x5d/0x170
[ 61.620976][ T506] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 61.621307][ T506] rtnetlink_rcv_msg+0x709/0xc00
[ 61.621560][ T506] ? rtnl_port_fill+0x850/0x850
[ 61.621858][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.622151][ T506] netlink_rcv_skb+0x121/0x340
[ 61.622415][ T506] ? rtnl_port_fill+0x850/0x850
[ 61.622689][ T506] ? netlink_ack+0xdd0/0xdd0
[ 61.622948][ T506] ? netlink_deliver_tap+0x13e/0x340
[ 61.623224][ T506] ? netlink_deliver_tap+0xc3/0x340
[ 61.623651][ T506] netlink_unicast+0x4aa/0x780
[ 61.623926][ T506] ? netlink_attachskb+0x810/0x810
[ 61.624170][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.624457][ T506] netlink_sendmsg+0x714/0xbd0
[ 61.624783][ T506] ? netlink_unicast+0x780/0x780
[ 61.625046][ T506] ? __import_iovec+0x230/0x3b0
[ 61.625305][ T506] ? netlink_unicast+0x780/0x780
[ 61.625547][ T506] ____sys_sendmsg+0x3dd/0x890
[ 61.625982][ T506] ? get_timestamp.constprop.0+0x380/0x380
[ 61.626316][ T506] ? __copy_msghdr+0x3c0/0x3c0
[ 61.626637][ T506] ___sys_sendmsg+0xed/0x170
[ 61.626872][ T506] ? kasan_record_aux_stack+0x8c/0xa0
[ 61.627402][ T506] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 61.627718][ T506] ? copy_msghdr_from_user+0x110/0x110
[ 61.627965][ T506] ? find_held_lock+0x2b/0x80
[ 61.628400][ T506] ? __lock_acquire+0x449/0x7e0
[ 61.628656][ T506] ? find_held_lock+0x2b/0x80
[ 61.629027][ T506] ? __virt_addr_valid+0x22a/0x450
[ 61.629320][ T506] ? __lock_release+0x5d/0x170
[ 61.629603][ T506] __sys_sendmsg+0x10b/0x1a0
[ 61.630013][ T506] ? __call_rcu_common.constprop.0+0x318/0x630
[ 61.630333][ T506] ? __sys_sendmsg_sock+0x20/0x20
[ 61.630783][ T506] ? rcu_is_watching+0x12/0xb0
[ 61.631035][ T506] do_syscall_64+0xc1/0xfd0
[ 61.631317][ T506] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 61.631643][ T506] RIP: 0033:0x7f648aca11d7
[ 61.631904][ T506] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 61.632919][ T506] RSP: 002b:00007fff8c6ece68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 61.633442][ T506] RAX: ffffffffffffffda RBX: 00007fff8c6ed590 RCX: 00007f648aca11d7
[ 61.633948][ T506] RDX: 0000000000000000 RSI: 00007fff8c6eced0 RDI: 0000000000000005
[ 61.634470][ T506] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 61.634862][ T506] R10: 00007f648ab9df60 R11: 0000000000000246 R12: 0000000000000002
[ 61.635228][ T506] R13: 00000000690ded86 R14: 0000000000499600 R15: 0000000000000000
[ 61.635606][ T506]
[ 61.635946][ T506] irq event stamp: 45935
[ 61.636137][ T506] hardirqs last enabled at (45935): [] finish_task_switch.isra.0+0x245/0x960
[ 61.636789][ T506] hardirqs last disabled at (45934): [] __schedule+0x94a/0x1b10
[ 61.637343][ T506] softirqs last enabled at (45840): [] handle_softirqs+0x352/0x610
[ 61.637788][ T506] softirqs last disabled at (45683): [] irq_exit_rcu+0xab/0x100
[ 61.638489][ T506] ---[ end trace 0000000000000000 ]---