[ 18.601765][ T250] ip (250) used greatest stack depth: 23984 bytes left [ 22.330313][ T288] 8021q: 802.1Q VLAN Support v1.8 [ 25.758001][ T311] br0: port 1(veth1) entered blocking state [ 25.758718][ T311] br0: port 1(veth1) entered disabled state [ 25.759328][ T311] veth1: entered allmulticast mode [ 25.763361][ T311] veth1: entered promiscuous mode [ 25.940564][ T313] br0: port 2(veth2) entered blocking state [ 25.941305][ T313] br0: port 2(veth2) entered disabled state [ 25.942093][ T313] veth2: entered allmulticast mode [ 25.948379][ T313] veth2: entered promiscuous mode [ 26.293745][ T35] br0: port 1(veth1) entered blocking state [ 26.294367][ T35] br0: port 1(veth1) entered forwarding state [ 26.495739][ T38] br0: port 2(veth2) entered blocking state [ 26.496493][ T38] br0: port 2(veth2) entered forwarding state [ 60.732414][ T404] br0: port 2(veth2) entered disabled state [ 60.855436][ T405] br0: port 1(veth1) entered disabled state [ 60.995243][ T406] veth2: left allmulticast mode [ 60.995785][ T406] veth2: left promiscuous mode [ 60.996901][ T406] br0: port 2(veth2) entered disabled state [ 61.001407][ T406] veth1: left allmulticast mode [ 61.002017][ T406] veth1: left promiscuous mode [ 61.002870][ T406] br0: port 1(veth1) entered disabled state [ 61.068150][ T406] ================================================================== [ 61.068683][ T406] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0 [ 61.069191][ T406] Read of size 1 at addr ffff88800be426ac by task ip/406 [ 61.069598][ T406] [ 61.069770][ T406] CPU: 3 UID: 0 PID: 406 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full) [ 61.069778][ T406] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 61.069781][ T406] Call Trace: [ 61.069784][ T406] [ 61.069787][ T406] dump_stack_lvl+0x82/0xc0 [ 61.069799][ T406] print_address_description.constprop.0+0x2c/0x3a0 [ 61.069813][ T406] ? kobject_put+0xbb/0xd0 [ 61.069820][ T406] print_report+0xb4/0x270 [ 61.069824][ T406] ? kobject_put+0xbb/0xd0 [ 61.069830][ T406] ? kasan_addr_to_slab+0x21/0x70 [ 61.069834][ T406] ? kobject_put+0xbb/0xd0 [ 61.069839][ T406] kasan_report+0xca/0x100 [ 61.069845][ T406] ? kobject_put+0xbb/0xd0 [ 61.069855][ T406] kobject_put+0xbb/0xd0 [ 61.069861][ T406] netdev_run_todo+0x5f0/0xc60 [ 61.069868][ T406] ? dev_ingress_queue_create+0x190/0x190 [ 61.069873][ T406] ? generic_xdp_install+0x410/0x410 [ 61.069876][ T406] ? kernfs_put.part.0+0x12d/0x480 [ 61.069886][ T406] ? unregister_netdevice_many+0x20/0x20 [ 61.069895][ T406] ? br_dev_delete+0x115/0x1a0 [bridge] [ 61.069958][ T406] rtnl_dellink+0x350/0xa30 [ 61.069965][ T406] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 61.069996][ T406] ? find_held_lock+0x2b/0x80 [ 61.070006][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.070016][ T406] ? find_held_lock+0x2b/0x80 [ 61.070022][ T406] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 61.070026][ T406] ? __lock_release+0x5d/0x170 [ 61.070034][ T406] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 61.070039][ T406] rtnetlink_rcv_msg+0x709/0xc00 [ 61.070046][ T406] ? rtnl_port_fill+0x850/0x850 [ 61.070050][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.070062][ T406] netlink_rcv_skb+0x121/0x340 [ 61.070068][ T406] ? rtnl_port_fill+0x850/0x850 [ 61.070074][ T406] ? netlink_ack+0xdd0/0xdd0 [ 61.070085][ T406] ? netlink_deliver_tap+0x13e/0x340 [ 61.070089][ T406] ? netlink_deliver_tap+0xc3/0x340 [ 61.070096][ T406] netlink_unicast+0x4aa/0x780 [ 61.070103][ T406] ? netlink_attachskb+0x810/0x810 [ 61.070110][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.070120][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.070127][ T406] ? netlink_unicast+0x780/0x780 [ 61.070132][ T406] ? __import_iovec+0x230/0x3b0 [ 61.070141][ T406] ? netlink_unicast+0x780/0x780 [ 61.070148][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.070157][ T406] ? get_timestamp.constprop.0+0x380/0x380 [ 61.070162][ T406] ? __copy_msghdr+0x3c0/0x3c0 [ 61.070177][ T406] ___sys_sendmsg+0xed/0x170 [ 61.070182][ T406] ? kasan_record_aux_stack+0x8c/0xa0 [ 61.070188][ T406] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 61.070198][ T406] ? copy_msghdr_from_user+0x110/0x110 [ 61.070207][ T406] ? find_held_lock+0x2b/0x80 [ 61.070214][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.070223][ T406] ? find_held_lock+0x2b/0x80 [ 61.070229][ T406] ? __virt_addr_valid+0x22a/0x450 [ 61.070236][ T406] ? __lock_release+0x5d/0x170 [ 61.070247][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.070253][ T406] ? __call_rcu_common.constprop.0+0x318/0x630 [ 61.070259][ T406] ? __sys_sendmsg_sock+0x20/0x20 [ 61.070271][ T406] ? rcu_is_watching+0x12/0xb0 [ 61.070278][ T406] do_syscall_64+0xc1/0xfd0 [ 61.070287][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.070293][ T406] RIP: 0033:0x7f8d794f41d7 [ 61.070300][ T406] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 61.070305][ T406] RSP: 002b:00007fff36d91498 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 61.070312][ T406] RAX: ffffffffffffffda RBX: 00007fff36d91bc0 RCX: 00007f8d794f41d7 [ 61.070315][ T406] RDX: 0000000000000000 RSI: 00007fff36d91500 RDI: 0000000000000005 [ 61.070318][ T406] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 61.070320][ T406] R10: 00007f8d793f0f60 R11: 0000000000000246 R12: 0000000000000002 [ 61.070322][ T406] R13: 00000000690dedc5 R14: 0000000000499600 R15: 0000000000000000 [ 61.070332][ T406] [ 61.070335][ T406] [ 61.092119][ T406] Allocated by task 309: [ 61.092347][ T406] kasan_save_stack+0x24/0x40 [ 61.092639][ T406] kasan_save_track+0x14/0x30 [ 61.092926][ T406] __kasan_kmalloc+0x7b/0x90 [ 61.093205][ T406] __kvmalloc_node_noprof+0x2e5/0x8e0 [ 61.093487][ T406] alloc_netdev_mqs+0x7d/0x1370 [ 61.093763][ T406] rtnl_create_link+0xa9e/0xe20 [ 61.094042][ T406] rtnl_newlink_create+0x203/0x770 [ 61.094350][ T406] __rtnl_newlink+0x231/0xa30 [ 61.094646][ T406] rtnl_newlink+0x693/0xa60 [ 61.095116][ T406] rtnetlink_rcv_msg+0x709/0xc00 [ 61.095407][ T406] netlink_rcv_skb+0x121/0x340 [ 61.095725][ T406] netlink_unicast+0x4aa/0x780 [ 61.096059][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.096526][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.096820][ T406] ___sys_sendmsg+0xed/0x170 [ 61.097125][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.097597][ T406] do_syscall_64+0xc1/0xfd0 [ 61.097891][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.098247][ T406] [ 61.098397][ T406] Freed by task 406: [ 61.098619][ T406] kasan_save_stack+0x24/0x40 [ 61.099261][ T406] kasan_save_track+0x14/0x30 [ 61.099554][ T406] __kasan_save_free_info+0x3b/0x60 [ 61.099841][ T406] __kasan_slab_free+0x3f/0x60 [ 61.100116][ T406] kfree+0x21d/0x540 [ 61.100326][ T406] device_release+0x9c/0x210 [ 61.100627][ T406] kobject_cleanup+0xfe/0x360 [ 61.101090][ T406] netdev_run_todo+0x81f/0xc60 [ 61.101545][ T406] rtnl_dellink+0x350/0xa30 [ 61.101834][ T406] rtnetlink_rcv_msg+0x709/0xc00 [ 61.102294][ T406] netlink_rcv_skb+0x121/0x340 [ 61.102636][ T406] netlink_unicast+0x4aa/0x780 [ 61.102939][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.103414][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.103705][ T406] ___sys_sendmsg+0xed/0x170 [ 61.104167][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.104460][ T406] do_syscall_64+0xc1/0xfd0 [ 61.104743][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.105288][ T406] [ 61.105604][ T406] Last potentially related work creation: [ 61.105924][ T406] kasan_save_stack+0x24/0x40 [ 61.106401][ T406] kasan_record_aux_stack+0x8c/0xa0 [ 61.106696][ T406] insert_work+0x34/0x230 [ 61.107100][ T406] __queue_work+0x5fd/0xab0 [ 61.107396][ T406] queue_work_on+0x84/0x90 [ 61.107687][ T406] fdb_delete+0x7bf/0xd50 [bridge] [ 61.108025][ T406] br_fdb_delete_by_port+0x1ce/0x260 [bridge] [ 61.108447][ T406] del_nbp+0x374/0xbe0 [bridge] [ 61.108791][ T406] br_dev_delete+0x91/0x1a0 [bridge] [ 61.109128][ T406] rtnl_dellink+0x334/0xa30 [ 61.109429][ T406] rtnetlink_rcv_msg+0x709/0xc00 [ 61.109720][ T406] netlink_rcv_skb+0x121/0x340 [ 61.110024][ T406] netlink_unicast+0x4aa/0x780 [ 61.110314][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.110604][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.110911][ T406] ___sys_sendmsg+0xed/0x170 [ 61.111206][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.111497][ T406] do_syscall_64+0xc1/0xfd0 [ 61.111797][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.112167][ T406] [ 61.112328][ T406] Second to last potentially related work creation: [ 61.112862][ T406] kasan_save_stack+0x24/0x40 [ 61.113176][ T406] kasan_record_aux_stack+0x8c/0xa0 [ 61.113465][ T406] insert_work+0x34/0x230 [ 61.113691][ T406] __queue_work+0x5fd/0xab0 [ 61.114164][ T406] queue_work_on+0x84/0x90 [ 61.114461][ T406] fdb_delete+0x7bf/0xd50 [bridge] [ 61.114813][ T406] br_fdb_delete_by_port+0x1ff/0x260 [bridge] [ 61.115230][ T406] nbp_vlan_delete+0x117/0x220 [bridge] [ 61.115779][ T406] br_vlan_info+0x1a9/0x350 [bridge] [ 61.116122][ T406] br_process_vlan_info+0x498/0x850 [bridge] [ 61.116530][ T406] br_afspec+0x3f8/0x4e0 [bridge] [ 61.116864][ T406] br_dellink+0x137/0x270 [bridge] [ 61.117387][ T406] rtnl_bridge_dellink+0x225/0x630 [ 61.117681][ T406] rtnetlink_rcv_msg+0x2fa/0xc00 [ 61.117981][ T406] netlink_rcv_skb+0x121/0x340 [ 61.118293][ T406] netlink_unicast+0x4aa/0x780 [ 61.118765][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.119056][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.119354][ T406] ___sys_sendmsg+0xed/0x170 [ 61.119696][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.120189][ T406] do_syscall_64+0xc1/0xfd0 [ 61.120492][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.120868][ T406] [ 61.121021][ T406] The buggy address belongs to the object at ffff88800be42000 [ 61.121021][ T406] which belongs to the cache kmalloc-8k of size 8192 [ 61.122031][ T406] The buggy address is located 1708 bytes inside of [ 61.122031][ T406] freed 8192-byte region [ffff88800be42000, ffff88800be44000) [ 61.122934][ T406] [ 61.123079][ T406] The buggy address belongs to the physical page: [ 61.123449][ T406] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbe40 [ 61.123952][ T406] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.124563][ T406] flags: 0x80000000000040(head|node=0|zone=1) [ 61.124941][ T406] page_type: f5(slab) [ 61.125183][ T406] raw: 0080000000000040 ffff8880010438c0 ffffea0000256a10 ffff888001041228 [ 61.126096][ T406] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 [ 61.126615][ T406] head: 0080000000000040 ffff8880010438c0 ffffea0000256a10 ffff888001041228 [ 61.127325][ T406] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 [ 61.127839][ T406] head: 0080000000000003 ffffea00002f9001 00000000ffffffff 00000000ffffffff [ 61.128418][ T406] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.128928][ T406] page dumped because: kasan: bad access detected [ 61.129312][ T406] [ 61.129475][ T406] Memory state around the buggy address: [ 61.129758][ T406] ffff88800be42580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.130209][ T406] ffff88800be42600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.130629][ T406] >ffff88800be42680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.131220][ T406] ^ [ 61.131490][ T406] ffff88800be42700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.131899][ T406] ffff88800be42780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.132508][ T406] ================================================================== [ 61.133015][ T406] Disabling lock debugging due to kernel taint [ 61.133380][ T406] ------------[ cut here ]------------ [ 61.133660][ T406] refcount_t: underflow; use-after-free. [ 61.134124][ T406] WARNING: CPU: 3 PID: 406 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0 [ 61.134634][ T406] Modules linked in: act_vlan cls_flower sch_ingress bridge stp llc 8021q vrf veth [ 61.135157][ T406] CPU: 3 UID: 0 PID: 406 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full) [ 61.135780][ T406] Tainted: [B]=BAD_PAGE [ 61.135996][ T406] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 61.136565][ T406] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0 [ 61.136977][ T406] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 05 9a e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff [ 61.138078][ T406] RSP: 0018:ffffc900006f71f0 EFLAGS: 00010286 [ 61.138456][ T406] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 61.138891][ T406] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 61.139486][ T406] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff353e134 [ 61.139904][ T406] R10: 0000000000000003 R11: ffffc900006f6d80 R12: 0000000000000001 [ 61.140529][ T406] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 61.140972][ T406] FS: 00007f8d79326800(0000) GS:ffff88809a572000(0000) knlGS:0000000000000000 [ 61.141471][ T406] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.141821][ T406] CR2: 00000000004e5ae8 CR3: 000000000bd7f003 CR4: 0000000000772ef0 [ 61.142249][ T406] PKRU: 55555554 [ 61.142474][ T406] Call Trace: [ 61.142687][ T406] [ 61.142842][ T406] netdev_run_todo+0x5f0/0xc60 [ 61.143343][ T406] ? dev_ingress_queue_create+0x190/0x190 [ 61.143635][ T406] ? generic_xdp_install+0x410/0x410 [ 61.143913][ T406] ? kernfs_put.part.0+0x12d/0x480 [ 61.144386][ T406] ? unregister_netdevice_many+0x20/0x20 [ 61.144674][ T406] ? br_dev_delete+0x115/0x1a0 [bridge] [ 61.145008][ T406] rtnl_dellink+0x350/0xa30 [ 61.145312][ T406] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 61.145857][ T406] ? find_held_lock+0x2b/0x80 [ 61.146166][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.146443][ T406] ? find_held_lock+0x2b/0x80 [ 61.146713][ T406] ? rtnetlink_rcv_msg+0x6e6/0xc00 [ 61.147158][ T406] ? __lock_release+0x5d/0x170 [ 61.147438][ T406] ? valid_bridge_getlink_req.constprop.0+0x640/0x640 [ 61.147790][ T406] rtnetlink_rcv_msg+0x709/0xc00 [ 61.148063][ T406] ? rtnl_port_fill+0x850/0x850 [ 61.148511][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.148796][ T406] netlink_rcv_skb+0x121/0x340 [ 61.149065][ T406] ? rtnl_port_fill+0x850/0x850 [ 61.149350][ T406] ? netlink_ack+0xdd0/0xdd0 [ 61.149802][ T406] ? netlink_deliver_tap+0x13e/0x340 [ 61.150071][ T406] ? netlink_deliver_tap+0xc3/0x340 [ 61.150371][ T406] netlink_unicast+0x4aa/0x780 [ 61.150649][ T406] ? netlink_attachskb+0x810/0x810 [ 61.151086][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.151378][ T406] netlink_sendmsg+0x714/0xbd0 [ 61.151653][ T406] ? netlink_unicast+0x780/0x780 [ 61.151926][ T406] ? __import_iovec+0x230/0x3b0 [ 61.152213][ T406] ? netlink_unicast+0x780/0x780 [ 61.152486][ T406] ____sys_sendmsg+0x3dd/0x890 [ 61.152768][ T406] ? get_timestamp.constprop.0+0x380/0x380 [ 61.153131][ T406] ? __copy_msghdr+0x3c0/0x3c0 [ 61.153587][ T406] ___sys_sendmsg+0xed/0x170 [ 61.153855][ T406] ? kasan_record_aux_stack+0x8c/0xa0 [ 61.154142][ T406] ? __call_rcu_common.constprop.0+0xa8/0x630 [ 61.154484][ T406] ? copy_msghdr_from_user+0x110/0x110 [ 61.154919][ T406] ? find_held_lock+0x2b/0x80 [ 61.155210][ T406] ? __lock_acquire+0x449/0x7e0 [ 61.155485][ T406] ? find_held_lock+0x2b/0x80 [ 61.155771][ T406] ? __virt_addr_valid+0x22a/0x450 [ 61.156211][ T406] ? __lock_release+0x5d/0x170 [ 61.156489][ T406] __sys_sendmsg+0x10b/0x1a0 [ 61.156761][ T406] ? __call_rcu_common.constprop.0+0x318/0x630 [ 61.157278][ T406] ? __sys_sendmsg_sock+0x20/0x20 [ 61.157559][ T406] ? rcu_is_watching+0x12/0xb0 [ 61.157828][ T406] do_syscall_64+0xc1/0xfd0 [ 61.158099][ T406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 61.158612][ T406] RIP: 0033:0x7f8d794f41d7 [ 61.158898][ T406] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 61.160097][ T406] RSP: 002b:00007fff36d91498 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 61.160530][ T406] RAX: ffffffffffffffda RBX: 00007fff36d91bc0 RCX: 00007f8d794f41d7 [ 61.160939][ T406] RDX: 0000000000000000 RSI: 00007fff36d91500 RDI: 0000000000000005 [ 61.161546][ T406] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 61.161965][ T406] R10: 00007f8d793f0f60 R11: 0000000000000246 R12: 0000000000000002 [ 61.162555][ T406] R13: 00000000690dedc5 R14: 0000000000499600 R15: 0000000000000000 [ 61.162966][ T406] [ 61.163214][ T406] irq event stamp: 53583 [ 61.163420][ T406] hardirqs last enabled at (53583): [] irqentry_exit+0x3b/0x80 [ 61.164086][ T406] hardirqs last disabled at (53582): [] handle_softirqs+0x47f/0x610 [ 61.164591][ T406] softirqs last enabled at (53446): [] handle_softirqs+0x352/0x610 [ 61.165263][ T406] softirqs last disabled at (53439): [] irq_exit_rcu+0xab/0x100 [ 61.165738][ T406] ---[ end trace 0000000000000000 ]---