[ 21.469979][ T315] gre: GRE over IPv4 demultiplexer driver
[ 21.488998][ T315] ip_gre: GRE over IPv4 tunneling driver
[ 22.501251][ T325] GACT probability NOT on
[ 22.813575][ T327] ip6_gre: GRE over IPv6 tunneling driver
[ 22.872577][ T326] ip (326) used greatest stack depth: 23888 bytes left
[ 23.027587][ T11] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 23.154498][ T11] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 23.482416][ T11] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 23.561524][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 24.447913][ T341] br1: port 1(veth1) entered blocking state
[ 24.448759][ T341] br1: port 1(veth1) entered disabled state
[ 24.449297][ T341] veth1: entered allmulticast mode
[ 24.452794][ T341] veth1: entered promiscuous mode
[ 24.577757][ T45] br1: port 1(veth1) entered blocking state
[ 24.578335][ T45] br1: port 1(veth1) entered forwarding state
[ 24.582449][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 24.583959][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 24.706666][ T343] br1: port 2(veth2) entered blocking state
[ 24.707884][ T343] br1: port 2(veth2) entered disabled state
[ 24.708918][ T343] veth2: entered allmulticast mode
[ 24.716403][ T343] veth2: entered promiscuous mode
[ 24.837874][ T45] br1: port 2(veth2) entered blocking state
[ 24.838608][ T45] br1: port 2(veth2) entered forwarding state
[ 25.475416][ T64] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 25.522532][ T70] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 25.738297][ T353] 8021q: 802.1Q VLAN Support v1.8
[ 25.842675][ T70] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 26.114022][ T12] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 28.481586][ C2] ip6_tnl_xmit_ctl: 2 callbacks suppressed
[ 28.481598][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 33.562889][ T388] Mirror/redirect action on
[ 36.289573][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 52.161518][ C2] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 54.447878][ T482] ==================================================================
[ 54.448206][ T482] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 54.448465][ T482] Read of size 1 at addr ffff888008be46ac by task ip/482
[ 54.448674][ T482]
[ 54.448769][ T482] CPU: 2 UID: 0 PID: 482 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 54.448774][ T482] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 54.448776][ T482] Call Trace:
[ 54.448779][ T482]
[ 54.448780][ T482] dump_stack_lvl+0x82/0xc0
[ 54.448786][ T482] print_address_description.constprop.0+0x2c/0x3a0
[ 54.448792][ T482] ? kobject_put+0xbb/0xd0
[ 54.448796][ T482] print_report+0xb4/0x270
[ 54.448799][ T482] ? kobject_put+0xbb/0xd0
[ 54.448802][ T482] ? kasan_addr_to_slab+0x21/0x70
[ 54.448805][ T482] ? kobject_put+0xbb/0xd0
[ 54.448808][ T482] kasan_report+0xca/0x100
[ 54.448812][ T482] ? kobject_put+0xbb/0xd0
[ 54.448817][ T482] kobject_put+0xbb/0xd0
[ 54.448821][ T482] netdev_run_todo+0x5f0/0xc60
[ 54.448825][ T482] ? dev_ingress_queue_create+0x190/0x190
[ 54.448828][ T482] ? generic_xdp_install+0x410/0x410
[ 54.448832][ T482] ? lockdep_hardirqs_on+0x7c/0x110
[ 54.448839][ T482] rtnl_dellink+0x350/0xa30
[ 54.448844][ T482] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 54.448862][ T482] ? find_held_lock+0x2b/0x80
[ 54.448869][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.448875][ T482] ? find_held_lock+0x2b/0x80
[ 54.448878][ T482] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 54.448881][ T482] ? __lock_release+0x5d/0x170
[ 54.448885][ T482] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 54.448889][ T482] rtnetlink_rcv_msg+0x709/0xc00
[ 54.448892][ T482] ? rtnl_port_fill+0x850/0x850
[ 54.448895][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.448902][ T482] netlink_rcv_skb+0x121/0x340
[ 54.448906][ T482] ? rtnl_port_fill+0x850/0x850
[ 54.448910][ T482] ? netlink_ack+0xdd0/0xdd0
[ 54.448916][ T482] ? netlink_deliver_tap+0x13e/0x340
[ 54.448919][ T482] ? netlink_deliver_tap+0xc3/0x340
[ 54.448923][ T482] netlink_unicast+0x4aa/0x780
[ 54.448927][ T482] ? netlink_attachskb+0x810/0x810
[ 54.448930][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.448936][ T482] netlink_sendmsg+0x714/0xbd0
[ 54.448940][ T482] ? netlink_unicast+0x780/0x780
[ 54.448944][ T482] ? __import_iovec+0x230/0x3b0
[ 54.448949][ T482] ? netlink_unicast+0x780/0x780
[ 54.448952][ T482] ____sys_sendmsg+0x3dd/0x890
[ 54.448957][ T482] ? get_timestamp.constprop.0+0x380/0x380
[ 54.448960][ T482] ? __copy_msghdr+0x3c0/0x3c0
[ 54.448967][ T482] ___sys_sendmsg+0xed/0x170
[ 54.448970][ T482] ? kasan_record_aux_stack+0x8c/0xa0
[ 54.448973][ T482] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 54.448978][ T482] ? copy_msghdr_from_user+0x110/0x110
[ 54.448983][ T482] ? find_held_lock+0x2b/0x80
[ 54.448987][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.448993][ T482] ? find_held_lock+0x2b/0x80
[ 54.448996][ T482] ? __virt_addr_valid+0x22a/0x450
[ 54.449001][ T482] ? __lock_release+0x5d/0x170
[ 54.449007][ T482] __sys_sendmsg+0x10b/0x1a0
[ 54.449010][ T482] ? __call_rcu_common.constprop.0+0x318/0x630
[ 54.449014][ T482] ? __sys_sendmsg_sock+0x20/0x20
[ 54.449023][ T482] ? rcu_is_watching+0x12/0xb0
[ 54.449029][ T482] do_syscall_64+0xc1/0xfd0
[ 54.449036][ T482] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 54.449041][ T482] RIP: 0033:0x7fbe8302d1d7
[ 54.449047][ T482] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 54.449051][ T482] RSP: 002b:00007ffd43e083e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 54.449055][ T482] RAX: ffffffffffffffda RBX: 00007ffd43e08b10 RCX: 00007fbe8302d1d7
[ 54.449057][ T482] RDX: 0000000000000000 RSI: 00007ffd43e08450 RDI: 0000000000000005
[ 54.449059][ T482] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 54.449060][ T482] R10: 00007fbe82f29f60 R11: 0000000000000246 R12: 0000000000000002
[ 54.449062][ T482] R13: 00000000690df8f4 R14: 0000000000499600 R15: 0000000000000000
[ 54.449069][ T482]
[ 54.449070][ T482]
[ 54.465178][ T482] Allocated by task 360:
[ 54.465318][ T482] kasan_save_stack+0x24/0x40
[ 54.465601][ T482] kasan_save_track+0x14/0x30
[ 54.465777][ T482] __kasan_kmalloc+0x7b/0x90
[ 54.465949][ T482] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 54.466128][ T482] alloc_netdev_mqs+0x7d/0x1370
[ 54.466304][ T482] rtnl_create_link+0xa9e/0xe20
[ 54.466477][ T482] rtnl_newlink_create+0x203/0x770
[ 54.466643][ T482] __rtnl_newlink+0x231/0xa30
[ 54.466823][ T482] rtnl_newlink+0x693/0xa60
[ 54.467112][ T482] rtnetlink_rcv_msg+0x709/0xc00
[ 54.467288][ T482] netlink_rcv_skb+0x121/0x340
[ 54.467479][ T482] netlink_unicast+0x4aa/0x780
[ 54.467653][ T482] netlink_sendmsg+0x714/0xbd0
[ 54.467838][ T482] ____sys_sendmsg+0x3dd/0x890
[ 54.468012][ T482] ___sys_sendmsg+0xed/0x170
[ 54.468199][ T482] __sys_sendmsg+0x10b/0x1a0
[ 54.468380][ T482] do_syscall_64+0xc1/0xfd0
[ 54.468587][ T482] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 54.468837][ T482]
[ 54.469019][ T482] Freed by task 482:
[ 54.469187][ T482] kasan_save_stack+0x24/0x40
[ 54.469467][ T482] kasan_save_track+0x14/0x30
[ 54.469641][ T482] __kasan_save_free_info+0x3b/0x60
[ 54.469842][ T482] __kasan_slab_free+0x3f/0x60
[ 54.470016][ T482] kfree+0x21d/0x540
[ 54.470161][ T482] device_release+0x9c/0x210
[ 54.470335][ T482] kobject_cleanup+0xfe/0x360
[ 54.470537][ T482] netdev_run_todo+0x81f/0xc60
[ 54.470729][ T482] rtnl_dellink+0x350/0xa30
[ 54.471002][ T482] rtnetlink_rcv_msg+0x709/0xc00
[ 54.471281][ T482] netlink_rcv_skb+0x121/0x340
[ 54.471462][ T482] netlink_unicast+0x4aa/0x780
[ 54.471631][ T482] netlink_sendmsg+0x714/0xbd0
[ 54.471806][ T482] ____sys_sendmsg+0x3dd/0x890
[ 54.471976][ T482] ___sys_sendmsg+0xed/0x170
[ 54.472162][ T482] __sys_sendmsg+0x10b/0x1a0
[ 54.472336][ T482] do_syscall_64+0xc1/0xfd0
[ 54.472508][ T482] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 54.472718][ T482]
[ 54.472903][ T482] The buggy address belongs to the object at ffff888008be4000
[ 54.472903][ T482] which belongs to the cache kmalloc-4k of size 4096
[ 54.473346][ T482] The buggy address is located 1708 bytes inside of
[ 54.473346][ T482] freed 4096-byte region [ffff888008be4000, ffff888008be5000)
[ 54.473875][ T482]
[ 54.473969][ T482] The buggy address belongs to the physical page:
[ 54.474200][ T482] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8be0
[ 54.474620][ T482] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 54.474895][ T482] flags: 0x80000000000040(head|node=0|zone=1)
[ 54.475234][ T482] page_type: f5(slab)
[ 54.475371][ T482] raw: 0080000000000040 ffff888001043700 ffffea0000243a10 ffffea0000305a10
[ 54.475773][ T482] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 54.476094][ T482] head: 0080000000000040 ffff888001043700 ffffea0000243a10 ffffea0000305a10
[ 54.476432][ T482] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 54.476774][ T482] head: 0080000000000003 ffffea000022f801 00000000ffffffff 00000000ffffffff
[ 54.477209][ T482] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 54.477532][ T482] page dumped because: kasan: bad access detected
[ 54.477750][ T482]
[ 54.477847][ T482] Memory state around the buggy address:
[ 54.478015][ T482] ffff888008be4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 54.478282][ T482] ffff888008be4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 54.478630][ T482] >ffff888008be4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 54.478907][ T482] ^
[ 54.479270][ T482] ffff888008be4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 54.479517][ T482] ffff888008be4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 54.479868][ T482] ==================================================================
[ 54.480575][ T482] Disabling lock debugging due to kernel taint
[ 54.480844][ T482] ------------[ cut here ]------------
[ 54.481037][ T482] refcount_t: underflow; use-after-free.
[ 54.481286][ T482] WARNING: CPU: 2 PID: 482 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 54.481638][ T482] Modules linked in: cls_flower act_mirred 8021q bridge stp llc ip6_gre ip6_tunnel tunnel6 act_gact cls_matchall ip_gre gre sch_ingress vrf veth
[ 54.482173][ T482] CPU: 2 UID: 0 PID: 482 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 54.482554][ T482] Tainted: [B]=BAD_PAGE
[ 54.482735][ T482] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 54.483115][ T482] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 54.483382][ T482] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d a5 88 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 54.484174][ T482] RSP: 0018:ffffc900007e71f0 EFLAGS: 00010286
[ 54.484427][ T482] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 54.484840][ T482] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 54.485153][ T482] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff127e134
[ 54.485445][ T482] R10: 0000000000000003 R11: ffffc900007e6d80 R12: 0000000000000001
[ 54.485853][ T482] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 54.486173][ T482] FS: 00007fbe82e5f800(0000) GS:ffff8880abaf2000(0000) knlGS:0000000000000000
[ 54.486607][ T482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 54.486881][ T482] CR2: 00000000004e6e70 CR3: 000000000541d006 CR4: 0000000000772ef0
[ 54.487206][ T482] PKRU: 55555554
[ 54.487364][ T482] Call Trace:
[ 54.487631][ T482]
[ 54.487750][ T482] netdev_run_todo+0x5f0/0xc60
[ 54.487981][ T482] ? dev_ingress_queue_create+0x190/0x190
[ 54.488189][ T482] ? generic_xdp_install+0x410/0x410
[ 54.488399][ T482] ? lockdep_hardirqs_on+0x7c/0x110
[ 54.488595][ T482] rtnl_dellink+0x350/0xa30
[ 54.488887][ T482] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 54.489168][ T482] ? find_held_lock+0x2b/0x80
[ 54.489482][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.489691][ T482] ? find_held_lock+0x2b/0x80
[ 54.489891][ T482] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 54.490119][ T482] ? __lock_release+0x5d/0x170
[ 54.490418][ T482] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 54.490660][ T482] rtnetlink_rcv_msg+0x709/0xc00
[ 54.490873][ T482] ? rtnl_port_fill+0x850/0x850
[ 54.491077][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.491292][ T482] netlink_rcv_skb+0x121/0x340
[ 54.491509][ T482] ? rtnl_port_fill+0x850/0x850
[ 54.491716][ T482] ? netlink_ack+0xdd0/0xdd0
[ 54.491937][ T482] ? netlink_deliver_tap+0x13e/0x340
[ 54.492266][ T482] ? netlink_deliver_tap+0xc3/0x340
[ 54.492465][ T482] netlink_unicast+0x4aa/0x780
[ 54.492667][ T482] ? netlink_attachskb+0x810/0x810
[ 54.492879][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.493222][ T482] netlink_sendmsg+0x714/0xbd0
[ 54.493419][ T482] ? netlink_unicast+0x780/0x780
[ 54.493619][ T482] ? __import_iovec+0x230/0x3b0
[ 54.493825][ T482] ? netlink_unicast+0x780/0x780
[ 54.494130][ T482] ____sys_sendmsg+0x3dd/0x890
[ 54.494342][ T482] ? get_timestamp.constprop.0+0x380/0x380
[ 54.494583][ T482] ? __copy_msghdr+0x3c0/0x3c0
[ 54.494794][ T482] ___sys_sendmsg+0xed/0x170
[ 54.495108][ T482] ? kasan_record_aux_stack+0x8c/0xa0
[ 54.495322][ T482] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 54.495561][ T482] ? copy_msghdr_from_user+0x110/0x110
[ 54.495762][ T482] ? find_held_lock+0x2b/0x80
[ 54.496065][ T482] ? __lock_acquire+0x449/0x7e0
[ 54.496274][ T482] ? find_held_lock+0x2b/0x80
[ 54.496470][ T482] ? __virt_addr_valid+0x22a/0x450
[ 54.496691][ T482] ? __lock_release+0x5d/0x170
[ 54.496978][ T482] __sys_sendmsg+0x10b/0x1a0
[ 54.497179][ T482] ? __call_rcu_common.constprop.0+0x318/0x630
[ 54.497411][ T482] ? __sys_sendmsg_sock+0x20/0x20
[ 54.497712][ T482] ? rcu_is_watching+0x12/0xb0
[ 54.497933][ T482] do_syscall_64+0xc1/0xfd0
[ 54.498139][ T482] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 54.498383][ T482] RIP: 0033:0x7fbe8302d1d7
[ 54.498777][ T482] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 54.499617][ T482] RSP: 002b:00007ffd43e083e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 54.500159][ T482] RAX: ffffffffffffffda RBX: 00007ffd43e08b10 RCX: 00007fbe8302d1d7
[ 54.500542][ T482] RDX: 0000000000000000 RSI: 00007ffd43e08450 RDI: 0000000000000005
[ 54.501125][ T482] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 54.501493][ T482] R10: 00007fbe82f29f60 R11: 0000000000000246 R12: 0000000000000002
[ 54.501893][ T482] R13: 00000000690df8f4 R14: 0000000000499600 R15: 0000000000000000
[ 54.502498][ T482]
[ 54.502738][ T482] irq event stamp: 44425
[ 54.502966][ T482] hardirqs last enabled at (44425): [] irqentry_exit+0x3b/0x80
[ 54.503625][ T482] hardirqs last disabled at (44424): [] handle_softirqs+0x47f/0x610
[ 54.504080][ T482] softirqs last enabled at (43942): [] handle_softirqs+0x352/0x610
[ 54.504595][ T482] softirqs last disabled at (43933): [] irq_exit_rcu+0xab/0x100
[ 54.505262][ T482] ---[ end trace 0000000000000000 ]---
[ 55.037074][ T489] br1: port 1(veth1) entered disabled state
[ 55.120953][ T490] br1: port 2(veth2) entered disabled state
[ 55.190735][ T491] veth2: left allmulticast mode
[ 55.190982][ T491] veth2: left promiscuous mode
[ 55.191314][ T491] br1: port 2(veth2) entered disabled state
[ 55.192521][ T491] veth1: left allmulticast mode
[ 55.192720][ T491] veth1: left promiscuous mode
[ 55.193024][ T491] br1: port 1(veth1) entered disabled state