[ 19.952535][ T302] br1: port 1(veth1) entered blocking state
[ 19.953155][ T302] br1: port 1(veth1) entered disabled state
[ 19.953734][ T302] veth1: entered allmulticast mode
[ 19.957358][ T302] veth1: entered promiscuous mode
[ 20.062920][ T38] br1: port 1(veth1) entered blocking state
[ 20.063474][ T38] br1: port 1(veth1) entered forwarding state
[ 20.177907][ T305] br1: port 2(veth2) entered blocking state
[ 20.178370][ T305] br1: port 2(veth2) entered disabled state
[ 20.178796][ T305] veth2: entered allmulticast mode
[ 20.182171][ T305] veth2: entered promiscuous mode
[ 20.289129][ T38] br1: port 2(veth2) entered blocking state
[ 20.289627][ T38] br1: port 2(veth2) entered forwarding state
[ 55.002620][ T665] br1: port 2(veth2) entered disabled state
[ 55.115427][ T666] veth2: left allmulticast mode
[ 55.115883][ T666] veth2: left promiscuous mode
[ 55.116475][ T666] br1: port 2(veth2) entered disabled state
[ 55.272907][ T667] br1: port 1(veth1) entered disabled state
[ 55.392857][ T668] veth1: left allmulticast mode
[ 55.393271][ T668] veth1: left promiscuous mode
[ 55.393802][ T668] br1: port 1(veth1) entered disabled state
[ 55.578257][ T669] ==================================================================
[ 55.578594][ T669] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 55.578892][ T669] Read of size 1 at addr ffff88800bd1a6ac by task ip/669
[ 55.579099][ T669]
[ 55.579186][ T669] CPU: 1 UID: 0 PID: 669 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 55.579191][ T669] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 55.579193][ T669] Call Trace:
[ 55.579196][ T669]
[ 55.579198][ T669] dump_stack_lvl+0x82/0xc0
[ 55.579205][ T669] print_address_description.constprop.0+0x2c/0x3a0
[ 55.579213][ T669] ? kobject_put+0xbb/0xd0
[ 55.579217][ T669] print_report+0xb4/0x270
[ 55.579221][ T669] ? kobject_put+0xbb/0xd0
[ 55.579224][ T669] ? kasan_addr_to_slab+0x21/0x70
[ 55.579227][ T669] ? kobject_put+0xbb/0xd0
[ 55.579230][ T669] kasan_report+0xca/0x100
[ 55.579234][ T669] ? kobject_put+0xbb/0xd0
[ 55.579239][ T669] kobject_put+0xbb/0xd0
[ 55.579243][ T669] netdev_run_todo+0x5f0/0xc60
[ 55.579248][ T669] ? dev_ingress_queue_create+0x190/0x190
[ 55.579252][ T669] ? generic_xdp_install+0x410/0x410
[ 55.579254][ T669] ? kernfs_put.part.0+0x12d/0x480
[ 55.579260][ T669] ? unregister_netdevice_many+0x20/0x20
[ 55.579267][ T669] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 55.579303][ T669] rtnl_dellink+0x350/0xa30
[ 55.579309][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 55.579341][ T669] ? find_held_lock+0x2b/0x80
[ 55.579348][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.579354][ T669] ? find_held_lock+0x2b/0x80
[ 55.579358][ T669] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 55.579360][ T669] ? __lock_release+0x5d/0x170
[ 55.579365][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 55.579368][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.579372][ T669] ? rtnl_port_fill+0x850/0x850
[ 55.579375][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.579386][ T669] netlink_rcv_skb+0x121/0x340
[ 55.579393][ T669] ? rtnl_port_fill+0x850/0x850
[ 55.579399][ T669] ? netlink_ack+0xdd0/0xdd0
[ 55.579406][ T669] ? netlink_deliver_tap+0x13e/0x340
[ 55.579409][ T669] ? netlink_deliver_tap+0xc3/0x340
[ 55.579413][ T669] netlink_unicast+0x4aa/0x780
[ 55.579417][ T669] ? netlink_attachskb+0x810/0x810
[ 55.579421][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.579427][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.579431][ T669] ? netlink_unicast+0x780/0x780
[ 55.579435][ T669] ? __import_iovec+0x230/0x3b0
[ 55.579443][ T669] ? netlink_unicast+0x780/0x780
[ 55.579449][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.579459][ T669] ? get_timestamp.constprop.0+0x380/0x380
[ 55.579464][ T669] ? __copy_msghdr+0x3c0/0x3c0
[ 55.579473][ T669] ___sys_sendmsg+0xed/0x170
[ 55.579478][ T669] ? kasan_record_aux_stack+0x8c/0xa0
[ 55.579483][ T669] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 55.579492][ T669] ? copy_msghdr_from_user+0x110/0x110
[ 55.579498][ T669] ? find_held_lock+0x2b/0x80
[ 55.579502][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.579508][ T669] ? find_held_lock+0x2b/0x80
[ 55.579512][ T669] ? __virt_addr_valid+0x22a/0x450
[ 55.579519][ T669] ? __lock_release+0x5d/0x170
[ 55.579525][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.579528][ T669] ? __call_rcu_common.constprop.0+0x318/0x630
[ 55.579532][ T669] ? __sys_sendmsg_sock+0x20/0x20
[ 55.579540][ T669] ? rcu_is_watching+0x12/0xb0
[ 55.579544][ T669] do_syscall_64+0xc1/0xfd0
[ 55.579550][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.579555][ T669] RIP: 0033:0x7f93080731d7
[ 55.579560][ T669] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 55.579564][ T669] RSP: 002b:00007ffda69e0d48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 55.579568][ T669] RAX: ffffffffffffffda RBX: 00007ffda69e1470 RCX: 00007f93080731d7
[ 55.579571][ T669] RDX: 0000000000000000 RSI: 00007ffda69e0db0 RDI: 0000000000000005
[ 55.579572][ T669] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 55.579574][ T669] R10: 00007f9307f6ff60 R11: 0000000000000246 R12: 0000000000000002
[ 55.579577][ T669] R13: 00000000690df901 R14: 0000000000499600 R15: 0000000000000000
[ 55.579583][ T669]
[ 55.579584][ T669]
[ 55.592847][ T669] Allocated by task 297:
[ 55.593005][ T669] kasan_save_stack+0x24/0x40
[ 55.593189][ T669] kasan_save_track+0x14/0x30
[ 55.593372][ T669] __kasan_kmalloc+0x7b/0x90
[ 55.593570][ T669] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 55.593740][ T669] alloc_netdev_mqs+0x7d/0x1370
[ 55.593934][ T669] rtnl_create_link+0xa9e/0xe20
[ 55.594123][ T669] rtnl_newlink_create+0x203/0x770
[ 55.594296][ T669] __rtnl_newlink+0x231/0xa30
[ 55.594483][ T669] rtnl_newlink+0x693/0xa60
[ 55.594647][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.594825][ T669] netlink_rcv_skb+0x121/0x340
[ 55.595022][ T669] netlink_unicast+0x4aa/0x780
[ 55.595193][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.595375][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.595560][ T669] ___sys_sendmsg+0xed/0x170
[ 55.595734][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.595929][ T669] do_syscall_64+0xc1/0xfd0
[ 55.596119][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.596335][ T669]
[ 55.596439][ T669] Freed by task 669:
[ 55.596567][ T669] kasan_save_stack+0x24/0x40
[ 55.596740][ T669] kasan_save_track+0x14/0x30
[ 55.596933][ T669] __kasan_save_free_info+0x3b/0x60
[ 55.597122][ T669] __kasan_slab_free+0x3f/0x60
[ 55.597295][ T669] kfree+0x21d/0x540
[ 55.597442][ T669] device_release+0x9c/0x210
[ 55.597621][ T669] kobject_cleanup+0xfe/0x360
[ 55.597795][ T669] netdev_run_todo+0x81f/0xc60
[ 55.597990][ T669] rtnl_dellink+0x350/0xa30
[ 55.598183][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.598368][ T669] netlink_rcv_skb+0x121/0x340
[ 55.598551][ T669] netlink_unicast+0x4aa/0x780
[ 55.598733][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.598926][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.599101][ T669] ___sys_sendmsg+0xed/0x170
[ 55.599282][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.599476][ T669] do_syscall_64+0xc1/0xfd0
[ 55.599642][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.599866][ T669]
[ 55.599963][ T669] Last potentially related work creation:
[ 55.600134][ T669] kasan_save_stack+0x24/0x40
[ 55.600338][ T669] kasan_record_aux_stack+0x8c/0xa0
[ 55.600525][ T669] insert_work+0x34/0x230
[ 55.600652][ T669] __queue_work+0x5fd/0xab0
[ 55.600831][ T669] queue_work_on+0x84/0x90
[ 55.601011][ T669] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 55.601280][ T669] br_dev_uninit+0x19/0x40 [bridge]
[ 55.601500][ T669] unregister_netdevice_many_notify+0xa80/0x1b30
[ 55.601719][ T669] rtnl_dellink+0x344/0xa30
[ 55.601922][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.602097][ T669] netlink_rcv_skb+0x121/0x340
[ 55.602280][ T669] netlink_unicast+0x4aa/0x780
[ 55.602475][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.602645][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.602826][ T669] ___sys_sendmsg+0xed/0x170
[ 55.603012][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.603182][ T669] do_syscall_64+0xc1/0xfd0
[ 55.603384][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.603624][ T669]
[ 55.603711][ T669] Second to last potentially related work creation:
[ 55.603944][ T669] kasan_save_stack+0x24/0x40
[ 55.604119][ T669] kasan_record_aux_stack+0x8c/0xa0
[ 55.604294][ T669] insert_work+0x34/0x230
[ 55.604454][ T669] __queue_work+0x5fd/0xab0
[ 55.604625][ T669] queue_work_on+0x84/0x90
[ 55.604793][ T669] fdb_delete+0x7bf/0xd50 [bridge]
[ 55.605020][ T669] br_fdb_delete_by_port+0x1ce/0x260 [bridge]
[ 55.605252][ T669] del_nbp+0x374/0xbe0 [bridge]
[ 55.605478][ T669] br_del_if+0xa3/0x1e0 [bridge]
[ 55.605674][ T669] do_set_master+0x144/0x4f0
[ 55.605853][ T669] do_setlink.constprop.0+0x9ee/0x2460
[ 55.606032][ T669] rtnl_newlink+0x693/0xa60
[ 55.606199][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.606378][ T669] netlink_rcv_skb+0x121/0x340
[ 55.606569][ T669] netlink_unicast+0x4aa/0x780
[ 55.606734][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.606926][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.607096][ T669] ___sys_sendmsg+0xed/0x170
[ 55.607272][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.607471][ T669] do_syscall_64+0xc1/0xfd0
[ 55.607638][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.607856][ T669]
[ 55.607958][ T669] The buggy address belongs to the object at ffff88800bd1a000
[ 55.607958][ T669] which belongs to the cache kmalloc-8k of size 8192
[ 55.608371][ T669] The buggy address is located 1708 bytes inside of
[ 55.608371][ T669] freed 8192-byte region [ffff88800bd1a000, ffff88800bd1c000)
[ 55.608787][ T669]
[ 55.608988][ T669] The buggy address belongs to the physical page:
[ 55.609203][ T669] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbd18
[ 55.609525][ T669] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 55.609894][ T669] flags: 0x80000000000040(head|node=0|zone=1)
[ 55.610106][ T669] page_type: f5(slab)
[ 55.610236][ T669] raw: 0080000000000040 ffff8880010438c0 ffffea000012fe10 ffff888001041228
[ 55.610677][ T669] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 55.611006][ T669] head: 0080000000000040 ffff8880010438c0 ffffea000012fe10 ffff888001041228
[ 55.611307][ T669] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 55.611734][ T669] head: 0080000000000003 ffffea00002f4601 00000000ffffffff 00000000ffffffff
[ 55.612053][ T669] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 55.612477][ T669] page dumped because: kasan: bad access detected
[ 55.612683][ T669]
[ 55.612768][ T669] Memory state around the buggy address:
[ 55.612956][ T669] ffff88800bd1a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.613291][ T669] ffff88800bd1a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.613573][ T669] >ffff88800bd1a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.613944][ T669] ^
[ 55.614109][ T669] ffff88800bd1a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.614367][ T669] ffff88800bd1a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 55.614729][ T669] ==================================================================
[ 55.615740][ T669] Disabling lock debugging due to kernel taint
[ 55.616092][ T669] ------------[ cut here ]------------
[ 55.616293][ T669] refcount_t: underflow; use-after-free.
[ 55.616527][ T669] WARNING: CPU: 3 PID: 669 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 55.616902][ T669] Modules linked in: act_skbedit cls_flower sch_prio sch_ingress bridge stp llc vrf veth
[ 55.617298][ T669] CPU: 3 UID: 0 PID: 669 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 55.617727][ T669] Tainted: [B]=BAD_PAGE
[ 55.617881][ T669] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 55.618144][ T669] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 55.618419][ T669] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d c5 b6 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 55.619169][ T669] RSP: 0018:ffffc90000f871f0 EFLAGS: 00010286
[ 55.619437][ T669] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 55.619751][ T669] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 55.620072][ T669] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff6ebe134
[ 55.620386][ T669] R10: 0000000000000003 R11: ffffc90000f86d80 R12: 0000000000000001
[ 55.620695][ T669] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 55.621009][ T669] FS: 00007f9307ea5800(0000) GS:ffff888077f72000(0000) knlGS:0000000000000000
[ 55.621380][ T669] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 55.621633][ T669] CR2: 00000000004061e9 CR3: 000000000c57d005 CR4: 0000000000772ef0
[ 55.621943][ T669] PKRU: 55555554
[ 55.622107][ T669] Call Trace:
[ 55.622264][ T669]
[ 55.622369][ T669] netdev_run_todo+0x5f0/0xc60
[ 55.622578][ T669] ? dev_ingress_queue_create+0x190/0x190
[ 55.622786][ T669] ? generic_xdp_install+0x410/0x410
[ 55.622985][ T669] ? kernfs_put.part.0+0x12d/0x480
[ 55.623203][ T669] ? unregister_netdevice_many+0x20/0x20
[ 55.623408][ T669] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 55.623661][ T669] rtnl_dellink+0x350/0xa30
[ 55.623869][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 55.624147][ T669] ? find_held_lock+0x2b/0x80
[ 55.624353][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.624557][ T669] ? find_held_lock+0x2b/0x80
[ 55.624758][ T669] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 55.624958][ T669] ? __lock_release+0x5d/0x170
[ 55.625182][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 55.625432][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 55.625639][ T669] ? rtnl_port_fill+0x850/0x850
[ 55.625839][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.626052][ T669] netlink_rcv_skb+0x121/0x340
[ 55.626252][ T669] ? rtnl_port_fill+0x850/0x850
[ 55.626453][ T669] ? netlink_ack+0xdd0/0xdd0
[ 55.626654][ T669] ? netlink_deliver_tap+0x13e/0x340
[ 55.626855][ T669] ? netlink_deliver_tap+0xc3/0x340
[ 55.627058][ T669] netlink_unicast+0x4aa/0x780
[ 55.627262][ T669] ? netlink_attachskb+0x810/0x810
[ 55.627460][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.627663][ T669] netlink_sendmsg+0x714/0xbd0
[ 55.627861][ T669] ? netlink_unicast+0x780/0x780
[ 55.628071][ T669] ? __import_iovec+0x230/0x3b0
[ 55.628271][ T669] ? netlink_unicast+0x780/0x780
[ 55.628470][ T669] ____sys_sendmsg+0x3dd/0x890
[ 55.628675][ T669] ? get_timestamp.constprop.0+0x380/0x380
[ 55.628930][ T669] ? __copy_msghdr+0x3c0/0x3c0
[ 55.629138][ T669] ___sys_sendmsg+0xed/0x170
[ 55.629338][ T669] ? kasan_record_aux_stack+0x8c/0xa0
[ 55.629540][ T669] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 55.629794][ T669] ? copy_msghdr_from_user+0x110/0x110
[ 55.629996][ T669] ? find_held_lock+0x2b/0x80
[ 55.630207][ T669] ? __lock_acquire+0x449/0x7e0
[ 55.630421][ T669] ? find_held_lock+0x2b/0x80
[ 55.630639][ T669] ? __virt_addr_valid+0x22a/0x450
[ 55.630846][ T669] ? __lock_release+0x5d/0x170
[ 55.631061][ T669] __sys_sendmsg+0x10b/0x1a0
[ 55.631265][ T669] ? __call_rcu_common.constprop.0+0x318/0x630
[ 55.631518][ T669] ? __sys_sendmsg_sock+0x20/0x20
[ 55.631721][ T669] ? rcu_is_watching+0x12/0xb0
[ 55.631919][ T669] do_syscall_64+0xc1/0xfd0
[ 55.632130][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 55.632386][ T669] RIP: 0033:0x7f93080731d7
[ 55.632603][ T669] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 55.633319][ T669] RSP: 002b:00007ffda69e0d48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 55.633652][ T669] RAX: ffffffffffffffda RBX: 00007ffda69e1470 RCX: 00007f93080731d7
[ 55.633980][ T669] RDX: 0000000000000000 RSI: 00007ffda69e0db0 RDI: 0000000000000005
[ 55.634295][ T669] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 55.634602][ T669] R10: 00007f9307f6ff60 R11: 0000000000000246 R12: 0000000000000002
[ 55.634901][ T669] R13: 00000000690df901 R14: 0000000000499600 R15: 0000000000000000
[ 55.635219][ T669]
[ 55.635376][ T669] irq event stamp: 42097
[ 55.635528][ T669] hardirqs last enabled at (42097): [] finish_task_switch.isra.0+0x245/0x960
[ 55.635929][ T669] hardirqs last disabled at (42096): [] __schedule+0x94a/0x1b10
[ 55.636303][ T669] softirqs last enabled at (41912): [] handle_softirqs+0x352/0x610
[ 55.636668][ T669] softirqs last disabled at (41905): [] irq_exit_rcu+0xab/0x100
[ 55.637018][ T669] ---[ end trace 0000000000000000 ]---
[ 55.642501][ T669] ip (669) used greatest stack depth: 24232 bytes left