[ 18.964377][ T261] ip (261) used greatest stack depth: 24496 bytes left
[ 23.700953][ T304] br1: port 1(veth1) entered blocking state
[ 23.701573][ T304] br1: port 1(veth1) entered disabled state
[ 23.702184][ T304] veth1: entered allmulticast mode
[ 23.705961][ T304] veth1: entered promiscuous mode
[ 23.881326][ T45] br1: port 1(veth1) entered blocking state
[ 23.882260][ T45] br1: port 1(veth1) entered forwarding state
[ 24.011007][ T306] br1: port 2(veth2) entered blocking state
[ 24.011513][ T306] br1: port 2(veth2) entered disabled state
[ 24.012029][ T306] veth2: entered allmulticast mode
[ 24.016066][ T306] veth2: entered promiscuous mode
[ 24.140867][ T37] br1: port 2(veth2) entered blocking state
[ 24.141383][ T37] br1: port 2(veth2) entered forwarding state
[ 63.193450][ T665] br1: port 2(veth2) entered disabled state
[ 63.393851][ T666] veth2: left allmulticast mode
[ 63.394261][ T666] veth2: left promiscuous mode
[ 63.394893][ T666] br1: port 2(veth2) entered disabled state
[ 63.587638][ T667] br1: port 1(veth1) entered disabled state
[ 63.706448][ T668] veth1: left allmulticast mode
[ 63.706907][ T668] veth1: left promiscuous mode
[ 63.707487][ T668] br1: port 1(veth1) entered disabled state
[ 63.910298][ T669] ==================================================================
[ 63.910680][ T669] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 63.911053][ T669] Read of size 1 at addr ffff88800937a6ac by task ip/669
[ 63.911337][ T669]
[ 63.911462][ T669] CPU: 0 UID: 0 PID: 669 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 63.911467][ T669] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 63.911471][ T669] Call Trace:
[ 63.911475][ T669]
[ 63.911477][ T669] dump_stack_lvl+0x82/0xc0
[ 63.911483][ T669] print_address_description.constprop.0+0x2c/0x3a0
[ 63.911493][ T669] ? kobject_put+0xbb/0xd0
[ 63.911498][ T669] print_report+0xb4/0x270
[ 63.911501][ T669] ? kobject_put+0xbb/0xd0
[ 63.911504][ T669] ? kasan_addr_to_slab+0x21/0x70
[ 63.911507][ T669] ? kobject_put+0xbb/0xd0
[ 63.911510][ T669] kasan_report+0xca/0x100
[ 63.911514][ T669] ? kobject_put+0xbb/0xd0
[ 63.911519][ T669] kobject_put+0xbb/0xd0
[ 63.911523][ T669] netdev_run_todo+0x5f0/0xc60
[ 63.911529][ T669] ? dev_ingress_queue_create+0x190/0x190
[ 63.911532][ T669] ? generic_xdp_install+0x410/0x410
[ 63.911534][ T669] ? kernfs_put.part.0+0x12d/0x480
[ 63.911542][ T669] ? unregister_netdevice_many+0x20/0x20
[ 63.911548][ T669] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 63.911587][ T669] rtnl_dellink+0x350/0xa30
[ 63.911591][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 63.911610][ T669] ? find_held_lock+0x2b/0x80
[ 63.911618][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.911624][ T669] ? find_held_lock+0x2b/0x80
[ 63.911628][ T669] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 63.911630][ T669] ? __lock_release+0x5d/0x170
[ 63.911635][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 63.911638][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.911641][ T669] ? rtnl_port_fill+0x850/0x850
[ 63.911644][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.911651][ T669] netlink_rcv_skb+0x121/0x340
[ 63.911656][ T669] ? rtnl_port_fill+0x850/0x850
[ 63.911659][ T669] ? netlink_ack+0xdd0/0xdd0
[ 63.911666][ T669] ? netlink_deliver_tap+0x13e/0x340
[ 63.911669][ T669] ? netlink_deliver_tap+0xc3/0x340
[ 63.911672][ T669] netlink_unicast+0x4aa/0x780
[ 63.911677][ T669] ? netlink_attachskb+0x810/0x810
[ 63.911680][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.911688][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.911696][ T669] ? netlink_unicast+0x780/0x780
[ 63.911702][ T669] ? __import_iovec+0x230/0x3b0
[ 63.911713][ T669] ? netlink_unicast+0x780/0x780
[ 63.911718][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.911726][ T669] ? get_timestamp.constprop.0+0x380/0x380
[ 63.911730][ T669] ? __copy_msghdr+0x3c0/0x3c0
[ 63.911738][ T669] ___sys_sendmsg+0xed/0x170
[ 63.911741][ T669] ? kasan_record_aux_stack+0x8c/0xa0
[ 63.911744][ T669] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 63.911753][ T669] ? copy_msghdr_from_user+0x110/0x110
[ 63.911758][ T669] ? find_held_lock+0x2b/0x80
[ 63.911762][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.911768][ T669] ? find_held_lock+0x2b/0x80
[ 63.911771][ T669] ? __virt_addr_valid+0x22a/0x450
[ 63.911779][ T669] ? __lock_release+0x5d/0x170
[ 63.911785][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.911789][ T669] ? __call_rcu_common.constprop.0+0x318/0x630
[ 63.911793][ T669] ? __sys_sendmsg_sock+0x20/0x20
[ 63.911800][ T669] ? rcu_is_watching+0x12/0xb0
[ 63.911804][ T669] do_syscall_64+0xc1/0xfd0
[ 63.911810][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.911814][ T669] RIP: 0033:0x7f2eeafcb1d7
[ 63.911820][ T669] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 63.911822][ T669] RSP: 002b:00007ffe1abeb768 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 63.911828][ T669] RAX: ffffffffffffffda RBX: 00007ffe1abebe90 RCX: 00007f2eeafcb1d7
[ 63.911831][ T669] RDX: 0000000000000000 RSI: 00007ffe1abeb7d0 RDI: 0000000000000005
[ 63.911832][ T669] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 63.911834][ T669] R10: 00007f2eeaec7f60 R11: 0000000000000246 R12: 0000000000000002
[ 63.911836][ T669] R13: 00000000690dedd1 R14: 0000000000499600 R15: 0000000000000000
[ 63.911843][ T669]
[ 63.911844][ T669]
[ 63.927572][ T669] Allocated by task 299:
[ 63.927794][ T669] kasan_save_stack+0x24/0x40
[ 63.928084][ T669] kasan_save_track+0x14/0x30
[ 63.928371][ T669] __kasan_kmalloc+0x7b/0x90
[ 63.928673][ T669] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 63.928968][ T669] alloc_netdev_mqs+0x7d/0x1370
[ 63.929257][ T669] rtnl_create_link+0xa9e/0xe20
[ 63.929558][ T669] rtnl_newlink_create+0x203/0x770
[ 63.929847][ T669] __rtnl_newlink+0x231/0xa30
[ 63.930133][ T669] rtnl_newlink+0x693/0xa60
[ 63.930424][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.930702][ T669] netlink_rcv_skb+0x121/0x340
[ 63.930998][ T669] netlink_unicast+0x4aa/0x780
[ 63.931281][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.931569][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.931870][ T669] ___sys_sendmsg+0xed/0x170
[ 63.932156][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.932453][ T669] do_syscall_64+0xc1/0xfd0
[ 63.932743][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.933100][ T669]
[ 63.933247][ T669] Freed by task 669:
[ 63.933469][ T669] kasan_save_stack+0x24/0x40
[ 63.933768][ T669] kasan_save_track+0x14/0x30
[ 63.934053][ T669] __kasan_save_free_info+0x3b/0x60
[ 63.934342][ T669] __kasan_slab_free+0x3f/0x60
[ 63.934643][ T669] kfree+0x21d/0x540
[ 63.934853][ T669] device_release+0x9c/0x210
[ 63.935151][ T669] kobject_cleanup+0xfe/0x360
[ 63.935448][ T669] netdev_run_todo+0x81f/0xc60
[ 63.935732][ T669] rtnl_dellink+0x350/0xa30
[ 63.936026][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.936313][ T669] netlink_rcv_skb+0x121/0x340
[ 63.936598][ T669] netlink_unicast+0x4aa/0x780
[ 63.936875][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.937157][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.937441][ T669] ___sys_sendmsg+0xed/0x170
[ 63.937710][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.938003][ T669] do_syscall_64+0xc1/0xfd0
[ 63.938279][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.938627][ T669]
[ 63.938783][ T669] Last potentially related work creation:
[ 63.939072][ T669] kasan_save_stack+0x24/0x40
[ 63.939384][ T669] kasan_record_aux_stack+0x8c/0xa0
[ 63.939684][ T669] insert_work+0x34/0x230
[ 63.939920][ T669] __queue_work+0x5fd/0xab0
[ 63.940208][ T669] queue_work_on+0x84/0x90
[ 63.940513][ T669] br_multicast_dev_del+0xeb/0x240 [bridge]
[ 63.940923][ T669] br_dev_uninit+0x19/0x40 [bridge]
[ 63.941258][ T669] unregister_netdevice_many_notify+0xa80/0x1b30
[ 63.941817][ T669] rtnl_dellink+0x344/0xa30
[ 63.942107][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.942398][ T669] netlink_rcv_skb+0x121/0x340
[ 63.942708][ T669] netlink_unicast+0x4aa/0x780
[ 63.942995][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.943291][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.943577][ T669] ___sys_sendmsg+0xed/0x170
[ 63.943785][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.943998][ T669] do_syscall_64+0xc1/0xfd0
[ 63.944188][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.944422][ T669]
[ 63.944541][ T669] Second to last potentially related work creation:
[ 63.944875][ T669] kasan_save_stack+0x24/0x40
[ 63.945071][ T669] kasan_record_aux_stack+0x8c/0xa0
[ 63.945256][ T669] insert_work+0x34/0x230
[ 63.945398][ T669] __queue_work+0x5fd/0xab0
[ 63.945687][ T669] queue_work_on+0x84/0x90
[ 63.945870][ T669] fdb_delete+0x7bf/0xd50 [bridge]
[ 63.946199][ T669] br_fdb_delete_by_port+0x1ce/0x260 [bridge]
[ 63.946453][ T669] del_nbp+0x374/0xbe0 [bridge]
[ 63.946660][ T669] br_del_if+0xa3/0x1e0 [bridge]
[ 63.946870][ T669] do_set_master+0x144/0x4f0
[ 63.947053][ T669] do_setlink.constprop.0+0x9ee/0x2460
[ 63.947341][ T669] rtnl_newlink+0x693/0xa60
[ 63.947528][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.947732][ T669] netlink_rcv_skb+0x121/0x340
[ 63.947921][ T669] netlink_unicast+0x4aa/0x780
[ 63.948100][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.948286][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.948469][ T669] ___sys_sendmsg+0xed/0x170
[ 63.948695][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.949026][ T669] do_syscall_64+0xc1/0xfd0
[ 63.949247][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.949646][ T669]
[ 63.949758][ T669] The buggy address belongs to the object at ffff88800937a000
[ 63.949758][ T669] which belongs to the cache kmalloc-8k of size 8192
[ 63.950300][ T669] The buggy address is located 1708 bytes inside of
[ 63.950300][ T669] freed 8192-byte region [ffff88800937a000, ffff88800937c000)
[ 63.950913][ T669]
[ 63.951029][ T669] The buggy address belongs to the physical page:
[ 63.951297][ T669] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9378
[ 63.951820][ T669] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 63.952111][ T669] flags: 0x80000000000040(head|node=0|zone=1)
[ 63.952356][ T669] page_type: f5(slab)
[ 63.952767][ T669] raw: 0080000000000040 ffff8880010438c0 ffffea000012d410 ffff888001041228
[ 63.953245][ T669] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 63.953673][ T669] head: 0080000000000040 ffff8880010438c0 ffffea000012d410 ffff888001041228
[ 63.954063][ T669] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 63.954470][ T669] head: 0080000000000003 ffffea000024de01 00000000ffffffff 00000000ffffffff
[ 63.954852][ T669] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 63.955217][ T669] page dumped because: kasan: bad access detected
[ 63.955600][ T669]
[ 63.955710][ T669] Memory state around the buggy address:
[ 63.955935][ T669] ffff88800937a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.956252][ T669] ffff88800937a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.956720][ T669] >ffff88800937a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.957031][ T669] ^
[ 63.957237][ T669] ffff88800937a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.957728][ T669] ffff88800937a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 63.958030][ T669] ==================================================================
[ 63.958498][ T669] Disabling lock debugging due to kernel taint
[ 63.958824][ T669] ------------[ cut here ]------------
[ 63.959031][ T669] refcount_t: underflow; use-after-free.
[ 63.959261][ T669] WARNING: CPU: 0 PID: 669 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 63.959735][ T669] Modules linked in: act_skbedit cls_flower sch_prio sch_ingress bridge stp llc vrf veth
[ 63.960088][ T669] CPU: 0 UID: 0 PID: 669 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 63.960461][ T669] Tainted: [B]=BAD_PAGE
[ 63.960612][ T669] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 63.960852][ T669] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 63.961093][ T669] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 65 8e e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 63.961869][ T669] RSP: 0018:ffffc90000ecf1f0 EFLAGS: 00010286
[ 63.962212][ T669] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 63.962509][ T669] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 63.962802][ T669] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff1dfe134
[ 63.963241][ T669] R10: 0000000000000003 R11: ffffc90000eced80 R12: 0000000000000001
[ 63.963558][ T669] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 63.963951][ T669] FS: 00007f2eeadfd800(0000) GS:ffff8880a5df2000(0000) knlGS:0000000000000000
[ 63.964311][ T669] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 63.964618][ T669] CR2: 00007faeabf87000 CR3: 000000000df4d004 CR4: 0000000000772ef0
[ 63.965021][ T669] PKRU: 55555554
[ 63.965190][ T669] Call Trace:
[ 63.965340][ T669]
[ 63.965472][ T669] netdev_run_todo+0x5f0/0xc60
[ 63.965728][ T669] ? dev_ingress_queue_create+0x190/0x190
[ 63.966016][ T669] ? generic_xdp_install+0x410/0x410
[ 63.966205][ T669] ? kernfs_put.part.0+0x12d/0x480
[ 63.966393][ T669] ? unregister_netdevice_many+0x20/0x20
[ 63.966604][ T669] ? br_dev_delete+0x115/0x1a0 [bridge]
[ 63.966963][ T669] rtnl_dellink+0x350/0xa30
[ 63.967191][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 63.967473][ T669] ? find_held_lock+0x2b/0x80
[ 63.967784][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.968014][ T669] ? find_held_lock+0x2b/0x80
[ 63.968193][ T669] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 63.968383][ T669] ? __lock_release+0x5d/0x170
[ 63.968701][ T669] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 63.968939][ T669] rtnetlink_rcv_msg+0x709/0xc00
[ 63.969131][ T669] ? rtnl_port_fill+0x850/0x850
[ 63.969312][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.969507][ T669] netlink_rcv_skb+0x121/0x340
[ 63.969705][ T669] ? rtnl_port_fill+0x850/0x850
[ 63.969888][ T669] ? netlink_ack+0xdd0/0xdd0
[ 63.970072][ T669] ? netlink_deliver_tap+0x13e/0x340
[ 63.970358][ T669] ? netlink_deliver_tap+0xc3/0x340
[ 63.970566][ T669] netlink_unicast+0x4aa/0x780
[ 63.970763][ T669] ? netlink_attachskb+0x810/0x810
[ 63.970966][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.971289][ T669] netlink_sendmsg+0x714/0xbd0
[ 63.971510][ T669] ? netlink_unicast+0x780/0x780
[ 63.971725][ T669] ? __import_iovec+0x230/0x3b0
[ 63.971921][ T669] ? netlink_unicast+0x780/0x780
[ 63.972137][ T669] ____sys_sendmsg+0x3dd/0x890
[ 63.972344][ T669] ? get_timestamp.constprop.0+0x380/0x380
[ 63.972627][ T669] ? __copy_msghdr+0x3c0/0x3c0
[ 63.972830][ T669] ___sys_sendmsg+0xed/0x170
[ 63.973051][ T669] ? kasan_record_aux_stack+0x8c/0xa0
[ 63.973253][ T669] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 63.973506][ T669] ? copy_msghdr_from_user+0x110/0x110
[ 63.973760][ T669] ? find_held_lock+0x2b/0x80
[ 63.974118][ T669] ? __lock_acquire+0x449/0x7e0
[ 63.974345][ T669] ? find_held_lock+0x2b/0x80
[ 63.974578][ T669] ? __virt_addr_valid+0x22a/0x450
[ 63.974812][ T669] ? __lock_release+0x5d/0x170
[ 63.975164][ T669] __sys_sendmsg+0x10b/0x1a0
[ 63.975352][ T669] ? __call_rcu_common.constprop.0+0x318/0x630
[ 63.975664][ T669] ? __sys_sendmsg_sock+0x20/0x20
[ 63.975929][ T669] ? rcu_is_watching+0x12/0xb0
[ 63.976122][ T669] do_syscall_64+0xc1/0xfd0
[ 63.976303][ T669] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 63.976584][ T669] RIP: 0033:0x7f2eeafcb1d7
[ 63.976887][ T669] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 63.977671][ T669] RSP: 002b:00007ffe1abeb768 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 63.978154][ T669] RAX: ffffffffffffffda RBX: 00007ffe1abebe90 RCX: 00007f2eeafcb1d7
[ 63.978466][ T669] RDX: 0000000000000000 RSI: 00007ffe1abeb7d0 RDI: 0000000000000005
[ 63.978851][ T669] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 63.979168][ T669] R10: 00007f2eeaec7f60 R11: 0000000000000246 R12: 0000000000000002
[ 63.979433][ T669] R13: 00000000690dedd1 R14: 0000000000499600 R15: 0000000000000000
[ 63.979836][ T669]
[ 63.979973][ T669] irq event stamp: 48539
[ 63.980107][ T669] hardirqs last enabled at (48539): [] irqentry_exit+0x3b/0x80
[ 63.980471][ T669] hardirqs last disabled at (48538): [] handle_softirqs+0x47f/0x610
[ 63.980965][ T669] softirqs last enabled at (48442): [] handle_softirqs+0x352/0x610
[ 63.981290][ T669] softirqs last disabled at (48435): [] irq_exit_rcu+0xab/0x100
[ 63.981822][ T669] ---[ end trace 0000000000000000 ]---