[ 18.736442][ T251] ip (251) used greatest stack depth: 23952 bytes left
[ 25.953548][ T317] gre: GRE over IPv4 demultiplexer driver
[ 25.976098][ T317] ip_gre: GRE over IPv4 tunneling driver
[ 27.349527][ T327] GACT probability NOT on
[ 27.756740][ T329] ip6_gre: GRE over IPv6 tunneling driver
[ 28.039545][ T10] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 28.121462][ T10] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 28.216426][ T10] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 28.243434][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 28.697393][ T10] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 29.266106][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 29.267338][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 29.861484][ T343] br1: port 1(veth1) entered blocking state
[ 29.862762][ T343] br1: port 1(veth1) entered disabled state
[ 29.863774][ T343] veth1: entered allmulticast mode
[ 29.870099][ T343] veth1: entered promiscuous mode
[ 30.033525][ T52] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 30.042105][ T46] br1: port 1(veth1) entered blocking state
[ 30.043053][ T46] br1: port 1(veth1) entered forwarding state
[ 30.246564][ T345] br1: port 2(veth2) entered blocking state
[ 30.247332][ T345] br1: port 2(veth2) entered disabled state
[ 30.248459][ T345] veth2: entered allmulticast mode
[ 30.254845][ T345] veth2: entered promiscuous mode
[ 30.432545][ T73] br1: port 2(veth2) entered blocking state
[ 30.433334][ T73] br1: port 2(veth2) entered forwarding state
[ 31.377344][ T10] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 32.401315][ T10] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 33.170305][ C1] ip6_tnl_xmit_ctl: 5 callbacks suppressed
[ 33.170316][ C1] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 33.426776][ T12] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 33.431892][ T12] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 33.617346][ T10] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 33.618291][ T12] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 34.002411][ T67] ip6_tunnel: gt6 xmit: Local address not yet configured!
[ 39.856073][ T388] Mirror/redirect action on
[ 39.886306][ T387] tc (387) used greatest stack depth: 23712 bytes left
[ 41.553402][ C1] ip6_tunnel: h3-gt6 xmit: Local address not yet configured!
[ 57.698717][ T478] ==================================================================
[ 57.699240][ T478] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 57.699710][ T478] Read of size 1 at addr ffff8880026646ac by task ip/478
[ 57.700098][ T478]
[ 57.700255][ T478] CPU: 1 UID: 0 PID: 478 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 57.700263][ T478] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 57.700270][ T478] Call Trace:
[ 57.700273][ T478]
[ 57.700277][ T478] dump_stack_lvl+0x82/0xc0
[ 57.700288][ T478] print_address_description.constprop.0+0x2c/0x3a0
[ 57.700305][ T478] ? kobject_put+0xbb/0xd0
[ 57.700311][ T478] print_report+0xb4/0x270
[ 57.700316][ T478] ? kobject_put+0xbb/0xd0
[ 57.700321][ T478] ? kasan_addr_to_slab+0x21/0x70
[ 57.700327][ T478] ? kobject_put+0xbb/0xd0
[ 57.700332][ T478] kasan_report+0xca/0x100
[ 57.700338][ T478] ? kobject_put+0xbb/0xd0
[ 57.700347][ T478] kobject_put+0xbb/0xd0
[ 57.700354][ T478] netdev_run_todo+0x5f0/0xc60
[ 57.700364][ T478] ? dev_ingress_queue_create+0x190/0x190
[ 57.700369][ T478] ? generic_xdp_install+0x410/0x410
[ 57.700373][ T478] ? unregister_netdevice_many+0x20/0x20
[ 57.700383][ T478] rtnl_dellink+0x350/0xa30
[ 57.700392][ T478] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 57.700426][ T478] ? find_held_lock+0x2b/0x80
[ 57.700436][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.700448][ T478] ? find_held_lock+0x2b/0x80
[ 57.700454][ T478] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 57.700459][ T478] ? __lock_release+0x5d/0x170
[ 57.700467][ T478] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 57.700473][ T478] rtnetlink_rcv_msg+0x709/0xc00
[ 57.700480][ T478] ? rtnl_port_fill+0x850/0x850
[ 57.700484][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.700497][ T478] netlink_rcv_skb+0x121/0x340
[ 57.700506][ T478] ? rtnl_port_fill+0x850/0x850
[ 57.700512][ T478] ? netlink_ack+0xdd0/0xdd0
[ 57.700525][ T478] ? netlink_deliver_tap+0x13e/0x340
[ 57.700530][ T478] ? netlink_deliver_tap+0xc3/0x340
[ 57.700535][ T478] netlink_unicast+0x4aa/0x780
[ 57.700543][ T478] ? netlink_attachskb+0x810/0x810
[ 57.700551][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.700560][ T478] netlink_sendmsg+0x714/0xbd0
[ 57.700568][ T478] ? netlink_unicast+0x780/0x780
[ 57.700574][ T478] ? __import_iovec+0x230/0x3b0
[ 57.700584][ T478] ? netlink_unicast+0x780/0x780
[ 57.700590][ T478] ____sys_sendmsg+0x3dd/0x890
[ 57.700602][ T478] ? get_timestamp.constprop.0+0x380/0x380
[ 57.700608][ T478] ? __copy_msghdr+0x3c0/0x3c0
[ 57.700622][ T478] ___sys_sendmsg+0xed/0x170
[ 57.700627][ T478] ? kasan_record_aux_stack+0x8c/0xa0
[ 57.700631][ T478] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 57.700642][ T478] ? copy_msghdr_from_user+0x110/0x110
[ 57.700651][ T478] ? find_held_lock+0x2b/0x80
[ 57.700659][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.700669][ T478] ? find_held_lock+0x2b/0x80
[ 57.700675][ T478] ? __virt_addr_valid+0x22a/0x450
[ 57.700683][ T478] ? __lock_release+0x5d/0x170
[ 57.700694][ T478] __sys_sendmsg+0x10b/0x1a0
[ 57.700699][ T478] ? __call_rcu_common.constprop.0+0x318/0x630
[ 57.700706][ T478] ? __sys_sendmsg_sock+0x20/0x20
[ 57.700719][ T478] ? rcu_is_watching+0x12/0xb0
[ 57.700726][ T478] do_syscall_64+0xc1/0xfd0
[ 57.700736][ T478] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 57.700742][ T478] RIP: 0033:0x7f7e0038f1d7
[ 57.700749][ T478] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 57.700754][ T478] RSP: 002b:00007ffed3f43618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 57.700765][ T478] RAX: ffffffffffffffda RBX: 00007ffed3f43d40 RCX: 00007f7e0038f1d7
[ 57.700769][ T478] RDX: 0000000000000000 RSI: 00007ffed3f43680 RDI: 0000000000000005
[ 57.700772][ T478] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 57.700775][ T478] R10: 00007f7e0028bf60 R11: 0000000000000246 R12: 0000000000000002
[ 57.700778][ T478] R13: 00000000690dee2d R14: 0000000000499600 R15: 0000000000000000
[ 57.700791][ T478]
[ 57.700794][ T478]
[ 57.720912][ T478] Allocated by task 351:
[ 57.721129][ T478] kasan_save_stack+0x24/0x40
[ 57.721419][ T478] kasan_save_track+0x14/0x30
[ 57.721724][ T478] __kasan_kmalloc+0x7b/0x90
[ 57.722003][ T478] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 57.722303][ T478] alloc_netdev_mqs+0x7d/0x1370
[ 57.722780][ T478] rtnl_create_link+0xa9e/0xe20
[ 57.723049][ T478] rtnl_newlink_create+0x203/0x770
[ 57.723321][ T478] __rtnl_newlink+0x231/0xa30
[ 57.723582][ T478] rtnl_newlink+0x693/0xa60
[ 57.724033][ T478] rtnetlink_rcv_msg+0x709/0xc00
[ 57.724308][ T478] netlink_rcv_skb+0x121/0x340
[ 57.724581][ T478] netlink_unicast+0x4aa/0x780
[ 57.724849][ T478] netlink_sendmsg+0x714/0xbd0
[ 57.725114][ T478] ____sys_sendmsg+0x3dd/0x890
[ 57.725394][ T478] ___sys_sendmsg+0xed/0x170
[ 57.725666][ T478] __sys_sendmsg+0x10b/0x1a0
[ 57.725942][ T478] do_syscall_64+0xc1/0xfd0
[ 57.726429][ T478] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 57.726789][ T478]
[ 57.726933][ T478] Freed by task 478:
[ 57.727138][ T478] kasan_save_stack+0x24/0x40
[ 57.727460][ T478] kasan_save_track+0x14/0x30
[ 57.727888][ T478] __kasan_save_free_info+0x3b/0x60
[ 57.728140][ T478] __kasan_slab_free+0x3f/0x60
[ 57.728462][ T478] kfree+0x21d/0x540
[ 57.728672][ T478] device_release+0x9c/0x210
[ 57.729105][ T478] kobject_cleanup+0xfe/0x360
[ 57.729377][ T478] netdev_run_todo+0x81f/0xc60
[ 57.729718][ T478] rtnl_dellink+0x350/0xa30
[ 57.730024][ T478] rtnetlink_rcv_msg+0x709/0xc00
[ 57.730492][ T478] netlink_rcv_skb+0x121/0x340
[ 57.730744][ T478] netlink_unicast+0x4aa/0x780
[ 57.731015][ T478] netlink_sendmsg+0x714/0xbd0
[ 57.731283][ T478] ____sys_sendmsg+0x3dd/0x890
[ 57.731656][ T478] ___sys_sendmsg+0xed/0x170
[ 57.731917][ T478] __sys_sendmsg+0x10b/0x1a0
[ 57.732112][ T478] do_syscall_64+0xc1/0xfd0
[ 57.732291][ T478] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 57.732630][ T478]
[ 57.732718][ T478] The buggy address belongs to the object at ffff888002664000
[ 57.732718][ T478] which belongs to the cache kmalloc-4k of size 4096
[ 57.733175][ T478] The buggy address is located 1708 bytes inside of
[ 57.733175][ T478] freed 4096-byte region [ffff888002664000, ffff888002665000)
[ 57.733744][ T478]
[ 57.733845][ T478] The buggy address belongs to the physical page:
[ 57.734082][ T478] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2660
[ 57.734485][ T478] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 57.734738][ T478] flags: 0x80000000000040(head|node=0|zone=1)
[ 57.735068][ T478] page_type: f5(slab)
[ 57.735201][ T478] raw: 0080000000000040 ffff888001043700 ffffea00002a9c10 ffffea000017a210
[ 57.735510][ T478] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 57.735936][ T478] head: 0080000000000040 ffff888001043700 ffffea00002a9c10 ffffea000017a210
[ 57.736272][ T478] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 57.736689][ T478] head: 0080000000000003 ffffea0000099801 00000000ffffffff 00000000ffffffff
[ 57.737018][ T478] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 57.737379][ T478] page dumped because: kasan: bad access detected
[ 57.737767][ T478]
[ 57.737863][ T478] Memory state around the buggy address:
[ 57.738078][ T478] ffff888002664580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.738333][ T478] ffff888002664600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.738722][ T478] >ffff888002664680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.739127][ T478] ^
[ 57.739401][ T478] ffff888002664700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.739774][ T478] ffff888002664780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 57.740048][ T478] ==================================================================
[ 57.741429][ T478] Disabling lock debugging due to kernel taint
[ 57.741709][ T478] ------------[ cut here ]------------
[ 57.741879][ T478] refcount_t: underflow; use-after-free.
[ 57.742241][ T478] WARNING: CPU: 1 PID: 478 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 57.742620][ T478] Modules linked in: cls_flower act_mirred bridge stp llc ip6_gre ip6_tunnel tunnel6 act_gact cls_matchall ip_gre gre sch_ingress vrf veth
[ 57.743142][ T478] CPU: 1 UID: 0 PID: 478 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 57.743523][ T478] Tainted: [B]=BAD_PAGE
[ 57.743659][ T478] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 57.743881][ T478] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 57.744251][ T478] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d a5 bc e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 57.744948][ T478] RSP: 0018:ffffc900008471f0 EFLAGS: 00010286
[ 57.745262][ T478] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 57.745576][ T478] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 57.745867][ T478] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff7a7e134
[ 57.746216][ T478] R10: 0000000000000003 R11: ffffc90000846d80 R12: 0000000000000001
[ 57.746531][ T478] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 57.746805][ T478] FS: 00007f7e001c1800(0000) GS:ffff888077a72000(0000) knlGS:0000000000000000
[ 57.747162][ T478] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 57.747371][ T478] CR2: 000055fddd545dec CR3: 0000000004ad2006 CR4: 0000000000772ef0
[ 57.747640][ T478] PKRU: 55555554
[ 57.747764][ T478] Call Trace:
[ 57.747891][ T478]
[ 57.748052][ T478] netdev_run_todo+0x5f0/0xc60
[ 57.748228][ T478] ? dev_ingress_queue_create+0x190/0x190
[ 57.748411][ T478] ? generic_xdp_install+0x410/0x410
[ 57.748610][ T478] ? unregister_netdevice_many+0x20/0x20
[ 57.748807][ T478] rtnl_dellink+0x350/0xa30
[ 57.749071][ T478] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 57.749298][ T478] ? find_held_lock+0x2b/0x80
[ 57.749498][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.749678][ T478] ? find_held_lock+0x2b/0x80
[ 57.749854][ T478] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 57.750141][ T478] ? __lock_release+0x5d/0x170
[ 57.750322][ T478] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 57.750583][ T478] rtnetlink_rcv_msg+0x709/0xc00
[ 57.750760][ T478] ? rtnl_port_fill+0x850/0x850
[ 57.751178][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.751367][ T478] netlink_rcv_skb+0x121/0x340
[ 57.751550][ T478] ? rtnl_port_fill+0x850/0x850
[ 57.751722][ T478] ? netlink_ack+0xdd0/0xdd0
[ 57.751911][ T478] ? netlink_deliver_tap+0x13e/0x340
[ 57.752169][ T478] ? netlink_deliver_tap+0xc3/0x340
[ 57.752332][ T478] netlink_unicast+0x4aa/0x780
[ 57.752511][ T478] ? netlink_attachskb+0x810/0x810
[ 57.752731][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.753091][ T478] netlink_sendmsg+0x714/0xbd0
[ 57.753286][ T478] ? netlink_unicast+0x780/0x780
[ 57.753464][ T478] ? __import_iovec+0x230/0x3b0
[ 57.753648][ T478] ? netlink_unicast+0x780/0x780
[ 57.753810][ T478] ____sys_sendmsg+0x3dd/0x890
[ 57.753973][ T478] ? get_timestamp.constprop.0+0x380/0x380
[ 57.754251][ T478] ? __copy_msghdr+0x3c0/0x3c0
[ 57.754447][ T478] ___sys_sendmsg+0xed/0x170
[ 57.754604][ T478] ? kasan_record_aux_stack+0x8c/0xa0
[ 57.754862][ T478] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 57.755134][ T478] ? copy_msghdr_from_user+0x110/0x110
[ 57.755313][ T478] ? find_held_lock+0x2b/0x80
[ 57.755483][ T478] ? __lock_acquire+0x449/0x7e0
[ 57.755645][ T478] ? find_held_lock+0x2b/0x80
[ 57.755819][ T478] ? __virt_addr_valid+0x22a/0x450
[ 57.756206][ T478] ? __lock_release+0x5d/0x170
[ 57.756377][ T478] __sys_sendmsg+0x10b/0x1a0
[ 57.756551][ T478] ? __call_rcu_common.constprop.0+0x318/0x630
[ 57.756803][ T478] ? __sys_sendmsg_sock+0x20/0x20
[ 57.757101][ T478] ? rcu_is_watching+0x12/0xb0
[ 57.757289][ T478] do_syscall_64+0xc1/0xfd0
[ 57.757467][ T478] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 57.757696][ T478] RIP: 0033:0x7f7e0038f1d7
[ 57.757883][ T478] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 57.758675][ T478] RSP: 002b:00007ffed3f43618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 57.758931][ T478] RAX: ffffffffffffffda RBX: 00007ffed3f43d40 RCX: 00007f7e0038f1d7
[ 57.759361][ T478] RDX: 0000000000000000 RSI: 00007ffed3f43680 RDI: 0000000000000005
[ 57.759688][ T478] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 57.759945][ T478] R10: 00007f7e0028bf60 R11: 0000000000000246 R12: 0000000000000002
[ 57.760285][ T478] R13: 00000000690dee2d R14: 0000000000499600 R15: 0000000000000000
[ 57.760573][ T478]
[ 57.760698][ T478] irq event stamp: 44777
[ 57.760824][ T478] hardirqs last enabled at (44777): [] finish_task_switch.isra.0+0x245/0x960
[ 57.761341][ T478] hardirqs last disabled at (44776): [] __schedule+0x94a/0x1b10
[ 57.761662][ T478] softirqs last enabled at (44606): [] handle_softirqs+0x352/0x610
[ 57.762051][ T478] softirqs last disabled at (44511): [] irq_exit_rcu+0xab/0x100
[ 57.762347][ T478] ---[ end trace 0000000000000000 ]---
[ 58.047696][ T483] br1: port 1(veth1) entered disabled state
[ 58.147744][ T484] br1: port 2(veth2) entered disabled state
[ 58.239261][ T485] veth2: left allmulticast mode
[ 58.239539][ T485] veth2: left promiscuous mode
[ 58.239922][ T485] br1: port 2(veth2) entered disabled state
[ 58.241331][ T485] veth1: left allmulticast mode
[ 58.241579][ T485] veth1: left promiscuous mode
[ 58.241930][ T485] br1: port 1(veth1) entered disabled state