[ 16.747583][ T280] veth0: entered allmulticast mode
[ 16.748540][ T280] veth1: entered allmulticast mode
[ 16.749212][ T280] veth2: entered allmulticast mode
[ 16.749732][ T280] veth3: entered allmulticast mode
[ 30.527334][ T368] GACT probability NOT on
[ 40.596013][ T516] ==================================================================
[ 40.596314][ T516] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 40.596605][ T516] Read of size 1 at addr ffff8880085096ac by task ip/516
[ 40.596817][ T516]
[ 40.596926][ T516] CPU: 3 UID: 0 PID: 516 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 40.596932][ T516] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 40.596934][ T516] Call Trace:
[ 40.596938][ T516]
[ 40.596941][ T516] dump_stack_lvl+0x82/0xc0
[ 40.596950][ T516] print_address_description.constprop.0+0x2c/0x3a0
[ 40.596960][ T516] ? kobject_put+0xbb/0xd0
[ 40.596964][ T516] print_report+0xb4/0x270
[ 40.596968][ T516] ? kobject_put+0xbb/0xd0
[ 40.596971][ T516] ? kasan_addr_to_slab+0x21/0x70
[ 40.596974][ T516] ? kobject_put+0xbb/0xd0
[ 40.596978][ T516] kasan_report+0xca/0x100
[ 40.596981][ T516] ? kobject_put+0xbb/0xd0
[ 40.596987][ T516] kobject_put+0xbb/0xd0
[ 40.596991][ T516] netdev_run_todo+0x5f0/0xc60
[ 40.597000][ T516] ? dev_ingress_queue_create+0x190/0x190
[ 40.597003][ T516] ? generic_xdp_install+0x410/0x410
[ 40.597008][ T516] ? vrf_dellink+0xff/0x150 [vrf]
[ 40.597015][ T516] ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 40.597019][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.597031][ T516] rtnl_dellink+0x350/0xa30
[ 40.597038][ T516] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 40.597057][ T516] ? find_held_lock+0x2b/0x80
[ 40.597061][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.597067][ T516] ? find_held_lock+0x2b/0x80
[ 40.597071][ T516] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 40.597074][ T516] ? __lock_release+0x5d/0x170
[ 40.597078][ T516] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 40.597082][ T516] rtnetlink_rcv_msg+0x709/0xc00
[ 40.597086][ T516] ? rtnl_port_fill+0x850/0x850
[ 40.597089][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.597096][ T516] netlink_rcv_skb+0x121/0x340
[ 40.597104][ T516] ? rtnl_port_fill+0x850/0x850
[ 40.597107][ T516] ? netlink_ack+0xdd0/0xdd0
[ 40.597114][ T516] ? netlink_deliver_tap+0x13e/0x340
[ 40.597116][ T516] ? netlink_deliver_tap+0xc3/0x340
[ 40.597120][ T516] netlink_unicast+0x4aa/0x780
[ 40.597124][ T516] ? netlink_attachskb+0x810/0x810
[ 40.597128][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.597134][ T516] netlink_sendmsg+0x714/0xbd0
[ 40.597139][ T516] ? netlink_unicast+0x780/0x780
[ 40.597142][ T516] ? __import_iovec+0x230/0x3b0
[ 40.597151][ T516] ? netlink_unicast+0x780/0x780
[ 40.597155][ T516] ____sys_sendmsg+0x3dd/0x890
[ 40.597162][ T516] ? get_timestamp.constprop.0+0x380/0x380
[ 40.597165][ T516] ? __copy_msghdr+0x3c0/0x3c0
[ 40.597174][ T516] ___sys_sendmsg+0xed/0x170
[ 40.597177][ T516] ? kasan_record_aux_stack+0x8c/0xa0
[ 40.597180][ T516] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 40.597187][ T516] ? copy_msghdr_from_user+0x110/0x110
[ 40.597193][ T516] ? find_held_lock+0x2b/0x80
[ 40.597197][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.597202][ T516] ? find_held_lock+0x2b/0x80
[ 40.597206][ T516] ? __virt_addr_valid+0x22a/0x450
[ 40.597217][ T516] ? __lock_release+0x5d/0x170
[ 40.597223][ T516] __sys_sendmsg+0x10b/0x1a0
[ 40.597226][ T516] ? __call_rcu_common.constprop.0+0x318/0x630
[ 40.597230][ T516] ? __sys_sendmsg_sock+0x20/0x20
[ 40.597237][ T516] ? rcu_is_watching+0x12/0xb0
[ 40.597241][ T516] do_syscall_64+0xc1/0xfd0
[ 40.597248][ T516] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 40.597252][ T516] RIP: 0033:0x7fa45d9b21d7
[ 40.597258][ T516] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 40.597261][ T516] RSP: 002b:00007ffc7d03fc48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 40.597270][ T516] RAX: ffffffffffffffda RBX: 00007ffc7d040370 RCX: 00007fa45d9b21d7
[ 40.597272][ T516] RDX: 0000000000000000 RSI: 00007ffc7d03fcb0 RDI: 0000000000000005
[ 40.597274][ T516] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 40.597276][ T516] R10: 00007fa45d8aef60 R11: 0000000000000246 R12: 0000000000000002
[ 40.597278][ T516] R13: 00000000690dfa7b R14: 0000000000499600 R15: 0000000000000000
[ 40.597285][ T516]
[ 40.597286][ T516]
[ 40.610114][ T516] Allocated by task 298:
[ 40.610251][ T516] kasan_save_stack+0x24/0x40
[ 40.610428][ T516] kasan_save_track+0x14/0x30
[ 40.610594][ T516] __kasan_kmalloc+0x7b/0x90
[ 40.610764][ T516] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 40.610947][ T516] alloc_netdev_mqs+0x7d/0x1370
[ 40.611139][ T516] rtnl_create_link+0xa9e/0xe20
[ 40.611310][ T516] rtnl_newlink_create+0x203/0x770
[ 40.611478][ T516] __rtnl_newlink+0x231/0xa30
[ 40.611640][ T516] rtnl_newlink+0x693/0xa60
[ 40.611831][ T516] rtnetlink_rcv_msg+0x709/0xc00
[ 40.612013][ T516] netlink_rcv_skb+0x121/0x340
[ 40.612209][ T516] netlink_unicast+0x4aa/0x780
[ 40.612390][ T516] netlink_sendmsg+0x714/0xbd0
[ 40.612553][ T516] ____sys_sendmsg+0x3dd/0x890
[ 40.612720][ T516] ___sys_sendmsg+0xed/0x170
[ 40.612887][ T516] __sys_sendmsg+0x10b/0x1a0
[ 40.613069][ T516] do_syscall_64+0xc1/0xfd0
[ 40.613240][ T516] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 40.613453][ T516]
[ 40.613537][ T516] Freed by task 516:
[ 40.613661][ T516] kasan_save_stack+0x24/0x40
[ 40.613833][ T516] kasan_save_track+0x14/0x30
[ 40.614015][ T516] __kasan_save_free_info+0x3b/0x60
[ 40.614208][ T516] __kasan_slab_free+0x3f/0x60
[ 40.614385][ T516] kfree+0x21d/0x540
[ 40.614611][ T516] device_release+0x9c/0x210
[ 40.614784][ T516] kobject_cleanup+0xfe/0x360
[ 40.614966][ T516] netdev_run_todo+0x81f/0xc60
[ 40.615337][ T516] rtnl_dellink+0x350/0xa30
[ 40.615500][ T516] rtnetlink_rcv_msg+0x709/0xc00
[ 40.615664][ T516] netlink_rcv_skb+0x121/0x340
[ 40.615942][ T516] netlink_unicast+0x4aa/0x780
[ 40.616109][ T516] netlink_sendmsg+0x714/0xbd0
[ 40.616280][ T516] ____sys_sendmsg+0x3dd/0x890
[ 40.616449][ T516] ___sys_sendmsg+0xed/0x170
[ 40.616619][ T516] __sys_sendmsg+0x10b/0x1a0
[ 40.616786][ T516] do_syscall_64+0xc1/0xfd0
[ 40.616964][ T516] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 40.617210][ T516]
[ 40.617393][ T516] The buggy address belongs to the object at ffff888008509000
[ 40.617393][ T516] which belongs to the cache kmalloc-4k of size 4096
[ 40.617876][ T516] The buggy address is located 1708 bytes inside of
[ 40.617876][ T516] freed 4096-byte region [ffff888008509000, ffff88800850a000)
[ 40.618428][ T516]
[ 40.618519][ T516] The buggy address belongs to the physical page:
[ 40.618728][ T516] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8508
[ 40.619173][ T516] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 40.619432][ T516] flags: 0x80000000000040(head|node=0|zone=1)
[ 40.619654][ T516] page_type: f5(slab)
[ 40.619785][ T516] raw: 0080000000000040 ffff888001043700 ffffea0000209a10 ffffea00001f4010
[ 40.620101][ T516] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 40.620447][ T516] head: 0080000000000040 ffff888001043700 ffffea0000209a10 ffffea00001f4010
[ 40.620783][ T516] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 40.621144][ T516] head: 0080000000000003 ffffea0000214201 00000000ffffffff 00000000ffffffff
[ 40.621685][ T516] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 40.622007][ T516] page dumped because: kasan: bad access detected
[ 40.622238][ T516]
[ 40.622338][ T516] Memory state around the buggy address:
[ 40.622635][ T516] ffff888008509580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.622883][ T516] ffff888008509600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.623237][ T516] >ffff888008509680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.623774][ T516] ^
[ 40.623992][ T516] ffff888008509700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.624256][ T516] ffff888008509780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.624612][ T516] ==================================================================
[ 40.625022][ T516] Disabling lock debugging due to kernel taint
[ 40.625321][ T516] ------------[ cut here ]------------
[ 40.625504][ T516] refcount_t: underflow; use-after-free.
[ 40.625759][ T516] WARNING: CPU: 2 PID: 516 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 40.626136][ T516] Modules linked in: act_gact cls_flower sch_ingress vrf veth
[ 40.626448][ T516] CPU: 2 UID: 0 PID: 516 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 40.626832][ T516] Tainted: [B]=BAD_PAGE
[ 40.626998][ T516] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 40.627257][ T516] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 40.627521][ T516] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 45 85 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 40.628184][ T516] RSP: 0018:ffffc90000e171f0 EFLAGS: 00010286
[ 40.628455][ T516] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 40.628743][ T516] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 40.629040][ T516] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff0bbe134
[ 40.629330][ T516] R10: 0000000000000003 R11: ffffc90000e16d80 R12: 0000000000000001
[ 40.629626][ T516] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 40.629927][ T516] FS: 00007fa45d7e4800(0000) GS:ffff8880af0f2000(0000) knlGS:0000000000000000
[ 40.630285][ T516] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 40.630529][ T516] CR2: 00007fd0013bb000 CR3: 0000000008c0c005 CR4: 0000000000772ef0
[ 40.630823][ T516] PKRU: 55555554
[ 40.630986][ T516] Call Trace:
[ 40.631177][ T516]
[ 40.631301][ T516] netdev_run_todo+0x5f0/0xc60
[ 40.631619][ T516] ? dev_ingress_queue_create+0x190/0x190
[ 40.631811][ T516] ? generic_xdp_install+0x410/0x410
[ 40.632031][ T516] ? vrf_dellink+0xff/0x150 [vrf]
[ 40.632232][ T516] ? vrf_map_unregister_dev+0x480/0x480 [vrf]
[ 40.632563][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.632771][ T516] rtnl_dellink+0x350/0xa30
[ 40.632976][ T516] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 40.633339][ T516] ? find_held_lock+0x2b/0x80
[ 40.633529][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.633716][ T516] ? find_held_lock+0x2b/0x80
[ 40.633908][ T516] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 40.634210][ T516] ? __lock_release+0x5d/0x170
[ 40.634411][ T516] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 40.634638][ T516] rtnetlink_rcv_msg+0x709/0xc00
[ 40.634830][ T516] ? rtnl_port_fill+0x850/0x850
[ 40.635131][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.635349][ T516] netlink_rcv_skb+0x121/0x340
[ 40.635541][ T516] ? rtnl_port_fill+0x850/0x850
[ 40.635735][ T516] ? netlink_ack+0xdd0/0xdd0
[ 40.636034][ T516] ? netlink_deliver_tap+0x13e/0x340
[ 40.636240][ T516] ? netlink_deliver_tap+0xc3/0x340
[ 40.636430][ T516] netlink_unicast+0x4aa/0x780
[ 40.636632][ T516] ? netlink_attachskb+0x810/0x810
[ 40.636920][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.637132][ T516] netlink_sendmsg+0x714/0xbd0
[ 40.637322][ T516] ? netlink_unicast+0x780/0x780
[ 40.637510][ T516] ? __import_iovec+0x230/0x3b0
[ 40.637812][ T516] ? netlink_unicast+0x780/0x780
[ 40.638016][ T516] ____sys_sendmsg+0x3dd/0x890
[ 40.638238][ T516] ? get_timestamp.constprop.0+0x380/0x380
[ 40.638489][ T516] ? __copy_msghdr+0x3c0/0x3c0
[ 40.638680][ T516] ___sys_sendmsg+0xed/0x170
[ 40.638876][ T516] ? kasan_record_aux_stack+0x8c/0xa0
[ 40.639091][ T516] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 40.639332][ T516] ? copy_msghdr_from_user+0x110/0x110
[ 40.639539][ T516] ? find_held_lock+0x2b/0x80
[ 40.639732][ T516] ? __lock_acquire+0x449/0x7e0
[ 40.639929][ T516] ? find_held_lock+0x2b/0x80
[ 40.640126][ T516] ? __virt_addr_valid+0x22a/0x450
[ 40.640410][ T516] ? __lock_release+0x5d/0x170
[ 40.640594][ T516] __sys_sendmsg+0x10b/0x1a0
[ 40.640798][ T516] ? __call_rcu_common.constprop.0+0x318/0x630
[ 40.641180][ T516] ? __sys_sendmsg_sock+0x20/0x20
[ 40.641377][ T516] ? rcu_is_watching+0x12/0xb0
[ 40.641578][ T516] do_syscall_64+0xc1/0xfd0
[ 40.641772][ T516] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 40.642034][ T516] RIP: 0033:0x7fa45d9b21d7
[ 40.642232][ T516] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 40.642968][ T516] RSP: 002b:00007ffc7d03fc48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 40.643253][ T516] RAX: ffffffffffffffda RBX: 00007ffc7d040370 RCX: 00007fa45d9b21d7
[ 40.643547][ T516] RDX: 0000000000000000 RSI: 00007ffc7d03fcb0 RDI: 0000000000000005
[ 40.643943][ T516] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 40.644234][ T516] R10: 00007fa45d8aef60 R11: 0000000000000246 R12: 0000000000000002
[ 40.644610][ T516] R13: 00000000690dfa7b R14: 0000000000499600 R15: 0000000000000000
[ 40.644914][ T516]
[ 40.645075][ T516] irq event stamp: 45635
[ 40.645225][ T516] hardirqs last enabled at (45635): [] kasan_quarantine_put+0xf9/0x210
[ 40.645636][ T516] hardirqs last disabled at (45634): [] kasan_quarantine_put+0xac/0x210
[ 40.645955][ T516] softirqs last enabled at (45468): [] handle_softirqs+0x352/0x610
[ 40.646281][ T516] softirqs last disabled at (45461): [] irq_exit_rcu+0xab/0x100
[ 40.646583][ T516] ---[ end trace 0000000000000000 ]---
[ 41.649704][ T280] veth0: left allmulticast mode
[ 41.650190][ T280] veth1: left allmulticast mode
[ 41.650561][ T280] veth2: left allmulticast mode
[ 41.650949][ T280] veth3: left allmulticast mode