[ 15.358371][ T251] ip (251) used greatest stack depth: 24688 bytes left
[ 16.512066][ T275] ip (275) used greatest stack depth: 24608 bytes left
[ 21.010803][ T316] 8021q: 802.1Q VLAN Support v1.8
[ 21.051850][ T315] ip (315) used greatest stack depth: 24112 bytes left
[ 21.505704][ T321] gre: GRE over IPv4 demultiplexer driver
[ 21.523070][ T321] ip_gre: GRE over IPv4 tunneling driver
[ 41.327432][ T418] ==================================================================
[ 41.327723][ T418] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 41.327973][ T418] Read of size 1 at addr ffff88800f1fc6ac by task ip/418
[ 41.328195][ T418]
[ 41.328298][ T418] CPU: 2 UID: 0 PID: 418 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 41.328304][ T418] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 41.328307][ T418] Call Trace:
[ 41.328309][ T418]
[ 41.328311][ T418] dump_stack_lvl+0x82/0xc0
[ 41.328318][ T418] print_address_description.constprop.0+0x2c/0x3a0
[ 41.328325][ T418] ? kobject_put+0xbb/0xd0
[ 41.328330][ T418] print_report+0xb4/0x270
[ 41.328333][ T418] ? kobject_put+0xbb/0xd0
[ 41.328336][ T418] ? kasan_addr_to_slab+0x21/0x70
[ 41.328339][ T418] ? kobject_put+0xbb/0xd0
[ 41.328342][ T418] kasan_report+0xca/0x100
[ 41.328346][ T418] ? kobject_put+0xbb/0xd0
[ 41.328352][ T418] kobject_put+0xbb/0xd0
[ 41.328355][ T418] netdev_run_todo+0x5f0/0xc60
[ 41.328361][ T418] ? dev_ingress_queue_create+0x190/0x190
[ 41.328364][ T418] ? generic_xdp_install+0x410/0x410
[ 41.328367][ T418] ? unregister_netdevice_many+0x20/0x20
[ 41.328369][ T418] ? net_generic+0xb1/0x1f0
[ 41.328376][ T418] ? net_generic+0xbb/0x1f0
[ 41.328381][ T418] rtnl_dellink+0x350/0xa30
[ 41.328387][ T418] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 41.328409][ T418] ? find_held_lock+0x2b/0x80
[ 41.328417][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.328424][ T418] ? find_held_lock+0x2b/0x80
[ 41.328427][ T418] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 41.328430][ T418] ? __lock_release+0x5d/0x170
[ 41.328435][ T418] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 41.328438][ T418] rtnetlink_rcv_msg+0x709/0xc00
[ 41.328442][ T418] ? rtnl_port_fill+0x850/0x850
[ 41.328444][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.328451][ T418] netlink_rcv_skb+0x121/0x340
[ 41.328457][ T418] ? rtnl_port_fill+0x850/0x850
[ 41.328461][ T418] ? netlink_ack+0xdd0/0xdd0
[ 41.328467][ T418] ? netlink_deliver_tap+0x13e/0x340
[ 41.328470][ T418] ? netlink_deliver_tap+0xc3/0x340
[ 41.328474][ T418] netlink_unicast+0x4aa/0x780
[ 41.328478][ T418] ? netlink_attachskb+0x810/0x810
[ 41.328482][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.328487][ T418] netlink_sendmsg+0x714/0xbd0
[ 41.328492][ T418] ? netlink_unicast+0x780/0x780
[ 41.328496][ T418] ? __import_iovec+0x230/0x3b0
[ 41.328503][ T418] ? netlink_unicast+0x780/0x780
[ 41.328507][ T418] ____sys_sendmsg+0x3dd/0x890
[ 41.328513][ T418] ? get_timestamp.constprop.0+0x380/0x380
[ 41.328516][ T418] ? __copy_msghdr+0x3c0/0x3c0
[ 41.328523][ T418] ___sys_sendmsg+0xed/0x170
[ 41.328526][ T418] ? kasan_record_aux_stack+0x8c/0xa0
[ 41.328529][ T418] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 41.328537][ T418] ? copy_msghdr_from_user+0x110/0x110
[ 41.328542][ T418] ? find_held_lock+0x2b/0x80
[ 41.328546][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.328552][ T418] ? find_held_lock+0x2b/0x80
[ 41.328555][ T418] ? __virt_addr_valid+0x22a/0x450
[ 41.328561][ T418] ? __lock_release+0x5d/0x170
[ 41.328567][ T418] __sys_sendmsg+0x10b/0x1a0
[ 41.328570][ T418] ? __call_rcu_common.constprop.0+0x318/0x630
[ 41.328574][ T418] ? __sys_sendmsg_sock+0x20/0x20
[ 41.328582][ T418] ? rcu_is_watching+0x12/0xb0
[ 41.328586][ T418] do_syscall_64+0xc1/0xfd0
[ 41.328592][ T418] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 41.328597][ T418] RIP: 0033:0x7f548f0d91d7
[ 41.328602][ T418] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 41.328606][ T418] RSP: 002b:00007ffc038dc418 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 41.328610][ T418] RAX: ffffffffffffffda RBX: 00007ffc038dcb40 RCX: 00007f548f0d91d7
[ 41.328612][ T418] RDX: 0000000000000000 RSI: 00007ffc038dc480 RDI: 0000000000000005
[ 41.328614][ T418] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 41.328616][ T418] R10: 00007f548efd5f60 R11: 0000000000000246 R12: 0000000000000002
[ 41.328618][ T418] R13: 00000000690dfaa3 R14: 0000000000499600 R15: 0000000000000000
[ 41.328624][ T418]
[ 41.328626][ T418]
[ 41.341120][ T418] Allocated by task 346:
[ 41.341262][ T418] kasan_save_stack+0x24/0x40
[ 41.341439][ T418] kasan_save_track+0x14/0x30
[ 41.341603][ T418] __kasan_kmalloc+0x7b/0x90
[ 41.341772][ T418] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 41.341936][ T418] alloc_netdev_mqs+0x7d/0x1370
[ 41.342121][ T418] rtnl_create_link+0xa9e/0xe20
[ 41.342300][ T418] rtnl_newlink_create+0x203/0x770
[ 41.342462][ T418] __rtnl_newlink+0x231/0xa30
[ 41.342622][ T418] rtnl_newlink+0x693/0xa60
[ 41.342785][ T418] rtnetlink_rcv_msg+0x709/0xc00
[ 41.342946][ T418] netlink_rcv_skb+0x121/0x340
[ 41.343127][ T418] netlink_unicast+0x4aa/0x780
[ 41.343309][ T418] netlink_sendmsg+0x714/0xbd0
[ 41.343473][ T418] ____sys_sendmsg+0x3dd/0x890
[ 41.343638][ T418] ___sys_sendmsg+0xed/0x170
[ 41.343802][ T418] __sys_sendmsg+0x10b/0x1a0
[ 41.343966][ T418] do_syscall_64+0xc1/0xfd0
[ 41.344259][ T418] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 41.344468][ T418]
[ 41.344559][ T418] Freed by task 418:
[ 41.344681][ T418] kasan_save_stack+0x24/0x40
[ 41.344848][ T418] kasan_save_track+0x14/0x30
[ 41.345021][ T418] __kasan_save_free_info+0x3b/0x60
[ 41.345184][ T418] __kasan_slab_free+0x3f/0x60
[ 41.345360][ T418] kfree+0x21d/0x540
[ 41.345485][ T418] device_release+0x9c/0x210
[ 41.345650][ T418] kobject_cleanup+0xfe/0x360
[ 41.345821][ T418] netdev_run_todo+0x81f/0xc60
[ 41.345986][ T418] rtnl_dellink+0x350/0xa30
[ 41.346156][ T418] rtnetlink_rcv_msg+0x709/0xc00
[ 41.346332][ T418] netlink_rcv_skb+0x121/0x340
[ 41.346493][ T418] netlink_unicast+0x4aa/0x780
[ 41.346773][ T418] netlink_sendmsg+0x714/0xbd0
[ 41.346937][ T418] ____sys_sendmsg+0x3dd/0x890
[ 41.347115][ T418] ___sys_sendmsg+0xed/0x170
[ 41.347299][ T418] __sys_sendmsg+0x10b/0x1a0
[ 41.347464][ T418] do_syscall_64+0xc1/0xfd0
[ 41.347630][ T418] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 41.347836][ T418]
[ 41.347922][ T418] The buggy address belongs to the object at ffff88800f1fc000
[ 41.347922][ T418] which belongs to the cache kmalloc-4k of size 4096
[ 41.348345][ T418] The buggy address is located 1708 bytes inside of
[ 41.348345][ T418] freed 4096-byte region [ffff88800f1fc000, ffff88800f1fd000)
[ 41.348746][ T418]
[ 41.348829][ T418] The buggy address belongs to the physical page:
[ 41.349043][ T418] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf1f8
[ 41.349351][ T418] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 41.349604][ T418] flags: 0x80000000000040(head|node=0|zone=1)
[ 41.349916][ T418] page_type: f5(slab)
[ 41.350059][ T418] raw: 0080000000000040 ffff888001043700 ffffea000012d210 ffffea000022a210
[ 41.350477][ T418] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 41.350765][ T418] head: 0080000000000040 ffff888001043700 ffffea000012d210 ffffea000022a210
[ 41.351180][ T418] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 41.351582][ T418] head: 0080000000000003 ffffea00003c7e01 00000000ffffffff 00000000ffffffff
[ 41.351870][ T418] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 41.352284][ T418] page dumped because: kasan: bad access detected
[ 41.352489][ T418]
[ 41.352571][ T418] Memory state around the buggy address:
[ 41.352738][ T418] ffff88800f1fc580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.353087][ T418] ffff88800f1fc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.353337][ T418] >ffff88800f1fc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.353571][ T418] ^
[ 41.353821][ T418] ffff88800f1fc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.354082][ T418] ffff88800f1fc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.354331][ T418] ==================================================================
[ 41.355109][ T418] Disabling lock debugging due to kernel taint
[ 41.355387][ T418] ------------[ cut here ]------------
[ 41.355589][ T418] refcount_t: underflow; use-after-free.
[ 41.355799][ T418] WARNING: CPU: 2 PID: 418 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 41.356137][ T418] Modules linked in: ip_gre gre 8021q vrf veth
[ 41.357131][ T418] CPU: 2 UID: 0 PID: 418 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 41.357524][ T418] Tainted: [B]=BAD_PAGE
[ 41.357672][ T418] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 41.357894][ T418] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 41.358157][ T418] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d 45 87 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
[ 41.358817][ T418] RSP: 0018:ffffc90000b971f0 EFLAGS: 00010286
[ 41.359070][ T418] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 41.359358][ T418] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 41.359629][ T418] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff0fbe134
[ 41.359901][ T418] R10: 0000000000000003 R11: ffffc90000b96d80 R12: 0000000000000001
[ 41.360179][ T418] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 41.360473][ T418] FS: 00007f548ef0b800(0000) GS:ffff8880a74f2000(0000) knlGS:0000000000000000
[ 41.360786][ T418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 41.361028][ T418] CR2: 00007f02a0253000 CR3: 000000000bd78004 CR4: 0000000000772ef0
[ 41.361313][ T418] PKRU: 55555554
[ 41.361470][ T418] Call Trace:
[ 41.361617][ T418]
[ 41.361725][ T418] netdev_run_todo+0x5f0/0xc60
[ 41.361925][ T418] ? dev_ingress_queue_create+0x190/0x190
[ 41.362126][ T418] ? generic_xdp_install+0x410/0x410
[ 41.362330][ T418] ? unregister_netdevice_many+0x20/0x20
[ 41.362618][ T418] ? net_generic+0xb1/0x1f0
[ 41.362807][ T418] ? net_generic+0xbb/0x1f0
[ 41.363006][ T418] rtnl_dellink+0x350/0xa30
[ 41.363195][ T418] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 41.363556][ T418] ? find_held_lock+0x2b/0x80
[ 41.363744][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.363931][ T418] ? find_held_lock+0x2b/0x80
[ 41.364228][ T418] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 41.364427][ T418] ? __lock_release+0x5d/0x170
[ 41.364612][ T418] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 41.364836][ T418] rtnetlink_rcv_msg+0x709/0xc00
[ 41.365137][ T418] ? rtnl_port_fill+0x850/0x850
[ 41.365334][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.365528][ T418] netlink_rcv_skb+0x121/0x340
[ 41.365715][ T418] ? rtnl_port_fill+0x850/0x850
[ 41.365904][ T418] ? netlink_ack+0xdd0/0xdd0
[ 41.366102][ T418] ? netlink_deliver_tap+0x13e/0x340
[ 41.366300][ T418] ? netlink_deliver_tap+0xc3/0x340
[ 41.366497][ T418] netlink_unicast+0x4aa/0x780
[ 41.366802][ T418] ? netlink_attachskb+0x810/0x810
[ 41.366988][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.367181][ T418] netlink_sendmsg+0x714/0xbd0
[ 41.367378][ T418] ? netlink_unicast+0x780/0x780
[ 41.367660][ T418] ? __import_iovec+0x230/0x3b0
[ 41.367847][ T418] ? netlink_unicast+0x780/0x780
[ 41.368076][ T418] ____sys_sendmsg+0x3dd/0x890
[ 41.368275][ T418] ? get_timestamp.constprop.0+0x380/0x380
[ 41.368601][ T418] ? __copy_msghdr+0x3c0/0x3c0
[ 41.368789][ T418] ___sys_sendmsg+0xed/0x170
[ 41.368977][ T418] ? kasan_record_aux_stack+0x8c/0xa0
[ 41.369171][ T418] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 41.369510][ T418] ? copy_msghdr_from_user+0x110/0x110
[ 41.369698][ T418] ? find_held_lock+0x2b/0x80
[ 41.369879][ T418] ? __lock_acquire+0x449/0x7e0
[ 41.370072][ T418] ? find_held_lock+0x2b/0x80
[ 41.370365][ T418] ? __virt_addr_valid+0x22a/0x450
[ 41.370567][ T418] ? __lock_release+0x5d/0x170
[ 41.370760][ T418] __sys_sendmsg+0x10b/0x1a0
[ 41.370945][ T418] ? __call_rcu_common.constprop.0+0x318/0x630
[ 41.371293][ T418] ? __sys_sendmsg_sock+0x20/0x20
[ 41.371491][ T418] ? rcu_is_watching+0x12/0xb0
[ 41.371674][ T418] do_syscall_64+0xc1/0xfd0
[ 41.371960][ T418] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 41.372196][ T418] RIP: 0033:0x7f548f0d91d7
[ 41.372416][ T418] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 41.373129][ T418] RSP: 002b:00007ffc038dc418 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 41.373426][ T418] RAX: ffffffffffffffda RBX: 00007ffc038dcb40 RCX: 00007f548f0d91d7
[ 41.373796][ T418] RDX: 0000000000000000 RSI: 00007ffc038dc480 RDI: 0000000000000005
[ 41.374070][ T418] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 41.374352][ T418] R10: 00007f548efd5f60 R11: 0000000000000246 R12: 0000000000000002
[ 41.374724][ T418] R13: 00000000690dfaa3 R14: 0000000000499600 R15: 0000000000000000
[ 41.375008][ T418]
[ 41.375166][ T418] irq event stamp: 38517
[ 41.375432][ T418] hardirqs last enabled at (38517): [] finish_task_switch.isra.0+0x245/0x960
[ 41.375777][ T418] hardirqs last disabled at (38516): [] __schedule+0x94a/0x1b10
[ 41.376193][ T418] softirqs last enabled at (38496): [] handle_softirqs+0x352/0x610
[ 41.376515][ T418] softirqs last disabled at (38489): [] irq_exit_rcu+0xab/0x100
[ 41.376850][ T418] ---[ end trace 0000000000000000 ]---