[ 347.368054][ T7985] br1: port 1(vx1) entered blocking state [ 347.368389][ T7985] br1: port 1(vx1) entered disabled state [ 347.368659][ T7985] vx1: entered allmulticast mode [ 347.370860][ T7985] vx1: entered promiscuous mode [ 347.372409][ T7985] br1: port 1(vx1) entered blocking state [ 347.372673][ T7985] br1: port 1(vx1) entered forwarding state [ 347.468392][ T7986] br1: port 2(veth1) entered blocking state [ 347.468789][ T7986] br1: port 2(veth1) entered disabled state [ 347.469105][ T7986] veth1: entered allmulticast mode [ 347.471441][ T7986] veth1: entered promiscuous mode [ 347.564059][ T251] br1: port 2(veth1) entered blocking state [ 347.564505][ T251] br1: port 2(veth1) entered forwarding state [ 347.812069][ T7990] br1: port 3(veth2) entered blocking state [ 347.812402][ T7990] br1: port 3(veth2) entered disabled state [ 347.812715][ T7990] veth2: entered allmulticast mode [ 347.815121][ T7990] veth2: entered promiscuous mode [ 347.910307][ T251] br1: port 3(veth2) entered blocking state [ 347.911157][ T251] br1: port 3(veth2) entered forwarding state [ 351.364646][ T8036] br2: port 1(w1) entered blocking state [ 351.364950][ T8036] br2: port 1(w1) entered disabled state [ 351.365506][ T8036] w1: entered allmulticast mode [ 351.367523][ T8036] w1: entered promiscuous mode [ 351.930963][ T8042] br2: port 2(vx2) entered blocking state [ 351.931371][ T8042] br2: port 2(vx2) entered disabled state [ 351.931738][ T8042] vx2: entered allmulticast mode [ 351.935424][ T8042] vx2: entered promiscuous mode [ 351.936841][ T8042] br2: port 2(vx2) entered blocking state [ 351.937175][ T8042] br2: port 2(vx2) entered forwarding state [ 352.689657][ T251] br2: port 1(w1) entered blocking state [ 352.689963][ T251] br2: port 1(w1) entered forwarding state [ 354.505301][ T8074] ip (8074) used greatest stack depth: 23280 bytes left [ 354.587030][ T8075] br2: port 1(w1) entered blocking state [ 354.587290][ T8075] br2: port 1(w1) entered disabled state [ 354.587620][ T8075] w1: entered allmulticast mode [ 354.589604][ T8075] w1: entered promiscuous mode [ 355.178265][ T8081] br2: port 2(vx2) entered blocking state [ 355.178547][ T8081] br2: port 2(vx2) entered disabled state [ 355.178838][ T8081] vx2: entered allmulticast mode [ 355.181214][ T8081] vx2: entered promiscuous mode [ 355.182287][ T8081] br2: port 2(vx2) entered blocking state [ 355.182561][ T8081] br2: port 2(vx2) entered forwarding state [ 355.947384][ T45] br2: port 1(w1) entered blocking state [ 355.947669][ T45] br2: port 1(w1) entered forwarding state [ 365.457845][ T8154] GACT probability NOT on [ 423.456559][ T8421] veth3: entered promiscuous mode [ 454.629233][ T8910] veth3: left promiscuous mode [ 479.144417][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.246149][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.347404][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.448507][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.549635][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.650825][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.751751][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.852819][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 479.954154][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 480.055293][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.160632][ C2] net_ratelimit: 1 callbacks suppressed [ 484.160643][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.261911][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.363024][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.464241][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.565758][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.667068][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.768302][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.869674][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 484.970844][ C2] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.282621][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.384093][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.485126][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.586255][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.687146][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.788089][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.889177][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 552.990150][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 553.091210][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 553.192062][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 554.863239][ T9879] vx1: left allmulticast mode [ 554.863546][ T9879] vx1: left promiscuous mode [ 554.863908][ T9879] br1: port 1(vx1) entered disabled state [ 560.282469][ T9884] br1: port 1(vx1) entered blocking state [ 560.282748][ T9884] br1: port 1(vx1) entered disabled state [ 560.282992][ T9884] vx1: entered allmulticast mode [ 560.285058][ T9884] vx1: entered promiscuous mode [ 560.285901][ T9884] br1: port 1(vx1) entered blocking state [ 560.286129][ T9884] br1: port 1(vx1) entered forwarding state [ 626.470198][T10171] veth3: entered promiscuous mode [ 657.594578][T10660] veth3: left promiscuous mode [ 658.505839][ T65] vx2: left allmulticast mode [ 658.506366][ T65] vx2: left promiscuous mode [ 658.506903][ T65] br2: port 2(vx2) entered disabled state [ 658.513812][ T65] w1: left allmulticast mode [ 658.514128][ T65] w1: left promiscuous mode [ 658.515116][ T65] br2: port 1(w1) entered disabled state [ 659.119688][ T65] vx2: left allmulticast mode [ 659.119921][ T65] vx2: left promiscuous mode [ 659.120240][ T65] br2: port 2(vx2) entered disabled state [ 659.131805][ T65] w1: left allmulticast mode [ 659.132014][ T65] w1: left promiscuous mode [ 659.132318][ T65] br2: port 1(w1) entered disabled state [ 659.431157][ T65] ================================================================== [ 659.431400][ T65] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 659.431591][ T65] Read of size 8 at addr ffff8880118f1a38 by task kworker/u16:1/65 [ 659.431770][ T65] [ 659.431839][ T65] CPU: 0 UID: 0 PID: 65 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 659.432124][ T65] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 659.432294][ T65] Workqueue: netns cleanup_net [ 659.432444][ T65] Call Trace: [ 659.432559][ T65] [ 659.432632][ T65] dump_stack_lvl+0x82/0xd0 [ 659.432776][ T65] print_address_description.constprop.0+0x2c/0x3b0 [ 659.432947][ T65] ? cleanup_net+0x932/0xa40 [ 659.433080][ T65] print_report+0xb4/0x270 [ 659.433205][ T65] ? kasan_addr_to_slab+0x25/0x80 [ 659.433338][ T65] kasan_report+0xbd/0xf0 [ 659.433435][ T65] ? cleanup_net+0x932/0xa40 [ 659.433564][ T65] cleanup_net+0x932/0xa40 [ 659.433690][ T65] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 659.433820][ T65] ? __pfx_cleanup_net+0x10/0x10 [ 659.433952][ T65] ? trace_lock_acquire+0x148/0x1f0 [ 659.434080][ T65] ? lock_acquire+0x32/0xc0 [ 659.434205][ T65] ? process_one_work+0xe0b/0x16d0 [ 659.434339][ T65] process_one_work+0xe55/0x16d0 [ 659.434466][ T65] ? __pfx___lock_release+0x10/0x10 [ 659.434596][ T65] ? __pfx_process_one_work+0x10/0x10 [ 659.434723][ T65] ? assign_work+0x16c/0x240 [ 659.434847][ T65] worker_thread+0x58c/0xce0 [ 659.434982][ T65] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 659.435137][ T65] ? __pfx_worker_thread+0x10/0x10 [ 659.435261][ T65] ? __pfx_worker_thread+0x10/0x10 [ 659.435393][ T65] kthread+0x28a/0x350 [ 659.435490][ T65] ? __pfx_kthread+0x10/0x10 [ 659.435614][ T65] ret_from_fork+0x31/0x70 [ 659.435738][ T65] ? __pfx_kthread+0x10/0x10 [ 659.435867][ T65] ret_from_fork_asm+0x1a/0x30 [ 659.436053][ T65] [ 659.436153][ T65] [ 659.436216][ T65] Allocated by task 8054: [ 659.436313][ T65] kasan_save_stack+0x24/0x50 [ 659.436447][ T65] kasan_save_track+0x14/0x30 [ 659.436588][ T65] __kasan_slab_alloc+0x59/0x70 [ 659.436715][ T65] kmem_cache_alloc_noprof+0x10b/0x350 [ 659.436839][ T65] copy_net_ns+0xc6/0x340 [ 659.436945][ T65] create_new_namespaces+0x35f/0x920 [ 659.437073][ T65] unshare_nsproxy_namespaces+0x8d/0x130 [ 659.437200][ T65] ksys_unshare+0x2a9/0x660 [ 659.437331][ T65] __x64_sys_unshare+0x31/0x40 [ 659.437464][ T65] do_syscall_64+0xc1/0x1d0 [ 659.437591][ T65] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 659.437744][ T65] [ 659.437808][ T65] Freed by task 65: [ 659.437904][ T65] kasan_save_stack+0x24/0x50 [ 659.438042][ T65] kasan_save_track+0x14/0x30 [ 659.438167][ T65] kasan_save_free_info+0x3b/0x60 [ 659.438290][ T65] __kasan_slab_free+0x38/0x50 [ 659.438424][ T65] kmem_cache_free+0xf8/0x330 [ 659.438551][ T65] cleanup_net+0x5a8/0xa40 [ 659.438680][ T65] process_one_work+0xe55/0x16d0 [ 659.438804][ T65] worker_thread+0x58c/0xce0 [ 659.438937][ T65] kthread+0x28a/0x350 [ 659.439036][ T65] ret_from_fork+0x31/0x70 [ 659.439165][ T65] ret_from_fork_asm+0x1a/0x30 [ 659.439290][ T65] [ 659.439364][ T65] Last potentially related work creation: [ 659.439498][ T65] kasan_save_stack+0x24/0x50 [ 659.439630][ T65] __kasan_record_aux_stack+0x8e/0xa0 [ 659.439758][ T65] insert_work+0x34/0x230 [ 659.439847][ T65] __queue_work+0x5fd/0xa40 [ 659.439987][ T65] call_timer_fn+0x13b/0x230 [ 659.440114][ T65] __run_timers+0x3ff/0x810 [ 659.440240][ T65] run_timer_softirq+0x154/0x1c0 [ 659.440377][ T65] handle_softirqs+0x1f6/0x5c0 [ 659.440504][ T65] __irq_exit_rcu+0xc4/0x100 [ 659.440633][ T65] irq_exit_rcu+0xe/0x20 [ 659.440733][ T65] sysvec_apic_timer_interrupt+0x78/0x90 [ 659.440861][ T65] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 659.441024][ T65] [ 659.441094][ T65] Second to last potentially related work creation: [ 659.441251][ T65] kasan_save_stack+0x24/0x50 [ 659.441384][ T65] __kasan_record_aux_stack+0x8e/0xa0 [ 659.441509][ T65] insert_work+0x34/0x230 [ 659.441604][ T65] __queue_work+0x5fd/0xa40 [ 659.441733][ T65] call_timer_fn+0x13b/0x230 [ 659.441857][ T65] __run_timers+0x3ff/0x810 [ 659.441991][ T65] run_timer_softirq+0x154/0x1c0 [ 659.442115][ T65] handle_softirqs+0x1f6/0x5c0 [ 659.442249][ T65] __irq_exit_rcu+0xc4/0x100 [ 659.442383][ T65] irq_exit_rcu+0xe/0x20 [ 659.442477][ T65] sysvec_apic_timer_interrupt+0x78/0x90 [ 659.442604][ T65] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 659.442764][ T65] [ 659.442828][ T65] The buggy address belongs to the object at ffff8880118f1980 [ 659.442828][ T65] which belongs to the cache net_namespace of size 6080 [ 659.443168][ T65] The buggy address is located 184 bytes inside of [ 659.443168][ T65] freed 6080-byte region [ffff8880118f1980, ffff8880118f3140) [ 659.443468][ T65] [ 659.443532][ T65] The buggy address belongs to the physical page: [ 659.443686][ T65] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880118f32c0 pfn:0x118f0 [ 659.443952][ T65] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 659.444145][ T65] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 659.444312][ T65] page_type: f5(slab) [ 659.444413][ T65] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 659.444632][ T65] raw: ffff8880118f32c0 0000000000050002 00000001f5000000 0000000000000000 [ 659.444855][ T65] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 659.445086][ T65] head: ffff8880118f32c0 0000000000050002 00000001f5000000 0000000000000000 [ 659.445305][ T65] head: 0080000000000003 ffffea0000463c01 ffffffffffffffff 0000000000000000 [ 659.445519][ T65] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 659.445738][ T65] page dumped because: kasan: bad access detected [ 659.445896][ T65] [ 659.445974][ T65] Memory state around the buggy address: [ 659.446108][ T65] ffff8880118f1900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 659.446305][ T65] ffff8880118f1980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 659.446502][ T65] >ffff8880118f1a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 659.446727][ T65] ^ [ 659.446896][ T65] ffff8880118f1a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 659.447102][ T65] ffff8880118f1b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 659.447300][ T65] ================================================================== [ 659.447531][ T65] Disabling lock debugging due to kernel taint [ 660.860310][T10699] br1: port 3(veth2) entered disabled state [ 660.930196][T10700] veth2: left allmulticast mode [ 660.931012][T10700] veth2: left promiscuous mode [ 660.931321][T10700] br1: port 3(veth2) entered disabled state [ 661.107619][T10703] br1: port 2(veth1) entered disabled state [ 661.178947][T10704] veth1: left allmulticast mode [ 661.179162][T10704] veth1: left promiscuous mode [ 661.179450][T10704] br1: port 2(veth1) entered disabled state [ 661.240860][T10705] vx1: left allmulticast mode [ 661.241102][T10705] vx1: left promiscuous mode [ 661.242589][T10705] br1: port 1(vx1) entered disabled state