[ 64.546707][ T824] br1: port 1(vx10) entered blocking state [ 64.547237][ T824] br1: port 1(vx10) entered disabled state [ 64.547591][ T824] vx10: entered allmulticast mode [ 64.549673][ T824] vx10: entered promiscuous mode [ 64.550841][ T824] br1: port 1(vx10) entered blocking state [ 64.551230][ T824] br1: port 1(vx10) entered forwarding state [ 64.924610][ T829] br1: port 2(vx20) entered blocking state [ 64.925316][ T829] br1: port 2(vx20) entered disabled state [ 64.925616][ T829] vx20: entered allmulticast mode [ 64.927654][ T829] vx20: entered promiscuous mode [ 64.928559][ T829] br1: port 2(vx20) entered blocking state [ 64.928969][ T829] br1: port 2(vx20) entered forwarding state [ 65.114917][ T831] br1: port 3(veth1) entered blocking state [ 65.115251][ T831] br1: port 3(veth1) entered disabled state [ 65.115599][ T831] veth1: entered allmulticast mode [ 65.117642][ T831] veth1: entered promiscuous mode [ 65.209179][ T37] br1: port 3(veth1) entered blocking state [ 65.209739][ T37] br1: port 3(veth1) entered forwarding state [ 65.578828][ T836] br1: port 4(veth2) entered blocking state [ 65.579171][ T836] br1: port 4(veth2) entered disabled state [ 65.579488][ T836] veth2: entered allmulticast mode [ 65.581541][ T836] veth2: entered promiscuous mode [ 65.670996][ T68] br1: port 4(veth2) entered blocking state [ 65.671345][ T68] br1: port 4(veth2) entered forwarding state [ 69.467705][ T893] br2: port 1(w1) entered blocking state [ 69.467972][ T893] br2: port 1(w1) entered disabled state [ 69.468227][ T893] w1: entered allmulticast mode [ 69.470226][ T893] w1: entered promiscuous mode [ 70.208033][ T901] br2: port 2(vx10) entered blocking state [ 70.208785][ T901] br2: port 2(vx10) entered disabled state [ 70.209094][ T901] vx10: entered allmulticast mode [ 70.211115][ T901] vx10: entered promiscuous mode [ 70.211699][ T901] br2: port 2(vx10) entered blocking state [ 70.211950][ T901] br2: port 2(vx10) entered forwarding state [ 70.914601][ T908] br2: port 3(vx20) entered blocking state [ 70.914987][ T908] br2: port 3(vx20) entered disabled state [ 70.915348][ T908] vx20: entered allmulticast mode [ 70.917577][ T908] vx20: entered promiscuous mode [ 70.918171][ T908] br2: port 3(vx20) entered blocking state [ 70.918500][ T908] br2: port 3(vx20) entered forwarding state [ 71.749257][ T37] br2: port 1(w1) entered blocking state [ 71.749807][ T37] br2: port 1(w1) entered forwarding state [ 74.408664][ T950] br2: port 1(w1) entered blocking state [ 74.408990][ T950] br2: port 1(w1) entered disabled state [ 74.409247][ T950] w1: entered allmulticast mode [ 74.411523][ T950] w1: entered promiscuous mode [ 75.122790][ T958] br2: port 2(vx10) entered blocking state [ 75.123158][ T958] br2: port 2(vx10) entered disabled state [ 75.123501][ T958] vx10: entered allmulticast mode [ 75.125835][ T958] vx10: entered promiscuous mode [ 75.126683][ T958] br2: port 2(vx10) entered blocking state [ 75.126955][ T958] br2: port 2(vx10) entered forwarding state [ 75.794506][ T965] br2: port 3(vx20) entered blocking state [ 75.794987][ T965] br2: port 3(vx20) entered disabled state [ 75.795476][ T965] vx20: entered allmulticast mode [ 75.799964][ T965] vx20: entered promiscuous mode [ 75.800847][ T965] br2: port 3(vx20) entered blocking state [ 75.801216][ T965] br2: port 3(vx20) entered forwarding state [ 76.508445][ T37] br2: port 1(w1) entered blocking state [ 76.508697][ T37] br2: port 1(w1) entered forwarding state [ 87.382708][ T1051] GACT probability NOT on [ 213.013274][ T1852] veth3: entered promiscuous mode [ 259.688770][ T2779] veth3: left promiscuous mode [ 260.129109][ T2785] veth3: entered promiscuous mode [ 306.488642][ T3712] veth3: left promiscuous mode [ 307.250470][ T3730] vx20: left allmulticast mode [ 307.250696][ T3730] vx20: left promiscuous mode [ 307.251017][ T3730] br1: port 2(vx20) entered disabled state [ 307.330764][ T3731] vx10: left allmulticast mode [ 307.331019][ T3731] vx10: left promiscuous mode [ 307.331798][ T3731] br1: port 1(vx10) entered disabled state [ 312.692895][ T3736] br1: port 1(vx10) entered blocking state [ 312.693406][ T3736] br1: port 1(vx10) entered disabled state [ 312.693839][ T3736] vx10: entered allmulticast mode [ 312.697139][ T3736] vx10: entered promiscuous mode [ 312.709023][ T3736] br1: port 1(vx10) entered blocking state [ 312.709530][ T3736] br1: port 1(vx10) entered forwarding state [ 312.886251][ T3738] br1: port 2(vx20) entered blocking state [ 312.886735][ T3738] br1: port 2(vx20) entered disabled state [ 312.887138][ T3738] vx20: entered allmulticast mode [ 312.890361][ T3738] vx20: entered promiscuous mode [ 312.891140][ T3738] br1: port 2(vx20) entered blocking state [ 312.891527][ T3738] br1: port 2(vx20) entered forwarding state [ 445.194807][ T4566] veth3: entered promiscuous mode [ 491.343220][ T5493] veth3: left promiscuous mode [ 491.803612][ T5499] veth3: entered promiscuous mode [ 536.955925][ T6426] veth3: left promiscuous mode [ 846.260361][ T11] vx20: left allmulticast mode [ 846.260782][ T11] vx20: left promiscuous mode [ 846.261149][ T11] br2: port 3(vx20) entered disabled state [ 846.263912][ T11] vx10: left allmulticast mode [ 846.264128][ T11] vx10: left promiscuous mode [ 846.264461][ T11] br2: port 2(vx10) entered disabled state [ 846.266458][ T11] w1: left allmulticast mode [ 846.266681][ T11] w1: left promiscuous mode [ 846.266986][ T11] br2: port 1(w1) entered disabled state [ 846.758061][ T11] vx20: left allmulticast mode [ 846.758283][ T11] vx20: left promiscuous mode [ 846.758601][ T11] br2: port 3(vx20) entered disabled state [ 846.760724][ T11] vx10: left allmulticast mode [ 846.760953][ T11] vx10: left promiscuous mode [ 846.761256][ T11] br2: port 2(vx10) entered disabled state [ 846.763755][ T11] w1: left allmulticast mode [ 846.763954][ T11] w1: left promiscuous mode [ 846.764283][ T11] br2: port 1(w1) entered disabled state [ 847.139275][ T11] ================================================================== [ 847.139511][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 847.139700][ T11] Read of size 8 at addr ffff888005551a38 by task kworker/u16:0/11 [ 847.139880][ T11] [ 847.139944][ T11] CPU: 2 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 847.140129][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 847.140287][ T11] Workqueue: netns cleanup_net [ 847.140417][ T11] Call Trace: [ 847.140513][ T11] [ 847.140579][ T11] dump_stack_lvl+0x82/0xd0 [ 847.140713][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 847.140885][ T11] ? cleanup_net+0x932/0xa40 [ 847.141015][ T11] print_report+0xb4/0x270 [ 847.141138][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 847.141264][ T11] kasan_report+0xbd/0xf0 [ 847.141361][ T11] ? cleanup_net+0x932/0xa40 [ 847.141485][ T11] cleanup_net+0x932/0xa40 [ 847.141607][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 847.141737][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 847.141865][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 847.141994][ T11] ? lock_acquire+0x32/0xc0 [ 847.142116][ T11] ? process_one_work+0xe0b/0x16d0 [ 847.142251][ T11] process_one_work+0xe55/0x16d0 [ 847.142377][ T11] ? __pfx___lock_release+0x10/0x10 [ 847.142502][ T11] ? __pfx_process_one_work+0x10/0x10 [ 847.142630][ T11] ? assign_work+0x16c/0x240 [ 847.142755][ T11] worker_thread+0x58c/0xce0 [ 847.142885][ T11] ? __pfx_worker_thread+0x10/0x10 [ 847.143012][ T11] kthread+0x28a/0x350 [ 847.143106][ T11] ? __pfx_kthread+0x10/0x10 [ 847.143229][ T11] ret_from_fork+0x31/0x70 [ 847.143357][ T11] ? __pfx_kthread+0x10/0x10 [ 847.143481][ T11] ret_from_fork_asm+0x1a/0x30 [ 847.143613][ T11] [ 847.143710][ T11] [ 847.143779][ T11] Allocated by task 929: [ 847.143873][ T11] kasan_save_stack+0x24/0x50 [ 847.144000][ T11] kasan_save_track+0x14/0x30 [ 847.144122][ T11] __kasan_slab_alloc+0x59/0x70 [ 847.144248][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 847.144376][ T11] copy_net_ns+0xc6/0x340 [ 847.144472][ T11] create_new_namespaces+0x35f/0x920 [ 847.144599][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 847.144731][ T11] ksys_unshare+0x2a9/0x660 [ 847.144858][ T11] __x64_sys_unshare+0x31/0x40 [ 847.144979][ T11] do_syscall_64+0xc1/0x1d0 [ 847.145105][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.145261][ T11] [ 847.145327][ T11] Freed by task 11: [ 847.145419][ T11] kasan_save_stack+0x24/0x50 [ 847.145547][ T11] kasan_save_track+0x14/0x30 [ 847.145671][ T11] kasan_save_free_info+0x3b/0x60 [ 847.145802][ T11] __kasan_slab_free+0x38/0x50 [ 847.145931][ T11] kmem_cache_free+0xf8/0x330 [ 847.146053][ T11] cleanup_net+0x5a8/0xa40 [ 847.146172][ T11] process_one_work+0xe55/0x16d0 [ 847.146294][ T11] worker_thread+0x58c/0xce0 [ 847.146416][ T11] kthread+0x28a/0x350 [ 847.146509][ T11] ret_from_fork+0x31/0x70 [ 847.146631][ T11] ret_from_fork_asm+0x1a/0x30 [ 847.146757][ T11] [ 847.146826][ T11] Last potentially related work creation: [ 847.146949][ T11] kasan_save_stack+0x24/0x50 [ 847.147083][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 847.147207][ T11] insert_work+0x34/0x230 [ 847.147304][ T11] __queue_work+0x5fd/0xa40 [ 847.147431][ T11] call_timer_fn+0x13b/0x230 [ 847.147558][ T11] __run_timers+0x3ff/0x810 [ 847.147687][ T11] run_timer_softirq+0x154/0x1c0 [ 847.147817][ T11] handle_softirqs+0x1f6/0x5c0 [ 847.147942][ T11] __irq_exit_rcu+0xc4/0x100 [ 847.148065][ T11] irq_exit_rcu+0xe/0x20 [ 847.148158][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 847.148282][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 847.148438][ T11] [ 847.148503][ T11] Second to last potentially related work creation: [ 847.148656][ T11] kasan_save_stack+0x24/0x50 [ 847.148782][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 847.148907][ T11] insert_work+0x34/0x230 [ 847.149000][ T11] __queue_work+0x5fd/0xa40 [ 847.149122][ T11] call_timer_fn+0x13b/0x230 [ 847.149246][ T11] __run_timers+0x3ff/0x810 [ 847.149370][ T11] run_timer_softirq+0x154/0x1c0 [ 847.149493][ T11] handle_softirqs+0x1f6/0x5c0 [ 847.149620][ T11] __irq_exit_rcu+0xc4/0x100 [ 847.149744][ T11] irq_exit_rcu+0xe/0x20 [ 847.149841][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 847.149964][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 847.150115][ T11] [ 847.150179][ T11] The buggy address belongs to the object at ffff888005551980 [ 847.150179][ T11] which belongs to the cache net_namespace of size 6080 [ 847.150501][ T11] The buggy address is located 184 bytes inside of [ 847.150501][ T11] freed 6080-byte region [ffff888005551980, ffff888005553140) [ 847.150793][ T11] [ 847.150857][ T11] The buggy address belongs to the physical page: [ 847.151007][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880055532c0 pfn:0x5550 [ 847.151263][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 847.151452][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 847.151612][ T11] page_type: f5(slab) [ 847.151710][ T11] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 847.151931][ T11] raw: ffff8880055532c0 0000000000050002 00000001f5000000 0000000000000000 [ 847.152154][ T11] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 847.152383][ T11] head: ffff8880055532c0 0000000000050002 00000001f5000000 0000000000000000 [ 847.152599][ T11] head: 0080000000000003 ffffea0000155401 ffffffffffffffff 0000000000000000 [ 847.152815][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 847.153032][ T11] page dumped because: kasan: bad access detected [ 847.153184][ T11] [ 847.153247][ T11] Memory state around the buggy address: [ 847.153370][ T11] ffff888005551900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 847.153548][ T11] ffff888005551980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 847.153726][ T11] >ffff888005551a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 847.153912][ T11] ^ [ 847.154060][ T11] ffff888005551a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 847.154236][ T11] ffff888005551b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 847.154414][ T11] ================================================================== [ 847.154660][ T11] Disabling lock debugging due to kernel taint [ 848.613804][T10992] br1: port 4(veth2) entered disabled state [ 848.665685][T10994] veth2: left allmulticast mode [ 848.665871][T10994] veth2: left promiscuous mode [ 848.666126][T10994] br1: port 4(veth2) entered disabled state [ 849.000235][T10998] br1: port 3(veth1) entered disabled state [ 849.080925][T10999] veth1: left allmulticast mode [ 849.081222][T10999] veth1: left promiscuous mode [ 849.081657][T10999] br1: port 3(veth1) entered disabled state [ 849.237244][T11001] vx20: left allmulticast mode [ 849.238133][T11001] vx20: left promiscuous mode [ 849.238402][T11001] br1: port 2(vx20) entered disabled state [ 849.481913][T11005] vx10: left allmulticast mode [ 849.482119][T11005] vx10: left promiscuous mode [ 849.482962][T11005] br1: port 1(vx10) entered disabled state