[ 15.142520][ T300] 8021q: 802.1Q VLAN Support v1.8 [ 18.825164][ T345] br1: port 1(vx10) entered blocking state [ 18.825658][ T345] br1: port 1(vx10) entered disabled state [ 18.826080][ T345] vx10: entered allmulticast mode [ 18.828642][ T345] vx10: entered promiscuous mode [ 18.830187][ T345] br1: port 1(vx10) entered blocking state [ 18.830784][ T345] br1: port 1(vx10) entered forwarding state [ 19.237591][ T350] br1: port 2(vx20) entered blocking state [ 19.237909][ T350] br1: port 2(vx20) entered disabled state [ 19.238189][ T350] vx20: entered allmulticast mode [ 19.241755][ T350] vx20: entered promiscuous mode [ 19.242816][ T350] br1: port 2(vx20) entered blocking state [ 19.243110][ T350] br1: port 2(vx20) entered forwarding state [ 19.455092][ T352] br1: port 3(veth1) entered blocking state [ 19.455430][ T352] br1: port 3(veth1) entered disabled state [ 19.455775][ T352] veth1: entered allmulticast mode [ 19.457744][ T352] veth1: entered promiscuous mode [ 19.546588][ T40] br1: port 3(veth1) entered blocking state [ 19.547197][ T40] br1: port 3(veth1) entered forwarding state [ 19.844739][ T356] br1: port 4(veth2) entered blocking state [ 19.845071][ T356] br1: port 4(veth2) entered disabled state [ 19.845931][ T356] veth2: entered allmulticast mode [ 19.854760][ T356] veth2: entered promiscuous mode [ 19.944584][ T45] br1: port 4(veth2) entered blocking state [ 19.945053][ T45] br1: port 4(veth2) entered forwarding state [ 23.887667][ T406] br2: port 1(w1) entered blocking state [ 23.887916][ T406] br2: port 1(w1) entered disabled state [ 23.888179][ T406] w1: entered allmulticast mode [ 23.890389][ T406] w1: entered promiscuous mode [ 24.668066][ T414] br2: port 2(vx10) entered blocking state [ 24.668417][ T414] br2: port 2(vx10) entered disabled state [ 24.668718][ T414] vx10: entered allmulticast mode [ 24.671181][ T414] vx10: entered promiscuous mode [ 24.671801][ T414] br2: port 2(vx10) entered blocking state [ 24.672087][ T414] br2: port 2(vx10) entered forwarding state [ 25.282816][ T421] br2: port 3(vx20) entered blocking state [ 25.283122][ T421] br2: port 3(vx20) entered disabled state [ 25.284245][ T421] vx20: entered allmulticast mode [ 25.286203][ T421] vx20: entered promiscuous mode [ 25.286760][ T421] br2: port 3(vx20) entered blocking state [ 25.287002][ T421] br2: port 3(vx20) entered forwarding state [ 26.101634][ T40] br2: port 1(w1) entered blocking state [ 26.102190][ T40] br2: port 1(w1) entered forwarding state [ 28.894026][ T461] br2: port 1(w1) entered blocking state [ 28.894686][ T461] br2: port 1(w1) entered disabled state [ 28.894967][ T461] w1: entered allmulticast mode [ 28.896992][ T461] w1: entered promiscuous mode [ 29.632852][ T469] br2: port 2(vx10) entered blocking state [ 29.633160][ T469] br2: port 2(vx10) entered disabled state [ 29.633720][ T469] vx10: entered allmulticast mode [ 29.635685][ T469] vx10: entered promiscuous mode [ 29.636235][ T469] br2: port 2(vx10) entered blocking state [ 29.636516][ T469] br2: port 2(vx10) entered forwarding state [ 30.311016][ T476] br2: port 3(vx20) entered blocking state [ 30.311479][ T476] br2: port 3(vx20) entered disabled state [ 30.311916][ T476] vx20: entered allmulticast mode [ 30.314930][ T476] vx20: entered promiscuous mode [ 30.315794][ T476] br2: port 3(vx20) entered blocking state [ 30.316584][ T476] br2: port 3(vx20) entered forwarding state [ 31.040570][ T71] br2: port 1(w1) entered blocking state [ 31.040832][ T71] br2: port 1(w1) entered forwarding state [ 47.043861][ T591] GACT probability NOT on [ 83.700596][ T1212] veth3: entered promiscuous mode [ 137.281467][ T2139] veth3: left promiscuous mode [ 137.791796][ T2145] veth3: entered promiscuous mode [ 191.502834][ T3072] veth3: left promiscuous mode [ 192.590136][ T3090] vx20: left allmulticast mode [ 192.590432][ T3090] vx20: left promiscuous mode [ 192.591020][ T3090] br1: port 2(vx20) entered disabled state [ 192.604281][ T3090] ip (3090) used greatest stack depth: 23720 bytes left [ 192.689065][ T3091] vx10: left allmulticast mode [ 192.689370][ T3091] vx10: left promiscuous mode [ 192.689730][ T3091] br1: port 1(vx10) entered disabled state [ 198.116060][ T3096] br1: port 1(vx10) entered blocking state [ 198.116765][ T3096] br1: port 1(vx10) entered disabled state [ 198.117048][ T3096] vx10: entered allmulticast mode [ 198.119014][ T3096] vx10: entered promiscuous mode [ 198.119560][ T3096] br1: port 1(vx10) entered blocking state [ 198.119811][ T3096] br1: port 1(vx10) entered forwarding state [ 198.298028][ T3098] br1: port 2(vx20) entered blocking state [ 198.298770][ T3098] br1: port 2(vx20) entered disabled state [ 198.306139][ T3098] vx20: entered allmulticast mode [ 198.308841][ T3098] vx20: entered promiscuous mode [ 198.309474][ T3098] br1: port 2(vx20) entered blocking state [ 198.309821][ T3098] br1: port 2(vx20) entered forwarding state [ 248.852278][ T3776] veth3: entered promiscuous mode [ 304.603182][ T4703] veth3: left promiscuous mode [ 305.192255][ T4709] veth3: entered promiscuous mode [ 359.619761][ T5636] veth3: left promiscuous mode [ 361.179195][ T5659] vx20: left allmulticast mode [ 361.179673][ T5659] vx20: left promiscuous mode [ 361.180282][ T5659] br1: port 2(vx20) entered disabled state [ 361.299995][ T5660] vx10: left allmulticast mode [ 361.300406][ T5660] vx10: left promiscuous mode [ 361.300912][ T5660] br1: port 1(vx10) entered disabled state [ 366.746504][ T5665] br1: port 1(vx10) entered blocking state [ 366.746977][ T5665] br1: port 1(vx10) entered disabled state [ 366.747455][ T5665] vx10: entered allmulticast mode [ 366.750792][ T5665] vx10: entered promiscuous mode [ 366.752265][ T5665] br1: port 1(vx10) entered blocking state [ 366.752706][ T5665] br1: port 1(vx10) entered forwarding state [ 366.935303][ T5667] br1: port 2(vx20) entered blocking state [ 366.935640][ T5667] br1: port 2(vx20) entered disabled state [ 366.935985][ T5667] vx20: entered allmulticast mode [ 366.938588][ T5667] vx20: entered promiscuous mode [ 366.939275][ T5667] br1: port 2(vx20) entered blocking state [ 366.939769][ T5667] br1: port 2(vx20) entered forwarding state [ 699.323414][ T8943] vx20: left allmulticast mode [ 699.323650][ T8943] vx20: left promiscuous mode [ 699.323968][ T8943] br1: port 2(vx20) entered disabled state [ 699.418776][ T8944] vx10: left allmulticast mode [ 699.419052][ T8944] vx10: left promiscuous mode [ 699.419449][ T8944] br1: port 1(vx10) entered disabled state [ 704.844155][ T8949] br1: port 1(vx10) entered blocking state [ 704.844495][ T8949] br1: port 1(vx10) entered disabled state [ 704.844776][ T8949] vx10: entered allmulticast mode [ 704.846724][ T8949] vx10: entered promiscuous mode [ 704.847256][ T8949] br1: port 1(vx10) entered blocking state [ 704.847530][ T8949] br1: port 1(vx10) entered forwarding state [ 705.019444][ T8951] br1: port 2(vx20) entered blocking state [ 705.019764][ T8951] br1: port 2(vx20) entered disabled state [ 705.020047][ T8951] vx20: entered allmulticast mode [ 705.021969][ T8951] vx20: entered promiscuous mode [ 705.022536][ T8951] br1: port 2(vx20) entered blocking state [ 705.022799][ T8951] br1: port 2(vx20) entered forwarding state [ 814.665422][T10823] ip (10823) used greatest stack depth: 23408 bytes left [ 814.753196][ T68] vx20: left allmulticast mode [ 814.753724][ T68] vx20: left promiscuous mode [ 814.754334][ T68] br2: port 3(vx20) entered disabled state [ 814.758927][ T68] vx10: left allmulticast mode [ 814.759247][ T68] vx10: left promiscuous mode [ 814.759586][ T68] br2: port 2(vx10) entered disabled state [ 814.762265][ T68] w1: left allmulticast mode [ 814.762505][ T68] w1: left promiscuous mode [ 814.762851][ T68] br2: port 1(w1) entered disabled state [ 815.195815][ T68] vx20: left allmulticast mode [ 815.196152][ T68] vx20: left promiscuous mode [ 815.196646][ T68] br2: port 3(vx20) entered disabled state [ 815.200614][ T68] vx10: left allmulticast mode [ 815.200931][ T68] vx10: left promiscuous mode [ 815.201453][ T68] br2: port 2(vx10) entered disabled state [ 815.208953][ T68] w1: left allmulticast mode [ 815.209267][ T68] w1: left promiscuous mode [ 815.209706][ T68] br2: port 1(w1) entered disabled state [ 815.589387][ T68] ================================================================== [ 815.589656][ T68] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 815.589852][ T68] Read of size 8 at addr ffff8880099e9a38 by task kworker/u16:1/68 [ 815.590049][ T68] [ 815.590116][ T68] CPU: 3 UID: 0 PID: 68 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 815.590328][ T68] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 815.590485][ T68] Workqueue: netns cleanup_net [ 815.590626][ T68] Call Trace: [ 815.590731][ T68] [ 815.590799][ T68] dump_stack_lvl+0x82/0xd0 [ 815.590960][ T68] print_address_description.constprop.0+0x2c/0x3b0 [ 815.591123][ T68] ? cleanup_net+0x932/0xa40 [ 815.591255][ T68] print_report+0xb4/0x270 [ 815.591381][ T68] ? kasan_addr_to_slab+0x25/0x80 [ 815.591512][ T68] kasan_report+0xbd/0xf0 [ 815.591615][ T68] ? cleanup_net+0x932/0xa40 [ 815.591757][ T68] cleanup_net+0x932/0xa40 [ 815.591901][ T68] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 815.592062][ T68] ? __pfx_cleanup_net+0x10/0x10 [ 815.592190][ T68] ? trace_lock_acquire+0x148/0x1f0 [ 815.592319][ T68] ? lock_acquire+0x32/0xc0 [ 815.592444][ T68] ? process_one_work+0xe0b/0x16d0 [ 815.592573][ T68] process_one_work+0xe55/0x16d0 [ 815.592703][ T68] ? __pfx___lock_release+0x10/0x10 [ 815.592843][ T68] ? __pfx_process_one_work+0x10/0x10 [ 815.592986][ T68] ? assign_work+0x16c/0x240 [ 815.593116][ T68] worker_thread+0x58c/0xce0 [ 815.593246][ T68] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 815.593427][ T68] ? __pfx_worker_thread+0x10/0x10 [ 815.593560][ T68] ? __pfx_worker_thread+0x10/0x10 [ 815.593685][ T68] kthread+0x28a/0x350 [ 815.593790][ T68] ? __pfx_kthread+0x10/0x10 [ 815.593930][ T68] ret_from_fork+0x31/0x70 [ 815.594054][ T68] ? __pfx_kthread+0x10/0x10 [ 815.594188][ T68] ret_from_fork_asm+0x1a/0x30 [ 815.594326][ T68] [ 815.594431][ T68] [ 815.594505][ T68] Allocated by task 440: [ 815.594604][ T68] kasan_save_stack+0x24/0x50 [ 815.594737][ T68] kasan_save_track+0x14/0x30 [ 815.594868][ T68] __kasan_slab_alloc+0x59/0x70 [ 815.595000][ T68] kmem_cache_alloc_noprof+0x10b/0x350 [ 815.595125][ T68] copy_net_ns+0xc6/0x340 [ 815.595227][ T68] create_new_namespaces+0x35f/0x920 [ 815.595351][ T68] unshare_nsproxy_namespaces+0x8d/0x130 [ 815.595477][ T68] ksys_unshare+0x2a9/0x660 [ 815.595608][ T68] __x64_sys_unshare+0x31/0x40 [ 815.595734][ T68] do_syscall_64+0xc1/0x1d0 [ 815.595873][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 815.596031][ T68] [ 815.596096][ T68] Freed by task 68: [ 815.596195][ T68] kasan_save_stack+0x24/0x50 [ 815.596325][ T68] kasan_save_track+0x14/0x30 [ 815.596448][ T68] kasan_save_free_info+0x3b/0x60 [ 815.596574][ T68] __kasan_slab_free+0x38/0x50 [ 815.596701][ T68] kmem_cache_free+0xf8/0x330 [ 815.596828][ T68] cleanup_net+0x5a8/0xa40 [ 815.596955][ T68] process_one_work+0xe55/0x16d0 [ 815.597081][ T68] worker_thread+0x58c/0xce0 [ 815.597219][ T68] kthread+0x28a/0x350 [ 815.597315][ T68] ret_from_fork+0x31/0x70 [ 815.597445][ T68] ret_from_fork_asm+0x1a/0x30 [ 815.597571][ T68] [ 815.597638][ T68] Last potentially related work creation: [ 815.597773][ T68] kasan_save_stack+0x24/0x50 [ 815.597921][ T68] __kasan_record_aux_stack+0x8e/0xa0 [ 815.598050][ T68] insert_work+0x34/0x230 [ 815.598154][ T68] __queue_work+0x5fd/0xa40 [ 815.598289][ T68] call_timer_fn+0x13b/0x230 [ 815.598431][ T68] __run_timers+0x3ff/0x810 [ 815.598568][ T68] run_timer_softirq+0x154/0x1c0 [ 815.598700][ T68] handle_softirqs+0x1f6/0x5c0 [ 815.598827][ T68] __irq_exit_rcu+0xc4/0x100 [ 815.598964][ T68] irq_exit_rcu+0xe/0x20 [ 815.599058][ T68] sysvec_apic_timer_interrupt+0x78/0x90 [ 815.599200][ T68] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 815.599392][ T68] [ 815.599489][ T68] Second to last potentially related work creation: [ 815.599702][ T68] kasan_save_stack+0x24/0x50 [ 815.599889][ T68] __kasan_record_aux_stack+0x8e/0xa0 [ 815.600073][ T68] insert_work+0x34/0x230 [ 815.600217][ T68] __queue_work+0x5fd/0xa40 [ 815.600404][ T68] call_timer_fn+0x13b/0x230 [ 815.600600][ T68] __run_timers+0x3ff/0x810 [ 815.600787][ T68] run_timer_softirq+0x154/0x1c0 [ 815.600986][ T68] handle_softirqs+0x1f6/0x5c0 [ 815.601196][ T68] __irq_exit_rcu+0xc4/0x100 [ 815.601395][ T68] irq_exit_rcu+0xe/0x20 [ 815.601539][ T68] sysvec_apic_timer_interrupt+0x78/0x90 [ 815.601721][ T68] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 815.601953][ T68] [ 815.602051][ T68] The buggy address belongs to the object at ffff8880099e9980 [ 815.602051][ T68] which belongs to the cache net_namespace of size 6080 [ 815.602549][ T68] The buggy address is located 184 bytes inside of [ 815.602549][ T68] freed 6080-byte region [ffff8880099e9980, ffff8880099eb140) [ 815.602998][ T68] [ 815.603092][ T68] The buggy address belongs to the physical page: [ 815.603342][ T68] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880099eb2c0 pfn:0x99e8 [ 815.603725][ T68] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 815.604026][ T68] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 815.604273][ T68] page_type: f5(slab) [ 815.604428][ T68] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 815.604775][ T68] raw: ffff8880099eb2c0 0000000000050002 00000001f5000000 0000000000000000 [ 815.605116][ T68] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 815.605467][ T68] head: ffff8880099eb2c0 0000000000050002 00000001f5000000 0000000000000000 [ 815.605836][ T68] head: 0080000000000003 ffffea0000267a01 ffffffffffffffff 0000000000000000 [ 815.606182][ T68] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 815.606509][ T68] page dumped because: kasan: bad access detected [ 815.606726][ T68] [ 815.606832][ T68] Memory state around the buggy address: [ 815.607018][ T68] ffff8880099e9900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 815.607230][ T68] ffff8880099e9980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 815.607506][ T68] >ffff8880099e9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 815.607734][ T68] ^ [ 815.607920][ T68] ffff8880099e9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 815.608112][ T68] ffff8880099e9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 815.608338][ T68] ================================================================== [ 815.608546][ T68] Disabling lock debugging due to kernel taint [ 817.113143][T10854] br1: port 4(veth2) entered disabled state [ 817.181049][T10856] veth2: left allmulticast mode [ 817.181317][T10856] veth2: left promiscuous mode [ 817.181606][T10856] br1: port 4(veth2) entered disabled state [ 817.373957][T10859] br1: port 3(veth1) entered disabled state [ 817.445876][T10861] veth1: left allmulticast mode [ 817.446077][T10861] veth1: left promiscuous mode [ 817.446393][T10861] br1: port 3(veth1) entered disabled state [ 817.569431][T10863] vx20: left allmulticast mode [ 817.569647][T10863] vx20: left promiscuous mode [ 817.570007][T10863] br1: port 2(vx20) entered disabled state [ 817.854135][T10867] vx10: left allmulticast mode [ 817.854436][T10867] vx10: left promiscuous mode [ 817.854751][T10867] br1: port 1(vx10) entered disabled state