[ 64.214680][ T934] br1: port 1(vx1) entered blocking state [ 64.214935][ T934] br1: port 1(vx1) entered disabled state [ 64.216834][ T934] vx1: entered allmulticast mode [ 64.218856][ T934] vx1: entered promiscuous mode [ 64.220021][ T934] br1: port 1(vx1) entered blocking state [ 64.220251][ T934] br1: port 1(vx1) entered forwarding state [ 64.333821][ T935] br1: port 2(veth1) entered blocking state [ 64.334199][ T935] br1: port 2(veth1) entered disabled state [ 64.334535][ T935] veth1: entered allmulticast mode [ 64.336937][ T935] veth1: entered promiscuous mode [ 64.427685][ T150] br1: port 2(veth1) entered blocking state [ 64.428027][ T150] br1: port 2(veth1) entered forwarding state [ 64.637262][ T938] br1: port 3(veth2) entered blocking state [ 64.637642][ T938] br1: port 3(veth2) entered disabled state [ 64.637947][ T938] veth2: entered allmulticast mode [ 64.639916][ T938] veth2: entered promiscuous mode [ 64.729153][ T306] br1: port 3(veth2) entered blocking state [ 64.729511][ T306] br1: port 3(veth2) entered forwarding state [ 68.457679][ T984] br2: port 1(w1) entered blocking state [ 68.457938][ T984] br2: port 1(w1) entered disabled state [ 68.458185][ T984] w1: entered allmulticast mode [ 68.460886][ T984] w1: entered promiscuous mode [ 69.013513][ T990] br2: port 2(vx2) entered blocking state [ 69.013831][ T990] br2: port 2(vx2) entered disabled state [ 69.014153][ T990] vx2: entered allmulticast mode [ 69.016567][ T990] vx2: entered promiscuous mode [ 69.017568][ T990] br2: port 2(vx2) entered blocking state [ 69.017809][ T990] br2: port 2(vx2) entered forwarding state [ 69.691540][ T150] br2: port 1(w1) entered blocking state [ 69.691883][ T150] br2: port 1(w1) entered forwarding state [ 71.615500][ T1023] br2: port 1(w1) entered blocking state [ 71.615797][ T1023] br2: port 1(w1) entered disabled state [ 71.616072][ T1023] w1: entered allmulticast mode [ 71.618050][ T1023] w1: entered promiscuous mode [ 72.124247][ T1029] br2: port 2(vx2) entered blocking state [ 72.124493][ T1029] br2: port 2(vx2) entered disabled state [ 72.124724][ T1029] vx2: entered allmulticast mode [ 72.127798][ T1029] vx2: entered promiscuous mode [ 72.128665][ T1029] br2: port 2(vx2) entered blocking state [ 72.128864][ T1029] br2: port 2(vx2) entered forwarding state [ 72.794660][ T45] br2: port 1(w1) entered blocking state [ 72.795025][ T45] br2: port 1(w1) entered forwarding state [ 138.141773][ T1366] veth3: entered promiscuous mode [ 165.754133][ T1855] veth3: left promiscuous mode [ 189.195388][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.297195][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.398205][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.499200][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.600225][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.701269][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.802275][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 189.903197][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 190.004351][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 190.105467][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.218199][ C3] net_ratelimit: 4 callbacks suppressed [ 194.218211][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.319594][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.420750][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.521841][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.622954][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 194.724037][ C3] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 253.934699][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.036304][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.137289][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.238329][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.339369][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.440385][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.541494][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.642662][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.743863][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 254.844988][ C0] vxlan: non-ECT from 2001:0db8:0004:0000:0000:0000:0000:0001 [ 256.453588][ T2824] vx1: left allmulticast mode [ 256.453829][ T2824] vx1: left promiscuous mode [ 256.454151][ T2824] br1: port 1(vx1) entered disabled state [ 261.846515][ T2829] br1: port 1(vx1) entered blocking state [ 261.846855][ T2829] br1: port 1(vx1) entered disabled state [ 261.847090][ T2829] vx1: entered allmulticast mode [ 261.849749][ T2829] vx1: entered promiscuous mode [ 261.850556][ T2829] br1: port 1(vx1) entered blocking state [ 261.850769][ T2829] br1: port 1(vx1) entered forwarding state [ 325.555124][ T3116] veth3: entered promiscuous mode [ 352.161790][ T3605] veth3: left promiscuous mode [ 352.894703][ T11] vx2: left allmulticast mode [ 352.895014][ T11] vx2: left promiscuous mode [ 352.895365][ T11] br2: port 2(vx2) entered disabled state [ 352.897469][ T11] w1: left allmulticast mode [ 352.897663][ T11] w1: left promiscuous mode [ 352.897967][ T11] br2: port 1(w1) entered disabled state [ 353.305186][ T11] vx2: left allmulticast mode [ 353.305425][ T11] vx2: left promiscuous mode [ 353.305841][ T11] br2: port 2(vx2) entered disabled state [ 353.308252][ T11] w1: left allmulticast mode [ 353.308463][ T11] w1: left promiscuous mode [ 353.308757][ T11] br2: port 1(w1) entered disabled state [ 353.518071][ T11] ================================================================== [ 353.518301][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 353.518500][ T11] Read of size 8 at addr ffff888005771a38 by task kworker/u16:0/11 [ 353.518691][ T11] [ 353.518760][ T11] CPU: 1 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 353.518948][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 353.519104][ T11] Workqueue: netns cleanup_net [ 353.519238][ T11] Call Trace: [ 353.519334][ T11] [ 353.519401][ T11] dump_stack_lvl+0x82/0xd0 [ 353.519536][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 353.519699][ T11] ? cleanup_net+0x932/0xa40 [ 353.519826][ T11] print_report+0xb4/0x270 [ 353.519952][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 353.520078][ T11] kasan_report+0xbd/0xf0 [ 353.520183][ T11] ? cleanup_net+0x932/0xa40 [ 353.520313][ T11] cleanup_net+0x932/0xa40 [ 353.520437][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 353.520569][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 353.520694][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 353.520819][ T11] ? lock_acquire+0x32/0xc0 [ 353.520945][ T11] ? process_one_work+0xe0b/0x16d0 [ 353.521074][ T11] process_one_work+0xe55/0x16d0 [ 353.521204][ T11] ? __pfx___lock_release+0x10/0x10 [ 353.521334][ T11] ? __pfx_process_one_work+0x10/0x10 [ 353.521465][ T11] ? assign_work+0x16c/0x240 [ 353.521595][ T11] worker_thread+0x58c/0xce0 [ 353.521725][ T11] ? __pfx_worker_thread+0x10/0x10 [ 353.521850][ T11] kthread+0x28a/0x350 [ 353.521948][ T11] ? __pfx_kthread+0x10/0x10 [ 353.522072][ T11] ret_from_fork+0x31/0x70 [ 353.522199][ T11] ? __pfx_kthread+0x10/0x10 [ 353.522325][ T11] ret_from_fork_asm+0x1a/0x30 [ 353.522457][ T11] [ 353.522552][ T11] [ 353.522615][ T11] Allocated by task 1002: [ 353.522709][ T11] kasan_save_stack+0x24/0x50 [ 353.522835][ T11] kasan_save_track+0x14/0x30 [ 353.522959][ T11] __kasan_slab_alloc+0x59/0x70 [ 353.523083][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 353.523211][ T11] copy_net_ns+0xc6/0x340 [ 353.523312][ T11] create_new_namespaces+0x35f/0x920 [ 353.523438][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 353.523562][ T11] ksys_unshare+0x2a9/0x660 [ 353.523690][ T11] __x64_sys_unshare+0x31/0x40 [ 353.523818][ T11] do_syscall_64+0xc1/0x1d0 [ 353.523945][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.524100][ T11] [ 353.524166][ T11] Freed by task 11: [ 353.524262][ T11] kasan_save_stack+0x24/0x50 [ 353.524390][ T11] kasan_save_track+0x14/0x30 [ 353.524513][ T11] kasan_save_free_info+0x3b/0x60 [ 353.524640][ T11] __kasan_slab_free+0x38/0x50 [ 353.524764][ T11] kmem_cache_free+0xf8/0x330 [ 353.524887][ T11] cleanup_net+0x5a8/0xa40 [ 353.525011][ T11] process_one_work+0xe55/0x16d0 [ 353.525133][ T11] worker_thread+0x58c/0xce0 [ 353.525264][ T11] kthread+0x28a/0x350 [ 353.525358][ T11] ret_from_fork+0x31/0x70 [ 353.525483][ T11] ret_from_fork_asm+0x1a/0x30 [ 353.525608][ T11] [ 353.525673][ T11] Last potentially related work creation: [ 353.525798][ T11] kasan_save_stack+0x24/0x50 [ 353.525927][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 353.526052][ T11] insert_work+0x34/0x230 [ 353.526150][ T11] __queue_work+0x5fd/0xa40 [ 353.526276][ T11] call_timer_fn+0x13b/0x230 [ 353.526405][ T11] __run_timers+0x3ff/0x810 [ 353.526529][ T11] run_timer_softirq+0x154/0x1c0 [ 353.526654][ T11] handle_softirqs+0x1f6/0x5c0 [ 353.526780][ T11] __irq_exit_rcu+0xc4/0x100 [ 353.526903][ T11] irq_exit_rcu+0xe/0x20 [ 353.527000][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 353.527127][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 353.527284][ T11] [ 353.527348][ T11] Second to last potentially related work creation: [ 353.527499][ T11] kasan_save_stack+0x24/0x50 [ 353.527628][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 353.527752][ T11] insert_work+0x34/0x230 [ 353.527847][ T11] __queue_work+0x5fd/0xa40 [ 353.527970][ T11] call_timer_fn+0x13b/0x230 [ 353.528098][ T11] __run_timers+0x3ff/0x810 [ 353.528225][ T11] run_timer_softirq+0x154/0x1c0 [ 353.528350][ T11] handle_softirqs+0x1f6/0x5c0 [ 353.528475][ T11] __irq_exit_rcu+0xc4/0x100 [ 353.528601][ T11] irq_exit_rcu+0xe/0x20 [ 353.528697][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 353.528821][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 353.528979][ T11] [ 353.529043][ T11] The buggy address belongs to the object at ffff888005771980 [ 353.529043][ T11] which belongs to the cache net_namespace of size 6080 [ 353.529369][ T11] The buggy address is located 184 bytes inside of [ 353.529369][ T11] freed 6080-byte region [ffff888005771980, ffff888005773140) [ 353.529663][ T11] [ 353.529727][ T11] The buggy address belongs to the physical page: [ 353.529880][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880057732c0 pfn:0x5770 [ 353.530142][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 353.530335][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 353.530495][ T11] page_type: f5(slab) [ 353.530596][ T11] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 353.530823][ T11] raw: ffff8880057732c0 0000000000050002 00000001f5000000 0000000000000000 [ 353.531045][ T11] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 353.531272][ T11] head: ffff8880057732c0 0000000000050002 00000001f5000000 0000000000000000 [ 353.531495][ T11] head: 0080000000000003 ffffea000015dc01 ffffffffffffffff 0000000000000000 [ 353.531719][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 353.531936][ T11] page dumped because: kasan: bad access detected [ 353.532089][ T11] [ 353.532153][ T11] Memory state around the buggy address: [ 353.532277][ T11] ffff888005771900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 353.532461][ T11] ffff888005771980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 353.532641][ T11] >ffff888005771a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 353.532824][ T11] ^ [ 353.532974][ T11] ffff888005771a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 353.533153][ T11] ffff888005771b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 353.533332][ T11] ================================================================== [ 353.533564][ T11] Disabling lock debugging due to kernel taint [ 354.680715][ T3645] br1: port 3(veth2) entered disabled state [ 354.731211][ T3646] veth2: left allmulticast mode [ 354.731532][ T3646] veth2: left promiscuous mode [ 354.731796][ T3646] br1: port 3(veth2) entered disabled state [ 354.876675][ T3648] br1: port 2(veth1) entered disabled state [ 354.930386][ T3649] veth1: left allmulticast mode [ 354.930628][ T3649] veth1: left promiscuous mode [ 354.930907][ T3649] br1: port 2(veth1) entered disabled state [ 354.980591][ T3650] vx1: left allmulticast mode [ 354.980780][ T3650] vx1: left promiscuous mode [ 354.981043][ T3650] br1: port 1(vx1) entered disabled state