[ 974.779462][ T6405] br1: port 1(vx10) entered blocking state [ 974.779981][ T6405] br1: port 1(vx10) entered disabled state [ 974.780469][ T6405] vx10: entered allmulticast mode [ 974.783549][ T6405] vx10: entered promiscuous mode [ 974.784440][ T6405] br1: port 1(vx10) entered blocking state [ 974.784797][ T6405] br1: port 1(vx10) entered forwarding state [ 975.201618][ T6410] br1: port 2(vx20) entered blocking state [ 975.201951][ T6410] br1: port 2(vx20) entered disabled state [ 975.202271][ T6410] vx20: entered allmulticast mode [ 975.205242][ T6410] vx20: entered promiscuous mode [ 975.205883][ T6410] br1: port 2(vx20) entered blocking state [ 975.206152][ T6410] br1: port 2(vx20) entered forwarding state [ 975.401872][ T6412] br1: port 3(veth1) entered blocking state [ 975.402173][ T6412] br1: port 3(veth1) entered disabled state [ 975.402458][ T6412] veth1: entered allmulticast mode [ 975.404706][ T6412] veth1: entered promiscuous mode [ 975.492150][ T37] br1: port 3(veth1) entered blocking state [ 975.492456][ T37] br1: port 3(veth1) entered forwarding state [ 975.788400][ T6416] br1: port 4(veth2) entered blocking state [ 975.788757][ T6416] br1: port 4(veth2) entered disabled state [ 975.789049][ T6416] veth2: entered allmulticast mode [ 975.791277][ T6416] veth2: entered promiscuous mode [ 975.906036][ T37] br1: port 4(veth2) entered blocking state [ 975.906474][ T37] br1: port 4(veth2) entered forwarding state [ 979.983304][ T6473] br2: port 1(w1) entered blocking state [ 979.983601][ T6473] br2: port 1(w1) entered disabled state [ 979.983861][ T6473] w1: entered allmulticast mode [ 979.986970][ T6473] w1: entered promiscuous mode [ 980.748678][ T6481] br2: port 2(vx10) entered blocking state [ 980.748975][ T6481] br2: port 2(vx10) entered disabled state [ 980.749307][ T6481] vx10: entered allmulticast mode [ 980.751910][ T6481] vx10: entered promiscuous mode [ 980.752625][ T6481] br2: port 2(vx10) entered blocking state [ 980.752918][ T6481] br2: port 2(vx10) entered forwarding state [ 981.545737][ T6488] br2: port 3(vx20) entered blocking state [ 981.546105][ T6488] br2: port 3(vx20) entered disabled state [ 981.546424][ T6488] vx20: entered allmulticast mode [ 981.548450][ T6488] vx20: entered promiscuous mode [ 981.549063][ T6488] br2: port 3(vx20) entered blocking state [ 981.549349][ T6488] br2: port 3(vx20) entered forwarding state [ 982.348077][ T304] br2: port 1(w1) entered blocking state [ 982.348412][ T304] br2: port 1(w1) entered forwarding state [ 984.848433][ T6528] br2: port 1(w1) entered blocking state [ 984.848684][ T6528] br2: port 1(w1) entered disabled state [ 984.848922][ T6528] w1: entered allmulticast mode [ 984.850989][ T6528] w1: entered promiscuous mode [ 985.511798][ T6536] br2: port 2(vx10) entered blocking state [ 985.512139][ T6536] br2: port 2(vx10) entered disabled state [ 985.512435][ T6536] vx10: entered allmulticast mode [ 985.515003][ T6536] vx10: entered promiscuous mode [ 985.515751][ T6536] br2: port 2(vx10) entered blocking state [ 985.516020][ T6536] br2: port 2(vx10) entered forwarding state [ 986.174896][ T6543] br2: port 3(vx20) entered blocking state [ 986.175225][ T6543] br2: port 3(vx20) entered disabled state [ 986.175548][ T6543] vx20: entered allmulticast mode [ 986.178299][ T6543] vx20: entered promiscuous mode [ 986.178876][ T6543] br2: port 3(vx20) entered blocking state [ 986.179154][ T6543] br2: port 3(vx20) entered forwarding state [ 986.878344][ T304] br2: port 1(w1) entered blocking state [ 986.878662][ T304] br2: port 1(w1) entered forwarding state [ 1033.139812][ T7276] veth3: entered promiscuous mode [ 1077.502076][ T8203] veth3: left promiscuous mode [ 1077.928582][ T8209] veth3: entered promiscuous mode [ 1123.062084][ T9136] veth3: left promiscuous mode [ 1123.851705][ T9154] vx20: left allmulticast mode [ 1123.851937][ T9154] vx20: left promiscuous mode [ 1123.852260][ T9154] br1: port 2(vx20) entered disabled state [ 1123.933547][ T9155] vx10: left allmulticast mode [ 1123.933814][ T9155] vx10: left promiscuous mode [ 1123.934154][ T9155] br1: port 1(vx10) entered disabled state [ 1129.288840][ T9160] br1: port 1(vx10) entered blocking state [ 1129.289161][ T9160] br1: port 1(vx10) entered disabled state [ 1129.289459][ T9160] vx10: entered allmulticast mode [ 1129.291467][ T9160] vx10: entered promiscuous mode [ 1129.293008][ T9160] br1: port 1(vx10) entered blocking state [ 1129.293275][ T9160] br1: port 1(vx10) entered forwarding state [ 1129.443203][ T9162] br1: port 2(vx20) entered blocking state [ 1129.443810][ T9162] br1: port 2(vx20) entered disabled state [ 1129.444094][ T9162] vx20: entered allmulticast mode [ 1129.446028][ T9162] vx20: entered promiscuous mode [ 1129.446569][ T9162] br1: port 2(vx20) entered blocking state [ 1129.446823][ T9162] br1: port 2(vx20) entered forwarding state [ 1172.593200][ T9840] veth3: entered promiscuous mode [ 1218.156489][T10767] veth3: left promiscuous mode [ 1218.613135][T10773] veth3: entered promiscuous mode [ 1265.091391][T11700] veth3: left promiscuous mode [ 1266.296089][T11723] vx20: left allmulticast mode [ 1266.296381][T11723] vx20: left promiscuous mode [ 1266.296743][T11723] br1: port 2(vx20) entered disabled state [ 1266.375152][T11724] vx10: left allmulticast mode [ 1266.375400][T11724] vx10: left promiscuous mode [ 1266.375749][T11724] br1: port 1(vx10) entered disabled state [ 1271.752092][T11729] br1: port 1(vx10) entered blocking state [ 1271.752422][T11729] br1: port 1(vx10) entered disabled state [ 1271.753072][T11729] vx10: entered allmulticast mode [ 1271.755161][T11729] vx10: entered promiscuous mode [ 1271.755727][T11729] br1: port 1(vx10) entered blocking state [ 1271.756007][T11729] br1: port 1(vx10) entered forwarding state [ 1271.911482][T11731] br1: port 2(vx20) entered blocking state [ 1271.911831][T11731] br1: port 2(vx20) entered disabled state [ 1271.912129][T11731] vx20: entered allmulticast mode [ 1271.914147][T11731] vx20: entered promiscuous mode [ 1271.915235][T11731] br1: port 2(vx20) entered blocking state [ 1271.915509][T11731] br1: port 2(vx20) entered forwarding state [ 1570.990580][T15006] vx20: left allmulticast mode [ 1570.990941][T15006] vx20: left promiscuous mode [ 1570.991285][T15006] br1: port 2(vx20) entered disabled state [ 1571.061885][T15007] vx10: left allmulticast mode [ 1571.062174][T15007] vx10: left promiscuous mode [ 1571.062537][T15007] br1: port 1(vx10) entered disabled state [ 1576.432078][T15012] br1: port 1(vx10) entered blocking state [ 1576.432485][T15012] br1: port 1(vx10) entered disabled state [ 1576.432825][T15012] vx10: entered allmulticast mode [ 1576.435686][T15012] vx10: entered promiscuous mode [ 1576.436240][T15012] br1: port 1(vx10) entered blocking state [ 1576.436541][T15012] br1: port 1(vx10) entered forwarding state [ 1576.585015][T15014] br1: port 2(vx20) entered blocking state [ 1576.585358][T15014] br1: port 2(vx20) entered disabled state [ 1576.585720][T15014] vx20: entered allmulticast mode [ 1576.588071][T15014] vx20: entered promiscuous mode [ 1576.588640][T15014] br1: port 2(vx20) entered blocking state [ 1576.588925][T15014] br1: port 2(vx20) entered forwarding state [ 1673.248707][ T11] vx20: left allmulticast mode [ 1673.249093][ T11] vx20: left promiscuous mode [ 1673.249456][ T11] br2: port 3(vx20) entered disabled state [ 1673.252982][ T11] vx10: left allmulticast mode [ 1673.253255][ T11] vx10: left promiscuous mode [ 1673.253581][ T11] br2: port 2(vx10) entered disabled state [ 1673.257904][ T11] w1: left allmulticast mode [ 1673.258191][ T11] w1: left promiscuous mode [ 1673.258510][ T11] br2: port 1(w1) entered disabled state [ 1673.871153][ T11] vx20: left allmulticast mode [ 1673.871440][ T11] vx20: left promiscuous mode [ 1673.871765][ T11] br2: port 3(vx20) entered disabled state [ 1673.873726][ T11] vx10: left allmulticast mode [ 1673.873907][ T11] vx10: left promiscuous mode [ 1673.874212][ T11] br2: port 2(vx10) entered disabled state [ 1673.876882][ T11] w1: left allmulticast mode [ 1673.877063][ T11] w1: left promiscuous mode [ 1673.877364][ T11] br2: port 1(w1) entered disabled state [ 1674.331184][ T11] ================================================================== [ 1674.331495][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 1674.331798][ T11] Read of size 8 at addr ffff888009439a38 by task kworker/u16:0/11 [ 1674.332069][ T11] [ 1674.332182][ T11] CPU: 0 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 1674.332475][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1674.332719][ T11] Workqueue: netns cleanup_net [ 1674.332931][ T11] Call Trace: [ 1674.333079][ T11] [ 1674.333182][ T11] dump_stack_lvl+0x82/0xd0 [ 1674.333381][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 1674.333633][ T11] ? cleanup_net+0x932/0xa40 [ 1674.333837][ T11] print_report+0xb4/0x270 [ 1674.334032][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 1674.334225][ T11] kasan_report+0xbd/0xf0 [ 1674.334377][ T11] ? cleanup_net+0x932/0xa40 [ 1674.334572][ T11] cleanup_net+0x932/0xa40 [ 1674.334765][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1674.334954][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 1674.335149][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 1674.335350][ T11] ? lock_acquire+0x32/0xc0 [ 1674.335542][ T11] ? process_one_work+0xe0b/0x16d0 [ 1674.335735][ T11] process_one_work+0xe55/0x16d0 [ 1674.335934][ T11] ? __pfx___lock_release+0x10/0x10 [ 1674.336129][ T11] ? __pfx_process_one_work+0x10/0x10 [ 1674.336327][ T11] ? assign_work+0x16c/0x240 [ 1674.336520][ T11] worker_thread+0x58c/0xce0 [ 1674.336727][ T11] ? __pfx_worker_thread+0x10/0x10 [ 1674.336921][ T11] kthread+0x28a/0x350 [ 1674.337075][ T11] ? __pfx_kthread+0x10/0x10 [ 1674.337272][ T11] ret_from_fork+0x31/0x70 [ 1674.337470][ T11] ? __pfx_kthread+0x10/0x10 [ 1674.337666][ T11] ret_from_fork_asm+0x1a/0x30 [ 1674.337876][ T11] [ 1674.338026][ T11] [ 1674.338124][ T11] Allocated by task 6507: [ 1674.338277][ T11] kasan_save_stack+0x24/0x50 [ 1674.338466][ T11] kasan_save_track+0x14/0x30 [ 1674.338663][ T11] __kasan_slab_alloc+0x59/0x70 [ 1674.338861][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 1674.339055][ T11] copy_net_ns+0xc6/0x340 [ 1674.339202][ T11] create_new_namespaces+0x35f/0x920 [ 1674.339401][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 1674.339616][ T11] ksys_unshare+0x2a9/0x660 [ 1674.339819][ T11] __x64_sys_unshare+0x31/0x40 [ 1674.340009][ T11] do_syscall_64+0xc1/0x1d0 [ 1674.340204][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.340443][ T11] [ 1674.340547][ T11] Freed by task 11: [ 1674.340692][ T11] kasan_save_stack+0x24/0x50 [ 1674.340890][ T11] kasan_save_track+0x14/0x30 [ 1674.341088][ T11] kasan_save_free_info+0x3b/0x60 [ 1674.341280][ T11] __kasan_slab_free+0x38/0x50 [ 1674.341473][ T11] kmem_cache_free+0xf8/0x330 [ 1674.341667][ T11] cleanup_net+0x5a8/0xa40 [ 1674.341866][ T11] process_one_work+0xe55/0x16d0 [ 1674.342058][ T11] worker_thread+0x58c/0xce0 [ 1674.342248][ T11] kthread+0x28a/0x350 [ 1674.342395][ T11] ret_from_fork+0x31/0x70 [ 1674.342584][ T11] ret_from_fork_asm+0x1a/0x30 [ 1674.342782][ T11] [ 1674.342882][ T11] Last potentially related work creation: [ 1674.343069][ T11] kasan_save_stack+0x24/0x50 [ 1674.343267][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 1674.343467][ T11] insert_work+0x34/0x230 [ 1674.343614][ T11] __queue_work+0x5fd/0xa40 [ 1674.343806][ T11] call_timer_fn+0x13b/0x230 [ 1674.344012][ T11] __run_timers+0x3ff/0x810 [ 1674.344210][ T11] run_timer_softirq+0x154/0x1c0 [ 1674.344402][ T11] handle_softirqs+0x1f6/0x5c0 [ 1674.344597][ T11] __irq_exit_rcu+0xc4/0x100 [ 1674.344791][ T11] irq_exit_rcu+0xe/0x20 [ 1674.344939][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 1674.345133][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1674.345373][ T11] [ 1674.345481][ T11] Second to last potentially related work creation: [ 1674.345720][ T11] kasan_save_stack+0x24/0x50 [ 1674.345921][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 1674.346118][ T11] insert_work+0x34/0x230 [ 1674.346267][ T11] __queue_work+0x5fd/0xa40 [ 1674.346463][ T11] call_timer_fn+0x13b/0x230 [ 1674.346659][ T11] __run_timers+0x3ff/0x810 [ 1674.346859][ T11] run_timer_softirq+0x154/0x1c0 [ 1674.347057][ T11] handle_softirqs+0x1f6/0x5c0 [ 1674.347252][ T11] __irq_exit_rcu+0xc4/0x100 [ 1674.347448][ T11] irq_exit_rcu+0xe/0x20 [ 1674.347603][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 1674.347805][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1674.348046][ T11] [ 1674.348112][ T11] The buggy address belongs to the object at ffff888009439980 [ 1674.348112][ T11] which belongs to the cache net_namespace of size 6080 [ 1674.348463][ T11] The buggy address is located 184 bytes inside of [ 1674.348463][ T11] freed 6080-byte region [ffff888009439980, ffff88800943b140) [ 1674.348759][ T11] [ 1674.348824][ T11] The buggy address belongs to the physical page: [ 1674.348974][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800943b2c0 pfn:0x9438 [ 1674.349230][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1674.349425][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 1674.349583][ T11] page_type: f5(slab) [ 1674.349681][ T11] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 1674.349921][ T11] raw: ffff88800943b2c0 0000000000050002 00000001f5000000 0000000000000000 [ 1674.350143][ T11] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 1674.350368][ T11] head: ffff88800943b2c0 0000000000050002 00000001f5000000 0000000000000000 [ 1674.350584][ T11] head: 0080000000000003 ffffea0000250e01 ffffffffffffffff 0000000000000000 [ 1674.350804][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 1674.351018][ T11] page dumped because: kasan: bad access detected [ 1674.351169][ T11] [ 1674.351232][ T11] Memory state around the buggy address: [ 1674.351389][ T11] ffff888009439900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1674.351666][ T11] ffff888009439980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1674.351949][ T11] >ffff888009439a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1674.352227][ T11] ^ [ 1674.352433][ T11] ffff888009439a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1674.352671][ T11] ffff888009439b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1674.352850][ T11] ================================================================== [ 1674.353121][ T11] Disabling lock debugging due to kernel taint [ 1675.710599][T16918] br1: port 4(veth2) entered disabled state [ 1675.765980][T16919] veth2: left allmulticast mode [ 1675.766198][T16919] veth2: left promiscuous mode [ 1675.766468][T16919] br1: port 4(veth2) entered disabled state [ 1675.924782][T16922] br1: port 3(veth1) entered disabled state [ 1675.992110][T16924] veth1: left allmulticast mode [ 1675.992329][T16924] veth1: left promiscuous mode [ 1675.992633][T16924] br1: port 3(veth1) entered disabled state [ 1676.096771][T16926] vx20: left allmulticast mode [ 1676.096987][T16926] vx20: left promiscuous mode [ 1676.097256][T16926] br1: port 2(vx20) entered disabled state [ 1676.370554][T16930] vx10: left allmulticast mode [ 1676.370773][T16930] vx10: left promiscuous mode [ 1676.371046][T16930] br1: port 1(vx10) entered disabled state