[ 15.747316][ T299] 8021q: 802.1Q VLAN Support v1.8 [ 19.656928][ T344] br1: port 1(vx10) entered blocking state [ 19.657416][ T344] br1: port 1(vx10) entered disabled state [ 19.657832][ T344] vx10: entered allmulticast mode [ 19.659912][ T344] vx10: entered promiscuous mode [ 19.660920][ T344] br1: port 1(vx10) entered blocking state [ 19.661278][ T344] br1: port 1(vx10) entered forwarding state [ 20.022630][ T349] br1: port 2(vx20) entered blocking state [ 20.022952][ T349] br1: port 2(vx20) entered disabled state [ 20.023328][ T349] vx20: entered allmulticast mode [ 20.025873][ T349] vx20: entered promiscuous mode [ 20.026805][ T349] br1: port 2(vx20) entered blocking state [ 20.027096][ T349] br1: port 2(vx20) entered forwarding state [ 20.219588][ T351] br1: port 3(veth1) entered blocking state [ 20.219891][ T351] br1: port 3(veth1) entered disabled state [ 20.220168][ T351] veth1: entered allmulticast mode [ 20.222263][ T351] veth1: entered promiscuous mode [ 20.295213][ T45] br1: port 3(veth1) entered blocking state [ 20.295737][ T45] br1: port 3(veth1) entered forwarding state [ 20.549441][ T355] br1: port 4(veth2) entered blocking state [ 20.549826][ T355] br1: port 4(veth2) entered disabled state [ 20.550164][ T355] veth2: entered allmulticast mode [ 20.552225][ T355] veth2: entered promiscuous mode [ 20.675830][ T37] br1: port 4(veth2) entered blocking state [ 20.676254][ T37] br1: port 4(veth2) entered forwarding state [ 24.617198][ T405] br2: port 1(w1) entered blocking state [ 24.617550][ T405] br2: port 1(w1) entered disabled state [ 24.617854][ T405] w1: entered allmulticast mode [ 24.619879][ T405] w1: entered promiscuous mode [ 25.320203][ T413] br2: port 2(vx10) entered blocking state [ 25.320918][ T413] br2: port 2(vx10) entered disabled state [ 25.321231][ T413] vx10: entered allmulticast mode [ 25.323178][ T413] vx10: entered promiscuous mode [ 25.323811][ T413] br2: port 2(vx10) entered blocking state [ 25.324147][ T413] br2: port 2(vx10) entered forwarding state [ 26.025110][ T420] br2: port 3(vx20) entered blocking state [ 26.026230][ T420] br2: port 3(vx20) entered disabled state [ 26.026733][ T420] vx20: entered allmulticast mode [ 26.030111][ T420] vx20: entered promiscuous mode [ 26.030955][ T420] br2: port 3(vx20) entered blocking state [ 26.031360][ T420] br2: port 3(vx20) entered forwarding state [ 26.838383][ T40] br2: port 1(w1) entered blocking state [ 26.838818][ T40] br2: port 1(w1) entered forwarding state [ 29.431892][ T461] br2: port 1(w1) entered blocking state [ 29.432279][ T461] br2: port 1(w1) entered disabled state [ 29.432653][ T461] w1: entered allmulticast mode [ 29.436434][ T461] w1: entered promiscuous mode [ 30.148345][ T470] br2: port 2(vx10) entered blocking state [ 30.148671][ T470] br2: port 2(vx10) entered disabled state [ 30.148988][ T470] vx10: entered allmulticast mode [ 30.150960][ T470] vx10: entered promiscuous mode [ 30.159452][ T470] br2: port 2(vx10) entered blocking state [ 30.159815][ T470] br2: port 2(vx10) entered forwarding state [ 30.855873][ T477] br2: port 3(vx20) entered blocking state [ 30.856157][ T477] br2: port 3(vx20) entered disabled state [ 30.856432][ T477] vx20: entered allmulticast mode [ 30.858759][ T477] vx20: entered promiscuous mode [ 30.859782][ T477] br2: port 3(vx20) entered blocking state [ 30.860193][ T477] br2: port 3(vx20) entered forwarding state [ 31.584876][ T460] br2: port 1(w1) entered blocking state [ 31.585140][ T460] br2: port 1(w1) entered forwarding state [ 47.732137][ T592] GACT probability NOT on [ 84.924200][ T1214] veth3: entered promiscuous mode [ 139.662744][ T2141] veth3: left promiscuous mode [ 140.217760][ T2147] veth3: entered promiscuous mode [ 201.080036][ T3074] veth3: left promiscuous mode [ 202.135143][ T3092] vx20: left allmulticast mode [ 202.135414][ T3092] vx20: left promiscuous mode [ 202.135784][ T3092] br1: port 2(vx20) entered disabled state [ 202.238760][ T3093] vx10: left allmulticast mode [ 202.239083][ T3093] vx10: left promiscuous mode [ 202.239444][ T3093] br1: port 1(vx10) entered disabled state [ 207.726280][ T3098] br1: port 1(vx10) entered blocking state [ 207.726744][ T3098] br1: port 1(vx10) entered disabled state [ 207.727195][ T3098] vx10: entered allmulticast mode [ 207.730554][ T3098] vx10: entered promiscuous mode [ 207.731386][ T3098] br1: port 1(vx10) entered blocking state [ 207.731825][ T3098] br1: port 1(vx10) entered forwarding state [ 207.898598][ T3100] br1: port 2(vx20) entered blocking state [ 207.898907][ T3100] br1: port 2(vx20) entered disabled state [ 207.899196][ T3100] vx20: entered allmulticast mode [ 207.902585][ T3100] vx20: entered promiscuous mode [ 207.903207][ T3100] br1: port 2(vx20) entered blocking state [ 207.903537][ T3100] br1: port 2(vx20) entered forwarding state [ 259.054161][ T3778] veth3: entered promiscuous mode [ 297.290343][ T4416] tc (4416) used greatest stack depth: 23544 bytes left [ 315.240652][ T4705] veth3: left promiscuous mode [ 315.823652][ T4711] veth3: entered promiscuous mode [ 371.221427][ T5638] veth3: left promiscuous mode [ 372.719226][ T5661] vx20: left allmulticast mode [ 372.719723][ T5661] vx20: left promiscuous mode [ 372.720093][ T5661] br1: port 2(vx20) entered disabled state [ 372.819929][ T5662] vx10: left allmulticast mode [ 372.820228][ T5662] vx10: left promiscuous mode [ 372.820615][ T5662] br1: port 1(vx10) entered disabled state [ 378.272407][ T5667] br1: port 1(vx10) entered blocking state [ 378.272716][ T5667] br1: port 1(vx10) entered disabled state [ 378.272998][ T5667] vx10: entered allmulticast mode [ 378.275927][ T5667] vx10: entered promiscuous mode [ 378.276452][ T5667] br1: port 1(vx10) entered blocking state [ 378.276716][ T5667] br1: port 1(vx10) entered forwarding state [ 378.485390][ T5669] br1: port 2(vx20) entered blocking state [ 378.485708][ T5669] br1: port 2(vx20) entered disabled state [ 378.486027][ T5669] vx20: entered allmulticast mode [ 378.487978][ T5669] vx20: entered promiscuous mode [ 378.488572][ T5669] br1: port 2(vx20) entered blocking state [ 378.488832][ T5669] br1: port 2(vx20) entered forwarding state [ 707.683456][ T8944] vx20: left allmulticast mode [ 707.683737][ T8944] vx20: left promiscuous mode [ 707.684082][ T8944] br1: port 2(vx20) entered disabled state [ 707.791453][ T8945] vx10: left allmulticast mode [ 707.791835][ T8945] vx10: left promiscuous mode [ 707.792177][ T8945] br1: port 1(vx10) entered disabled state [ 713.241765][ T8950] br1: port 1(vx10) entered blocking state [ 713.242074][ T8950] br1: port 1(vx10) entered disabled state [ 713.242365][ T8950] vx10: entered allmulticast mode [ 713.244617][ T8950] vx10: entered promiscuous mode [ 713.245162][ T8950] br1: port 1(vx10) entered blocking state [ 713.245419][ T8950] br1: port 1(vx10) entered forwarding state [ 713.417800][ T8952] br1: port 2(vx20) entered blocking state [ 713.418098][ T8952] br1: port 2(vx20) entered disabled state [ 713.418396][ T8952] vx20: entered allmulticast mode [ 713.420341][ T8952] vx20: entered promiscuous mode [ 713.420878][ T8952] br1: port 2(vx20) entered blocking state [ 713.421154][ T8952] br1: port 2(vx20) entered forwarding state [ 826.390121][T10825] ip (10825) used greatest stack depth: 23008 bytes left [ 826.475985][ T11] vx20: left allmulticast mode [ 826.476591][ T11] vx20: left promiscuous mode [ 826.477208][ T11] br2: port 3(vx20) entered disabled state [ 826.484933][ T11] vx10: left allmulticast mode [ 826.485293][ T11] vx10: left promiscuous mode [ 826.486511][ T11] br2: port 2(vx10) entered disabled state [ 826.491376][ T11] w1: left allmulticast mode [ 826.491704][ T11] w1: left promiscuous mode [ 826.492158][ T11] br2: port 1(w1) entered disabled state [ 827.029684][ T11] vx20: left allmulticast mode [ 827.030034][ T11] vx20: left promiscuous mode [ 827.030590][ T11] br2: port 3(vx20) entered disabled state [ 827.033969][ T11] vx10: left allmulticast mode [ 827.034321][ T11] vx10: left promiscuous mode [ 827.035534][ T11] br2: port 2(vx10) entered disabled state [ 827.040112][ T11] w1: left allmulticast mode [ 827.040433][ T11] w1: left promiscuous mode [ 827.043026][ T11] br2: port 1(w1) entered disabled state [ 827.500893][ T11] ================================================================== [ 827.501210][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 827.501495][ T11] Read of size 8 at addr ffff88800d5e9a38 by task kworker/u16:0/11 [ 827.501768][ T11] [ 827.501867][ T11] CPU: 2 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 827.502163][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 827.502404][ T11] Workqueue: netns cleanup_net [ 827.502623][ T11] Call Trace: [ 827.502774][ T11] [ 827.502879][ T11] dump_stack_lvl+0x82/0xd0 [ 827.503084][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 827.503332][ T11] ? cleanup_net+0x932/0xa40 [ 827.503531][ T11] print_report+0xb4/0x270 [ 827.503734][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 827.503931][ T11] kasan_report+0xbd/0xf0 [ 827.504077][ T11] ? cleanup_net+0x932/0xa40 [ 827.504276][ T11] cleanup_net+0x932/0xa40 [ 827.504471][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 827.504670][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 827.504866][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 827.505057][ T11] ? lock_acquire+0x32/0xc0 [ 827.505245][ T11] ? process_one_work+0xe0b/0x16d0 [ 827.505432][ T11] process_one_work+0xe55/0x16d0 [ 827.505631][ T11] ? __pfx___lock_release+0x10/0x10 [ 827.505821][ T11] ? __pfx_process_one_work+0x10/0x10 [ 827.506058][ T11] ? assign_work+0x16c/0x240 [ 827.506194][ T11] worker_thread+0x58c/0xce0 [ 827.506328][ T11] ? __pfx_worker_thread+0x10/0x10 [ 827.506463][ T11] kthread+0x28a/0x350 [ 827.506566][ T11] ? __pfx_kthread+0x10/0x10 [ 827.506696][ T11] ret_from_fork+0x31/0x70 [ 827.506824][ T11] ? __pfx_kthread+0x10/0x10 [ 827.506950][ T11] ret_from_fork_asm+0x1a/0x30 [ 827.507084][ T11] [ 827.507181][ T11] [ 827.507247][ T11] Allocated by task 439: [ 827.507348][ T11] kasan_save_stack+0x24/0x50 [ 827.507480][ T11] kasan_save_track+0x14/0x30 [ 827.507602][ T11] __kasan_slab_alloc+0x59/0x70 [ 827.507724][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 827.507857][ T11] copy_net_ns+0xc6/0x340 [ 827.507951][ T11] create_new_namespaces+0x35f/0x920 [ 827.508074][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 827.508195][ T11] ksys_unshare+0x2a9/0x660 [ 827.508320][ T11] __x64_sys_unshare+0x31/0x40 [ 827.508441][ T11] do_syscall_64+0xc1/0x1d0 [ 827.508567][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.508742][ T11] [ 827.508813][ T11] Freed by task 11: [ 827.508905][ T11] kasan_save_stack+0x24/0x50 [ 827.509035][ T11] kasan_save_track+0x14/0x30 [ 827.509157][ T11] kasan_save_free_info+0x3b/0x60 [ 827.509282][ T11] __kasan_slab_free+0x38/0x50 [ 827.509404][ T11] kmem_cache_free+0xf8/0x330 [ 827.509531][ T11] cleanup_net+0x5a8/0xa40 [ 827.509665][ T11] process_one_work+0xe55/0x16d0 [ 827.509808][ T11] worker_thread+0x58c/0xce0 [ 827.509932][ T11] kthread+0x28a/0x350 [ 827.510026][ T11] ret_from_fork+0x31/0x70 [ 827.510151][ T11] ret_from_fork_asm+0x1a/0x30 [ 827.510281][ T11] [ 827.510347][ T11] Last potentially related work creation: [ 827.510473][ T11] kasan_save_stack+0x24/0x50 [ 827.510609][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 827.510737][ T11] insert_work+0x34/0x230 [ 827.510834][ T11] __queue_work+0x5fd/0xa40 [ 827.510958][ T11] call_timer_fn+0x13b/0x230 [ 827.511087][ T11] __run_timers+0x3ff/0x810 [ 827.511213][ T11] run_timer_softirq+0x154/0x1c0 [ 827.511340][ T11] handle_softirqs+0x1f6/0x5c0 [ 827.511467][ T11] __irq_exit_rcu+0xc4/0x100 [ 827.511598][ T11] irq_exit_rcu+0xe/0x20 [ 827.511693][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 827.511822][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 827.511977][ T11] [ 827.512041][ T11] Second to last potentially related work creation: [ 827.512195][ T11] kasan_save_stack+0x24/0x50 [ 827.512321][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 827.512448][ T11] insert_work+0x34/0x230 [ 827.512541][ T11] __queue_work+0x5fd/0xa40 [ 827.512680][ T11] call_timer_fn+0x13b/0x230 [ 827.512811][ T11] __run_timers+0x3ff/0x810 [ 827.512946][ T11] run_timer_softirq+0x154/0x1c0 [ 827.513073][ T11] handle_softirqs+0x1f6/0x5c0 [ 827.513215][ T11] __irq_exit_rcu+0xc4/0x100 [ 827.513346][ T11] irq_exit_rcu+0xe/0x20 [ 827.513463][ T11] sysvec_apic_timer_interrupt+0x78/0x90 [ 827.513610][ T11] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 827.513792][ T11] [ 827.513862][ T11] The buggy address belongs to the object at ffff88800d5e9980 [ 827.513862][ T11] which belongs to the cache net_namespace of size 6080 [ 827.514222][ T11] The buggy address is located 184 bytes inside of [ 827.514222][ T11] freed 6080-byte region [ffff88800d5e9980, ffff88800d5eb140) [ 827.514556][ T11] [ 827.514634][ T11] The buggy address belongs to the physical page: [ 827.514803][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800d5eb2c0 pfn:0xd5e8 [ 827.515081][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 827.515300][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 827.515477][ T11] page_type: f5(slab) [ 827.515588][ T11] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 827.515835][ T11] raw: ffff88800d5eb2c0 0000000000050002 00000001f5000000 0000000000000000 [ 827.516091][ T11] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 827.516341][ T11] head: ffff88800d5eb2c0 0000000000050002 00000001f5000000 0000000000000000 [ 827.516583][ T11] head: 0080000000000003 ffffea0000357a01 ffffffffffffffff 0000000000000000 [ 827.516819][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 827.517063][ T11] page dumped because: kasan: bad access detected [ 827.517234][ T11] [ 827.517308][ T11] Memory state around the buggy address: [ 827.517449][ T11] ffff88800d5e9900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 827.517650][ T11] ffff88800d5e9980: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 827.517841][ T11] >ffff88800d5e9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 827.518038][ T11] ^ [ 827.518206][ T11] ffff88800d5e9a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 827.518400][ T11] ffff88800d5e9b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 827.518598][ T11] ================================================================== [ 827.518881][ T11] Disabling lock debugging due to kernel taint [ 828.955016][T10856] br1: port 4(veth2) entered disabled state [ 829.027105][T10858] veth2: left allmulticast mode [ 829.027347][T10858] veth2: left promiscuous mode [ 829.027663][T10858] br1: port 4(veth2) entered disabled state [ 829.204382][T10861] br1: port 3(veth1) entered disabled state [ 829.259304][T10862] veth1: left allmulticast mode [ 829.259643][T10862] veth1: left promiscuous mode [ 829.260059][T10862] br1: port 3(veth1) entered disabled state [ 829.401966][T10864] vx20: left allmulticast mode [ 829.402248][T10864] vx20: left promiscuous mode [ 829.402974][T10864] br1: port 2(vx20) entered disabled state [ 829.686094][T10868] vx10: left allmulticast mode [ 829.686308][T10868] vx10: left promiscuous mode [ 829.686920][T10868] br1: port 1(vx10) entered disabled state