[ 298.272514][ T2283] br1: port 1(vx10) entered blocking state [ 298.272836][ T2283] br1: port 1(vx10) entered disabled state [ 298.273139][ T2283] vx10: entered allmulticast mode [ 298.275546][ T2283] vx10: entered promiscuous mode [ 298.276349][ T2283] br1: port 1(vx10) entered blocking state [ 298.276618][ T2283] br1: port 1(vx10) entered forwarding state [ 298.646975][ T2288] br1: port 2(vx20) entered blocking state [ 298.647395][ T2288] br1: port 2(vx20) entered disabled state [ 298.647699][ T2288] vx20: entered allmulticast mode [ 298.649991][ T2288] vx20: entered promiscuous mode [ 298.651319][ T2288] br1: port 2(vx20) entered blocking state [ 298.651645][ T2288] br1: port 2(vx20) entered forwarding state [ 298.864906][ T2290] br1: port 3(veth1) entered blocking state [ 298.865360][ T2290] br1: port 3(veth1) entered disabled state [ 298.865791][ T2290] veth1: entered allmulticast mode [ 298.869608][ T2290] veth1: entered promiscuous mode [ 298.966862][ T39] br1: port 3(veth1) entered blocking state [ 298.967194][ T39] br1: port 3(veth1) entered forwarding state [ 299.051052][ T2292] br1: port 4(veth2) entered blocking state [ 299.051383][ T2292] br1: port 4(veth2) entered disabled state [ 299.051677][ T2292] veth2: entered allmulticast mode [ 299.053639][ T2292] veth2: entered promiscuous mode [ 299.137838][ T40] br1: port 4(veth2) entered blocking state [ 299.138199][ T40] br1: port 4(veth2) entered forwarding state [ 299.423579][ T2297] br1: port 5(vx4001) entered blocking state [ 299.423924][ T2297] br1: port 5(vx4001) entered disabled state [ 299.424251][ T2297] vx4001: entered allmulticast mode [ 299.427146][ T2297] vx4001: entered promiscuous mode [ 299.427948][ T2297] br1: port 5(vx4001) entered blocking state [ 299.428275][ T2297] br1: port 5(vx4001) entered forwarding state [ 300.286523][ T2308] br1: entered promiscuous mode [ 300.288834][ T2308] br1: left promiscuous mode [ 300.306949][ T2308] br1: entered promiscuous mode [ 306.487302][ T2391] br1: port 1(vx10) entered blocking state [ 306.487618][ T2391] br1: port 1(vx10) entered disabled state [ 306.487930][ T2391] vx10: entered allmulticast mode [ 306.490494][ T2391] vx10: entered promiscuous mode [ 306.491342][ T2391] br1: port 1(vx10) entered blocking state [ 306.491617][ T2391] br1: port 1(vx10) entered forwarding state [ 306.874802][ T2395] br1: port 2(vx20) entered blocking state [ 306.875126][ T2395] br1: port 2(vx20) entered disabled state [ 306.875417][ T2395] vx20: entered allmulticast mode [ 306.878035][ T2395] vx20: entered promiscuous mode [ 306.878624][ T2395] br1: port 2(vx20) entered blocking state [ 306.878898][ T2395] br1: port 2(vx20) entered forwarding state [ 307.245526][ T2399] br1: port 3(vx4001) entered blocking state [ 307.245829][ T2399] br1: port 3(vx4001) entered disabled state [ 307.246115][ T2399] vx4001: entered allmulticast mode [ 307.248047][ T2399] vx4001: entered promiscuous mode [ 307.249033][ T2399] br1: port 3(vx4001) entered blocking state [ 307.249303][ T2399] br1: port 3(vx4001) entered forwarding state [ 307.423597][ T2401] br1: port 4(w1) entered blocking state [ 307.423883][ T2401] br1: port 4(w1) entered disabled state [ 307.424250][ T2401] w1: entered allmulticast mode [ 307.426685][ T2401] w1: entered promiscuous mode [ 307.517655][ T69] br1: port 4(w1) entered blocking state [ 307.517942][ T69] br1: port 4(w1) entered forwarding state [ 307.692455][ T2404] br1: port 5(w3) entered blocking state [ 307.692715][ T2404] br1: port 5(w3) entered disabled state [ 307.692971][ T2404] w3: entered allmulticast mode [ 307.695036][ T2404] w3: entered promiscuous mode [ 307.778944][ T40] br1: port 5(w3) entered blocking state [ 307.779689][ T40] br1: port 5(w3) entered forwarding state [ 308.675209][ T2414] br1: entered promiscuous mode [ 308.677608][ T2414] br1: left promiscuous mode [ 308.692005][ T2414] br1: entered promiscuous mode [ 309.578941][ C1] net_ratelimit: 3 callbacks suppressed [ 309.578955][ C1] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20) [ 309.754782][ C1] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20) [ 309.758143][ C1] IPv6: vlan20-v: IPv6 duplicate address fe80::200:5eff:fe00:101 used by 00:00:5e:00:01:01 detected! [ 309.759191][ C1] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10) [ 309.759848][ C3] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10) [ 309.761770][ C3] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10) [ 309.762530][ C3] IPv6: vlan10-v: IPv6 duplicate address 2001:db8:1::3 used by 00:00:5e:00:01:01 detected! [ 310.267329][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10) [ 310.268650][ C0] br1: received packet on vx10 with own address as source address (addr:00:00:5e:00:01:01, vlan:10) [ 310.631858][ C0] br1: received packet on vx20 with own address as source address (addr:00:00:5e:00:01:01, vlan:20) [ 328.257126][ T67] w3: left allmulticast mode [ 328.257483][ T67] w3: left promiscuous mode [ 328.258007][ T67] br1: port 5(w3) entered disabled state [ 328.261406][ T67] w1: left allmulticast mode [ 328.261606][ T67] w1: left promiscuous mode [ 328.261930][ T67] br1: port 4(w1) entered disabled state [ 328.263511][ T67] vx4001: left allmulticast mode [ 328.263734][ T67] vx4001: left promiscuous mode [ 328.264042][ T67] br1: port 3(vx4001) entered disabled state [ 328.265671][ T67] vx20: left allmulticast mode [ 328.265933][ T67] vx20: left promiscuous mode [ 328.266649][ T67] br1: port 2(vx20) entered disabled state [ 328.269052][ T67] vx10: left allmulticast mode [ 328.269862][ T67] vx10: left promiscuous mode [ 328.270182][ T67] br1: port 1(vx10) entered disabled state [ 329.088024][ T67] ================================================================== [ 329.088275][ T67] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 329.088496][ T67] Read of size 8 at addr ffff8880092500f8 by task kworker/u16:1/67 [ 329.088729][ T67] [ 329.088804][ T67] CPU: 0 UID: 0 PID: 67 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 329.089025][ T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 329.089199][ T67] Workqueue: netns cleanup_net [ 329.089374][ T67] Call Trace: [ 329.089485][ T67] [ 329.089560][ T67] dump_stack_lvl+0x82/0xd0 [ 329.089715][ T67] print_address_description.constprop.0+0x2c/0x3b0 [ 329.089887][ T67] ? cleanup_net+0x932/0xa40 [ 329.090036][ T67] print_report+0xb4/0x270 [ 329.090194][ T67] ? kasan_addr_to_slab+0x25/0x80 [ 329.090333][ T67] kasan_report+0xbd/0xf0 [ 329.090444][ T67] ? cleanup_net+0x932/0xa40 [ 329.090587][ T67] cleanup_net+0x932/0xa40 [ 329.090725][ T67] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 329.090885][ T67] ? __pfx_cleanup_net+0x10/0x10 [ 329.091021][ T67] ? trace_lock_acquire+0x148/0x1f0 [ 329.091161][ T67] ? lock_acquire+0x32/0xc0 [ 329.091304][ T67] ? process_one_work+0xe0b/0x16d0 [ 329.091446][ T67] process_one_work+0xe55/0x16d0 [ 329.091588][ T67] ? __pfx___lock_release+0x10/0x10 [ 329.091726][ T67] ? __pfx_process_one_work+0x10/0x10 [ 329.091868][ T67] ? assign_work+0x16c/0x240 [ 329.092014][ T67] worker_thread+0x58c/0xce0 [ 329.092156][ T67] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 329.092332][ T67] ? __pfx_worker_thread+0x10/0x10 [ 329.092467][ T67] ? __pfx_worker_thread+0x10/0x10 [ 329.092610][ T67] kthread+0x28a/0x350 [ 329.092717][ T67] ? __pfx_kthread+0x10/0x10 [ 329.092850][ T67] ret_from_fork+0x31/0x70 [ 329.092986][ T67] ? __pfx_kthread+0x10/0x10 [ 329.093116][ T67] ret_from_fork_asm+0x1a/0x30 [ 329.093261][ T67] [ 329.093373][ T67] [ 329.093433][ T67] Allocated by task 1841: [ 329.093538][ T67] kasan_save_stack+0x24/0x50 [ 329.093688][ T67] kasan_save_track+0x14/0x30 [ 329.093826][ T67] __kasan_slab_alloc+0x59/0x70 [ 329.093962][ T67] kmem_cache_alloc_noprof+0x10b/0x350 [ 329.094104][ T67] copy_net_ns+0xc6/0x340 [ 329.094209][ T67] create_new_namespaces+0x35f/0x920 [ 329.094353][ T67] unshare_nsproxy_namespaces+0x8d/0x130 [ 329.094488][ T67] ksys_unshare+0x2a9/0x660 [ 329.094639][ T67] __x64_sys_unshare+0x31/0x40 [ 329.094808][ T67] do_syscall_64+0xc1/0x1d0 [ 329.094948][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.095141][ T67] [ 329.095228][ T67] Freed by task 67: [ 329.095352][ T67] kasan_save_stack+0x24/0x50 [ 329.095544][ T67] kasan_save_track+0x14/0x30 [ 329.095722][ T67] kasan_save_free_info+0x3b/0x60 [ 329.095899][ T67] __kasan_slab_free+0x38/0x50 [ 329.096077][ T67] kmem_cache_free+0xf8/0x330 [ 329.096262][ T67] cleanup_net+0x5a8/0xa40 [ 329.096433][ T67] process_one_work+0xe55/0x16d0 [ 329.096583][ T67] worker_thread+0x58c/0xce0 [ 329.096726][ T67] kthread+0x28a/0x350 [ 329.096836][ T67] ret_from_fork+0x31/0x70 [ 329.096975][ T67] ret_from_fork_asm+0x1a/0x30 [ 329.097110][ T67] [ 329.097184][ T67] Last potentially related work creation: [ 329.097326][ T67] kasan_save_stack+0x24/0x50 [ 329.097496][ T67] __kasan_record_aux_stack+0x8e/0xa0 [ 329.097652][ T67] insert_work+0x34/0x230 [ 329.097758][ T67] __queue_work+0x5fd/0xa40 [ 329.097904][ T67] queue_delayed_work_on+0x8c/0xa0 [ 329.098045][ T67] __inet_insert_ifa+0x751/0xb10 [ 329.098183][ T67] inetdev_event+0xb18/0xcf0 [ 329.098319][ T67] notifier_call_chain+0xcd/0x150 [ 329.098460][ T67] __dev_notify_flags+0xe6/0x250 [ 329.098605][ T67] dev_change_flags+0xec/0x160 [ 329.098741][ T67] do_setlink.constprop.0+0x79d/0x2300 [ 329.098880][ T67] rtnl_newlink+0x6de/0xa80 [ 329.099026][ T67] rtnetlink_rcv_msg+0x712/0xc10 [ 329.099165][ T67] netlink_rcv_skb+0x130/0x360 [ 329.099323][ T67] netlink_unicast+0x44b/0x710 [ 329.099460][ T67] netlink_sendmsg+0x723/0xbe0 [ 329.099606][ T67] ____sys_sendmsg+0x7ac/0xa10 [ 329.099745][ T67] ___sys_sendmsg+0xee/0x170 [ 329.099882][ T67] __sys_sendmsg+0x109/0x1a0 [ 329.100020][ T67] do_syscall_64+0xc1/0x1d0 [ 329.100166][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.100343][ T67] [ 329.100417][ T67] The buggy address belongs to the object at ffff888009250040 [ 329.100417][ T67] which belongs to the cache net_namespace of size 6080 [ 329.100796][ T67] The buggy address is located 184 bytes inside of [ 329.100796][ T67] freed 6080-byte region [ffff888009250040, ffff888009251800) [ 329.101139][ T67] [ 329.101211][ T67] The buggy address belongs to the physical page: [ 329.101380][ T67] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880092532c0 pfn:0x9250 [ 329.101667][ T67] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 329.101897][ T67] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 329.102081][ T67] page_type: f5(slab) [ 329.102192][ T67] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 329.102445][ T67] raw: ffff8880092532c0 0000000000050002 00000001f5000000 0000000000000000 [ 329.102699][ T67] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 329.103014][ T67] head: ffff8880092532c0 0000000000050002 00000001f5000000 0000000000000000 [ 329.103263][ T67] head: 0080000000000003 ffffea0000249401 ffffffffffffffff 0000000000000000 [ 329.103505][ T67] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 329.103821][ T67] page dumped because: kasan: bad access detected [ 329.103992][ T67] [ 329.104061][ T67] Memory state around the buggy address: [ 329.104197][ T67] ffff88800924ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 329.104403][ T67] ffff888009250000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 329.104605][ T67] >ffff888009250080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 329.104877][ T67] ^ [ 329.105073][ T67] ffff888009250100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 329.105279][ T67] ffff888009250180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 329.105612][ T67] ================================================================== [ 329.105842][ T67] Disabling lock debugging due to kernel taint [ 330.282728][ T2611] br1: left promiscuous mode [ 330.793937][ T2617] br1: port 4(veth2) entered disabled state [ 330.847497][ T2618] veth2: left allmulticast mode [ 330.847687][ T2618] veth2: left promiscuous mode [ 330.847942][ T2618] br1: port 4(veth2) entered disabled state [ 330.982402][ T2620] br1: port 3(veth1) entered disabled state [ 331.051676][ T2621] veth1: left allmulticast mode [ 331.051894][ T2621] veth1: left promiscuous mode [ 331.052244][ T2621] br1: port 3(veth1) entered disabled state [ 331.197544][ T2623] vx4001: left allmulticast mode [ 331.197757][ T2623] vx4001: left promiscuous mode [ 331.198064][ T2623] br1: port 5(vx4001) entered disabled state [ 331.449646][ T2627] vx20: left allmulticast mode [ 331.449919][ T2627] vx20: left promiscuous mode [ 331.450593][ T2627] br1: port 2(vx20) entered disabled state [ 331.739748][ T2631] vx10: left allmulticast mode [ 331.739977][ T2631] vx10: left promiscuous mode [ 331.740266][ T2631] br1: port 1(vx10) entered disabled state