[ 4411.153887][T19689] eth1: renamed from tmp
[ 4458.732539][T20139] eth1: renamed from tmp
[ 4507.442242][T20590] eth1: renamed from tmp
[ 4556.822129][T21055] eth1: renamed from tmp
[ 4605.122433][T21521] eth1: renamed from tmp
[ 4754.752300][T22751] eth1: renamed from tmp
[ 4777.550825][T23015] eth2: renamed from tmp
[ 4897.199591][T23928] eth1: renamed from tmp
[ 5042.894625][T25624] eth1: renamed from tmp
[ 5115.305260][T26475] eth1: renamed from tmp
[ 5134.832348][T26660] eth1: renamed from tmp
[ 5159.758018][T26902] eth1: renamed from tmp
[ 5177.291592][T27030] eth1: renamed from tmp
[ 5192.954607][T27158] eth1: renamed from tmp
[ 5210.917850][T27293] eth1: renamed from tmp
[ 5228.926558][T27429] eth1: renamed from tmp
[ 5247.113313][T27565] eth1: renamed from tmp
[ 5265.675242][T27700] eth1: renamed from tmp
[ 5284.239561][T27835] eth1: renamed from tmp
[ 5302.582935][T27970] eth1: renamed from tmp
[ 5321.062763][T28104] eth1: renamed from tmp
[ 5339.149781][T28239] eth1: renamed from tmp
[ 5357.095204][T28374] eth1: renamed from tmp
[ 5375.429908][T28509] eth1: renamed from tmp
[ 5393.946655][T28644] eth1: renamed from tmp
[ 5412.228929][T28779] eth1: renamed from tmp
[ 5430.476287][T28914] eth1: renamed from tmp
[ 5449.542046][T29049] eth1: renamed from tmp
[ 5468.498692][T29184] eth1: renamed from tmp
[ 5487.568029][T29319] eth1: renamed from tmp
[ 5506.493137][T29454] eth1: renamed from tmp
[ 5525.137587][T29589] eth1: renamed from tmp
[ 5544.076501][T29724] eth1: renamed from tmp
[ 5562.984514][T29861] eth1: renamed from tmp
[ 5581.900618][T29996] eth1: renamed from tmp
[ 5600.602596][T30130] eth1: renamed from tmp
[ 5619.724531][T30264] eth1: renamed from tmp
[ 5638.579559][T30399] eth1: renamed from tmp
[ 5657.593502][T30535] eth1: renamed from tmp
[ 5676.478347][T30670] eth1: renamed from tmp
[ 5695.283884][T30805] eth1: renamed from tmp
[ 5713.910693][T30940] eth1: renamed from tmp
[ 5732.607562][T31075] eth1: renamed from tmp
[ 5750.568870][T31210] eth1: renamed from tmp
[ 5772.425757][T31373] eth1: renamed from tmp
[ 5794.153347][T31536] eth1: renamed from tmp
[ 5815.648964][T31699] eth1: renamed from tmp
[ 5837.491665][T31862] eth1: renamed from tmp
[ 5848.107161][ C2] ==================================================================
[ 5848.107586][ C2] BUG: KASAN: slab-use-after-free in __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.107952][ C2] Read of size 4 at addr ffff88800bd71848 by task nettest/31938
[ 5848.108254][ C2]
[ 5848.108362][ C2] CPU: 2 UID: 0 PID: 31938 Comm: nettest Not tainted 6.17.0-rc6-virtme #1 PREEMPT(full)
[ 5848.108367][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 5848.108369][ C2] Call Trace:
[ 5848.108371][ C2]
[ 5848.108373][ C2] dump_stack_lvl+0x82/0xc0
[ 5848.108380][ C2] print_address_description.constprop.0+0x2c/0x3a0
[ 5848.108389][ C2] ? __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.108394][ C2] print_report+0xb4/0x270
[ 5848.108397][ C2] ? __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.108400][ C2] ? kasan_addr_to_slab+0x21/0x70
[ 5848.108404][ C2] ? __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.108407][ C2] kasan_report+0xca/0x100
[ 5848.108411][ C2] ? __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.108416][ C2] kasan_check_range+0x39/0x1b0
[ 5848.108420][ C2] __udp_enqueue_schedule_skb+0x179/0xe60
[ 5848.108424][ C2] ? sk_filter_trim_cap+0x2c0/0xa40
[ 5848.108430][ C2] ? reuseport_select_sock+0x199/0x380
[ 5848.108435][ C2] ? fib_lookup.constprop.0+0x370/0x370
[ 5848.108438][ C2] ? udp_sendmsg+0x21f0/0x21f0
[ 5848.108441][ C2] ? udp6_lib_lookup2+0x151/0x4d0
[ 5848.108447][ C2] ? txopt_get+0x2e0/0x2e0
[ 5848.108450][ C2] ? __xfrm_policy_check2.constprop.0+0x3d/0x680
[ 5848.108455][ C2] udpv6_queue_rcv_one_skb+0xa35/0x14f0
[ 5848.108458][ C2] ? __udp6_lib_lookup+0x64e/0xa40
[ 5848.108462][ C2] ? __xfrm_policy_check2.constprop.0+0x680/0x680
[ 5848.108468][ C2] udp6_unicast_rcv_skb+0x10b/0x2c0
[ 5848.108472][ C2] __udp6_lib_rcv+0xa85/0x1650
[ 5848.108478][ C2] ? udpv6_err+0xe0/0xe0
[ 5848.108483][ C2] ip6_protocol_deliver_rcu+0x113/0x1340
[ 5848.108492][ C2] ? rcu_is_watching+0x12/0xb0
[ 5848.108501][ C2] ip6_input_finish+0x175/0x410
[ 5848.108505][ C2] ip6_input+0x111/0x4f0
[ 5848.108508][ C2] ? ip6_input_finish+0x410/0x410
[ 5848.108513][ C2] ? ip6_rcv_core+0x9e8/0x1930
[ 5848.108518][ C2] ipv6_rcv+0x3e1/0x5d0
[ 5848.108521][ C2] ? __xfrm_policy_check2.constprop.0+0x540/0x540
[ 5848.108525][ C2] ? rcu_read_lock_any_held+0x3f/0xa0
[ 5848.108528][ C2] ? validate_chain+0x15e/0x4d0
[ 5848.108536][ C2] ? __lock_acquire+0x449/0x7e0
[ 5848.108540][ C2] ? __xfrm_policy_check2.constprop.0+0x540/0x540
[ 5848.108543][ C2] ? process_backlog+0x381/0x13e0
[ 5848.108548][ C2] __netif_receive_skb_one_core+0x108/0x180
[ 5848.108552][ C2] ? __netif_receive_skb_list_core+0x980/0x980
[ 5848.108557][ C2] ? rcu_is_watching+0x12/0xb0
[ 5848.108560][ C2] ? lock_acquire+0x104/0x160
[ 5848.108563][ C2] ? process_backlog+0x381/0x13e0
[ 5848.108567][ C2] process_backlog+0x3c1/0x13e0
[ 5848.108573][ C2] __napi_poll.constprop.0+0x9f/0x460
[ 5848.108577][ C2] net_rx_action+0x54f/0xda0
[ 5848.108584][ C2] ? __napi_poll.constprop.0+0x460/0x460
[ 5848.108587][ C2] ? sched_ttwu_pending+0x290/0x530
[ 5848.108593][ C2] ? __lock_release+0x5d/0x170
[ 5848.108597][ C2] ? do_raw_spin_unlock+0x58/0x220
[ 5848.108601][ C2] ? _raw_spin_unlock+0x2d/0x50
[ 5848.108609][ C2] ? rcu_is_watching+0x12/0xb0
[ 5848.108612][ C2] ? ttwu_do_activate+0x8c0/0x8c0
[ 5848.108615][ C2] ? lockdep_hardirqs_on+0x7c/0x110
[ 5848.108621][ C2] handle_softirqs+0x215/0x610
[ 5848.108627][ C2] ? __dev_queue_xmit+0x97e/0x18e0
[ 5848.108631][ C2] do_softirq+0xad/0xe0
[ 5848.108634][ C2]
[ 5848.108635][ C2]
[ 5848.108636][ C2] __local_bh_enable_ip+0x101/0x120
[ 5848.108639][ C2] ? __dev_queue_xmit+0x97e/0x18e0
[ 5848.108642][ C2] __dev_queue_xmit+0x993/0x18e0
[ 5848.108646][ C2] ? __lock_acquire+0x449/0x7e0
[ 5848.108651][ C2] ? netdev_core_pick_tx+0x2f0/0x2f0
[ 5848.108654][ C2] ? ip6_finish_output+0x5b8/0xc70
[ 5848.108659][ C2] ? neigh_hh_output+0x33a/0x520
[ 5848.108662][ C2] ? lockdep_hardirqs_on+0x7c/0x110
[ 5848.108665][ C2] ? neigh_hh_output+0x33a/0x520
[ 5848.108672][ C2] ip6_finish_output+0x5b8/0xc70
[ 5848.108676][ C2] ip6_output+0x242/0x810
[ 5848.108680][ C2] ? ip6_finish_output+0xc70/0xc70
[ 5848.108687][ C2] ip6_send_skb+0xef/0x350
[ 5848.108691][ C2] udp_v6_send_skb+0x85a/0x1dc0
[ 5848.108694][ C2] ? jhash.constprop.0+0x101/0x150
[ 5848.108700][ C2] udpv6_sendmsg+0x1b04/0x24a0
[ 5848.108702][ C2] ? find_held_lock+0x2b/0x80
[ 5848.108705][ C2] ? ip_select_ident_segs+0x400/0x400
[ 5848.108715][ C2] ? udpv6_splice_eof+0x170/0x170
[ 5848.108720][ C2] ? rcu_read_lock_any_held+0x3f/0xa0
[ 5848.108723][ C2] ? validate_chain+0x15e/0x4d0
[ 5848.108732][ C2] ? __might_fault+0x117/0x170
[ 5848.108737][ C2] ? __lock_release+0x5d/0x170
[ 5848.108742][ C2] ? __sys_sendto+0x24b/0x380
[ 5848.108747][ C2] __sys_sendto+0x24b/0x380
[ 5848.108750][ C2] ? __ia32_sys_getpeername+0xb0/0xb0
[ 5848.108758][ C2] ? __sys_recvmsg_sock+0x20/0x20
[ 5848.108766][ C2] __x64_sys_sendto+0xe0/0x1b0
[ 5848.108769][ C2] ? do_syscall_64+0x85/0x300
[ 5848.108772][ C2] ? lockdep_hardirqs_on+0x7c/0x110
[ 5848.108775][ C2] do_syscall_64+0xc1/0x300
[ 5848.108778][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 5848.108782][ C2] RIP: 0033:0x7f4b1c57f28a
[ 5848.108786][ C2] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[ 5848.108788][ C2] RSP: 002b:00007ffd311bff28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 5848.108792][ C2] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007f4b1c57f28a
[ 5848.108794][ C2] RDX: 000000000000000c RSI: 0000000000406752 RDI: 0000000000000005
[ 5848.108796][ C2] RBP: 0000000000000005 R08: 00007ffd311c04b0 R09: 000000000000001c
[ 5848.108798][ C2] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd311c04b0
[ 5848.108799][ C2] R13: 000000000000001c R14: 0000000000000002 R15: 0000000000000002
[ 5848.108805][ C2]
[ 5848.108806][ C2]
[ 5848.132579][ C2] Allocated by task 31903:
[ 5848.132785][ C2] kasan_save_stack+0x24/0x40
[ 5848.132994][ C2] kasan_save_track+0x14/0x30
[ 5848.133197][ C2] __kasan_kmalloc+0x7b/0x90
[ 5848.133450][ C2] __kmalloc_noprof+0x1d4/0x460
[ 5848.133728][ C2] udpv6_init_sock+0x237/0x410
[ 5848.134000][ C2] inet6_create.part.0+0x989/0x10b0
[ 5848.134268][ C2] __sock_create+0x235/0x690
[ 5848.134478][ C2] __sys_socket+0x116/0x1d0
[ 5848.134681][ C2] __x64_sys_socket+0x72/0xb0
[ 5848.134885][ C2] do_syscall_64+0xc1/0x300
[ 5848.135088][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 5848.135342][ C2]
[ 5848.135444][ C2] Freed by task 31903:
[ 5848.135601][ C2] kasan_save_stack+0x24/0x40
[ 5848.135809][ C2] kasan_save_track+0x14/0x30
[ 5848.136012][ C2] kasan_save_free_info+0x3b/0x60
[ 5848.136216][ C2] __kasan_slab_free+0x3b/0x50
[ 5848.136420][ C2] kfree+0x144/0x320
[ 5848.136574][ C2] sk_common_release+0x60/0x300
[ 5848.136778][ C2] inet_release+0x100/0x220
[ 5848.136984][ C2] __sock_release+0xa0/0x250
[ 5848.137188][ C2] sock_close+0x18/0x20
[ 5848.137344][ C2] __fput+0x35c/0xa70
[ 5848.137503][ C2] fput_close_sync+0xdd/0x1b0
[ 5848.137708][ C2] __x64_sys_close+0x7d/0xd0
[ 5848.137913][ C2] do_syscall_64+0xc1/0x300
[ 5848.138115][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 5848.138369][ C2]
[ 5848.138472][ C2] The buggy address belongs to the object at ffff88800bd71840
[ 5848.138472][ C2] which belongs to the cache kmalloc-64 of size 64
[ 5848.139111][ C2] The buggy address is located 8 bytes inside of
[ 5848.139111][ C2] freed 64-byte region [ffff88800bd71840, ffff88800bd71880)
[ 5848.139662][ C2]
[ 5848.139777][ C2] The buggy address belongs to the physical page:
[ 5848.140028][ C2] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800bd71640 pfn:0xbd71
[ 5848.140504][ C2] flags: 0x80000000000200(workingset|node=0|zone=1)
[ 5848.140847][ C2] page_type: f5(slab)
[ 5848.141055][ C2] raw: 0080000000000200 ffff888001042ac0 ffffea000053aad0 ffffea0000278450
[ 5848.141534][ C2] raw: ffff88800bd71640 000000000010000d 00000000f5000000 0000000000000000
[ 5848.141913][ C2] page dumped because: kasan: bad access detected
[ 5848.142168][ C2]
[ 5848.142269][ C2] Memory state around the buggy address:
[ 5848.142468][ C2] ffff88800bd71700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 fc
[ 5848.142820][ C2] ffff88800bd71780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 5848.143212][ C2] >ffff88800bd71800: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 5848.143714][ C2] ^
[ 5848.143959][ C2] ffff88800bd71880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 5848.144358][ C2] ffff88800bd71900: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 fc fc
[ 5848.144874][ C2] ==================================================================
[ 5848.145239][ C2] Disabling lock debugging due to kernel taint
[ 5855.452898][T32025] eth1: renamed from tmp
[ 5870.803534][T32188] eth1: renamed from tmp
[ 5886.354785][T32350] eth1: renamed from tmp
[ 5902.315746][T32512] eth1: renamed from tmp
[ 5918.011389][T32676] eth1: renamed from tmp
[ 5933.790497][ T371] eth1: renamed from tmp
[ 5949.712061][ T540] eth1: renamed from tmp
[ 5965.504836][ T704] eth1: renamed from tmp
[ 5980.984519][ T867] eth1: renamed from tmp
[ 5996.823644][ T1030] eth1: renamed from tmp
[ 6012.777124][ T1193] eth1: renamed from tmp