[ 15.247505][ T256] xdummy0: entered promiscuous mode
[ 15.258475][ T256] xdummy0: left promiscuous mode
[ 15.279469][ T256] ==================================================================
[ 15.279780][ T256] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 15.280060][ T256] Read of size 1 at addr ffff8880058826c4 by task tap/256
[ 15.280298][ T256]
[ 15.280397][ T256] CPU: 2 UID: 0 PID: 256 Comm: tap Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 15.280402][ T256] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 15.280405][ T256] Call Trace:
[ 15.280407][ T256]
[ 15.280409][ T256] dump_stack_lvl+0x82/0xc0
[ 15.280416][ T256] print_address_description.constprop.0+0x2c/0x3a0
[ 15.280424][ T256] ? kobject_put+0xbb/0xd0
[ 15.280428][ T256] print_report+0xb4/0x270
[ 15.280431][ T256] ? kobject_put+0xbb/0xd0
[ 15.280435][ T256] ? kasan_addr_to_slab+0x21/0x70
[ 15.280439][ T256] ? kobject_put+0xbb/0xd0
[ 15.280442][ T256] kasan_report+0xca/0x100
[ 15.280446][ T256] ? kobject_put+0xbb/0xd0
[ 15.280451][ T256] kobject_put+0xbb/0xd0
[ 15.280455][ T256] netdev_run_todo+0x5f0/0xc60
[ 15.280462][ T256] ? dev_ingress_queue_create+0x190/0x190
[ 15.280466][ T256] ? generic_xdp_install+0x410/0x410
[ 15.280471][ T256] ? __netdev_upper_dev_unlink+0x220/0x220
[ 15.280475][ T256] rtnl_dellink+0x350/0xa30
[ 15.280481][ T256] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 15.280501][ T256] ? find_held_lock+0x2b/0x80
[ 15.280510][ T256] ? __lock_acquire+0x449/0x7e0
[ 15.280516][ T256] ? find_held_lock+0x2b/0x80
[ 15.280520][ T256] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 15.280523][ T256] ? __lock_release+0x5d/0x170
[ 15.280526][ T256] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 15.280530][ T256] rtnetlink_rcv_msg+0x709/0xc00
[ 15.280535][ T256] ? rtnl_port_fill+0x890/0x890
[ 15.280538][ T256] ? __lock_acquire+0x449/0x7e0
[ 15.280544][ T256] netlink_rcv_skb+0x121/0x340
[ 15.280549][ T256] ? rtnl_port_fill+0x890/0x890
[ 15.280553][ T256] ? netlink_ack+0xdf0/0xdf0
[ 15.280559][ T256] ? netlink_deliver_tap+0x13e/0x340
[ 15.280562][ T256] ? netlink_deliver_tap+0xc3/0x340
[ 15.280565][ T256] netlink_unicast+0x4aa/0x780
[ 15.280570][ T256] ? netlink_attachskb+0x810/0x810
[ 15.280572][ T256] ? netlink_insert+0xee/0x2a0
[ 15.280576][ T256] ? netlink_autobind.isra.0+0xa5/0x270
[ 15.280579][ T256] ? netlink_autobind.isra.0+0x18a/0x270
[ 15.280583][ T256] netlink_sendmsg+0x714/0xbd0
[ 15.280587][ T256] ? netlink_unicast+0x780/0x780
[ 15.280589][ T256] ? lockdep_hardirqs_on+0x7c/0x110
[ 15.280596][ T256] ? lockdep_init_map_type+0x4b/0x270
[ 15.280601][ T256] __sys_sendto+0x24b/0x380
[ 15.280606][ T256] ? __ia32_sys_getpeername+0xb0/0xb0
[ 15.280611][ T256] ? fd_install+0x18e/0x4e0
[ 15.280616][ T256] ? __lock_release+0x5d/0x170
[ 15.280619][ T256] ? fd_install+0x18e/0x4e0
[ 15.280623][ T256] ? fd_install+0x19d/0x4e0
[ 15.280627][ T256] ? __sys_socket+0x162/0x1d0
[ 15.280630][ T256] ? update_socket_protocol+0x10/0x10
[ 15.280632][ T256] ? xfd_validate_state+0x2c/0x140
[ 15.280640][ T256] __x64_sys_sendto+0xe0/0x1b0
[ 15.280642][ T256] ? do_syscall_64+0x85/0xfd0
[ 15.280647][ T256] ? lockdep_hardirqs_on+0x7c/0x110
[ 15.280650][ T256] do_syscall_64+0xc1/0xfd0
[ 15.280654][ T256] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 15.280658][ T256] RIP: 0033:0x7fd7dd70d120
[ 15.280663][ T256] Code: ff ff 64 89 02 eb bd 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 1d 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 68 c3 0f 1f 80 00 00 00 00 41 54 48 83 ec 20
[ 15.280666][ T256] RSP: 002b:00007ffef8c51f28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 15.280670][ T256] RAX: ffffffffffffffda RBX: 0000000000000030 RCX: 00007fd7dd70d120
[ 15.280673][ T256] RDX: 0000000000000030 RSI: 00007ffef8c51f30 RDI: 0000000000000005
[ 15.280674][ T256] RBP: 00000000004047d0 R08: 0000000000000000 R09: 0000000000000000
[ 15.280676][ T256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[ 15.280678][ T256] R13: 00007ffef8c51f30 R14: 00007fd7dd5f9000 R15: 0000000000407160
[ 15.280685][ T256]
[ 15.280686][ T256]
[ 15.293870][ T256] Allocated by task 256:
[ 15.294009][ T256] kasan_save_stack+0x24/0x40
[ 15.294213][ T256] kasan_save_track+0x14/0x30
[ 15.294506][ T256] __kasan_kmalloc+0x7b/0x90
[ 15.294698][ T256] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 15.294990][ T256] alloc_netdev_mqs+0x7d/0x1370
[ 15.295181][ T256] rtnl_create_link+0xa9e/0xe20
[ 15.295471][ T256] rtnl_newlink_create+0x203/0x8f0
[ 15.295655][ T256] __rtnl_newlink+0x231/0xa30
[ 15.295846][ T256] rtnl_newlink+0x693/0xa60
[ 15.296151][ T256] rtnetlink_rcv_msg+0x709/0xc00
[ 15.296454][ T256] netlink_rcv_skb+0x121/0x340
[ 15.296740][ T256] netlink_unicast+0x4aa/0x780
[ 15.296938][ T256] netlink_sendmsg+0x714/0xbd0
[ 15.297159][ T256] __sys_sendto+0x24b/0x380
[ 15.297459][ T256] __x64_sys_sendto+0xe0/0x1b0
[ 15.297657][ T256] do_syscall_64+0xc1/0xfd0
[ 15.297847][ T256] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 15.298175][ T256]
[ 15.298283][ T256] Freed by task 256:
[ 15.298425][ T256] kasan_save_stack+0x24/0x40
[ 15.298631][ T256] kasan_save_track+0x14/0x30
[ 15.298815][ T256] __kasan_save_free_info+0x3b/0x60
[ 15.299158][ T256] __kasan_slab_free+0x3f/0x60
[ 15.299359][ T256] kfree+0x21d/0x540
[ 15.299510][ T256] device_release+0x9c/0x210
[ 15.299705][ T256] kobject_cleanup+0xfe/0x360
[ 15.299932][ T256] netdev_run_todo+0x81f/0xc60
[ 15.300126][ T256] rtnl_dellink+0x350/0xa30
[ 15.300329][ T256] rtnetlink_rcv_msg+0x709/0xc00
[ 15.300513][ T256] netlink_rcv_skb+0x121/0x340
[ 15.300713][ T256] netlink_unicast+0x4aa/0x780
[ 15.300908][ T256] netlink_sendmsg+0x714/0xbd0
[ 15.301095][ T256] __sys_sendto+0x24b/0x380
[ 15.301285][ T256] __x64_sys_sendto+0xe0/0x1b0
[ 15.301574][ T256] do_syscall_64+0xc1/0xfd0
[ 15.301772][ T256] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 15.302098][ T256]
[ 15.302192][ T256] The buggy address belongs to the object at ffff888005882000
[ 15.302192][ T256] which belongs to the cache kmalloc-8k of size 8192
[ 15.302751][ T256] The buggy address is located 1732 bytes inside of
[ 15.302751][ T256] freed 8192-byte region [ffff888005882000, ffff888005884000)
[ 15.303185][ T256]
[ 15.303289][ T256] The buggy address belongs to the physical page:
[ 15.303524][ T256] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5880
[ 15.303860][ T256] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 15.304242][ T256] flags: 0x80000000000040(head|node=0|zone=1)
[ 15.304481][ T256] page_type: f5(slab)
[ 15.304634][ T256] raw: 0080000000000040 ffff8880010438c0 ffffea0000241610 ffffea0000162210
[ 15.305065][ T256] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 15.305394][ T256] head: 0080000000000040 ffff8880010438c0 ffffea0000241610 ffffea0000162210
[ 15.305836][ T256] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 15.306153][ T256] head: 0080000000000003 ffffea0000162001 00000000ffffffff 00000000ffffffff
[ 15.306643][ T256] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 15.306964][ T256] page dumped because: kasan: bad access detected
[ 15.307192][ T256]
[ 15.307293][ T256] Memory state around the buggy address:
[ 15.307648][ T256] ffff888005882580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 15.307912][ T256] ffff888005882600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 15.308171][ T256] >ffff888005882680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 15.308537][ T256] ^
[ 15.308769][ T256] ffff888005882700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 15.309052][ T256] ffff888005882780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 15.309319][ T256] ==================================================================
[ 15.310142][ T256] Disabling lock debugging due to kernel taint
[ 15.310545][ T256] ------------[ cut here ]------------
[ 15.310750][ T256] refcount_t: underflow; use-after-free.
[ 15.311436][ T256] WARNING: CPU: 2 PID: 256 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 15.311800][ T256] Modules linked in:
[ 15.311976][ T256] CPU: 2 UID: 0 PID: 256 Comm: tap Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 15.312368][ T256] Tainted: [B]=BAD_PAGE
[ 15.312527][ T256] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 15.312799][ T256] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 15.313066][ T256] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba a5 9a e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff
[ 15.313752][ T256] RSP: 0018:ffffc90000b473f0 EFLAGS: 00010286
[ 15.314022][ T256] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 15.314318][ T256] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 15.314612][ T256] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff3740934
[ 15.314933][ T256] R10: 0000000000000003 R11: ffffc90000b46f80 R12: 0000000000000001
[ 15.315224][ T256] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 15.315715][ T256] FS: 00007fd7dd5fab80(0000) GS:ffff8880d0208000(0000) knlGS:0000000000000000
[ 15.316084][ T256] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 15.316347][ T256] CR2: 00000000004070d8 CR3: 000000000e965004 CR4: 0000000000772ef0
[ 15.316643][ T256] PKRU: 55555554
[ 15.316811][ T256] Call Trace:
[ 15.317002][ T256]
[ 15.317117][ T256] netdev_run_todo+0x5f0/0xc60
[ 15.317340][ T256] ? dev_ingress_queue_create+0x190/0x190
[ 15.317566][ T256] ? generic_xdp_install+0x410/0x410
[ 15.317775][ T256] ? __netdev_upper_dev_unlink+0x220/0x220
[ 15.318048][ T256] rtnl_dellink+0x350/0xa30
[ 15.318262][ T256] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 15.318529][ T256] ? find_held_lock+0x2b/0x80
[ 15.318748][ T256] ? __lock_acquire+0x449/0x7e0
[ 15.318995][ T256] ? find_held_lock+0x2b/0x80
[ 15.319202][ T256] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 15.319413][ T256] ? __lock_release+0x5d/0x170
[ 15.319744][ T256] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 15.320108][ T256] rtnetlink_rcv_msg+0x709/0xc00
[ 15.320336][ T256] ? rtnl_port_fill+0x890/0x890
[ 15.320542][ T256] ? __lock_acquire+0x449/0x7e0
[ 15.320743][ T256] netlink_rcv_skb+0x121/0x340
[ 15.320970][ T256] ? rtnl_port_fill+0x890/0x890
[ 15.321174][ T256] ? netlink_ack+0xdf0/0xdf0
[ 15.321385][ T256] ? netlink_deliver_tap+0x13e/0x340
[ 15.321583][ T256] ? netlink_deliver_tap+0xc3/0x340
[ 15.321909][ T256] netlink_unicast+0x4aa/0x780
[ 15.322120][ T256] ? netlink_attachskb+0x810/0x810
[ 15.322335][ T256] ? netlink_insert+0xee/0x2a0
[ 15.322539][ T256] ? netlink_autobind.isra.0+0xa5/0x270
[ 15.322737][ T256] ? netlink_autobind.isra.0+0x18a/0x270
[ 15.322968][ T256] netlink_sendmsg+0x714/0xbd0
[ 15.323170][ T256] ? netlink_unicast+0x780/0x780
[ 15.323386][ T256] ? lockdep_hardirqs_on+0x7c/0x110
[ 15.323599][ T256] ? lockdep_init_map_type+0x4b/0x270
[ 15.323811][ T256] __sys_sendto+0x24b/0x380
[ 15.324031][ T256] ? __ia32_sys_getpeername+0xb0/0xb0
[ 15.324232][ T256] ? fd_install+0x18e/0x4e0
[ 15.324477][ T256] ? __lock_release+0x5d/0x170
[ 15.324696][ T256] ? fd_install+0x18e/0x4e0
[ 15.324929][ T256] ? fd_install+0x19d/0x4e0
[ 15.325129][ T256] ? __sys_socket+0x162/0x1d0
[ 15.325344][ T256] ? update_socket_protocol+0x10/0x10
[ 15.325540][ T256] ? xfd_validate_state+0x2c/0x140
[ 15.325754][ T256] __x64_sys_sendto+0xe0/0x1b0
[ 15.325988][ T256] ? do_syscall_64+0x85/0xfd0
[ 15.326304][ T256] ? lockdep_hardirqs_on+0x7c/0x110
[ 15.326503][ T256] do_syscall_64+0xc1/0xfd0
[ 15.326732][ T256] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 15.327008][ T256] RIP: 0033:0x7fd7dd70d120
[ 15.327217][ T256] Code: ff ff 64 89 02 eb bd 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 1d 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 68 c3 0f 1f 80 00 00 00 00 41 54 48 83 ec 20
[ 15.328038][ T256] RSP: 002b:00007ffef8c51f28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 15.328354][ T256] RAX: ffffffffffffffda RBX: 0000000000000030 RCX: 00007fd7dd70d120
[ 15.328661][ T256] RDX: 0000000000000030 RSI: 00007ffef8c51f30 RDI: 0000000000000005
[ 15.329195][ T256] RBP: 00000000004047d0 R08: 0000000000000000 R09: 0000000000000000
[ 15.329514][ T256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[ 15.330115][ T256] R13: 00007ffef8c51f30 R14: 00007fd7dd5f9000 R15: 0000000000407160
[ 15.330428][ T256]
[ 15.330600][ T256] irq event stamp: 15305
[ 15.330889][ T256] hardirqs last enabled at (15305): [] finish_task_switch.isra.0+0x245/0x960
[ 15.331292][ T256] hardirqs last disabled at (15304): [] __schedule+0x94a/0x1b10
[ 15.331733][ T256] softirqs last enabled at (14396): [] handle_softirqs+0x352/0x610
[ 15.332091][ T256] softirqs last disabled at (14287): [] irq_exit_rcu+0xab/0x100
[ 15.332427][ T256] ---[ end trace 0000000000000000 ]---
[ 15.358027][ T256] tap (256) used greatest stack depth: 24744 bytes left
[ 15.391772][ T262] xdummy0: entered promiscuous mode
[ 15.405966][ T262] xdummy0: left promiscuous mode
[ 15.465455][ T264] xdummy0: entered promiscuous mode
[ 15.472442][ T264] xdummy0: left promiscuous mode