[ 20.589590][ T69] ==================================================================
[ 20.589933][ T69] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 20.590281][ T69] Read of size 1 at addr ffff88800a1e46c4 by task kworker/u16:1/69
[ 20.590585][ T69]
[ 20.590687][ T69] CPU: 0 UID: 0 PID: 69 Comm: kworker/u16:1 Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 20.590692][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 20.590696][ T69] Workqueue: netns cleanup_net
[ 20.590707][ T69] Call Trace:
[ 20.590709][ T69]
[ 20.590713][ T69] dump_stack_lvl+0x82/0xc0
[ 20.590720][ T69] print_address_description.constprop.0+0x2c/0x3a0
[ 20.590728][ T69] ? kobject_put+0xbb/0xd0
[ 20.590733][ T69] print_report+0xb4/0x270
[ 20.590736][ T69] ? kobject_put+0xbb/0xd0
[ 20.590739][ T69] ? kasan_addr_to_slab+0x21/0x70
[ 20.590743][ T69] ? kobject_put+0xbb/0xd0
[ 20.590746][ T69] kasan_report+0xca/0x100
[ 20.590750][ T69] ? kobject_put+0xbb/0xd0
[ 20.590755][ T69] kobject_put+0xbb/0xd0
[ 20.590759][ T69] netdev_run_todo+0x5f0/0xc60
[ 20.590766][ T69] ? dev_ingress_queue_create+0x190/0x190
[ 20.590770][ T69] ? generic_xdp_install+0x410/0x410
[ 20.590773][ T69] ? net_generic+0xb1/0x1f0
[ 20.590783][ T69] ops_undo_list+0x714/0x890
[ 20.590789][ T69] ? rtnl_net_dumpid_one+0x270/0x270
[ 20.590792][ T69] ? cleanup_net+0x2d6/0x8b0
[ 20.590798][ T69] cleanup_net+0x3b2/0x8b0
[ 20.590803][ T69] ? net_passive_dec+0x190/0x190
[ 20.590807][ T69] ? rcu_is_watching+0x12/0xb0
[ 20.590816][ T69] process_one_work+0xe35/0x1650
[ 20.590827][ T69] ? pwq_dec_nr_in_flight+0x550/0x550
[ 20.590833][ T69] ? assign_work+0x168/0x240
[ 20.590837][ T69] worker_thread+0x591/0xcf0
[ 20.590843][ T69] ? rescuer_thread+0xd10/0xd10
[ 20.590846][ T69] kthread+0x37b/0x5f0
[ 20.590852][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.590855][ T69] ? ret_from_fork+0x1b/0x270
[ 20.590860][ T69] ? __lock_release+0x5d/0x170
[ 20.590866][ T69] ? rcu_is_watching+0x12/0xb0
[ 20.590869][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.590872][ T69] ret_from_fork+0x1db/0x270
[ 20.590875][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.590878][ T69] ret_from_fork_asm+0x11/0x20
[ 20.590888][ T69]
[ 20.590889][ T69]
[ 20.597935][ T69] Allocated by task 273:
[ 20.598061][ T69] kasan_save_stack+0x24/0x40
[ 20.598271][ T69] kasan_save_track+0x14/0x30
[ 20.598438][ T69] __kasan_kmalloc+0x7b/0x90
[ 20.598590][ T69] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 20.598777][ T69] alloc_netdev_mqs+0x7d/0x1370
[ 20.598939][ T69] ip6_tnl_init_net+0x102/0x3f0
[ 20.599098][ T69] ops_init+0x189/0x550
[ 20.599215][ T69] setup_net+0xf1/0x380
[ 20.599333][ T69] copy_net_ns+0x253/0x510
[ 20.599490][ T69] create_new_namespaces+0x35f/0x900
[ 20.599658][ T69] unshare_nsproxy_namespaces+0x8a/0x1a0
[ 20.599895][ T69] ksys_unshare+0x2be/0x6e0
[ 20.600120][ T69] __x64_sys_unshare+0x31/0x40
[ 20.600293][ T69] do_syscall_64+0xc1/0xfd0
[ 20.600457][ T69] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 20.600675][ T69]
[ 20.600757][ T69] Freed by task 69:
[ 20.600874][ T69] kasan_save_stack+0x24/0x40
[ 20.601051][ T69] kasan_save_track+0x14/0x30
[ 20.601266][ T69] __kasan_save_free_info+0x3b/0x60
[ 20.601521][ T69] __kasan_slab_free+0x3f/0x60
[ 20.601708][ T69] kfree+0x21d/0x540
[ 20.601836][ T69] device_release+0x9c/0x210
[ 20.602009][ T69] kobject_cleanup+0xfe/0x360
[ 20.602181][ T69] netdev_run_todo+0x81f/0xc60
[ 20.602338][ T69] ops_undo_list+0x714/0x890
[ 20.602495][ T69] cleanup_net+0x3b2/0x8b0
[ 20.602666][ T69] process_one_work+0xe35/0x1650
[ 20.602823][ T69] worker_thread+0x591/0xcf0
[ 20.602980][ T69] kthread+0x37b/0x5f0
[ 20.603099][ T69] ret_from_fork+0x1db/0x270
[ 20.603256][ T69] ret_from_fork_asm+0x11/0x20
[ 20.603416][ T69]
[ 20.603496][ T69] The buggy address belongs to the object at ffff88800a1e4000
[ 20.603496][ T69] which belongs to the cache kmalloc-4k of size 4096
[ 20.603891][ T69] The buggy address is located 1732 bytes inside of
[ 20.603891][ T69] freed 4096-byte region [ffff88800a1e4000, ffff88800a1e5000)
[ 20.604267][ T69]
[ 20.604349][ T69] The buggy address belongs to the physical page:
[ 20.604537][ T69] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa1e0
[ 20.604887][ T69] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 20.605133][ T69] flags: 0x80000000000040(head|node=0|zone=1)
[ 20.605329][ T69] page_type: f5(slab)
[ 20.605454][ T69] raw: 0080000000000040 ffff888001043700 ffffea00001c8010 ffffea000022ea10
[ 20.605740][ T69] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 20.606020][ T69] head: 0080000000000040 ffff888001043700 ffffea00001c8010 ffffea000022ea10
[ 20.606303][ T69] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 20.606573][ T69] head: 0080000000000003 ffffea0000287801 00000000ffffffff 00000000ffffffff
[ 20.606855][ T69] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 20.607131][ T69] page dumped because: kasan: bad access detected
[ 20.607329][ T69]
[ 20.607406][ T69] Memory state around the buggy address:
[ 20.607561][ T69] ffff88800a1e4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.607798][ T69] ffff88800a1e4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.608020][ T69] >ffff88800a1e4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.608246][ T69] ^
[ 20.608436][ T69] ffff88800a1e4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.608665][ T69] ffff88800a1e4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 20.608893][ T69] ==================================================================
[ 20.609303][ T69] Disabling lock debugging due to kernel taint
[ 20.609503][ T69] ------------[ cut here ]------------
[ 20.609730][ T69] refcount_t: underflow; use-after-free.
[ 20.609913][ T69] WARNING: CPU: 0 PID: 69 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 20.610197][ T69] Modules linked in:
[ 20.610321][ T69] CPU: 0 UID: 0 PID: 69 Comm: kworker/u16:1 Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 20.610822][ T69] Tainted: [B]=BAD_PAGE
[ 20.611031][ T69] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 20.611402][ T69] Workqueue: netns cleanup_net
[ 20.611571][ T69] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 20.611833][ T69] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba 25 93 e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff
[ 20.612383][ T69] RSP: 0000:ffffc900004a7a08 EFLAGS: 00010282
[ 20.612770][ T69] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 20.613100][ T69] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 20.613327][ T69] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff2840934
[ 20.613594][ T69] R10: 0000000000000003 R11: ffffc900004a7580 R12: 0000000000000001
[ 20.613874][ T69] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 20.614112][ T69] FS: 0000000000000000(0000) GS:ffff8880d7908000(0000) knlGS:0000000000000000
[ 20.614457][ T69] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 20.614675][ T69] CR2: 00007f466b21f000 CR3: 0000000033d49004 CR4: 0000000000772ef0
[ 20.615079][ T69] PKRU: 55555554
[ 20.615250][ T69] Call Trace:
[ 20.615400][ T69]
[ 20.615482][ T69] netdev_run_todo+0x5f0/0xc60
[ 20.615650][ T69] ? dev_ingress_queue_create+0x190/0x190
[ 20.615826][ T69] ? generic_xdp_install+0x410/0x410
[ 20.615985][ T69] ? net_generic+0xb1/0x1f0
[ 20.616167][ T69] ops_undo_list+0x714/0x890
[ 20.616395][ T69] ? rtnl_net_dumpid_one+0x270/0x270
[ 20.616771][ T69] ? cleanup_net+0x2d6/0x8b0
[ 20.616971][ T69] cleanup_net+0x3b2/0x8b0
[ 20.617123][ T69] ? net_passive_dec+0x190/0x190
[ 20.617358][ T69] ? rcu_is_watching+0x12/0xb0
[ 20.617625][ T69] process_one_work+0xe35/0x1650
[ 20.617841][ T69] ? pwq_dec_nr_in_flight+0x550/0x550
[ 20.618044][ T69] ? assign_work+0x168/0x240
[ 20.618300][ T69] worker_thread+0x591/0xcf0
[ 20.618466][ T69] ? rescuer_thread+0xd10/0xd10
[ 20.618687][ T69] kthread+0x37b/0x5f0
[ 20.618813][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.618973][ T69] ? ret_from_fork+0x1b/0x270
[ 20.619157][ T69] ? __lock_release+0x5d/0x170
[ 20.619373][ T69] ? rcu_is_watching+0x12/0xb0
[ 20.619531][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.619702][ T69] ret_from_fork+0x1db/0x270
[ 20.620109][ T69] ? kthread_is_per_cpu+0xc0/0xc0
[ 20.620380][ T69] ret_from_fork_asm+0x11/0x20
[ 20.620581][ T69]
[ 20.620770][ T69] irq event stamp: 11965
[ 20.620970][ T69] hardirqs last enabled at (11965): [] irqentry_exit+0x3b/0x80
[ 20.621495][ T69] hardirqs last disabled at (11964): [] handle_softirqs+0x47f/0x610
[ 20.621965][ T69] softirqs last enabled at (11446): [] handle_softirqs+0x352/0x610
[ 20.622415][ T69] softirqs last disabled at (9993): [] irq_exit_rcu+0xab/0x100
[ 20.622725][ T69] ---[ end trace 0000000000000000 ]---
[ 22.933782][ T304] GACT probability NOT on
[ 23.155510][ T308] drop_monitor: Initializing network drop monitor service
[ 36.015671][ T324] ------------[ cut here ]------------
[ 36.016090][ T324] kernel BUG at net/core/net-sysfs.c:2246!
[ 36.016502][ T324] Oops: invalid opcode: 0000 [#1] SMP KASAN
[ 36.016874][ T324] CPU: 2 UID: 0 PID: 324 Comm: echo Tainted: G B W 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 36.017471][ T324] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 36.017757][ T324] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 36.018114][ T324] RIP: 0010:netdev_release+0x6f/0x80
[ 36.018422][ T324] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 20 48 8b bb b0 fa ff ff e8 9c 81 d1 fe 48 89 ef 5b 5d e9 62 8e d1 fe 90 <0f> 0b e8 0a 65 d8 fe eb bc e8 63 65 d8 fe eb d9 90 f3 0f 1e fa 0f
[ 36.019564][ T324] RSP: 0018:ffffc900005878a8 EFLAGS: 00010297
[ 36.019929][ T324] RAX: 0000000000000000 RBX: ffff8880094fa688 RCX: ffffffff92d7ab51
[ 36.020366][ T324] RDX: 1ffff1100129f4cc RSI: ffffffff932602c0 RDI: ffff8880094fa660
[ 36.020822][ T324] RBP: ffff8880094fa000 R08: 0000000000000001 R09: ffffed100129f4d8
[ 36.021300][ T324] R10: ffff8880094fa6c3 R11: ffffffff904000b0 R12: ffff88800b3be200
[ 36.021767][ T324] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100
[ 36.022225][ T324] FS: 00007f6b57ed5b80(0000) GS:ffff8880d7a08000(0000) knlGS:0000000000000000
[ 36.022758][ T324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.023140][ T324] CR2: 0000561529334dec CR3: 000000000ae61006 CR4: 0000000000772ef0
[ 36.023600][ T324] PKRU: 55555554
[ 36.023826][ T324] Call Trace:
[ 36.024061][ T324]
[ 36.024251][ T324] device_release+0x9c/0x210
[ 36.024577][ T324] kobject_cleanup+0xfe/0x360
[ 36.024870][ T324] netdev_run_todo+0x5f0/0xc60
[ 36.025164][ T324] ? generic_xdp_install+0x410/0x410
[ 36.025456][ T324] ? kfree+0x21d/0x540
[ 36.025682][ T324] nsim_destroy+0x1da/0x700 [netdevsim]
[ 36.025997][ T324] __nsim_dev_port_del+0x17e/0x250 [netdevsim]
[ 36.026368][ T324] nsim_dev_reload_destroy+0xdc/0x470 [netdevsim]
[ 36.026745][ T324] nsim_drv_remove+0x51/0x1d0 [netdevsim]
[ 36.027055][ T324] device_release_driver_internal+0x3bb/0x580
[ 36.027412][ T324] ? klist_put+0xb1/0x170
[ 36.027636][ T324] bus_remove_device+0x1ee/0x3f0
[ 36.027925][ T324] device_del+0x33b/0x8c0
[ 36.028139][ T324] ? __device_link_del+0x3c0/0x3c0
[ 36.028423][ T324] ? kernfs_fop_write_iter+0x207/0x490
[ 36.028717][ T324] device_unregister+0x17/0xa0
[ 36.028999][ T324] del_device_store+0x2f2/0x4f0 [netdevsim]
[ 36.029363][ T324] ? sysfs_file_kobj+0xb5/0x1f0
[ 36.029652][ T324] ? rcu_is_watching+0x12/0xb0
[ 36.029941][ T324] ? nsim_bus_dev_numvfs_show+0x60/0x60 [netdevsim]
[ 36.030308][ T324] ? sysfs_file_kobj+0xbf/0x1f0
[ 36.030610][ T324] ? sysfs_file_ops+0x120/0x120
[ 36.030895][ T324] kernfs_fop_write_iter+0x2f2/0x490
[ 36.031184][ T324] vfs_write+0xaae/0x12c0
[ 36.031409][ T324] ? kernel_write+0x6b0/0x6b0
[ 36.031701][ T324] ? lock_vma_under_rcu+0x138/0x3d0
[ 36.031995][ T324] ? __handle_mm_fault+0x5d0/0x5d0
[ 36.032288][ T324] ksys_write+0xf7/0x1d0
[ 36.032513][ T324] ? __ia32_sys_read+0xb0/0xb0
[ 36.032809][ T324] ? do_user_addr_fault+0x955/0xe00
[ 36.033111][ T324] do_syscall_64+0xc1/0xfd0
[ 36.033396][ T324] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 36.033766][ T324] RIP: 0033:0x7f6b57fd6257
[ 36.034063][ T324] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 36.035095][ T324] RSP: 002b:00007ffee8f3bc08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 36.035537][ T324] RAX: ffffffffffffffda RBX: 00007f6b580d2780 RCX: 00007f6b57fd6257
[ 36.035982][ T324] RDX: 0000000000000005 RSI: 0000562ec8ab22f0 RDI: 0000000000000001
[ 36.036414][ T324] RBP: 0000000000000005 R08: 0000000000000004 R09: 0000000000000077
[ 36.036842][ T324] R10: 0000000000000063 R11: 0000000000000246 R12: 0000000000000005
[ 36.037274][ T324] R13: 0000562ec8ab22f0 R14: 0000000000000005 R15: 00007f6b580cd9c0
[ 36.037726][ T324]
[ 36.037952][ T324] Modules linked in: drop_monitor act_gact cls_flower sch_ingress netdevsim psample
[ 36.038581][ T324] ---[ end trace 0000000000000000 ]---
[ 36.038911][ T324] RIP: 0010:netdev_release+0x6f/0x80
[ 36.039246][ T324] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 20 48 8b bb b0 fa ff ff e8 9c 81 d1 fe 48 89 ef 5b 5d e9 62 8e d1 fe 90 <0f> 0b e8 0a 65 d8 fe eb bc e8 63 65 d8 fe eb d9 90 f3 0f 1e fa 0f
[ 36.040301][ T324] RSP: 0018:ffffc900005878a8 EFLAGS: 00010297
[ 36.041981][ T324] RAX: 0000000000000000 RBX: ffff8880094fa688 RCX: ffffffff92d7ab51
[ 36.042509][ T324] RDX: 1ffff1100129f4cc RSI: ffffffff932602c0 RDI: ffff8880094fa660
[ 36.042999][ T324] RBP: ffff8880094fa000 R08: 0000000000000001 R09: ffffed100129f4d8
[ 36.043478][ T324] R10: ffff8880094fa6c3 R11: ffffffff904000b0 R12: ffff88800b3be200
[ 36.043952][ T324] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100
[ 36.044439][ T324] FS: 00007f6b57ed5b80(0000) GS:ffff8880d7a08000(0000) knlGS:0000000000000000
[ 36.044993][ T324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.045412][ T324] CR2: 0000561529334dec CR3: 000000000ae61006 CR4: 0000000000772ef0
[ 36.045890][ T324] PKRU: 55555554
[ 36.046146][ T324] Kernel panic - not syncing: Fatal exception
[ 36.046632][ T324] Kernel Offset: 0xf400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 36.047331][ T324] ---[ end Kernel panic - not syncing: Fatal exception ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr