[ 16.744225][ T288] ==================================================================
[ 16.744533][ T288] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 16.744791][ T288] Read of size 1 at addr ffff88800528a6c4 by task ip/288
[ 16.744999][ T288]
[ 16.745094][ T288] CPU: 0 UID: 0 PID: 288 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 16.745099][ T288] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 16.745101][ T288] Call Trace:
[ 16.745104][ T288]
[ 16.745106][ T288] dump_stack_lvl+0x82/0xc0
[ 16.745112][ T288] print_address_description.constprop.0+0x2c/0x3a0
[ 16.745120][ T288] ? kobject_put+0xbb/0xd0
[ 16.745124][ T288] print_report+0xb4/0x270
[ 16.745127][ T288] ? kobject_put+0xbb/0xd0
[ 16.745130][ T288] ? kasan_addr_to_slab+0x21/0x70
[ 16.745134][ T288] ? kobject_put+0xbb/0xd0
[ 16.745137][ T288] kasan_report+0xca/0x100
[ 16.745141][ T288] ? kobject_put+0xbb/0xd0
[ 16.745146][ T288] kobject_put+0xbb/0xd0
[ 16.745150][ T288] netdev_run_todo+0x5f0/0xc60
[ 16.745159][ T288] ? dev_ingress_queue_create+0x190/0x190
[ 16.745162][ T288] ? generic_xdp_install+0x410/0x410
[ 16.745167][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.745174][ T288] rtnl_dellink+0x350/0xa30
[ 16.745180][ T288] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 16.745200][ T288] ? find_held_lock+0x2b/0x80
[ 16.745208][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.745213][ T288] ? find_held_lock+0x2b/0x80
[ 16.745217][ T288] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 16.745220][ T288] ? __lock_release+0x5d/0x170
[ 16.745224][ T288] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 16.745227][ T288] rtnetlink_rcv_msg+0x709/0xc00
[ 16.745231][ T288] ? rtnl_port_fill+0x890/0x890
[ 16.745235][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.745241][ T288] netlink_rcv_skb+0x121/0x340
[ 16.745247][ T288] ? rtnl_port_fill+0x890/0x890
[ 16.745251][ T288] ? netlink_ack+0xdf0/0xdf0
[ 16.745257][ T288] ? netlink_deliver_tap+0x13e/0x340
[ 16.745260][ T288] ? netlink_deliver_tap+0xc3/0x340
[ 16.745263][ T288] netlink_unicast+0x4aa/0x780
[ 16.745267][ T288] ? netlink_attachskb+0x810/0x810
[ 16.745271][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.745276][ T288] netlink_sendmsg+0x714/0xbd0
[ 16.745280][ T288] ? netlink_unicast+0x780/0x780
[ 16.745283][ T288] ? __import_iovec+0x230/0x3b0
[ 16.745290][ T288] ? netlink_unicast+0x780/0x780
[ 16.745293][ T288] ____sys_sendmsg+0x3dd/0x890
[ 16.745297][ T288] ? get_timestamp.constprop.0+0x370/0x370
[ 16.745300][ T288] ? __copy_msghdr+0x3c0/0x3c0
[ 16.745308][ T288] ___sys_sendmsg+0xed/0x170
[ 16.745311][ T288] ? kasan_record_aux_stack+0x8c/0xa0
[ 16.745314][ T288] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 16.745320][ T288] ? copy_msghdr_from_user+0x110/0x110
[ 16.745324][ T288] ? find_held_lock+0x2b/0x80
[ 16.745329][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.745334][ T288] ? find_held_lock+0x2b/0x80
[ 16.745337][ T288] ? __virt_addr_valid+0x22a/0x450
[ 16.745343][ T288] ? __lock_release+0x5d/0x170
[ 16.745348][ T288] __sys_sendmsg+0x10b/0x1a0
[ 16.745351][ T288] ? __call_rcu_common.constprop.0+0x318/0x630
[ 16.745353][ T288] ? __sys_sendmsg_sock+0x20/0x20
[ 16.745360][ T288] ? rcu_is_watching+0x12/0xb0
[ 16.745366][ T288] do_syscall_64+0xc1/0xfd0
[ 16.745373][ T288] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 16.745376][ T288] RIP: 0033:0x7f7df2d731d7
[ 16.745381][ T288] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 16.745384][ T288] RSP: 002b:00007ffe185f0218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 16.745388][ T288] RAX: ffffffffffffffda RBX: 00007ffe185f0940 RCX: 00007f7df2d731d7
[ 16.745390][ T288] RDX: 0000000000000000 RSI: 00007ffe185f0280 RDI: 0000000000000005
[ 16.745392][ T288] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 16.745394][ T288] R10: 00007f7df2c6ff60 R11: 0000000000000246 R12: 0000000000000002
[ 16.745396][ T288] R13: 00000000690df92c R14: 0000000000499600 R15: 0000000000000000
[ 16.745402][ T288]
[ 16.745403][ T288]
[ 16.757770][ T288] Allocated by task 262:
[ 16.757899][ T288] kasan_save_stack+0x24/0x40
[ 16.758083][ T288] kasan_save_track+0x14/0x30
[ 16.758250][ T288] __kasan_kmalloc+0x7b/0x90
[ 16.758415][ T288] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 16.758588][ T288] alloc_netdev_mqs+0x7d/0x1370
[ 16.758754][ T288] rtnl_create_link+0xa9e/0xe20
[ 16.758919][ T288] rtnl_newlink_create+0x203/0x8f0
[ 16.759087][ T288] __rtnl_newlink+0x231/0xa30
[ 16.759254][ T288] rtnl_newlink+0x693/0xa60
[ 16.759417][ T288] rtnetlink_rcv_msg+0x709/0xc00
[ 16.759581][ T288] netlink_rcv_skb+0x121/0x340
[ 16.759742][ T288] netlink_unicast+0x4aa/0x780
[ 16.759910][ T288] netlink_sendmsg+0x714/0xbd0
[ 16.760083][ T288] ____sys_sendmsg+0x3dd/0x890
[ 16.760251][ T288] ___sys_sendmsg+0xed/0x170
[ 16.760419][ T288] __sys_sendmsg+0x10b/0x1a0
[ 16.760583][ T288] do_syscall_64+0xc1/0xfd0
[ 16.760744][ T288] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 16.760945][ T288]
[ 16.761038][ T288] Freed by task 288:
[ 16.761167][ T288] kasan_save_stack+0x24/0x40
[ 16.761336][ T288] kasan_save_track+0x14/0x30
[ 16.761503][ T288] __kasan_save_free_info+0x3b/0x60
[ 16.761671][ T288] __kasan_slab_free+0x3f/0x60
[ 16.761835][ T288] kfree+0x21d/0x540
[ 16.761959][ T288] device_release+0x9c/0x210
[ 16.762129][ T288] kobject_cleanup+0xfe/0x360
[ 16.762297][ T288] netdev_run_todo+0x81f/0xc60
[ 16.762473][ T288] rtnl_dellink+0x350/0xa30
[ 16.762691][ T288] rtnetlink_rcv_msg+0x709/0xc00
[ 16.762869][ T288] netlink_rcv_skb+0x121/0x340
[ 16.763055][ T288] netlink_unicast+0x4aa/0x780
[ 16.763237][ T288] netlink_sendmsg+0x714/0xbd0
[ 16.763417][ T288] ____sys_sendmsg+0x3dd/0x890
[ 16.763598][ T288] ___sys_sendmsg+0xed/0x170
[ 16.763780][ T288] __sys_sendmsg+0x10b/0x1a0
[ 16.763960][ T288] do_syscall_64+0xc1/0xfd0
[ 16.764151][ T288] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 16.764374][ T288]
[ 16.764466][ T288] Last potentially related work creation:
[ 16.764644][ T288] kasan_save_stack+0x24/0x40
[ 16.764830][ T288] kasan_record_aux_stack+0x8c/0xa0
[ 16.765026][ T288] insert_work+0x34/0x230
[ 16.765171][ T288] __queue_work+0x5fd/0xab0
[ 16.765356][ T288] queue_work_on+0x84/0x90
[ 16.765535][ T288] vxlan_fdb_destroy+0x8e0/0xfb0 [vxlan]
[ 16.765727][ T288] vxlan_flush+0x6fa/0xc50 [vxlan]
[ 16.765917][ T288] vxlan_dellink+0x9d/0x2e0 [vxlan]
[ 16.766114][ T288] rtnl_dellink+0x334/0xa30
[ 16.766296][ T288] rtnetlink_rcv_msg+0x709/0xc00
[ 16.766475][ T288] netlink_rcv_skb+0x121/0x340
[ 16.766653][ T288] netlink_unicast+0x4aa/0x780
[ 16.766837][ T288] netlink_sendmsg+0x714/0xbd0
[ 16.767022][ T288] ____sys_sendmsg+0x3dd/0x890
[ 16.767215][ T288] ___sys_sendmsg+0xed/0x170
[ 16.767396][ T288] __sys_sendmsg+0x10b/0x1a0
[ 16.767574][ T288] do_syscall_64+0xc1/0xfd0
[ 16.767755][ T288] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 16.767980][ T288]
[ 16.768079][ T288] The buggy address belongs to the object at ffff88800528a000
[ 16.768079][ T288] which belongs to the cache kmalloc-8k of size 8192
[ 16.768515][ T288] The buggy address is located 1732 bytes inside of
[ 16.768515][ T288] freed 8192-byte region [ffff88800528a000, ffff88800528c000)
[ 16.768953][ T288]
[ 16.769050][ T288] The buggy address belongs to the physical page:
[ 16.769272][ T288] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5288
[ 16.769599][ T288] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 16.769871][ T288] flags: 0x80000000000040(head|node=0|zone=1)
[ 16.770102][ T288] page_type: f5(slab)
[ 16.770245][ T288] raw: 0080000000000040 ffff8880010438c0 ffffea0000228810 ffff888001041228
[ 16.770566][ T288] raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 16.770889][ T288] head: 0080000000000040 ffff8880010438c0 ffffea0000228810 ffff888001041228
[ 16.771218][ T288] head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
[ 16.771532][ T288] head: 0080000000000003 ffffea000014a201 00000000ffffffff 00000000ffffffff
[ 16.771848][ T288] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 16.772177][ T288] page dumped because: kasan: bad access detected
[ 16.772398][ T288]
[ 16.772487][ T288] Memory state around the buggy address:
[ 16.772664][ T288] ffff88800528a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 16.772931][ T288] ffff88800528a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 16.773205][ T288] >ffff88800528a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 16.773463][ T288] ^
[ 16.773676][ T288] ffff88800528a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 16.773932][ T288] ffff88800528a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 16.774202][ T288] ==================================================================
[ 16.774537][ T288] Disabling lock debugging due to kernel taint
[ 16.774863][ T288] ------------[ cut here ]------------
[ 16.775049][ T288] refcount_t: underflow; use-after-free.
[ 16.775250][ T288] WARNING: CPU: 1 PID: 288 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 16.775568][ T288] Modules linked in: vxlan
[ 16.775763][ T288] CPU: 1 UID: 0 PID: 288 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 16.776129][ T288] Tainted: [B]=BAD_PAGE
[ 16.776264][ T288] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 16.776486][ T288] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 16.776724][ T288] Code: cc 38 03 80 fb 01 0f 87 29 33 d7 fe 83 e3 01 0f 85 51 ff ff ff c6 05 17 cc 38 03 01 90 48 c7 c7 40 ba c5 89 e8 62 d6 16 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 c0 9d a0 ff e9 ba fe ff ff
[ 16.777374][ T288] RSP: 0018:ffffc900005371f0 EFLAGS: 00010286
[ 16.777604][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 16.777865][ T288] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 16.778146][ T288] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff1580934
[ 16.778405][ T288] R10: 0000000000000003 R11: ffffc90000536d80 R12: 0000000000000001
[ 16.778671][ T288] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 16.778931][ T288] FS: 00007f7df2ba5800(0000) GS:ffff8880da988000(0000) knlGS:0000000000000000
[ 16.779257][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.779478][ T288] CR2: 0000560191d06288 CR3: 000000000d0de001 CR4: 0000000000772ef0
[ 16.779748][ T288] PKRU: 55555554
[ 16.779886][ T288] Call Trace:
[ 16.780019][ T288]
[ 16.780123][ T288] netdev_run_todo+0x5f0/0xc60
[ 16.780304][ T288] ? dev_ingress_queue_create+0x190/0x190
[ 16.780481][ T288] ? generic_xdp_install+0x410/0x410
[ 16.780671][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.780850][ T288] rtnl_dellink+0x350/0xa30
[ 16.781023][ T288] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 16.781262][ T288] ? find_held_lock+0x2b/0x80
[ 16.781439][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.781621][ T288] ? find_held_lock+0x2b/0x80
[ 16.781795][ T288] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 16.781974][ T288] ? __lock_release+0x5d/0x170
[ 16.782155][ T288] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 16.782368][ T288] rtnetlink_rcv_msg+0x709/0xc00
[ 16.782540][ T288] ? rtnl_port_fill+0x890/0x890
[ 16.782725][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.782908][ T288] netlink_rcv_skb+0x121/0x340
[ 16.783082][ T288] ? rtnl_port_fill+0x890/0x890
[ 16.783280][ T288] ? netlink_ack+0xdf0/0xdf0
[ 16.783454][ T288] ? netlink_deliver_tap+0x13e/0x340
[ 16.783632][ T288] ? netlink_deliver_tap+0xc3/0x340
[ 16.783804][ T288] netlink_unicast+0x4aa/0x780
[ 16.783980][ T288] ? netlink_attachskb+0x810/0x810
[ 16.784151][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.784336][ T288] netlink_sendmsg+0x714/0xbd0
[ 16.784510][ T288] ? netlink_unicast+0x780/0x780
[ 16.784693][ T288] ? __import_iovec+0x230/0x3b0
[ 16.784867][ T288] ? netlink_unicast+0x780/0x780
[ 16.785040][ T288] ____sys_sendmsg+0x3dd/0x890
[ 16.785225][ T288] ? get_timestamp.constprop.0+0x370/0x370
[ 16.785421][ T288] ? __copy_msghdr+0x3c0/0x3c0
[ 16.785589][ T288] ___sys_sendmsg+0xed/0x170
[ 16.785745][ T288] ? kasan_record_aux_stack+0x8c/0xa0
[ 16.785913][ T288] ? __call_rcu_common.constprop.0+0xa8/0x630
[ 16.786112][ T288] ? copy_msghdr_from_user+0x110/0x110
[ 16.786377][ T288] ? find_held_lock+0x2b/0x80
[ 16.786535][ T288] ? __lock_acquire+0x449/0x7e0
[ 16.786699][ T288] ? find_held_lock+0x2b/0x80
[ 16.786859][ T288] ? __virt_addr_valid+0x22a/0x450
[ 16.787106][ T288] ? __lock_release+0x5d/0x170
[ 16.787290][ T288] __sys_sendmsg+0x10b/0x1a0
[ 16.787454][ T288] ? __call_rcu_common.constprop.0+0x318/0x630
[ 16.787749][ T288] ? __sys_sendmsg_sock+0x20/0x20
[ 16.787943][ T288] ? rcu_is_watching+0x12/0xb0
[ 16.788120][ T288] do_syscall_64+0xc1/0xfd0
[ 16.788284][ T288] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 16.788584][ T288] RIP: 0033:0x7f7df2d731d7
[ 16.788764][ T288] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 16.789448][ T288] RSP: 002b:00007ffe185f0218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 16.789703][ T288] RAX: ffffffffffffffda RBX: 00007ffe185f0940 RCX: 00007f7df2d731d7
[ 16.789943][ T288] RDX: 0000000000000000 RSI: 00007ffe185f0280 RDI: 0000000000000005
[ 16.790274][ T288] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078
[ 16.790523][ T288] R10: 00007f7df2c6ff60 R11: 0000000000000246 R12: 0000000000000002
[ 16.790860][ T288] R13: 00000000690df92c R14: 0000000000499600 R15: 0000000000000000
[ 16.791101][ T288]
[ 16.791222][ T288] irq event stamp: 45457
[ 16.791350][ T288] hardirqs last enabled at (45457): [] finish_task_switch.isra.0+0x245/0x960
[ 16.791770][ T288] hardirqs last disabled at (45456): [] __schedule+0x94a/0x1b10
[ 16.792045][ T288] softirqs last enabled at (44438): [] handle_softirqs+0x352/0x610
[ 16.792424][ T288] softirqs last disabled at (44201): [] irq_exit_rcu+0xab/0x100
[ 16.792707][ T288] ---[ end trace 0000000000000000 ]---