[ 4998.220052][ C0] ==================================================================
[ 4998.220325][ C0] BUG: KASAN: slab-use-after-free in dst_destroy+0x316/0x370
[ 4998.220564][ C0] Read of size 8 at addr ffff88800a39d730 by task swapper/0/0
[ 4998.220785][ C0]
[ 4998.220872][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.9.0-rc6-virtme #1
[ 4998.221114][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 4998.221454][ C0] Call Trace:
[ 4998.221570][ C0]
[ 4998.221652][ C0] dump_stack_lvl+0x82/0xd0
[ 4998.221815][ C0] print_address_description.constprop.0+0x2c/0x3b0
[ 4998.221998][ C0] ? dst_destroy+0x316/0x370
[ 4998.222154][ C0] print_report+0xb4/0x270
[ 4998.222302][ C0] ? kasan_addr_to_slab+0x4e/0x90
[ 4998.222464][ C0] kasan_report+0xbd/0xf0
[ 4998.222596][ C0] ? dst_destroy+0x316/0x370
[ 4998.222770][ C0] dst_destroy+0x316/0x370
[ 4998.222921][ C0] ? rcu_do_batch+0x3be/0xfb0
[ 4998.223091][ C0] rcu_do_batch+0x3c0/0xfb0
[ 4998.223238][ C0] ? __pfx_rcu_do_batch+0x10/0x10
[ 4998.223390][ C0] ? lockdep_hardirqs_on_prepare.part.0+0x14f/0x370
[ 4998.223583][ C0] rcu_core+0x2be/0x500
[ 4998.223699][ C0] __do_softirq+0x1f8/0x5df
[ 4998.223858][ C0] irq_exit_rcu+0x97/0xc0
[ 4998.223984][ C0] sysvec_apic_timer_interrupt+0x75/0x80
[ 4998.224137][ C0]
[ 4998.224215][ C0]
[ 4998.224297][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 4998.224490][ C0] RIP: 0010:default_idle+0xf/0x20
[ 4998.224649][ C0] Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 e6 30 00 fb f4 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
[ 4998.225176][ C0] RSP: 0018:ffffffff92a07e00 EFLAGS: 00000246
[ 4998.225371][ C0] RAX: 0000000005ad0005 RBX: 1ffffffff2540fc2 RCX: ffffffff91b526a5
[ 4998.225611][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f2aefc4
[ 4998.225834][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1005ec709c
[ 4998.226056][ C0] R10: ffff88802f6384e3 R11: ffff88802f63de40 R12: 0000000000000000
[ 4998.226286][ C0] R13: ffffffff92a31000 R14: dffffc0000000000 R15: 0000000000014770
[ 4998.226621][ C0] ? ct_kernel_exit.constprop.0+0xc5/0xf0
[ 4998.226772][ C0] ? cpuidle_idle_call+0x1f4/0x280
[ 4998.226928][ C0] default_idle_call+0x6d/0xb0
[ 4998.227076][ C0] cpuidle_idle_call+0x1f4/0x280
[ 4998.227328][ C0] ? __pfx_cpuidle_idle_call+0x10/0x10
[ 4998.227482][ C0] ? tsc_verify_tsc_adjust+0x5e/0x2b0
[ 4998.227634][ C0] do_idle+0xf9/0x160
[ 4998.227751][ C0] cpu_startup_entry+0x54/0x60
[ 4998.227993][ C0] rest_init+0x14f/0x260
[ 4998.228104][ C0] start_kernel+0x318/0x3d0
[ 4998.228259][ C0] x86_64_start_reservations+0x18/0x30
[ 4998.228419][ C0] x86_64_start_kernel+0xba/0x110
[ 4998.228566][ C0] common_startup_64+0x12c/0x138
[ 4998.228821][ C0]
[ 4998.228929][ C0]
[ 4998.229007][ C0] Allocated by task 28444:
[ 4998.229160][ C0] kasan_save_stack+0x24/0x50
[ 4998.229311][ C0] kasan_save_track+0x14/0x30
[ 4998.229564][ C0] __kasan_slab_alloc+0x59/0x70
[ 4998.229713][ C0] kmem_cache_alloc+0xef/0x270
[ 4998.229867][ C0] copy_net_ns+0xc6/0x730
[ 4998.229981][ C0] create_new_namespaces+0x35f/0x920
[ 4998.230136][ C0] unshare_nsproxy_namespaces+0x8a/0x1b0
[ 4998.230378][ C0] ksys_unshare+0x2cc/0x6e0
[ 4998.230522][ C0] __x64_sys_unshare+0x31/0x40
[ 4998.230673][ C0] do_syscall_64+0xc3/0x1d0
[ 4998.230825][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 4998.231099][ C0]
[ 4998.231176][ C0] Freed by task 10:
[ 4998.231290][ C0] kasan_save_stack+0x24/0x50
[ 4998.231446][ C0] kasan_save_track+0x14/0x30
[ 4998.231595][ C0] kasan_save_free_info+0x3b/0x60
[ 4998.231742][ C0] __kasan_slab_free+0xf4/0x180
[ 4998.231888][ C0] kmem_cache_free+0xd7/0x220
[ 4998.232037][ C0] cleanup_net+0x7de/0xb60
[ 4998.232184][ C0] process_one_work+0xe2c/0x1730
[ 4998.232421][ C0] worker_thread+0x587/0xd30
[ 4998.232570][ C0] kthread+0x28a/0x350
[ 4998.232681][ C0] ret_from_fork+0x31/0x70
[ 4998.232863][ C0] ret_from_fork_asm+0x1a/0x30
[ 4998.233092][ C0]
[ 4998.233165][ C0] The buggy address belongs to the object at ffff88800a39cd80
[ 4998.233165][ C0] which belongs to the cache net_namespace of size 6208
[ 4998.233550][ C0] The buggy address is located 2480 bytes inside of
[ 4998.233550][ C0] freed 6208-byte region [ffff88800a39cd80, ffff88800a39e5c0)
[ 4998.233979][ C0]
[ 4998.234053][ C0] The buggy address belongs to the physical page:
[ 4998.234239][ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800a399a00 pfn:0xa398
[ 4998.234616][ C0] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 4998.234830][ C0] flags: 0x80000000000a40(workingset|slab|head|node=0|zone=1)
[ 4998.235134][ C0] page_type: 0xffffffff()
[ 4998.235247][ C0] raw: 0080000000000a40 ffff88800192d240 ffff888001932088 ffffea0000161e10
[ 4998.235505][ C0] raw: ffff88800a399a00 0000000000040002 00000001ffffffff 0000000000000000
[ 4998.235872][ C0] head: 0080000000000a40 ffff88800192d240 ffff888001932088 ffffea0000161e10
[ 4998.236124][ C0] head: ffff88800a399a00 0000000000040002 00000001ffffffff 0000000000000000
[ 4998.236371][ C0] head: 0080000000000003 ffffea000028e601 dead000000000122 00000000ffffffff
[ 4998.236626][ C0] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
[ 4998.236884][ C0] page dumped because: kasan: bad access detected
[ 4998.237068][ C0]
[ 4998.237144][ C0] Memory state around the buggy address:
[ 4998.237283][ C0] ffff88800a39d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 4998.237490][ C0] ffff88800a39d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 4998.237782][ C0] >ffff88800a39d700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 4998.237987][ C0] ^
[ 4998.238125][ C0] ffff88800a39d780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 4998.238343][ C0] ffff88800a39d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 4998.238550][ C0] ==================================================================
[ 4998.238777][ C0] Disabling lock debugging due to kernel taint
[ 5005.608922][T28788] eth0: renamed from r1h0
[ 5006.546940][T28795] eth1: renamed from r1h1
[ 5007.487172][T28802] eth2: renamed from r1h2
[ 5008.435767][T28809] eth3: renamed from r1h3