[ 11.948165][ T277] ip (277) used greatest stack depth: 24000 bytes left [ 12.049075][ T279] eth0: renamed from r1h1 [ 12.251837][ T281] eth1: renamed from r1h2 [ 18.333706][ T63] ================================================================== [ 18.333939][ T63] BUG: KASAN: slab-use-after-free in cleanup_net+0xa5d/0xb90 [ 18.334161][ T63] Read of size 8 at addr ffff88800bd980f8 by task kworker/u16:1/63 [ 18.334363][ T63] [ 18.334434][ T63] CPU: 1 UID: 0 PID: 63 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 18.334641][ T63] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 18.334815][ T63] Workqueue: netns cleanup_net [ 18.334959][ T63] Call Trace: [ 18.335063][ T63] [ 18.335146][ T63] dump_stack_lvl+0x82/0xd0 [ 18.335296][ T63] print_address_description.constprop.0+0x2c/0x3b0 [ 18.335474][ T63] ? cleanup_net+0xa5d/0xb90 [ 18.335612][ T63] print_report+0xb4/0x270 [ 18.335751][ T63] ? kasan_addr_to_slab+0x25/0x80 [ 18.335888][ T63] kasan_report+0xbd/0xf0 [ 18.335993][ T63] ? cleanup_net+0xa5d/0xb90 [ 18.336143][ T63] cleanup_net+0xa5d/0xb90 [ 18.336286][ T63] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 18.336429][ T63] ? __pfx_cleanup_net+0x10/0x10 [ 18.336565][ T63] ? trace_lock_acquire+0x148/0x1f0 [ 18.336704][ T63] ? lock_acquire+0x32/0xc0 [ 18.336842][ T63] ? process_one_work+0xe0b/0x16d0 [ 18.336988][ T63] process_one_work+0xe55/0x16d0 [ 18.337136][ T63] ? __pfx___lock_release+0x10/0x10 [ 18.337278][ T63] ? __pfx_process_one_work+0x10/0x10 [ 18.337420][ T63] ? assign_work+0x16c/0x240 [ 18.337559][ T63] worker_thread+0x58c/0xce0 [ 18.337699][ T63] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 18.337869][ T63] ? __pfx_worker_thread+0x10/0x10 [ 18.338013][ T63] ? __pfx_worker_thread+0x10/0x10 [ 18.338160][ T63] kthread+0x28a/0x350 [ 18.338269][ T63] ? __pfx_kthread+0x10/0x10 [ 18.338409][ T63] ret_from_fork+0x31/0x70 [ 18.338549][ T63] ? __pfx_kthread+0x10/0x10 [ 18.338685][ T63] ret_from_fork_asm+0x1a/0x30 [ 18.338834][ T63] [ 18.338939][ T63] [ 18.339013][ T63] Allocated by task 256: [ 18.339125][ T63] kasan_save_stack+0x24/0x50 [ 18.339268][ T63] kasan_save_track+0x14/0x30 [ 18.339405][ T63] __kasan_slab_alloc+0x59/0x70 [ 18.339543][ T63] kmem_cache_alloc_noprof+0x10b/0x350 [ 18.339685][ T63] copy_net_ns+0xc6/0x540 [ 18.339791][ T63] create_new_namespaces+0x35f/0x920 [ 18.339930][ T63] unshare_nsproxy_namespaces+0x8a/0x1b0 [ 18.340070][ T63] ksys_unshare+0x2c4/0x6e0 [ 18.340219][ T63] __x64_sys_unshare+0x31/0x40 [ 18.340361][ T63] do_syscall_64+0xc1/0x1d0 [ 18.340502][ T63] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 18.340674][ T63] [ 18.340744][ T63] Freed by task 63: [ 18.340850][ T63] kasan_save_stack+0x24/0x50 [ 18.340991][ T63] kasan_save_track+0x14/0x30 [ 18.341140][ T63] kasan_save_free_info+0x3b/0x60 [ 18.341282][ T63] __kasan_slab_free+0x38/0x50 [ 18.341418][ T63] kmem_cache_free+0xf8/0x330 [ 18.341558][ T63] cleanup_net+0x5a8/0xb90 [ 18.341696][ T63] process_one_work+0xe55/0x16d0 [ 18.341832][ T63] worker_thread+0x58c/0xce0 [ 18.341969][ T63] kthread+0x28a/0x350 [ 18.342074][ T63] ret_from_fork+0x31/0x70 [ 18.342218][ T63] ret_from_fork_asm+0x1a/0x30 [ 18.342358][ T63] [ 18.342431][ T63] Last potentially related work creation: [ 18.342570][ T63] kasan_save_stack+0x24/0x50 [ 18.342709][ T63] __kasan_record_aux_stack+0x8e/0xa0 [ 18.342849][ T63] insert_work+0x34/0x230 [ 18.342953][ T63] __queue_work+0x5fd/0xa40 [ 18.343093][ T63] queue_delayed_work_on+0x8c/0xa0 [ 18.343244][ T63] __inet_insert_ifa+0x751/0xb10 [ 18.343387][ T63] inet_rtm_newaddr+0x833/0xbd0 [ 18.343526][ T63] rtnetlink_rcv_msg+0x712/0xc10 [ 18.343666][ T63] netlink_rcv_skb+0x130/0x360 [ 18.343809][ T63] netlink_unicast+0x44b/0x710 [ 18.343946][ T63] netlink_sendmsg+0x723/0xbe0 [ 18.344083][ T63] ____sys_sendmsg+0x7ac/0xa10 [ 18.344229][ T63] ___sys_sendmsg+0xee/0x170 [ 18.344371][ T63] __sys_sendmsg+0x109/0x1a0 [ 18.344508][ T63] do_syscall_64+0xc1/0x1d0 [ 18.344645][ T63] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 18.344815][ T63] [ 18.344888][ T63] Second to last potentially related work creation: [ 18.345056][ T63] kasan_save_stack+0x24/0x50 [ 18.345206][ T63] __kasan_record_aux_stack+0x8e/0xa0 [ 18.345354][ T63] insert_work+0x34/0x230 [ 18.345456][ T63] __queue_work+0x5fd/0xa40 [ 18.345592][ T63] queue_delayed_work_on+0x8c/0xa0 [ 18.345730][ T63] __inet_insert_ifa+0x751/0xb10 [ 18.345867][ T63] inetdev_event+0xb18/0xcf0 [ 18.346005][ T63] notifier_call_chain+0xcd/0x150 [ 18.346152][ T63] __dev_notify_flags+0xe6/0x250 [ 18.346290][ T63] dev_change_flags+0xec/0x160 [ 18.346430][ T63] do_setlink.constprop.0+0x79d/0x2300 [ 18.346572][ T63] rtnl_newlink+0x6de/0xa80 [ 18.346710][ T63] rtnetlink_rcv_msg+0x712/0xc10 [ 18.346848][ T63] netlink_rcv_skb+0x130/0x360 [ 18.346989][ T63] netlink_unicast+0x44b/0x710 [ 18.347144][ T63] netlink_sendmsg+0x723/0xbe0 [ 18.347301][ T63] ____sys_sendmsg+0x7ac/0xa10 [ 18.347441][ T63] ___sys_sendmsg+0xee/0x170 [ 18.347579][ T63] __sys_sendmsg+0x109/0x1a0 [ 18.347721][ T63] do_syscall_64+0xc1/0x1d0 [ 18.347858][ T63] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 18.348033][ T63] [ 18.348112][ T63] The buggy address belongs to the object at ffff88800bd98040 [ 18.348112][ T63] which belongs to the cache net_namespace of size 6528 [ 18.348484][ T63] The buggy address is located 184 bytes inside of [ 18.348484][ T63] freed 6528-byte region [ffff88800bd98040, ffff88800bd999c0) [ 18.348817][ T63] [ 18.348887][ T63] The buggy address belongs to the physical page: [ 18.349054][ T63] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800bd9d140 pfn:0xbd98 [ 18.349346][ T63] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.349554][ T63] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 18.349731][ T63] page_type: f5(slab) [ 18.349844][ T63] raw: 0080000000000240 ffff888001975240 ffff88800197a088 ffff88800197a088 [ 18.350088][ T63] raw: ffff88800bd9d140 0000000000040003 00000001f5000000 0000000000000000 [ 18.350343][ T63] head: 0080000000000240 ffff888001975240 ffff88800197a088 ffff88800197a088 [ 18.350589][ T63] head: ffff88800bd9d140 0000000000040003 00000001f5000000 0000000000000000 [ 18.350830][ T63] head: 0080000000000003 ffffea00002f6601 ffffffffffffffff 0000000000000000 [ 18.351075][ T63] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 18.351325][ T63] page dumped because: kasan: bad access detected [ 18.351494][ T63] [ 18.351564][ T63] Memory state around the buggy address: [ 18.351699][ T63] ffff88800bd97f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.351900][ T63] ffff88800bd98000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 18.352101][ T63] >ffff88800bd98080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.352331][ T63] ^ [ 18.352561][ T63] ffff88800bd98100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.352760][ T63] ffff88800bd98180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.352955][ T63] ================================================================== [ 18.353218][ T63] Disabling lock debugging due to kernel taint [ 20.389304][ T377] eth0: renamed from r1h1 [ 20.539647][ T379] eth1: renamed from r1h2 [ 27.519286][ T473] eth0: renamed from r1h1 [ 27.668290][ T475] eth1: renamed from r1h2 [ 34.596499][ T568] eth0: renamed from r1h1 [ 34.762078][ T570] eth1: renamed from r1h2 [ 41.764311][ T661] eth0: renamed from r1h1 [ 41.923135][ T663] eth1: renamed from r1h2 [ 49.729184][ T759] eth0: renamed from r1h1 [ 49.878782][ T761] eth1: renamed from r1h2 [ 57.939111][ T863] eth0: renamed from r1h1 [ 58.085885][ T865] eth0: renamed from r2h1 [ 58.242142][ T867] eth1: renamed from r1h2 [ 58.401135][ T869] eth1: renamed from r2h2 [ 58.690787][ T874] br0: port 1(eth0) entered blocking state [ 58.691012][ T874] br0: port 1(eth0) entered disabled state [ 58.691210][ T874] eth0: entered allmulticast mode [ 58.692143][ T874] eth0: entered promiscuous mode [ 58.693730][ T44] br0: port 1(eth0) entered blocking state [ 58.693933][ T44] br0: port 1(eth0) entered forwarding state [ 58.753943][ T875] br0: port 2(eth1) entered blocking state [ 58.754175][ T875] br0: port 2(eth1) entered disabled state [ 58.754378][ T875] eth1: entered allmulticast mode [ 58.755310][ T875] eth1: entered promiscuous mode [ 58.756443][ T38] br0: port 2(eth1) entered blocking state [ 58.756661][ T38] br0: port 2(eth1) entered forwarding state [ 59.163110][ T882] br0: port 1(eth0) entered blocking state [ 59.163356][ T882] br0: port 1(eth0) entered disabled state [ 59.163557][ T882] eth0: entered allmulticast mode [ 59.164491][ T882] eth0: entered promiscuous mode [ 59.226105][ T883] br0: port 2(eth1) entered blocking state [ 59.226374][ T883] br0: port 2(eth1) entered disabled state [ 59.226586][ T883] eth1: entered allmulticast mode [ 59.227547][ T883] eth1: entered promiscuous mode [ 59.228720][ T39] br0: port 2(eth1) entered blocking state [ 59.228918][ T39] br0: port 2(eth1) entered forwarding state [ 59.940774][ T40] br0: port 1(eth0) entered blocking state [ 59.941070][ T40] br0: port 1(eth0) entered forwarding state [ 63.515364][ T63] eth1: left allmulticast mode [ 63.515557][ T63] eth1: left promiscuous mode [ 63.515884][ T63] br0: port 2(eth1) entered disabled state [ 63.517317][ T63] eth0: left allmulticast mode [ 63.517539][ T63] eth0: left promiscuous mode [ 63.517863][ T63] br0: port 1(eth0) entered disabled state [ 63.846931][ T63] eth1: left allmulticast mode [ 63.847217][ T63] eth1: left promiscuous mode [ 63.847547][ T63] br0: port 2(eth1) entered disabled state [ 63.848851][ T63] eth0: left allmulticast mode [ 63.849072][ T63] eth0: left promiscuous mode [ 63.849395][ T63] br0: port 1(eth0) entered disabled state [ 66.744188][ T987] eth0: renamed from r1h1 [ 66.914386][ T989] eth0: renamed from r2h1 [ 67.065098][ T991] eth1: renamed from r1h2 [ 67.210244][ T993] eth1: renamed from r2h2 [ 67.503852][ T998] br0: port 1(eth0) entered blocking state [ 67.504112][ T998] br0: port 1(eth0) entered disabled state [ 67.504321][ T998] eth0: entered allmulticast mode [ 67.505285][ T998] eth0: entered promiscuous mode [ 67.506885][ T39] br0: port 1(eth0) entered blocking state [ 67.507081][ T39] br0: port 1(eth0) entered forwarding state [ 67.566096][ T999] br0: port 2(eth1) entered blocking state [ 67.566869][ T999] br0: port 2(eth1) entered disabled state [ 67.567067][ T999] eth1: entered allmulticast mode [ 67.568000][ T999] eth1: entered promiscuous mode [ 67.569477][ T40] br0: port 2(eth1) entered blocking state [ 67.569691][ T40] br0: port 2(eth1) entered forwarding state [ 67.971048][ T1006] br0: port 1(eth0) entered blocking state [ 67.971650][ T1006] br0: port 1(eth0) entered disabled state [ 67.971865][ T1006] eth0: entered allmulticast mode [ 67.972812][ T1006] eth0: entered promiscuous mode [ 68.028108][ T1007] br0: port 2(eth1) entered blocking state [ 68.028702][ T1007] br0: port 2(eth1) entered disabled state [ 68.033939][ T1007] eth1: entered allmulticast mode [ 68.035251][ T1007] eth1: entered promiscuous mode [ 68.036556][ T40] br0: port 2(eth1) entered blocking state [ 68.036776][ T40] br0: port 2(eth1) entered forwarding state [ 68.708891][ T38] br0: port 1(eth0) entered blocking state [ 68.709106][ T38] br0: port 1(eth0) entered forwarding state [ 72.225176][ T63] eth1: left allmulticast mode [ 72.225380][ T63] eth1: left promiscuous mode [ 72.225654][ T63] br0: port 2(eth1) entered disabled state [ 72.226685][ T63] eth0: left allmulticast mode [ 72.226834][ T63] eth0: left promiscuous mode [ 72.227071][ T63] br0: port 1(eth0) entered disabled state [ 72.512623][ T63] eth1: left allmulticast mode [ 72.512797][ T63] eth1: left promiscuous mode [ 72.513041][ T63] br0: port 2(eth1) entered disabled state [ 72.514311][ T63] eth0: left allmulticast mode [ 72.514489][ T63] eth0: left promiscuous mode [ 72.514725][ T63] br0: port 1(eth0) entered disabled state [ 74.769815][ T1099] eth0: renamed from r1h1 [ 74.915124][ T1101] eth1: renamed from r1h2 [ 81.939240][ T1200] eth0: renamed from r1h1 [ 82.071090][ T1202] eth1: renamed from r1h2 [ 89.032121][ T1300] eth0: renamed from r1h1 [ 89.177260][ T1302] eth1: renamed from r1h2 [ 96.170415][ T1398] eth0: renamed from r1h1 [ 96.321101][ T1400] eth1: renamed from r1h2 [ 104.236428][ T1501] eth0: renamed from r1h1 [ 104.377085][ T1503] eth1: renamed from r1h2 [ 112.835209][ T1614] eth0: renamed from r1h1 [ 112.977416][ T1616] eth0: renamed from r2h1 [ 113.133081][ T1618] eth1: renamed from r1h2 [ 113.270058][ T1620] eth1: renamed from r2h2 [ 113.564147][ T1625] br0: port 1(eth0) entered blocking state [ 113.564440][ T1625] br0: port 1(eth0) entered disabled state [ 113.564623][ T1625] eth0: entered allmulticast mode [ 113.565528][ T1625] eth0: entered promiscuous mode [ 113.567114][ T44] br0: port 1(eth0) entered blocking state [ 113.567319][ T44] br0: port 1(eth0) entered forwarding state [ 113.620560][ T1626] br0: port 2(eth1) entered blocking state [ 113.620828][ T1626] br0: port 2(eth1) entered disabled state [ 113.621009][ T1626] eth1: entered allmulticast mode [ 113.621918][ T1626] eth1: entered promiscuous mode [ 113.623321][ T40] br0: port 2(eth1) entered blocking state [ 113.623509][ T40] br0: port 2(eth1) entered forwarding state [ 114.030174][ T1633] br0: port 1(eth0) entered blocking state [ 114.030465][ T1633] br0: port 1(eth0) entered disabled state [ 114.030648][ T1633] eth0: entered allmulticast mode [ 114.031572][ T1633] eth0: entered promiscuous mode [ 114.093494][ T1634] br0: port 2(eth1) entered blocking state [ 114.093768][ T1634] br0: port 2(eth1) entered disabled state [ 114.093946][ T1634] eth1: entered allmulticast mode [ 114.094853][ T1634] eth1: entered promiscuous mode [ 114.096035][ T44] br0: port 2(eth1) entered blocking state [ 114.096232][ T44] br0: port 2(eth1) entered forwarding state [ 114.789909][ T39] br0: port 1(eth0) entered blocking state [ 114.790130][ T39] br0: port 1(eth0) entered forwarding state [ 118.310702][ T63] eth1: left allmulticast mode [ 118.310919][ T63] eth1: left promiscuous mode [ 118.311186][ T63] br0: port 2(eth1) entered disabled state [ 118.312304][ T63] eth0: left allmulticast mode [ 118.312511][ T63] eth0: left promiscuous mode [ 118.312754][ T63] br0: port 1(eth0) entered disabled state [ 118.575116][ T63] eth1: left allmulticast mode [ 118.575291][ T63] eth1: left promiscuous mode [ 118.575545][ T63] br0: port 2(eth1) entered disabled state [ 118.576783][ T63] eth0: left allmulticast mode [ 118.576923][ T63] eth0: left promiscuous mode [ 118.577152][ T63] br0: port 1(eth0) entered disabled state [ 121.402077][ T1738] eth0: renamed from r1h1 [ 121.554938][ T1740] eth0: renamed from r2h1 [ 121.713099][ T1742] eth1: renamed from r1h2 [ 121.861252][ T1744] eth1: renamed from r2h2 [ 122.150463][ T1749] br0: port 1(eth0) entered blocking state [ 122.150775][ T1749] br0: port 1(eth0) entered disabled state [ 122.150972][ T1749] eth0: entered allmulticast mode [ 122.151899][ T1749] eth0: entered promiscuous mode [ 122.153436][ T39] br0: port 1(eth0) entered blocking state [ 122.153649][ T39] br0: port 1(eth0) entered forwarding state [ 122.210955][ T1750] br0: port 2(eth1) entered blocking state [ 122.211216][ T1750] br0: port 2(eth1) entered disabled state [ 122.211417][ T1750] eth1: entered allmulticast mode [ 122.212325][ T1750] eth1: entered promiscuous mode [ 122.213856][ T44] br0: port 2(eth1) entered blocking state [ 122.214041][ T44] br0: port 2(eth1) entered forwarding state [ 122.617663][ T1757] br0: port 1(eth0) entered blocking state [ 122.617985][ T1757] br0: port 1(eth0) entered disabled state [ 122.618181][ T1757] eth0: entered allmulticast mode [ 122.619125][ T1757] eth0: entered promiscuous mode [ 122.679685][ T1758] br0: port 2(eth1) entered blocking state [ 122.679957][ T1758] br0: port 2(eth1) entered disabled state [ 122.680143][ T1758] eth1: entered allmulticast mode [ 122.681073][ T1758] eth1: entered promiscuous mode [ 122.682266][ T44] br0: port 2(eth1) entered blocking state [ 122.682491][ T44] br0: port 2(eth1) entered forwarding state [ 123.364828][ T38] br0: port 1(eth0) entered blocking state [ 123.365059][ T38] br0: port 1(eth0) entered forwarding state [ 126.886236][ T63] eth1: left allmulticast mode [ 126.886443][ T63] eth1: left promiscuous mode [ 126.886747][ T63] br0: port 2(eth1) entered disabled state [ 126.887965][ T63] eth0: left allmulticast mode [ 126.888116][ T63] eth0: left promiscuous mode [ 126.888395][ T63] br0: port 1(eth0) entered disabled state [ 127.212266][ T63] eth1: left allmulticast mode [ 127.212495][ T63] eth1: left promiscuous mode [ 127.212766][ T63] br0: port 2(eth1) entered disabled state [ 127.213951][ T63] eth0: left allmulticast mode [ 127.214130][ T63] eth0: left promiscuous mode [ 127.214389][ T63] br0: port 1(eth0) entered disabled state