[ 11.806575][ T280] eth0: renamed from r1h1 [ 11.990597][ T282] eth1: renamed from r1h2 [ 14.217353][ T311] ip (311) used greatest stack depth: 23584 bytes left [ 17.960470][ T67] ================================================================== [ 17.960709][ T67] BUG: KASAN: slab-use-after-free in cleanup_net+0xa5d/0xb90 [ 17.960916][ T67] Read of size 8 at addr ffff8880058600f8 by task kworker/u16:1/67 [ 17.961118][ T67] [ 17.961189][ T67] CPU: 2 UID: 0 PID: 67 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 17.961396][ T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 17.961568][ T67] Workqueue: netns cleanup_net [ 17.961714][ T67] Call Trace: [ 17.961824][ T67] [ 17.961898][ T67] dump_stack_lvl+0x82/0xd0 [ 17.962049][ T67] print_address_description.constprop.0+0x2c/0x3b0 [ 17.962228][ T67] ? cleanup_net+0xa5d/0xb90 [ 17.962368][ T67] print_report+0xb4/0x270 [ 17.962509][ T67] ? kasan_addr_to_slab+0x25/0x80 [ 17.962650][ T67] kasan_report+0xbd/0xf0 [ 17.962756][ T67] ? cleanup_net+0xa5d/0xb90 [ 17.962898][ T67] cleanup_net+0xa5d/0xb90 [ 17.963033][ T67] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 17.963179][ T67] ? __pfx_cleanup_net+0x10/0x10 [ 17.963316][ T67] ? trace_lock_acquire+0x148/0x1f0 [ 17.963453][ T67] ? lock_acquire+0x32/0xc0 [ 17.963590][ T67] ? process_one_work+0xe0b/0x16d0 [ 17.963735][ T67] process_one_work+0xe55/0x16d0 [ 17.963878][ T67] ? __pfx___lock_release+0x10/0x10 [ 17.964015][ T67] ? __pfx_process_one_work+0x10/0x10 [ 17.964152][ T67] ? assign_work+0x16c/0x240 [ 17.964294][ T67] worker_thread+0x58c/0xce0 [ 17.964431][ T67] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 17.964603][ T67] ? __pfx_worker_thread+0x10/0x10 [ 17.964746][ T67] ? __pfx_worker_thread+0x10/0x10 [ 17.964882][ T67] kthread+0x28a/0x350 [ 17.964989][ T67] ? __pfx_kthread+0x10/0x10 [ 17.965126][ T67] ret_from_fork+0x31/0x70 [ 17.965265][ T67] ? __pfx_kthread+0x10/0x10 [ 17.965412][ T67] ret_from_fork_asm+0x1a/0x30 [ 17.965557][ T67] [ 17.965659][ T67] [ 17.965727][ T67] Allocated by task 257: [ 17.965830][ T67] kasan_save_stack+0x24/0x50 [ 17.965973][ T67] kasan_save_track+0x14/0x30 [ 17.966112][ T67] __kasan_slab_alloc+0x59/0x70 [ 17.966251][ T67] kmem_cache_alloc_noprof+0x10b/0x350 [ 17.966394][ T67] copy_net_ns+0xc6/0x540 [ 17.966497][ T67] create_new_namespaces+0x35f/0x920 [ 17.966640][ T67] unshare_nsproxy_namespaces+0x8a/0x1b0 [ 17.966779][ T67] ksys_unshare+0x2c4/0x6e0 [ 17.966917][ T67] __x64_sys_unshare+0x31/0x40 [ 17.967057][ T67] do_syscall_64+0xc1/0x1d0 [ 17.967202][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 17.967377][ T67] [ 17.967449][ T67] Freed by task 67: [ 17.967557][ T67] kasan_save_stack+0x24/0x50 [ 17.967701][ T67] kasan_save_track+0x14/0x30 [ 17.967835][ T67] kasan_save_free_info+0x3b/0x60 [ 17.967979][ T67] __kasan_slab_free+0x38/0x50 [ 17.968117][ T67] kmem_cache_free+0xf8/0x330 [ 17.968254][ T67] cleanup_net+0x5a8/0xb90 [ 17.968394][ T67] process_one_work+0xe55/0x16d0 [ 17.968534][ T67] worker_thread+0x58c/0xce0 [ 17.968680][ T67] kthread+0x28a/0x350 [ 17.968784][ T67] ret_from_fork+0x31/0x70 [ 17.968919][ T67] ret_from_fork_asm+0x1a/0x30 [ 17.969058][ T67] [ 17.969128][ T67] Last potentially related work creation: [ 17.969269][ T67] kasan_save_stack+0x24/0x50 [ 17.969411][ T67] __kasan_record_aux_stack+0x8e/0xa0 [ 17.969551][ T67] insert_work+0x34/0x230 [ 17.969654][ T67] __queue_work+0x5fd/0xa40 [ 17.969791][ T67] queue_delayed_work_on+0x8c/0xa0 [ 17.969934][ T67] __inet_insert_ifa+0x751/0xb10 [ 17.970073][ T67] inet_rtm_newaddr+0x833/0xbd0 [ 17.970208][ T67] rtnetlink_rcv_msg+0x712/0xc10 [ 17.970348][ T67] netlink_rcv_skb+0x130/0x360 [ 17.970487][ T67] netlink_unicast+0x44b/0x710 [ 17.970623][ T67] netlink_sendmsg+0x723/0xbe0 [ 17.970757][ T67] ____sys_sendmsg+0x7ac/0xa10 [ 17.970899][ T67] ___sys_sendmsg+0xee/0x170 [ 17.971035][ T67] __sys_sendmsg+0x109/0x1a0 [ 17.971172][ T67] do_syscall_64+0xc1/0x1d0 [ 17.971312][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 17.971486][ T67] [ 17.971557][ T67] Second to last potentially related work creation: [ 17.971726][ T67] kasan_save_stack+0x24/0x50 [ 17.971862][ T67] __kasan_record_aux_stack+0x8e/0xa0 [ 17.972001][ T67] insert_work+0x34/0x230 [ 17.972105][ T67] __queue_work+0x5fd/0xa40 [ 17.972239][ T67] queue_delayed_work_on+0x8c/0xa0 [ 17.972374][ T67] __inet_insert_ifa+0x751/0xb10 [ 17.972511][ T67] inetdev_event+0xb18/0xcf0 [ 17.972647][ T67] notifier_call_chain+0xcd/0x150 [ 17.972787][ T67] __dev_notify_flags+0xe6/0x250 [ 17.972922][ T67] dev_change_flags+0xec/0x160 [ 17.973061][ T67] do_setlink.constprop.0+0x79d/0x2300 [ 17.973200][ T67] rtnl_newlink+0x6de/0xa80 [ 17.973338][ T67] rtnetlink_rcv_msg+0x712/0xc10 [ 17.973475][ T67] netlink_rcv_skb+0x130/0x360 [ 17.973611][ T67] netlink_unicast+0x44b/0x710 [ 17.973751][ T67] netlink_sendmsg+0x723/0xbe0 [ 17.973889][ T67] ____sys_sendmsg+0x7ac/0xa10 [ 17.974025][ T67] ___sys_sendmsg+0xee/0x170 [ 17.974162][ T67] __sys_sendmsg+0x109/0x1a0 [ 17.974300][ T67] do_syscall_64+0xc1/0x1d0 [ 17.974436][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 17.974603][ T67] [ 17.974673][ T67] The buggy address belongs to the object at ffff888005860040 [ 17.974673][ T67] which belongs to the cache net_namespace of size 6528 [ 17.975032][ T67] The buggy address is located 184 bytes inside of [ 17.975032][ T67] freed 6528-byte region [ffff888005860040, ffff8880058619c0) [ 17.975355][ T67] [ 17.975432][ T67] The buggy address belongs to the physical page: [ 17.975600][ T67] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888005865140 pfn:0x5860 [ 17.975875][ T67] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 17.976084][ T67] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 17.976258][ T67] page_type: f5(slab) [ 17.976369][ T67] raw: 0080000000000240 ffff888001975240 ffff88800197a088 ffff88800197a088 [ 17.976611][ T67] raw: ffff888005865140 0000000000040003 00000001f5000000 0000000000000000 [ 17.976854][ T67] head: 0080000000000240 ffff888001975240 ffff88800197a088 ffff88800197a088 [ 17.977097][ T67] head: ffff888005865140 0000000000040003 00000001f5000000 0000000000000000 [ 17.977339][ T67] head: 0080000000000003 ffffea0000161801 ffffffffffffffff 0000000000000000 [ 17.977579][ T67] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 17.977818][ T67] page dumped because: kasan: bad access detected [ 17.977987][ T67] [ 17.978056][ T67] Memory state around the buggy address: [ 17.978191][ T67] ffff88800585ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 17.978390][ T67] ffff888005860000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 17.978593][ T67] >ffff888005860080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.978791][ T67] ^ [ 17.978988][ T67] ffff888005860100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.979184][ T67] ffff888005860180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 17.979381][ T67] ================================================================== [ 17.979668][ T67] Disabling lock debugging due to kernel taint [ 19.910412][ T377] eth0: renamed from r1h1 [ 20.048321][ T379] eth1: renamed from r1h2 [ 26.926967][ T472] eth0: renamed from r1h1 [ 27.067300][ T474] eth1: renamed from r1h2 [ 33.897174][ T567] eth0: renamed from r1h1 [ 34.047198][ T569] eth1: renamed from r1h2 [ 40.907256][ T660] eth0: renamed from r1h1 [ 41.055156][ T662] eth1: renamed from r1h2 [ 48.845321][ T757] eth0: renamed from r1h1 [ 49.006333][ T759] eth1: renamed from r1h2 [ 57.197249][ T861] eth0: renamed from r1h1 [ 57.339247][ T863] eth0: renamed from r2h1 [ 57.488349][ T865] eth1: renamed from r1h2 [ 57.651466][ T867] eth1: renamed from r2h2 [ 57.939703][ T872] br0: port 1(eth0) entered blocking state [ 57.940011][ T872] br0: port 1(eth0) entered disabled state [ 57.940219][ T872] eth0: entered allmulticast mode [ 57.941190][ T872] eth0: entered promiscuous mode [ 57.942763][ T40] br0: port 1(eth0) entered blocking state [ 57.942960][ T40] br0: port 1(eth0) entered forwarding state [ 57.989131][ T873] br0: port 2(eth1) entered blocking state [ 57.989333][ T873] br0: port 2(eth1) entered disabled state [ 57.990707][ T873] eth1: entered allmulticast mode [ 57.991678][ T873] eth1: entered promiscuous mode [ 57.997203][ T45] br0: port 2(eth1) entered blocking state [ 57.997487][ T45] br0: port 2(eth1) entered forwarding state [ 58.399383][ T880] br0: port 1(eth0) entered blocking state [ 58.399727][ T880] br0: port 1(eth0) entered disabled state [ 58.399926][ T880] eth0: entered allmulticast mode [ 58.409543][ T880] eth0: entered promiscuous mode [ 58.478539][ T881] br0: port 2(eth1) entered blocking state [ 58.478822][ T881] br0: port 2(eth1) entered disabled state [ 58.479020][ T881] eth1: entered allmulticast mode [ 58.479952][ T881] eth1: entered promiscuous mode [ 58.480974][ T40] br0: port 2(eth1) entered blocking state [ 58.481165][ T40] br0: port 2(eth1) entered forwarding state [ 59.173877][ T38] br0: port 1(eth0) entered blocking state [ 59.174087][ T38] br0: port 1(eth0) entered forwarding state [ 62.754279][ T67] eth1: left allmulticast mode [ 62.754458][ T67] eth1: left promiscuous mode [ 62.754709][ T67] br0: port 2(eth1) entered disabled state [ 62.755877][ T67] eth0: left allmulticast mode [ 62.756024][ T67] eth0: left promiscuous mode [ 62.756257][ T67] br0: port 1(eth0) entered disabled state [ 63.049968][ T67] eth1: left allmulticast mode [ 63.050144][ T67] eth1: left promiscuous mode [ 63.050435][ T67] br0: port 2(eth1) entered disabled state [ 63.051750][ T67] eth0: left allmulticast mode [ 63.051927][ T67] eth0: left promiscuous mode [ 63.052163][ T67] br0: port 1(eth0) entered disabled state [ 66.129359][ T986] eth0: renamed from r1h1 [ 66.290381][ T988] eth0: renamed from r2h1 [ 66.451753][ T990] eth1: renamed from r1h2 [ 66.604371][ T992] eth1: renamed from r2h2 [ 66.915041][ T997] br0: port 1(eth0) entered blocking state [ 66.915474][ T997] br0: port 1(eth0) entered disabled state [ 66.915765][ T997] eth0: entered allmulticast mode [ 66.916726][ T997] eth0: entered promiscuous mode [ 66.918354][ T58] br0: port 1(eth0) entered blocking state [ 66.918579][ T58] br0: port 1(eth0) entered forwarding state [ 66.975581][ T998] br0: port 2(eth1) entered blocking state [ 66.975796][ T998] br0: port 2(eth1) entered disabled state [ 66.975992][ T998] eth1: entered allmulticast mode [ 66.976893][ T998] eth1: entered promiscuous mode [ 66.981673][ T40] br0: port 2(eth1) entered blocking state [ 66.981872][ T40] br0: port 2(eth1) entered forwarding state [ 67.377048][ T1005] br0: port 1(eth0) entered blocking state [ 67.377340][ T1005] br0: port 1(eth0) entered disabled state [ 67.378017][ T1005] eth0: entered allmulticast mode [ 67.378987][ T1005] eth0: entered promiscuous mode [ 67.444577][ T1006] br0: port 2(eth1) entered blocking state [ 67.444850][ T1006] br0: port 2(eth1) entered disabled state [ 67.445035][ T1006] eth1: entered allmulticast mode [ 67.445959][ T1006] eth1: entered promiscuous mode [ 67.447032][ T45] br0: port 2(eth1) entered blocking state [ 67.447217][ T45] br0: port 2(eth1) entered forwarding state [ 68.070173][ T38] br0: port 1(eth0) entered blocking state [ 68.070382][ T38] br0: port 1(eth0) entered forwarding state [ 71.736449][ T67] eth1: left allmulticast mode [ 71.736675][ T67] eth1: left promiscuous mode [ 71.736958][ T67] br0: port 2(eth1) entered disabled state [ 71.739801][ T67] eth0: left allmulticast mode [ 71.739965][ T67] eth0: left promiscuous mode [ 71.740217][ T67] br0: port 1(eth0) entered disabled state [ 72.010441][ T67] eth1: left allmulticast mode [ 72.010680][ T67] eth1: left promiscuous mode [ 72.010924][ T67] br0: port 2(eth1) entered disabled state [ 72.012041][ T67] eth0: left allmulticast mode [ 72.012181][ T67] eth0: left promiscuous mode [ 72.012427][ T67] br0: port 1(eth0) entered disabled state [ 74.328334][ T1098] eth0: renamed from r1h1 [ 74.495302][ T1100] eth1: renamed from r1h2 [ 81.680285][ T1199] eth0: renamed from r1h1 [ 81.822203][ T1201] eth1: renamed from r1h2 [ 88.938223][ T1299] eth0: renamed from r1h1 [ 89.088245][ T1301] eth1: renamed from r1h2 [ 96.323072][ T1397] eth0: renamed from r1h1 [ 96.461447][ T1399] eth1: renamed from r1h2 [ 104.409196][ T1499] eth0: renamed from r1h1 [ 104.552155][ T1501] eth1: renamed from r1h2 [ 113.075377][ T1612] eth0: renamed from r1h1 [ 113.237227][ T1614] eth0: renamed from r2h1 [ 113.392023][ T1616] eth1: renamed from r1h2 [ 113.533572][ T1618] eth1: renamed from r2h2 [ 113.816452][ T1623] br0: port 1(eth0) entered blocking state [ 113.816732][ T1623] br0: port 1(eth0) entered disabled state [ 113.816920][ T1623] eth0: entered allmulticast mode [ 113.817846][ T1623] eth0: entered promiscuous mode [ 113.819483][ T40] br0: port 1(eth0) entered blocking state [ 113.819703][ T40] br0: port 1(eth0) entered forwarding state [ 113.874790][ T1624] br0: port 2(eth1) entered blocking state [ 113.875075][ T1624] br0: port 2(eth1) entered disabled state [ 113.875256][ T1624] eth1: entered allmulticast mode [ 113.876161][ T1624] eth1: entered promiscuous mode [ 113.877402][ T40] br0: port 2(eth1) entered blocking state [ 113.877608][ T40] br0: port 2(eth1) entered forwarding state [ 114.285223][ T1631] br0: port 1(eth0) entered blocking state [ 114.285448][ T1631] br0: port 1(eth0) entered disabled state [ 114.285635][ T1631] eth0: entered allmulticast mode [ 114.286552][ T1631] eth0: entered promiscuous mode [ 114.349935][ T1632] br0: port 2(eth1) entered blocking state [ 114.350225][ T1632] br0: port 2(eth1) entered disabled state [ 114.350429][ T1632] eth1: entered allmulticast mode [ 114.351348][ T1632] eth1: entered promiscuous mode [ 114.352521][ T45] br0: port 2(eth1) entered blocking state [ 114.352726][ T45] br0: port 2(eth1) entered forwarding state [ 115.046061][ T38] br0: port 1(eth0) entered blocking state [ 115.046300][ T38] br0: port 1(eth0) entered forwarding state [ 118.572715][ T67] eth1: left allmulticast mode [ 118.572931][ T67] eth1: left promiscuous mode [ 118.573209][ T67] br0: port 2(eth1) entered disabled state [ 118.574361][ T67] eth0: left allmulticast mode [ 118.574564][ T67] eth0: left promiscuous mode [ 118.574819][ T67] br0: port 1(eth0) entered disabled state [ 118.891965][ T67] eth1: left allmulticast mode [ 118.892152][ T67] eth1: left promiscuous mode [ 118.892429][ T67] br0: port 2(eth1) entered disabled state [ 118.893553][ T67] eth0: left allmulticast mode [ 118.893703][ T67] eth0: left promiscuous mode [ 118.893938][ T67] br0: port 1(eth0) entered disabled state [ 121.691150][ T1736] eth0: renamed from r1h1 [ 121.841441][ T1738] eth0: renamed from r2h1 [ 121.994071][ T1740] eth1: renamed from r1h2 [ 122.135043][ T1742] eth1: renamed from r2h2 [ 122.434360][ T1747] br0: port 1(eth0) entered blocking state [ 122.434587][ T1747] br0: port 1(eth0) entered disabled state [ 122.434772][ T1747] eth0: entered allmulticast mode [ 122.435713][ T1747] eth0: entered promiscuous mode [ 122.437249][ T40] br0: port 1(eth0) entered blocking state [ 122.437454][ T40] br0: port 1(eth0) entered forwarding state [ 122.492340][ T1748] br0: port 2(eth1) entered blocking state [ 122.493313][ T1748] br0: port 2(eth1) entered disabled state [ 122.493876][ T1748] eth1: entered allmulticast mode [ 122.494851][ T1748] eth1: entered promiscuous mode [ 122.495980][ T45] br0: port 2(eth1) entered blocking state [ 122.496185][ T45] br0: port 2(eth1) entered forwarding state [ 122.898311][ T1755] br0: port 1(eth0) entered blocking state [ 122.898724][ T1755] br0: port 1(eth0) entered disabled state [ 122.898927][ T1755] eth0: entered allmulticast mode [ 122.899865][ T1755] eth0: entered promiscuous mode [ 122.960915][ T1756] br0: port 2(eth1) entered blocking state [ 122.961195][ T1756] br0: port 2(eth1) entered disabled state [ 122.961402][ T1756] eth1: entered allmulticast mode [ 122.962310][ T1756] eth1: entered promiscuous mode [ 122.963560][ T45] br0: port 2(eth1) entered blocking state [ 122.963792][ T45] br0: port 2(eth1) entered forwarding state [ 123.686856][ T58] br0: port 1(eth0) entered blocking state [ 123.687119][ T58] br0: port 1(eth0) entered forwarding state [ 127.208168][ T67] eth1: left allmulticast mode [ 127.208353][ T67] eth1: left promiscuous mode [ 127.209898][ T67] br0: port 2(eth1) entered disabled state [ 127.211253][ T67] eth0: left allmulticast mode [ 127.211434][ T67] eth0: left promiscuous mode [ 127.211691][ T67] br0: port 1(eth0) entered disabled state [ 127.487831][ T67] eth1: left allmulticast mode [ 127.488024][ T67] eth1: left promiscuous mode [ 127.488320][ T67] br0: port 2(eth1) entered disabled state [ 127.489518][ T67] eth0: left allmulticast mode [ 127.489695][ T67] eth0: left promiscuous mode [ 127.489940][ T67] br0: port 1(eth0) entered disabled state