[ 13.000709][ T291] ip (291) used greatest stack depth: 24640 bytes left [ 13.197753][ T294] ip (294) used greatest stack depth: 23472 bytes left [ 15.126996][ T318] br0: port 1(swp1) entered blocking state [ 15.127442][ T318] br0: port 1(swp1) entered disabled state [ 15.127731][ T318] swp1: entered allmulticast mode [ 15.128960][ T318] swp1: entered promiscuous mode [ 15.509698][ T321] br0: port 2(vx0) entered blocking state [ 15.510074][ T321] br0: port 2(vx0) entered disabled state [ 15.510332][ T321] vx0: entered allmulticast mode [ 15.511696][ T321] vx0: entered promiscuous mode [ 15.512356][ T321] br0: port 2(vx0) entered blocking state [ 15.512972][ T321] br0: port 2(vx0) entered forwarding state [ 16.094737][ T265] br0: port 1(swp1) entered blocking state [ 16.095155][ T265] br0: port 1(swp1) entered forwarding state [ 16.861051][ T340] br0: port 1(swp1) entered blocking state [ 16.861675][ T340] br0: port 1(swp1) entered disabled state [ 16.861908][ T340] swp1: entered allmulticast mode [ 16.863069][ T340] swp1: entered promiscuous mode [ 16.866635][ T37] br0: port 1(swp1) entered blocking state [ 16.866884][ T37] br0: port 1(swp1) entered forwarding state [ 17.101886][ T343] br0: port 2(vx0) entered blocking state [ 17.102103][ T343] br0: port 2(vx0) entered disabled state [ 17.102788][ T343] vx0: entered allmulticast mode [ 17.103979][ T343] vx0: entered promiscuous mode [ 17.104502][ T343] br0: port 2(vx0) entered blocking state [ 17.104680][ T343] br0: port 2(vx0) entered forwarding state [ 23.161262][ T359] GACT probability NOT on [ 33.193701][ T66] br0: port 1(swp1) entered disabled state [ 33.348387][ T66] swp1 (unregistering): left allmulticast mode [ 33.348713][ T66] swp1 (unregistering): left promiscuous mode [ 33.348924][ T66] br0: port 1(swp1) entered disabled state [ 33.462132][ T66] br0: port 1(swp1) entered disabled state [ 33.593677][ T66] swp1 (unregistering): left allmulticast mode [ 33.593933][ T66] swp1 (unregistering): left promiscuous mode [ 33.594176][ T66] br0: port 1(swp1) entered disabled state [ 33.650319][ T66] ================================================================== [ 33.650600][ T66] BUG: KASAN: slab-use-after-free in cleanup_net+0xa5d/0xb90 [ 33.650785][ T66] Read of size 8 at addr ffff88800b1500f8 by task kworker/u16:1/66 [ 33.650968][ T66] [ 33.651034][ T66] CPU: 2 UID: 0 PID: 66 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 33.651223][ T66] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 33.651376][ T66] Workqueue: netns cleanup_net [ 33.651512][ T66] Call Trace: [ 33.651607][ T66] [ 33.651678][ T66] dump_stack_lvl+0x82/0xd0 [ 33.651805][ T66] print_address_description.constprop.0+0x2c/0x3b0 [ 33.651959][ T66] ? cleanup_net+0xa5d/0xb90 [ 33.652086][ T66] print_report+0xb4/0x270 [ 33.652206][ T66] ? kasan_addr_to_slab+0x25/0x80 [ 33.652333][ T66] kasan_report+0xbd/0xf0 [ 33.652424][ T66] ? cleanup_net+0xa5d/0xb90 [ 33.652553][ T66] cleanup_net+0xa5d/0xb90 [ 33.652673][ T66] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 33.652797][ T66] ? __pfx_cleanup_net+0x10/0x10 [ 33.652924][ T66] ? trace_lock_acquire+0x148/0x1f0 [ 33.653049][ T66] ? lock_acquire+0x32/0xc0 [ 33.653173][ T66] ? process_one_work+0xe0b/0x16d0 [ 33.653302][ T66] process_one_work+0xe55/0x16d0 [ 33.653424][ T66] ? __pfx___lock_release+0x10/0x10 [ 33.653557][ T66] ? __pfx_process_one_work+0x10/0x10 [ 33.653683][ T66] ? assign_work+0x16c/0x240 [ 33.653805][ T66] worker_thread+0x58c/0xce0 [ 33.653926][ T66] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 33.654084][ T66] ? __pfx_worker_thread+0x10/0x10 [ 33.654210][ T66] ? __pfx_worker_thread+0x10/0x10 [ 33.654331][ T66] kthread+0x28a/0x350 [ 33.654427][ T66] ? __pfx_kthread+0x10/0x10 [ 33.654553][ T66] ret_from_fork+0x31/0x70 [ 33.654674][ T66] ? __pfx_kthread+0x10/0x10 [ 33.654796][ T66] ret_from_fork_asm+0x1a/0x30 [ 33.654925][ T66] [ 33.655022][ T66] [ 33.655083][ T66] Allocated by task 263: [ 33.655176][ T66] kasan_save_stack+0x24/0x50 [ 33.655306][ T66] kasan_save_track+0x14/0x30 [ 33.655430][ T66] __kasan_slab_alloc+0x59/0x70 [ 33.655555][ T66] kmem_cache_alloc_noprof+0x10b/0x350 [ 33.655679][ T66] copy_net_ns+0xc6/0x540 [ 33.655770][ T66] create_new_namespaces+0x35f/0x920 [ 33.655893][ T66] unshare_nsproxy_namespaces+0x8a/0x1b0 [ 33.656019][ T66] ksys_unshare+0x2c4/0x6e0 [ 33.656149][ T66] __x64_sys_unshare+0x31/0x40 [ 33.656277][ T66] do_syscall_64+0xc1/0x1d0 [ 33.656397][ T66] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.656555][ T66] [ 33.656623][ T66] Freed by task 66: [ 33.656721][ T66] kasan_save_stack+0x24/0x50 [ 33.656847][ T66] kasan_save_track+0x14/0x30 [ 33.656971][ T66] kasan_save_free_info+0x3b/0x60 [ 33.657100][ T66] __kasan_slab_free+0x38/0x50 [ 33.657223][ T66] kmem_cache_free+0xf8/0x330 [ 33.657351][ T66] cleanup_net+0x5a8/0xb90 [ 33.657483][ T66] process_one_work+0xe55/0x16d0 [ 33.657610][ T66] worker_thread+0x58c/0xce0 [ 33.657733][ T66] kthread+0x28a/0x350 [ 33.657844][ T66] ret_from_fork+0x31/0x70 [ 33.657969][ T66] ret_from_fork_asm+0x1a/0x30 [ 33.658094][ T66] [ 33.658157][ T66] Last potentially related work creation: [ 33.658283][ T66] kasan_save_stack+0x24/0x50 [ 33.658406][ T66] __kasan_record_aux_stack+0x8e/0xa0 [ 33.658537][ T66] insert_work+0x34/0x230 [ 33.658636][ T66] __queue_work+0x5fd/0xa40 [ 33.658763][ T66] queue_delayed_work_on+0x8c/0xa0 [ 33.658888][ T66] __inet_insert_ifa+0x751/0xb10 [ 33.659024][ T66] inet_rtm_newaddr+0x833/0xbd0 [ 33.659146][ T66] rtnetlink_rcv_msg+0x712/0xc10 [ 33.659273][ T66] netlink_rcv_skb+0x130/0x360 [ 33.659402][ T66] netlink_unicast+0x44b/0x710 [ 33.659526][ T66] netlink_sendmsg+0x723/0xbe0 [ 33.659648][ T66] ____sys_sendmsg+0x7ac/0xa10 [ 33.659774][ T66] ___sys_sendmsg+0xee/0x170 [ 33.659901][ T66] __sys_sendmsg+0x109/0x1a0 [ 33.660030][ T66] do_syscall_64+0xc1/0x1d0 [ 33.660161][ T66] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.660320][ T66] [ 33.660388][ T66] Second to last potentially related work creation: [ 33.660547][ T66] kasan_save_stack+0x24/0x50 [ 33.660678][ T66] __kasan_record_aux_stack+0x8e/0xa0 [ 33.660812][ T66] insert_work+0x34/0x230 [ 33.660908][ T66] __queue_work+0x5fd/0xa40 [ 33.661035][ T66] queue_delayed_work_on+0x8c/0xa0 [ 33.661164][ T66] __inet_insert_ifa+0x751/0xb10 [ 33.661292][ T66] inet_rtm_newaddr+0x833/0xbd0 [ 33.661423][ T66] rtnetlink_rcv_msg+0x712/0xc10 [ 33.661552][ T66] netlink_rcv_skb+0x130/0x360 [ 33.661683][ T66] netlink_unicast+0x44b/0x710 [ 33.661815][ T66] netlink_sendmsg+0x723/0xbe0 [ 33.661948][ T66] ____sys_sendmsg+0x7ac/0xa10 [ 33.662078][ T66] ___sys_sendmsg+0xee/0x170 [ 33.662208][ T66] __sys_sendmsg+0x109/0x1a0 [ 33.662335][ T66] do_syscall_64+0xc1/0x1d0 [ 33.662461][ T66] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 33.662621][ T66] [ 33.662687][ T66] The buggy address belongs to the object at ffff88800b150040 [ 33.662687][ T66] which belongs to the cache net_namespace of size 6528 [ 33.663035][ T66] The buggy address is located 184 bytes inside of [ 33.663035][ T66] freed 6528-byte region [ffff88800b150040, ffff88800b1519c0) [ 33.663344][ T66] [ 33.663410][ T66] The buggy address belongs to the physical page: [ 33.663569][ T66] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb150 [ 33.663798][ T66] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.663992][ T66] flags: 0x80000000000040(head|node=0|zone=1) [ 33.664153][ T66] page_type: f5(slab) [ 33.664257][ T66] raw: 0080000000000040 ffff888001975240 ffff88800197a0a8 ffff88800197a0a8 [ 33.664485][ T66] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 33.664716][ T66] head: 0080000000000040 ffff888001975240 ffff88800197a0a8 ffff88800197a0a8 [ 33.664948][ T66] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 33.665173][ T66] head: 0080000000000003 ffffea00002c5401 ffffffffffffffff 0000000000000000 [ 33.665400][ T66] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 33.665624][ T66] page dumped because: kasan: bad access detected [ 33.665779][ T66] [ 33.665843][ T66] Memory state around the buggy address: [ 33.665970][ T66] ffff88800b14ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.666153][ T66] ffff88800b150000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 33.666344][ T66] >ffff88800b150080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.666528][ T66] ^ [ 33.666710][ T66] ffff88800b150100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.666893][ T66] ffff88800b150180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.667081][ T66] ================================================================== [ 33.667307][ T66] Disabling lock debugging due to kernel taint [ 33.727984][ T66] vx0: left allmulticast mode [ 33.728190][ T66] vx0: left promiscuous mode [ 33.728470][ T66] br0: port 2(vx0) entered disabled state [ 33.968884][ T66] vx0: left allmulticast mode [ 33.969087][ T66] vx0: left promiscuous mode [ 33.969361][ T66] br0: port 2(vx0) entered disabled state [ 38.406355][ T586] br0: port 1(swp1) entered blocking state [ 38.406636][ T586] br0: port 1(swp1) entered disabled state [ 38.406833][ T586] swp1: entered allmulticast mode [ 38.407744][ T586] swp1: entered promiscuous mode [ 38.587641][ T589] br0: port 2(vx0) entered blocking state [ 38.587902][ T589] br0: port 2(vx0) entered disabled state [ 38.588071][ T589] vx0: entered allmulticast mode [ 38.588979][ T589] vx0: entered promiscuous mode [ 38.589375][ T589] br0: port 2(vx0) entered blocking state [ 38.589525][ T589] br0: port 2(vx0) entered forwarding state [ 38.862677][ T292] br0: port 1(swp1) entered blocking state [ 38.862935][ T292] br0: port 1(swp1) entered forwarding state [ 39.576789][ T606] br0: port 1(swp1) entered blocking state [ 39.577084][ T606] br0: port 1(swp1) entered disabled state [ 39.577286][ T606] swp1: entered allmulticast mode [ 39.578216][ T606] swp1: entered promiscuous mode [ 39.581061][ T40] br0: port 1(swp1) entered blocking state [ 39.581297][ T40] br0: port 1(swp1) entered forwarding state [ 39.756298][ T609] br0: port 2(vx0) entered blocking state [ 39.756553][ T609] br0: port 2(vx0) entered disabled state [ 39.756717][ T609] vx0: entered allmulticast mode [ 39.757635][ T609] vx0: entered promiscuous mode [ 39.758196][ T609] br0: port 2(vx0) entered blocking state [ 39.758346][ T609] br0: port 2(vx0) entered forwarding state [ 61.457390][ T66] br0: port 1(swp1) entered disabled state [ 61.553517][ T66] swp1 (unregistering): left allmulticast mode [ 61.553742][ T66] swp1 (unregistering): left promiscuous mode [ 61.553920][ T66] br0: port 1(swp1) entered disabled state [ 61.676960][ T66] br0: port 1(swp1) entered disabled state [ 61.836410][ T66] swp1 (unregistering): left allmulticast mode [ 61.836626][ T66] swp1 (unregistering): left promiscuous mode [ 61.836808][ T66] br0: port 1(swp1) entered disabled state [ 61.878339][ T66] vx0: left allmulticast mode [ 61.878510][ T66] vx0: left promiscuous mode [ 61.878769][ T66] br0: port 2(vx0) entered disabled state [ 62.122501][ T66] vx0: left allmulticast mode [ 62.122685][ T66] vx0: left promiscuous mode [ 62.122937][ T66] br0: port 2(vx0) entered disabled state [ 66.662671][ T847] br0: port 1(swp1) entered blocking state [ 66.662962][ T847] br0: port 1(swp1) entered disabled state [ 66.663338][ T847] swp1: entered allmulticast mode [ 66.664263][ T847] swp1: entered promiscuous mode [ 66.839727][ T850] br0: port 2(vx0) entered blocking state [ 66.839995][ T850] br0: port 2(vx0) entered disabled state [ 66.840180][ T850] vx0: entered allmulticast mode [ 66.841087][ T850] vx0: entered promiscuous mode [ 66.841656][ T850] br0: port 2(vx0) entered blocking state [ 66.841806][ T850] br0: port 2(vx0) entered forwarding state [ 67.151618][ T45] br0: port 1(swp1) entered blocking state [ 67.151838][ T45] br0: port 1(swp1) entered forwarding state [ 67.787086][ T867] br0: port 1(swp1) entered blocking state [ 67.787406][ T867] br0: port 1(swp1) entered disabled state [ 67.787604][ T867] swp1: entered allmulticast mode [ 67.788518][ T867] swp1: entered promiscuous mode [ 67.791747][ T45] br0: port 1(swp1) entered blocking state [ 67.791963][ T45] br0: port 1(swp1) entered forwarding state [ 67.966752][ T870] br0: port 2(vx0) entered blocking state [ 67.967036][ T870] br0: port 2(vx0) entered disabled state [ 67.967226][ T870] vx0: entered allmulticast mode [ 67.968185][ T870] vx0: entered promiscuous mode [ 67.968612][ T870] br0: port 2(vx0) entered blocking state [ 67.968782][ T870] br0: port 2(vx0) entered forwarding state [ 79.050229][ T66] br0: port 1(swp1) entered disabled state [ 79.139449][ T66] swp1 (unregistering): left allmulticast mode [ 79.139662][ T66] swp1 (unregistering): left promiscuous mode [ 79.139883][ T66] br0: port 1(swp1) entered disabled state [ 79.277032][ T66] br0: port 1(swp1) entered disabled state [ 79.372002][ T66] swp1 (unregistering): left allmulticast mode [ 79.372221][ T66] swp1 (unregistering): left promiscuous mode [ 79.372405][ T66] br0: port 1(swp1) entered disabled state [ 79.474041][ T66] vx0: left allmulticast mode [ 79.474234][ T66] vx0: left promiscuous mode [ 79.474479][ T66] br0: port 2(vx0) entered disabled state [ 79.697288][ T66] vx0: left allmulticast mode [ 79.697568][ T66] vx0: left promiscuous mode [ 79.697827][ T66] br0: port 2(vx0) entered disabled state [ 83.885532][ T1099] br0: port 1(swp1) entered blocking state [ 83.885783][ T1099] br0: port 1(swp1) entered disabled state [ 83.885995][ T1099] swp1: entered allmulticast mode [ 83.886912][ T1099] swp1: entered promiscuous mode [ 84.055474][ T1102] br0: port 2(vx0) entered blocking state [ 84.055697][ T1102] br0: port 2(vx0) entered disabled state [ 84.055873][ T1102] vx0: entered allmulticast mode [ 84.057045][ T1102] vx0: entered promiscuous mode [ 84.057617][ T1102] br0: port 2(vx0) entered blocking state [ 84.057798][ T1102] br0: port 2(vx0) entered forwarding state [ 84.431537][ T124] br0: port 1(swp1) entered blocking state [ 84.431759][ T124] br0: port 1(swp1) entered forwarding state [ 84.998911][ T1119] br0: port 1(swp1) entered blocking state [ 84.999239][ T1119] br0: port 1(swp1) entered disabled state [ 84.999470][ T1119] swp1: entered allmulticast mode [ 85.000379][ T1119] swp1: entered promiscuous mode [ 85.009752][ T292] br0: port 1(swp1) entered blocking state [ 85.009952][ T292] br0: port 1(swp1) entered forwarding state [ 85.173529][ T1122] br0: port 2(vx0) entered blocking state [ 85.173776][ T1122] br0: port 2(vx0) entered disabled state [ 85.173939][ T1122] vx0: entered allmulticast mode [ 85.174858][ T1122] vx0: entered promiscuous mode [ 85.175409][ T1122] br0: port 2(vx0) entered blocking state [ 85.175559][ T1122] br0: port 2(vx0) entered forwarding state [ 96.129301][ T66] br0: port 1(swp1) entered disabled state [ 96.231879][ T66] swp1 (unregistering): left allmulticast mode [ 96.232140][ T66] swp1 (unregistering): left promiscuous mode [ 96.232343][ T66] br0: port 1(swp1) entered disabled state [ 96.352919][ T66] br0: port 1(swp1) entered disabled state [ 96.452269][ T66] swp1 (unregistering): left allmulticast mode [ 96.452477][ T66] swp1 (unregistering): left promiscuous mode [ 96.452646][ T66] br0: port 1(swp1) entered disabled state [ 96.567925][ T66] vx0: left allmulticast mode [ 96.568099][ T66] vx0: left promiscuous mode [ 96.568375][ T66] br0: port 2(vx0) entered disabled state [ 96.807375][ T66] vx0: left allmulticast mode [ 96.807579][ T66] vx0: left promiscuous mode [ 96.807824][ T66] br0: port 2(vx0) entered disabled state