[ 17.282744][ T319] br0: port 1(swp1) entered blocking state [ 17.283364][ T319] br0: port 1(swp1) entered disabled state [ 17.283947][ T319] swp1: entered allmulticast mode [ 17.285767][ T319] swp1: entered promiscuous mode [ 17.705482][ T40] br0: port 1(swp1) entered blocking state [ 17.706351][ T40] br0: port 1(swp1) entered forwarding state [ 17.731386][ T322] br0: port 2(vx0) entered blocking state [ 17.732003][ T322] br0: port 2(vx0) entered disabled state [ 17.732332][ T322] vx0: entered allmulticast mode [ 17.734220][ T322] vx0: entered promiscuous mode [ 17.735891][ T322] br0: port 2(vx0) entered blocking state [ 17.736231][ T322] br0: port 2(vx0) entered forwarding state [ 19.227984][ T341] br0: port 1(swp1) entered blocking state [ 19.228246][ T341] br0: port 1(swp1) entered disabled state [ 19.228492][ T341] swp1: entered allmulticast mode [ 19.229708][ T341] swp1: entered promiscuous mode [ 19.233142][ T37] br0: port 1(swp1) entered blocking state [ 19.233411][ T37] br0: port 1(swp1) entered forwarding state [ 19.467235][ T344] br0: port 2(vx0) entered blocking state [ 19.467580][ T344] br0: port 2(vx0) entered disabled state [ 19.467867][ T344] vx0: entered allmulticast mode [ 19.469115][ T344] vx0: entered promiscuous mode [ 19.470182][ T344] br0: port 2(vx0) entered blocking state [ 19.470387][ T344] br0: port 2(vx0) entered forwarding state [ 25.579263][ T360] GACT probability NOT on [ 35.797169][ T67] br0: port 1(swp1) entered disabled state [ 35.975184][ T67] swp1 (unregistering): left allmulticast mode [ 35.975569][ T67] swp1 (unregistering): left promiscuous mode [ 35.975784][ T67] br0: port 1(swp1) entered disabled state [ 36.118331][ T67] br0: port 1(swp1) entered disabled state [ 36.267174][ T67] swp1 (unregistering): left allmulticast mode [ 36.267434][ T67] swp1 (unregistering): left promiscuous mode [ 36.267675][ T67] br0: port 1(swp1) entered disabled state [ 36.316927][ T67] ================================================================== [ 36.317237][ T67] BUG: KASAN: slab-use-after-free in cleanup_net+0xa5d/0xb90 [ 36.317468][ T67] Read of size 8 at addr ffff8880025f00f8 by task kworker/u16:1/67 [ 36.317688][ T67] [ 36.317763][ T67] CPU: 1 UID: 0 PID: 67 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 36.317986][ T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 36.318169][ T67] Workqueue: netns cleanup_net [ 36.318321][ T67] Call Trace: [ 36.318429][ T67] [ 36.318508][ T67] dump_stack_lvl+0x82/0xd0 [ 36.318663][ T67] print_address_description.constprop.0+0x2c/0x3b0 [ 36.318846][ T67] ? cleanup_net+0xa5d/0xb90 [ 36.318991][ T67] print_report+0xb4/0x270 [ 36.319137][ T67] ? kasan_addr_to_slab+0x25/0x80 [ 36.319280][ T67] kasan_report+0xbd/0xf0 [ 36.319388][ T67] ? cleanup_net+0xa5d/0xb90 [ 36.319534][ T67] cleanup_net+0xa5d/0xb90 [ 36.319680][ T67] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 36.319831][ T67] ? __pfx_cleanup_net+0x10/0x10 [ 36.319971][ T67] ? trace_lock_acquire+0x148/0x1f0 [ 36.320119][ T67] ? lock_acquire+0x32/0xc0 [ 36.320275][ T67] ? process_one_work+0xe0b/0x16d0 [ 36.320435][ T67] process_one_work+0xe55/0x16d0 [ 36.320578][ T67] ? __pfx___lock_release+0x10/0x10 [ 36.320719][ T67] ? __pfx_process_one_work+0x10/0x10 [ 36.320865][ T67] ? assign_work+0x16c/0x240 [ 36.321007][ T67] worker_thread+0x58c/0xce0 [ 36.321148][ T67] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 36.321323][ T67] ? __pfx_worker_thread+0x10/0x10 [ 36.321465][ T67] ? __pfx_worker_thread+0x10/0x10 [ 36.321603][ T67] kthread+0x28a/0x350 [ 36.321710][ T67] ? __pfx_kthread+0x10/0x10 [ 36.321848][ T67] ret_from_fork+0x31/0x70 [ 36.321988][ T67] ? __pfx_kthread+0x10/0x10 [ 36.322122][ T67] ret_from_fork_asm+0x1a/0x30 [ 36.322265][ T67] [ 36.322368][ T67] [ 36.322437][ T67] Allocated by task 264: [ 36.322549][ T67] kasan_save_stack+0x24/0x50 [ 36.322689][ T67] kasan_save_track+0x14/0x30 [ 36.322824][ T67] __kasan_slab_alloc+0x59/0x70 [ 36.322959][ T67] kmem_cache_alloc_noprof+0x10b/0x350 [ 36.323101][ T67] copy_net_ns+0xc6/0x540 [ 36.323203][ T67] create_new_namespaces+0x35f/0x920 [ 36.323343][ T67] unshare_nsproxy_namespaces+0x8a/0x1b0 [ 36.323480][ T67] ksys_unshare+0x2c4/0x6e0 [ 36.323622][ T67] __x64_sys_unshare+0x31/0x40 [ 36.323759][ T67] do_syscall_64+0xc1/0x1d0 [ 36.323900][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.324078][ T67] [ 36.324166][ T67] Freed by task 67: [ 36.324273][ T67] kasan_save_stack+0x24/0x50 [ 36.324413][ T67] kasan_save_track+0x14/0x30 [ 36.324551][ T67] kasan_save_free_info+0x3b/0x60 [ 36.324689][ T67] __kasan_slab_free+0x38/0x50 [ 36.324829][ T67] kmem_cache_free+0xf8/0x330 [ 36.324969][ T67] cleanup_net+0x5a8/0xb90 [ 36.325111][ T67] process_one_work+0xe55/0x16d0 [ 36.325248][ T67] worker_thread+0x58c/0xce0 [ 36.325387][ T67] kthread+0x28a/0x350 [ 36.325492][ T67] ret_from_fork+0x31/0x70 [ 36.325630][ T67] ret_from_fork_asm+0x1a/0x30 [ 36.325769][ T67] [ 36.325840][ T67] Last potentially related work creation: [ 36.325977][ T67] kasan_save_stack+0x24/0x50 [ 36.326120][ T67] __kasan_record_aux_stack+0x8e/0xa0 [ 36.326260][ T67] insert_work+0x34/0x230 [ 36.326364][ T67] __queue_work+0x5fd/0xa40 [ 36.326504][ T67] queue_delayed_work_on+0x8c/0xa0 [ 36.326643][ T67] __inet_insert_ifa+0x751/0xb10 [ 36.326786][ T67] inet_rtm_newaddr+0x833/0xbd0 [ 36.326924][ T67] rtnetlink_rcv_msg+0x712/0xc10 [ 36.327068][ T67] netlink_rcv_skb+0x130/0x360 [ 36.327216][ T67] netlink_unicast+0x44b/0x710 [ 36.327354][ T67] netlink_sendmsg+0x723/0xbe0 [ 36.327497][ T67] ____sys_sendmsg+0x7ac/0xa10 [ 36.327643][ T67] ___sys_sendmsg+0xee/0x170 [ 36.327785][ T67] __sys_sendmsg+0x109/0x1a0 [ 36.327925][ T67] do_syscall_64+0xc1/0x1d0 [ 36.328066][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.328237][ T67] [ 36.328311][ T67] Second to last potentially related work creation: [ 36.328481][ T67] kasan_save_stack+0x24/0x50 [ 36.328622][ T67] __kasan_record_aux_stack+0x8e/0xa0 [ 36.328762][ T67] insert_work+0x34/0x230 [ 36.328880][ T67] __queue_work+0x5fd/0xa40 [ 36.329016][ T67] queue_delayed_work_on+0x8c/0xa0 [ 36.329153][ T67] __inet_insert_ifa+0x751/0xb10 [ 36.329293][ T67] inet_rtm_newaddr+0x833/0xbd0 [ 36.329431][ T67] rtnetlink_rcv_msg+0x712/0xc10 [ 36.329570][ T67] netlink_rcv_skb+0x130/0x360 [ 36.329708][ T67] netlink_unicast+0x44b/0x710 [ 36.329844][ T67] netlink_sendmsg+0x723/0xbe0 [ 36.329984][ T67] ____sys_sendmsg+0x7ac/0xa10 [ 36.330120][ T67] ___sys_sendmsg+0xee/0x170 [ 36.330257][ T67] __sys_sendmsg+0x109/0x1a0 [ 36.330395][ T67] do_syscall_64+0xc1/0x1d0 [ 36.330534][ T67] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.330707][ T67] [ 36.330777][ T67] The buggy address belongs to the object at ffff8880025f0040 [ 36.330777][ T67] which belongs to the cache net_namespace of size 6528 [ 36.331139][ T67] The buggy address is located 184 bytes inside of [ 36.331139][ T67] freed 6528-byte region [ffff8880025f0040, ffff8880025f19c0) [ 36.331485][ T67] [ 36.331555][ T67] The buggy address belongs to the physical page: [ 36.331724][ T67] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25f0 [ 36.331966][ T67] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 36.332192][ T67] flags: 0x80000000000040(head|node=0|zone=1) [ 36.332374][ T67] page_type: f5(slab) [ 36.332484][ T67] raw: 0080000000000040 ffff888001975240 ffff88800197a0a8 ffff88800197a0a8 [ 36.332734][ T67] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 36.332987][ T67] head: 0080000000000040 ffff888001975240 ffff88800197a0a8 ffff88800197a0a8 [ 36.333228][ T67] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 36.333469][ T67] head: 0080000000000003 ffffea0000097c01 ffffffffffffffff 0000000000000000 [ 36.333708][ T67] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 36.333947][ T67] page dumped because: kasan: bad access detected [ 36.334114][ T67] [ 36.334182][ T67] Memory state around the buggy address: [ 36.334334][ T67] ffff8880025eff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.334553][ T67] ffff8880025f0000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 36.334755][ T67] >ffff8880025f0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.334958][ T67] ^ [ 36.335156][ T67] ffff8880025f0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.335360][ T67] ffff8880025f0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.335562][ T67] ================================================================== [ 36.335816][ T67] Disabling lock debugging due to kernel taint [ 36.408243][ T67] vx0: left allmulticast mode [ 36.408501][ T67] vx0: left promiscuous mode [ 36.408783][ T67] br0: port 2(vx0) entered disabled state [ 36.763592][ T67] vx0: left allmulticast mode [ 36.763912][ T67] vx0: left promiscuous mode [ 36.764361][ T67] br0: port 2(vx0) entered disabled state [ 41.667984][ T586] br0: port 1(swp1) entered blocking state [ 41.668251][ T586] br0: port 1(swp1) entered disabled state [ 41.668460][ T586] swp1: entered allmulticast mode [ 41.669487][ T586] swp1: entered promiscuous mode [ 41.874204][ T589] br0: port 2(vx0) entered blocking state [ 41.874568][ T589] br0: port 2(vx0) entered disabled state [ 41.874747][ T589] vx0: entered allmulticast mode [ 41.875749][ T589] vx0: entered promiscuous mode [ 41.876356][ T589] br0: port 2(vx0) entered blocking state [ 41.876529][ T589] br0: port 2(vx0) entered forwarding state [ 41.960167][ T40] br0: port 1(swp1) entered blocking state [ 41.960454][ T40] br0: port 1(swp1) entered forwarding state [ 42.978165][ T606] br0: port 1(swp1) entered blocking state [ 42.978416][ T606] br0: port 1(swp1) entered disabled state [ 42.978638][ T606] swp1: entered allmulticast mode [ 42.979647][ T606] swp1: entered promiscuous mode [ 42.982336][ T40] br0: port 1(swp1) entered blocking state [ 42.982587][ T40] br0: port 1(swp1) entered forwarding state [ 43.160096][ T609] br0: port 2(vx0) entered blocking state [ 43.160315][ T609] br0: port 2(vx0) entered disabled state [ 43.160501][ T609] vx0: entered allmulticast mode [ 43.161526][ T609] vx0: entered promiscuous mode [ 43.162019][ T609] br0: port 2(vx0) entered blocking state [ 43.162194][ T609] br0: port 2(vx0) entered forwarding state [ 65.545644][ T67] br0: port 1(swp1) entered disabled state [ 65.651760][ T67] swp1 (unregistering): left allmulticast mode [ 65.651985][ T67] swp1 (unregistering): left promiscuous mode [ 65.652158][ T67] br0: port 1(swp1) entered disabled state [ 65.830109][ T67] br0: port 1(swp1) entered disabled state [ 65.985968][ T67] swp1 (unregistering): left allmulticast mode [ 65.986211][ T67] swp1 (unregistering): left promiscuous mode [ 65.986397][ T67] br0: port 1(swp1) entered disabled state [ 66.066777][ T67] vx0: left allmulticast mode [ 66.066966][ T67] vx0: left promiscuous mode [ 66.067214][ T67] br0: port 2(vx0) entered disabled state [ 66.316963][ T67] vx0: left allmulticast mode [ 66.317144][ T67] vx0: left promiscuous mode [ 66.317407][ T67] br0: port 2(vx0) entered disabled state [ 70.650132][ T846] br0: port 1(swp1) entered blocking state [ 70.650417][ T846] br0: port 1(swp1) entered disabled state [ 70.650605][ T846] swp1: entered allmulticast mode [ 70.651496][ T846] swp1: entered promiscuous mode [ 70.820895][ T849] br0: port 2(vx0) entered blocking state [ 70.821129][ T849] br0: port 2(vx0) entered disabled state [ 70.821298][ T849] vx0: entered allmulticast mode [ 70.822239][ T849] vx0: entered promiscuous mode [ 70.822645][ T849] br0: port 2(vx0) entered blocking state [ 70.822804][ T849] br0: port 2(vx0) entered forwarding state [ 71.142972][ T293] br0: port 1(swp1) entered blocking state [ 71.143214][ T293] br0: port 1(swp1) entered forwarding state [ 71.779630][ T866] br0: port 1(swp1) entered blocking state [ 71.779907][ T866] br0: port 1(swp1) entered disabled state [ 71.780093][ T866] swp1: entered allmulticast mode [ 71.780987][ T866] swp1: entered promiscuous mode [ 71.783746][ T40] br0: port 1(swp1) entered blocking state [ 71.783966][ T40] br0: port 1(swp1) entered forwarding state [ 71.960263][ T869] br0: port 2(vx0) entered blocking state [ 71.960531][ T869] br0: port 2(vx0) entered disabled state [ 71.960697][ T869] vx0: entered allmulticast mode [ 71.961615][ T869] vx0: entered promiscuous mode [ 71.961997][ T869] br0: port 2(vx0) entered blocking state [ 71.962148][ T869] br0: port 2(vx0) entered forwarding state [ 83.180484][ T67] br0: port 1(swp1) entered disabled state [ 83.269869][ T67] swp1 (unregistering): left allmulticast mode [ 83.270087][ T67] swp1 (unregistering): left promiscuous mode [ 83.270265][ T67] br0: port 1(swp1) entered disabled state [ 83.405456][ T67] br0: port 1(swp1) entered disabled state [ 83.509200][ T67] swp1 (unregistering): left allmulticast mode [ 83.509397][ T67] swp1 (unregistering): left promiscuous mode [ 83.509579][ T67] br0: port 1(swp1) entered disabled state [ 83.613249][ T67] vx0: left allmulticast mode [ 83.613476][ T67] vx0: left promiscuous mode [ 83.613758][ T67] br0: port 2(vx0) entered disabled state [ 83.846956][ T67] vx0: left allmulticast mode [ 83.847129][ T67] vx0: left promiscuous mode [ 83.847380][ T67] br0: port 2(vx0) entered disabled state [ 88.154620][ T1098] br0: port 1(swp1) entered blocking state [ 88.154830][ T1098] br0: port 1(swp1) entered disabled state [ 88.155018][ T1098] swp1: entered allmulticast mode [ 88.155935][ T1098] swp1: entered promiscuous mode [ 88.333032][ T1101] br0: port 2(vx0) entered blocking state [ 88.333311][ T1101] br0: port 2(vx0) entered disabled state [ 88.333498][ T1101] vx0: entered allmulticast mode [ 88.334414][ T1101] vx0: entered promiscuous mode [ 88.334967][ T1101] br0: port 2(vx0) entered blocking state [ 88.335132][ T1101] br0: port 2(vx0) entered forwarding state [ 88.679895][ T38] br0: port 1(swp1) entered blocking state [ 88.680118][ T38] br0: port 1(swp1) entered forwarding state [ 89.305154][ T1118] br0: port 1(swp1) entered blocking state [ 89.305434][ T1118] br0: port 1(swp1) entered disabled state [ 89.306463][ T1118] swp1: entered allmulticast mode [ 89.307376][ T1118] swp1: entered promiscuous mode [ 89.310288][ T37] br0: port 1(swp1) entered blocking state [ 89.310527][ T37] br0: port 1(swp1) entered forwarding state [ 89.482379][ T1121] br0: port 2(vx0) entered blocking state [ 89.482645][ T1121] br0: port 2(vx0) entered disabled state [ 89.482799][ T1121] vx0: entered allmulticast mode [ 89.483722][ T1121] vx0: entered promiscuous mode [ 89.484139][ T1121] br0: port 2(vx0) entered blocking state [ 89.484285][ T1121] br0: port 2(vx0) entered forwarding state [ 100.630379][ T67] br0: port 1(swp1) entered disabled state [ 100.804062][ T67] swp1 (unregistering): left allmulticast mode [ 100.804361][ T67] swp1 (unregistering): left promiscuous mode [ 100.804632][ T67] br0: port 1(swp1) entered disabled state [ 100.899620][ T67] br0: port 1(swp1) entered disabled state [ 101.028897][ T67] swp1 (unregistering): left allmulticast mode [ 101.029125][ T67] swp1 (unregistering): left promiscuous mode [ 101.029312][ T67] br0: port 1(swp1) entered disabled state [ 101.109228][ T67] vx0: left allmulticast mode [ 101.109421][ T67] vx0: left promiscuous mode [ 101.109697][ T67] br0: port 2(vx0) entered disabled state [ 101.357676][ T67] vx0: left allmulticast mode [ 101.357863][ T67] vx0: left promiscuous mode [ 101.358114][ T67] br0: port 2(vx0) entered disabled state