[ 4076.575710][ T67] ==================================================================
[ 4076.575998][ T67] BUG: KASAN: use-after-free in page_pool_item_uninit+0x100/0x130
[ 4076.576250][ T67] Read of size 8 at addr ffff88800ac7d008 by task kworker/u16:1/67
[ 4076.576495][ T67]
[ 4076.576587][ T67] CPU: 3 UID: 0 PID: 67 Comm: kworker/u16:1 Not tainted 6.13.0-rc5-virtme #1
[ 4076.576880][ T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4076.577082][ T67] Workqueue: netns cleanup_net
[ 4076.577258][ T67] Call Trace:
[ 4076.577382][ T67]
[ 4076.577470][ T67] dump_stack_lvl+0x82/0xd0
[ 4076.577645][ T67] print_address_description.constprop.0+0x2c/0x3b0
[ 4076.577857][ T67] ? page_pool_item_uninit+0x100/0x130
[ 4076.578022][ T67] print_report+0xb4/0x270
[ 4076.578186][ T67] ? kasan_addr_to_slab+0x25/0x80
[ 4076.578354][ T67] kasan_report+0xbd/0xf0
[ 4076.578477][ T67] ? page_pool_item_uninit+0x100/0x130
[ 4076.578651][ T67] page_pool_item_uninit+0x100/0x130
[ 4076.578820][ T67] page_pool_release+0x44a/0x5b0
[ 4076.578985][ T67] ? __folio_put+0x1a0/0x280
[ 4076.579151][ T67] ? __pfx_page_pool_release+0x10/0x10
[ 4076.579317][ T67] ? __page_pool_return_page+0x27c/0x3c0
[ 4076.579485][ T67] page_pool_destroy+0x11e/0x560
[ 4076.579648][ T67] veth_napi_del_range+0x34d/0x580
[ 4076.579820][ T67] ? mark_held_locks+0x9e/0xe0
[ 4076.579999][ T67] veth_disable_xdp+0x24e/0x2d0
[ 4076.580164][ T67] veth_close+0x8e/0x190
[ 4076.580286][ T67] __dev_close_many+0x1a0/0x2d0
[ 4076.580445][ T67] ? __pfx___dev_close_many+0x10/0x10
[ 4076.580611][ T67] dev_close_many+0x202/0x650
[ 4076.580769][ T67] ? fou_exit_net+0x2f/0xf0
[ 4076.580934][ T67] ? __pfx_dev_close_many+0x10/0x10
[ 4076.581097][ T67] ? __mutex_trylock_common+0xfa/0x260
[ 4076.581258][ T67] ? __pfx___mutex_trylock_common+0x10/0x10
[ 4076.581464][ T67] unregister_netdevice_many_notify+0x8ed/0x1580
[ 4076.581669][ T67] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 4076.581874][ T67] ? default_device_exit_batch+0x81/0x2e0
[ 4076.582045][ T67] ? mutex_is_locked+0x1c/0x60
[ 4076.582209][ T67] ? rtnl_is_locked+0x15/0x20
[ 4076.582373][ T67] ? unregister_netdevice_queue+0x70/0x410
[ 4076.582572][ T67] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 4076.582779][ T67] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 4076.582977][ T67] default_device_exit_batch+0x241/0x2e0
[ 4076.583139][ T67] ? __pfx_default_device_exit_batch+0x10/0x10
[ 4076.583340][ T67] ? ops_exit_list+0xb4/0x170
[ 4076.583500][ T67] cleanup_net+0x4ef/0xba0
[ 4076.583665][ T67] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 4076.583827][ T67] ? __pfx_cleanup_net+0x10/0x10
[ 4076.583990][ T67] ? trace_lock_acquire+0x14c/0x1f0
[ 4076.584154][ T67] ? lock_acquire+0x32/0xc0
[ 4076.584334][ T67] ? process_one_work+0xe0b/0x16d0
[ 4076.584505][ T67] process_one_work+0xe55/0x16d0
[ 4076.584668][ T67] ? __pfx___lock_release+0x10/0x10
[ 4076.584836][ T67] ? __pfx_process_one_work+0x10/0x10
[ 4076.584999][ T67] ? assign_work+0x16c/0x240
[ 4076.585162][ T67] worker_thread+0x58c/0xce0
[ 4076.585321][ T67] ? lockdep_hardirqs_on_prepare+0x275/0x410
[ 4076.585523][ T67] ? __pfx_worker_thread+0x10/0x10
[ 4076.585683][ T67] ? __pfx_worker_thread+0x10/0x10
[ 4076.585843][ T67] kthread+0x28a/0x350
[ 4076.585971][ T67] ? __pfx_kthread+0x10/0x10
[ 4076.586142][ T67] ret_from_fork+0x31/0x70
[ 4076.586309][ T67] ? __pfx_kthread+0x10/0x10
[ 4076.586469][ T67] ret_from_fork_asm+0x1a/0x30
[ 4076.586636][ T67]
[ 4076.586761][ T67]
[ 4076.586844][ T67] The buggy address belongs to the physical page:
[ 4076.587124][ T67] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xac7d
[ 4076.587410][ T67] flags: 0x80000000000000(node=0|zone=1)
[ 4076.587572][ T67] page_type: f5(slab)
[ 4076.587698][ T67] raw: 0080000000000000 ffff8880010427c0 ffffea0000263850 ffffea0000264510
[ 4076.587982][ T67] raw: 0000000000000000 0000000000190019 00000001f5000000 0000000000000000
[ 4076.588268][ T67] page dumped because: kasan: bad access detected
[ 4076.588471][ T67]
[ 4076.588557][ T67] Memory state around the buggy address:
[ 4076.588712][ T67] ffff88800ac7cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 4076.588953][ T67] ffff88800ac7cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 4076.589190][ T67] >ffff88800ac7d000: fc fc fa fb fc fc fc fc fc fc fc fc fc fc fc fc
[ 4076.589504][ T67] ^
[ 4076.589625][ T67] ffff88800ac7d080: fc fc fc fc fc fc fa fb fc fc fc fc fc fc fc fc
[ 4076.589855][ T67] ffff88800ac7d100: fc fc fc fc fc fc fc fc fc fc fa fb fc fc fc fc
[ 4076.590089][ T67] ==================================================================
[ 4076.590409][ T67] Disabling lock debugging due to kernel taint
[ 4076.590707][ T67] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 4076.591105][ T67] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7]
[ 4076.591374][ T67] CPU: 3 UID: 0 PID: 67 Comm: kworker/u16:1 Tainted: G B 6.13.0-rc5-virtme #1
[ 4076.591682][ T67] Tainted: [B]=BAD_PAGE
[ 4076.591888][ T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4076.592090][ T67] Workqueue: netns cleanup_net
[ 4076.592337][ T67] RIP: 0010:page_pool_item_uninit+0x7a/0x130
[ 4076.592538][ T67] Code: 8e 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
[ 4076.593088][ T67] RSP: 0018:ffffc90000487658 EFLAGS: 00010a06
[ 4076.593366][ T67] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff8d89f6e3
[ 4076.593602][ T67] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[ 4076.593834][ T67] RBP: fffffbfff1de4c78 R08: 0000000000000000 R09: fffffbfff21bf688
[ 4076.594064][ T67] R10: ffffffff90dfb447 R11: 205d373654202020 R12: ffff888012295a20
[ 4076.594404][ T67] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea0000264500
[ 4076.594730][ T67] FS: 0000000000000000(0000) GS:ffff88806d180000(0000) knlGS:0000000000000000
[ 4076.595001][ T67] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4076.595202][ T67] CR2: 00007f94b0dfef00 CR3: 000000001873a001 CR4: 0000000000772ef0
[ 4076.595445][ T67] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4076.595759][ T67] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4076.596069][ T67] PKRU: 55555554
[ 4076.596189][ T67] Call Trace:
[ 4076.596320][ T67]
[ 4076.596410][ T67] ? die_addr+0x41/0xa0
[ 4076.596544][ T67] ? exc_general_protection+0x14d/0x230
[ 4076.596706][ T67] ? asm_exc_general_protection+0x26/0x30
[ 4076.596874][ T67] ? page_pool_item_uninit+0x73/0x130
[ 4076.597035][ T67] ? page_pool_item_uninit+0x7a/0x130
[ 4076.597275][ T67] ? page_pool_item_uninit+0x73/0x130
[ 4076.597434][ T67] page_pool_release+0x44a/0x5b0
[ 4076.597596][ T67] ? __folio_put+0x1a0/0x280
[ 4076.597762][ T67] ? __pfx_page_pool_release+0x10/0x10
[ 4076.597921][ T67] ? __page_pool_return_page+0x27c/0x3c0
[ 4076.598082][ T67] page_pool_destroy+0x11e/0x560
[ 4076.598242][ T67] veth_napi_del_range+0x34d/0x580
[ 4076.598404][ T67] ? mark_held_locks+0x9e/0xe0
[ 4076.598563][ T67] veth_disable_xdp+0x24e/0x2d0
[ 4076.598803][ T67] veth_close+0x8e/0x190
[ 4076.598932][ T67] __dev_close_many+0x1a0/0x2d0
[ 4076.599090][ T67] ? __pfx___dev_close_many+0x10/0x10
[ 4076.599250][ T67] dev_close_many+0x202/0x650
[ 4076.599409][ T67] ? fou_exit_net+0x2f/0xf0
[ 4076.599651][ T67] ? __pfx_dev_close_many+0x10/0x10
[ 4076.599805][ T67] ? __mutex_trylock_common+0xfa/0x260
[ 4076.599964][ T67] ? __pfx___mutex_trylock_common+0x10/0x10
[ 4076.600166][ T67] unregister_netdevice_many_notify+0x8ed/0x1580
[ 4076.600369][ T67] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 4076.600640][ T67] ? default_device_exit_batch+0x81/0x2e0
[ 4076.600802][ T67] ? mutex_is_locked+0x1c/0x60
[ 4076.600958][ T67] ? rtnl_is_locked+0x15/0x20
[ 4076.601121][ T67] ? unregister_netdevice_queue+0x70/0x410
[ 4076.601403][ T67] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 4076.601606][ T67] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 4076.601824][ T67] default_device_exit_batch+0x241/0x2e0
[ 4076.601984][ T67] ? __pfx_default_device_exit_batch+0x10/0x10
[ 4076.602181][ T67] ? ops_exit_list+0xb4/0x170
[ 4076.602494][ T67] cleanup_net+0x4ef/0xba0
[ 4076.602644][ T67] ? __pfx_lock_acquire.part.0+0x10/0x10
[ 4076.602879][ T67] ? __pfx_cleanup_net+0x10/0x10
[ 4076.603027][ T67] ? trace_lock_acquire+0x14c/0x1f0
[ 4076.603176][ T67] ? lock_acquire+0x32/0xc0
[ 4076.603329][ T67] ? process_one_work+0xe0b/0x16d0
[ 4076.603485][ T67] process_one_work+0xe55/0x16d0
[ 4076.603642][ T67] ? __pfx___lock_release+0x10/0x10
[ 4076.603801][ T67] ? __pfx_process_one_work+0x10/0x10
[ 4076.603968][ T67] ? assign_work+0x16c/0x240
[ 4076.604128][ T67] worker_thread+0x58c/0xce0
[ 4076.604298][ T67] ? lockdep_hardirqs_on_prepare+0x275/0x410
[ 4076.604497][ T67] ? __pfx_worker_thread+0x10/0x10
[ 4076.604656][ T67] ? __pfx_worker_thread+0x10/0x10
[ 4076.604814][ T67] kthread+0x28a/0x350
[ 4076.604933][ T67] ? __pfx_kthread+0x10/0x10
[ 4076.605172][ T67] ret_from_fork+0x31/0x70
[ 4076.605329][ T67] ? __pfx_kthread+0x10/0x10
[ 4076.605491][ T67] ret_from_fork_asm+0x1a/0x30
[ 4076.605654][ T67]
[ 4076.605775][ T67] Modules linked in: cls_matchall geneve ip6_gre ip_gre gre cls_bpf netdevsim psample sha1_generic xfrm_user xt_policy nft_compat nf_tables libcrc32c act_gact cls_flower sch_ingress vxlan
[ 4076.606508][ T67] ---[ end trace 0000000000000000 ]---
[ 4076.606748][ T67] RIP: 0010:page_pool_item_uninit+0x7a/0x130
[ 4076.606947][ T67] Code: 8e 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
[ 4076.607557][ T67] RSP: 0018:ffffc90000487658 EFLAGS: 00010a06
[ 4076.607767][ T67] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff8d89f6e3
[ 4076.607994][ T67] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[ 4076.608226][ T67] RBP: fffffbfff1de4c78 R08: 0000000000000000 R09: fffffbfff21bf688
[ 4076.608518][ T67] R10: ffffffff90dfb447 R11: 205d373654202020 R12: ffff888012295a20
[ 4076.608760][ T67] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea0000264500
[ 4076.609069][ T67] FS: 0000000000000000(0000) GS:ffff88806d180000(0000) knlGS:0000000000000000
[ 4076.609485][ T67] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4076.609682][ T67] CR2: 00007f94b0dfef00 CR3: 000000001873a001 CR4: 0000000000772ef0
[ 4076.609925][ T67] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4076.610159][ T67] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4076.610525][ T67] PKRU: 55555554
[ 4076.610645][ T67] Kernel panic - not syncing: Fatal exception
[ 4076.611036][ T67] Kernel Offset: 0xa200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 4076.611385][ T67] ---[ end Kernel panic - not syncing: Fatal exception ]---
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr
WAIT TIMEOUT stderr