====================================== | [ 9.040217] ------------[ cut here ]------------ | [ 9.040291] refcount_t: underflow; use-after-free. | [ 9.040345] WARNING: CPU: 1 PID: 12 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 9.040410] Modules linked in: vxlan [ 9.040507] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 9.040550] Workqueue: netns cleanup_net [ 9.040584] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 9.040625] Code: 84 e8 e8 54 ba ff 90 0f 0b 90 90 c3 80 3d 00 e6 2b 01 00 75 89 c6 05 f7 e5 2b 01 01 90 48 c7 c7 f8 48 b5 84 e8 c5 54 ba ff 90 <0f> 0b 90 90 c3 80 3d db e5 2b 01 00 0f 85 62 ff ff ff c6 05 ce e5 All code ======== 0: 84 e8 test %ch,%al 2: e8 54 ba ff 90 call 0xffffffff90ffba5b 7: 0f 0b ud2 9: 90 nop a: 90 nop b: c3 ret c: 80 3d 00 e6 2b 01 00 cmpb $0x0,0x12be600(%rip) # 0x12be613 13: 75 89 jne 0xffffffffffffff9e 15: c6 05 f7 e5 2b 01 01 movb $0x1,0x12be5f7(%rip) # 0x12be613 1c: 90 nop 1d: 48 c7 c7 f8 48 b5 84 mov $0xffffffff84b548f8,%rdi 24: e8 c5 54 ba ff call 0xffffffffffba54ee 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: c3 ret 2f: 80 3d db e5 2b 01 00 cmpb $0x0,0x12be5db(%rip) # 0x12be611 36: 0f 85 62 ff ff ff jne 0xffffffffffffff9e 3c: c6 .byte 0xc6 3d: 05 .byte 0x5 3e: ce (bad) 3f: e5 .byte 0xe5 Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: c3 ret 5: 80 3d db e5 2b 01 00 cmpb $0x0,0x12be5db(%rip) # 0x12be5e7 c: 0f 85 62 ff ff ff jne 0xffffffffffffff74 12: c6 .byte 0xc6 13: 05 .byte 0x5 14: ce (bad) 15: e5 .byte 0xe5 [ 9.040749] RSP: 0018:ffffacbcc0067d50 EFLAGS: 00010286 [ 9.040789] RAX: 0000000000000000 RBX: ffffacbcc0067d60 RCX: 00000000ffffdfff [ 9.040840] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001 [ 9.040890] RBP: ffffacbcc0067858 R08: ffffffff8535ba28 R09: 00000000ffffdfff [ 9.040949] R10: ffffffff8527ba40 R11: ffffffff8532ba40 R12: dead000000000122 [ 9.041006] R13: 00000000fffb8ef3 R14: 0000000000000001 R15: ffff9dc9c5cf8000 [ 9.041058] FS: 0000000000000000(0000) GS:ffff9dca79211000(0000) knlGS:0000000000000000 [ 9.041114] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.041161] CR2: 00007fd4cef3f000 CR3: 0000000022646004 CR4: 0000000000772ef0 [ 9.041224] PKRU: 55555554 [ 9.041247] Call Trace: [ 9.041266] [ 9.041287] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 9.041320] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 9.041352] cleanup_net (net/core/net_namespace.c:698) [ 9.041383] process_one_work (kernel/workqueue.c:3268) [ 9.041416] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 9.041447] ? rescuer_thread (kernel/workqueue.c:3373) [ 9.041479] kthread (kernel/kthread.c:463) [ 9.041510] ? kthreads_online_cpu (kernel/kthread.c:412) [ 9.041545] ? kthreads_online_cpu (kernel/kthread.c:412) [ 9.041579] ret_from_fork (arch/x86/kernel/process.c:164) [ 9.041610] ? kthreads_online_cpu (kernel/kthread.c:412) Finger prints: refcount_warn_saturate:netdev_run_todo:ops_undo_list:cleanup_net:process_one_work