[ 87.227954][ T696] netdevsim netdevsim10 eni10np1: renamed from eth0 [ 87.245692][ T709] netdevsim netdevsim10 eni10np3: renamed from eth2 [ 92.888830][ T702] netdevsim netdevsim10 eni10np2: renamed from eth1 [ 92.893947][ T712] netdevsim netdevsim10 eni10np4: renamed from eth3 [ 92.901050][ T717] devlink (717) used greatest stack depth: 22256 bytes left [ 117.319586][ T770] netdevsim netdevsim10 eni10np1: renamed from eth0 [ 117.337576][ T767] netdevsim netdevsim10 eni10np4: renamed from eth3 [ 117.460414][ T775] netdevsim netdevsim10 eni10np3: renamed from eth2 [ 117.512750][ T765] netdevsim netdevsim10 eni10np2: renamed from eth1 [ 120.584579][ T770] netdevsim netdevsim10 eni10np2: renamed from eth1 [ 122.872241][ T11] ================================================================== [ 122.872594][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 122.872919][ T11] Read of size 8 at addr ffff88800da400f8 by task kworker/u16:0/11 [ 122.873219][ T11] [ 122.873337][ T11] CPU: 0 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 122.873665][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 122.873935][ T11] Workqueue: netns cleanup_net [ 122.874165][ T11] Call Trace: [ 122.874344][ T11] [ 122.874453][ T11] dump_stack_lvl+0x82/0xd0 [ 122.874672][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 122.874944][ T11] ? cleanup_net+0x932/0xa40 [ 122.875153][ T11] print_report+0xb4/0x270 [ 122.875413][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 122.875608][ T11] kasan_report+0xbd/0xf0 [ 122.875785][ T11] ? cleanup_net+0x932/0xa40 [ 122.876017][ T11] cleanup_net+0x932/0xa40 [ 122.876243][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 122.876474][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 122.876697][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 122.876921][ T11] ? lock_acquire+0x32/0xc0 [ 122.877123][ T11] ? process_one_work+0xe0b/0x16d0 [ 122.877293][ T11] process_one_work+0xe55/0x16d0 [ 122.877513][ T11] ? __pfx___lock_release+0x10/0x10 [ 122.877734][ T11] ? __pfx_process_one_work+0x10/0x10 [ 122.877954][ T11] ? assign_work+0x16c/0x240 [ 122.878176][ T11] worker_thread+0x58c/0xce0 [ 122.878406][ T11] ? __pfx_worker_thread+0x10/0x10 [ 122.878629][ T11] kthread+0x28a/0x350 [ 122.878766][ T11] ? __pfx_kthread+0x10/0x10 [ 122.878967][ T11] ret_from_fork+0x31/0x70 [ 122.879175][ T11] ? __pfx_kthread+0x10/0x10 [ 122.879373][ T11] ret_from_fork_asm+0x1a/0x30 [ 122.879596][ T11] [ 122.879775][ T11] [ 122.879891][ T11] Allocated by task 242: [ 122.880058][ T11] kasan_save_stack+0x24/0x50 [ 122.880282][ T11] kasan_save_track+0x14/0x30 [ 122.880495][ T11] __kasan_slab_alloc+0x59/0x70 [ 122.880710][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 122.880927][ T11] copy_net_ns+0xc6/0x340 [ 122.881077][ T11] create_new_namespaces+0x35f/0x920 [ 122.881298][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 122.881499][ T11] ksys_unshare+0x2a9/0x660 [ 122.881730][ T11] __x64_sys_unshare+0x31/0x40 [ 122.881949][ T11] do_syscall_64+0xc1/0x1d0 [ 122.882179][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.882460][ T11] [ 122.882586][ T11] Freed by task 11: [ 122.882758][ T11] kasan_save_stack+0x24/0x50 [ 122.882979][ T11] kasan_save_track+0x14/0x30 [ 122.883192][ T11] kasan_save_free_info+0x3b/0x60 [ 122.883416][ T11] __kasan_slab_free+0x38/0x50 [ 122.883636][ T11] kmem_cache_free+0xf8/0x330 [ 122.883867][ T11] cleanup_net+0x5a8/0xa40 [ 122.884095][ T11] process_one_work+0xe55/0x16d0 [ 122.884326][ T11] worker_thread+0x58c/0xce0 [ 122.884543][ T11] kthread+0x28a/0x350 [ 122.884720][ T11] ret_from_fork+0x31/0x70 [ 122.884950][ T11] ret_from_fork_asm+0x1a/0x30 [ 122.885234][ T11] [ 122.885351][ T11] The buggy address belongs to the object at ffff88800da40040 [ 122.885351][ T11] which belongs to the cache net_namespace of size 5696 [ 122.885920][ T11] The buggy address is located 184 bytes inside of [ 122.885920][ T11] freed 5696-byte region [ffff88800da40040, ffff88800da41680) [ 122.886430][ T11] [ 122.886547][ T11] The buggy address belongs to the physical page: [ 122.886919][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800da44780 pfn:0xda40 [ 122.887433][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 122.887744][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 122.888008][ T11] page_type: f5(slab) [ 122.888177][ T11] raw: 0080000000000240 ffff888001927240 ffff88800192a088 ffff88800192a088 [ 122.888562][ T11] raw: ffff88800da44780 0000000000050003 00000001f5000000 0000000000000000 [ 122.889284][ T11] head: 0080000000000240 ffff888001927240 ffff88800192a088 ffff88800192a088 [ 122.889657][ T11] head: ffff88800da44780 0000000000050003 00000001f5000000 0000000000000000 [ 122.890050][ T11] head: 0080000000000003 ffffea0000369001 ffffffffffffffff 0000000000000000 [ 122.890419][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 122.890902][ T11] page dumped because: kasan: bad access detected [ 122.891151][ T11] [ 122.891255][ T11] Memory state around the buggy address: [ 122.891472][ T11] ffff88800da3ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 122.891784][ T11] ffff88800da40000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 122.892081][ T11] >ffff88800da40080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.892390][ T11] ^ [ 122.892693][ T11] ffff88800da40100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.893000][ T11] ffff88800da40180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 122.893299][ T11] ================================================================== [ 122.893702][ T11] Disabling lock debugging due to kernel taint [ 122.938412][ T775] netdevsim netdevsim10 eni10np1: renamed from eth0 [ 122.965669][ T779] netdevsim netdevsim10 eni10np4: renamed from eth3 [ 123.070414][ T770] netdevsim netdevsim10 eni10np2: renamed from eth1 [ 123.072141][ T863] netdevsim netdevsim10 eni10np3: renamed from eth2 [ 125.190792][ T979] Failed to register fib notifier [ 125.453003][ T770] netdevsim netdevsim10 eni10np2: renamed from eth1 [ 125.461249][ T779] netdevsim netdevsim10 eni10np4: renamed from eth3 [ 125.557449][ T863] netdevsim netdevsim10 eni10np3: renamed from eth2 [ 125.568234][ T775] netdevsim netdevsim10 eni10np1: renamed from eth0 [ 131.358715][ T1228] netdevsim netdevsim10 eni10npf0vf1: renamed from eth1 [ 131.394609][ T1230] netdevsim netdevsim10 eni10npf0vf2: renamed from eth2 [ 131.433215][ T1232] netdevsim netdevsim10 eni10npf0vf3: renamed from eth3 [ 131.497601][ T1226] netdevsim netdevsim10 eni10npf0vf0: renamed from eth0