[ 97.861072][ T2198] netdevsim netdevsim1337 eni1337np1: renamed from eth0 [ 97.891240][ T2199] netdevsim netdevsim1057 eni1057np1: renamed from eth1 [ 98.059316][ T2213] netdevsim netdevsim5417 eni5417np1: renamed from eth0 [ 120.421422][ T68] ================================================================== [ 120.421747][ T68] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 120.422045][ T68] Read of size 8 at addr ffff88800c0000f8 by task kworker/u16:1/68 [ 120.422335][ T68] [ 120.422438][ T68] CPU: 0 UID: 0 PID: 68 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 120.422737][ T68] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 120.422990][ T68] Workqueue: netns cleanup_net [ 120.423206][ T68] Call Trace: [ 120.423353][ T68] [ 120.423460][ T68] dump_stack_lvl+0x82/0xd0 [ 120.423668][ T68] print_address_description.constprop.0+0x2c/0x3b0 [ 120.423927][ T68] ? cleanup_net+0x932/0xa40 [ 120.424137][ T68] print_report+0xb4/0x270 [ 120.424340][ T68] ? kasan_addr_to_slab+0x25/0x80 [ 120.424542][ T68] kasan_report+0xbd/0xf0 [ 120.424699][ T68] ? cleanup_net+0x932/0xa40 [ 120.424900][ T68] cleanup_net+0x932/0xa40 [ 120.425103][ T68] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 120.425308][ T68] ? __pfx_cleanup_net+0x10/0x10 [ 120.425500][ T68] ? trace_lock_acquire+0x148/0x1f0 [ 120.425702][ T68] ? lock_acquire+0x32/0xc0 [ 120.425907][ T68] ? process_one_work+0xe0b/0x16d0 [ 120.426116][ T68] process_one_work+0xe55/0x16d0 [ 120.426318][ T68] ? __pfx___lock_release+0x10/0x10 [ 120.426516][ T68] ? __pfx_process_one_work+0x10/0x10 [ 120.426724][ T68] ? assign_work+0x16c/0x240 [ 120.426925][ T68] worker_thread+0x58c/0xce0 [ 120.427123][ T68] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 120.427383][ T68] ? __pfx_worker_thread+0x10/0x10 [ 120.427581][ T68] ? __pfx_worker_thread+0x10/0x10 [ 120.427782][ T68] kthread+0x28a/0x350 [ 120.427944][ T68] ? __pfx_kthread+0x10/0x10 [ 120.428144][ T68] ret_from_fork+0x31/0x70 [ 120.428339][ T68] ? __pfx_kthread+0x10/0x10 [ 120.428537][ T68] ret_from_fork_asm+0x1a/0x30 [ 120.428743][ T68] [ 120.428894][ T68] [ 120.428993][ T68] Allocated by task 2042: [ 120.429135][ T68] kasan_save_stack+0x24/0x50 [ 120.429337][ T68] kasan_save_track+0x14/0x30 [ 120.429544][ T68] __kasan_slab_alloc+0x59/0x70 [ 120.429737][ T68] kmem_cache_alloc_noprof+0x10b/0x350 [ 120.429934][ T68] copy_net_ns+0xc6/0x340 [ 120.430083][ T68] create_new_namespaces+0x35f/0x920 [ 120.430283][ T68] unshare_nsproxy_namespaces+0x8d/0x130 [ 120.430474][ T68] ksys_unshare+0x2a9/0x660 [ 120.430674][ T68] __x64_sys_unshare+0x31/0x40 [ 120.430868][ T68] do_syscall_64+0xc1/0x1d0 [ 120.431062][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.431309][ T68] [ 120.431407][ T68] Freed by task 68: [ 120.431552][ T68] kasan_save_stack+0x24/0x50 [ 120.431752][ T68] kasan_save_track+0x14/0x30 [ 120.431948][ T68] kasan_save_free_info+0x3b/0x60 [ 120.432144][ T68] __kasan_slab_free+0x38/0x50 [ 120.432346][ T68] kmem_cache_free+0xf8/0x330 [ 120.432544][ T68] cleanup_net+0x5a8/0xa40 [ 120.432738][ T68] process_one_work+0xe55/0x16d0 [ 120.432925][ T68] worker_thread+0x58c/0xce0 [ 120.433119][ T68] kthread+0x28a/0x350 [ 120.433267][ T68] ret_from_fork+0x31/0x70 [ 120.433468][ T68] ret_from_fork_asm+0x1a/0x30 [ 120.433659][ T68] [ 120.433766][ T68] The buggy address belongs to the object at ffff88800c000040 [ 120.433766][ T68] which belongs to the cache net_namespace of size 5696 [ 120.434268][ T68] The buggy address is located 184 bytes inside of [ 120.434268][ T68] freed 5696-byte region [ffff88800c000040, ffff88800c001680) [ 120.434727][ T68] [ 120.434828][ T68] The buggy address belongs to the physical page: [ 120.435077][ T68] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c002fc0 pfn:0xc000 [ 120.435473][ T68] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 120.435776][ T68] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 120.436021][ T68] page_type: f5(slab) [ 120.436172][ T68] raw: 0080000000000240 ffff888001927240 ffff88800192a088 ffff88800192a088 [ 120.436513][ T68] raw: ffff88800c002fc0 0000000000050002 00000001f5000000 0000000000000000 [ 120.436847][ T68] head: 0080000000000240 ffff888001927240 ffff88800192a088 ffff88800192a088 [ 120.437188][ T68] head: ffff88800c002fc0 0000000000050002 00000001f5000000 0000000000000000 [ 120.437521][ T68] head: 0080000000000003 ffffea0000300001 ffffffffffffffff 0000000000000000 [ 120.437854][ T68] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 120.438192][ T68] page dumped because: kasan: bad access detected [ 120.438434][ T68] [ 120.438528][ T68] Memory state around the buggy address: [ 120.438708][ T68] ffff88800bffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 120.438984][ T68] ffff88800c000000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 120.439256][ T68] >ffff88800c000080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 120.439559][ T68] ^ [ 120.439831][ T68] ffff88800c000100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 120.440104][ T68] ffff88800c000180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 120.440380][ T68] ================================================================== [ 120.440695][ T68] Disabling lock debugging due to kernel taint