[ 2234.766117][T19874] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 2235.264883][T19880] br0: port 1(veth0) entered blocking state [ 2235.265603][T19880] br0: port 1(veth0) entered disabled state [ 2235.266076][T19880] veth0: entered allmulticast mode [ 2235.269762][T19880] veth0: entered promiscuous mode [ 2235.739216][T19883] br0: port 1(veth0) entered blocking state [ 2235.739875][T19883] br0: port 1(veth0) entered forwarding state [ 2240.487841][T19928] veth0: left allmulticast mode [ 2240.488335][T19928] veth0: left promiscuous mode [ 2240.488940][T19928] br0: port 1(veth0) entered disabled state [ 2240.918551][T19931] 8021q: 802.1Q VLAN Support v1.8 [ 2241.363843][T19935] br0: port 1(veth0.10) entered blocking state [ 2241.364368][T19935] br0: port 1(veth0.10) entered disabled state [ 2241.364855][T19935] veth0.10: entered allmulticast mode [ 2241.365140][T19935] veth0: entered allmulticast mode [ 2241.368715][T19935] veth0.10: entered promiscuous mode [ 2241.369028][T19935] veth0: entered promiscuous mode [ 2241.381840][T19935] br0: port 1(veth0.10) entered blocking state [ 2241.382318][T19935] br0: port 1(veth0.10) entered forwarding state [ 2246.794794][T19986] br0: port 1(veth0.10) entered disabled state [ 2247.081588][T19988] veth0.10 (unregistering): left allmulticast mode [ 2247.082068][T19988] veth0: left allmulticast mode [ 2247.082423][T19988] veth0.10 (unregistering): left promiscuous mode [ 2247.082949][T19988] veth0: left promiscuous mode [ 2247.083637][T19988] br0: port 1(veth0.10) entered disabled state [ 2250.184602][T20011] Initializing XFRM netlink socket [ 2308.724520][T20316] br0: port 1(veth0) entered blocking state [ 2308.724991][T20316] br0: port 1(veth0) entered disabled state [ 2308.725449][T20316] veth0: entered allmulticast mode [ 2308.729051][T20316] veth0: entered promiscuous mode [ 2309.179259][T20319] br0: port 1(veth0) entered blocking state [ 2309.179742][T20319] br0: port 1(veth0) entered forwarding state [ 2313.809736][T20348] ================================================================== [ 2313.810139][T20348] BUG: KASAN: slab-use-after-free in tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810446][T20348] Read of size 4 at addr ffff8880134729d8 by task socat/20348 [ 2313.810747][T20348] [ 2313.810876][T20348] CPU: 0 UID: 0 PID: 20348 Comm: socat Not tainted 6.16.0-rc5-virtme #1 PREEMPT(full) [ 2313.810882][T20348] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 2313.810889][T20348] Call Trace: [ 2313.810893][T20348] [ 2313.810896][T20348] dump_stack_lvl+0x82/0xd0 [ 2313.810909][T20348] print_address_description.constprop.0+0x2c/0x400 [ 2313.810929][T20348] ? tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810932][T20348] print_report+0xb4/0x270 [ 2313.810935][T20348] ? tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810938][T20348] ? kasan_addr_to_slab+0x25/0x80 [ 2313.810945][T20348] ? tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810948][T20348] kasan_report+0xca/0x100 [ 2313.810951][T20348] ? tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810957][T20348] tcp_prune_ofo_queue+0x55d/0x660 [ 2313.810962][T20348] tcp_try_rmem_schedule+0x855/0x12e0 [ 2313.810969][T20348] tcp_data_queue+0x4dd/0x2260 [ 2313.810975][T20348] ? __pfx_tcp_data_queue+0x10/0x10 [ 2313.810979][T20348] ? kvm_clock_get_cycles+0x18/0x30 [ 2313.810993][T20348] ? ktime_get+0xb8/0x200 [ 2313.811005][T20348] tcp_rcv_established+0x5e8/0x2370 [ 2313.811011][T20348] ? find_held_lock+0x2b/0x80 [ 2313.811024][T20348] ? __pfx_tcp_rcv_established+0x10/0x10 [ 2313.811028][T20348] ? ipv4_dst_check+0x167/0x2e0 [ 2313.811037][T20348] tcp_v4_do_rcv+0x4ba/0x8c0 [ 2313.811042][T20348] ? lockdep_hardirqs_on+0x7c/0x110 [ 2313.811049][T20348] __release_sock+0x27a/0x390 [ 2313.811063][T20348] release_sock+0x53/0x1d0 [ 2313.811066][T20348] tcp_sendmsg+0x37/0x50 [ 2313.811074][T20348] sock_write_iter+0x3c1/0x520 [ 2313.811083][T20348] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 2313.811089][T20348] ? backing_file_read_iter+0x50c/0x740 [ 2313.811106][T20348] ? __pfx_sock_write_iter+0x10/0x10 [ 2313.811114][T20348] ? rcu_is_watching+0x12/0xc0 [ 2313.811125][T20348] vfs_write+0xc09/0x1210 [ 2313.811133][T20348] ? __pfx___sys_recvfrom+0x10/0x10 [ 2313.811137][T20348] ? ksys_read+0x137/0x1d0 [ 2313.811140][T20348] ? __lock_release+0x5d/0x170 [ 2313.811146][T20348] ? __pfx_vfs_write+0x10/0x10 [ 2313.811156][T20348] ksys_write+0x183/0x1d0 [ 2313.811159][T20348] ? __pfx_ksys_write+0x10/0x10 [ 2313.811165][T20348] do_syscall_64+0xc1/0x380 [ 2313.811173][T20348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2313.811184][T20348] RIP: 0033:0x7fcf73ef2337 [ 2313.811190][T20348] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 [ 2313.811194][T20348] RSP: 002b:00007ffd4f924708 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2313.811201][T20348] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcf73ef2337 [ 2313.811204][T20348] RDX: 0000000000002000 RSI: 0000555f11d1a000 RDI: 0000000000000008 [ 2313.811206][T20348] RBP: 0000555f11d1a000 R08: 0000000000002000 R09: 0000000000000000 [ 2313.811208][T20348] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000008 [ 2313.811210][T20348] R13: 0000000000002000 R14: 0000555ee1a44570 R15: 0000000000002000 [ 2313.811217][T20348] [ 2313.811218][T20348] [ 2313.822076][T20348] Allocated by task 20348: [ 2313.822272][T20348] kasan_save_stack+0x24/0x50 [ 2313.822485][T20348] kasan_save_track+0x14/0x30 [ 2313.822683][T20348] __kasan_slab_alloc+0x59/0x70 [ 2313.822883][T20348] kmem_cache_alloc_node_noprof+0x110/0x340 [ 2313.823138][T20348] __alloc_skb+0x213/0x2e0 [ 2313.823342][T20348] tcp_collapse+0x43f/0xff0 [ 2313.823544][T20348] tcp_try_rmem_schedule+0x6b9/0x12e0 [ 2313.823752][T20348] tcp_data_queue+0x4dd/0x2260 [ 2313.823953][T20348] tcp_rcv_established+0x5e8/0x2370 [ 2313.824153][T20348] tcp_v4_do_rcv+0x4ba/0x8c0 [ 2313.824352][T20348] __release_sock+0x27a/0x390 [ 2313.824554][T20348] release_sock+0x53/0x1d0 [ 2313.824753][T20348] tcp_sendmsg+0x37/0x50 [ 2313.824906][T20348] sock_write_iter+0x3c1/0x520 [ 2313.825107][T20348] vfs_write+0xc09/0x1210 [ 2313.825265][T20348] ksys_write+0x183/0x1d0 [ 2313.825417][T20348] do_syscall_64+0xc1/0x380 [ 2313.825618][T20348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2313.825864][T20348] [ 2313.825963][T20348] Freed by task 20348: [ 2313.826111][T20348] kasan_save_stack+0x24/0x50 [ 2313.826317][T20348] kasan_save_track+0x14/0x30 [ 2313.826517][T20348] kasan_save_free_info+0x3b/0x60 [ 2313.826722][T20348] __kasan_slab_free+0x38/0x50 [ 2313.826920][T20348] kmem_cache_free+0x149/0x330 [ 2313.827119][T20348] tcp_prune_ofo_queue+0x211/0x660 [ 2313.827316][T20348] tcp_try_rmem_schedule+0x855/0x12e0 [ 2313.827513][T20348] tcp_data_queue+0x4dd/0x2260 [ 2313.827711][T20348] tcp_rcv_established+0x5e8/0x2370 [ 2313.827911][T20348] tcp_v4_do_rcv+0x4ba/0x8c0 [ 2313.828116][T20348] __release_sock+0x27a/0x390 [ 2313.828315][T20348] release_sock+0x53/0x1d0 [ 2313.828513][T20348] tcp_sendmsg+0x37/0x50 [ 2313.828666][T20348] sock_write_iter+0x3c1/0x520 [ 2313.828871][T20348] vfs_write+0xc09/0x1210 [ 2313.829022][T20348] ksys_write+0x183/0x1d0 [ 2313.829172][T20348] do_syscall_64+0xc1/0x380 [ 2313.829371][T20348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2313.829625][T20348] [ 2313.829727][T20348] The buggy address belongs to the object at ffff888013472900 [ 2313.829727][T20348] which belongs to the cache skbuff_head_cache of size 232 [ 2313.830253][T20348] The buggy address is located 216 bytes inside of [ 2313.830253][T20348] freed 232-byte region [ffff888013472900, ffff8880134729e8) [ 2313.830727][T20348] [ 2313.830836][T20348] The buggy address belongs to the physical page: [ 2313.831091][T20348] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13472 [ 2313.831457][T20348] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2313.831758][T20348] flags: 0x80000000000040(head|node=0|zone=1) [ 2313.832018][T20348] page_type: f5(slab) [ 2313.832174][T20348] raw: 0080000000000040 ffff88800198fb40 ffffea0000347b10 ffffea00004f5290 [ 2313.832548][T20348] raw: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000 [ 2313.832903][T20348] head: 0080000000000040 ffff88800198fb40 ffffea0000347b10 ffffea00004f5290 [ 2313.833265][T20348] head: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000 [ 2313.833620][T20348] head: 0080000000000001 ffffea00004d1c81 00000000ffffffff 00000000ffffffff [ 2313.833978][T20348] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2313.834336][T20348] page dumped because: kasan: bad access detected [ 2313.834581][T20348] [ 2313.834679][T20348] Memory state around the buggy address: [ 2313.834873][T20348] ffff888013472880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2313.835271][T20348] ffff888013472900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2313.835562][T20348] >ffff888013472980: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 2313.835964][T20348] ^ [ 2313.836210][T20348] ffff888013472a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2313.836495][T20348] ffff888013472a80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2313.836896][T20348] ================================================================== [ 2313.837223][T20348] Disabling lock debugging due to kernel taint [ 2314.958903][T20364] veth0: left allmulticast mode [ 2314.959135][T20364] veth0: left promiscuous mode [ 2314.959530][T20364] br0: port 1(veth0) entered disabled state [ 2315.416197][T20369] br0: port 1(veth0.10) entered blocking state [ 2315.416522][T20369] br0: port 1(veth0.10) entered disabled state [ 2315.416816][T20369] veth0.10: entered allmulticast mode [ 2315.417008][T20369] veth0: entered allmulticast mode [ 2315.418997][T20369] veth0.10: entered promiscuous mode [ 2315.419216][T20369] veth0: entered promiscuous mode [ 2315.426807][T20369] br0: port 1(veth0.10) entered blocking state [ 2315.427095][T20369] br0: port 1(veth0.10) entered forwarding state [ 2319.791475][T20420] br0: port 1(veth0.10) entered disabled state [ 2319.995860][T20422] veth0.10 (unregistering): left allmulticast mode [ 2319.996260][T20422] veth0: left allmulticast mode [ 2319.996501][T20422] veth0.10 (unregistering): left promiscuous mode [ 2319.996773][T20422] veth0: left promiscuous mode [ 2319.997202][T20422] br0: port 1(veth0.10) entered disabled state