[ 22.029468][ T253] ip (253) used greatest stack depth: 24448 bytes left
[ 23.073022][ T258] ip (258) used greatest stack depth: 24208 bytes left
[ 26.044678][ T272] ip (272) used greatest stack depth: 24176 bytes left
[ 71.773293][ T589] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 72.395821][ T594] br0: port 1(veth0) entered blocking state
[ 72.396912][ T594] br0: port 1(veth0) entered disabled state
[ 72.398136][ T594] veth0: entered allmulticast mode
[ 72.404967][ T594] veth0: entered promiscuous mode
[ 72.914151][ T597] br0: port 1(veth0) entered blocking state
[ 72.914817][ T597] br0: port 1(veth0) entered forwarding state
[ 78.702670][ T642] veth0: left allmulticast mode
[ 78.703305][ T642] veth0: left promiscuous mode
[ 78.704148][ T642] br0: port 1(veth0) entered disabled state
[ 79.243239][ T645] 8021q: 802.1Q VLAN Support v1.8
[ 79.858579][ T649] br0: port 1(veth0.10) entered blocking state
[ 79.860202][ T649] br0: port 1(veth0.10) entered disabled state
[ 79.861027][ T649] veth0.10: entered allmulticast mode
[ 79.861570][ T649] veth0: entered allmulticast mode
[ 79.867277][ T649] veth0.10: entered promiscuous mode
[ 79.867920][ T649] veth0: entered promiscuous mode
[ 79.870445][ T649] br0: port 1(veth0.10) entered blocking state
[ 79.871582][ T649] br0: port 1(veth0.10) entered forwarding state
[ 86.659822][ T700] br0: port 1(veth0.10) entered disabled state
[ 86.998859][ T702] veth0.10 (unregistering): left allmulticast mode
[ 86.999397][ T702] veth0: left allmulticast mode
[ 87.000291][ T702] veth0.10 (unregistering): left promiscuous mode
[ 87.000761][ T702] veth0: left promiscuous mode
[ 87.001423][ T702] br0: port 1(veth0.10) entered disabled state
[ 87.034036][ T702] ==================================================================
[ 87.034442][ T702] BUG: KASAN: slab-use-after-free in kobject_put+0xbb/0xd0
[ 87.034742][ T702] Read of size 1 at addr ffff88800a0b46ac by task ip/702
[ 87.035004][ T702]
[ 87.035121][ T702] CPU: 0 UID: 0 PID: 702 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 87.035126][ T702] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 87.035129][ T702] Call Trace:
[ 87.035131][ T702]
[ 87.035134][ T702] dump_stack_lvl+0x82/0xc0
[ 87.035140][ T702] print_address_description.constprop.0+0x2c/0x3a0
[ 87.035149][ T702] ? kobject_put+0xbb/0xd0
[ 87.035153][ T702] print_report+0xb4/0x270
[ 87.035157][ T702] ? kobject_put+0xbb/0xd0
[ 87.035160][ T702] ? kasan_addr_to_slab+0x21/0x70
[ 87.035164][ T702] ? kobject_put+0xbb/0xd0
[ 87.035167][ T702] kasan_report+0xca/0x100
[ 87.035172][ T702] ? kobject_put+0xbb/0xd0
[ 87.035178][ T702] kobject_put+0xbb/0xd0
[ 87.035181][ T702] netdev_run_todo+0x5f0/0xc60
[ 87.035188][ T702] ? dev_ingress_queue_create+0x190/0x190
[ 87.035192][ T702] ? generic_xdp_install+0x410/0x410
[ 87.035197][ T702] ? lockdep_hardirqs_on+0x7c/0x110
[ 87.035203][ T702] rtnl_dellink+0x350/0xa30
[ 87.035209][ T702] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 87.035231][ T702] ? find_held_lock+0x2b/0x80
[ 87.035239][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.035246][ T702] ? find_held_lock+0x2b/0x80
[ 87.035250][ T702] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 87.035254][ T702] ? __lock_release+0x5d/0x170
[ 87.035258][ T702] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 87.035265][ T702] rtnetlink_rcv_msg+0x709/0xc00
[ 87.035271][ T702] ? rtnl_port_fill+0x890/0x890
[ 87.035276][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.035287][ T702] netlink_rcv_skb+0x121/0x340
[ 87.035294][ T702] ? rtnl_port_fill+0x890/0x890
[ 87.035298][ T702] ? netlink_ack+0xdf0/0xdf0
[ 87.035306][ T702] ? netlink_deliver_tap+0x13e/0x340
[ 87.035309][ T702] ? netlink_deliver_tap+0xc3/0x340
[ 87.035314][ T702] netlink_unicast+0x4aa/0x780
[ 87.035318][ T702] ? netlink_attachskb+0x810/0x810
[ 87.035322][ T702] ? __lock_acquire+0x440/0x7e0
[ 87.035329][ T702] netlink_sendmsg+0x714/0xbd0
[ 87.035334][ T702] ? netlink_unicast+0x780/0x780
[ 87.035338][ T702] ? __import_iovec+0x230/0x3b0
[ 87.035344][ T702] ? _copy_from_user+0x53/0x90
[ 87.035349][ T702] ? netlink_unicast+0x780/0x780
[ 87.035354][ T702] ____sys_sendmsg+0x3dd/0x890
[ 87.035359][ T702] ? get_timestamp.constprop.0+0x370/0x370
[ 87.035362][ T702] ? __copy_msghdr+0x3d0/0x3d0
[ 87.035368][ T702] ? do_wp_page+0xa70/0x1760
[ 87.035373][ T702] ___sys_sendmsg+0xed/0x170
[ 87.035377][ T702] ? copy_msghdr_from_user+0x110/0x110
[ 87.035381][ T702] ? do_pte_missing+0xec0/0xec0
[ 87.035383][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.035389][ T702] ? __handle_mm_fault+0x3fc/0x5d0
[ 87.035392][ T702] ? __pmd_alloc+0x700/0x700
[ 87.035399][ T702] ? lock_vma_under_rcu+0x2d/0x3d0
[ 87.035404][ T702] ? lock_vma_under_rcu+0x138/0x3d0
[ 87.035409][ T702] __sys_sendmsg+0x10b/0x1a0
[ 87.035412][ T702] ? __sys_sendmsg_sock+0x20/0x20
[ 87.035415][ T702] ? exc_page_fault+0x65/0xd0
[ 87.035420][ T702] ? do_user_addr_fault+0x955/0xe00
[ 87.035427][ T702] ? rcu_is_watching+0x12/0xb0
[ 87.035434][ T702] do_syscall_64+0xc1/0xfd0
[ 87.035441][ T702] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 87.035445][ T702] RIP: 0033:0x7f83c8a441d7
[ 87.035452][ T702] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 87.035455][ T702] RSP: 002b:00007ffdb6670478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 87.035459][ T702] RAX: ffffffffffffffda RBX: 00007ffdb6670bb0 RCX: 00007f83c8a441d7
[ 87.035462][ T702] RDX: 0000000000000000 RSI: 00007ffdb66704e0 RDI: 0000000000000005
[ 87.035463][ T702] RBP: 0000000000000000 R08: 000000000000002c R09: 0000000000404178
[ 87.035465][ T702] R10: 0000000000404178 R11: 0000000000000246 R12: 00007ffdb6670bc8
[ 87.035467][ T702] R13: 00000000690de845 R14: 0000000000499600 R15: 0000000000000000
[ 87.035474][ T702]
[ 87.035475][ T702]
[ 87.049323][ T702] Allocated by task 644:
[ 87.049468][ T702] kasan_save_stack+0x24/0x40
[ 87.049664][ T702] kasan_save_track+0x14/0x30
[ 87.049832][ T702] __kasan_kmalloc+0x7b/0x90
[ 87.050010][ T702] __kvmalloc_node_noprof+0x2e5/0x8e0
[ 87.050201][ T702] alloc_netdev_mqs+0x7d/0x1370
[ 87.050404][ T702] rtnl_create_link+0xa9e/0xe20
[ 87.050579][ T702] rtnl_newlink_create+0x203/0x770
[ 87.050751][ T702] __rtnl_newlink+0x231/0xa30
[ 87.050920][ T702] rtnl_newlink+0x693/0xa60
[ 87.051107][ T702] rtnetlink_rcv_msg+0x709/0xc00
[ 87.051284][ T702] netlink_rcv_skb+0x121/0x340
[ 87.051468][ T702] netlink_unicast+0x4aa/0x780
[ 87.051651][ T702] netlink_sendmsg+0x714/0xbd0
[ 87.051827][ T702] ____sys_sendmsg+0x3dd/0x890
[ 87.052003][ T702] ___sys_sendmsg+0xed/0x170
[ 87.052190][ T702] __sys_sendmsg+0x10b/0x1a0
[ 87.052369][ T702] do_syscall_64+0xc1/0xfd0
[ 87.052589][ T702] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 87.052846][ T702]
[ 87.052936][ T702] Freed by task 702:
[ 87.053095][ T702] kasan_save_stack+0x24/0x40
[ 87.053300][ T702] kasan_save_track+0x14/0x30
[ 87.053519][ T702] __kasan_save_free_info+0x3b/0x60
[ 87.053712][ T702] __kasan_slab_free+0x3f/0x60
[ 87.053913][ T702] kfree+0x21d/0x540
[ 87.054083][ T702] device_release+0x9c/0x210
[ 87.054285][ T702] kobject_cleanup+0xfe/0x360
[ 87.054485][ T702] netdev_run_todo+0x81f/0xc60
[ 87.054706][ T702] rtnl_dellink+0x350/0xa30
[ 87.054904][ T702] rtnetlink_rcv_msg+0x709/0xc00
[ 87.055109][ T702] netlink_rcv_skb+0x121/0x340
[ 87.055288][ T702] netlink_unicast+0x4aa/0x780
[ 87.055505][ T702] netlink_sendmsg+0x714/0xbd0
[ 87.055692][ T702] ____sys_sendmsg+0x3dd/0x890
[ 87.055866][ T702] ___sys_sendmsg+0xed/0x170
[ 87.056044][ T702] __sys_sendmsg+0x10b/0x1a0
[ 87.056225][ T702] do_syscall_64+0xc1/0xfd0
[ 87.056417][ T702] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 87.056632][ T702]
[ 87.056744][ T702] The buggy address belongs to the object at ffff88800a0b4000
[ 87.056744][ T702] which belongs to the cache kmalloc-4k of size 4096
[ 87.057225][ T702] The buggy address is located 1708 bytes inside of
[ 87.057225][ T702] freed 4096-byte region [ffff88800a0b4000, ffff88800a0b5000)
[ 87.057671][ T702]
[ 87.057764][ T702] The buggy address belongs to the physical page:
[ 87.057983][ T702] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa0b0
[ 87.058351][ T702] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 87.058646][ T702] flags: 0x80000000000040(head|node=0|zone=1)
[ 87.058866][ T702] page_type: f5(slab)
[ 87.059017][ T702] raw: 0080000000000040 ffff888001043700 ffffea00001d7410 ffffea00003ffe10
[ 87.059403][ T702] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 87.059727][ T702] head: 0080000000000040 ffff888001043700 ffffea00001d7410 ffffea00003ffe10
[ 87.060082][ T702] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[ 87.060448][ T702] head: 0080000000000003 ffffea0000282c01 00000000ffffffff 00000000ffffffff
[ 87.060800][ T702] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 87.061155][ T702] page dumped because: kasan: bad access detected
[ 87.061381][ T702]
[ 87.061483][ T702] Memory state around the buggy address:
[ 87.061650][ T702] ffff88800a0b4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.061912][ T702] ffff88800a0b4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.062184][ T702] >ffff88800a0b4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.062461][ T702] ^
[ 87.062636][ T702] ffff88800a0b4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.062935][ T702] ffff88800a0b4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 87.063212][ T702] ==================================================================
[ 87.063834][ T702] Disabling lock debugging due to kernel taint
[ 87.064139][ T702] ------------[ cut here ]------------
[ 87.064324][ T702] refcount_t: underflow; use-after-free.
[ 87.064575][ T702] WARNING: CPU: 1 PID: 702 at lib/refcount.c:28 refcount_warn_saturate+0x16f/0x1b0
[ 87.064936][ T702] Modules linked in: 8021q bridge stp llc nft_masq nft_nat nft_chain_nat nf_nat tcp_diag inet_diag nft_flow_offload nft_ct nf_flow_table_inet nf_flow_table nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables veth
[ 87.065657][ T702] CPU: 1 UID: 0 PID: 702 Comm: ip Tainted: G B 6.18.0-rc4-virtme #1 PREEMPT(full)
[ 87.066056][ T702] Tainted: [B]=BAD_PAGE
[ 87.066202][ T702] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 87.066460][ T702] RIP: 0010:refcount_warn_saturate+0x16f/0x1b0
[ 87.066752][ T702] Code: 83 90 02 80 fb 01 0f 87 95 6b d6 fe 83 e3 01 0f 85 51 ff ff ff c6 05 b1 83 90 02 01 90 48 c7 c7 a0 de 45 9d e8 c2 8b 15 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 f0 34 a1 ff e9 ba fe ff ff
[ 87.067509][ T702] RSP: 0018:ffffc900009671f0 EFLAGS: 00010286
[ 87.067808][ T702] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 87.068136][ T702] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[ 87.068404][ T702] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff3bbe220
[ 87.068725][ T702] R10: 0000000000000003 R11: ffffc90000966d80 R12: 0000000000000001
[ 87.068990][ T702] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[ 87.069288][ T702] FS: 00007f83c8876800(0000) GS:ffff88809706c000(0000) knlGS:0000000000000000
[ 87.069612][ T702] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.069848][ T702] CR2: 00007f1e277d9a20 CR3: 000000000bed6002 CR4: 0000000000772ef0
[ 87.070168][ T702] PKRU: 55555554
[ 87.070340][ T702] Call Trace:
[ 87.070505][ T702]
[ 87.070620][ T702] netdev_run_todo+0x5f0/0xc60
[ 87.070832][ T702] ? dev_ingress_queue_create+0x190/0x190
[ 87.071079][ T702] ? generic_xdp_install+0x410/0x410
[ 87.071407][ T702] ? lockdep_hardirqs_on+0x7c/0x110
[ 87.071726][ T702] rtnl_dellink+0x350/0xa30
[ 87.072045][ T702] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 87.072477][ T702] ? find_held_lock+0x2b/0x80
[ 87.072775][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.073082][ T702] ? find_held_lock+0x2b/0x80
[ 87.073400][ T702] ? rtnetlink_rcv_msg+0x6e6/0xc00
[ 87.073726][ T702] ? __lock_release+0x5d/0x170
[ 87.073923][ T702] ? valid_bridge_getlink_req.constprop.0+0x640/0x640
[ 87.074166][ T702] rtnetlink_rcv_msg+0x709/0xc00
[ 87.074361][ T702] ? rtnl_port_fill+0x890/0x890
[ 87.074527][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.074712][ T702] netlink_rcv_skb+0x121/0x340
[ 87.074884][ T702] ? rtnl_port_fill+0x890/0x890
[ 87.075089][ T702] ? netlink_ack+0xdf0/0xdf0
[ 87.075277][ T702] ? netlink_deliver_tap+0x13e/0x340
[ 87.075485][ T702] ? netlink_deliver_tap+0xc3/0x340
[ 87.075690][ T702] netlink_unicast+0x4aa/0x780
[ 87.075866][ T702] ? netlink_attachskb+0x810/0x810
[ 87.076032][ T702] ? __lock_acquire+0x440/0x7e0
[ 87.076320][ T702] netlink_sendmsg+0x714/0xbd0
[ 87.076531][ T702] ? netlink_unicast+0x780/0x780
[ 87.076711][ T702] ? __import_iovec+0x230/0x3b0
[ 87.076907][ T702] ? _copy_from_user+0x53/0x90
[ 87.077215][ T702] ? netlink_unicast+0x780/0x780
[ 87.077425][ T702] ____sys_sendmsg+0x3dd/0x890
[ 87.077613][ T702] ? get_timestamp.constprop.0+0x370/0x370
[ 87.077864][ T702] ? __copy_msghdr+0x3d0/0x3d0
[ 87.078050][ T702] ? do_wp_page+0xa70/0x1760
[ 87.078240][ T702] ___sys_sendmsg+0xed/0x170
[ 87.078431][ T702] ? copy_msghdr_from_user+0x110/0x110
[ 87.078660][ T702] ? do_pte_missing+0xec0/0xec0
[ 87.078853][ T702] ? __lock_acquire+0x449/0x7e0
[ 87.079045][ T702] ? __handle_mm_fault+0x3fc/0x5d0
[ 87.079254][ T702] ? __pmd_alloc+0x700/0x700
[ 87.079450][ T702] ? lock_vma_under_rcu+0x2d/0x3d0
[ 87.079629][ T702] ? lock_vma_under_rcu+0x138/0x3d0
[ 87.079810][ T702] __sys_sendmsg+0x10b/0x1a0
[ 87.080043][ T702] ? __sys_sendmsg_sock+0x20/0x20
[ 87.080218][ T702] ? exc_page_fault+0x65/0xd0
[ 87.080402][ T702] ? do_user_addr_fault+0x955/0xe00
[ 87.080614][ T702] ? rcu_is_watching+0x12/0xb0
[ 87.080791][ T702] do_syscall_64+0xc1/0xfd0
[ 87.080961][ T702] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 87.081215][ T702] RIP: 0033:0x7f83c8a441d7
[ 87.081397][ T702] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[ 87.082095][ T702] RSP: 002b:00007ffdb6670478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 87.082371][ T702] RAX: ffffffffffffffda RBX: 00007ffdb6670bb0 RCX: 00007f83c8a441d7
[ 87.082672][ T702] RDX: 0000000000000000 RSI: 00007ffdb66704e0 RDI: 0000000000000005
[ 87.082936][ T702] RBP: 0000000000000000 R08: 000000000000002c R09: 0000000000404178
[ 87.083247][ T702] R10: 0000000000404178 R11: 0000000000000246 R12: 00007ffdb6670bc8
[ 87.083527][ T702] R13: 00000000690de845 R14: 0000000000499600 R15: 0000000000000000
[ 87.083841][ T702]
[ 87.083993][ T702] irq event stamp: 60175
[ 87.084146][ T702] hardirqs last enabled at (60175): [] finish_task_switch.isra.0+0x245/0x960
[ 87.084511][ T702] hardirqs last disabled at (60174): [] __schedule+0x94a/0x1b10
[ 87.084838][ T702] softirqs last enabled at (60008): [] handle_softirqs+0x352/0x610
[ 87.085153][ T702] softirqs last disabled at (60001): [] irq_exit_rcu+0xab/0x100
[ 87.085461][ T702] ---[ end trace 0000000000000000 ]---
[ 89.294008][ T725] Initializing XFRM netlink socket
[ 136.493833][ T1092] br0: port 1(veth0) entered blocking state
[ 136.494215][ T1092] br0: port 1(veth0) entered disabled state
[ 136.494515][ T1092] veth0: entered allmulticast mode
[ 136.497731][ T1092] veth0: entered promiscuous mode
[ 136.842766][ T1095] br0: port 1(veth0) entered blocking state
[ 136.843104][ T1095] br0: port 1(veth0) entered forwarding state
[ 144.684448][ T1140] veth0: left allmulticast mode
[ 144.684870][ T1140] veth0: left promiscuous mode
[ 144.685433][ T1140] br0: port 1(veth0) entered disabled state
[ 145.266931][ T1145] br0: port 1(veth0.10) entered blocking state
[ 145.267373][ T1145] br0: port 1(veth0.10) entered disabled state
[ 145.267799][ T1145] veth0.10: entered allmulticast mode
[ 145.268081][ T1145] veth0: entered allmulticast mode
[ 145.271292][ T1145] veth0.10: entered promiscuous mode
[ 145.271650][ T1145] veth0: entered promiscuous mode
[ 145.273149][ T1145] br0: port 1(veth0.10) entered blocking state
[ 145.273479][ T1145] br0: port 1(veth0.10) entered forwarding state
[ 153.175596][ T1196] br0: port 1(veth0.10) entered disabled state
[ 153.417261][ T1198] veth0.10 (unregistering): left allmulticast mode
[ 153.418133][ T1198] veth0: left allmulticast mode
[ 153.418470][ T1198] veth0.10 (unregistering): left promiscuous mode
[ 153.418901][ T1198] veth0: left promiscuous mode
[ 153.419549][ T1198] br0: port 1(veth0.10) entered disabled state