[ 11.675569][ T250] IPVS: Registered protocols (TCP) [ 11.676795][ T250] IPVS: Connection hash table configured (size=4096, memory=32Kbytes) [ 11.678050][ T250] IPVS: ipvs loaded. [ 12.926612][ T267] ip (267) used greatest stack depth: 23664 bytes left [ 13.840902][ T274] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 14.048235][ T275] br0: port 1(veth01) entered blocking state [ 14.048795][ T275] br0: port 1(veth01) entered disabled state [ 14.049158][ T275] veth01: entered allmulticast mode [ 14.051154][ T275] veth01: entered promiscuous mode [ 14.220656][ T276] br0: port 2(veth02) entered blocking state [ 14.220964][ T276] br0: port 2(veth02) entered disabled state [ 14.221239][ T276] veth02: entered allmulticast mode [ 14.223533][ T276] veth02: entered promiscuous mode [ 14.735137][ T70] br0: port 1(veth01) entered blocking state [ 14.735586][ T70] br0: port 1(veth01) entered forwarding state [ 15.746744][ T37] br0: port 2(veth02) entered blocking state [ 15.747081][ T37] br0: port 2(veth02) entered forwarding state [ 17.566967][ T292] IPVS: [rr] scheduler registered. [ 17.581221][ T9] IPVS: starting estimator thread 0... [ 17.646417][ T293] IPVS: using max 46 ests per chain, 110400 per kthread [ 19.401730][ T11] veth02: left allmulticast mode [ 19.402051][ T11] veth02: left promiscuous mode [ 19.402466][ T11] br0: port 2(veth02) entered disabled state [ 19.405745][ T11] veth01: left allmulticast mode [ 19.405938][ T11] veth01: left promiscuous mode [ 19.406298][ T11] br0: port 1(veth01) entered disabled state [ 20.019192][ T11] IPVS: stop unused estimator thread 0... [ 20.033622][ T11] ================================================================== [ 20.033888][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 20.034079][ T11] Read of size 8 at addr ffff888008ff00f8 by task kworker/u16:0/11 [ 20.034264][ T11] [ 20.034331][ T11] CPU: 1 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 20.034529][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 20.034698][ T11] Workqueue: netns cleanup_net [ 20.034831][ T11] Call Trace: [ 20.034926][ T11] [ 20.034994][ T11] dump_stack_lvl+0x82/0xd0 [ 20.035123][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 20.035280][ T11] ? cleanup_net+0x932/0xa40 [ 20.035406][ T11] print_report+0xb4/0x270 [ 20.035538][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 20.035668][ T11] kasan_report+0xbd/0xf0 [ 20.035768][ T11] ? cleanup_net+0x932/0xa40 [ 20.035898][ T11] cleanup_net+0x932/0xa40 [ 20.036023][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 20.036150][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 20.036278][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 20.036409][ T11] ? lock_acquire+0x32/0xc0 [ 20.036536][ T11] ? process_one_work+0xe0b/0x16d0 [ 20.036665][ T11] process_one_work+0xe55/0x16d0 [ 20.036790][ T11] ? __pfx___lock_release+0x10/0x10 [ 20.036921][ T11] ? __pfx_process_one_work+0x10/0x10 [ 20.037048][ T11] ? assign_work+0x16c/0x240 [ 20.037171][ T11] worker_thread+0x58c/0xce0 [ 20.037297][ T11] ? __pfx_worker_thread+0x10/0x10 [ 20.037419][ T11] kthread+0x28a/0x350 [ 20.037514][ T11] ? __pfx_kthread+0x10/0x10 [ 20.037644][ T11] ret_from_fork+0x31/0x70 [ 20.037767][ T11] ? __pfx_kthread+0x10/0x10 [ 20.037891][ T11] ret_from_fork_asm+0x1a/0x30 [ 20.038019][ T11] [ 20.038112][ T11] [ 20.038176][ T11] Allocated by task 259: [ 20.038272][ T11] kasan_save_stack+0x24/0x50 [ 20.038397][ T11] kasan_save_track+0x14/0x30 [ 20.038522][ T11] __kasan_slab_alloc+0x59/0x70 [ 20.038650][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 20.038773][ T11] copy_net_ns+0xc6/0x340 [ 20.038865][ T11] create_new_namespaces+0x35f/0x920 [ 20.038989][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 20.039112][ T11] ksys_unshare+0x2a9/0x660 [ 20.039238][ T11] __x64_sys_unshare+0x31/0x40 [ 20.039362][ T11] do_syscall_64+0xc1/0x1d0 [ 20.039488][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 20.039642][ T11] [ 20.039706][ T11] Freed by task 11: [ 20.039801][ T11] kasan_save_stack+0x24/0x50 [ 20.039927][ T11] kasan_save_track+0x14/0x30 [ 20.040052][ T11] kasan_save_free_info+0x3b/0x60 [ 20.040178][ T11] __kasan_slab_free+0x38/0x50 [ 20.040307][ T11] kmem_cache_free+0xf8/0x330 [ 20.040442][ T11] cleanup_net+0x5a8/0xa40 [ 20.040568][ T11] process_one_work+0xe55/0x16d0 [ 20.040693][ T11] worker_thread+0x58c/0xce0 [ 20.040815][ T11] kthread+0x28a/0x350 [ 20.040910][ T11] ret_from_fork+0x31/0x70 [ 20.041032][ T11] ret_from_fork_asm+0x1a/0x30 [ 20.041156][ T11] [ 20.041220][ T11] Last potentially related work creation: [ 20.041344][ T11] kasan_save_stack+0x24/0x50 [ 20.041475][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 20.041601][ T11] insert_work+0x34/0x230 [ 20.041697][ T11] __queue_work+0x5fd/0xa40 [ 20.041822][ T11] queue_delayed_work_on+0x8c/0xa0 [ 20.041947][ T11] __inet_insert_ifa+0x751/0xb10 [ 20.042074][ T11] inet_rtm_newaddr+0x833/0xbd0 [ 20.042201][ T11] rtnetlink_rcv_msg+0x712/0xc10 [ 20.042330][ T11] netlink_rcv_skb+0x130/0x360 [ 20.042461][ T11] netlink_unicast+0x44b/0x710 [ 20.042588][ T11] netlink_sendmsg+0x723/0xbe0 [ 20.042715][ T11] ____sys_sendmsg+0x7ac/0xa10 [ 20.042841][ T11] ___sys_sendmsg+0xee/0x170 [ 20.042967][ T11] __sys_sendmsg+0x109/0x1a0 [ 20.043092][ T11] do_syscall_64+0xc1/0x1d0 [ 20.043219][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 20.043375][ T11] [ 20.043456][ T11] Second to last potentially related work creation: [ 20.043608][ T11] kasan_save_stack+0x24/0x50 [ 20.043737][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 20.043863][ T11] insert_work+0x34/0x230 [ 20.043957][ T11] __queue_work+0x5fd/0xa40 [ 20.044081][ T11] queue_delayed_work_on+0x8c/0xa0 [ 20.044207][ T11] __inet_insert_ifa+0x751/0xb10 [ 20.044336][ T11] inetdev_event+0xb18/0xcf0 [ 20.044460][ T11] notifier_call_chain+0xcd/0x150 [ 20.044588][ T11] __dev_notify_flags+0xe6/0x250 [ 20.044713][ T11] dev_change_flags+0xec/0x160 [ 20.044839][ T11] do_setlink.constprop.0+0x79d/0x2300 [ 20.044965][ T11] rtnl_newlink+0x6de/0xa80 [ 20.045089][ T11] rtnetlink_rcv_msg+0x712/0xc10 [ 20.045214][ T11] netlink_rcv_skb+0x130/0x360 [ 20.045342][ T11] netlink_unicast+0x44b/0x710 [ 20.045468][ T11] netlink_sendmsg+0x723/0xbe0 [ 20.045593][ T11] ____sys_sendmsg+0x7ac/0xa10 [ 20.045718][ T11] ___sys_sendmsg+0xee/0x170 [ 20.045844][ T11] __sys_sendmsg+0x109/0x1a0 [ 20.045968][ T11] do_syscall_64+0xc1/0x1d0 [ 20.046093][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 20.046252][ T11] [ 20.046320][ T11] The buggy address belongs to the object at ffff888008ff0040 [ 20.046320][ T11] which belongs to the cache net_namespace of size 6592 [ 20.046648][ T11] The buggy address is located 184 bytes inside of [ 20.046648][ T11] freed 6592-byte region [ffff888008ff0040, ffff888008ff1a00) [ 20.046956][ T11] [ 20.047019][ T11] The buggy address belongs to the physical page: [ 20.047174][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888008ff5200 pfn:0x8ff0 [ 20.047428][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.047615][ T11] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 20.047775][ T11] page_type: f5(slab) [ 20.047873][ T11] raw: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 20.048098][ T11] raw: ffff888008ff5200 0000000000040003 00000001f5000000 0000000000000000 [ 20.048320][ T11] head: 0080000000000240 ffff888001963240 ffff888001968088 ffff888001968088 [ 20.048542][ T11] head: ffff888008ff5200 0000000000040003 00000001f5000000 0000000000000000 [ 20.048761][ T11] head: 0080000000000003 ffffea000023fc01 ffffffffffffffff 0000000000000000 [ 20.048981][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 20.049200][ T11] page dumped because: kasan: bad access detected [ 20.049354][ T11] [ 20.049417][ T11] Memory state around the buggy address: [ 20.049538][ T11] ffff888008feff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.049720][ T11] ffff888008ff0000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 20.049904][ T11] >ffff888008ff0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.050085][ T11] ^ [ 20.050265][ T11] ffff888008ff0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.050441][ T11] ffff888008ff0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.050623][ T11] ================================================================== [ 20.051013][ T11] Disabling lock debugging due to kernel taint [ 22.340181][ T352] br0: port 1(veth01) entered blocking state [ 22.341033][ T352] br0: port 1(veth01) entered disabled state [ 22.341293][ T352] veth01: entered allmulticast mode [ 22.342789][ T352] veth01: entered promiscuous mode [ 22.466097][ T353] br0: port 2(veth02) entered blocking state [ 22.466440][ T353] br0: port 2(veth02) entered disabled state [ 22.466745][ T353] veth02: entered allmulticast mode [ 22.468300][ T353] veth02: entered promiscuous mode [ 22.851910][ T56] br0: port 1(veth01) entered blocking state [ 22.852175][ T56] br0: port 1(veth01) entered forwarding state [ 23.640170][ T39] br0: port 2(veth02) entered blocking state [ 23.640514][ T39] br0: port 2(veth02) entered forwarding state [ 25.206750][ T64] IPVS: starting estimator thread 0... [ 25.269377][ T369] IPVS: using max 109 ests per chain, 261600 per kthread [ 25.576815][ T372] br0: port 2(veth02) entered disabled state [ 25.683662][ T372] veth02 (unregistering): left allmulticast mode [ 25.683993][ T372] veth02 (unregistering): left promiscuous mode [ 25.684201][ T372] br0: port 2(veth02) entered disabled state [ 26.454661][ T11] veth01: left allmulticast mode [ 26.454873][ T11] veth01: left promiscuous mode [ 26.455150][ T11] br0: port 1(veth01) entered disabled state [ 26.842033][ T11] IPVS: stop unused estimator thread 0... [ 29.070212][ T424] br0: port 1(veth01) entered blocking state [ 29.070657][ T424] br0: port 1(veth01) entered disabled state [ 29.070979][ T424] veth01: entered allmulticast mode [ 29.072460][ T424] veth01: entered promiscuous mode [ 29.195232][ T425] br0: port 2(veth02) entered blocking state [ 29.195477][ T425] br0: port 2(veth02) entered disabled state [ 29.195695][ T425] veth02: entered allmulticast mode [ 29.197175][ T425] veth02: entered promiscuous mode [ 29.561645][ T39] br0: port 1(veth01) entered blocking state [ 29.561927][ T39] br0: port 1(veth01) entered forwarding state [ 30.329409][ T37] br0: port 2(veth02) entered blocking state [ 30.329650][ T37] br0: port 2(veth02) entered forwarding state [ 31.810382][ T439] ipip: IPv4 and MPLS over IPv4 tunneling driver [ 32.390827][ T9] IPVS: starting estimator thread 0... [ 32.454377][ T448] IPVS: using max 108 ests per chain, 259200 per kthread [ 34.166504][ T11] veth02: left allmulticast mode [ 34.166743][ T11] veth02: left promiscuous mode [ 34.167053][ T11] br0: port 2(veth02) entered disabled state [ 34.168203][ T11] veth01: left allmulticast mode [ 34.168421][ T11] veth01: left promiscuous mode [ 34.168708][ T11] br0: port 1(veth01) entered disabled state [ 34.581737][ T11] IPVS: stop unused estimator thread 0...