[ 15.512913][ T269] ip (269) used greatest stack depth: 23048 bytes left [ 16.496077][ T277] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 16.691952][ T280] br0: port 1(veth1) entered blocking state [ 16.692406][ T280] br0: port 1(veth1) entered disabled state [ 16.692778][ T280] veth1: entered allmulticast mode [ 16.694765][ T280] veth1: entered promiscuous mode [ 16.798067][ T281] br0: port 2(veth2) entered blocking state [ 16.798386][ T281] br0: port 2(veth2) entered disabled state [ 16.798681][ T281] veth2: entered allmulticast mode [ 16.801268][ T281] veth2: entered promiscuous mode [ 16.913084][ T282] br0: port 3(veth3) entered blocking state [ 16.913581][ T282] br0: port 3(veth3) entered disabled state [ 16.913876][ T282] veth3: entered allmulticast mode [ 16.915760][ T282] veth3: entered promiscuous mode [ 17.771054][ T290] veth4: entered promiscuous mode [ 17.899728][ T291] br0: port 4(macvlan4) entered blocking state [ 17.900228][ T291] br0: port 4(macvlan4) entered disabled state [ 17.900696][ T291] macvlan4: entered allmulticast mode [ 17.900988][ T291] veth4: entered allmulticast mode [ 17.904004][ T291] macvlan4: entered promiscuous mode [ 18.022672][ T292] br0: entered promiscuous mode [ 18.299941][ T294] Bridge firewalling registered [ 19.891943][ T46] br0: port 1(veth1) entered blocking state [ 19.892365][ T46] br0: port 1(veth1) entered forwarding state [ 19.993931][ T40] br0: port 2(veth2) entered blocking state [ 19.994232][ T40] br0: port 2(veth2) entered forwarding state [ 20.111592][ T39] br0: port 3(veth3) entered blocking state [ 20.112146][ T39] br0: port 3(veth3) entered forwarding state [ 20.226046][ T40] br0: port 4(macvlan4) entered blocking state [ 20.226507][ T40] br0: port 4(macvlan4) entered forwarding state [ 74.334732][ T11] macvlan4: left allmulticast mode [ 74.335072][ T11] veth4: left allmulticast mode [ 74.335429][ T11] macvlan4: left promiscuous mode [ 74.335846][ T11] br0: port 4(macvlan4) entered disabled state [ 74.338998][ T11] veth3: left allmulticast mode [ 74.339201][ T11] veth3: left promiscuous mode [ 74.339512][ T11] br0: port 3(veth3) entered disabled state [ 74.341302][ T11] veth2: left allmulticast mode [ 74.341547][ T11] veth2: left promiscuous mode [ 74.341844][ T11] br0: port 2(veth2) entered disabled state [ 74.343613][ T11] veth1: left allmulticast mode [ 74.343837][ T11] veth1: left promiscuous mode [ 74.344138][ T11] br0: port 1(veth1) entered disabled state [ 74.430055][ T11] veth4: left promiscuous mode [ 74.889515][ T11] ================================================================== [ 74.889747][ T11] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 74.889945][ T11] Read of size 8 at addr ffff888009be80f8 by task kworker/u16:0/11 [ 74.890142][ T11] [ 74.890213][ T11] CPU: 2 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.12.0-virtme #1 [ 74.890401][ T11] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 74.890563][ T11] Workqueue: netns cleanup_net [ 74.890711][ T11] Call Trace: [ 74.890812][ T11] [ 74.890878][ T11] dump_stack_lvl+0x82/0xd0 [ 74.891007][ T11] print_address_description.constprop.0+0x2c/0x3b0 [ 74.891170][ T11] ? cleanup_net+0x932/0xa40 [ 74.891300][ T11] print_report+0xb4/0x270 [ 74.891429][ T11] ? kasan_addr_to_slab+0x25/0x80 [ 74.891558][ T11] kasan_report+0xbd/0xf0 [ 74.891653][ T11] ? cleanup_net+0x932/0xa40 [ 74.891776][ T11] cleanup_net+0x932/0xa40 [ 74.891908][ T11] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 74.892038][ T11] ? __pfx_cleanup_net+0x10/0x10 [ 74.892168][ T11] ? trace_lock_acquire+0x148/0x1f0 [ 74.892295][ T11] ? lock_acquire+0x32/0xc0 [ 74.892423][ T11] ? process_one_work+0xe0b/0x16d0 [ 74.892549][ T11] process_one_work+0xe55/0x16d0 [ 74.892681][ T11] ? __pfx___lock_release+0x10/0x10 [ 74.892805][ T11] ? __pfx_process_one_work+0x10/0x10 [ 74.892956][ T11] ? assign_work+0x16c/0x240 [ 74.893089][ T11] worker_thread+0x58c/0xce0 [ 74.893217][ T11] ? __pfx_worker_thread+0x10/0x10 [ 74.893339][ T11] kthread+0x28a/0x350 [ 74.893443][ T11] ? __pfx_kthread+0x10/0x10 [ 74.893567][ T11] ret_from_fork+0x31/0x70 [ 74.893694][ T11] ? __pfx_kthread+0x10/0x10 [ 74.893815][ T11] ret_from_fork_asm+0x1a/0x30 [ 74.893950][ T11] [ 74.894046][ T11] [ 74.894114][ T11] Allocated by task 248: [ 74.894213][ T11] kasan_save_stack+0x24/0x50 [ 74.894337][ T11] kasan_save_track+0x14/0x30 [ 74.894466][ T11] __kasan_slab_alloc+0x59/0x70 [ 74.894589][ T11] kmem_cache_alloc_noprof+0x10b/0x350 [ 74.894716][ T11] copy_net_ns+0xc6/0x340 [ 74.894809][ T11] create_new_namespaces+0x35f/0x920 [ 74.894969][ T11] unshare_nsproxy_namespaces+0x8d/0x130 [ 74.895112][ T11] ksys_unshare+0x2a9/0x660 [ 74.895245][ T11] __x64_sys_unshare+0x31/0x40 [ 74.895368][ T11] do_syscall_64+0xc1/0x1d0 [ 74.895498][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.895654][ T11] [ 74.895721][ T11] Freed by task 11: [ 74.895814][ T11] kasan_save_stack+0x24/0x50 [ 74.895937][ T11] kasan_save_track+0x14/0x30 [ 74.896072][ T11] kasan_save_free_info+0x3b/0x60 [ 74.896202][ T11] __kasan_slab_free+0x38/0x50 [ 74.896325][ T11] kmem_cache_free+0xf8/0x330 [ 74.896454][ T11] cleanup_net+0x5a8/0xa40 [ 74.896579][ T11] process_one_work+0xe55/0x16d0 [ 74.896708][ T11] worker_thread+0x58c/0xce0 [ 74.896831][ T11] kthread+0x28a/0x350 [ 74.896925][ T11] ret_from_fork+0x31/0x70 [ 74.897058][ T11] ret_from_fork_asm+0x1a/0x30 [ 74.897181][ T11] [ 74.897262][ T11] Last potentially related work creation: [ 74.897388][ T11] kasan_save_stack+0x24/0x50 [ 74.897518][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 74.897645][ T11] insert_work+0x34/0x230 [ 74.897740][ T11] __queue_work+0x5fd/0xa40 [ 74.897867][ T11] queue_delayed_work_on+0x8c/0xa0 [ 74.897995][ T11] __inet_insert_ifa+0x751/0xb10 [ 74.898120][ T11] inet_rtm_newaddr+0x833/0xbd0 [ 74.898248][ T11] rtnetlink_rcv_msg+0x712/0xc10 [ 74.898384][ T11] netlink_rcv_skb+0x130/0x360 [ 74.898510][ T11] netlink_unicast+0x44b/0x710 [ 74.898636][ T11] netlink_sendmsg+0x723/0xbe0 [ 74.898768][ T11] ____sys_sendmsg+0x7ac/0xa10 [ 74.898894][ T11] ___sys_sendmsg+0xee/0x170 [ 74.899024][ T11] __sys_sendmsg+0x109/0x1a0 [ 74.899151][ T11] do_syscall_64+0xc1/0x1d0 [ 74.899288][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.899445][ T11] [ 74.899509][ T11] Second to last potentially related work creation: [ 74.899658][ T11] kasan_save_stack+0x24/0x50 [ 74.899784][ T11] __kasan_record_aux_stack+0x8e/0xa0 [ 74.899915][ T11] insert_work+0x34/0x230 [ 74.900007][ T11] __queue_work+0x5fd/0xa40 [ 74.900155][ T11] queue_delayed_work_on+0x8c/0xa0 [ 74.900277][ T11] __inet_insert_ifa+0x751/0xb10 [ 74.900404][ T11] inet_rtm_newaddr+0x833/0xbd0 [ 74.900525][ T11] rtnetlink_rcv_msg+0x712/0xc10 [ 74.900651][ T11] netlink_rcv_skb+0x130/0x360 [ 74.900775][ T11] netlink_unicast+0x44b/0x710 [ 74.900902][ T11] netlink_sendmsg+0x723/0xbe0 [ 74.901031][ T11] ____sys_sendmsg+0x7ac/0xa10 [ 74.901159][ T11] ___sys_sendmsg+0xee/0x170 [ 74.901283][ T11] __sys_sendmsg+0x109/0x1a0 [ 74.901405][ T11] do_syscall_64+0xc1/0x1d0 [ 74.901530][ T11] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.901685][ T11] [ 74.901749][ T11] The buggy address belongs to the object at ffff888009be8040 [ 74.901749][ T11] which belongs to the cache net_namespace of size 6592 [ 74.902072][ T11] The buggy address is located 184 bytes inside of [ 74.902072][ T11] freed 6592-byte region [ffff888009be8040, ffff888009be9a00) [ 74.902368][ T11] [ 74.902430][ T11] The buggy address belongs to the physical page: [ 74.902576][ T11] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9be8 [ 74.902801][ T11] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 74.903036][ T11] flags: 0x80000000000040(head|node=0|zone=1) [ 74.903191][ T11] page_type: f5(slab) [ 74.903286][ T11] raw: 0080000000000040 ffff888001963240 ffff8880019680a8 ffff8880019680a8 [ 74.903501][ T11] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 74.903722][ T11] head: 0080000000000040 ffff888001963240 ffff8880019680a8 ffff8880019680a8 [ 74.903964][ T11] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 74.904174][ T11] head: 0080000000000003 ffffea000026fa01 ffffffffffffffff 0000000000000000 [ 74.904390][ T11] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 74.904610][ T11] page dumped because: kasan: bad access detected [ 74.904766][ T11] [ 74.904857][ T11] Memory state around the buggy address: [ 74.904977][ T11] ffff888009be7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 74.905157][ T11] ffff888009be8000: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 74.905331][ T11] >ffff888009be8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 74.905513][ T11] ^ [ 74.905718][ T11] ffff888009be8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 74.905897][ T11] ffff888009be8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 74.906071][ T11] ================================================================== [ 74.906303][ T11] Disabling lock debugging due to kernel taint