[ 14.881762][ T281] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 15.433032][ T291] br0: port 1(c1) entered blocking state [ 15.433418][ T291] br0: port 1(c1) entered disabled state [ 15.433712][ T291] c1: entered allmulticast mode [ 15.435709][ T291] c1: entered promiscuous mode [ 15.907779][ T296] br0: port 2(c2) entered blocking state [ 15.908016][ T296] br0: port 2(c2) entered disabled state [ 15.908269][ T296] c2: entered allmulticast mode [ 15.910164][ T296] c2: entered promiscuous mode [ 16.392539][ T301] br0: port 3(c3) entered blocking state [ 16.392824][ T301] br0: port 3(c3) entered disabled state [ 16.393040][ T301] c3: entered allmulticast mode [ 16.395377][ T301] c3: entered promiscuous mode [ 16.865735][ T306] br0: port 4(sender) entered blocking state [ 16.866033][ T306] br0: port 4(sender) entered disabled state [ 16.866324][ T306] sender: entered allmulticast mode [ 16.868221][ T306] sender: entered promiscuous mode [ 17.040251][ T308] br0: port 4(sender) entered blocking state [ 17.040667][ T308] br0: port 4(sender) entered forwarding state [ 17.041305][ T308] br0: port 3(c3) entered blocking state [ 17.041524][ T308] br0: port 3(c3) entered forwarding state [ 17.041961][ T308] br0: port 2(c2) entered blocking state [ 17.042181][ T308] br0: port 2(c2) entered forwarding state [ 17.042611][ T308] br0: port 1(c1) entered blocking state [ 17.042835][ T308] br0: port 1(c1) entered forwarding state [ 17.178132][ T309] Bridge firewalling registered [ 30.114466][ T68] br0: port 1(c1) entered disabled state [ 30.245990][ T68] c1 (unregistering): left allmulticast mode [ 30.246412][ T68] c1 (unregistering): left promiscuous mode [ 30.246652][ T68] br0: port 1(c1) entered disabled state [ 30.508118][ T68] br0: port 2(c2) entered disabled state [ 30.622322][ T68] c2 (unregistering): left allmulticast mode [ 30.622768][ T68] c2 (unregistering): left promiscuous mode [ 30.623127][ T68] br0: port 2(c2) entered disabled state [ 30.666418][ T68] ================================================================== [ 30.666672][ T68] BUG: KASAN: slab-use-after-free in cleanup_net+0x932/0xa40 [ 30.666883][ T68] Read of size 8 at addr ffff8880058b1c38 by task kworker/u16:1/68 [ 30.667128][ T68] [ 30.667214][ T68] CPU: 3 UID: 0 PID: 68 Comm: kworker/u16:1 Not tainted 6.12.0-virtme #1 [ 30.667471][ T68] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 30.667647][ T68] Workqueue: netns cleanup_net [ 30.667838][ T68] Call Trace: [ 30.667970][ T68] [ 30.668063][ T68] dump_stack_lvl+0x82/0xd0 [ 30.668267][ T68] print_address_description.constprop.0+0x2c/0x3b0 [ 30.668495][ T68] ? cleanup_net+0x932/0xa40 [ 30.668656][ T68] print_report+0xb4/0x270 [ 30.668844][ T68] ? kasan_addr_to_slab+0x25/0x80 [ 30.668983][ T68] kasan_report+0xbd/0xf0 [ 30.669115][ T68] ? cleanup_net+0x932/0xa40 [ 30.669294][ T68] cleanup_net+0x932/0xa40 [ 30.669433][ T68] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 30.669577][ T68] ? __pfx_cleanup_net+0x10/0x10 [ 30.669712][ T68] ? trace_lock_acquire+0x148/0x1f0 [ 30.669851][ T68] ? lock_acquire+0x32/0xc0 [ 30.670039][ T68] ? process_one_work+0xe0b/0x16d0 [ 30.670228][ T68] process_one_work+0xe55/0x16d0 [ 30.670375][ T68] ? __pfx___lock_release+0x10/0x10 [ 30.670554][ T68] ? __pfx_process_one_work+0x10/0x10 [ 30.670728][ T68] ? assign_work+0x16c/0x240 [ 30.670912][ T68] worker_thread+0x58c/0xce0 [ 30.671090][ T68] ? lockdep_hardirqs_on_prepare+0x275/0x410 [ 30.671325][ T68] ? __pfx_worker_thread+0x10/0x10 [ 30.671526][ T68] ? __pfx_worker_thread+0x10/0x10 [ 30.671676][ T68] kthread+0x28a/0x350 [ 30.671789][ T68] ? __pfx_kthread+0x10/0x10 [ 30.671958][ T68] ret_from_fork+0x31/0x70 [ 30.672122][ T68] ? __pfx_kthread+0x10/0x10 [ 30.672286][ T68] ret_from_fork_asm+0x1a/0x30 [ 30.672440][ T68] [ 30.672546][ T68] [ 30.672617][ T68] Allocated by task 269: [ 30.672721][ T68] kasan_save_stack+0x24/0x50 [ 30.672868][ T68] kasan_save_track+0x14/0x30 [ 30.673051][ T68] __kasan_slab_alloc+0x59/0x70 [ 30.673225][ T68] kmem_cache_alloc_noprof+0x10b/0x350 [ 30.673380][ T68] copy_net_ns+0xc6/0x340 [ 30.673530][ T68] create_new_namespaces+0x35f/0x920 [ 30.673710][ T68] unshare_nsproxy_namespaces+0x8d/0x130 [ 30.673906][ T68] ksys_unshare+0x2a9/0x660 [ 30.674108][ T68] __x64_sys_unshare+0x31/0x40 [ 30.674314][ T68] do_syscall_64+0xc1/0x1d0 [ 30.674528][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.674736][ T68] [ 30.674809][ T68] Freed by task 68: [ 30.674920][ T68] kasan_save_stack+0x24/0x50 [ 30.675096][ T68] kasan_save_track+0x14/0x30 [ 30.675266][ T68] kasan_save_free_info+0x3b/0x60 [ 30.675404][ T68] __kasan_slab_free+0x38/0x50 [ 30.675541][ T68] kmem_cache_free+0xf8/0x330 [ 30.675681][ T68] cleanup_net+0x5a8/0xa40 [ 30.675819][ T68] process_one_work+0xe55/0x16d0 [ 30.675976][ T68] worker_thread+0x58c/0xce0 [ 30.676153][ T68] kthread+0x28a/0x350 [ 30.676292][ T68] ret_from_fork+0x31/0x70 [ 30.676443][ T68] ret_from_fork_asm+0x1a/0x30 [ 30.676612][ T68] [ 30.676717][ T68] Last potentially related work creation: [ 30.676909][ T68] kasan_save_stack+0x24/0x50 [ 30.677118][ T68] __kasan_record_aux_stack+0x8e/0xa0 [ 30.677329][ T68] insert_work+0x34/0x230 [ 30.677488][ T68] __queue_work+0x5fd/0xa40 [ 30.677628][ T68] queue_delayed_work_on+0x8c/0xa0 [ 30.677767][ T68] __inet_insert_ifa+0x751/0xb10 [ 30.677908][ T68] inet_rtm_newaddr+0x833/0xbd0 [ 30.678092][ T68] rtnetlink_rcv_msg+0x712/0xc10 [ 30.678245][ T68] netlink_rcv_skb+0x130/0x360 [ 30.678387][ T68] netlink_unicast+0x44b/0x710 [ 30.678526][ T68] netlink_sendmsg+0x723/0xbe0 [ 30.678670][ T68] ____sys_sendmsg+0x7ac/0xa10 [ 30.678811][ T68] ___sys_sendmsg+0xee/0x170 [ 30.678995][ T68] __sys_sendmsg+0x109/0x1a0 [ 30.679137][ T68] do_syscall_64+0xc1/0x1d0 [ 30.679321][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.679495][ T68] [ 30.679568][ T68] Second to last potentially related work creation: [ 30.679780][ T68] kasan_save_stack+0x24/0x50 [ 30.679967][ T68] __kasan_record_aux_stack+0x8e/0xa0 [ 30.680147][ T68] insert_work+0x34/0x230 [ 30.680280][ T68] __queue_work+0x5fd/0xa40 [ 30.680464][ T68] queue_delayed_work_on+0x8c/0xa0 [ 30.680639][ T68] __inet_insert_ifa+0x751/0xb10 [ 30.680847][ T68] inetdev_event+0xb18/0xcf0 [ 30.681003][ T68] notifier_call_chain+0xcd/0x150 [ 30.681190][ T68] __dev_notify_flags+0xe6/0x250 [ 30.681353][ T68] dev_change_flags+0xec/0x160 [ 30.681494][ T68] do_setlink.constprop.0+0x79d/0x2300 [ 30.681634][ T68] rtnl_newlink+0x6de/0xa80 [ 30.681779][ T68] rtnetlink_rcv_msg+0x712/0xc10 [ 30.681919][ T68] netlink_rcv_skb+0x130/0x360 [ 30.682105][ T68] netlink_unicast+0x44b/0x710 [ 30.682284][ T68] netlink_sendmsg+0x723/0xbe0 [ 30.682488][ T68] ____sys_sendmsg+0x7ac/0xa10 [ 30.682626][ T68] ___sys_sendmsg+0xee/0x170 [ 30.682767][ T68] __sys_sendmsg+0x109/0x1a0 [ 30.682953][ T68] do_syscall_64+0xc1/0x1d0 [ 30.683093][ T68] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.683289][ T68] [ 30.683395][ T68] The buggy address belongs to the object at ffff8880058b1b80 [ 30.683395][ T68] which belongs to the cache net_namespace of size 6592 [ 30.683769][ T68] The buggy address is located 184 bytes inside of [ 30.683769][ T68] freed 6592-byte region [ffff8880058b1b80, ffff8880058b3540) [ 30.684187][ T68] [ 30.684279][ T68] The buggy address belongs to the physical page: [ 30.684450][ T68] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58b0 [ 30.684750][ T68] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 30.685073][ T68] flags: 0x80000000000040(head|node=0|zone=1) [ 30.685373][ T68] page_type: f5(slab) [ 30.685507][ T68] raw: 0080000000000040 ffff888001963240 ffffea00002e6010 ffff8880019680a8 [ 30.685760][ T68] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 30.686064][ T68] head: 0080000000000040 ffff888001963240 ffffea00002e6010 ffff8880019680a8 [ 30.686398][ T68] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 30.686687][ T68] head: 0080000000000003 ffffea0000162c01 ffffffffffffffff 0000000000000000 [ 30.686988][ T68] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 30.687496][ T68] page dumped because: kasan: bad access detected [ 30.687676][ T68] [ 30.687749][ T68] Memory state around the buggy address: [ 30.687885][ T68] ffff8880058b1b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.688152][ T68] ffff8880058b1b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.688390][ T68] >ffff8880058b1c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.688614][ T68] ^ [ 30.688862][ T68] ffff8880058b1c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.689124][ T68] ffff8880058b1d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.689463][ T68] ================================================================== [ 30.689750][ T68] Disabling lock debugging due to kernel taint [ 30.865655][ T68] br0: port 3(c3) entered disabled state [ 30.998062][ T68] c3 (unregistering): left allmulticast mode [ 30.998369][ T68] c3 (unregistering): left promiscuous mode [ 30.998589][ T68] br0: port 3(c3) entered disabled state [ 31.147146][ T68] br0: port 4(sender) entered disabled state [ 31.253780][ T68] sender (unregistering): left allmulticast mode [ 31.254098][ T68] sender (unregistering): left promiscuous mode [ 31.254400][ T68] br0: port 4(sender) entered disabled state