====================================== | [ 3.578229] ------------[ cut here ]------------ | [ 3.578310] refcount_t: underflow; use-after-free. | [ 3.578379] WARNING: CPU: 0 PID: 68 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 3.578471] Modules linked in: nf_conntrack_netlink xt_REDIRECT tcp_diag inet_diag nft_chain_nat xt_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_tcpudp nft_compat nf_tables x_tables veth [ 3.578755] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 3.578820] Workqueue: netns cleanup_net [ 3.578865] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 3.578918] Code: 96 e8 18 ed b9 ff 90 0f 0b 90 90 c3 80 3d d9 ea ea 00 00 75 89 c6 05 d0 ea ea 00 01 90 48 c7 c7 78 de f1 96 e8 f5 ec b9 ff 90 <0f> 0b 90 90 c3 80 3d b4 ea ea 00 00 0f 85 62 ff ff ff c6 05 a7 ea All code ======== 0: 96 xchg %eax,%esi 1: e8 18 ed b9 ff call 0xffffffffffb9ed1e 6: 90 nop 7: 0f 0b ud2 9: 90 nop a: 90 nop b: c3 ret c: 80 3d d9 ea ea 00 00 cmpb $0x0,0xeaead9(%rip) # 0xeaeaec 13: 75 89 jne 0xffffffffffffff9e 15: c6 05 d0 ea ea 00 01 movb $0x1,0xeaead0(%rip) # 0xeaeaec 1c: 90 nop 1d: 48 c7 c7 78 de f1 96 mov $0xffffffff96f1de78,%rdi 24: e8 f5 ec b9 ff call 0xffffffffffb9ed1e 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: c3 ret 2f: 80 3d b4 ea ea 00 00 cmpb $0x0,0xeaeab4(%rip) # 0xeaeaea 36: 0f 85 62 ff ff ff jne 0xffffffffffffff9e 3c: c6 .byte 0xc6 3d: 05 .byte 0x5 3e: a7 cmpsl %es:(%rdi),%ds:(%rsi) 3f: ea (bad) Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: c3 ret 5: 80 3d b4 ea ea 00 00 cmpb $0x0,0xeaeab4(%rip) # 0xeaeac0 c: 0f 85 62 ff ff ff jne 0xffffffffffffff74 12: c6 .byte 0xc6 13: 05 .byte 0x5 14: a7 cmpsl %es:(%rdi),%ds:(%rsi) 15: ea (bad) [ 3.579100] RSP: 0018:ffffba170025bd50 EFLAGS: 00010286 [ 3.579171] RAX: 0000000000000000 RBX: ffffba170025bd60 RCX: 00000000ffffdfff [ 3.579256] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001 [ 3.579341] RBP: ffffba170025b868 R08: ffffffff97356d28 R09: 00000000ffffdfff [ 3.579422] R10: ffffffff97276d40 R11: ffffffff97326d40 R12: dead000000000122 [ 3.579498] R13: 00000000fffb7983 R14: 0000000000000001 R15: ffff9300c112b000 [ 3.579576] FS: 0000000000000000(0000) GS:ffff9301671d8000(0000) knlGS:0000000000000000 [ 3.579661] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.579726] CR2: 00000000004a00a4 CR3: 00000000072f9002 CR4: 0000000000772ef0 [ 3.579807] PKRU: 55555554 [ 3.579831] Call Trace: [ 3.579859] [ 3.579883] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 3.579934] ops_undo_list (net/core/net_namespace.c:190 net/core/net_namespace.c:248) [ 3.579986] cleanup_net (net/core/net_namespace.c:698) [ 3.580023] process_one_work (kernel/workqueue.c:3268) [ 3.580071] worker_thread (kernel/workqueue.c:3340 kernel/workqueue.c:3427) [ 3.580110] ? rescuer_thread (kernel/workqueue.c:3373) [ 3.580148] kthread (kernel/kthread.c:463) [ 3.580205] ? kthreads_online_cpu (kernel/kthread.c:412) [ 3.580260] ? kthreads_online_cpu (kernel/kthread.c:412) [ 3.580319] ret_from_fork (arch/x86/kernel/process.c:164) [ 3.580370] ? kthreads_online_cpu (kernel/kthread.c:412) Finger prints: refcount_warn_saturate:netdev_run_todo:ops_undo_list:cleanup_net:process_one_work