[ 493.000856][ T5659] lag1: Mode changed to "loadbalance" [ 493.039121][ T5660] 8021q: adding VLAN 0 to HW filter on device lag1 [ 493.175457][ T5667] lag1: Port device veth0 added [ 493.211334][ T5670] lag1: Port device veth6 added [ 493.374469][ T5685] 8021q: adding VLAN 0 to HW filter on device lag1 [ 493.881056][ T5708] lag4: Mode changed to "loadbalance" [ 493.907923][ T5711] 8021q: adding VLAN 0 to HW filter on device lag4 [ 494.101575][ T5719] lag4: Port device veth3 added [ 494.123245][ T5720] lag4: Port device veth5 added [ 494.255535][ T5726] 8021q: adding VLAN 0 to HW filter on device lag4 [ 494.758562][ T5749] lag2: Mode changed to "loadbalance" [ 494.805070][ T5752] 8021q: adding VLAN 0 to HW filter on device lag2 [ 494.989212][ T5760] lag2: Port device veth1 added [ 495.027407][ T5761] lag2: Port device veth7 added [ 495.294464][ T5775] br1: port 1(lag2.100) entered blocking state [ 495.294647][ T5775] br1: port 1(lag2.100) entered disabled state [ 495.294834][ T5775] lag2.100: entered allmulticast mode [ 495.294948][ T5775] lag2: entered allmulticast mode [ 495.295069][ T5775] veth1: entered allmulticast mode [ 495.295197][ T5775] veth7: entered allmulticast mode [ 495.297309][ T5775] lag2.100: entered promiscuous mode [ 495.297447][ T5775] lag2: entered promiscuous mode [ 495.297574][ T5775] veth1: entered promiscuous mode [ 495.297861][ T5775] veth7: entered promiscuous mode [ 495.430314][ T5783] br2: port 1(lag2.200) entered blocking state [ 495.430498][ T5783] br2: port 1(lag2.200) entered disabled state [ 495.430670][ T5783] lag2.200: entered allmulticast mode [ 495.432813][ T5783] lag2.200: entered promiscuous mode [ 495.505627][ T5786] br1: port 1(lag2.100) entered blocking state [ 495.505825][ T5786] br1: port 1(lag2.100) entered forwarding state [ 495.530334][ T5787] br2: port 1(lag2.200) entered blocking state [ 495.530520][ T5787] br2: port 1(lag2.200) entered forwarding state [ 495.707481][ T5795] lag3: Mode changed to "loadbalance" [ 495.753599][ T5798] 8021q: adding VLAN 0 to HW filter on device lag3 [ 495.910751][ T5806] lag3: Port device veth2 added [ 495.938636][ T5807] lag3: Port device veth4 added [ 505.986459][ T5896] veth7: left promiscuous mode [ 505.987173][ T5896] veth7: left allmulticast mode [ 505.989052][ T5896] lag2: Port device veth7 removed [ 520.368186][ T5959] veth7: entered promiscuous mode [ 520.368534][ T5959] veth7: entered allmulticast mode [ 520.369402][ T5959] lag2: Port device veth7 added [ 520.483071][ T5970] veth1: left promiscuous mode [ 520.483335][ T5970] veth1: left allmulticast mode [ 520.484713][ T5970] lag2: Port device veth1 removed [ 534.845112][ T93] br1: port 1(lag2.100) entered disabled state [ 534.847328][ T93] br2: port 1(lag2.200) entered disabled state [ 534.873072][ T6033] veth7: left promiscuous mode [ 534.873398][ T6033] veth7: left allmulticast mode [ 534.874346][ T6033] lag2: Port device veth7 removed [ 534.993184][ T6044] veth1: entered promiscuous mode [ 534.993511][ T6044] veth1: entered allmulticast mode [ 534.995518][ T6044] lag2: Port device veth1 added [ 535.014129][ T527] br1: port 1(lag2.100) entered blocking state [ 535.014308][ T527] br1: port 1(lag2.100) entered forwarding state [ 535.015046][ T527] br2: port 1(lag2.200) entered blocking state [ 535.015199][ T527] br2: port 1(lag2.200) entered forwarding state [ 535.122996][ T6055] veth7: entered promiscuous mode [ 535.123351][ T6055] veth7: entered allmulticast mode [ 535.125056][ T6055] lag2: Port device veth7 added [ 549.489478][ T6117] lag2.200: left allmulticast mode [ 549.490076][ T6117] lag2.200: left promiscuous mode [ 549.490566][ T6117] br2: port 1(lag2.200) entered disabled state [ 549.524047][ T6118] lag2.100: left allmulticast mode [ 549.524196][ T6118] lag2: left allmulticast mode [ 549.524325][ T6118] veth1: left allmulticast mode [ 549.524458][ T6118] veth7: left allmulticast mode [ 549.524741][ T6118] lag2.100: left promiscuous mode [ 549.524867][ T6118] lag2: left promiscuous mode [ 549.524992][ T6118] veth1: left promiscuous mode [ 549.525275][ T6118] veth7: left promiscuous mode [ 549.526026][ T6118] br1: port 1(lag2.100) entered disabled state [ 551.558884][ T6120] br1: port 1(lag2.100) entered blocking state [ 551.559096][ T6120] br1: port 1(lag2.100) entered disabled state [ 551.559293][ T6120] lag2.100: entered allmulticast mode [ 551.559414][ T6120] lag2: entered allmulticast mode [ 551.559541][ T6120] veth1: entered allmulticast mode [ 551.559673][ T6120] veth7: entered allmulticast mode [ 551.561299][ T6120] lag2.100: entered promiscuous mode [ 551.561436][ T6120] lag2: entered promiscuous mode [ 551.561565][ T6120] veth1: entered promiscuous mode [ 551.561852][ T6120] veth7: entered promiscuous mode [ 551.562653][ T6120] br1: port 1(lag2.100) entered blocking state [ 551.562825][ T6120] br1: port 1(lag2.100) entered forwarding state [ 551.585081][ T6121] br2: port 1(lag2.200) entered blocking state [ 551.585298][ T6121] br2: port 1(lag2.200) entered disabled state [ 551.585524][ T6121] lag2.200: entered allmulticast mode [ 551.587520][ T6121] lag2.200: entered promiscuous mode [ 551.588879][ T6121] br2: port 1(lag2.200) entered blocking state [ 551.589090][ T6121] br2: port 1(lag2.200) entered forwarding state [ 565.963322][ T6183] lag3: Port device veth2 removed [ 580.363034][ T6246] lag3: Port device veth2 added [ 580.479087][ T6257] lag3: Port device veth4 removed [ 594.863871][ T6320] lag3: Port device veth2 removed [ 594.985295][ T6331] lag3: Port device veth4 added [ 595.102998][ T6342] lag3: Port device veth2 added [ 609.816917][ T6414] lag3: Port device veth4 removed [ 609.839720][ T6416] lag3: Port device veth2 removed [ 609.893599][ T5749] ================================================================== [ 609.893751][ T5749] BUG: KASAN: slab-use-after-free in rtnl_fill_prop_list+0x5ad/0x600 [ 609.893912][ T5749] Read of size 8 at addr ff110000026dab50 by task teamd/5749 [ 609.894034][ T5749] [ 609.894078][ T5749] CPU: 1 UID: 0 PID: 5749 Comm: teamd Not tainted 7.1.0-rc3-virtme #1 PREEMPT(full) [ 609.894082][ T5749] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 609.894084][ T5749] Call Trace: [ 609.894085][ T5749] [ 609.894087][ T5749] dump_stack_lvl+0x6f/0xa0 [ 609.894093][ T5749] print_address_description.constprop.0+0x56/0x2d0 [ 609.894097][ T5749] print_report+0xfc/0x1fa [ 609.894099][ T5749] ? __virt_addr_valid+0x102/0x440 [ 609.894103][ T5749] ? __virt_addr_valid+0x1da/0x440 [ 609.894106][ T5749] kasan_report+0x108/0x130 [ 609.894109][ T5749] ? rtnl_fill_prop_list+0x5ad/0x600 [ 609.894111][ T5749] ? rtnl_fill_prop_list+0x5ad/0x600 [ 609.894113][ T5749] rtnl_fill_prop_list+0x5ad/0x600 [ 609.894114][ T5749] ? __asan_memcpy+0x3c/0x60 [ 609.894117][ T5749] rtnl_fill_ifinfo.isra.0+0x3dc/0x2a80 [ 609.894120][ T5749] ? rcu_read_lock_any_held+0x3c/0x90 [ 609.894122][ T5749] ? validate_chain+0x38b/0xc20 [ 609.894125][ T5749] ? rtnl_fill_vf+0x450/0x450 [ 609.894126][ T5749] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 609.894128][ T5749] ? lockdep_hardirqs_on+0x8c/0x130 [ 609.894131][ T5749] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 609.894133][ T5749] ? __lock_acquire+0x508/0xc10 [ 609.894135][ T5749] ? rtnl_fill_vfinfo+0x602/0xf70 [ 609.894137][ T5749] ? lock_acquire.part.0+0xbc/0x260 [ 609.894138][ T5749] ? find_held_lock+0x2b/0x80 [ 609.894141][ T5749] ? __lock_release.isra.0+0x6b/0x1a0 [ 609.894143][ T5749] ? mark_held_locks+0x40/0x70 [ 609.894144][ T5749] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 609.894146][ T5749] ? lockdep_hardirqs_on+0x8c/0x130 [ 609.894147][ T5749] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 609.894149][ T5749] rtnl_getlink+0xa48/0xe50 [ 609.894152][ T5749] ? find_held_lock+0x2b/0x80 [ 609.894154][ T5749] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 609.894155][ T5749] ? mark_usage+0x61/0x170 [ 609.894157][ T5749] ? __lock_release.isra.0+0x6b/0x1a0 [ 609.894158][ T5749] ? __lock_acquire+0x508/0xc10 [ 609.894166][ T5749] ? lock_acquire.part.0+0xbc/0x260 [ 609.894167][ T5749] ? find_held_lock+0x2b/0x80 [ 609.894169][ T5749] ? mark_usage+0x61/0x170 [ 609.894170][ T5749] ? __lock_release.isra.0+0x6b/0x1a0 [ 609.894171][ T5749] ? __lock_acquire+0x508/0xc10 [ 609.894173][ T5749] ? bpf_address_lookup+0x282/0x290 [ 609.894176][ T5749] ? lock_acquire.part.0+0xbc/0x260 [ 609.894178][ T5749] ? find_held_lock+0x2b/0x80 [ 609.894179][ T5749] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 609.894181][ T5749] ? __lock_release.isra.0+0x6b/0x1a0 [ 609.894183][ T5749] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 609.894184][ T5749] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 609.894186][ T5749] ? validate_chain+0x38b/0xc20 [ 609.894188][ T5749] ? rtnl_link_fill+0x900/0x900 [ 609.894189][ T5749] ? __lock_acquire+0x508/0xc10 [ 609.894191][ T5749] ? lock_acquire.part.0+0xbc/0x260 [ 609.894192][ T5749] ? find_held_lock+0x2b/0x80 [ 609.894195][ T5749] netlink_rcv_skb+0x14e/0x3a0 [ 609.894198][ T5749] ? rtnl_link_fill+0x900/0x900 [ 609.894199][ T5749] ? netlink_ack+0xcd0/0xcd0 [ 609.894202][ T5749] ? netlink_deliver_tap+0xc5/0x330 [ 609.894204][ T5749] ? netlink_deliver_tap+0x13c/0x330 [ 609.894207][ T5749] netlink_unicast+0x4af/0x780 [ 609.894209][ T5749] ? netlink_attachskb+0x800/0x800 [ 609.894210][ T5749] ? trace_irq_enable.constprop.0+0x9b/0x180 [ 609.894213][ T5749] ? __lock_acquire+0x508/0xc10 [ 609.894215][ T5749] netlink_sendmsg+0x735/0xc60 [ 609.894218][ T5749] ? netlink_unicast+0x780/0x780 [ 609.894220][ T5749] ? __might_fault+0x97/0x140 [ 609.894224][ T5749] ____sys_sendmsg+0x419/0x850 [ 609.894227][ T5749] ? copy_msghdr_from_user+0x2a0/0x460 [ 609.894229][ T5749] ? get_timestamp.constprop.0+0x3a0/0x3a0 [ 609.894231][ T5749] ? move_addr_to_kernel+0x40/0x40 [ 609.894235][ T5749] ___sys_sendmsg+0x14e/0x1d0 [ 609.894237][ T5749] ? copy_msghdr_from_user+0x460/0x460 [ 609.894238][ T5749] ? kfree+0x22/0x5a0 [ 609.894245][ T5749] ? rcu_is_watching+0x15/0xd0 [ 609.894247][ T5749] ? rcu_is_watching+0x15/0xd0 [ 609.894249][ T5749] __sys_sendmsg+0x145/0x1f0 [ 609.894252][ T5749] ? __sys_sendmsg_sock+0x20/0x20 [ 609.894255][ T5749] ? rcu_is_watching+0x15/0xd0 [ 609.894257][ T5749] do_syscall_64+0x117/0xfc0 [ 609.894260][ T5749] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 609.894262][ T5749] RIP: 0033:0x7f6e0011808e [ 609.894265][ T5749] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa [ 609.894267][ T5749] RSP: 002b:00007ffe4831dad0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 609.894271][ T5749] RAX: ffffffffffffffda RBX: 0000565261f5a330 RCX: 00007f6e0011808e [ 609.894273][ T5749] RDX: 0000000000000000 RSI: 00007ffe4831db70 RDI: 0000000000000005 [ 609.894274][ T5749] RBP: 00007ffe4831dae0 R08: 0000000000000000 R09: 0000000000000000 [ 609.894275][ T5749] R10: 0000000000000000 R11: 0000000000000202 R12: 0000565261f638a0 [ 609.894276][ T5749] R13: 00007ffe4831db70 R14: 0000565261f5a240 R15: 00007ffe4831dcb0 [ 609.894278][ T5749] [ 609.894279][ T5749] [ 609.901552][ T5749] Allocated by task 5795: [ 609.901613][ T5749] kasan_save_stack+0x2f/0x50 [ 609.901684][ T5749] kasan_save_track+0x14/0x30 [ 609.901752][ T5749] __kasan_kmalloc+0x7b/0x90 [ 609.901820][ T5749] register_netdevice+0x48b/0x1980 [ 609.901891][ T5749] team_newlink+0xa2/0x1a0 [ 609.901960][ T5749] rtnl_newlink_create+0x2da/0x780 [ 609.902068][ T5749] __rtnl_newlink+0x22b/0xa50 [ 609.902135][ T5749] rtnl_newlink+0x8d1/0xee0 [ 609.902203][ T5749] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 609.902270][ T5749] netlink_rcv_skb+0x14e/0x3a0 [ 609.902379][ T5749] netlink_unicast+0x4af/0x780 [ 609.902446][ T5749] netlink_sendmsg+0x735/0xc60 [ 609.902513][ T5749] ____sys_sendmsg+0x419/0x850 [ 609.902581][ T5749] ___sys_sendmsg+0x14e/0x1d0 [ 609.902691][ T5749] __sys_sendmsg+0x145/0x1f0 [ 609.902760][ T5749] do_syscall_64+0x117/0xfc0 [ 609.902826][ T5749] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 609.902911][ T5749] [ 609.902987][ T5749] Freed by task 5795: [ 609.903042][ T5749] kasan_save_stack+0x2f/0x50 [ 609.903111][ T5749] kasan_save_track+0x14/0x30 [ 609.903182][ T5749] kasan_save_free_info+0x3b/0x60 [ 609.903291][ T5749] __kasan_slab_free+0x43/0x70 [ 609.903361][ T5749] kfree+0x123/0x5a0 [ 609.903412][ T5749] unregister_netdevice_many_notify+0xe38/0x1d80 [ 609.903496][ T5749] rtnl_dellink+0x4a0/0xae0 [ 609.903606][ T5749] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 609.903674][ T5749] netlink_rcv_skb+0x14e/0x3a0 [ 609.903741][ T5749] netlink_unicast+0x4af/0x780 [ 609.903809][ T5749] netlink_sendmsg+0x735/0xc60 [ 609.903916][ T5749] ____sys_sendmsg+0x419/0x850 [ 609.903983][ T5749] ___sys_sendmsg+0x14e/0x1d0 [ 609.904051][ T5749] __sys_sendmsg+0x145/0x1f0 [ 609.904119][ T5749] do_syscall_64+0x117/0xfc0 [ 609.904226][ T5749] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 609.904310][ T5749] [ 609.904344][ T5749] The buggy address belongs to the object at ff110000026dab40 [ 609.904344][ T5749] which belongs to the cache kmalloc-64 of size 64 [ 609.904548][ T5749] The buggy address is located 16 bytes inside of [ 609.904548][ T5749] freed 64-byte region [ff110000026dab40, ff110000026dab80) [ 609.904718][ T5749] [ 609.904753][ T5749] The buggy address belongs to the physical page: [ 609.904874][ T5749] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff110000026da740 pfn:0x26da [ 609.905012][ T5749] flags: 0x80000000000200(workingset|node=0|zone=1) [ 609.905102][ T5749] page_type: f5(slab) [ 609.905199][ T5749] raw: 0080000000000200 ff1100000103cac0 ffd40000004749d0 ffd400000052dfd0 [ 609.905321][ T5749] raw: ff110000026da740 000000000010000e 00000000f5000000 0000000000000000 [ 609.905486][ T5749] page dumped because: kasan: bad access detected [ 609.905571][ T5749] [ 609.905609][ T5749] Memory state around the buggy address: [ 609.905675][ T5749] ff110000026daa00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 fc [ 609.905819][ T5749] ff110000026daa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 609.905916][ T5749] >ff110000026dab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 609.906015][ T5749] ^ [ 609.906138][ T5749] ff110000026dab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 609.906236][ T5749] ff110000026dac00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 609.906333][ T5749] ================================================================== [ 609.906482][ T5749] Disabling lock debugging due to kernel taint [ 610.043985][ T6429] br2: port 1(lag2.200) entered disabled state [ 610.062641][ T6430] br1: port 1(lag2.100) entered disabled state [ 610.109032][ T6433] lag2.200: left allmulticast mode [ 610.109170][ T6433] lag2.200: left promiscuous mode [ 610.109432][ T6433] br2: port 1(lag2.200) entered disabled state [ 610.170551][ T6435] lag2.100: left allmulticast mode [ 610.170649][ T6435] lag2: left allmulticast mode [ 610.171069][ T6435] veth1: left allmulticast mode [ 610.171150][ T6435] veth7: left allmulticast mode [ 610.171287][ T6435] lag2.100: left promiscuous mode [ 610.171359][ T6435] lag2: left promiscuous mode [ 610.171432][ T6435] veth1: left promiscuous mode [ 610.171613][ T6435] veth7: left promiscuous mode [ 610.171954][ T6435] br1: port 1(lag2.100) entered disabled state [ 610.285685][ T6439] lag2: Port device veth7 removed [ 610.306479][ T6440] lag2: Port device veth1 removed [ 610.672613][ T6455] lag4: Port device veth5 removed [ 610.690131][ T6456] lag4: Port device veth3 removed [ 611.054144][ T6471] lag1: Port device veth6 removed [ 611.067846][ T6472] lag1: Port device veth0 removed