[ 293.352839][ T3206] lag1: Mode changed to "loadbalance" [ 293.389978][ T3207] 8021q: adding VLAN 0 to HW filter on device lag1 [ 293.616687][ T3215] lag1: Port device veth0 added [ 293.658143][ T3216] lag1: Port device veth6 added [ 293.804114][ T3222] 8021q: adding VLAN 0 to HW filter on device lag1 [ 294.380244][ T3245] lag4: Mode changed to "loadbalance" [ 294.413875][ T3247] 8021q: adding VLAN 0 to HW filter on device lag4 [ 294.582188][ T3256] lag4: Port device veth3 added [ 294.612697][ T3257] lag4: Port device veth5 added [ 294.750522][ T3263] 8021q: adding VLAN 0 to HW filter on device lag4 [ 295.257644][ T3286] lag2: Mode changed to "loadbalance" [ 295.283100][ T3287] 8021q: adding VLAN 0 to HW filter on device lag2 [ 295.457617][ T3295] lag2: Port device veth1 added [ 295.488700][ T3296] lag2: Port device veth7 added [ 295.741639][ T3310] br1: port 1(lag2.100) entered blocking state [ 295.741839][ T3310] br1: port 1(lag2.100) entered disabled state [ 295.742017][ T3310] lag2.100: entered allmulticast mode [ 295.742134][ T3310] lag2: entered allmulticast mode [ 295.742269][ T3310] veth1: entered allmulticast mode [ 295.742406][ T3310] veth7: entered allmulticast mode [ 295.744374][ T3310] lag2.100: entered promiscuous mode [ 295.744510][ T3310] lag2: entered promiscuous mode [ 295.744635][ T3310] veth1: entered promiscuous mode [ 295.744904][ T3310] veth7: entered promiscuous mode [ 295.883774][ T3318] br2: port 1(lag2.200) entered blocking state [ 295.884013][ T3318] br2: port 1(lag2.200) entered disabled state [ 295.884255][ T3318] lag2.200: entered allmulticast mode [ 295.885850][ T3318] lag2.200: entered promiscuous mode [ 295.961334][ T3321] br1: port 1(lag2.100) entered blocking state [ 295.961519][ T3321] br1: port 1(lag2.100) entered forwarding state [ 295.994559][ T3322] br2: port 1(lag2.200) entered blocking state [ 295.994740][ T3322] br2: port 1(lag2.200) entered forwarding state [ 296.167822][ T3330] lag3: Mode changed to "loadbalance" [ 296.198223][ T3333] 8021q: adding VLAN 0 to HW filter on device lag3 [ 296.373810][ T3341] lag3: Port device veth2 added [ 296.403076][ T3342] lag3: Port device veth4 added [ 306.350914][ T3431] veth7: left promiscuous mode [ 306.351250][ T3431] veth7: left allmulticast mode [ 306.359739][ T3431] lag2: Port device veth7 removed [ 320.734294][ T3494] veth7: entered promiscuous mode [ 320.734813][ T3494] veth7: entered allmulticast mode [ 320.736321][ T3494] lag2: Port device veth7 added [ 320.849806][ T3505] veth1: left promiscuous mode [ 320.850229][ T3505] veth1: left allmulticast mode [ 320.856938][ T3505] lag2: Port device veth1 removed [ 335.232554][ T39] br1: port 1(lag2.100) entered disabled state [ 335.233990][ T39] br2: port 1(lag2.200) entered disabled state [ 335.256067][ T3569] veth7: left promiscuous mode [ 335.256663][ T3569] veth7: left allmulticast mode [ 335.257667][ T3569] lag2: Port device veth7 removed [ 335.388985][ T3580] veth1: entered promiscuous mode [ 335.389327][ T3580] veth1: entered allmulticast mode [ 335.391925][ T3580] lag2: Port device veth1 added [ 335.410890][ T46] br1: port 1(lag2.100) entered blocking state [ 335.411061][ T46] br1: port 1(lag2.100) entered forwarding state [ 335.411597][ T46] br2: port 1(lag2.200) entered blocking state [ 335.411756][ T46] br2: port 1(lag2.200) entered forwarding state [ 335.523978][ T3591] veth7: entered promiscuous mode [ 335.524284][ T3591] veth7: entered allmulticast mode [ 335.525097][ T3591] lag2: Port device veth7 added [ 349.903403][ T3653] lag2.200: left allmulticast mode [ 349.904002][ T3653] lag2.200: left promiscuous mode [ 349.904960][ T3653] br2: port 1(lag2.200) entered disabled state [ 349.927380][ T3655] lag2.100: left allmulticast mode [ 349.927521][ T3655] lag2: left allmulticast mode [ 349.927654][ T3655] veth1: left allmulticast mode [ 349.927795][ T3655] veth7: left allmulticast mode [ 349.928037][ T3655] lag2.100: left promiscuous mode [ 349.928161][ T3655] lag2: left promiscuous mode [ 349.928810][ T3655] veth1: left promiscuous mode [ 349.929103][ T3655] veth7: left promiscuous mode [ 349.929698][ T3655] br1: port 1(lag2.100) entered disabled state [ 351.973140][ T3658] br1: port 1(lag2.100) entered blocking state [ 351.973356][ T3658] br1: port 1(lag2.100) entered disabled state [ 351.973542][ T3658] lag2.100: entered allmulticast mode [ 351.973665][ T3658] lag2: entered allmulticast mode [ 351.973796][ T3658] veth1: entered allmulticast mode [ 351.973927][ T3658] veth7: entered allmulticast mode [ 351.975602][ T3658] lag2.100: entered promiscuous mode [ 351.975731][ T3658] lag2: entered promiscuous mode [ 351.975866][ T3658] veth1: entered promiscuous mode [ 351.976153][ T3658] veth7: entered promiscuous mode [ 351.976918][ T3658] br1: port 1(lag2.100) entered blocking state [ 351.977083][ T3658] br1: port 1(lag2.100) entered forwarding state [ 352.006382][ T3659] br2: port 1(lag2.200) entered blocking state [ 352.006556][ T3659] br2: port 1(lag2.200) entered disabled state [ 352.006723][ T3659] lag2.200: entered allmulticast mode [ 352.008622][ T3659] lag2.200: entered promiscuous mode [ 352.009233][ T3659] br2: port 1(lag2.200) entered blocking state [ 352.009398][ T3659] br2: port 1(lag2.200) entered forwarding state [ 366.364874][ T3721] lag3: Port device veth2 removed [ 380.765146][ T3784] lag3: Port device veth2 added [ 380.892624][ T3795] lag3: Port device veth4 removed [ 395.286526][ T3858] lag3: Port device veth2 removed [ 395.409070][ T3869] lag3: Port device veth4 added [ 395.526062][ T3881] lag3: Port device veth2 added [ 410.145120][ T3952] lag3: Port device veth4 removed [ 410.178467][ T3955] lag3: Port device veth2 removed [ 410.228453][ T3245] ================================================================== [ 410.228608][ T3245] BUG: KASAN: slab-use-after-free in rtnl_fill_prop_list+0x5ad/0x600 [ 410.228719][ T3245] Read of size 8 at addr ff110000177d2b50 by task teamd/3245 [ 410.228823][ T3245] [ 410.228862][ T3245] CPU: 3 UID: 0 PID: 3245 Comm: teamd Not tainted 7.1.0-rc3-virtme #1 PREEMPT(full) [ 410.228865][ T3245] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 410.228867][ T3245] Call Trace: [ 410.228869][ T3245] [ 410.228870][ T3245] dump_stack_lvl+0x6f/0xa0 [ 410.228876][ T3245] print_address_description.constprop.0+0x56/0x2d0 [ 410.228881][ T3245] print_report+0xfc/0x1fa [ 410.228883][ T3245] ? __virt_addr_valid+0x102/0x440 [ 410.228886][ T3245] ? __virt_addr_valid+0x1da/0x440 [ 410.228889][ T3245] kasan_report+0x108/0x130 [ 410.228892][ T3245] ? rtnl_fill_prop_list+0x5ad/0x600 [ 410.228894][ T3245] ? rtnl_fill_prop_list+0x5ad/0x600 [ 410.228897][ T3245] rtnl_fill_prop_list+0x5ad/0x600 [ 410.228898][ T3245] ? __asan_memcpy+0x3c/0x60 [ 410.228901][ T3245] rtnl_fill_ifinfo.isra.0+0x3d3/0x2b50 [ 410.228903][ T3245] ? rcu_read_lock_any_held+0x3c/0x90 [ 410.228906][ T3245] ? validate_chain+0x38b/0xc20 [ 410.228909][ T3245] ? rtnl_fill_vf+0x450/0x450 [ 410.228910][ T3245] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 410.228912][ T3245] ? lockdep_hardirqs_on+0x8c/0x130 [ 410.228915][ T3245] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 410.228918][ T3245] ? __lock_acquire+0x508/0xc10 [ 410.228919][ T3245] ? rtnl_fill_vfinfo+0x848/0xf70 [ 410.228921][ T3245] ? lock_acquire.part.0+0xbc/0x260 [ 410.228923][ T3245] ? find_held_lock+0x2b/0x80 [ 410.228926][ T3245] ? __lock_release.isra.0+0x6b/0x1a0 [ 410.228927][ T3245] ? mark_held_locks+0x40/0x70 [ 410.228929][ T3245] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 410.228930][ T3245] ? lockdep_hardirqs_on+0x8c/0x130 [ 410.228932][ T3245] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 410.228934][ T3245] rtnl_getlink+0xa48/0xe50 [ 410.228936][ T3245] ? find_held_lock+0x2b/0x80 [ 410.228938][ T3245] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 410.228940][ T3245] ? mark_usage+0x61/0x170 [ 410.228941][ T3245] ? __lock_release.isra.0+0x6b/0x1a0 [ 410.228942][ T3245] ? __lock_acquire+0x508/0xc10 [ 410.228949][ T3245] ? lock_acquire.part.0+0xbc/0x260 [ 410.228951][ T3245] ? find_held_lock+0x2b/0x80 [ 410.228953][ T3245] ? mark_usage+0x61/0x170 [ 410.228954][ T3245] ? __lock_release.isra.0+0x6b/0x1a0 [ 410.228955][ T3245] ? __lock_acquire+0x508/0xc10 [ 410.228957][ T3245] ? bpf_address_lookup+0x282/0x290 [ 410.228960][ T3245] ? lock_acquire.part.0+0xbc/0x260 [ 410.228961][ T3245] ? find_held_lock+0x2b/0x80 [ 410.228963][ T3245] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 410.228965][ T3245] ? __lock_release.isra.0+0x6b/0x1a0 [ 410.228967][ T3245] ? rtnl_dump_ifinfo+0xfb0/0xfb0 [ 410.228968][ T3245] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 410.228970][ T3245] ? validate_chain+0x38b/0xc20 [ 410.228971][ T3245] ? rtnl_link_fill+0x900/0x900 [ 410.228973][ T3245] ? __lock_acquire+0x508/0xc10 [ 410.228975][ T3245] ? lock_acquire.part.0+0xbc/0x260 [ 410.228976][ T3245] ? find_held_lock+0x2b/0x80 [ 410.228978][ T3245] netlink_rcv_skb+0x14e/0x3a0 [ 410.228981][ T3245] ? rtnl_link_fill+0x900/0x900 [ 410.228983][ T3245] ? netlink_ack+0xcd0/0xcd0 [ 410.228986][ T3245] ? netlink_deliver_tap+0xc5/0x330 [ 410.228988][ T3245] ? netlink_deliver_tap+0x13c/0x330 [ 410.228990][ T3245] netlink_unicast+0x47c/0x740 [ 410.228992][ T3245] ? netlink_attachskb+0x800/0x800 [ 410.228993][ T3245] ? trace_irq_enable.constprop.0+0x9b/0x180 [ 410.228997][ T3245] ? __lock_acquire+0x508/0xc10 [ 410.228999][ T3245] netlink_sendmsg+0x735/0xc60 [ 410.229001][ T3245] ? netlink_unicast+0x740/0x740 [ 410.229003][ T3245] ? __might_fault+0x97/0x140 [ 410.229007][ T3245] ____sys_sendmsg+0x419/0x850 [ 410.229010][ T3245] ? copy_msghdr_from_user+0x2a0/0x460 [ 410.229012][ T3245] ? get_timestamp.constprop.0+0x3a0/0x3a0 [ 410.229014][ T3245] ? move_addr_to_kernel+0x40/0x40 [ 410.229017][ T3245] ___sys_sendmsg+0x14e/0x1d0 [ 410.229019][ T3245] ? copy_msghdr_from_user+0x460/0x460 [ 410.229021][ T3245] ? kfree+0x22/0x5a0 [ 410.229028][ T3245] __sys_sendmsg+0x145/0x1f0 [ 410.229031][ T3245] ? __sys_sendmsg_sock+0x20/0x20 [ 410.229034][ T3245] ? rcu_is_watching+0x15/0xd0 [ 410.229037][ T3245] do_syscall_64+0x117/0xfc0 [ 410.229039][ T3245] ? irq_exit_rcu+0x1a/0x30 [ 410.229042][ T3245] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 410.229044][ T3245] RIP: 0033:0x7fb908cbb08e [ 410.229047][ T3245] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa [ 410.229049][ T3245] RSP: 002b:00007ffea314bf80 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 410.229053][ T3245] RAX: ffffffffffffffda RBX: 0000557701785330 RCX: 00007fb908cbb08e [ 410.229054][ T3245] RDX: 0000000000000000 RSI: 00007ffea314c020 RDI: 0000000000000005 [ 410.229056][ T3245] RBP: 00007ffea314bf90 R08: 0000000000000000 R09: 0000000000000000 [ 410.229056][ T3245] R10: 0000000000000000 R11: 0000000000000202 R12: 00005577017a7370 [ 410.229057][ T3245] R13: 00007ffea314c020 R14: 0000557701785240 R15: 00007ffea314c160 [ 410.229060][ T3245] [ 410.229061][ T3245] [ 410.235453][ T3245] Allocated by task 3330: [ 410.235507][ T3245] kasan_save_stack+0x2f/0x50 [ 410.235581][ T3245] kasan_save_track+0x14/0x30 [ 410.235650][ T3245] __kasan_kmalloc+0x7b/0x90 [ 410.235718][ T3245] register_netdevice+0x48b/0x1980 [ 410.235785][ T3245] team_newlink+0xa2/0x1a0 [ 410.235854][ T3245] rtnl_newlink_create+0x2da/0x780 [ 410.235925][ T3245] __rtnl_newlink+0x22b/0xa50 [ 410.235993][ T3245] rtnl_newlink+0x8d1/0xee0 [ 410.236061][ T3245] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 410.236129][ T3245] netlink_rcv_skb+0x14e/0x3a0 [ 410.236197][ T3245] netlink_unicast+0x47c/0x740 [ 410.236274][ T3245] netlink_sendmsg+0x735/0xc60 [ 410.236345][ T3245] ____sys_sendmsg+0x419/0x850 [ 410.236414][ T3245] ___sys_sendmsg+0x14e/0x1d0 [ 410.236486][ T3245] __sys_sendmsg+0x145/0x1f0 [ 410.236555][ T3245] do_syscall_64+0x117/0xfc0 [ 410.236626][ T3245] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 410.236711][ T3245] [ 410.236747][ T3245] Freed by task 3330: [ 410.236801][ T3245] kasan_save_stack+0x2f/0x50 [ 410.236871][ T3245] kasan_save_track+0x14/0x30 [ 410.236946][ T3245] kasan_save_free_info+0x3b/0x60 [ 410.237015][ T3245] __kasan_slab_free+0x43/0x70 [ 410.237088][ T3245] kfree+0x123/0x5a0 [ 410.237140][ T3245] unregister_netdevice_many_notify+0xe38/0x1d80 [ 410.237231][ T3245] rtnl_dellink+0x4a0/0xae0 [ 410.237299][ T3245] rtnetlink_rcv_msg+0x6fd/0xbd0 [ 410.237369][ T3245] netlink_rcv_skb+0x14e/0x3a0 [ 410.237438][ T3245] netlink_unicast+0x47c/0x740 [ 410.237509][ T3245] netlink_sendmsg+0x735/0xc60 [ 410.237582][ T3245] ____sys_sendmsg+0x419/0x850 [ 410.237652][ T3245] ___sys_sendmsg+0x14e/0x1d0 [ 410.237721][ T3245] __sys_sendmsg+0x145/0x1f0 [ 410.237790][ T3245] do_syscall_64+0x117/0xfc0 [ 410.237858][ T3245] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 410.237945][ T3245] [ 410.237980][ T3245] The buggy address belongs to the object at ff110000177d2b40 [ 410.237980][ T3245] which belongs to the cache kmalloc-64 of size 64 [ 410.238148][ T3245] The buggy address is located 16 bytes inside of [ 410.238148][ T3245] freed 64-byte region [ff110000177d2b40, ff110000177d2b80) [ 410.238319][ T3245] [ 410.238354][ T3245] The buggy address belongs to the physical page: [ 410.238479][ T3245] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x177d2 [ 410.238604][ T3245] flags: 0x80000000000000(node=0|zone=1) [ 410.238676][ T3245] page_type: f5(slab) [ 410.238731][ T3245] raw: 0080000000000000 ff1100000103cac0 ffd40000003d5b10 ffd4000000048890 [ 410.238857][ T3245] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 410.238981][ T3245] page dumped because: kasan: bad access detected [ 410.239066][ T3245] [ 410.239102][ T3245] Memory state around the buggy address: [ 410.239169][ T3245] ff110000177d2a00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 410.239282][ T3245] ff110000177d2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 410.239381][ T3245] >ff110000177d2b00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 410.239478][ T3245] ^ [ 410.239562][ T3245] ff110000177d2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 410.239662][ T3245] ff110000177d2c00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 410.239760][ T3245] ================================================================== [ 410.239906][ T3245] Disabling lock debugging due to kernel taint [ 410.387697][ T3969] br2: port 1(lag2.200) entered disabled state [ 410.405153][ T3970] br1: port 1(lag2.100) entered disabled state [ 410.458533][ T3973] lag2.200: left allmulticast mode [ 410.458893][ T3973] lag2.200: left promiscuous mode [ 410.459268][ T3973] br2: port 1(lag2.200) entered disabled state [ 410.509795][ T3976] lag2.100: left allmulticast mode [ 410.509900][ T3976] lag2: left allmulticast mode [ 410.509982][ T3976] veth1: left allmulticast mode [ 410.510060][ T3976] veth7: left allmulticast mode [ 410.510188][ T3976] lag2.100: left promiscuous mode [ 410.510545][ T3976] lag2: left promiscuous mode [ 410.510625][ T3976] veth1: left promiscuous mode [ 410.510809][ T3976] veth7: left promiscuous mode [ 410.511145][ T3976] br1: port 1(lag2.100) entered disabled state [ 410.612714][ T3980] lag2: Port device veth7 removed [ 410.626245][ T3981] lag2: Port device veth1 removed [ 410.998354][ T3996] lag4: Port device veth5 removed [ 411.012110][ T3997] lag4: Port device veth3 removed [ 411.388101][ T4012] lag1: Port device veth6 removed [ 411.400868][ T4013] lag1: Port device veth0 removed