veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
==================================================================
BUG: KASAN: slab-use-after-free in mini_qdisc_pair_swap+0x68/0x190 net/sched/sch_generic.c:1572
Read of size 8 at addr ffff888055ed8000 by task kworker/u8:23/8462

CPU: 1 UID: 0 PID: 8462 Comm: kworker/u8:23 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 mini_qdisc_pair_swap+0x68/0x190 net/sched/sch_generic.c:1572
 tcf_chain_head_change_item net/sched/cls_api.c:522 [inline]
 tcf_chain0_head_change_cb_del+0x249/0x380 net/sched/cls_api.c:969
 tcf_block_put_ext+0x129/0x390 net/sched/cls_api.c:1559
 clsact_destroy+0x25e/0x8d0 net/sched/sch_ingress.c:302
 __qdisc_destroy+0x153/0x420 net/sched/sch_generic.c:1081
 dev_shutdown+0x233/0x440 net/sched/sch_generic.c:1496
 unregister_netdevice_many_notify+0xe0f/0x1ff0 net/core/dev.c:12242
 unregister_netdevice_many net/core/dev.c:12317 [inline]
 default_device_exit_batch+0x819/0x890 net/core/dev.c:12821
 ops_exit_list net/core/net_namespace.c:205 [inline]
 ops_undo_list+0x525/0x990 net/core/net_namespace.c:252
 cleanup_net+0x4d8/0x820 net/core/net_namespace.c:695
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 8462:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417
 kasan_kmalloc include/linux/kasan.h:262 [inline]
 __do_kmalloc_node mm/slub.c:5604 [inline]
 __kmalloc_node_track_caller_noprof+0x568/0x800 mm/slub.c:5713
 kmalloc_reserve+0x136/0x290 net/core/skbuff.c:601
 __alloc_skb+0x142/0x2d0 net/core/skbuff.c:670
 alloc_skb include/linux/skbuff.h:1383 [inline]
 nlmsg_new include/net/netlink.h:1055 [inline]
 rtmsg_ifinfo_build_skb+0x84/0x260 net/core/rtnetlink.c:4400
 unregister_netdevice_many_notify+0x1556/0x1ff0 net/core/dev.c:12257
 unregister_netdevice_many net/core/dev.c:12317 [inline]
 default_device_exit_batch+0x819/0x890 net/core/dev.c:12821
 ops_exit_list net/core/net_namespace.c:205 [inline]
 ops_undo_list+0x525/0x990 net/core/net_namespace.c:252
 cleanup_net+0x4d8/0x820 net/core/net_namespace.c:695
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 8462:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2515 [inline]
 slab_free mm/slub.c:6574 [inline]
 kfree+0x19a/0x6d0 mm/slub.c:6781
 skb_release_data+0x6