[ 242.946600] nipa-hw-worker: [9/43] drivers/net:queues.py: rc=0 (1.2s) [ 242.946681] nipa-hw-worker: [10/43] Running drivers/net:ring_reconfig.py [ 243.120724] kselftest: Running tests in drivers/net [ 243.939039] i40e 0000:e1:00.0: User requested queue count/HW max RSS count: 1/32 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 244.185872] i40e 0000:e1:00.0: User requested queue count/HW max RSS count: 32/32 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 244.453152] ================================================================== [ 244.462078] BUG: KASAN: slab-use-after-free in i40e_free_q_vector+0x2c2/0x380 [ 244.470901] Write of size 8 at addr ff110001c95e04f8 by task python3/4726 [ 244.479320] [ 244.481792] CPU: 30 UID: 0 PID: 4726 Comm: python3 Not tainted 7.0.0-yovg-gc0d73dc96d6a #1 PREEMPT(full) [ 244.481798] Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R29_F43 10/23/2025 [ 244.481801] Call Trace: [ 244.481803] [ 244.481804] dump_stack_lvl+0x6f/0xa0 [ 244.481813] print_address_description.constprop.0+0x73/0x300 [ 244.481820] print_report+0xfc/0x1fa [ 244.481823] ? __virt_addr_valid+0x102/0x440 [ 244.481826] ? __virt_addr_valid+0x1da/0x440 [ 244.481830] kasan_report+0x108/0x130 [ 244.481834] ? i40e_free_q_vector+0x2c2/0x380 [ 244.481839] ? i40e_free_q_vector+0x2c2/0x380 [ 244.481843] i40e_free_q_vector+0x2c2/0x380 [ 244.481847] i40e_vsi_reinit_setup+0x20b/0xbc0 [ 244.481850] ? i40e_pf_reset_stats+0x14f/0x280 [ 244.481853] i40e_setup_pf_switch+0x90f/0xf90 [ 244.481857] i40e_rebuild+0x506/0x14b0 [ 244.481861] ? i40e_clear_hw+0x570/0x570 [ 244.481864] ? __lock_release.isra.0+0x6b/0x1a0 [ 244.481868] ? rcu_is_watching+0x15/0xd0 [ 244.481870] ? i40e_setup_pf_switch+0xf90/0xf90 [ 244.481874] ? i40e_pf_reset+0x1b0/0x450 [ 244.481876] ? i40e_reset+0x19/0x70 [ 244.481879] i40e_reconfig_rss_queues+0x35d/0x620 [ 244.481883] i40e_set_channels+0x332/0x470 [ 244.481886] ? netdev_queue_busy+0x26/0x150 [ 244.481891] ethnl_set_channels+0x677/0xa20 [ 244.481896] ? ethnl_set_channels_validate+0x100/0x100 [ 244.481900] ? lockdep_hardirqs_on_prepare.part.0+0x9a/0x160 [ 244.481903] ? lockdep_hardirqs_on+0x8c/0x130 [ 244.481907] ? _raw_spin_unlock_irqrestore+0x53/0x80 [ 244.481910] ? _raw_spin_unlock_irqrestore+0x40/0x80 [ 244.481914] ethnl_default_set_doit+0x32e/0x900 [ 244.481917] genl_family_rcv_msg_doit+0x206/0x300 [ 244.481922] ? genl_family_rcv_msg_attrs_parse.isra.0+0x330/0x330 [ 244.481924] ? selinux_inode_free_security+0x330/0x330 [ 244.481932] genl_family_rcv_msg+0x3a4/0x640 [ 244.481936] ? genl_family_rcv_msg_dumpit+0x340/0x340 [ 244.481938] ? rcu_lockdep_current_cpu_online+0x39/0x1b0 [ 244.481940] ? ethnl_notify+0x180/0x180 [ 244.481943] ? __lock_acquire+0x508/0xc10 [ 244.481948] genl_rcv_msg+0xbb/0x160 [ 244.481951] netlink_rcv_skb+0x14e/0x3a0 [ 244.481953] ? genl_family_rcv_msg+0x640/0x640 [ 244.481956] ? netlink_ack+0xcd0/0xcd0 [ 244.481961] ? netlink_deliver_tap+0xc5/0x330 [ 244.481963] ? netlink_deliver_tap+0x13c/0x330 [ 244.481966] genl_rcv+0x28/0x40 [ 244.481969] netlink_unicast+0x47c/0x740 [ 244.481972] ? netlink_attachskb+0x800/0x800 [ 244.481974] ? sock_has_perm+0x283/0x3f0 [ 244.481978] netlink_sendmsg+0x75b/0xc90 [ 244.481982] ? netlink_unicast+0x740/0x740 [ 244.481984] ? avc_has_perm+0xaa/0x170 [ 244.481989] __sock_sendmsg+0xca/0x180 [ 244.481993] ? fdget+0x4f/0x1e0 [ 244.481997] __sys_sendto+0x275/0x330 [ 244.482001] ? __ia32_sys_getpeername+0xd0/0xd0 [ 244.482004] ? new_sync_read+0x740/0x740 [ 244.482012] ? ksys_write+0x1ac/0x250 [ 244.482016] __x64_sys_sendto+0xe4/0x1f0 [ 244.482018] ? trace_irq_enable.constprop.0+0x9b/0x180 [ 244.482022] ? lockdep_hardirqs_on+0x8c/0x130 [ 244.482024] ? do_syscall_64+0x82/0x650 [ 244.482027] do_syscall_64+0xf3/0x650 [ 244.482030] ? trace_hardirqs_off+0xd/0x30 [ 244.482032] ? exc_page_fault+0xda/0xf0 [ 244.482035] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 244.482038] RIP: 0033:0x7fa9eec2d22e [ 244.482042] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa [ 244.482044] RSP: 002b:00007fff91ed6c10 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 244.482049] RAX: ffffffffffffffda RBX: 00007fff91ed6d20 RCX: 00007fa9eec2d22e [ 244.482050] RDX: 0000000000000028 RSI: 00007fa9ee1e2670 RDI: 0000000000000006 [ 244.482052] RBP: 00007fff91ed6c20 R08: 0000000000000000 R09: 0000000000000000 [ 244.482053] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa9ee16e430 [ 244.482055] R13: 00007fff91ed6d20 R14: 00007fa9ee47d150 R15: 0000000000000002 [ 244.482059] [ 244.482060] [ 244.952953] Allocated by task 4726: [ 244.957658] kasan_save_stack+0x2f/0x50 [ 244.962753] kasan_save_track+0x14/0x30 [ 244.967846] __kasan_kmalloc+0x7b/0x90 [ 244.972839] __kmalloc_noprof+0x2ff/0x820 [ 244.978129] i40e_alloc_rings+0x496/0x12d0 [ 244.983515] i40e_vsi_reinit_setup+0x5d9/0xbc0 [ 244.989290] i40e_setup_pf_switch+0x90f/0xf90 [ 244.994967] i40e_rebuild+0x506/0x14b0 [ 244.999963] i40e_reconfig_rss_queues+0x35d/0x620 [ 245.006030] i40e_set_channels+0x332/0x470 [ 245.011414] ethnl_set_channels+0x677/0xa20 [ 245.016891] ethnl_default_set_doit+0x32e/0x900 [ 245.022764] genl_family_rcv_msg_doit+0x206/0x300 [ 245.028832] genl_family_rcv_msg+0x3a4/0x640 [ 245.034411] genl_rcv_msg+0xbb/0x160 [ 245.039210] netlink_rcv_skb+0x14e/0x3a0 [ 245.044400] genl_rcv+0x28/0x40 [ 245.048711] netlink_unicast+0x47c/0x740 [ 245.053900] netlink_sendmsg+0x75b/0xc90 [ 245.059088] __sock_sendmsg+0xca/0x180 [ 245.064085] __sys_sendto+0x275/0x330 [ 245.068982] __x64_sys_sendto+0xe4/0x1f0 [ 245.074173] do_syscall_64+0xf3/0x650 [ 245.079061] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 245.085519] [ 245.087979] Freed by task 178: [ 245.092196] kasan_save_stack+0x2f/0x50 [ 245.097287] kasan_save_track+0x14/0x30 [ 245.102379] kasan_save_free_info+0x3b/0x60 [ 245.107863] __kasan_slab_free+0x43/0x70 [ 245.113052] kmem_cache_free_bulk.part.0+0x1dd/0x4f0 [ 245.119411] kvfree_rcu_bulk+0x1f1/0x240 [ 245.124604] kfree_rcu_work+0x130/0x1b0 [ 245.129694] process_one_work+0xdf5/0x1410 [ 245.135079] worker_thread+0x4f1/0xd60 [ 245.140074] kthread+0x364/0x460 [ 245.144482] ret_from_fork+0x4a4/0x720 [ 245.149481] ret_from_fork_asm+0x11/0x20 [ 245.154673] [ 245.157134] Last potentially related work creation: [ 245.163388] kasan_save_stack+0x2f/0x50 [ 245.168479] kasan_record_aux_stack+0x9b/0xc0 [ 245.174155] kvfree_call_rcu+0x7e/0x5b0 [ 245.179246] i40e_vsi_clear_rings+0x157/0x3e0 [ 245.184925] i40e_vsi_reinit_setup+0x1ba/0xbc0 [ 245.190700] i40e_setup_pf_switch+0x90f/0xf90 [ 245.196377] i40e_rebuild+0x506/0x14b0 [ 245.201371] i40e_reconfig_rss_queues+0x35d/0x620 [ 245.207438] i40e_set_channels+0x332/0x470 [ 245.212824] ethnl_set_channels+0x677/0xa20 [ 245.218307] ethnl_default_set_doit+0x32e/0x900 [ 245.224178] genl_family_rcv_msg_doit+0x206/0x300 [ 245.230245] genl_family_rcv_msg+0x3a4/0x640 [ 245.235825] genl_rcv_msg+0xbb/0x160 [ 245.240626] netlink_rcv_skb+0x14e/0x3a0 [ 245.245814] genl_rcv+0x28/0x40 [ 245.250129] netlink_unicast+0x47c/0x740 [ 245.255320] netlink_sendmsg+0x75b/0xc90 [ 245.260509] __sock_sendmsg+0xca/0x180 [ 245.265504] __sys_sendto+0x275/0x330 [ 245.270401] __x64_sys_sendto+0xe4/0x1f0 [ 245.275590] do_syscall_64+0xf3/0x650 [ 245.280487] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 245.286944] [ 245.289403] The buggy address belongs to the object at ff110001c95e0400\x0a which belongs to the cache kmalloc-1k of size 1024 [ 245.305031] The buggy address is located 248 bytes inside of\x0a freed 1024-byte region [ff110001c95e0400, ff110001c95e0800) [ 245.320463] [ 245.322922] The buggy address belongs to the physical page: [ 245.329966] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff110001c95e2800 pfn:0x1c95e0 [ 245.341203] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 245.350588] flags: 0x200000000000240(workingset|head|node=0|zone=2) [ 245.358413] page_type: f5(slab) [ 245.362727] raw: 0200000000000240 ff110001000510c0 ffd4000007b06e10 ffd4000007b69e10 [ 245.372208] raw: ff110001c95e2800 00000008000a0008 00000000f5000000 0000000000000000 [ 245.381687] head: 0200000000000240 ff110001000510c0 ffd4000007b06e10 ffd4000007b69e10 [ 245.391268] head: ff110001c95e2800 00000008000a0008 00000000f5000000 0000000000000000 [ 245.400847] head: 0200000000000003 ffd4000007257801 00000000ffffffff 00000000ffffffff [ 245.410416] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 245.419996] page dumped because: kasan: bad access detected [ 245.427039] [ 245.429500] Memory state around the buggy address: [ 245.435665] ff110001c95e0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 245.444561] ff110001c95e0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.453456] >ff110001c95e0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.462352] ^ [ 245.471149] ff110001c95e0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.480047] ff110001c95e0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 245.488942] ================================================================== [ 245.497946] Disabling lock debugging due to kernel taint [ 245.526814] i40e 0000:e1:00.0: User requested queue count/HW max RSS count: 1/32 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.536427] i40e 0000:e1:00.0 ens1f0np0: Changing Tx descriptor count from 512 to 256. SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.600553] i40e 0000:e1:00.0 ens1f0np0: Changing Tx descriptor count from 256 to 128. SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.664132] i40e 0000:e1:00.0 ens1f0np0: Changing Tx descriptor count from 128 to 64. SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.726276] i40e 0000:e1:00.0 ens1f0np0: Descriptors requested (Tx: 32 / Rx: 512) out of range [64-8160] SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.738117] i40e 0000:e1:00.0 ens1f0np0: Changing Rx descriptor count from 512 to 256 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.800059] i40e 0000:e1:00.0 ens1f0np0: Changing Rx descriptor count from 256 to 128 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.861926] i40e 0000:e1:00.0 ens1f0np0: Changing Rx descriptor count from 128 to 64 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 245.923663] i40e 0000:e1:00.0 ens1f0np0: Descriptors requested (Tx: 64 / Rx: 32) out of range [64-8160] SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 246.591509] i40e 0000:e1:00.0 ens1f0np0: Changing Tx descriptor count from 64 to 8160. SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 246.601348] i40e 0000:e1:00.0 ens1f0np0: Changing Rx descriptor count from 64 to 8160 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 249.467549] i40e 0000:e1:00.0: User requested queue count/HW max RSS count: 32/32 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 249.477498] i40e 0000:e1:00.0 ens1f0np0: Changing Tx descriptor count from 8160 to 512. SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0 [ 249.489227] i40e 0000:e1:00.0 ens1f0np0: Changing Rx descriptor count from 8160 to 512 SUBSYSTEM=pci DEVICE=+pci:0000:e1:00.0