======================================
| [   53.930097][   T11] ==================================================================
| [ 53.930557][ T11] BUG: KASAN: slab-use-after-free in kobject_put (lib/kobject.c:729) 
| [   53.930949][   T11] Read of size 1 at addr ffff888003d1c93c by task kworker/u8:0/11
| [   53.931377][   T11]
[   53.931937][   T11] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   53.932619][   T11] Workqueue: netns cleanup_net
[   53.932886][   T11] Call Trace:
[   53.933075][   T11]  <TASK>
[ 53.933236][ T11] dump_stack_lvl (lib/dump_stack.c:107) 
[ 53.933481][ T11] print_address_description.constprop.0 (mm/kasan/report.c:378) 
[ 53.933836][ T11] ? kobject_put (lib/kobject.c:729) 
[ 53.934083][ T11] print_report (mm/kasan/report.c:489) 
[ 53.934327][ T11] ? kasan_addr_to_slab (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/page-flags.h:481 mm/kasan/../slab.h:206 mm/kasan/common.c:38) 
[ 53.934676][ T11] kasan_report (mm/kasan/report.c:603) 
[ 53.934914][ T11] ? kobject_put (lib/kobject.c:729) 
[ 53.935168][ T11] kobject_put (lib/kobject.c:729) 
[ 53.935439][ T11] br_sysfs_delbr (net/bridge/br_sysfs_br.c:1086) bridge
[ 53.935819][ T11] br_dev_delete (net/bridge/br_if.c:396) bridge
[ 53.936171][ T11] br_net_exit_batch_rtnl (net/bridge/br.c:369) bridge
[ 53.936586][ T11] cleanup_net (net/core/net_namespace.c:628 (discriminator 2)) 
[ 53.936831][ T11] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) 
[ 53.937146][ T11] ? __pfx_cleanup_net (net/core/net_namespace.c:581) 
[ 53.937414][ T11] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5725) 
[ 53.937663][ T11] ? process_one_work (kernel/workqueue.c:2609) 
[ 53.937942][ T11] process_one_work (kernel/workqueue.c:2638) 
[ 53.938221][ T11] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 53.938465][ T11] ? __pfx_process_one_work (kernel/workqueue.c:2542) 
[ 53.938754][ T11] ? assign_work (kernel/workqueue.c:1101) 
[ 53.939009][ T11] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 53.939271][ T11] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 53.939549][ T11] kthread (kernel/kthread.c:388) 
[ 53.939770][ T11] ? __pfx_kthread (kernel/kthread.c:341) 
[ 53.940028][ T11] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 53.940269][ T11] ? __pfx_kthread (kernel/kthread.c:341) 
[ 53.940520][ T11] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) 
| [   53.961712][   T11] ------------[ cut here ]------------
| [   53.962513][   T11] refcount_t: underflow; use-after-free.
| [ 53.962870][ T11] WARNING: CPU: 2 PID: 11 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
| [   53.963382][   T11] Modules linked in: macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel bridge stp llc vrf veth
[   53.964450][   T11] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   53.965112][   T11] Workqueue: netns cleanup_net
[ 53.965372][ T11] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[ 53.965717][ T11] Code: 64 5d 03 80 fb 01 0f 87 54 5a 91 01 83 e3 01 0f 85 4d ff ff ff c6 05 d6 64 5d 03 01 90 48 c7 c7 00 58 e2 a9 e8 5e 4c 2b ff 90 <0f> 0b 90 90 e9 2f ff ff ff 48 89 df e8 7c 23 a7 ff e9 b6 fe ff ff
All code
========
   0:	64 5d                	fs pop %rbp
   2:	03 80 fb 01 0f 87    	add    -0x78f0fe05(%rax),%eax
   8:	54                   	push   %rsp
   9:	5a                   	pop    %rdx
   a:	91                   	xchg   %eax,%ecx
   b:	01 83 e3 01 0f 85    	add    %eax,-0x7af0fe1d(%rbx)
  11:	4d ff                	rex.WRB (bad)
  13:	ff                   	(bad)
  14:	ff c6                	inc    %esi
  16:	05 d6 64 5d 03       	add    $0x35d64d6,%eax
  1b:	01 90 48 c7 c7 00    	add    %edx,0xc7c748(%rax)
  21:	58                   	pop    %rax
  22:	e2 a9                	loop   0xffffffffffffffcd
  24:	e8 5e 4c 2b ff       	call   0xffffffffff2b4c87
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	e9 2f ff ff ff       	jmp    0xffffffffffffff62
  33:	48 89 df             	mov    %rbx,%rdi
  36:	e8 7c 23 a7 ff       	call   0xffffffffffa723b7
  3b:	e9 b6 fe ff ff       	jmp    0xfffffffffffffef6

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	e9 2f ff ff ff       	jmp    0xffffffffffffff38
   9:	48 89 df             	mov    %rbx,%rdi
   c:	e8 7c 23 a7 ff       	call   0xffffffffffa7238d
  11:	e9 b6 fe ff ff       	jmp    0xfffffffffffffecc
[   53.966853][   T11] RSP: 0018:ffffc900000bfb98 EFLAGS: 00010282
[   53.967236][   T11] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffa730e74f
[   53.967725][   T11] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001
[   53.968205][   T11] RBP: 0000000000000003 R08: 0000000000000000 R09: fffff52000017f18
[   53.968680][   T11] R10: ffffc900000bf8c7 R11: 205d313154202020 R12: ffff888008baa000
[   53.969146][   T11] R13: ffff888008baadd8 R14: ffffc900000bfc98 R15: ffff888008baaba0
[   53.969600][   T11] FS:  0000000000000000(0000) GS:ffff888035a00000(0000) knlGS:0000000000000000
[   53.970192][   T11] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.970577][   T11] CR2: 00005624e54ecdec CR3: 00000000083b0001 CR4: 00000000001706f0
[   53.971049][   T11] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   53.971569][   T11] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   53.972049][   T11] Call Trace:
[   53.972252][   T11]  <TASK>
[ 53.972414][ T11] ? __warn (kernel/panic.c:677) 
[ 53.972655][ T11] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[ 53.972987][ T11] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[ 53.973267][ T11] ? vprintk_emit (kernel/printk/printk.c:2313) 
[ 53.973537][ T11] ? handle_bug (arch/x86/kernel/traps.c:238) 
[ 53.973811][ T11] ? exc_invalid_op (arch/x86/kernel/traps.c:259 (discriminator 1)) 
[ 53.974106][ T11] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[ 53.974408][ T11] ? desc_read (./arch/x86/include/asm/atomic64_64.h:20 ./include/linux/atomic/atomic-arch-fallback.h:2615 ./include/linux/atomic/atomic-long.h:79 ./include/linux/atomic/atomic-instrumented.h:3196 kernel/printk/printk_ringbuffer.c:534) 
[ 53.974680][ T11] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[ 53.975024][ T11] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[ 53.975378][ T11] br_sysfs_delbr (net/bridge/br_sysfs_br.c:1086) bridge
[ 53.975760][ T11] br_dev_delete (net/bridge/br_if.c:396) bridge
[ 53.976136][ T11] br_net_exit_batch_rtnl (net/bridge/br.c:369) bridge
[ 53.976526][ T11] cleanup_net (net/core/net_namespace.c:628 (discriminator 2)) 
[ 53.976769][ T11] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) 
[ 53.977084][ T11] ? __pfx_cleanup_net (net/core/net_namespace.c:581) 
[ 53.977356][ T11] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5725) 
[ 53.977609][ T11] ? process_one_work (kernel/workqueue.c:2609) 
[ 53.977885][ T11] process_one_work (kernel/workqueue.c:2638) 
[ 53.978168][ T11] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 53.978414][ T11] ? __pfx_process_one_work (kernel/workqueue.c:2542) 
[ 53.978702][ T11] ? assign_work (kernel/workqueue.c:1101) 
[ 53.978949][ T11] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 53.979257][ T11] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 53.979535][ T11] kthread (kernel/kthread.c:388) 
[ 53.979756][ T11] ? __pfx_kthread (kernel/kthread.c:341) 
[ 53.980019][ T11] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 53.980259][ T11] ? __pfx_kthread (kernel/kthread.c:341) 
[ 53.980510][ T11] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) 
| [   53.984029][   T11] ------------[ cut here ]------------
| [   53.984338][   T11] sysfs group 'bridge' not found for kobject 'br1'
| [ 53.984786][ T11] WARNING: CPU: 2 PID: 11 at fs/sysfs/group.c:282 sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
| [   53.985686][   T11] Modules linked in: macvlan 8021q vxlan ip6_udp_tunnel udp_tunnel bridge stp llc vrf veth
[   53.986814][   T11] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   53.987541][   T11] Workqueue: netns cleanup_net
[ 53.987804][ T11] RIP: 0010:sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[ 53.988139][ T11] Code: 89 d9 49 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 01 00 75 45 48 8b 33 48 c7 c7 a0 99 dc a9 e8 10 18 5f ff 90 <0f> 0b 90 90 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc e8 69 ee da ff
All code
========
   0:	89 d9                	mov    %ebx,%ecx
   2:	49 8b 14 24          	mov    (%r12),%rdx
   6:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   d:	fc ff df 
  10:	48 c1 e9 03          	shr    $0x3,%rcx
  14:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
  18:	75 45                	jne    0x5f
  1a:	48 8b 33             	mov    (%rbx),%rsi
  1d:	48 c7 c7 a0 99 dc a9 	mov    $0xffffffffa9dc99a0,%rdi
  24:	e8 10 18 5f ff       	call   0xffffffffff5f1839
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	48 83 c4 08          	add    $0x8,%rsp
  32:	5b                   	pop    %rbx
  33:	5d                   	pop    %rbp
  34:	41 5c                	pop    %r12
  36:	c3                   	ret
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	cc                   	int3
  3b:	e8 69 ee da ff       	call   0xffffffffffdaeea9

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	48 83 c4 08          	add    $0x8,%rsp
   8:	5b                   	pop    %rbx
   9:	5d                   	pop    %rbp
   a:	41 5c                	pop    %r12
   c:	c3                   	ret
   d:	cc                   	int3
   e:	cc                   	int3
   f:	cc                   	int3
  10:	cc                   	int3
  11:	e8 69 ee da ff       	call   0xffffffffffdaee7f
[   53.989182][   T11] RSP: 0018:ffffc900000bfba0 EFLAGS: 00010282
[   53.989513][   T11] RAX: 0000000000000000 RBX: ffffffffc0388f00 RCX: ffffffffa730e74f
[   53.989941][   T11] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001
[   53.990376][   T11] RBP: 0000000000000000 R08: 0000000000000000 R09: fffff52000017f19
[   53.990869][   T11] R10: ffffc900000bf8cf R11: 205d313154202020 R12: ffff888008baa610
[   53.991357][   T11] R13: ffff888008baadd8 R14: ffffc900000bfc98 R15: ffff888008baaba0
[   53.991842][   T11] FS:  0000000000000000(0000) GS:ffff888035a00000(0000) knlGS:0000000000000000
[   53.992380][   T11] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.992759][   T11] CR2: 00005624e54ecdec CR3: 00000000083b0001 CR4: 00000000001706f0
[   53.993255][   T11] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   53.993733][   T11] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   53.994229][   T11] Call Trace:
[   53.994435][   T11]  <TASK>
[ 53.994594][ T11] ? __warn (kernel/panic.c:677) 
[ 53.994842][ T11] ? console_trylock (kernel/printk/printk.c:2659 kernel/printk/printk.c:2654) 
[ 53.995181][ T11] ? sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[ 53.995575][ T11] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[ 53.995899][ T11] ? handle_bug (arch/x86/kernel/traps.c:238) 
[ 53.996151][ T11] ? exc_invalid_op (arch/x86/kernel/traps.c:259 (discriminator 1)) 
[ 53.996404][ T11] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[ 53.996676][ T11] ? desc_read (./arch/x86/include/asm/atomic64_64.h:20 ./include/linux/atomic/atomic-arch-fallback.h:2615 ./include/linux/atomic/atomic-long.h:79 ./include/linux/atomic/atomic-instrumented.h:3196 kernel/printk/printk_ringbuffer.c:534) 
[ 53.996916][ T11] ? sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[ 53.997212][ T11] br_dev_delete (net/bridge/br_if.c:396) bridge
[ 53.997543][ T11] br_net_exit_batch_rtnl (net/bridge/br.c:369) bridge
[ 53.997905][ T11] cleanup_net (net/core/net_namespace.c:628 (discriminator 2)) 
[ 53.998160][ T11] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) 
[ 53.998463][ T11] ? __pfx_cleanup_net (net/core/net_namespace.c:581) 
[ 53.998733][ T11] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5725) 
[ 53.998984][ T11] ? process_one_work (kernel/workqueue.c:2609) 
[ 53.999281][ T11] process_one_work (kernel/workqueue.c:2638) 
[ 53.999553][ T11] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 53.999799][ T11] ? __pfx_process_one_work (kernel/workqueue.c:2542) 
[ 54.000101][ T11] ? assign_work (kernel/workqueue.c:1101) 
[ 54.000349][ T11] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 54.000606][ T11] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 54.000882][ T11] kthread (kernel/kthread.c:388) 
[ 54.001118][ T11] ? __pfx_kthread (kernel/kthread.c:341) 
[ 54.001369][ T11] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 54.001608][ T11] ? __pfx_kthread (kernel/kthread.c:341) 


Finger prints:
dump_stack_lvl:print_report:kasan_report:kobject_put
refcount_warn_saturate:br_sysfs_delbr:br_dev_delete:br_net_exit_batch_rtnl
sysfs_remove_group:br_dev_delete:br_net_exit_batch_rtnl:cleanup_net