======================================
| [   31.933486][  T308] veth3: entered allmulticast mode
| [   31.935319][  T308] veth3: entered promiscuous mode
| [   32.226974][    C3] BUG: spinlock bad magic on CPU#3, ip/310
| [ 32.227234][ C3] lock: noop_qdisc+0x240/0x300, .magic: 00000000, .owner: ip/310, .owner_cpu: 3 
[   32.227745][    C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   32.228075][    C3] Call Trace:
[   32.228190][    C3]  <IRQ>
[ 32.228268][ C3] dump_stack_lvl (lib/dump_stack.c:122) 
[ 32.228431][ C3] do_raw_spin_unlock (kernel/locking/spinlock_debug.c:100 kernel/locking/spinlock_debug.c:141) 
[ 32.228585][ C3] _raw_spin_unlock (./arch/x86/include/asm/preempt.h:94 ./include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) 
[ 32.228742][ C3] __dev_xmit_skb (./include/net/sch_generic.h:226 ./include/net/sch_generic.h:217 net/core/dev.c:3879) 
[ 32.228895][ C3] ? __pfx___dev_xmit_skb (net/core/dev.c:3784) 
[ 32.229046][ C3] ? __dev_queue_xmit (./include/linux/bottom_half.h:20 ./include/linux/rcupdate.h:890 net/core/dev.c:4348) 
[ 32.229197][ C3] ? lock_acquire (kernel/locking/lockdep.c:5732) 
[ 32.229350][ C3] ? __dev_queue_xmit (./include/linux/bottom_half.h:20 ./include/linux/rcupdate.h:890 net/core/dev.c:4348) 
[ 32.229500][ C3] __dev_queue_xmit (net/core/dev.c:4389) 
[ 32.229656][ C3] ? __lock_release (kernel/locking/lockdep.c:5435) 
[ 32.229805][ C3] ? ip_finish_output2 (./include/net/neighbour.h:542 net/ipv4/ip_output.c:235) 
[ 32.229961][ C3] ? __pfx___lock_release (kernel/locking/lockdep.c:5411) 
[ 32.230112][ C3] ? __pfx___dev_queue_xmit (net/core/dev.c:4332) 
[ 32.230263][ C3] ? mark_held_locks (kernel/locking/lockdep.c:4273) 
[ 32.230413][ C3] ? eth_header (net/ethernet/eth.c:100) 
[ 32.230568][ C3] ? neigh_resolve_output (./include/linux/netdevice.h:3159 net/core/neighbour.c:1560 net/core/neighbour.c:1545) 
[ 32.230722][ C3] ip_finish_output2 (./include/net/neighbour.h:542 net/ipv4/ip_output.c:235) 
[ 32.230873][ C3] ? find_held_lock (kernel/locking/lockdep.c:5249) 
[ 32.231028][ C3] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:199) 
[ 32.231198][ C3] ? igmpv3_send_cr (./include/linux/rcupdate.h:336 ./include/linux/rcupdate.h:869 net/ipv4/igmp.c:719) 
[ 32.231352][ C3] ? __ip_finish_output (./include/linux/skbuff.h:1666 ./include/linux/skbuff.h:4954 net/ipv4/ip_output.c:307 net/ipv4/ip_output.c:295) 
[ 32.231504][ C3] ip_output (./include/linux/netfilter.h:303 net/ipv4/ip_output.c:433) 
[ 32.231618][ C3] ? __pfx_ip_output (net/ipv4/ip_output.c:427) 
[ 32.231770][ C3] ? igmpv3_send_cr (net/ipv4/igmp.c:721) 
[ 32.231921][ C3] ? ip_local_out (net/ipv4/ip_output.c:128) 
[ 32.232072][ C3] igmp_ifc_timer_expire (net/ipv4/igmp.c:815) 
[ 32.232222][ C3] ? __pfx_igmp_ifc_timer_expire (net/ipv4/igmp.c:809) 
[ 32.232408][ C3] call_timer_fn (kernel/time/timer.c:1792) 
[ 32.232563][ C3] ? call_timer_fn (./include/linux/lockdep.h:31 kernel/time/timer.c:1782) 
[ 32.232713][ C3] ? call_timer_fn (./include/linux/lockdep.h:31 kernel/time/timer.c:1782) 
[ 32.232861][ C3] ? __pfx_call_timer_fn (kernel/time/timer.c:1769) 
[ 32.233008][ C3] ? mark_lock (kernel/locking/lockdep.c:4655 (discriminator 3)) 
[ 32.233126][ C3] __run_timers (kernel/time/timer.c:1844 kernel/time/timer.c:2417) 
[ 32.233274][ C3] ? __pfx_igmp_ifc_timer_expire (net/ipv4/igmp.c:809) 
[ 32.233459][ C3] ? __pfx___run_timers (kernel/time/timer.c:2388) 
[ 32.233612][ C3] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 32.233768][ C3] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) 
[ 32.233917][ C3] ? lock_acquire (kernel/locking/lockdep.c:5732) 
[ 32.234066][ C3] ? run_timer_softirq (kernel/time/timer.c:2428 kernel/time/timer.c:2421 kernel/time/timer.c:2437 kernel/time/timer.c:2447) 
[ 32.234215][ C3] run_timer_softirq (kernel/time/timer.c:2429 kernel/time/timer.c:2421 kernel/time/timer.c:2437 kernel/time/timer.c:2447) 
[ 32.234365][ C3] handle_softirqs (kernel/softirq.c:554) 
[ 32.234518][ C3] irq_exit_rcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637 kernel/softirq.c:649) 
[ 32.234632][ C3] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043 arch/x86/kernel/apic/apic.c:1043) 
[   32.234782][    C3]  </IRQ>
[   32.234858][    C3]  <TASK>
[ 32.234934][ C3] asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) 
[ 32.235153][ C3] RIP: 0010:_raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) 
[ 32.235349][ C3] Code: 10 e8 b1 39 8e fd 48 89 ef e8 59 aa 8e fd 81 e3 00 02 00 00 75 1d 9c 58 f6 c4 02 75 29 48 85 db 74 01 fb 65 ff 0d b5 80 c2 48 <74> 0e 5b 5d c3 cc cc cc cc e8 7f 77 b2 fd eb dc 0f 1f 44 00 00 5b
All code
========
   0:	10 e8                	adc    %ch,%al
   2:	b1 39                	mov    $0x39,%cl
   4:	8e fd                	mov    %ebp,%?
   6:	48 89 ef             	mov    %rbp,%rdi
   9:	e8 59 aa 8e fd       	call   0xfffffffffd8eaa67
   e:	81 e3 00 02 00 00    	and    $0x200,%ebx
  14:	75 1d                	jne    0x33
  16:	9c                   	pushf
  17:	58                   	pop    %rax
  18:	f6 c4 02             	test   $0x2,%ah
  1b:	75 29                	jne    0x46
  1d:	48 85 db             	test   %rbx,%rbx
  20:	74 01                	je     0x23
  22:	fb                   	sti
  23:	65 ff 0d b5 80 c2 48 	decl   %gs:0x48c280b5(%rip)        # 0x48c280df
  2a:*	74 0e                	je     0x3a		<-- trapping instruction
  2c:	5b                   	pop    %rbx
  2d:	5d                   	pop    %rbp
  2e:	c3                   	ret
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	e8 7f 77 b2 fd       	call   0xfffffffffdb277b7
  38:	eb dc                	jmp    0x16
  3a:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  3f:	5b                   	pop    %rbx

Code starting with the faulting instruction
===========================================
   0:	74 0e                	je     0x10
   2:	5b                   	pop    %rbx
   3:	5d                   	pop    %rbp
   4:	c3                   	ret
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	e8 7f 77 b2 fd       	call   0xfffffffffdb2778d
   e:	eb dc                	jmp    0xffffffffffffffec
  10:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  15:	5b                   	pop    %rbx
[   32.235877][    C3] RSP: 0018:ffffc9000068f790 EFLAGS: 00000282
[   32.236065][    C3] RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff722a281
[   32.236294][    C3] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb7414821
[   32.236519][    C3] RBP: ffff888001041080 R08: 0000000000000001 R09: 0000000000000001
[   32.236742][    C3] R10: ffffffffb91559df R11: ffffc9000068f5b9 R12: ffff888001041080
[   32.236969][    C3] R13: ffffea000013b800 R14: ffff8880010433c0 R15: ffff888004ee4000
[ 32.237205][ C3] ? _raw_spin_unlock_irqrestore (./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) 
[ 32.237399][ C3] get_partial_node.part.0 (mm/slub.c:2768) 
[ 32.237553][ C3] ___slab_alloc (mm/slub.c:2729 mm/slub.c:2846 mm/slub.c:3703) 
[ 32.237704][ C3] ? __lock_release (kernel/locking/lockdep.c:5435) 
[ 32.237853][ C3] ? fs_reclaim_acquire (mm/page_alloc.c:3808 mm/page_alloc.c:3801 mm/page_alloc.c:3831) 
[ 32.238003][ C3] ? p9_fcall_init (net/9p/client.c:233) 
[ 32.238152][ C3] ? lock_downgrade (kernel/locking/lockdep.c:115 kernel/locking/lockdep.c:5655) 
[ 32.238306][ C3] ? p9_fcall_init (net/9p/client.c:233) 
[ 32.238454][ C3] ? __kmalloc_noprof (mm/slub.c:3813 mm/slub.c:3866 mm/slub.c:4025 mm/slub.c:4157 mm/slub.c:4170) 
[ 32.238613][ C3] __kmalloc_noprof (mm/slub.c:3813 mm/slub.c:3866 mm/slub.c:4025 mm/slub.c:4157 mm/slub.c:4170) 
[ 32.238763][ C3] p9_fcall_init (net/9p/client.c:233) 
[ 32.238914][ C3] p9_tag_alloc (net/9p/client.c:300) 
[ 32.239064][ C3] ? __pfx_p9_tag_alloc (net/9p/client.c:280) 
[ 32.239231][ C3] p9_client_prepare_req (net/9p/client.c:644) 
[ 32.239382][ C3] ? __pfx_p9_client_prepare_req (net/9p/client.c:628) 
[ 32.239569][ C3] ? __pfx_validate_chain (kernel/locking/lockdep.c:3824) 
[ 32.239719][ C3] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:227) 
[ 32.239878][ C3] ? mark_lock (kernel/locking/lockdep.c:4655 (discriminator 3)) 
[ 32.239991][ C3] ? kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) 
[ 32.240143][ C3] p9_client_rpc (net/9p/client.c:691 (discriminator 4)) 
[ 32.240296][ C3] ? __pfx_p9_client_rpc (net/9p/client.c:675) 
[ 32.240445][ C3] ? find_held_lock (kernel/locking/lockdep.c:5249) 
[ 32.240596][ C3] ? v9fs_dir_release (./include/net/9p/client.h:271 fs/9p/vfs_dir.c:224) 
[ 32.240746][ C3] ? __pfx___lock_release (kernel/locking/lockdep.c:5411) 
[ 32.240896][ C3] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5724) 
[ 32.241046][ C3] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 32.241209][ C3] p9_client_clunk (net/9p/client.c:1441 (discriminator 3)) 
[ 32.241361][ C3] v9fs_dir_release (./include/net/9p/client.h:280 fs/9p/vfs_dir.c:224) 
[ 32.241514][ C3] __fput (fs/file_table.c:422) 
[ 32.241634][ C3] task_work_run (kernel/task_work.c:222 (discriminator 1)) 
[ 32.241786][ C3] ? __pfx_task_work_run (kernel/task_work.c:190) 
[ 32.241934][ C3] ? switch_task_namespaces (kernel/nsproxy.c:250) 
[ 32.242089][ C3] ? do_raw_spin_unlock (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/asm-generic/qspinlock.h:57 kernel/locking/spinlock_debug.c:101 kernel/locking/spinlock_debug.c:141) 
[ 32.242242][ C3] do_exit (kernel/exit.c:883) 
[ 32.242365][ C3] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 32.242513][ C3] ? __pfx_do_exit (kernel/exit.c:821) 
[ 32.242661][ C3] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) 
[ 32.242813][ C3] do_group_exit (kernel/exit.c:1012) 
[ 32.242962][ C3] __x64_sys_exit_group (kernel/exit.c:1040) 
[ 32.243126][ C3] x64_sys_call (./arch/x86/include/generated/asm/syscalls_64.h:61) 
[ 32.243281][ C3] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 32.243432][ C3] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[   32.243622][    C3] RIP: 0033:0x7f886a2dba8d
[ 32.243780][ C3] Code: Unable to access opcode bytes at 0x7f886a2dba63.

Code starting with the faulting instruction
===========================================
[   32.243971][    C3] RSP: 002b:00007ffd9060c7d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   32.244199][    C3] RAX: ffffffffffffffda RBX: 00007f886a3b89c0 RCX: 00007f886a2dba8d
[   32.244421][    C3] RDX: 00000000000000e7 RSI: fffffffffffffe90 RDI: 0000000000000000
[   32.244644][    C3] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000060
[   32.244869][    C3] R10: 00007f886a1c8fa8 R11: 0000000000000246 R12: 00007f886a3b89c0


Finger prints:
do_raw_spin_unlock:_raw_spin_unlock:__dev_xmit_skb:__dev_queue_xmit:ip_finish_output2