======================================
| [  111.753307][   T38] ==================================================================
| [ 111.753559][ T38] BUG: KASAN: slab-use-after-free in neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) 
| [  111.753793][   T38] Write of size 8 at addr ffff888005af9c18 by task kworker/u18:0/38
| [  111.754023][   T38]
[  111.754369][   T38] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[  111.754700][   T38] Workqueue: events_unbound linkwatch_event
[  111.754867][   T38] Call Trace:
[  111.754994][   T38]  <TASK>
[ 111.755067][ T38] dump_stack_lvl (lib/dump_stack.c:123) 
[ 111.755215][ T38] print_address_description.constprop.0 (mm/kasan/report.c:378) 
[ 111.755403][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) 
[ 111.755533][ T38] print_report (mm/kasan/report.c:489) 
[ 111.755672][ T38] ? kasan_addr_to_slab (./include/linux/mm.h:1282 mm/kasan/../slab.h:206 mm/kasan/common.c:38) 
[ 111.755832][ T38] kasan_report (mm/kasan/report.c:603) 
[ 111.755949][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) 
[ 111.756129][ T38] neigh_flush_dev.isra.0 (./include/linux/list.h:990 ./include/linux/rculist.h:516 net/core/neighbour.c:385) 
[ 111.756273][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 111.756409][ T38] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) 
[ 111.756559][ T38] neigh_carrier_down (net/core/neighbour.c:438) 
[ 111.756688][ T38] arp_netdev_event (net/ipv4/arp.c:1343) 
[ 111.756841][ T38] ? trace_notifier_run (./include/trace/events/notifier.h:59 (discriminator 52)) 
[ 111.757008][ T38] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) 
[ 111.757139][ T38] netdev_state_change (net/core/dev.c:1380 net/core/dev.c:1371) 
[ 111.757283][ T38] ? __pfx_netdev_state_change (net/core/dev.c:1372) 
[ 111.757429][ T38] ? dev_deactivate (./include/linux/list.h:111 ./include/linux/list.h:215 ./include/linux/list.h:229 net/sched/sch_generic.c:1404) 
[ 111.757617][ T38] linkwatch_do_dev (net/core/link_watch.c:177) 
[ 111.757752][ T38] __linkwatch_run_queue (./include/linux/spinlock.h:376 net/core/link_watch.c:236) 
[ 111.757886][ T38] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) 
[ 111.758071][ T38] ? __pfx___linkwatch_run_queue (net/core/link_watch.c:186) 
[ 111.758334][ T38] ? process_one_work (kernel/workqueue.c:3205) 
[ 111.758512][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 111.758654][ T38] linkwatch_event (net/core/link_watch.c:278) 
[ 111.758835][ T38] process_one_work (kernel/workqueue.c:3229) 
[ 111.758987][ T38] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 111.759132][ T38] ? __pfx_process_one_work (kernel/workqueue.c:3131) 
[ 111.759291][ T38] ? assign_work (kernel/workqueue.c:1200) 
[ 111.759435][ T38] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391) 
[ 111.759593][ T38] ? __pfx_worker_thread (kernel/workqueue.c:3337) 
[ 111.759751][ T38] kthread (kernel/kthread.c:389) 
[ 111.759850][ T38] ? __pfx_kthread (kernel/kthread.c:342) 
[ 111.759993][ T38] ret_from_fork (arch/x86/kernel/process.c:147) 
[ 111.760149][ T38] ? __pfx_kthread (kernel/kthread.c:342) 
[ 111.760277][ T38] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) 
| [  111.773674][   T38] Disabling lock debugging due to kernel taint
| [  111.773950][   T38] Oops: general protection fault, probably for non-canonical address 0xe02c3c380000004a: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [  111.774506][   T38] KASAN: maybe wild-memory-access in range [0x016201c000000250-0x016201c000000257]
| [  111.775108][   T38] Tainted: [B]=BAD_PAGE
[  111.775209][   T38] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[  111.775601][   T38] Workqueue: events_unbound linkwatch_event
[ 111.775891][ T38] RIP: 0010:neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) 
[ 111.776176][ T38] Code: 0f 85 ef 04 00 00 49 8d 7f 08 49 8b 1f 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 cc 04 00 00 49 8b 6f 08 48 89 e8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 19 05 00 00 48 89 5d 00 48 85 db 74 1a 48 8d
All code
========
   0:	0f 85 ef 04 00 00    	jne    0x4f5
   6:	49 8d 7f 08          	lea    0x8(%r15),%rdi
   a:	49 8b 1f             	mov    (%r15),%rbx
   d:	48 89 f8             	mov    %rdi,%rax
  10:	48 c1 e8 03          	shr    $0x3,%rax
  14:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  19:	0f 85 cc 04 00 00    	jne    0x4eb
  1f:	49 8b 6f 08          	mov    0x8(%r15),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)		<-- trapping instruction
  2f:	0f 85 19 05 00 00    	jne    0x54e
  35:	48 89 5d 00          	mov    %rbx,0x0(%rbp)
  39:	48 85 db             	test   %rbx,%rbx
  3c:	74 1a                	je     0x58
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d

Code starting with the faulting instruction
===========================================
   0:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
   5:	0f 85 19 05 00 00    	jne    0x524
   b:	48 89 5d 00          	mov    %rbx,0x0(%rbp)
   f:	48 85 db             	test   %rbx,%rbx
  12:	74 1a                	je     0x2e
  14:	48                   	rex.W
  15:	8d                   	.byte 0x8d
[  111.776926][   T38] RSP: 0018:ffffc900002b7a08 EFLAGS: 00010202
[  111.777099][   T38] RAX: 002c40380000004a RBX: ffff88800604db40 RCX: ffffffffac0796f0
[  111.777304][   T38] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888005af9c08
[  111.777535][   T38] RBP: 016201c000000251 R08: 0000000000000000 R09: 0000000000000000
[  111.777819][   T38] R10: ffffffffae571f0f R11: ffffffffa9ec2ce1 R12: ffff888005af9d3c
[  111.778044][   T38] R13: dffffc0000000000 R14: ffff88800572c000 R15: ffff888005af9c00
[  111.778286][   T38] FS:  0000000000000000(0000) GS:ffff88802f600000(0000) knlGS:0000000000000000
[  111.778569][   T38] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  111.778817][   T38] CR2: 00007fd6da45c000 CR3: 0000000034326006 CR4: 0000000000772ef0
[  111.779134][   T38] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  111.779337][   T38] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  111.779532][   T38] PKRU: 55555554
[  111.779666][   T38] Call Trace:
[  111.779767][   T38]  <TASK>
[ 111.779841][ T38] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460) 
[ 111.779948][ T38] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693) 
[ 111.780173][ T38] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617) 
[ 111.780304][ T38] ? ret_from_fork (arch/x86/kernel/process.c:147) 
[ 111.780456][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) 
[ 111.780588][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:988 ./include/linux/rculist.h:516 net/core/neighbour.c:384) 
[ 111.780791][ T38] ? neigh_flush_dev.isra.0 (./include/linux/list.h:986 ./include/linux/rculist.h:516 net/core/neighbour.c:384) 
[ 111.780933][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 111.781067][ T38] __neigh_ifdown.isra.0 (net/core/neighbour.c:826 net/core/neighbour.c:426) 
[ 111.781209][ T38] neigh_carrier_down (net/core/neighbour.c:438) 
[ 111.781439][ T38] arp_netdev_event (net/ipv4/arp.c:1343) 
[ 111.781572][ T38] ? trace_notifier_run (./include/trace/events/notifier.h:59 (discriminator 52)) 
[ 111.781710][ T38] notifier_call_chain (kernel/notifier.c:93 (discriminator 2)) 
[ 111.781850][ T38] netdev_state_change (net/core/dev.c:1380 net/core/dev.c:1371) 
[ 111.782014][ T38] ? __pfx_netdev_state_change (net/core/dev.c:1372) 
[ 111.782223][ T38] ? dev_deactivate (./include/linux/list.h:111 ./include/linux/list.h:215 ./include/linux/list.h:229 net/sched/sch_generic.c:1404) 
[ 111.782363][ T38] linkwatch_do_dev (net/core/link_watch.c:177) 
[ 111.782513][ T38] __linkwatch_run_queue (./include/linux/spinlock.h:376 net/core/link_watch.c:236) 
[ 111.782646][ T38] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 52)) 
[ 111.782862][ T38] ? __pfx___linkwatch_run_queue (net/core/link_watch.c:186) 
[ 111.783024][ T38] ? process_one_work (kernel/workqueue.c:3205) 
[ 111.783160][ T38] ? lock_acquire (kernel/locking/lockdep.c:5798) 
[ 111.783293][ T38] linkwatch_event (net/core/link_watch.c:278) 
[ 111.783502][ T38] process_one_work (kernel/workqueue.c:3229) 
[ 111.783635][ T38] ? __pfx___lock_release (kernel/locking/lockdep.c:5477) 
[ 111.783775][ T38] ? __pfx_process_one_work (kernel/workqueue.c:3131) 
[ 111.783907][ T38] ? assign_work (kernel/workqueue.c:1200) 
[ 111.784051][ T38] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391) 
[ 111.784184][ T38] ? __pfx_worker_thread (kernel/workqueue.c:3337) 
[ 111.784386][ T38] kthread (kernel/kthread.c:389) 
[ 111.784488][ T38] ? __pfx_kthread (kernel/kthread.c:342) 
[ 111.784617][ T38] ret_from_fork (arch/x86/kernel/process.c:147) 
[ 111.784782][ T38] ? __pfx_kthread (kernel/kthread.c:342) 


Finger prints:
print_report:kasan_report:neigh_carrier_down:arp_netdev_event:notifier_call_chain
neigh_carrier_down:arp_netdev_event:notifier_call_chain:netdev_state_change:linkwatch_do_dev