======================================
| [ 1762.684281][   T70] ==================================================================
| [ 1762.684706][ T70] BUG: KASAN: slab-use-after-free in __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
| [ 1762.685092][   T70] Read of size 8 at addr ffff888008475668 by task kworker/u8:1/70
| [ 1762.685483][   T70]
[ 1762.686013][   T70] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 1762.686625][   T70] Workqueue: netns cleanup_net
[ 1762.686873][   T70] Call Trace:
[ 1762.687045][   T70]  <TASK>
[ 1762.687195][ T70] dump_stack_lvl (lib/dump_stack.c:107) 
[ 1762.687430][ T70] print_address_description.constprop.0 (mm/kasan/report.c:378) 
[ 1762.687764][ T70] ? __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 1762.688004][ T70] print_report (mm/kasan/report.c:489) 
[ 1762.688229][ T70] ? kasan_addr_to_slab (./arch/x86/include/asm/bitops.h:206 ./arch/x86/include/asm/bitops.h:238 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 ./include/linux/page-flags.h:481 mm/kasan/../slab.h:206 mm/kasan/common.c:38) 
[ 1762.688485][ T70] kasan_report (mm/kasan/report.c:603) 
[ 1762.688706][ T70] ? __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 1762.688947][ T70] __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 1762.689177][ T70] ? mark_held_locks (kernel/locking/lockdep.c:4274) 
[ 1762.689424][ T70] ? refcount_dec_and_mutex_lock (./include/linux/instrumented.h:96 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 1762.689721][ T70] ? __pfx___mutex_lock (kernel/locking/mutex.c:751) 
[ 1762.689977][ T70] ? refcount_dec_not_one (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 lib/refcount.c:76) 
[ 1762.690244][ T70] ? __pfx_refcount_dec_not_one (lib/refcount.c:75) 
[ 1762.690534][ T70] ? refcount_dec_and_mutex_lock (./include/linux/instrumented.h:96 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 1762.690828][ T70] refcount_dec_and_mutex_lock (./include/linux/instrumented.h:96 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 1762.691115][ T70] __tcf_action_put (net/sched/act_api.c:377) 
[ 1762.691355][ T70] tcf_action_destroy (net/sched/act_api.c:413 net/sched/act_api.c:393 net/sched/act_api.c:1175) 
[ 1762.691663][ T70] tcf_exts_destroy (net/sched/cls_api.c:3312) 
[ 1762.691942][ T70] __u32_destroy_key (net/sched/cls_u32.c:398 (discriminator 9)) cls_u32
[ 1762.692254][ T70] u32_clear_hnode (net/sched/cls_u32.c:415 net/sched/cls_u32.c:594) cls_u32
[ 1762.692559][ T70] ? __pfx_u32_clear_hnode (net/sched/cls_u32.c:578) cls_u32
[ 1762.692889][ T70] ? tcf_chain0_head_change.isra.0 (net/sched/cls_api.c:506) 
[ 1762.693204][ T70] ? tcf_chain_flush (net/sched/cls_api.c:739 (discriminator 9)) 
[ 1762.693455][ T70] u32_destroy_hnode.isra.0 (net/sched/cls_u32.c:609) cls_u32
[ 1762.693792][ T70] u32_destroy (net/sched/cls_u32.c:634) cls_u32
[ 1762.694065][ T70] tcf_proto_destroy (net/sched/cls_api.c:418) 
[ 1762.694314][ T70] tcf_chain_flush (net/sched/cls_api.c:737) 
[ 1762.694557][ T70] __tcf_block_put (net/sched/cls_api.c:1070 net/sched/cls_api.c:1141 net/sched/cls_api.c:1305) 
[ 1762.694800][ T70] ingress_destroy (net/sched/sch_ingress.c:123) sch_ingress
[ 1762.695108][ T70] __qdisc_destroy (net/sched/sch_generic.c:1067) 
[ 1762.695348][ T70] dev_shutdown (net/sched/sch_generic.c:1482) 
[ 1762.695576][ T70] unregister_netdevice_many_notify (./include/net/tcx.h:168 net/core/dev.c:11084) 
[ 1762.695896][ T70] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2569 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3161 kernel/locking/mutex.c:81 kernel/locking/mutex.c:91) 
[ 1762.696140][ T70] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11035) 
[ 1762.696484][ T70] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11019) 
[ 1762.696800][ T70] default_device_exit_batch (net/core/dev.c:11629) 
[ 1762.697120][ T70] ? __pfx_default_device_exit_batch (net/core/dev.c:11604) 
[ 1762.697452][ T70] ? ops_exit_list (net/core/net_namespace.c:169 (discriminator 3)) 
[ 1762.697706][ T70] cleanup_net (net/core/net_namespace.c:636 (discriminator 3)) 
[ 1762.697932][ T70] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5719) 
[ 1762.698233][ T70] ? __pfx_cleanup_net (net/core/net_namespace.c:581) 
[ 1762.698499][ T70] ? lock_acquire (./include/trace/events/lock.h:24 kernel/locking/lockdep.c:5725) 
[ 1762.698750][ T70] ? process_one_work (kernel/workqueue.c:2609) 
[ 1762.699029][ T70] process_one_work (kernel/workqueue.c:2633) 
[ 1762.699296][ T70] ? hlock_class (./arch/x86/include/asm/bitops.h:227 ./arch/x86/include/asm/bitops.h:239 ./include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:228) 
[ 1762.699545][ T70] ? __pfx_process_one_work (kernel/workqueue.c:2542) 
[ 1762.699835][ T70] ? assign_work (kernel/workqueue.c:1101) 
[ 1762.700089][ T70] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 1762.700346][ T70] ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4300 kernel/locking/lockdep.c:4359) 
[ 1762.700679][ T70] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 1762.700937][ T70] kthread (kernel/kthread.c:388) 
[ 1762.701143][ T70] ? __pfx_kthread (kernel/kthread.c:341) 
[ 1762.701377][ T70] ret_from_fork (arch/x86/kernel/process.c:147) 
[ 1762.701601][ T70] ? __pfx_kthread (kernel/kthread.c:341) 


Finger prints:
dump_stack_lvl:print_report:kasan_report:__mutex_lock