======================================
| [   51.435902][  T810] ==================================================================
| [ 51.436215][ T810] BUG: KASAN: use-after-free in page_pool_item_uninit (net/core/page_pool.c:523)
| [   51.436432][  T810] Read of size 8 at addr ffff88800b5e8008 by task ethtool/810
| [   51.436642][  T810]
[   51.436932][  T810] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   51.437111][  T810] Call Trace:
[   51.437222][  T810]  <TASK>
[ 51.437299][ T810] dump_stack_lvl (lib/dump_stack.c:123)
[ 51.437449][ T810] print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 51.437628][ T810] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 51.437779][ T810] print_report (mm/kasan/report.c:490)
[ 51.437923][ T810] ? kasan_addr_to_slab (./include/linux/mm.h:1295 mm/kasan/../slab.h:211 mm/kasan/common.c:38)
[ 51.438097][ T810] kasan_report (mm/kasan/report.c:604)
[ 51.438206][ T810] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 51.438354][ T810] page_pool_item_uninit (net/core/page_pool.c:523)
[ 51.438496][ T810] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 51.438638][ T810] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 51.438790][ T810] page_pool_destroy (net/core/page_pool.c:1555)
[ 51.438934][ T810] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 51.439081][ T810] ? __pfx_call_netdevice_notifiers (net/core/dev.c:2095)
[ 51.439263][ T810] veth_set_features (drivers/net/veth.c:1060 drivers/net/veth.c:1494 drivers/net/veth.c:1472)
[ 51.439408][ T810] ? netdev_upper_get_next_dev_rcu (net/core/dev.c:7309 (discriminator 1))
[ 51.439587][ T810] __netdev_update_features (net/core/dev.c:10251)
[ 51.439730][ T810] ? __pfx___netdev_update_features (net/core/dev.c:10224)
[ 51.439905][ T810] ? __pfx_ethnl_parse_header_dev_get.part.0 (net/ethtool/netlink.c:137)
[ 51.440095][ T810] ethnl_set_features (net/ethtool/features.c:262)
[ 51.440237][ T810] ? __pfx_ethnl_set_features (net/ethtool/features.c:211)
[ 51.440379][ T810] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 51.440559][ T810] ? __nla_validate_parse (lib/nlattr.c:638)
[ 51.440705][ T810] ? __nla_parse (lib/nlattr.c:732)
[ 51.440845][ T810] ? genl_family_rcv_msg_attrs_parse.constprop.0 (net/netlink/genetlink.c:947)
[ 51.441059][ T810] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1115)
[ 51.441202][ T810] ? __pfx_genl_family_rcv_msg_doit (net/netlink/genetlink.c:1088)
[ 51.441382][ T810] ? rcu_read_lock_any_held (kernel/rcu/update.c:386 kernel/rcu/update.c:380)
[ 51.441528][ T810] ? validate_chain (kernel/locking/lockdep.c:3797 kernel/locking/lockdep.c:3817 kernel/locking/lockdep.c:3872)
[ 51.441674][ T810] genl_family_rcv_msg (net/netlink/genetlink.c:1195)
[ 51.441822][ T810] ? __pfx_genl_family_rcv_msg (net/netlink/genetlink.c:1160)
[ 51.441963][ T810] ? __pfx_ethnl_set_features (net/ethtool/features.c:211)
[ 51.442110][ T810] genl_rcv_msg (net/netlink/genetlink.c:65 net/netlink/genetlink.c:1211)
[ 51.442252][ T810] netlink_rcv_skb (net/netlink/af_netlink.c:2543)
[ 51.442393][ T810] ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1201)
[ 51.442535][ T810] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2520)
[ 51.442681][ T810] ? genl_rcv (net/netlink/genetlink.c:1219)
[ 51.442793][ T810] ? __pfx_down_read (kernel/locking/rwsem.c:1522)
[ 51.442938][ T810] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340)
[ 51.443081][ T810] genl_rcv (net/netlink/genetlink.c:1220)
[ 51.443188][ T810] netlink_unicast (net/netlink/af_netlink.c:1322 net/netlink/af_netlink.c:1348)
[ 51.443332][ T810] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1333)
[ 51.443479][ T810] ? find_held_lock (kernel/locking/lockdep.c:5339)
[ 51.443621][ T810] netlink_sendmsg (net/netlink/af_netlink.c:1892)
[ 51.443764][ T810] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1811)
[ 51.443904][ T810] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 51.444047][ T810] ? __might_fault (mm/memory.c:6751 mm/memory.c:6744)
[ 51.444191][ T810] __sys_sendto (net/socket.c:711 net/socket.c:726 net/socket.c:2208)
[ 51.444333][ T810] ? __pfx___sys_sendto (net/socket.c:2175)
[ 51.444476][ T810] ? __lock_release (kernel/locking/lockdep.c:5525)
[ 51.444625][ T810] ? __sys_recvmsg (net/socket.c:2889)
[ 51.444764][ T810] ? __pfx___sys_recvmsg (net/socket.c:2874)
[ 51.444906][ T810] ? do_user_addr_fault (./include/linux/rcupdate.h:882 ./include/linux/mm.h:742 arch/x86/mm/fault.c:1340)
[ 51.445048][ T810] __x64_sys_sendto (net/socket.c:2211)
[ 51.445190][ T810] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 51.445363][ T810] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 51.445503][ T810] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   51.445683][  T810] RIP: 0033:0x7f9ca23d8a4a
[ 51.445831][ T810] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
All code
========
   0:	d8 64 89 02          	fsubs  0x2(%rcx,%rcx,4)
   4:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   b:	eb b8                	jmp    0xffffffffffffffc5
   d:	0f 1f 00             	nopl   (%rax)
  10:	f3 0f 1e fa          	endbr64
  14:	41 89 ca             	mov    %ecx,%r10d
  17:	64 8b 04 25 18 00 00 	mov    %fs:0x18,%eax
  1e:	00 
  1f:	85 c0                	test   %eax,%eax
  21:	75 15                	jne    0x38
  23:	b8 2c 00 00 00       	mov    $0x2c,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 7e                	ja     0xb0
  32:	c3                   	ret
  33:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  38:	41 54                	push   %r12
  3a:	48 83 ec 30          	sub    $0x30,%rsp
  3e:	44                   	rex.R
  3f:	89                   	.byte 0x89

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 7e                	ja     0x86
   8:	c3                   	ret
   9:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   e:	41 54                	push   %r12
  10:	48 83 ec 30          	sub    $0x30,%rsp
  14:	44                   	rex.R
  15:	89                   	.byte 0x89
[   51.446327][  T810] RSP: 002b:00007ffe89130578 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[   51.446543][  T810] RAX: ffffffffffffffda RBX: 000000002a87c2a0 RCX: 00007f9ca23d8a4a
[   51.446757][  T810] RDX: 0000000000000044 RSI: 000000002a87c3b0 RDI: 0000000000000005
[   51.446969][  T810] RBP: 0000000000486020 R08: 00007f9ca2495200 R09: 000000000000000c
[   51.447181][  T810] R10: 0000000000000000 R11: 0000000000000246 R12: 000000002a87c340
[   51.447395][  T810] R13: 0000000000000000 R14: 000000002a87c350 R15: 000000002a87c2a0
| [   51.451427][  T810] Disabling lock debugging due to kernel taint
| [   51.451701][  T810] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [   51.452043][  T810] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7]
| [   51.452521][  T810] Tainted: [B]=BAD_PAGE
[   51.452625][  T810] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 51.452799][ T810] RIP: 0010:page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 51.452981][ T810] Code: 9b 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
All code
========
   0:	9b                   	fwait
   1:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
   8:	fc ff df 
   b:	48 c1 ed 03          	shr    $0x3,%rbp
   f:	48 01 dd             	add    %rbx,%rbp
  12:	4d 8d 75 1c          	lea    0x1c(%r13),%r14
  16:	be 04 00 00 00       	mov    $0x4,%esi
  1b:	4c 89 f7             	mov    %r14,%rdi
  1e:	e8 ad 6d 63 fe       	call   0xfffffffffe636dd0
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx		<-- trapping instruction
  2e:	4c 89 f0             	mov    %r14,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 04                	jl     0x3f
  3b:	84 d2                	test   %dl,%dl
  3d:	75 62                	jne    0xa1
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx
   4:	4c 89 f0             	mov    %r14,%rax
   7:	83 e0 07             	and    $0x7,%eax
   a:	83 c0 03             	add    $0x3,%eax
   d:	38 d0                	cmp    %dl,%al
   f:	7c 04                	jl     0x15
  11:	84 d2                	test   %dl,%dl
  13:	75 62                	jne    0x77
  15:	41                   	rex.B
[   51.453460][  T810] RSP: 0018:ffffc900005672e0 EFLAGS: 00010a06
[   51.453636][  T810] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff9a89f6e3
[   51.453844][  T810] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[   51.454052][  T810] RBP: fffffbfff37e4c78 R08: 0000000000000000 R09: fffffbfff3bbf688
[   51.454256][  T810] R10: ffffffff9ddfb447 R11: 205d303138542020 R12: ffff8880091fe620
[   51.454461][  T810] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: 0000000000000000
[   51.454670][  T810] FS:  00007f9ca2288000(0000) GS:ffff88806d100000(0000) knlGS:0000000000000000
[   51.454911][  T810] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   51.455086][  T810] CR2: 000000002a88d088 CR3: 000000001131c001 CR4: 0000000000772ef0
[   51.455293][  T810] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   51.455499][  T810] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   51.455709][  T810] PKRU: 55555554
[   51.455813][  T810] Call Trace:
[   51.455916][  T810]  <TASK>
[ 51.455987][ T810] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460)
[ 51.456093][ T810] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693)
[ 51.456235][ T810] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617)
[ 51.456378][ T810] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 51.456515][ T810] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 51.456656][ T810] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 51.456796][ T810] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 51.456934][ T810] page_pool_destroy (net/core/page_pool.c:1555)
[ 51.457071][ T810] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 51.457210][ T810] ? __pfx_call_netdevice_notifiers (net/core/dev.c:2095)
[ 51.457385][ T810] veth_set_features (drivers/net/veth.c:1060 drivers/net/veth.c:1494 drivers/net/veth.c:1472)
[ 51.457521][ T810] ? netdev_upper_get_next_dev_rcu (net/core/dev.c:7309 (discriminator 1))
[ 51.457693][ T810] __netdev_update_features (net/core/dev.c:10251)
[ 51.457833][ T810] ? __pfx___netdev_update_features (net/core/dev.c:10224)
[ 51.458002][ T810] ? __pfx_ethnl_parse_header_dev_get.part.0 (net/ethtool/netlink.c:137)
[ 51.458179][ T810] ethnl_set_features (net/ethtool/features.c:262)
[ 51.458315][ T810] ? __pfx_ethnl_set_features (net/ethtool/features.c:211)
[ 51.458454][ T810] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 51.458628][ T810] ? __nla_validate_parse (lib/nlattr.c:638)
[ 51.458772][ T810] ? __nla_parse (lib/nlattr.c:732)
[ 51.458907][ T810] ? genl_family_rcv_msg_attrs_parse.constprop.0 (net/netlink/genetlink.c:947)
[ 51.459113][ T810] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1115)
[ 51.459250][ T810] ? __pfx_genl_family_rcv_msg_doit (net/netlink/genetlink.c:1088)
[ 51.459422][ T810] ? rcu_read_lock_any_held (kernel/rcu/update.c:386 kernel/rcu/update.c:380)
[ 51.459563][ T810] ? validate_chain (kernel/locking/lockdep.c:3797 kernel/locking/lockdep.c:3817 kernel/locking/lockdep.c:3872)
[ 51.459700][ T810] genl_family_rcv_msg (net/netlink/genetlink.c:1195)
[ 51.459836][ T810] ? __pfx_genl_family_rcv_msg (net/netlink/genetlink.c:1160)
[ 51.459976][ T810] ? __pfx_ethnl_set_features (net/ethtool/features.c:211)
[ 51.460116][ T810] genl_rcv_msg (net/netlink/genetlink.c:65 net/netlink/genetlink.c:1211)
[ 51.460254][ T810] netlink_rcv_skb (net/netlink/af_netlink.c:2543)
[ 51.460391][ T810] ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1201)
[ 51.460529][ T810] ? __pfx_netlink_rcv_skb (net/netlink/af_netlink.c:2520)
[ 51.460670][ T810] ? genl_rcv (net/netlink/genetlink.c:1219)
[ 51.460774][ T810] ? __pfx_down_read (kernel/locking/rwsem.c:1522)
[ 51.460912][ T810] ? netlink_deliver_tap (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 net/netlink/af_netlink.c:340)
[ 51.461053][ T810] genl_rcv (net/netlink/genetlink.c:1220)
[ 51.461158][ T810] netlink_unicast (net/netlink/af_netlink.c:1322 net/netlink/af_netlink.c:1348)
[ 51.461375][ T810] ? __pfx_netlink_unicast (net/netlink/af_netlink.c:1333)
[ 51.461511][ T810] ? find_held_lock (kernel/locking/lockdep.c:5339)
[ 51.461651][ T810] netlink_sendmsg (net/netlink/af_netlink.c:1892)
[ 51.461789][ T810] ? __pfx_netlink_sendmsg (net/netlink/af_netlink.c:1811)
[ 51.462005][ T810] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 51.462141][ T810] ? __might_fault (mm/memory.c:6751 mm/memory.c:6744)
[ 51.462280][ T810] __sys_sendto (net/socket.c:711 net/socket.c:726 net/socket.c:2208)
[ 51.462419][ T810] ? __pfx___sys_sendto (net/socket.c:2175)
[ 51.462635][ T810] ? __lock_release (kernel/locking/lockdep.c:5525)
[ 51.462772][ T810] ? __sys_recvmsg (net/socket.c:2889)
[ 51.462912][ T810] ? __pfx___sys_recvmsg (net/socket.c:2874)
[ 51.463052][ T810] ? do_user_addr_fault (./include/linux/rcupdate.h:882 ./include/linux/mm.h:742 arch/x86/mm/fault.c:1340)
[ 51.463190][ T810] __x64_sys_sendto (net/socket.c:2211)
[ 51.463326][ T810] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 51.463494][ T810] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
[ 51.463632][ T810] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   51.463881][  T810] RIP: 0033:0x7f9ca23d8a4a
[ 51.464025][ T810] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
All code
========
   0:	d8 64 89 02          	fsubs  0x2(%rcx,%rcx,4)
   4:	48 c7 c0 ff ff ff ff 	mov    $0xffffffffffffffff,%rax
   b:	eb b8                	jmp    0xffffffffffffffc5
   d:	0f 1f 00             	nopl   (%rax)
  10:	f3 0f 1e fa          	endbr64
  14:	41 89 ca             	mov    %ecx,%r10d
  17:	64 8b 04 25 18 00 00 	mov    %fs:0x18,%eax
  1e:	00 
  1f:	85 c0                	test   %eax,%eax
  21:	75 15                	jne    0x38
  23:	b8 2c 00 00 00       	mov    $0x2c,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 7e                	ja     0xb0
  32:	c3                   	ret
  33:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  38:	41 54                	push   %r12
  3a:	48 83 ec 30          	sub    $0x30,%rsp
  3e:	44                   	rex.R
  3f:	89                   	.byte 0x89

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 7e                	ja     0x86
   8:	c3                   	ret
   9:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
   e:	41 54                	push   %r12
  10:	48 83 ec 30          	sub    $0x30,%rsp
  14:	44                   	rex.R
  15:	89                   	.byte 0x89
[   51.464587][  T810] RSP: 002b:00007ffe89130578 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[   51.464794][  T810] RAX: ffffffffffffffda RBX: 000000002a87c2a0 RCX: 00007f9ca23d8a4a
[   51.465085][  T810] RDX: 0000000000000044 RSI: 000000002a87c3b0 RDI: 0000000000000005
[   51.465288][  T810] RBP: 0000000000486020 R08: 00007f9ca2495200 R09: 000000000000000c
[   51.465493][  T810] R10: 0000000000000000 R11: 0000000000000246 R12: 000000002a87c340


Finger prints:
page_pool_item_uninit:page_pool_release:page_pool_destroy:veth_napi_del_range:veth_set_features
print_report:kasan_report:page_pool_item_uninit:page_pool_release:page_pool_destroy