======================================
| [ 4076.575710][   T67] ==================================================================
| [ 4076.575998][ T67] BUG: KASAN: use-after-free in page_pool_item_uninit (net/core/page_pool.c:523)
| [ 4076.576250][   T67] Read of size 8 at addr ffff88800ac7d008 by task kworker/u16:1/67
| [ 4076.576495][   T67]
[ 4076.576880][   T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4076.577082][   T67] Workqueue: netns cleanup_net
[ 4076.577258][   T67] Call Trace:
[ 4076.577382][   T67]  <TASK>
[ 4076.577470][ T67] dump_stack_lvl (lib/dump_stack.c:123)
[ 4076.577645][ T67] print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 4076.577857][ T67] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 4076.578022][ T67] print_report (mm/kasan/report.c:490)
[ 4076.578186][ T67] ? kasan_addr_to_slab (./include/linux/mm.h:1295 mm/kasan/../slab.h:211 mm/kasan/common.c:38)
[ 4076.578354][ T67] kasan_report (mm/kasan/report.c:604)
[ 4076.578477][ T67] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 4076.578651][ T67] page_pool_item_uninit (net/core/page_pool.c:523)
[ 4076.578820][ T67] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 4076.578985][ T67] ? __folio_put (mm/swap.c:98)
[ 4076.579151][ T67] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 4076.579317][ T67] ? __page_pool_return_page (./include/net/netmem.h:93 ./include/net/netmem.h:104 net/core/page_pool.c:1054)
[ 4076.579485][ T67] page_pool_destroy (net/core/page_pool.c:1555)
[ 4076.579648][ T67] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 4076.579820][ T67] ? mark_held_locks (kernel/locking/lockdep.c:4321)
[ 4076.579999][ T67] veth_disable_xdp (drivers/net/veth.c:1061 drivers/net/veth.c:1162)
[ 4076.580164][ T67] veth_close (drivers/net/veth.c:1383)
[ 4076.580286][ T67] __dev_close_many (net/core/dev.c:1591)
[ 4076.580445][ T67] ? __pfx___dev_close_many (net/core/dev.c:1555)
[ 4076.580611][ T67] dev_close_many (net/core/dev.c:1618)
[ 4076.580769][ T67] ? fou_exit_net (net/ipv4/fou_core.c:1234)
[ 4076.580934][ T67] ? __pfx_dev_close_many (net/core/dev.c:1608)
[ 4076.581097][ T67] ? __mutex_trylock_common (./arch/x86/include/asm/atomic64_64.h:101 ./include/linux/atomic/atomic-arch-fallback.h:4296 ./include/linux/atomic/atomic-long.h:1482 ./include/linux/atomic/atomic-instrumented.h:4458 kernel/locking/mutex.c:104)
[ 4076.581258][ T67] ? __pfx___mutex_trylock_common (kernel/locking/mutex.c:79)
[ 4076.581464][ T67] unregister_netdevice_many_notify (net/core/dev.c:11562)
[ 4076.581669][ T67] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11529)
[ 4076.581874][ T67] ? default_device_exit_batch (net/core/dev.c:12122)
[ 4076.582045][ T67] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:47 kernel/locking/mutex.c:66)
[ 4076.582209][ T67] ? rtnl_is_locked (net/core/rtnetlink.c:163)
[ 4076.582373][ T67] ? unregister_netdevice_queue (net/core/dev.c:11514)
[ 4076.582572][ T67] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 4076.582779][ T67] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 4076.582977][ T67] default_device_exit_batch (net/core/dev.c:12136)
[ 4076.583139][ T67] ? __pfx_default_device_exit_batch (net/core/dev.c:12111)
[ 4076.583340][ T67] ? ops_exit_list (net/core/net_namespace.c:171 (discriminator 3))
[ 4076.583500][ T67] cleanup_net (net/core/net_namespace.c:647 (discriminator 3))
[ 4076.583665][ T67] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 4076.583827][ T67] ? __pfx_cleanup_net (net/core/net_namespace.c:592)
[ 4076.583990][ T67] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 4076.584154][ T67] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 4076.584334][ T67] ? process_one_work (kernel/workqueue.c:3205)
[ 4076.584505][ T67] process_one_work (kernel/workqueue.c:3229)
[ 4076.584668][ T67] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 4076.584836][ T67] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 4076.584999][ T67] ? assign_work (kernel/workqueue.c:1200)
[ 4076.585162][ T67] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 4076.585321][ T67] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 4076.585523][ T67] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 4076.585683][ T67] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 4076.585843][ T67] kthread (kernel/kthread.c:389)
[ 4076.585971][ T67] ? __pfx_kthread (kernel/kthread.c:342)
[ 4076.586142][ T67] ret_from_fork (arch/x86/kernel/process.c:147)
[ 4076.586309][ T67] ? __pfx_kthread (kernel/kthread.c:342)
[ 4076.586469][ T67] ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
| [ 4076.590409][   T67] Disabling lock debugging due to kernel taint
| [ 4076.590707][   T67] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [ 4076.591105][   T67] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7]
| [ 4076.591682][   T67] Tainted: [B]=BAD_PAGE
[ 4076.591888][   T67] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 4076.592090][   T67] Workqueue: netns cleanup_net
[ 4076.592337][ T67] RIP: 0010:page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 4076.592538][ T67] Code: 8e 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
All code
========
   0:	8e 48 bb             	mov    -0x45(%rax),%cs
   3:	00 00                	add    %al,(%rax)
   5:	00 00                	add    %al,(%rax)
   7:	00 fc                	add    %bh,%ah
   9:	ff                   	(bad)
   a:	df 48 c1             	fisttps -0x3f(%rax)
   d:	ed                   	in     (%dx),%eax
   e:	03 48 01             	add    0x1(%rax),%ecx
  11:	dd 4d 8d             	fisttpll -0x73(%rbp)
  14:	75 1c                	jne    0x32
  16:	be 04 00 00 00       	mov    $0x4,%esi
  1b:	4c 89 f7             	mov    %r14,%rdi
  1e:	e8 ad 6d 63 fe       	call   0xfffffffffe636dd0
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx		<-- trapping instruction
  2e:	4c 89 f0             	mov    %r14,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 04                	jl     0x3f
  3b:	84 d2                	test   %dl,%dl
  3d:	75 62                	jne    0xa1
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx
   4:	4c 89 f0             	mov    %r14,%rax
   7:	83 e0 07             	and    $0x7,%eax
   a:	83 c0 03             	add    $0x3,%eax
   d:	38 d0                	cmp    %dl,%al
   f:	7c 04                	jl     0x15
  11:	84 d2                	test   %dl,%dl
  13:	75 62                	jne    0x77
  15:	41                   	rex.B
[ 4076.593088][   T67] RSP: 0018:ffffc90000487658 EFLAGS: 00010a06
[ 4076.593366][   T67] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffff8d89f6e3
[ 4076.593602][   T67] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[ 4076.593834][   T67] RBP: fffffbfff1de4c78 R08: 0000000000000000 R09: fffffbfff21bf688
[ 4076.594064][   T67] R10: ffffffff90dfb447 R11: 205d373654202020 R12: ffff888012295a20
[ 4076.594404][   T67] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea0000264500
[ 4076.594730][   T67] FS:  0000000000000000(0000) GS:ffff88806d180000(0000) knlGS:0000000000000000
[ 4076.595001][   T67] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4076.595202][   T67] CR2: 00007f94b0dfef00 CR3: 000000001873a001 CR4: 0000000000772ef0
[ 4076.595445][   T67] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4076.595759][   T67] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4076.596069][   T67] PKRU: 55555554
[ 4076.596189][   T67] Call Trace:
[ 4076.596320][   T67]  <TASK>
[ 4076.596410][ T67] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460)
[ 4076.596544][ T67] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693)
[ 4076.596706][ T67] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617)
[ 4076.596874][ T67] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 4076.597035][ T67] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 4076.597275][ T67] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 4076.597434][ T67] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 4076.597596][ T67] ? __folio_put (mm/swap.c:98)
[ 4076.597762][ T67] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 4076.597921][ T67] ? __page_pool_return_page (./include/net/netmem.h:93 ./include/net/netmem.h:104 net/core/page_pool.c:1054)
[ 4076.598082][ T67] page_pool_destroy (net/core/page_pool.c:1555)
[ 4076.598242][ T67] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 4076.598404][ T67] ? mark_held_locks (kernel/locking/lockdep.c:4321)
[ 4076.598563][ T67] veth_disable_xdp (drivers/net/veth.c:1061 drivers/net/veth.c:1162)
[ 4076.598803][ T67] veth_close (drivers/net/veth.c:1383)
[ 4076.598932][ T67] __dev_close_many (net/core/dev.c:1591)
[ 4076.599090][ T67] ? __pfx___dev_close_many (net/core/dev.c:1555)
[ 4076.599250][ T67] dev_close_many (net/core/dev.c:1618)
[ 4076.599409][ T67] ? fou_exit_net (net/ipv4/fou_core.c:1234)
[ 4076.599651][ T67] ? __pfx_dev_close_many (net/core/dev.c:1608)
[ 4076.599805][ T67] ? __mutex_trylock_common (./arch/x86/include/asm/atomic64_64.h:101 ./include/linux/atomic/atomic-arch-fallback.h:4296 ./include/linux/atomic/atomic-long.h:1482 ./include/linux/atomic/atomic-instrumented.h:4458 kernel/locking/mutex.c:104)
[ 4076.599964][ T67] ? __pfx___mutex_trylock_common (kernel/locking/mutex.c:79)
[ 4076.600166][ T67] unregister_netdevice_many_notify (net/core/dev.c:11562)
[ 4076.600369][ T67] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11529)
[ 4076.600640][ T67] ? default_device_exit_batch (net/core/dev.c:12122)
[ 4076.600802][ T67] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:47 kernel/locking/mutex.c:66)
[ 4076.600958][ T67] ? rtnl_is_locked (net/core/rtnetlink.c:163)
[ 4076.601121][ T67] ? unregister_netdevice_queue (net/core/dev.c:11514)
[ 4076.601403][ T67] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 4076.601606][ T67] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 4076.601824][ T67] default_device_exit_batch (net/core/dev.c:12136)
[ 4076.601984][ T67] ? __pfx_default_device_exit_batch (net/core/dev.c:12111)
[ 4076.602181][ T67] ? ops_exit_list (net/core/net_namespace.c:171 (discriminator 3))
[ 4076.602494][ T67] cleanup_net (net/core/net_namespace.c:647 (discriminator 3))
[ 4076.602644][ T67] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 4076.602879][ T67] ? __pfx_cleanup_net (net/core/net_namespace.c:592)
[ 4076.603027][ T67] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 4076.603176][ T67] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 4076.603329][ T67] ? process_one_work (kernel/workqueue.c:3205)
[ 4076.603485][ T67] process_one_work (kernel/workqueue.c:3229)
[ 4076.603642][ T67] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 4076.603801][ T67] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 4076.603968][ T67] ? assign_work (kernel/workqueue.c:1200)
[ 4076.604128][ T67] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 4076.604298][ T67] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 4076.604497][ T67] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 4076.604656][ T67] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 4076.604814][ T67] kthread (kernel/kthread.c:389)
[ 4076.604933][ T67] ? __pfx_kthread (kernel/kthread.c:342)
[ 4076.605172][ T67] ret_from_fork (arch/x86/kernel/process.c:147)
[ 4076.605329][ T67] ? __pfx_kthread (kernel/kthread.c:342)


Finger prints:
page_pool_item_uninit:page_pool_release:page_pool_destroy:veth_napi_del_range:veth_disable_xdp
print_report:kasan_report:page_pool_item_uninit:page_pool_release:page_pool_destroy