======================================
| [   16.623481][   T65] ==================================================================
| [ 16.623746][ T65] BUG: KASAN: use-after-free in page_pool_item_uninit (net/core/page_pool.c:523)
| [   16.623980][   T65] Read of size 8 at addr ffff88800aec4008 by task kworker/u16:1/65
| [   16.624199][   T65]
[   16.624550][   T65] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   16.624739][   T65] Workqueue: netns cleanup_net
[   16.624904][   T65] Call Trace:
[   16.625020][   T65]  <TASK>
[ 16.625105][ T65] dump_stack_lvl (lib/dump_stack.c:123)
[ 16.625268][ T65] print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 16.625471][ T65] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 16.625632][ T65] print_report (mm/kasan/report.c:490)
[ 16.625792][ T65] ? kasan_addr_to_slab (./include/linux/mm.h:1295 mm/kasan/../slab.h:211 mm/kasan/common.c:38)
[ 16.625945][ T65] kasan_report (mm/kasan/report.c:604)
[ 16.626061][ T65] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 16.626222][ T65] page_pool_item_uninit (net/core/page_pool.c:523)
[ 16.626376][ T65] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 16.626530][ T65] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 16.626678][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.626873][ T65] page_pool_destroy (net/core/page_pool.c:1555)
[ 16.627023][ T65] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 16.627181][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.627374][ T65] veth_close (drivers/net/veth.c:1383)
[ 16.627490][ T65] __dev_close_many (net/core/dev.c:1591)
[ 16.627641][ T65] ? __pfx___dev_close_many (net/core/dev.c:1555)
[ 16.627800][ T65] dev_close_many (net/core/dev.c:1618)
[ 16.627955][ T65] ? fou_exit_net (net/ipv4/fou_core.c:1234)
[ 16.628108][ T65] ? __pfx_dev_close_many (net/core/dev.c:1608)
[ 16.628262][ T65] ? __mutex_trylock_common (./arch/x86/include/asm/atomic64_64.h:101 ./include/linux/atomic/atomic-arch-fallback.h:4296 ./include/linux/atomic/atomic-long.h:1482 ./include/linux/atomic/atomic-instrumented.h:4458 kernel/locking/mutex.c:104)
[ 16.628407][ T65] ? __pfx___mutex_trylock_common (kernel/locking/mutex.c:79)
[ 16.628592][ T65] unregister_netdevice_many_notify (net/core/dev.c:11562)
[ 16.628796][ T65] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11529)
[ 16.628981][ T65] ? default_device_exit_batch (net/core/dev.c:12122)
[ 16.629129][ T65] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:47 kernel/locking/mutex.c:66)
[ 16.629286][ T65] ? rtnl_is_locked (net/core/rtnetlink.c:163)
[ 16.629435][ T65] ? unregister_netdevice_queue (net/core/dev.c:11514)
[ 16.629626][ T65] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 16.629814][ T65] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 16.630006][ T65] default_device_exit_batch (net/core/dev.c:12136)
[ 16.630156][ T65] ? __pfx_default_device_exit_batch (net/core/dev.c:12111)
[ 16.630340][ T65] ? ops_exit_list (net/core/net_namespace.c:171 (discriminator 3))
[ 16.630494][ T65] cleanup_net (net/core/net_namespace.c:647 (discriminator 3))
[ 16.630646][ T65] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 16.630801][ T65] ? __pfx_cleanup_net (net/core/net_namespace.c:592)
[ 16.630951][ T65] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 16.631102][ T65] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 16.631252][ T65] ? process_one_work (kernel/workqueue.c:3205)
[ 16.631400][ T65] process_one_work (kernel/workqueue.c:3229)
[ 16.631548][ T65] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 16.631697][ T65] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 16.631847][ T65] ? assign_work (kernel/workqueue.c:1200)
[ 16.631993][ T65] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 16.632141][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.632329][ T65] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 16.632557][ T65] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 16.632705][ T65] kthread (kernel/kthread.c:389)
[ 16.632817][ T65] ? __pfx_kthread (kernel/kthread.c:342)
[ 16.632967][ T65] ret_from_fork (arch/x86/kernel/process.c:147)
[ 16.633192][ T65] ? __pfx_kthread (kernel/kthread.c:342)
[ 16.633337][ T65] ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
| [   16.637186][   T65] Disabling lock debugging due to kernel taint
| [   16.637370][   T65] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [   16.637782][   T65] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7]
| [   16.638308][   T65] Tainted: [B]=BAD_PAGE
[   16.638492][   T65] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   16.638677][   T65] Workqueue: netns cleanup_net
[ 16.638840][ T65] RIP: 0010:page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 16.639099][ T65] Code: af 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
All code
========
   0:	af                   	scas   %es:(%rdi),%eax
   1:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
   8:	fc ff df 
   b:	48 c1 ed 03          	shr    $0x3,%rbp
   f:	48 01 dd             	add    %rbx,%rbp
  12:	4d 8d 75 1c          	lea    0x1c(%r13),%r14
  16:	be 04 00 00 00       	mov    $0x4,%esi
  1b:	4c 89 f7             	mov    %r14,%rdi
  1e:	e8 ad 6d 63 fe       	call   0xfffffffffe636dd0
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx		<-- trapping instruction
  2e:	4c 89 f0             	mov    %r14,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 04                	jl     0x3f
  3b:	84 d2                	test   %dl,%dl
  3d:	75 62                	jne    0xa1
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx
   4:	4c 89 f0             	mov    %r14,%rax
   7:	83 e0 07             	and    $0x7,%eax
   a:	83 c0 03             	add    $0x3,%eax
   d:	38 d0                	cmp    %dl,%al
   f:	7c 04                	jl     0x15
  11:	84 d2                	test   %dl,%dl
  13:	75 62                	jne    0x77
  15:	41                   	rex.B
[   16.639603][   T65] RSP: 0000:ffffc90000467698 EFLAGS: 00010a06
[   16.639854][   T65] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffffae29f6e3
[   16.640069][   T65] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[   16.640281][   T65] RBP: fffffbfff5f24c78 R08: 0000000000000000 R09: fffffbfff62ff688
[   16.640573][   T65] R10: ffffffffb17fb447 R11: 205d353654202020 R12: ffff888009281e20
[   16.640780][   T65] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: 0000000000000000
[   16.641070][   T65] FS:  0000000000000000(0000) GS:ffff88806d080000(0000) knlGS:0000000000000000
[   16.641317][   T65] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.641493][   T65] CR2: 00007f80ead4f868 CR3: 000000002d53a003 CR4: 0000000000772ef0
[   16.641775][   T65] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   16.641981][   T65] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   16.642191][   T65] PKRU: 55555554
[   16.642379][   T65] Call Trace:
[   16.642483][   T65]  <TASK>
[ 16.642555][ T65] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460)
[ 16.642662][ T65] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693)
[ 16.642811][ T65] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617)
[ 16.643032][ T65] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 16.643180][ T65] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 16.643323][ T65] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 16.643460][ T65] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 16.643607][ T65] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 16.643753][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.643928][ T65] page_pool_destroy (net/core/page_pool.c:1555)
[ 16.644071][ T65] veth_napi_del_range (drivers/net/veth.c:1054 (discriminator 3))
[ 16.644212][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.644389][ T65] veth_close (drivers/net/veth.c:1383)
[ 16.644500][ T65] __dev_close_many (net/core/dev.c:1591)
[ 16.644642][ T65] ? __pfx___dev_close_many (net/core/dev.c:1555)
[ 16.644856][ T65] dev_close_many (net/core/dev.c:1618)
[ 16.644996][ T65] ? fou_exit_net (net/ipv4/fou_core.c:1234)
[ 16.645137][ T65] ? __pfx_dev_close_many (net/core/dev.c:1608)
[ 16.645276][ T65] ? __mutex_trylock_common (./arch/x86/include/asm/atomic64_64.h:101 ./include/linux/atomic/atomic-arch-fallback.h:4296 ./include/linux/atomic/atomic-long.h:1482 ./include/linux/atomic/atomic-instrumented.h:4458 kernel/locking/mutex.c:104)
[ 16.645494][ T65] ? __pfx___mutex_trylock_common (kernel/locking/mutex.c:79)
[ 16.645667][ T65] unregister_netdevice_many_notify (net/core/dev.c:11562)
[ 16.645841][ T65] ? __pfx_unregister_netdevice_many_notify (net/core/dev.c:11529)
[ 16.646083][ T65] ? default_device_exit_batch (net/core/dev.c:12122)
[ 16.646224][ T65] ? mutex_is_locked (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-long.h:38 ./include/linux/atomic/atomic-instrumented.h:3189 kernel/locking/mutex.h:47 kernel/locking/mutex.c:66)
[ 16.646361][ T65] ? rtnl_is_locked (net/core/rtnetlink.c:163)
[ 16.646504][ T65] ? unregister_netdevice_queue (net/core/dev.c:11514)
[ 16.646754][ T65] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 16.646924][ T65] ? __pfx_unregister_netdevice_queue (net/core/dev.c:11513)
[ 16.647096][ T65] default_device_exit_batch (net/core/dev.c:12136)
[ 16.647315][ T65] ? __pfx_default_device_exit_batch (net/core/dev.c:12111)
[ 16.647493][ T65] ? ops_exit_list (net/core/net_namespace.c:171 (discriminator 3))
[ 16.647631][ T65] cleanup_net (net/core/net_namespace.c:647 (discriminator 3))
[ 16.647770][ T65] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 16.647982][ T65] ? __pfx_cleanup_net (net/core/net_namespace.c:592)
[ 16.648119][ T65] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 16.648255][ T65] ? lock_acquire (kernel/locking/lockdep.c:5822)
[ 16.648393][ T65] ? process_one_work (kernel/workqueue.c:3205)
[ 16.648604][ T65] process_one_work (kernel/workqueue.c:3229)
[ 16.648747][ T65] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 16.648890][ T65] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 16.649028][ T65] ? assign_work (kernel/workqueue.c:1200)
[ 16.649240][ T65] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 16.649375][ T65] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 16.649543][ T65] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 16.649679][ T65] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 16.649889][ T65] kthread (kernel/kthread.c:389)
[ 16.649996][ T65] ? __pfx_kthread (kernel/kthread.c:342)
[ 16.650132][ T65] ret_from_fork (arch/x86/kernel/process.c:147)
[ 16.650268][ T65] ? __pfx_kthread (kernel/kthread.c:342)


Finger prints:
page_pool_item_uninit:page_pool_release:page_pool_destroy:veth_napi_del_range:veth_close
print_report:kasan_report:page_pool_item_uninit:page_pool_release:page_pool_destroy