======================================
| [   22.228234][  T291] ==================================================================
| [ 22.228557][ T291] BUG: KASAN: use-after-free in page_pool_item_uninit (net/core/page_pool.c:523)
| [   22.228767][  T291] Read of size 8 at addr ffff88800e484008 by task kworker/0:2/291
| [   22.228960][  T291]
[   22.229273][  T291] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   22.229442][  T291] Workqueue: events page_pool_release_retry
[   22.229611][  T291] Call Trace:
[   22.229713][  T291]  <TASK>
[ 22.229791][ T291] dump_stack_lvl (lib/dump_stack.c:123)
[ 22.229927][ T291] print_address_description.constprop.0 (mm/kasan/report.c:379)
[ 22.230091][ T291] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 22.230234][ T291] print_report (mm/kasan/report.c:490)
[ 22.230359][ T291] ? kasan_addr_to_slab (./include/linux/mm.h:1295 mm/kasan/../slab.h:211 mm/kasan/common.c:38)
[ 22.230490][ T291] kasan_report (mm/kasan/report.c:604)
[ 22.230588][ T291] ? page_pool_item_uninit (net/core/page_pool.c:523)
[ 22.230717][ T291] page_pool_item_uninit (net/core/page_pool.c:523)
[ 22.230855][ T291] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 22.230983][ T291] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 22.231119][ T291] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 22.231253][ T291] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 22.231390][ T291] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 22.231528][ T291] page_pool_release_retry (net/core/page_pool.c:1497)
[ 22.231662][ T291] ? trace_workqueue_execute_start (./include/trace/events/workqueue.h:84 (discriminator 37))
[ 22.231846][ T291] process_one_work (kernel/workqueue.c:3229)
[ 22.231981][ T291] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 22.232118][ T291] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 22.232246][ T291] ? assign_work (kernel/workqueue.c:1200)
[ 22.232375][ T291] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 22.232507][ T291] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 22.232677][ T291] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 22.232803][ T291] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 22.232942][ T291] kthread (kernel/kthread.c:389)
[ 22.233049][ T291] ? __pfx_kthread (kernel/kthread.c:342)
[ 22.233177][ T291] ret_from_fork (arch/x86/kernel/process.c:147)
[ 22.233305][ T291] ? __pfx_kthread (kernel/kthread.c:342)
[ 22.233433][ T291] ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
| [   22.236351][  T291] Disabling lock debugging due to kernel taint
| [   22.236536][  T291] Oops: general protection fault, probably for non-canonical address 0xf99995999999999c: 0000 [#1] PREEMPT SMP KASAN NOPTI
| [   22.236835][  T291] KASAN: maybe wild-memory-access in range [0xcccccccccccccce0-0xcccccccccccccce7]
| [   22.237319][  T291] Tainted: [B]=BAD_PAGE
[   22.237420][  T291] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   22.237579][  T291] Workqueue: events page_pool_release_retry
[ 22.237752][ T291] RIP: 0010:page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 22.237913][ T291] Code: a8 48 bb 00 00 00 00 00 fc ff df 48 c1 ed 03 48 01 dd 4d 8d 75 1c be 04 00 00 00 4c 89 f7 e8 ad 6d 63 fe 4c 89 f0 48 c1 e8 03 <0f> b6 14 18 4c 89 f0 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 62 41
All code
========
   0:	a8 48                	test   $0x48,%al
   2:	bb 00 00 00 00       	mov    $0x0,%ebx
   7:	00 fc                	add    %bh,%ah
   9:	ff                   	(bad)
   a:	df 48 c1             	fisttps -0x3f(%rax)
   d:	ed                   	in     (%dx),%eax
   e:	03 48 01             	add    0x1(%rax),%ecx
  11:	dd 4d 8d             	fisttpll -0x73(%rbp)
  14:	75 1c                	jne    0x32
  16:	be 04 00 00 00       	mov    $0x4,%esi
  1b:	4c 89 f7             	mov    %r14,%rdi
  1e:	e8 ad 6d 63 fe       	call   0xfffffffffe636dd0
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx		<-- trapping instruction
  2e:	4c 89 f0             	mov    %r14,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 d0                	cmp    %dl,%al
  39:	7c 04                	jl     0x3f
  3b:	84 d2                	test   %dl,%dl
  3d:	75 62                	jne    0xa1
  3f:	41                   	rex.B

Code starting with the faulting instruction
===========================================
   0:	0f b6 14 18          	movzbl (%rax,%rbx,1),%edx
   4:	4c 89 f0             	mov    %r14,%rax
   7:	83 e0 07             	and    $0x7,%eax
   a:	83 c0 03             	add    $0x3,%eax
   d:	38 d0                	cmp    %dl,%al
   f:	7c 04                	jl     0x15
  11:	84 d2                	test   %dl,%dl
  13:	75 62                	jne    0x77
  15:	41                   	rex.B
[   22.238363][  T291] RSP: 0018:ffffc90000587bc0 EFLAGS: 00010a06
[   22.238532][  T291] RAX: 199999999999999c RBX: dffffc0000000000 RCX: ffffffffa749f6e3
[   22.238721][  T291] RDX: 0000000000000000 RSI: 0000000000000004 RDI: cccccccccccccce0
[   22.238904][  T291] RBP: fffffbfff5164c78 R08: 0000000000000000 R09: fffffbfff553f688
[   22.239103][  T291] R10: ffffffffaa9fb447 R11: 205d313932542020 R12: ffff88800509f220
[   22.239299][  T291] R13: ccccccccccccccc4 R14: cccccccccccccce0 R15: ffffea0000377200
[   22.239484][  T291] FS:  0000000000000000(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000
[   22.239708][  T291] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   22.239874][  T291] CR2: 0000563348403dec CR3: 000000000bac2006 CR4: 0000000000772ef0
[   22.240061][  T291] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   22.240255][  T291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   22.240443][  T291] PKRU: 55555554
[   22.240547][  T291] Call Trace:
[   22.240639][  T291]  <TASK>
[ 22.240704][ T291] ? die_addr (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:460)
[ 22.240811][ T291] ? exc_general_protection (arch/x86/kernel/traps.c:751 arch/x86/kernel/traps.c:693)
[ 22.240938][ T291] ? asm_exc_general_protection (./arch/x86/include/asm/idtentry.h:617)
[ 22.241077][ T291] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 22.241203][ T291] ? page_pool_item_uninit (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/atomic/atomic-instrumented.h:33 ./include/linux/refcount.h:136 net/core/page_pool.c:524)
[ 22.241335][ T291] page_pool_release (net/core/page_pool.c:1431 net/core/page_pool.c:1484)
[ 22.241460][ T291] ? __pfx_page_pool_release (net/core/page_pool.c:1478)
[ 22.241593][ T291] ? __pfx_lock_acquire.part.0 (kernel/locking/lockdep.c:5814)
[ 22.241745][ T291] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 22.241871][ T291] ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 37))
[ 22.241995][ T291] page_pool_release_retry (net/core/page_pool.c:1497)
[ 22.242118][ T291] ? trace_workqueue_execute_start (./include/trace/events/workqueue.h:84 (discriminator 37))
[ 22.242273][ T291] process_one_work (kernel/workqueue.c:3229)
[ 22.242408][ T291] ? __pfx___lock_release (kernel/locking/lockdep.c:5501)
[ 22.242533][ T291] ? __pfx_process_one_work (kernel/workqueue.c:3131)
[ 22.242656][ T291] ? assign_work (kernel/workqueue.c:1200)
[ 22.242779][ T291] worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391)
[ 22.242900][ T291] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)
[ 22.243052][ T291] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 22.243175][ T291] ? __pfx_worker_thread (kernel/workqueue.c:3337)
[ 22.243297][ T291] kthread (kernel/kthread.c:389)
[ 22.243393][ T291] ? __pfx_kthread (kernel/kthread.c:342)
[ 22.243515][ T291] ret_from_fork (arch/x86/kernel/process.c:147)
[ 22.243637][ T291] ? __pfx_kthread (kernel/kthread.c:342)


Finger prints:
page_pool_item_uninit:page_pool_release:page_pool_release_retry:process_one_work:worker_thread
print_report:kasan_report:page_pool_item_uninit:page_pool_release:page_pool_release_retry