[    1.918203] ip (272) used greatest stack depth: 12136 bytes left
[    2.113371] ------------[ cut here ]------------
[    2.113454] refcount_t: underflow; use-after-free.
[    2.113519] WARNING: CPU: 3 PID: 304 at lib/refcount.c:28 refcount_warn_saturate+0xbc/0x110
[    2.113607] Modules linked in:
[    2.113645] CPU: 3 UID: 0 PID: 304 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(voluntary) 
[    2.113731] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    2.113791] RIP: 0010:refcount_warn_saturate+0xbc/0x110
[    2.113839] Code: 9f e8 e8 54 ba ff 90 0f 0b 90 90 c3 80 3d 00 e6 2b 01 00 75 89 c6 05 f7 e5 2b 01 01 90 48 c7 c7 f8 48 75 9f e8 c5 54 ba ff 90 <0f> 0b 90 90 c3 80 3d db e5 2b 01 00 0f 85 62 ff ff ff c6 05 ce e5
[    2.114012] RSP: 0018:ffffbbc6806878e0 EFLAGS: 00010286
[    2.114062] RAX: 0000000000000000 RBX: ffffbbc6806878f0 RCX: 00000000ffffdfff
[    2.114137] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[    2.114212] RBP: ffffbbc6806873e8 R08: ffffffff9ff5ba28 R09: 00000000ffffdfff
[    2.114287] R10: ffffffff9fe7ba40 R11: ffffffff9ff2ba40 R12: dead000000000122
[    2.114365] R13: 00000000fffb73e2 R14: 0000000000000001 R15: ffff958481f3b000
[    2.114445] FS:  00007fea47c6e800(0000) GS:ffff95851e711000(0000) knlGS:0000000000000000
[    2.114519] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.114581] CR2: 00007ffdcac906c0 CR3: 00000000090c1001 CR4: 0000000000772ef0
[    2.114657] PKRU: 55555554
[    2.114688] Call Trace:
[    2.114715]  <TASK>
[    2.114737]  netdev_run_todo+0x21a/0x550
[    2.114778]  rtnl_newlink+0x5a9/0xc00
[    2.114823]  ? rtnl_setlink+0x2c0/0x2c0
[    2.114866]  rtnetlink_rcv_msg+0x358/0x400
[    2.114904]  ? get_page_from_freelist+0x2b6/0x1770
[    2.114963]  ? rtnl_calcit.isra.0+0x110/0x110
[    2.115014]  netlink_rcv_skb+0x57/0x100
[    2.115061]  netlink_unicast+0x252/0x380
[    2.115097]  ? __alloc_skb+0xdb/0x190
[    2.115141]  netlink_sendmsg+0x1be/0x3e0
[    2.115181]  ____sys_sendmsg+0x132/0x260
[    2.115228]  ? copy_msghdr_from_user+0x6c/0xa0
[    2.115276]  ___sys_sendmsg+0x87/0xd0
[    2.115314]  ? do_filp_open+0xc1/0x170
[    2.115360]  ? kmem_cache_alloc_noprof+0x393/0x4a0
[    2.115413]  __sys_sendmsg+0x71/0xd0
[    2.115449]  do_syscall_64+0xa4/0xfd0
[    2.115492]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[    2.115541] RIP: 0033:0x7fea47e3c1d7
[    2.115581] Code: Unable to access opcode bytes at 0x7fea47e3c1ad.
[    2.115646] RSP: 002b:00007ffdcac94188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[    2.115721] RAX: ffffffffffffffda RBX: 00007ffdcac948b0 RCX: 00007fea47e3c1d7
[    2.115796] RDX: 0000000000000000 RSI: 00007ffdcac941f0 RDI: 0000000000000005
[    2.115870] RBP: 0000000000000002 R08: 0000000000000044 R09: 0000000000000000
[    2.115946] R10: 00007fea47d33770 R11: 0000000000000246 R12: 00007ffdcac948c8
[    2.116020] R13: 00000000690e00a7 R14: 0000000000499600 R15: 00007ffdcac942d8
[    2.116096]  </TASK>
[    2.116121] ---[ end trace 0000000000000000 ]---