[    2.771982] ------------[ cut here ]------------
[    2.772068] refcount_t: underflow; use-after-free.
[    2.772152] WARNING: CPU: 0 PID: 304 at lib/refcount.c:28 refcount_warn_saturate+0xbc/0x110
[    2.772306] Modules linked in:
[    2.772352] CPU: 0 UID: 0 PID: 304 Comm: ip Not tainted 6.18.0-rc4-virtme #1 PREEMPT(voluntary) 
[    2.772428] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    2.772484] RIP: 0010:refcount_warn_saturate+0xbc/0x110
[    2.772537] Code: 93 e8 e8 54 ba ff 90 0f 0b 90 90 c3 80 3d 00 e6 2b 01 00 75 89 c6 05 f7 e5 2b 01 01 90 48 c7 c7 f8 48 d5 93 e8 c5 54 ba ff 90 <0f> 0b 90 90 c3 80 3d db e5 2b 01 00 0f 85 62 ff ff ff c6 05 ce e5
[    2.772686] RSP: 0018:ffffb50a0066f8e0 EFLAGS: 00010286
[    2.772729] RAX: 0000000000000000 RBX: ffffb50a0066f8f0 RCX: 00000000ffffdfff
[    2.772790] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[    2.772847] RBP: ffffb50a0066f3e8 R08: ffffffff9455ba28 R09: 00000000ffffdfff
[    2.772912] R10: ffffffff9447ba40 R11: ffffffff9452ba40 R12: dead000000000122
[    2.772997] R13: 00000000fffb7671 R14: 0000000000000001 R15: ffff903282fc6000
[    2.773060] FS:  00007fa5f5312800(0000) GS:ffff903329f91000(0000) knlGS:0000000000000000
[    2.773124] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.773203] CR2: 00007ffe5c0a5940 CR3: 000000000445f004 CR4: 0000000000772ef0
[    2.773271] PKRU: 55555554
[    2.773297] Call Trace:
[    2.773329]  <TASK>
[    2.773354]  netdev_run_todo+0x21a/0x550
[    2.773395]  rtnl_newlink+0x5a9/0xc00
[    2.773434]  ? rtnl_setlink+0x2c0/0x2c0
[    2.773481]  rtnetlink_rcv_msg+0x358/0x400
[    2.773515]  ? get_page_from_freelist+0x2b6/0x1770
[    2.773562]  ? rtnl_calcit.isra.0+0x110/0x110
[    2.773626]  netlink_rcv_skb+0x57/0x100
[    2.773669]  netlink_unicast+0x252/0x380
[    2.773713]  ? __alloc_skb+0xdb/0x190
[    2.773760]  netlink_sendmsg+0x1be/0x3e0
[    2.773794]  ____sys_sendmsg+0x132/0x260
[    2.773833]  ? copy_msghdr_from_user+0x6c/0xa0
[    2.773886]  ___sys_sendmsg+0x87/0xd0
[    2.773921]  ? do_filp_open+0xc1/0x170
[    2.773979]  ? kmem_cache_alloc_noprof+0x393/0x4a0
[    2.774042]  __sys_sendmsg+0x71/0xd0
[    2.774088]  do_syscall_64+0xa4/0xfd0
[    2.774145]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
[    2.774204] RIP: 0033:0x7fa5f54e01d7
[    2.774247] Code: Unable to access opcode bytes at 0x7fa5f54e01ad.
[    2.774301] RSP: 002b:00007ffe5c0a9418 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[    2.774360] RAX: ffffffffffffffda RBX: 00007ffe5c0a9b40 RCX: 00007fa5f54e01d7
[    2.774422] RDX: 0000000000000000 RSI: 00007ffe5c0a9480 RDI: 0000000000000005
[    2.774498] RBP: 0000000000000002 R08: 0000000000000044 R09: 0000000000000000
[    2.774559] R10: 00007fa5f53d7770 R11: 0000000000000246 R12: 00007ffe5c0a9b58
[    2.774618] R13: 00000000690deb54 R14: 0000000000499600 R15: 00007ffe5c0a9568
[    2.774683]  </TASK>
[    2.774705] ---[ end trace 0000000000000000 ]---