======================================
| [    2.113371] ------------[ cut here ]------------
| [    2.113454] refcount_t: underflow; use-after-free.
| [    2.113519] WARNING: CPU: 3 PID: 304 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
| [    2.113607] Modules linked in:
[    2.113731] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    2.113791] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
[    2.113839] Code: 9f e8 e8 54 ba ff 90 0f 0b 90 90 c3 80 3d 00 e6 2b 01 00 75 89 c6 05 f7 e5 2b 01 01 90 48 c7 c7 f8 48 75 9f e8 c5 54 ba ff 90 <0f> 0b 90 90 c3 80 3d db e5 2b 01 00 0f 85 62 ff ff ff c6 05 ce e5
All code
========
   0:	9f                   	lahf
   1:	e8 e8 54 ba ff       	call   0xffffffffffba54ee
   6:	90                   	nop
   7:	0f 0b                	ud2
   9:	90                   	nop
   a:	90                   	nop
   b:	c3                   	ret
   c:	80 3d 00 e6 2b 01 00 	cmpb   $0x0,0x12be600(%rip)        # 0x12be613
  13:	75 89                	jne    0xffffffffffffff9e
  15:	c6 05 f7 e5 2b 01 01 	movb   $0x1,0x12be5f7(%rip)        # 0x12be613
  1c:	90                   	nop
  1d:	48 c7 c7 f8 48 75 9f 	mov    $0xffffffff9f7548f8,%rdi
  24:	e8 c5 54 ba ff       	call   0xffffffffffba54ee
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	c3                   	ret
  2f:	80 3d db e5 2b 01 00 	cmpb   $0x0,0x12be5db(%rip)        # 0x12be611
  36:	0f 85 62 ff ff ff    	jne    0xffffffffffffff9e
  3c:	c6                   	.byte 0xc6
  3d:	05                   	.byte 0x5
  3e:	ce                   	(bad)
  3f:	e5                   	.byte 0xe5

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	c3                   	ret
   5:	80 3d db e5 2b 01 00 	cmpb   $0x0,0x12be5db(%rip)        # 0x12be5e7
   c:	0f 85 62 ff ff ff    	jne    0xffffffffffffff74
  12:	c6                   	.byte 0xc6
  13:	05                   	.byte 0x5
  14:	ce                   	(bad)
  15:	e5                   	.byte 0xe5
[    2.114012] RSP: 0018:ffffbbc6806878e0 EFLAGS: 00010286
[    2.114062] RAX: 0000000000000000 RBX: ffffbbc6806878f0 RCX: 00000000ffffdfff
[    2.114137] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[    2.114212] RBP: ffffbbc6806873e8 R08: ffffffff9ff5ba28 R09: 00000000ffffdfff
[    2.114287] R10: ffffffff9fe7ba40 R11: ffffffff9ff2ba40 R12: dead000000000122
[    2.114365] R13: 00000000fffb73e2 R14: 0000000000000001 R15: ffff958481f3b000
[    2.114445] FS:  00007fea47c6e800(0000) GS:ffff95851e711000(0000) knlGS:0000000000000000
[    2.114519] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.114581] CR2: 00007ffdcac906c0 CR3: 00000000090c1001 CR4: 0000000000772ef0
[    2.114657] PKRU: 55555554
[    2.114688] Call Trace:
[    2.114715]  <TASK>
[    2.114737]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[    2.114778]  rtnl_newlink (net/core/rtnetlink.c:301 net/core/rtnetlink.c:4076)
[    2.114823]  ? rtnl_setlink (net/core/rtnetlink.c:3963)
[    2.114866]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6959)
[    2.114904]  ? get_page_from_freelist (./arch/x86/include/asm/preempt.h:95 mm/page_alloc.c:3310 mm/page_alloc.c:3340 mm/page_alloc.c:3881)
[    2.114963]  ? rtnl_calcit.isra.0 (net/core/rtnetlink.c:6861)
[    2.115014]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
[    2.115061]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
[    2.115097]  ? __alloc_skb (net/core/skbuff.c:690)
[    2.115141]  netlink_sendmsg (net/netlink/af_netlink.c:1894)
[    2.115181]  ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630)
[    2.115228]  ? copy_msghdr_from_user (net/socket.c:2570)
[    2.115276]  ___sys_sendmsg (net/socket.c:2686)
[    2.115314]  ? do_filp_open (fs/namei.c:4161)
[    2.115360]  ? kmem_cache_alloc_noprof (./include/linux/kernel.h:61 ./include/linux/sched/mm.h:321 mm/slub.c:4921 mm/slub.c:5256 mm/slub.c:5287)
[    2.115413]  __sys_sendmsg (net/socket.c:2716)
[    2.115449]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[    2.115492]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[    2.115541] RIP: 0033:0x7fea47e3c1d7
[    2.115581] Code: Unable to access opcode bytes at 0x7fea47e3c1ad.

Code starting with the faulting instruction
===========================================
[    2.115646] RSP: 002b:00007ffdcac94188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[    2.115721] RAX: ffffffffffffffda RBX: 00007ffdcac948b0 RCX: 00007fea47e3c1d7
[    2.115796] RDX: 0000000000000000 RSI: 00007ffdcac941f0 RDI: 0000000000000005
[    2.115870] RBP: 0000000000000002 R08: 0000000000000044 R09: 0000000000000000
[    2.115946] R10: 00007fea47d33770 R11: 0000000000000246 R12: 00007ffdcac948c8


Finger prints:
refcount_warn_saturate:netdev_run_todo:rtnl_newlink:rtnetlink_rcv_msg:netlink_rcv_skb