======================================
| xx__-> [    2.771982] ------------[ cut here ]------------
| [    2.772068] refcount_t: underflow; use-after-free.
| [    2.772152] WARNING: CPU: 0 PID: 304 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
| [    2.772306] Modules linked in:
[    2.772428] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    2.772484] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
[    2.772537] Code: 93 e8 e8 54 ba ff 90 0f 0b 90 90 c3 80 3d 00 e6 2b 01 00 75 89 c6 05 f7 e5 2b 01 01 90 48 c7 c7 f8 48 d5 93 e8 c5 54 ba ff 90 <0f> 0b 90 90 c3 80 3d db e5 2b 01 00 0f 85 62 ff ff ff c6 05 ce e5
All code
========
   0:	93                   	xchg   %eax,%ebx
   1:	e8 e8 54 ba ff       	call   0xffffffffffba54ee
   6:	90                   	nop
   7:	0f 0b                	ud2
   9:	90                   	nop
   a:	90                   	nop
   b:	c3                   	ret
   c:	80 3d 00 e6 2b 01 00 	cmpb   $0x0,0x12be600(%rip)        # 0x12be613
  13:	75 89                	jne    0xffffffffffffff9e
  15:	c6 05 f7 e5 2b 01 01 	movb   $0x1,0x12be5f7(%rip)        # 0x12be613
  1c:	90                   	nop
  1d:	48 c7 c7 f8 48 d5 93 	mov    $0xffffffff93d548f8,%rdi
  24:	e8 c5 54 ba ff       	call   0xffffffffffba54ee
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	c3                   	ret
  2f:	80 3d db e5 2b 01 00 	cmpb   $0x0,0x12be5db(%rip)        # 0x12be611
  36:	0f 85 62 ff ff ff    	jne    0xffffffffffffff9e
  3c:	c6                   	.byte 0xc6
  3d:	05                   	.byte 0x5
  3e:	ce                   	(bad)
  3f:	e5                   	.byte 0xe5

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	c3                   	ret
   5:	80 3d db e5 2b 01 00 	cmpb   $0x0,0x12be5db(%rip)        # 0x12be5e7
   c:	0f 85 62 ff ff ff    	jne    0xffffffffffffff74
  12:	c6                   	.byte 0xc6
  13:	05                   	.byte 0x5
  14:	ce                   	(bad)
  15:	e5                   	.byte 0xe5
[    2.772686] RSP: 0018:ffffb50a0066f8e0 EFLAGS: 00010286
[    2.772729] RAX: 0000000000000000 RBX: ffffb50a0066f8f0 RCX: 00000000ffffdfff
[    2.772790] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[    2.772847] RBP: ffffb50a0066f3e8 R08: ffffffff9455ba28 R09: 00000000ffffdfff
[    2.772912] R10: ffffffff9447ba40 R11: ffffffff9452ba40 R12: dead000000000122
[    2.772997] R13: 00000000fffb7671 R14: 0000000000000001 R15: ffff903282fc6000
[    2.773060] FS:  00007fa5f5312800(0000) GS:ffff903329f91000(0000) knlGS:0000000000000000
[    2.773124] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.773203] CR2: 00007ffe5c0a5940 CR3: 000000000445f004 CR4: 0000000000772ef0
[    2.773271] PKRU: 55555554
[    2.773297] Call Trace:
[    2.773329]  <TASK>
[    2.773354]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[    2.773395]  rtnl_newlink (net/core/rtnetlink.c:301 net/core/rtnetlink.c:4076)
[    2.773434]  ? rtnl_setlink (net/core/rtnetlink.c:3963)
[    2.773481]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6959)
[    2.773515]  ? get_page_from_freelist (./arch/x86/include/asm/preempt.h:95 mm/page_alloc.c:3310 mm/page_alloc.c:3340 mm/page_alloc.c:3881)
[    2.773562]  ? rtnl_calcit.isra.0 (net/core/rtnetlink.c:6861)
[    2.773626]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
[    2.773669]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
[    2.773713]  ? __alloc_skb (net/core/skbuff.c:690)
[    2.773760]  netlink_sendmsg (net/netlink/af_netlink.c:1894)
[    2.773794]  ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630)
[    2.773833]  ? copy_msghdr_from_user (net/socket.c:2570)
[    2.773886]  ___sys_sendmsg (net/socket.c:2686)
[    2.773921]  ? do_filp_open (fs/namei.c:4161)
[    2.773979]  ? kmem_cache_alloc_noprof (./include/linux/kernel.h:61 ./include/linux/sched/mm.h:321 mm/slub.c:4921 mm/slub.c:5256 mm/slub.c:5287)
[    2.774042]  __sys_sendmsg (net/socket.c:2716)
[    2.774088]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[    2.774145]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[    2.774204] RIP: 0033:0x7fa5f54e01d7
[    2.774247] Code: Unable to access opcode bytes at 0x7fa5f54e01ad.

Code starting with the faulting instruction
===========================================
[    2.774301] RSP: 002b:00007ffe5c0a9418 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[    2.774360] RAX: ffffffffffffffda RBX: 00007ffe5c0a9b40 RCX: 00007fa5f54e01d7
[    2.774422] RDX: 0000000000000000 RSI: 00007ffe5c0a9480 RDI: 0000000000000005
[    2.774498] RBP: 0000000000000002 R08: 0000000000000044 R09: 0000000000000000
[    2.774559] R10: 00007fa5f53d7770 R11: 0000000000000246 R12: 00007ffe5c0a9b58


Finger prints:
refcount_warn_saturate:netdev_run_todo:rtnl_newlink:rtnetlink_rcv_msg:netlink_rcv_skb