======================================
| xx__-> [   38.491112] ------------[ cut here ]------------
| [   38.491469] refcount_t: underflow; use-after-free.
| [   38.491849] WARNING: CPU: 2 PID: 68 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
| [   38.492434] Modules linked in: xt_HL nft_compat nf_tables libcrc32c amt act_mirred act_tunnel_key cls_flower bareudp ip6_udp_tunnel udp_tunnel mpls_iptunnel mpls_router sch_ingress
[   38.494086] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   38.494864] Workqueue: netns cleanup_net
[   38.495147] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[ 38.495502] Code: 0b 90 90 c3 cc cc cc cc 80 3d 69 d4 67 01 00 0f 85 75 ff ff ff c6 05 5c d4 67 01 01 90 48 c7 c7 e8 37 33 aa e8 a1 26 b4 ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 3c d4 67 01 00 0f 85 4a ff ff ff
All code
========
   0:	0b 90 90 c3 cc cc    	or     -0x33333c70(%rax),%edx
   6:	cc                   	int3
   7:	cc                   	int3
   8:	80 3d 69 d4 67 01 00 	cmpb   $0x0,0x167d469(%rip)        # 0x167d478
   f:	0f 85 75 ff ff ff    	jne    0xffffffffffffff8a
  15:	c6 05 5c d4 67 01 01 	movb   $0x1,0x167d45c(%rip)        # 0x167d478
  1c:	90                   	nop
  1d:	48 c7 c7 e8 37 33 aa 	mov    $0xffffffffaa3337e8,%rdi
  24:	e8 a1 26 b4 ff       	call   0xffffffffffb426ca
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	c3                   	ret
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	80 3d 3c d4 67 01 00 	cmpb   $0x0,0x167d43c(%rip)        # 0x167d476
  3a:	0f 85 4a ff ff ff    	jne    0xffffffffffffff8a

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	c3                   	ret
   5:	cc                   	int3
   6:	cc                   	int3
   7:	cc                   	int3
   8:	cc                   	int3
   9:	80 3d 3c d4 67 01 00 	cmpb   $0x0,0x167d43c(%rip)        # 0x167d44c
  10:	0f 85 4a ff ff ff    	jne    0xffffffffffffff60
[   38.496753] RSP: 0018:ffffb33c80263d78 EFLAGS: 00010286
[   38.497114] RAX: 0000000000000000 RBX: ffff9dfb43b2c000 RCX: 00000000ffffdfff
[   38.497585] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[   38.497957] RBP: ffff9dfb43b2c610 R08: ffffffffaa778508 R09: 00000000ffffdfff
[   38.498321] R10: ffffffffaa698520 R11: ffffffffaa748520 R12: ffff9dfb43b2c000
[   38.498778] R13: ffffb33c80263e08 R14: ffff9dfb43b2cb80 R15: ffff9dfb439b4550
[   38.499206] FS:  0000000000000000(0000) GS:ffff9dfb7ed00000(0000) knlGS:0000000000000000
[   38.499742] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   38.500058] CR2: 00007fc9cde560e0 CR3: 000000001be60001 CR4: 0000000000770ef0
[   38.500504] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   38.500927] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   38.501379] PKRU: 55555554
[   38.501579] Call Trace:
[   38.501758]  <TASK>
[   38.501915] ? __warn (kernel/panic.c:677) 
[   38.502143] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[   38.502467] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[   38.502740] ? handle_bug (arch/x86/kernel/traps.c:238) 
[   38.502981] ? exc_invalid_op (arch/x86/kernel/traps.c:259 (discriminator 1)) 
[   38.503252] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[   38.503551] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[   38.503877] ? refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) 
[   38.504199] br_sysfs_delbr (net/bridge/br_sysfs_br.c:1086) 
[   38.504475] br_dev_delete (net/bridge/br_if.c:396) 
[   38.504723] br_net_exit_batch_rtnl (net/bridge/br.c:369) 
[   38.505036] cleanup_net (net/core/net_namespace.c:630) 
[   38.505289] ? process_one_work (kernel/workqueue.c:2606) 
[   38.505657] process_one_work (kernel/workqueue.c:2633) 
[   38.505919] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[   38.506188] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[   38.506482] kthread (kernel/kthread.c:388) 
[   38.506660] ? __pfx_kthread (kernel/kthread.c:341) 
[   38.506857] ret_from_fork (arch/x86/kernel/process.c:147) 
[   38.507049] ? __pfx_kthread (kernel/kthread.c:341) 
[   38.507244] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) 
| [   38.510583] sysfs group 'bridge' not found for kobject 'br0'
| [   38.510909] WARNING: CPU: 3 PID: 68 at fs/sysfs/group.c:282 sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
|
| [   38.511346] Modules linked in: xt_HL nft_compat nf_tables libcrc32c amt act_mirred act_tunnel_key cls_flower bareudp ip6_udp_tunnel udp_tunnel mpls_iptunnel mpls_router sch_ingress
[   38.512697] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   38.513366] Workqueue: netns cleanup_net
[   38.513598] RIP: 0010:sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[ 38.513884] Code: 48 89 ef 5d 41 5c e9 7a ad ff ff 48 89 ef e8 12 9b ff ff eb d1 90 49 8b 14 24 48 8b 33 48 c7 c7 d0 cd 32 aa e8 ac 67 c5 ff 90 <0f> 0b 90 90 5b 5d 41 5c c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00
All code
========
   0:	48 89 ef             	mov    %rbp,%rdi
   3:	5d                   	pop    %rbp
   4:	41 5c                	pop    %r12
   6:	e9 7a ad ff ff       	jmp    0xffffffffffffad85
   b:	48 89 ef             	mov    %rbp,%rdi
   e:	e8 12 9b ff ff       	call   0xffffffffffff9b25
  13:	eb d1                	jmp    0xffffffffffffffe6
  15:	90                   	nop
  16:	49 8b 14 24          	mov    (%r12),%rdx
  1a:	48 8b 33             	mov    (%rbx),%rsi
  1d:	48 c7 c7 d0 cd 32 aa 	mov    $0xffffffffaa32cdd0,%rdi
  24:	e8 ac 67 c5 ff       	call   0xffffffffffc567d5
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	5b                   	pop    %rbx
  2f:	5d                   	pop    %rbp
  30:	41 5c                	pop    %r12
  32:	c3                   	ret
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	66                   	data16
  38:	66                   	data16
  39:	2e                   	cs
  3a:	0f                   	.byte 0xf
  3b:	1f                   	(bad)
  3c:	84 00                	test   %al,(%rax)
	...

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	5b                   	pop    %rbx
   5:	5d                   	pop    %rbp
   6:	41 5c                	pop    %r12
   8:	c3                   	ret
   9:	cc                   	int3
   a:	cc                   	int3
   b:	cc                   	int3
   c:	cc                   	int3
   d:	66                   	data16
   e:	66                   	data16
   f:	2e                   	cs
  10:	0f                   	.byte 0xf
  11:	1f                   	(bad)
  12:	84 00                	test   %al,(%rax)
	...
[   38.514939] RSP: 0018:ffffb33c80263d70 EFLAGS: 00010286
xx__-> [   38.515231] RAX: 0000000000000000 RBX: ffffffffa9f472c0 RCX: 00000000ffffdfff
[   38.515668] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[   38.516048] RBP: 0000000000000000 R08: ffffffffaa778508 R09: 00000000ffffdfff
[   38.516452] R10: ffffffffaa698520 R11: ffffffffaa748520 R12: ffff9dfb43b2c610

[   38.516842] R13: ffffb33c80263e08 R14: ffff9dfb43b2cb80 R15: ffff9dfb439b4550
[   38.517284] FS:  0000000000000000(0000) GS:ffff9dfb7ed80000(0000) knlGS:0000000000000000
[   38.517716] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   38.518030] CR2: 00007fd87631e0e0 CR3: 000000001be60004 CR4: 0000000000770ef0
[   38.518411] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   38.518784] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
xx__-> [   38.519202] PKRU: 55555554
[   38.519397] Call Trace:
[   38.519530]  <TASK>
[   38.519657] ? __warn (kernel/panic.c:677) 
[   38.519836] ? sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[   38.520089] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[   38.520286] ? handle_bug (arch/x86/kernel/traps.c:238) 
[   38.520484] ? exc_invalid_op (arch/x86/kernel/traps.c:259 (discriminator 1)) 
[   38.520705] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[   38.520942] ? sysfs_remove_group (fs/sysfs/group.c:282 (discriminator 1)) 
[   38.521169] br_dev_delete (net/bridge/br_if.c:396) 
[   38.521367] br_net_exit_batch_rtnl (net/bridge/br.c:369) 
[   38.521621] cleanup_net (net/core/net_namespace.c:630) 
[   38.521822] ? process_one_work (kernel/workqueue.c:2606) 
[   38.522042] process_one_work (kernel/workqueue.c:2633) 
[   38.522266] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[   38.522466] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[   38.522714] kthread (kernel/kthread.c:388) 
[   38.522884] ? __pfx_kthread (kernel/kthread.c:341) 
[   38.523081] ret_from_fork (arch/x86/kernel/process.c:147) 
[   38.523271] ? __pfx_kthread (kernel/kthread.c:341) 


Finger prints:
refcount_warn_saturate:br_sysfs_delbr:br_dev_delete:br_net_exit_batch_rtnl
sysfs_remove_group:br_dev_delete:br_net_exit_batch_rtnl:cleanup_net