======================================
| [ 2536.583047] ------------[ cut here ]------------
| [ 2536.583324] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
| [ 2536.583348] WARNING: CPU: 3 PID: 11 at kernel/locking/mutex.c:587 __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
| [ 2536.584102] Modules linked in: sctp_diag xt_length act_ct nf_flow_table sctp geneve ip_gre sch_fq cls_bpf nft_chain_nat xt_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_HL amt act_tunnel_key bareudp drop_monitor act_gact cls_flower netdevsim psample xfrm_interface cls_u32 ifb act_mirred cls_matchall ip6_gre gre sch_ingress vxlan mpls_iptunnel mpls_router l2tp_ip6 l2tp_eth l2tp_ip l2tp_netlink l2tp_core sha1_generic xfrm_user xt_policy nft_compat nf_tables libcrc32c [last unloaded: test_bpf]
[ 2536.586764] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 2536.587377] Workqueue: netns cleanup_net
[ 2536.587588] RIP: 0010:__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 2536.587825] Code: ff 90 e8 a2 e7 70 ff 85 c0 74 23 8b 35 9c 8e db 00 85 f6 75 19 90 48 c7 c6 97 37 8a 88 48 c7 c7 3a ac 89 88 e8 00 04 26 ff 90 <0f> 0b 90 90 90 e9 03 fd ff ff 4c 8d 6d a0 4c 89 e7 4c 89 ee e8 d6
All code
========
   0:	ff 90 e8 a2 e7 70    	call   *0x70e7a2e8(%rax)
   6:	ff 85 c0 74 23 8b    	incl   -0x74dc8b40(%rbp)
   c:	35 9c 8e db 00       	xor    $0xdb8e9c,%eax
  11:	85 f6                	test   %esi,%esi
  13:	75 19                	jne    0x2e
  15:	90                   	nop
  16:	48 c7 c6 97 37 8a 88 	mov    $0xffffffff888a3797,%rsi
  1d:	48 c7 c7 3a ac 89 88 	mov    $0xffffffff8889ac3a,%rdi
  24:	e8 00 04 26 ff       	call   0xffffffffff260429
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	90                   	nop
  2f:	e9 03 fd ff ff       	jmp    0xfffffffffffffd37
  34:	4c 8d 6d a0          	lea    -0x60(%rbp),%r13
  38:	4c 89 e7             	mov    %r12,%rdi
  3b:	4c 89 ee             	mov    %r13,%rsi
  3e:	e8                   	.byte 0xe8
  3f:	d6                   	(bad)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	e9 03 fd ff ff       	jmp    0xfffffffffffffd0d
   a:	4c 8d 6d a0          	lea    -0x60(%rbp),%r13
   e:	4c 89 e7             	mov    %r12,%rdi
  11:	4c 89 ee             	mov    %r13,%rsi
  14:	e8                   	.byte 0xe8
  15:	d6                   	(bad)
[ 2536.588774] RSP: 0018:ffffa37bc0063ab0 EFLAGS: 00010286
[ 2536.589059] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffdfff
[ 2536.589431] RDX: 0000000000000000 RSI: 00000000ffffffea RDI: 0000000000000001
[ 2536.589799] RBP: ffffa37bc0063b30 R08: ffffffff88d78508 R09: 00000000ffffdfff
[ 2536.590180] R10: ffffffff88c98520 R11: ffffffff88d5bc60 R12: ffff8bd503879800
[ 2536.590551] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8bd5069ba800
[ 2536.590934] FS:  0000000000000000(0000) GS:ffff8bd53ed80000(0000) knlGS:0000000000000000
[ 2536.591352] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2536.591659] CR2: 00007f2d68f86000 CR3: 000000001f060006 CR4: 0000000000770ef0
[ 2536.592033] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2536.592404] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2536.592777] PKRU: 55555554
[ 2536.592929] Call Trace:
[ 2536.593067]  <TASK>
[ 2536.593187] ? __warn (kernel/panic.c:677) 
[ 2536.593368] ? __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 2536.593573] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[ 2536.593772] ? handle_bug (arch/x86/kernel/traps.c:238) 
[ 2536.593975] ? exc_invalid_op (arch/x86/kernel/traps.c:259 (discriminator 1)) 
[ 2536.594180] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:568) 
[ 2536.594409] ? __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 2536.594614] ? refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.594900] ? up_read (kernel/locking/rwsem.c:1622) 
[ 2536.595079] ? tc_setup_cb_destroy (net/sched/cls_api.c:3715) 
[ 2536.595318] ? refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.595580] refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.595835] __tcf_action_put (net/sched/act_api.c:377) 
[ 2536.596055] tcf_action_destroy (net/sched/act_api.c:413 net/sched/act_api.c:393 net/sched/act_api.c:1175) 
[ 2536.596269] tcf_exts_destroy (net/sched/cls_api.c:3312) 
[ 2536.596483] __fl_destroy_filter (./include/net/pkt_cls.h:261 net/sched/cls_flower.c:425) cls_flower
[ 2536.596769] __fl_delete (net/sched/cls_flower.c:574) cls_flower
[ 2536.597035] fl_destroy (net/sched/cls_flower.c:599) cls_flower
[ 2536.597280] tcf_proto_destroy (net/sched/cls_api.c:418) 
[ 2536.597490] tcf_chain_flush (net/sched/cls_api.c:737) 
[ 2536.597695] __tcf_block_put (net/sched/cls_api.c:1070 net/sched/cls_api.c:1141 net/sched/cls_api.c:1305) 
[ 2536.597905] clsact_destroy (net/sched/sch_ingress.c:302) sch_ingress
[ 2536.598175] __qdisc_destroy (net/sched/sch_generic.c:1067) 
[ 2536.598385] dev_shutdown (net/sched/sch_generic.c:1482) 
[ 2536.598579] unregister_netdevice_many_notify (./include/net/tcx.h:168 net/core/dev.c:11084) 
[ 2536.598867] cleanup_net (net/core/net_namespace.c:633) 
[ 2536.599061] ? process_one_work (kernel/workqueue.c:2606) 
[ 2536.599293] process_one_work (kernel/workqueue.c:2633) 
[ 2536.599512] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 2536.599718] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 2536.599952] kthread (kernel/kthread.c:388) 
[ 2536.600125] ? __pfx_kthread (kernel/kthread.c:341) 
[ 2536.600326] ret_from_fork (arch/x86/kernel/process.c:147) 
[ 2536.600520] ? __pfx_kthread (kernel/kthread.c:341) 
[ 2536.600729] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) 
| [ 2536.603840] #PF: supervisor read access in kernel mode
| [ 2536.604113] #PF: error_code(0x0000) - not-present page
| [ 2536.604383] PGD 0 P4D 0
| [ 2536.604524] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 2536.605211] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 2536.605799] Workqueue: netns cleanup_net
[ 2536.606017] RIP: 0010:__mutex_lock (./include/linux/sched.h:2165 kernel/locking/mutex.c:409 kernel/locking/mutex.c:452 kernel/locking/mutex.c:612 kernel/locking/mutex.c:752) 
[ 2536.606253] Code: 0f 65 8b 05 76 b6 f3 77 85 c0 0f 84 32 01 00 00 65 48 8b 04 25 00 f1 02 00 48 8b 00 a8 08 75 11 49 8b 04 24 48 83 e0 f8 74 7e <8b> 50 34 85 d2 75 74 65 48 8b 04 25 00 f1 02 00 48 8b 10 83 e2 08
All code
========
   0:	0f 65 8b 05 76 b6 f3 	pcmpgtw -0xc4989fb(%rbx),%mm1
   7:	77 85                	ja     0xffffffffffffff8e
   9:	c0 0f 84             	rorb   $0x84,(%rdi)
   c:	32 01                	xor    (%rcx),%al
   e:	00 00                	add    %al,(%rax)
  10:	65 48 8b 04 25 00 f1 	mov    %gs:0x2f100,%rax
  17:	02 00 
  19:	48 8b 00             	mov    (%rax),%rax
  1c:	a8 08                	test   $0x8,%al
  1e:	75 11                	jne    0x31
  20:	49 8b 04 24          	mov    (%r12),%rax
  24:	48 83 e0 f8          	and    $0xfffffffffffffff8,%rax
  28:	74 7e                	je     0xa8
  2a:*	8b 50 34             	mov    0x34(%rax),%edx		<-- trapping instruction
  2d:	85 d2                	test   %edx,%edx
  2f:	75 74                	jne    0xa5
  31:	65 48 8b 04 25 00 f1 	mov    %gs:0x2f100,%rax
  38:	02 00 
  3a:	48 8b 10             	mov    (%rax),%rdx
  3d:	83 e2 08             	and    $0x8,%edx

Code starting with the faulting instruction
===========================================
   0:	8b 50 34             	mov    0x34(%rax),%edx
   3:	85 d2                	test   %edx,%edx
   5:	75 74                	jne    0x7b
   7:	65 48 8b 04 25 00 f1 	mov    %gs:0x2f100,%rax
   e:	02 00 
  10:	48 8b 10             	mov    (%rax),%rdx
  13:	83 e2 08             	and    $0x8,%edx
[ 2536.607212] RSP: 0018:ffffa37bc0063ab0 EFLAGS: 00010206
[ 2536.607487] RAX: 0000000100000000 RBX: 0000000000000000 RCX: ffffffff877ff465
[ 2536.607859] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8bd503879800
[ 2536.608226] RBP: ffffa37bc0063b30 R08: 0000000000000001 R09: 0000000000000000
[ 2536.608595] R10: 0000000000000000 R11: ffffffff88d5bc60 R12: ffff8bd503879800
[ 2536.608970] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8bd503879868
[ 2536.609337] FS:  0000000000000000(0000) GS:ffff8bd53ed80000(0000) knlGS:0000000000000000
[ 2536.609760] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2536.610058] CR2: 0000000100000034 CR3: 000000001f060006 CR4: 0000000000770ef0
[ 2536.610423] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2536.610789] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2536.611156] PKRU: 55555554
[ 2536.611299] Call Trace:
[ 2536.611432]  <TASK>
[ 2536.611549] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) 
[ 2536.611719] ? page_fault_oops (arch/x86/mm/fault.c:707) 
[ 2536.611936] ? __warn (./include/trace/events/error_report.h:69 kernel/panic.c:685) 
[ 2536.612115] ? __mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:752) 
[ 2536.612320] ? report_bug (lib/bug.c:201 lib/bug.c:219) 
[ 2536.612516] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:67 ./arch/x86/include/asm/irqflags.h:127 arch/x86/mm/fault.c:1515 arch/x86/mm/fault.c:1563) 
[ 2536.612726] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:570) 
[ 2536.612947] ? refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.613207] ? __mutex_lock (./include/linux/sched.h:2165 kernel/locking/mutex.c:409 kernel/locking/mutex.c:452 kernel/locking/mutex.c:612 kernel/locking/mutex.c:752) 
[ 2536.613410] ? refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.613668] ? up_read (kernel/locking/rwsem.c:1622) 
[ 2536.613843] ? tc_setup_cb_destroy (net/sched/cls_api.c:3715) 
[ 2536.614079] ? refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.614340] refcount_dec_and_mutex_lock (./arch/x86/include/asm/atomic.h:103 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:261 ./include/linux/refcount.h:304 ./include/linux/refcount.h:322 lib/refcount.c:119 lib/refcount.c:113) 
[ 2536.614591] __tcf_action_put (net/sched/act_api.c:377) 
[ 2536.614794] tcf_action_destroy (net/sched/act_api.c:413 net/sched/act_api.c:393 net/sched/act_api.c:1175) 
[ 2536.615004] tcf_exts_destroy (net/sched/cls_api.c:3312) 
[ 2536.615207] __fl_destroy_filter (./include/net/pkt_cls.h:261 net/sched/cls_flower.c:425) cls_flower
[ 2536.615483] __fl_delete (net/sched/cls_flower.c:574) cls_flower
[ 2536.615732] fl_destroy (net/sched/cls_flower.c:599) cls_flower
[ 2536.615973] tcf_proto_destroy (net/sched/cls_api.c:418) 
[ 2536.616182] tcf_chain_flush (net/sched/cls_api.c:737) 
[ 2536.616385] __tcf_block_put (net/sched/cls_api.c:1070 net/sched/cls_api.c:1141 net/sched/cls_api.c:1305) 
[ 2536.616589] clsact_destroy (net/sched/sch_ingress.c:302) sch_ingress
[ 2536.616850] __qdisc_destroy (net/sched/sch_generic.c:1067) 
[ 2536.617075] dev_shutdown (net/sched/sch_generic.c:1482) 
[ 2536.617266] unregister_netdevice_many_notify (./include/net/tcx.h:168 net/core/dev.c:11084) 
[ 2536.617549] cleanup_net (net/core/net_namespace.c:633) 
[ 2536.617752] ? process_one_work (kernel/workqueue.c:2606) 
[ 2536.617982] process_one_work (kernel/workqueue.c:2633) 
[ 2536.618194] worker_thread (kernel/workqueue.c:2700 kernel/workqueue.c:2787) 
[ 2536.618400] ? __pfx_worker_thread (kernel/workqueue.c:2733) 
[ 2536.618632] kthread (kernel/kthread.c:388) 
[ 2536.618808] ? __pfx_kthread (kernel/kthread.c:341) 
[ 2536.619008] ret_from_fork (arch/x86/kernel/process.c:147) 
[ 2536.619208] ? __pfx_kthread (kernel/kthread.c:341) 


Finger prints:
__mutex_lock:refcount_dec_and_mutex_lock:__tcf_action_put:tcf_action_destroy
__mutex_lock:refcount_dec_and_mutex_lock:__tcf_action_put:tcf_action_destroy