======================================
| xx__-> [   18.967356][  T239] ==================================================================
| [   18.967920][  T239] BUG: KASAN: use-after-free in kobject_put (lib/kobject.c:733)
| [   18.968322][  T239] Read of size 1 at addr ffff88800c40068c by task packetdrill/239
| [   18.968761][  T239]
[   18.968933][  T239] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   18.968937][  T239] Call Trace:
[   18.968941][  T239]  <TASK>
[   18.968944][  T239]  dump_stack_lvl (lib/dump_stack.c:123)
[   18.968954][  T239]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[   18.968974][  T239]  ? kobject_put (lib/kobject.c:733)
[   18.968981][  T239]  print_report (mm/kasan/report.c:483)
[   18.968986][  T239]  ? kobject_put (lib/kobject.c:733)
[   18.968990][  T239]  ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47)
[   18.968995][  T239]  ? kobject_put (lib/kobject.c:733)
[   18.968999][  T239]  kasan_report (mm/kasan/report.c:597)
[   18.969005][  T239]  ? kobject_put (lib/kobject.c:733)
[   18.969013][  T239]  kobject_put (lib/kobject.c:733)
[   18.969018][  T239]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[   18.969030][  T239]  ? rtnl_is_locked (net/core/rtnetlink.c:169)
[   18.969039][  T239]  ? generic_xdp_install (net/core/dev.c:11630)
[   18.969046][  T239]  ? kfree (mm/slub.c:6630 mm/slub.c:6837)
[   18.969057][  T239]  tun_chr_close (./include/net/sock.h:1990 drivers/net/tun.c:643 drivers/net/tun.c:3436)
[   18.969067][  T239]  __fput (fs/file_table.c:468)
[   18.969082][  T239]  task_work_run (kernel/task_work.c:229 (discriminator 1))
[   18.969097][  T239]  ? task_work_cancel (kernel/task_work.c:195)
[   18.969103][  T239]  ? kmem_cache_free (mm/slub.c:6630 mm/slub.c:6740)
[   18.969108][  T239]  ? refcount_dec_and_lock (lib/refcount.c:146)
[   18.969116][  T239]  ? do_exit (./include/linux/task_work.h:40 kernel/exit.c:966)
[   18.969126][  T239]  do_exit (kernel/exit.c:967)
[   18.969130][  T239]  ? stack_not_used (kernel/exit.c:898)
[   18.969134][  T239]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   18.969141][  T239]  ? get_signal (./include/linux/cgroup.h:804 kernel/signal.c:2999)
[   18.969148][  T239]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   18.969154][  T239]  do_group_exit (kernel/exit.c:1088)
[   18.969159][  T239]  get_signal (kernel/signal.c:701 kernel/signal.c:2912)
[   18.969169][  T239]  ? ptrace_signal (kernel/signal.c:2800)
[   18.969175][  T239]  ? do_futex (kernel/futex/syscalls.c:130)
[   18.969188][  T239]  arch_do_signal_or_restart (arch/x86/kernel/signal.c:337)
[   18.969199][  T239]  ? get_sigframe_size (arch/x86/kernel/signal.c:334)
[   18.969205][  T239]  ? __x64_sys_futex (kernel/futex/syscalls.c:207 kernel/futex/syscalls.c:188 kernel/futex/syscalls.c:188)
[   18.969212][  T239]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   18.969217][  T239]  ? do_futex (kernel/futex/syscalls.c:188)
[   18.969222][  T239]  ? __task_pid_nr_ns (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/pid.c:520)
[   18.969226][  T239]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   18.969232][  T239]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[   18.969241][  T239]  exit_to_user_mode_loop (kernel/entry/common.c:42)
[   18.969250][  T239]  do_syscall_64 (./include/linux/irq-entry-common.h:225 ./include/linux/entry-common.h:175 ./include/linux/entry-common.h:210 arch/x86/entry/syscall_64.c:100)
[   18.969259][  T239]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   18.969265][  T239] RIP: 0033:0x4d7f9a
[   18.969271][  T239] Code: Unable to access opcode bytes at 0x4d7f70.

Code starting with the faulting instruction
===========================================
[   18.969274][  T239] RSP: 002b:00007fa79235a090 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   18.969281][  T239] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00000000004d7f9a
[   18.969285][  T239] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 0000000026e3b690
[   18.969288][  T239] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
[   18.969290][  T239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   18.969293][  T239] R13: 0000000026e3b690 R14: 00007fa79235a0f0 R15: 0000000000000000
| [   18.992505][  T239] refcount_t: underflow; use-after-free.
| [   18.992829][  T239] WARNING: CPU: 2 PID: 239 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
| [   18.993401][  T239] Modules linked in:
| [   18.994335][  T239] Tainted: [B]=BAD_PAGE
[   18.994591][  T239] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   18.994991][  T239] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
[   18.995408][  T239] Code: 3f 92 02 80 fb 01 0f 87 bb b9 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 5e 3f 92 02 01 90 48 c7 c7 20 8d a5 9f e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
All code
========
   0:	3f                   	(bad)
   1:	92                   	xchg   %eax,%edx
   2:	02 80 fb 01 0f 87    	add    -0x78f0fe05(%rax),%al
   8:	bb b9 d9 fe 83       	mov    $0x83fed9b9,%ebx
   d:	e3 01                	jrcxz  0x10
   f:	0f 85 51 ff ff ff    	jne    0xffffffffffffff66
  15:	c6 05 5e 3f 92 02 01 	movb   $0x1,0x2923f5e(%rip)        # 0x2923f7a
  1c:	90                   	nop
  1d:	48 c7 c7 20 8d a5 9f 	mov    $0xffffffff9fa58d20,%rdi
  24:	e8 32 bf 18 ff       	call   0xffffffffff18bf5b
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	e9 33 ff ff ff       	jmp    0xffffffffffffff66
  33:	48 89 df             	mov    %rbx,%rdi
  36:	e8 b0 63 a1 ff       	call   0xffffffffffa163eb
  3b:	e9 ba fe ff ff       	jmp    0xfffffffffffffefa

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	e9 33 ff ff ff       	jmp    0xffffffffffffff3c
   9:	48 89 df             	mov    %rbx,%rdi
   c:	e8 b0 63 a1 ff       	call   0xffffffffffa163c1
  11:	e9 ba fe ff ff       	jmp    0xfffffffffffffed0
[   18.996473][  T239] RSP: 0018:ffffc90000ac79f0 EFLAGS: 00010286
[   18.996870][  T239] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   18.997317][  T239] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[   18.997764][  T239] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff407e134
[   18.998235][  T239] R10: 0000000000000003 R11: ffffc90000ac7580 R12: 0000000000000001
[   18.998707][  T239] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[   18.999193][  T239] FS:  0000000000000000(0000) GS:ffff888094b1a000(0000) knlGS:0000000000000000
[   18.999724][  T239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.000111][  T239] CR2: 00007f09f5cfd000 CR3: 0000000030b35002 CR4: 0000000000772ef0
[   19.000562][  T239] PKRU: 55555554
[   19.000808][  T239] Call Trace:
[   19.001064][  T239]  <TASK>
[   19.001244][  T239]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[   19.001575][  T239]  ? rtnl_is_locked (net/core/rtnetlink.c:169)
[   19.001883][  T239]  ? generic_xdp_install (net/core/dev.c:11630)
[   19.002197][  T239]  ? kfree (mm/slub.c:6630 mm/slub.c:6837)
[   19.002446][  T239]  tun_chr_close (./include/net/sock.h:1990 drivers/net/tun.c:643 drivers/net/tun.c:3436)
[   19.002758][  T239]  __fput (fs/file_table.c:468)
[   19.003012][  T239]  task_work_run (kernel/task_work.c:229 (discriminator 1))
[   19.003349][  T239]  ? task_work_cancel (kernel/task_work.c:195)
[   19.003667][  T239]  ? kmem_cache_free (mm/slub.c:6630 mm/slub.c:6740)
[   19.003988][  T239]  ? refcount_dec_and_lock (lib/refcount.c:146)
[   19.004317][  T239]  ? do_exit (./include/linux/task_work.h:40 kernel/exit.c:966)
[   19.004564][  T239]  do_exit (kernel/exit.c:967)
[   19.004793][  T239]  ? stack_not_used (kernel/exit.c:898)
[   19.005110][  T239]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   19.005423][  T239]  ? get_signal (./include/linux/cgroup.h:804 kernel/signal.c:2999)
[   19.005742][  T239]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   19.006068][  T239]  do_group_exit (kernel/exit.c:1088)
[   19.006400][  T239]  get_signal (kernel/signal.c:701 kernel/signal.c:2912)
[   19.006711][  T239]  ? ptrace_signal (kernel/signal.c:2800)
[   19.007031][  T239]  ? do_futex (kernel/futex/syscalls.c:130)
[   19.007286][  T239]  arch_do_signal_or_restart (arch/x86/kernel/signal.c:337)
[   19.007606][  T239]  ? get_sigframe_size (arch/x86/kernel/signal.c:334)
[   19.007917][  T239]  ? __x64_sys_futex (kernel/futex/syscalls.c:207 kernel/futex/syscalls.c:188 kernel/futex/syscalls.c:188)
[   19.008242][  T239]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   19.008545][  T239]  ? do_futex (kernel/futex/syscalls.c:188)
[   19.008802][  T239]  ? __task_pid_nr_ns (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/pid.c:520)
[   19.009119][  T239]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   19.009411][  T239]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[   19.009734][  T239]  exit_to_user_mode_loop (kernel/entry/common.c:42)
[   19.010045][  T239]  do_syscall_64 (./include/linux/irq-entry-common.h:225 ./include/linux/entry-common.h:175 ./include/linux/entry-common.h:210 arch/x86/entry/syscall_64.c:100)
[   19.010378][  T239]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   19.010746][  T239] RIP: 0033:0x4d7f9a
[   19.010925][  T239] Code: Unable to access opcode bytes at 0x4d7f70.

Code starting with the faulting instruction
===========================================
[   19.011340][  T239] RSP: 002b:00007fa79235a090 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   19.011807][  T239] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00000000004d7f9a
[   19.012240][  T239] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 0000000026e3b690
[   19.012709][  T239] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
[   19.013163][  T239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000


Finger prints:
print_report:kasan_report:kobject_put:netdev_run_todo:tun_chr_close
refcount_warn_saturate:netdev_run_todo:tun_chr_close:__fput:task_work_run