======================================
| xx__-> [   15.698091][  T238] ==================================================================
| [   15.698407][  T238] BUG: KASAN: use-after-free in kobject_put (lib/kobject.c:733)
| [   15.698630][  T238] Read of size 1 at addr ffff88800be1068c by task packetdrill/238
| [   15.698880][  T238]
[   15.698969][  T238] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   15.698971][  T238] Call Trace:
[   15.698973][  T238]  <TASK>
[   15.698975][  T238]  dump_stack_lvl (lib/dump_stack.c:123)
[   15.698980][  T238]  print_address_description.constprop.0 (mm/kasan/report.c:379)
[   15.698987][  T238]  ? kobject_put (lib/kobject.c:733)
[   15.698991][  T238]  print_report (mm/kasan/report.c:483)
[   15.698994][  T238]  ? kobject_put (lib/kobject.c:733)
[   15.698997][  T238]  ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47)
[   15.699001][  T238]  ? kobject_put (lib/kobject.c:733)
[   15.699004][  T238]  kasan_report (mm/kasan/report.c:597)
[   15.699008][  T238]  ? kobject_put (lib/kobject.c:733)
[   15.699013][  T238]  kobject_put (lib/kobject.c:733)
[   15.699016][  T238]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[   15.699021][  T238]  ? rtnl_is_locked (net/core/rtnetlink.c:169)
[   15.699025][  T238]  ? generic_xdp_install (net/core/dev.c:11630)
[   15.699029][  T238]  ? kfree (mm/slub.c:6630 mm/slub.c:6837)
[   15.699036][  T238]  tun_chr_close (./include/net/sock.h:1990 drivers/net/tun.c:643 drivers/net/tun.c:3436)
[   15.699041][  T238]  __fput (fs/file_table.c:468)
[   15.699048][  T238]  task_work_run (kernel/task_work.c:229 (discriminator 1))
[   15.699054][  T238]  ? task_work_cancel (kernel/task_work.c:195)
[   15.699057][  T238]  ? kmem_cache_free (mm/slub.c:6630 mm/slub.c:6740)
[   15.699060][  T238]  ? refcount_dec_and_lock (lib/refcount.c:146)
[   15.699065][  T238]  ? do_exit (./include/linux/task_work.h:40 kernel/exit.c:966)
[   15.699070][  T238]  do_exit (kernel/exit.c:967)
[   15.699073][  T238]  ? stack_not_used (kernel/exit.c:898)
[   15.699075][  T238]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   15.699079][  T238]  ? get_signal (./include/linux/cgroup.h:804 kernel/signal.c:2999)
[   15.699083][  T238]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   15.699087][  T238]  do_group_exit (kernel/exit.c:1088)
[   15.699091][  T238]  get_signal (kernel/signal.c:701 kernel/signal.c:2912)
[   15.699096][  T238]  ? ptrace_signal (kernel/signal.c:2800)
[   15.699100][  T238]  ? do_futex (kernel/futex/syscalls.c:130)
[   15.699106][  T238]  arch_do_signal_or_restart (arch/x86/kernel/signal.c:337)
[   15.699113][  T238]  ? get_sigframe_size (arch/x86/kernel/signal.c:334)
[   15.699116][  T238]  ? __x64_sys_futex (kernel/futex/syscalls.c:207 kernel/futex/syscalls.c:188 kernel/futex/syscalls.c:188)
[   15.699120][  T238]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   15.699122][  T238]  ? do_futex (kernel/futex/syscalls.c:188)
[   15.699125][  T238]  ? __task_pid_nr_ns (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/pid.c:520)
[   15.699128][  T238]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   15.699132][  T238]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[   15.699138][  T238]  exit_to_user_mode_loop (kernel/entry/common.c:42)
[   15.699144][  T238]  do_syscall_64 (./include/linux/irq-entry-common.h:225 ./include/linux/entry-common.h:175 ./include/linux/entry-common.h:210 arch/x86/entry/syscall_64.c:100)
[   15.699148][  T238]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   15.699152][  T238] RIP: 0033:0x4d7f9a
[   15.699155][  T238] Code: Unable to access opcode bytes at 0x4d7f70.

Code starting with the faulting instruction
===========================================
[   15.699157][  T238] RSP: 002b:00007fc6beac6090 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   15.699160][  T238] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00000000004d7f9a
[   15.699162][  T238] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 000000000ce3dca0
[   15.699164][  T238] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
[   15.699166][  T238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   15.699167][  T238] R13: 000000000ce3dca0 R14: 00007fc6beac60f0 R15: 0000000000000000
| [   15.712116][  T238] refcount_t: underflow; use-after-free.
| [   15.712299][  T238] WARNING: CPU: 1 PID: 238 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
| [   15.712587][  T238] Modules linked in:
| [   15.713098][  T238] Tainted: [B]=BAD_PAGE
[   15.713234][  T238] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   15.713458][  T238] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3))
[   15.713670][  T238] Code: 3f 92 02 80 fb 01 0f 87 bb b9 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 5e 3f 92 02 01 90 48 c7 c7 20 8d 05 8e e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff
All code
========
   0:	3f                   	(bad)
   1:	92                   	xchg   %eax,%edx
   2:	02 80 fb 01 0f 87    	add    -0x78f0fe05(%rax),%al
   8:	bb b9 d9 fe 83       	mov    $0x83fed9b9,%ebx
   d:	e3 01                	jrcxz  0x10
   f:	0f 85 51 ff ff ff    	jne    0xffffffffffffff66
  15:	c6 05 5e 3f 92 02 01 	movb   $0x1,0x2923f5e(%rip)        # 0x2923f7a
  1c:	90                   	nop
  1d:	48 c7 c7 20 8d 05 8e 	mov    $0xffffffff8e058d20,%rdi
  24:	e8 32 bf 18 ff       	call   0xffffffffff18bf5b
  29:	90                   	nop
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	90                   	nop
  2d:	90                   	nop
  2e:	e9 33 ff ff ff       	jmp    0xffffffffffffff66
  33:	48 89 df             	mov    %rbx,%rdi
  36:	e8 b0 63 a1 ff       	call   0xffffffffffa163eb
  3b:	e9 ba fe ff ff       	jmp    0xfffffffffffffefa

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	90                   	nop
   3:	90                   	nop
   4:	e9 33 ff ff ff       	jmp    0xffffffffffffff3c
   9:	48 89 df             	mov    %rbx,%rdi
   c:	e8 b0 63 a1 ff       	call   0xffffffffffa163c1
  11:	e9 ba fe ff ff       	jmp    0xfffffffffffffed0
[   15.714273][  T238] RSP: 0018:ffffc90000b179f0 EFLAGS: 00010286
[   15.714490][  T238] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   15.714730][  T238] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001
[   15.714982][  T238] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff1d3e134
[   15.715238][  T238] R10: 0000000000000003 R11: ffffc90000b17580 R12: 0000000000000001
[   15.715496][  T238] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100
[   15.715747][  T238] FS:  0000000000000000(0000) GS:ffff8880a649a000(0000) knlGS:0000000000000000
[   15.716030][  T238] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   15.716232][  T238] CR2: 00007f8ac8552a20 CR3: 0000000025b35006 CR4: 0000000000772ef0
[   15.716470][  T238] PKRU: 55555554
[   15.716605][  T238] Call Trace:
[   15.716737][  T238]  <TASK>
[   15.716827][  T238]  netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670)
[   15.716996][  T238]  ? rtnl_is_locked (net/core/rtnetlink.c:169)
[   15.717172][  T238]  ? generic_xdp_install (net/core/dev.c:11630)
[   15.717331][  T238]  ? kfree (mm/slub.c:6630 mm/slub.c:6837)
[   15.717473][  T238]  tun_chr_close (./include/net/sock.h:1990 drivers/net/tun.c:643 drivers/net/tun.c:3436)
[   15.717639][  T238]  __fput (fs/file_table.c:468)
[   15.717772][  T238]  task_work_run (kernel/task_work.c:229 (discriminator 1))
[   15.717943][  T238]  ? task_work_cancel (kernel/task_work.c:195)
[   15.718199][  T238]  ? kmem_cache_free (mm/slub.c:6630 mm/slub.c:6740)
[   15.718370][  T238]  ? refcount_dec_and_lock (lib/refcount.c:146)
[   15.718536][  T238]  ? do_exit (./include/linux/task_work.h:40 kernel/exit.c:966)
[   15.718657][  T238]  do_exit (kernel/exit.c:967)
[   15.718789][  T238]  ? stack_not_used (kernel/exit.c:898)
[   15.718960][  T238]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   15.719122][  T238]  ? get_signal (./include/linux/cgroup.h:804 kernel/signal.c:2999)
[   15.719279][  T238]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   15.719439][  T238]  do_group_exit (kernel/exit.c:1088)
[   15.719706][  T238]  get_signal (kernel/signal.c:701 kernel/signal.c:2912)
[   15.719875][  T238]  ? ptrace_signal (kernel/signal.c:2800)
[   15.720031][  T238]  ? do_futex (kernel/futex/syscalls.c:130)
[   15.720154][  T238]  arch_do_signal_or_restart (arch/x86/kernel/signal.c:337)
[   15.720413][  T238]  ? get_sigframe_size (arch/x86/kernel/signal.c:334)
[   15.720574][  T238]  ? __x64_sys_futex (kernel/futex/syscalls.c:207 kernel/futex/syscalls.c:188 kernel/futex/syscalls.c:188)
[   15.720732][  T238]  ? find_held_lock (kernel/locking/lockdep.c:5350)
[   15.720896][  T238]  ? do_futex (kernel/futex/syscalls.c:188)
[   15.721114][  T238]  ? __task_pid_nr_ns (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 kernel/pid.c:520)
[   15.721271][  T238]  ? __lock_release (kernel/locking/lockdep.c:5536)
[   15.721427][  T238]  ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751)
[   15.721588][  T238]  exit_to_user_mode_loop (kernel/entry/common.c:42)
[   15.721853][  T238]  do_syscall_64 (./include/linux/irq-entry-common.h:225 ./include/linux/entry-common.h:175 ./include/linux/entry-common.h:210 arch/x86/entry/syscall_64.c:100)
[   15.722016][  T238]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[   15.722210][  T238] RIP: 0033:0x4d7f9a
[   15.722342][  T238] Code: Unable to access opcode bytes at 0x4d7f70.

Code starting with the faulting instruction
===========================================
[   15.722644][  T238] RSP: 002b:00007fc6beac6090 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   15.722913][  T238] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 00000000004d7f9a
[   15.723154][  T238] RDX: 0000000000000000 RSI: 0000000000000189 RDI: 000000000ce3dca0
[   15.723485][  T238] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff
[   15.723733][  T238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000


Finger prints:
print_report:kasan_report:kobject_put:netdev_run_todo:tun_chr_close
refcount_warn_saturate:netdev_run_todo:tun_chr_close:__fput:task_work_run