device veth0_vlan left promiscuous mode
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: null-ptr-deref in atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline]
BUG: KASAN: null-ptr-deref in atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
BUG: KASAN: null-ptr-deref in rwsem_clear_owner kernel/locking/rwsem.c:183 [inline]
BUG: KASAN: null-ptr-deref in __up_write kernel/locking/rwsem.c:1480 [inline]
BUG: KASAN: null-ptr-deref in up_write+0x2e/0x120 kernel/locking/rwsem.c:1621
Write of size 8 at addr 0000000000000070 by task kworker/u4:2/110
CPU: 0 PID: 110 Comm: kworker/u4:2 Tainted: G W 5.10.222-syzkaller-01494-gfd58936f3c1f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
__kasan_report mm/kasan/report.c:439 [inline]
kasan_report+0x167/0x1c0 mm/kasan/report.c:452
kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_write include/linux/instrumented.h:86 [inline]
atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline]
atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
rwsem_clear_owner kernel/locking/rwsem.c:183 [inline]
__up_write kernel/locking/rwsem.c:1480 [inline]
up_write+0x2e/0x120 kernel/locking/rwsem.c:1621
kernfs_drain fs/kernfs/dir.c:475 [inline]
__kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1394
kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1598
kernfs_remove_by_name include/linux/kernfs.h:623 [inline]
remove_files fs/sysfs/group.c:28 [inline]
sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289
sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313
device_remove_groups drivers/base/core.c:2371 [inline]
device_remove_attrs+0x113/0x130 drivers/base/core.c:2568
device_del+0x683/0xf00 drivers/base/core.c:3451
netdev_unregister_kobject+0x18a/0x250 net/core/net-sysfs.c:1963
unregister_netdevice_many+0x1276/0x17d0 net/core/dev.c:10774
default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11267
ops_exit_list net/core/net_namespace.c:190 [inline]
cleanup_net+0x6e9/0xcb0 net/core/net_namespace.c:609
process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301
worker_thread+0xaea/0x1510 kernel/workqueue.c:2447
kthread+0x34b/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
==================================================================
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 1 PID: 110 Comm: kworker/u4:2 Tainted: G B W 5.10.222-syzkaller-01494-gfd58936f3c1f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: netns cleanup_net
RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
RIP: 0010:atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
RIP: 0010:atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:183 [inline]
RIP: 0010:__up_write kernel/locking/rwsem.c:1480 [inline]
RIP: 0010:up_write+0x35/0x120 kernel/locking/rwsem.c:1621
Code: 49 89 ff 49 bc 00 00 00 00 00 fc ff df 0f 1f 44 00 00 49 8d 5f 08 48 89 df be 08 00 00 00 e8 72 d1 57 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 fc cf 57 00 49 c7 47 08 00 00 00
RSP: 0018:ffffc90000ba7610 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810d5013c0
RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff
RBP: ffffc90000ba7630 R08: ffffffff813e275b R09: 0000000000000003
R10: fffffbfff0e10c48 R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888107fed004 R15: 0000000000000068
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd4c9806ab8 CR3: 000000010c879000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kernfs_drain fs/kernfs/dir.c:475 [inline]
__kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1394
kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1598
kernfs_remove_by_name include/linux/kernfs.h:623 [inline]
remove_files fs/sysfs/group.c:28 [inline]
sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289
sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313
device_remove_groups drivers/base/core.c:2371 [inline]
device_remove_attrs+0x113/0x130 drivers/base/core.c:2568
device_del+0x683/0xf00 drivers/base/core.c:3451
netdev_unregister_kobject+0x18a/0x250 net/core/net-sysfs.c:1963
unregister_netdevice_many+0x1276/0x17d0 net/core/dev.c:10774
default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11267
ops_exit_list net/core/net_namespace.c:190 [inline]
cleanup_net+0x6e9/0xcb0 net/core/net_namespace.c:609
process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301
worker_thread+0xaea/0x1510 kernel/workqueue.c:2447
kthread+0x34b/0x3d0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 886394d48d77c520 ]---
RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
RIP: 0010:atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
RIP: 0010:atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:183 [inline]
RIP: 0010:__up_write kernel/locking/rwsem.c:1480 [inline]
RIP: 0010:up_write+0x35/0x120 kernel/locking/rwsem.c:1621
Code: 49 89 ff 49 bc 00 00 00 00 00 fc ff df 0f 1f 44 00 00 49 8d 5f 08 48 89 df be 08 00 00 00 e8 72 d1 57 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 fc cf 57 00 49 c7 47 08 00 00 00
RSP: 0018:ffffc90000ba7610 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810d5013c0
RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff
RBP: ffffc90000ba7630 R08: ffffffff813e275b R09: 0000000000000003
R10: fffffbfff0e10c48 R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888107fed004 R15: 0000000000000068
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efe1a0e9000 CR3: 000000011d3c1000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 49 89 ff mov %rdi,%r15
3: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
a: fc ff df
d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
12: 49 8d 5f 08 lea 0x8(%r15),%rbx
16: 48 89 df mov %rbx,%rdi
19: be 08 00 00 00 mov $0x8,%esi
1e: e8 72 d1 57 00 call 0x57d195
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 fc cf 57 00 call 0x57d035
39: 49 rex.WB
3a: c7 .byte 0xc7
3b: 47 08 00 rex.RXB or %r8b,(%r8)