syzbot

------------[ cut here ]------------
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:177 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: __refcount_sub_and_test include/linux/refcount.h:272 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: __refcount_dec_and_test include/linux/refcount.h:315 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: refcount_dec_and_test include/linux/refcount.h:333 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: kref_put include/linux/kref.h:64 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: batadv_dat_entry_put net/batman-adv/distributed-arp-table.c:133 [inline]
ODEBUG: free active (active state 0) object: 0000000096a6ed66 object type: timer_list hint: batadv_dat_purge+0x0/0x154 net/batman-adv/distributed-arp-table.c:1829
WARNING: CPU: 0 PID: 5968 at lib/debugobjects.c:512 debug_print_object lib/debugobjects.c:509 [inline]
WARNING: CPU: 0 PID: 5968 at lib/debugobjects.c:512 __debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
WARNING: CPU: 0 PID: 5968 at lib/debugobjects.c:512 debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027
Modules linked in:
CPU: 0 PID: 5968 Comm: kworker/u4:1 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: netns cleanup_net
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:509 [inline]
pc : __debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
pc : debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027
lr : debug_print_object lib/debugobjects.c:509 [inline]
lr : __debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
lr : debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027
sp : ffff80001ea075d0
x29: ffff80001ea07620 x28: ffff8000124e9860 x27: dfff800000000000
x26: ffff0000e71614f8 x25: 0000000000000000 x24: ffff80001a2da088
x23: ffff8000124e9860 x22: ffff0000e71614f8 x21: ffff80001a2da080
x20: ffff80001299ccb8 x19: ffff0000e7160000 x18: ffff80001ea06ae0
x17: 626f203636646536 x16: ffff80001236e294 x15: 0000000000000002
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 999515d0e3b3cd00
x8 : 999515d0e3b3cd00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001ea06eb8 x4 : ffff800015e4ccc0 x3 : ffff800008584230
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
 debug_print_object lib/debugobjects.c:509 [inline]
 __debug_check_no_obj_freed lib/debugobjects.c:996 [inline]
 debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027
 slab_free_hook mm/slub.c:1756 [inline]
 slab_free_freelist_hook mm/slub.c:1807 [inline]
 slab_free mm/slub.c:3787 [inline]
 __kmem_cache_free+0x24c/0x49c mm/slub.c:3800
 kfree+0xb8/0x19c mm/slab_common.c:1019
 kvfree+0x40/0x50 mm/util.c:649
 netdev_freemem+0x4c/0x64 net/core/dev.c:10542
 netdev_release+0x88/0xb0 net/core/net-sysfs.c:1938
 device_release+0x8c/0x1ac
 kobject_cleanup lib/kobject.c:681 [inline]
 kobject_release lib/kobject.c:712 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2a8/0x41c lib/kobject.c:729
 netdev_run_todo+0xcf0/0xe08 net/core/dev.c:10362
 rtnl_unlock+0x14/0x20 net/core/rtnetlink.c:148
 default_device_exit_batch+0x6cc/0x744 net/core/dev.c:11354
 ops_exit_list net/core/net_namespace.c:174 [inline]
 cleanup_net+0x5dc/0x8d0 net/core/net_namespace.c:613
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2390
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2537
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 3732576
hardirqs last  enabled at (3732575): [<ffff8000083416f0>] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345
hardirqs last disabled at (3732576): [<ffff800012369e90>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3732504): [<ffff8000121183bc>] spin_unlock_bh include/linux/spinlock.h:395 [inline]
softirqs last  enabled at (3732504): [<ffff8000121183bc>] batadv_tvlv_handler_unregister+0x158/0x254 net/batman-adv/tvlv.c:602
softirqs last disabled at (3732502): [<ffff800012118328>] spin_lock_bh include/linux/spinlock.h:355 [inline]
softirqs last disabled at (3732502): [<ffff800012118328>] batadv_tvlv_handler_unregister+0xc4/0x254 net/batman-adv/tvlv.c:600
---[ end trace 0000000000000000 ]---
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): Released all slaves