KASAN: null-ptr-deref Write in rcuref

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: null-ptr-deref Write in rcuref_put (2) net				1	108d	108d	0/28	closed as invalid on 2024/11/27 19:42
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:87 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put+0x190/0x240 include/linux/rcuref.h:150
Write of size 4 at addr 0000000000000041 by task kworker/u8:9/2835

CPU: 0 PID: 2835 Comm: kworker/u8:9 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_add_negative_release include/linux/atomic/atomic-instrumented.h:1457 [inline]
 __rcuref_put include/linux/rcuref.h:87 [inline]
 rcuref_put+0x190/0x240 include/linux/rcuref.h:150
 dst_release+0x1b/0x50 net/core/dst.c:164
 dst_cache_destroy+0x115/0x190 net/core/dst_cache.c:161
 netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10692
 cleanup_net+0x762/0xcc0 net/core/net_namespace.c:636
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
==================================================================