syzbot

     __do_sys_unshare kernel/fork.c:3380 [inline]
     __se_sys_unshare kernel/fork.c:3378 [inline]
     __arm64_sys_unshare+0x3c/0x50 kernel/fork.c:3378
     __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
     invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
     el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
     do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
------------[ cut here ]------------
WARNING: CPU: 0 PID: 294 at lib/ref_tracker.c:179 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
WARNING: CPU: 0 PID: 294 at lib/ref_tracker.c:179 ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
Modules linked in:
CPU: 0 UID: 0 PID: 294 Comm: kworker/u8:6 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: netns cleanup_net
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ref_tracker_dir_exit+0x390/0x4b4 include/linux/spinlock.h:406
lr : spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
lr : ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
sp : ffff80009bd77900
x29: ffff80009bd77980 x28: ffff0000c56381d8 x27: 1ffff000137aef24
x26: dfff800000000000 x25: ffff0000c5638228 x24: dead000000000100
x23: ffff0000c5638228 x22: ffff0000c56381d8 x21: ffff0000c5638228
x20: ffff0000c5638228 x19: 1fffe00018544d90 x18: 1fffe000366d31ee
x17: ffff80008f56d000 x16: ffff800080347214 x15: 0000000000000001
x14: 1fffe000366d5cd0 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000001
x8 : 0000000000000008 x7 : ffff8000802b7e24 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80008b4b2c40 x0 : ffff8001241e1000
Call trace:
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 ref_tracker_dir_exit+0x390/0x4b4 lib/ref_tracker.c:178
 net_free+0x80/0xf4 net/core/net_namespace.c:465
 cleanup_net+0x90c/0x9b4 net/core/net_namespace.c:661
 process_one_work+0x79c/0x15b8 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x978/0xec4 kernel/workqueue.c:3389
 kthread+0x288/0x310 kernel/kthread.c:389
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 1867812
hardirqs last  enabled at (1867811): [<ffff8000802b7ec4>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1427 [inline]
hardirqs last  enabled at (1867811): [<ffff8000802b7ec4>] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:4942
hardirqs last disabled at (1867812): [<ffff80008b3363f4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:470
softirqs last  enabled at (1867808): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last  enabled at (1867808): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582
softirqs last disabled at (1867795): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
---[ end trace 0000000000000000 ]---
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed