syzbot

reference already released.
allocated in:
------------[ cut here ]------------
slab index 30269 out of bounds (15) for stack id 3f12763d
WARNING: CPU: 1 PID: 3346 at lib/stackdepot.c:378 stack_depot_fetch lib/stackdepot.c:377 [inline]
WARNING: CPU: 1 PID: 3346 at lib/stackdepot.c:378 stack_depot_print+0x34/0x78 lib/stackdepot.c:349
Modules linked in:
CPU: 1 PID: 3346 Comm: syz-fuzzer Not tainted 6.1.0-rc7-syzkaller-33054-gcdb931b58ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : stack_depot_fetch lib/stackdepot.c:377 [inline]
pc : stack_depot_print+0x34/0x78 lib/stackdepot.c:349
lr : stack_depot_fetch lib/stackdepot.c:377 [inline]
lr : stack_depot_print+0x34/0x78 lib/stackdepot.c:349
sp : ffff80000800bcc0
x29: ffff80000800bcc0 x28: 0000000000000002 x27: 000000000000000a
x26: 0000000000000000 x25: ffff00011aca2090 x24: 0000000000000001
x23: 000000000000003f x22: 000000003f12763d x21: ffff00011ac8a480
x20: 0000000000000000 x19: ffff00011ad025b8 x18: 00000000000000c0
x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff00010daa3480
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff00010daa3480
x11: ff808000081c4d64 x10: 0000000000000000 x9 : 67b071ca44648600
x8 : 67b071ca44648600 x7 : ffff80000c091344 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000101 x0 : 0000000000000039
Call trace:
 stack_depot_fetch lib/stackdepot.c:377 [inline]
 stack_depot_print+0x34/0x78 lib/stackdepot.c:349
 ref_tracker_free+0x23c/0x340 lib/ref_tracker.c:129
 netdev_tracker_free include/linux/netdevice.h:4015 [inline]
 netdev_put include/linux/netdevice.h:4032 [inline]
 fib_nh_common_release+0x38/0x2d4 net/ipv4/fib_semantics.c:214
 fib6_nh_release+0x270/0x2b8 net/ipv6/route.c:3656
 fib6_info_destroy_rcu+0xac/0x1a8 net/ipv6/ip6_fib.c:176
 rcu_do_batch+0x1a4/0x584 kernel/rcu/tree.c:2250
 rcu_core+0x2bc/0x5b4 kernel/rcu/tree.c:2510
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2527
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 el0_interrupt+0x7c/0x218 arch/arm64/kernel/entry-common.c:717
 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724
 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729
 el0t_64_irq+0x190/0x194 arch/arm64/kernel/entry.S:585
irq event stamp: 1458663
hardirqs last  enabled at (1458662): [<ffff80000c0963d4>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (1458662): [<ffff80000c0963d4>] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194
hardirqs last disabled at (1458663): [<ffff80000c096210>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1458663): [<ffff80000c096210>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last  enabled at (1458628): [<ffff80000801c82c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1458633): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
freed in:
------------[ cut here ]------------
slab index 16191 out of bounds (15) for stack id 3f053f3f
WARNING: CPU: 1 PID: 3346 at lib/stackdepot.c:378 stack_depot_fetch lib/stackdepot.c:377 [inline]
WARNING: CPU: 1 PID: 3346 at lib/stackdepot.c:378 stack_depot_print+0x34/0x78 lib/stackdepot.c:349
Modules linked in:
CPU: 1 PID: 3346 Comm: syz-fuzzer Tainted: G        W          6.1.0-rc7-syzkaller-33054-gcdb931b58ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : stack_depot_fetch lib/stackdepot.c:377 [inline]
pc : stack_depot_print+0x34/0x78 lib/stackdepot.c:349
lr : stack_depot_fetch lib/stackdepot.c:377 [inline]
lr : stack_depot_print+0x34/0x78 lib/stackdepot.c:349
sp : ffff80000800bcc0
x29: ffff80000800bcc0 x28: 0000000000000002 x27: 000000000000000a
x26: 0000000000000000 x25: ffff00011aca2090 x24: 0000000000000001
x23: 000000000000003f x22: 000000003f053f3f x21: ffff00011ac8a480
x20: 0000000000000000 x19: ffff00011ad025b8 x18: 00000000000000c0
x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff00010daa3480
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff00010daa3480
x11: ff808000081c4d64 x10: 0000000000000000 x9 : 67b071ca44648600
x8 : 67b071ca44648600 x7 : ffff80000c091344 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000100000101 x0 : 0000000000000039
Call trace:
 stack_depot_fetch lib/stackdepot.c:377 [inline]
 stack_depot_print+0x34/0x78 lib/stackdepot.c:349
 ref_tracker_free+0x258/0x340 lib/ref_tracker.c:133
 netdev_tracker_free include/linux/netdevice.h:4015 [inline]
 netdev_put include/linux/netdevice.h:4032 [inline]
 fib_nh_common_release+0x38/0x2d4 net/ipv4/fib_semantics.c:214
 fib6_nh_release+0x270/0x2b8 net/ipv6/route.c:3656
 fib6_info_destroy_rcu+0xac/0x1a8 net/ipv6/ip6_fib.c:176
 rcu_do_batch+0x1a4/0x584 kernel/rcu/tree.c:2250
 rcu_core+0x2bc/0x5b4 kernel/rcu/tree.c:2510
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2527
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 el0_interrupt+0x7c/0x218 arch/arm64/kernel/entry-common.c:717
 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724
 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729
 el0t_64_irq+0x190/0x194 arch/arm64/kernel/entry.S:585
irq event stamp: 1458663
hardirqs last  enabled at (1458662): [<ffff80000c0963d4>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (1458662): [<ffff80000c0963d4>] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194
hardirqs last disabled at (1458663): [<ffff80000c096210>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (1458663): [<ffff80000c096210>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last  enabled at (1458628): [<ffff80000801c82c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1458633): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3346 at lib/ref_tracker.c:136 spin_unlock_irqrestore include/linux/spinlock.h:405 [inline]
WARNING: CPU: 1 PID: 3346 at lib/ref_tracker.c:136 ref_tracker_free+0x218/0x340 lib/ref_tracker.c:135
Modules linked in:
CPU: 1 PID: 3346 Comm: syz-fuzzer Tainted: G        W          6.1.0-rc7-syzkaller-33054-gcdb931b58ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ref_tracker_free+0x218/0x340 include/linux/spinlock.h:405
lr : spin_unlock_irqrestore include/linux/spinlock.h:405 [inline]
lr : ref_tracker_free+0x218/0x340 lib/ref_tracker.c:135
sp : ffff80000800bcd0
x29: ffff80000800bd60 x28: 0000000000000002 x27: 000000000000000a
x26: 0000000000000000 x25: ffff00011aca2090 x24: 0000000000000001
x23: 000000000000003f x22: 000000003f053f3f x21: ffff00011ac8a480
x20: 0000000000000000 x19: ffff00011ad025b8 x18: 00000000000000c0
x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff00010daa3480
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff00010daa3480
x11: ff808000095d4bb8 x10: 0000000000000000 x9 : 0000000000000100
x8 : 0000000000000100 x7 : ffff80000c091344 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff00010daa3480 x1 : ffff80000ceb257e x0 : 0000000000000001
Call trace:
 spin_unlock_irqrestore include/linux/spinlock.h:405 [inline]
 ref_tracker_free+0x218/0x340 lib/ref_tracker.c:135
 netdev_tracker_free include/linux/netdevice.h:4015 [inline]
 netdev_put include/linux/netdevice.h:4032 [inline]
 fib_nh_common_release+0x38/0x2d4 net/ipv4/fib_semantics.c:214
 fib6_nh_release+0x270/0x2b8 net/ipv6/route.c:3656
 fib6_info_destroy_rcu+0xac/0x1a8 net/ipv6/ip6_fib.c:176
 rcu_do_batch+0x1a4/0x584 kernel/rcu/tree.c:2250
 rcu_core+0x2bc/0x5b4 kernel/rcu/tree.c:2510
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2527
 _stext+0x168/0x37c
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x2c/0x54 arch/arm64/kernel/entry.S:892
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq+0x70/0xbc kernel/softirq.c:452
 __irq_exit_rcu+0xf0/0x140 kernel/softirq.c:650
 irq_exit_rcu+0x10/0x40 kernel/softirq.c:662
 el0_interrupt+0x7c/0x218 arch/arm64/kernel/entry-common.c:717
 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724
 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729
 el0t_64_irq+0x190/0x194 arch/arm64/kernel/entry.S:585
irq event stamp: 1458671
hardirqs last  enabled at (1458670): [<ffff80000c0858c0>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (1458670): [<ffff80000c0858c0>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (1458671): [<ffff80000c083704>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1458628): [<ffff80000801c82c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1458633): [<ffff800008017c88>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---