program:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @loopback}, {0x2, 0x0, @remote}, 0x184, 0x0, 0x0, 0xfdffffffffffffff, 0x0, &(0x7f0000000180)='lo\x00'})
getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000100), &(0x7f00000001c0)=0x68)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @loopback}, {0x2, 0x0, @private}, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7f4}) (async)
r2 = socket$netlink(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r3, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async, rerun: 64)
syz_usb_connect(0x2, 0x2d, 0x0, 0x0) (rerun: 64)
[ 85.726086][ T4658] Bluetooth: hci0: command tx timeout
[ 85.793636][ T5335] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 87.200158][ T5335] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 87.807368][ T4658] Bluetooth: hci0: command tx timeout
[ 88.256887][ T5335] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.422180][ T5335] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.589090][ T185] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.634114][ T185] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.651917][ T185] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.675496][ T185] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.696673][ T5335] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.729469][ T185] ==================================================================
[ 88.743409][ T185] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550
[ 88.752089][ T185] Read of size 8 at addr ffff88800e5626a8 by task kworker/u4:6/185
[ 88.758788][ T185]
[ 88.759807][ T185] CPU: 0 UID: 0 PID: 185 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 88.759831][ T185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.759840][ T185] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 88.759861][ T185] Call Trace:
[ 88.759868][ T185]
[ 88.759874][ T185] dump_stack_lvl+0xe8/0x150
[ 88.759889][ T185] print_address_description+0x55/0x1e0
[ 88.759901][ T185] ? __mutex_lock+0x15a/0x1550
[ 88.759911][ T185] print_report+0x58/0x70
[ 88.759920][ T185] kasan_report+0x117/0x150
[ 88.759935][ T185] ? __mutex_lock+0x15a/0x1550
[ 88.759947][ T185] __mutex_lock+0x15a/0x1550
[ 88.759958][ T185] ? __lock_acquire+0x6b5/0x2cf0
[ 88.759969][ T185] ? look_up_lock_class+0x57/0x110
[ 88.759980][ T185] ? __mutex_lock+0x608/0x1550
[ 88.759990][ T185] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.760002][ T185] ? __pfx___mutex_lock+0x10/0x10
[ 88.760014][ T185] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 88.760029][ T185] ? process_scheduled_works+0xa70/0x1860
[ 88.760041][ T185] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.760055][ T185] ? process_scheduled_works+0xa70/0x1860
[ 88.760065][ T185] ? process_scheduled_works+0xa70/0x1860
[ 88.760074][ T185] process_scheduled_works+0xb5d/0x1860
[ 88.760092][ T185] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.760104][ T185] ? assign_work+0x3d5/0x5e0
[ 88.760114][ T185] worker_thread+0xa53/0xfc0
[ 88.760131][ T185] kthread+0x389/0x470
[ 88.760144][ T185] ? __pfx_worker_thread+0x10/0x10
[ 88.760154][ T185] ? __pfx_kthread+0x10/0x10
[ 88.760166][ T185] ret_from_fork+0x514/0xb70
[ 88.760179][ T185] ? __pfx_ret_from_fork+0x10/0x10
[ 88.760190][ T185] ? __switch_to+0xc79/0x1410
[ 88.760205][ T185] ? __pfx_kthread+0x10/0x10
[ 88.760217][ T185] ret_from_fork_asm+0x1a/0x30
[ 88.760233][ T185]
[ 88.760237][ T185]
[ 88.961376][ T185] Allocated by task 5335:
[ 88.967880][ T185] kasan_save_track+0x3e/0x80
[ 88.976523][ T185] __kasan_kmalloc+0x93/0xb0
[ 88.982492][ T185] __kmalloc_noprof+0x35c/0x760
[ 88.987380][ T185] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0
[ 88.991066][ T185] notifier_call_chain+0x1ad/0x3d0
[ 88.994331][ T185] register_netdevice+0x18c9/0x1ec0
[ 88.997529][ T185] nsim_create+0xbed/0x1160
[ 89.000178][ T185] __nsim_dev_port_add+0x857/0xd30
[ 89.003522][ T185] nsim_dev_port_add_all+0x37/0xf0
[ 89.026820][ T185] nsim_dev_reload_up+0x45f/0x7c0
[ 89.030763][ T185] devlink_reload+0x4f8/0x8c0
[ 89.034671][ T185] devlink_nl_reload_doit+0xaaa/0xc80
[ 89.037916][ T185] genl_family_rcv_msg_doit+0x22a/0x330
[ 89.041011][ T185] genl_rcv_msg+0x61c/0x7a0
[ 89.043594][ T185] netlink_rcv_skb+0x232/0x4b0
[ 89.046107][ T185] genl_rcv+0x28/0x40
[ 89.048661][ T185] netlink_unicast+0x75c/0x8e0
[ 89.051637][ T185] netlink_sendmsg+0x813/0xb40
[ 89.054501][ T185] ____sys_sendmsg+0x972/0x9f0
[ 89.067324][ T185] ___sys_sendmsg+0x2a5/0x360
[ 89.070081][ T185] __x64_sys_sendmsg+0x1bd/0x2a0
[ 89.073046][ T185] do_syscall_64+0x174/0x580
[ 89.075824][ T185] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.080315][ T185]
[ 89.081692][ T185] Freed by task 5335:
[ 89.083898][ T185] kasan_save_track+0x3e/0x80
[ 89.086563][ T185] kasan_save_free_info+0x46/0x50
[ 89.089264][ T185] __kasan_slab_free+0x5c/0x80
[ 89.093091][ T185] kfree+0x1c5/0x640
[ 89.095463][ T185] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0
[ 89.099335][ T185] notifier_call_chain+0x1ad/0x3d0
[ 89.102079][ T185] unregister_netdevice_many_notify+0x17a5/0x22c0
[ 89.105640][ T185] unregister_netdevice_queue+0x31f/0x360
[ 89.109005][ T185] nsim_destroy+0x26d/0x7f0
[ 89.111771][ T185] __nsim_dev_port_del+0x14f/0x200
[ 89.114759][ T185] nsim_dev_reload_destroy+0x288/0x490
[ 89.117732][ T185] nsim_dev_reload_down+0x8a/0xc0
[ 89.120684][ T185] devlink_reload+0x1eb/0x8c0
[ 89.123266][ T185] devlink_nl_reload_doit+0xaaa/0xc80
[ 89.126414][ T185] genl_family_rcv_msg_doit+0x22a/0x330
[ 89.129245][ T185] genl_rcv_msg+0x61c/0x7a0
[ 89.131535][ T185] netlink_rcv_skb+0x232/0x4b0
[ 89.133426][ T185] genl_rcv+0x28/0x40
[ 89.135029][ T185] netlink_unicast+0x75c/0x8e0
[ 89.137336][ T185] netlink_sendmsg+0x813/0xb40
[ 89.142180][ T185] ____sys_sendmsg+0x972/0x9f0
[ 89.151318][ T185] ___sys_sendmsg+0x2a5/0x360
[ 89.155239][ T185] __x64_sys_sendmsg+0x1bd/0x2a0
[ 89.157994][ T185] do_syscall_64+0x174/0x580
[ 89.160864][ T185] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.164166][ T185]
[ 89.165697][ T185] Last potentially related work creation:
[ 89.169130][ T185] kasan_save_stack+0x3e/0x60
[ 89.172913][ T185] kasan_record_aux_stack+0xbd/0xd0
[ 89.176691][ T185] insert_work+0x3d/0x330
[ 89.179824][ T185] __queue_work+0xbba/0x1040
[ 89.183385][ T185] queue_work_on+0x106/0x1d0
[ 89.186941][ T185] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 89.191397][ T185] udp_tunnel_push_rx_port+0x186/0x210
[ 89.197925][ T185] geneve_offload_rx_ports+0xc7/0x150
[ 89.202847][ T185] geneve_netdevice_event+0x6a/0x80
[ 89.207214][ T185] notifier_call_chain+0x1ad/0x3d0
[ 89.210870][ T185] call_netdevice_notifiers+0x90/0xd0
[ 89.215454][ T185] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 89.219726][ T185] notifier_call_chain+0x1ad/0x3d0
[ 89.223730][ T185] register_netdevice+0x18c9/0x1ec0
[ 89.225976][ T185] nsim_create+0xbed/0x1160
[ 89.227911][ T185] __nsim_dev_port_add+0x857/0xd30
[ 89.230034][ T185] nsim_dev_port_add_all+0x37/0xf0
[ 89.232112][ T185] nsim_dev_reload_up+0x45f/0x7c0
[ 89.234143][ T185] devlink_reload+0x4f8/0x8c0
[ 89.247123][ T185] devlink_nl_reload_doit+0xaaa/0xc80
[ 89.250234][ T185] genl_family_rcv_msg_doit+0x22a/0x330
[ 89.253320][ T185] genl_rcv_msg+0x61c/0x7a0
[ 89.256372][ T185] netlink_rcv_skb+0x232/0x4b0
[ 89.259150][ T185] genl_rcv+0x28/0x40
[ 89.268736][ T185] netlink_unicast+0x75c/0x8e0
[ 89.271532][ T185] netlink_sendmsg+0x813/0xb40
[ 89.274878][ T185] ____sys_sendmsg+0x972/0x9f0
[ 89.280627][ T185] ___sys_sendmsg+0x2a5/0x360
[ 89.282731][ T185] __x64_sys_sendmsg+0x1bd/0x2a0
[ 89.284904][ T185] do_syscall_64+0x174/0x580
[ 89.295040][ T185] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.301423][ T185]
[ 89.302875][ T185] Second to last potentially related work creation:
[ 89.305880][ T185] kasan_save_stack+0x3e/0x60
[ 89.319927][ T185] kasan_record_aux_stack+0xbd/0xd0
[ 89.322612][ T185] insert_work+0x3d/0x330
[ 89.324536][ T185] __queue_work+0xcef/0x1040
[ 89.330093][ T185] queue_work_on+0x106/0x1d0
[ 89.332843][ T185] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 89.336088][ T185] udp_tunnel_push_rx_port+0x186/0x210
[ 89.342233][ T185] geneve_offload_rx_ports+0xc7/0x150
[ 89.346999][ T185] geneve_netdevice_event+0x6a/0x80
[ 89.350996][ T185] notifier_call_chain+0x1ad/0x3d0
[ 89.354761][ T185] call_netdevice_notifiers+0x90/0xd0
[ 89.359020][ T185] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 89.362804][ T185] notifier_call_chain+0x1ad/0x3d0
[ 89.366692][ T185] register_netdevice+0x18c9/0x1ec0
[ 89.371771][ T185] nsim_create+0xbed/0x1160
[ 89.377027][ T185] __nsim_dev_port_add+0x857/0xd30
[ 89.381861][ T185] nsim_dev_port_add_all+0x37/0xf0
[ 89.385210][ T185] nsim_dev_reload_up+0x45f/0x7c0
[ 89.389618][ T185] devlink_reload+0x4f8/0x8c0
[ 89.394064][ T185] devlink_nl_reload_doit+0xaaa/0xc80
[ 89.398175][ T185] genl_family_rcv_msg_doit+0x22a/0x330
[ 89.404109][ T185] genl_rcv_msg+0x61c/0x7a0
[ 89.409830][ T185] netlink_rcv_skb+0x232/0x4b0
[ 89.413762][ T185] genl_rcv+0x28/0x40
[ 89.417297][ T185] netlink_unicast+0x75c/0x8e0
[ 89.421395][ T185] netlink_sendmsg+0x813/0xb40
[ 89.426874][ T185] ____sys_sendmsg+0x972/0x9f0
[ 89.430633][ T185] ___sys_sendmsg+0x2a5/0x360
[ 89.434420][ T185] __x64_sys_sendmsg+0x1bd/0x2a0
[ 89.439006][ T185] do_syscall_64+0x174/0x580
[ 89.442776][ T185] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.447337][ T185]
[ 89.449486][ T185] The buggy address belongs to the object at ffff88800e562600
[ 89.449486][ T185] which belongs to the cache kmalloc-256 of size 256
[ 89.462092][ T185] The buggy address is located 168 bytes inside of
[ 89.462092][ T185] freed 256-byte region [ffff88800e562600, ffff88800e562700)
[ 89.475135][ T185]
[ 89.477041][ T185] The buggy address belongs to the physical page:
[ 89.481883][ T185] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe562
[ 89.488197][ T185] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 89.493540][ T185] page_type: f5(slab)
[ 89.496758][ T185] raw: 00fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000
[ 89.502109][ T185] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 89.526011][ T185] page dumped because: kasan: bad access detected
[ 89.528908][ T185] page_owner tracks the page as allocated
[ 89.532423][ T185] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5290, tgid 5290 (syz-executor), ts 83883582909, free_ts 83869976346
[ 89.567683][ T185] post_alloc_hook+0x22d/0x280
[ 89.571101][ T185] get_page_from_freelist+0x2593/0x2610
[ 89.575623][ T185] __alloc_frozen_pages_noprof+0x18d/0x380
[ 89.581445][ T185] allocate_slab+0x77/0x660
[ 89.587560][ T185] refill_objects+0x339/0x3d0
[ 89.599558][ T185] __pcs_replace_empty_main+0x321/0x720
[ 89.607210][ T185] __kmalloc_noprof+0x474/0x760
[ 89.609289][ T185] __list_lru_init+0xba/0x5d0
[ 89.611339][ T185] alloc_super+0x8b5/0xab0
[ 89.613288][ T185] sget_fc+0x329/0xa40
[ 89.615054][ T185] get_tree_nodev+0x2a/0x150
[ 89.639366][ T185] vfs_get_tree+0x92/0x2a0
[ 89.641198][ T185] do_new_mount+0x341/0xd30
[ 89.644139][ T185] __se_sys_mount+0x31d/0x420
[ 89.646006][ T185] do_syscall_64+0x174/0x580
[ 89.655721][ T185] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 89.671212][ T185] page last free pid 76 tgid 76 stack trace:
[ 89.678484][ T185] free_unref_folios+0xd9f/0x14c0
[ 89.680826][ T185] shrink_folio_list+0x4a88/0x52a0
[ 89.683250][ T185] evict_folios+0x4998/0x5ac0
[ 89.685222][ T185] try_to_shrink_lruvec+0xbca/0x1050
[ 89.719205][ T185] shrink_one+0x25c/0x710
[ 89.721427][ T185] shrink_node+0x31bf/0x3ae0
[ 89.723771][ T185] kswapd+0x1736/0x2de0
[ 89.725871][ T185] kthread+0x389/0x470
[ 89.747857][ T185] ret_from_fork+0x514/0xb70
[ 89.749966][ T185] ret_from_fork_asm+0x1a/0x30
[ 89.759620][ T185]
[ 89.760851][ T185] Memory state around the buggy address:
[ 89.773789][ T185] ffff88800e562580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 89.784289][ T185] ffff88800e562600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.801254][ T185] >ffff88800e562680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 89.811824][ T185] ^
[ 89.814480][ T185] ffff88800e562700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 89.839349][ T185] ffff88800e562780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 89.842840][ T185] ==================================================================
[ 90.011253][ T4658] Bluetooth: hci0: command tx timeout
[ 90.057815][ T185] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 90.071837][ T185] CPU: 0 UID: 0 PID: 185 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full)
[ 90.085755][ T185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 90.097225][ T185] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 90.100607][ T185] Call Trace:
[ 90.102241][ T185]
[ 90.103873][ T185] vpanic+0x56c/0xa60
[ 90.106083][ T185] ? __pfx_vpanic+0x10/0x10
[ 90.136599][ T185] panic+0xc5/0xd0
[ 90.147846][ T185] ? __pfx_panic+0x10/0x10
[ 90.150043][ T185] ? preempt_schedule_thunk+0x16/0x30
[ 90.158524][ T185] ? __mutex_lock+0x15a/0x1550
[ 90.160715][ T185] ? preempt_schedule_thunk+0x16/0x30
[ 90.182768][ T185] ? __mutex_lock+0x15a/0x1550
[ 90.187769][ T185] check_panic_on_warn+0x89/0xb0
[ 90.190245][ T185] ? __mutex_lock+0x15a/0x1550
[ 90.199194][ T185] end_report+0x73/0x170
[ 90.211006][ T185] ? __mutex_lock+0x15a/0x1550
[ 90.213371][ T185] kasan_report+0x128/0x150
[ 90.215691][ T185] ? __mutex_lock+0x15a/0x1550
[ 90.235786][ T185] __mutex_lock+0x15a/0x1550
[ 90.239877][ T185] ? __lock_acquire+0x6b5/0x2cf0
[ 90.246036][ T185] ? look_up_lock_class+0x57/0x110
[ 90.252897][ T185] ? __mutex_lock+0x608/0x1550
[ 90.262110][ T185] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 90.265417][ T185] ? __pfx___mutex_lock+0x10/0x10
[ 90.272272][ T185] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 90.274820][ T185] ? process_scheduled_works+0xa70/0x1860
[ 90.297921][ T185] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 90.300378][ T185] ? process_scheduled_works+0xa70/0x1860
[ 90.325513][ T185] ? process_scheduled_works+0xa70/0x1860
[ 90.340716][ T185] process_scheduled_works+0xb5d/0x1860
[ 90.343713][ T185] ? __pfx_process_scheduled_works+0x10/0x10
[ 90.347005][ T185] ? assign_work+0x3d5/0x5e0
[ 90.349413][ T185] worker_thread+0xa53/0xfc0
[ 90.351299][ T185] kthread+0x389/0x470
[ 90.352965][ T185] ? __pfx_worker_thread+0x10/0x10
[ 90.371225][ T185] ? __pfx_kthread+0x10/0x10
[ 90.373299][ T185] ret_from_fork+0x514/0xb70
[ 90.375587][ T185] ? __pfx_ret_from_fork+0x10/0x10
[ 90.378434][ T185] ? __switch_to+0xc79/0x1410
[ 90.380683][ T185] ? __pfx_kthread+0x10/0x10
[ 90.383412][ T185] ret_from_fork_asm+0x1a/0x30
[ 90.386780][ T185]
[ 90.392663][ T185] Kernel Offset: disabled
[ 90.397300][ T185] Rebooting in 86400 seconds..