slab kmalloc-32 start fff0000017b8bdc0 pointer offset 17365880163140632576 size 32 list_del corruption. prev->next should be f7f000002d88de00, but was ffffc1ffc137bd00. (prev=f0f0000017b8bdc0) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:62! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Modules linked in: CPU: 1 UID: 0 PID: 31390 Comm: kworker/u8:4 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: linux,dummy-virt (DT) Workqueue: events_power_efficient neigh_periodic_work pstate: 614020c9 (nZCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62 lr : __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62 sp : ffff80008be8bbf0 x29: ffff80008be8bbf0 x28: 0000000000000000 x27: ffff800082d1d3e0 x26: f6f000000eb5ee00 x25: dead000000000122 x24: 000000000000009d x23: 0000000000000000 x22: ffffc1ffc137bd00 x21: f0f0000017b8bdc0 x20: f4f0000040190400 x19: f7f000002d88de00 x18: 0000000000000010 x17: 0000000000000000 x16: 0000000000000000 x15: ffff800082d7db2e x14: 00000000ffffffea x13: ffff80008be8b868 x12: ffff800082b6f288 x11: ffff800082abf2e0 x10: ffff800082b6f2e0 x9 : 0000000000000001 x8 : 0000000000000001 x7 : 000000000002ffe8 x6 : c0000000ffffdfff x5 : fff000007d8e6508 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : f5f00000035a3240 x0 : 000000000000006d Call trace: __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62 (P) __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_move_tail include/linux/list.h:318 [inline] ref_tracker_free+0xa8/0x278 lib/ref_tracker.c:329 netdev_tracker_free include/linux/netdevice.h:4456 [inline] netdev_put include/linux/netdevice.h:4473 [inline] netdev_put include/linux/netdevice.h:4469 [inline] neigh_destroy+0x110/0x2b4 net/core/neighbour.c:941 neigh_release include/net/neighbour.h:459 [inline] neigh_cleanup_and_release net/core/neighbour.c:121 [inline] neigh_periodic_work+0x2dc/0x33c net/core/neighbour.c:1030 process_one_work+0x180/0x2d0 kernel/workqueue.c:3276 process_scheduled_works kernel/workqueue.c:3359 [inline] worker_thread+0x184/0x2fc kernel/workqueue.c:3440 kthread+0x118/0x124 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: aa1503e3 f000f6c0 910d6000 97e40c49 (d4210000) ---[ end trace 0000000000000000 ]---