unregister_netdevice: waiting for syzkaller0 to become free. Usage count = 2 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4049 [inline] netdev_tracker_alloc include/linux/netdevice.h:4061 [inline] fib6_nh_init+0x604/0x1a08 net/ipv6/route.c:3667 ip6_route_info_create+0x7d0/0xf9c net/ipv6/route.c:3848 addrconf_f6i_alloc+0x1a8/0x36c net/ipv6/route.c:4623 ipv6_add_addr+0x3d4/0xd74 net/ipv6/addrconf.c:1121 addrconf_add_linklocal+0x23c/0x60c net/ipv6/addrconf.c:3264 addrconf_addr_gen+0x3ec/0x500 net/ipv6/addrconf.c:3395 addrconf_init_auto_addrs+0x5a8/0x91c net/ipv6/addrconf.c:-1 addrconf_notify+0x8cc/0xc98 net/ipv6/addrconf.c:3692 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x260/0x490 net/core/dev.c:8715 dev_change_flags+0xd0/0x15c net/core/dev.c:8753 dev_ifsioc+0x130/0xc04 net/core/dev_ioctl.c:326 dev_ioctl+0x4b0/0xc78 net/core/dev_ioctl.c:572 sock_do_ioctl+0x198/0x258 net/socket.c:1216 sock_ioctl+0x234/0x828 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4465 at include/linux/backing-dev.h:247 inode_to_wb include/linux/backing-dev.h:243 [inline] WARNING: CPU: 1 PID: 4465 at include/linux/backing-dev.h:247 folio_account_dirtied mm/page-writeback.c:2587 [inline] WARNING: CPU: 1 PID: 4465 at include/linux/backing-dev.h:247 __folio_mark_dirty+0x8b8/0xce0 mm/page-writeback.c:2638 Modules linked in: CPU: 1 PID: 4465 Comm: syz.0.1 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : inode_to_wb include/linux/backing-dev.h:243 [inline] pc : folio_account_dirtied mm/page-writeback.c:2587 [inline] pc : __folio_mark_dirty+0x8b8/0xce0 mm/page-writeback.c:2638 lr : inode_to_wb include/linux/backing-dev.h:243 [inline] lr : folio_account_dirtied mm/page-writeback.c:2587 [inline] lr : __folio_mark_dirty+0x8b8/0xce0 mm/page-writeback.c:2638 sp : ffff8000216374c0 x29: ffff8000216374d0 x28: 1fffff8000659c30 x27: 0000000000000000 x26: dfff800000000000 x25: 0000000000000000 x24: ffff0000c049c998 x23: 0000000000000001 x22: 0000000000000000 x21: 1fffe00018093933 x20: ffff0000d3e207e8 x19: fffffc00032ce180 x18: 1fffe00033e7697e x17: ffff80001537d000 x16: ffff8000082dbd3c x15: ffff8000184cd000 x14: 0000000000000001 x13: 1fffe00018093933 x12: 0000000000000000 x11: ff00800008715320 x10: 0000000000000000 x9 : ffff800008715320 x8 : ffff0000cc72d400 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff800008a66f8c x2 : ffff0000ceba8060 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: inode_to_wb include/linux/backing-dev.h:243 [inline] folio_account_dirtied mm/page-writeback.c:2587 [inline] __folio_mark_dirty+0x8b8/0xce0 mm/page-writeback.c:2638 __set_page_dirty include/linux/pagemap.h:1090 [inline] mark_buffer_dirty+0x2b8/0x5c0 fs/buffer.c:1105 gfs2_unpin+0x128/0x918 fs/gfs2/lops.c:111 buf_lo_after_commit+0x144/0x18c fs/gfs2/lops.c:747 lops_after_commit fs/gfs2/lops.h:49 [inline] __gfs2_log_flush+0x12e8/0x1bd4 fs/gfs2/log.c:1118 gfs2_log_flush+0x3c/0x58 fs/gfs2/log.c:1180 gfs2_kill_sb+0x5c/0xd8 fs/gfs2/ops_fstype.c:1729 deactivate_locked_super+0xb4/0x128 fs/super.c:332 deactivate_super+0xe4/0x104 fs/super.c:363 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198 task_work_run+0x1f4/0x280 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x54c/0x19ac kernel/exit.c:887 do_group_exit+0x198/0x238 kernel/exit.c:1030 get_signal+0x11f4/0x133c kernel/signal.c:2880 do_signal arch/arm64/kernel/signal.c:1095 [inline] do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 30080 hardirqs last enabled at (30079): [] folio_memcg_lock+0xe8/0x1f8 mm/memcontrol.c:2113 hardirqs last disabled at (30080): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (30080): [] _raw_spin_lock_irqsave+0xa4/0xb0 kernel/locking/spinlock.c:162 softirqs last enabled at (30038): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (30038): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (30013): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4465 at include/linux/backing-dev.h:247 inode_to_wb include/linux/backing-dev.h:243 [inline] WARNING: CPU: 1 PID: 4465 at include/linux/backing-dev.h:247 __folio_start_writeback+0x8a8/0xa98 mm/page-writeback.c:3003 Modules linked in: CPU: 1 PID: 4465 Comm: syz.0.1 Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : inode_to_wb include/linux/backing-dev.h:243 [inline] pc : __folio_start_writeback+0x8a8/0xa98 mm/page-writeback.c:3003 lr : inode_to_wb include/linux/backing-dev.h:243 [inline] lr : __folio_start_writeback+0x8a8/0xa98 mm/page-writeback.c:3003 sp : ffff800021636f40 x29: ffff800021637020 x28: ffff7000042c6df0 x27: 0000000000000000 x26: ffff0000c049c7f0 x25: 1fffff8000659c31 x24: dfff800000000000 x23: ffff0000d3e207e8 x22: ffff800021636fa0 x21: ffff0000c049c998 x20: 0000000000000001 x19: fffffc00032ce180 x18: 1fffe00033e7697e x17: ffff80001537d000 x16: ffff8000082dbd3c x15: 0000000000000000 x14: 0000000000000001 x13: 1fffff8000659c30 x12: 0000000000000000 x11: ff00800008717844 x10: 0000000000000000 x9 : ffff800008717844 x8 : ffff0000cc72d400 x7 : ffff800008717294 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff8000087172d0 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: inode_to_wb include/linux/backing-dev.h:243 [inline] __folio_start_writeback+0x8a8/0xa98 mm/page-writeback.c:3003 set_page_writeback+0x5c/0x7c mm/folio-compat.c:56 gfs2_aspace_writepage+0x524/0x6f4 fs/gfs2/meta_io.c:73 __gfs2_writepage+0x70/0x184 fs/gfs2/log.c:87 write_cache_pages+0x760/0xe00 mm/page-writeback.c:2382 gfs2_ail1_start_one fs/gfs2/log.c:143 [inline] gfs2_ail1_flush+0x7a8/0x9f0 fs/gfs2/log.c:223 gfs2_ail1_start fs/gfs2/log.c:254 [inline] empty_ail1_list+0x130/0x214 fs/gfs2/log.c:987 __gfs2_log_flush+0x15c8/0x1bd4 fs/gfs2/log.c:1133 gfs2_log_flush+0x3c/0x58 fs/gfs2/log.c:1180 gfs2_kill_sb+0x5c/0xd8 fs/gfs2/ops_fstype.c:1729 deactivate_locked_super+0xb4/0x128 fs/super.c:332 deactivate_super+0xe4/0x104 fs/super.c:363 cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191 __cleanup_mnt+0x20/0x30 fs/namespace.c:1198 task_work_run+0x1f4/0x280 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x54c/0x19ac kernel/exit.c:887 do_group_exit+0x198/0x238 kernel/exit.c:1030 get_signal+0x11f4/0x133c kernel/signal.c:2880 do_signal arch/arm64/kernel/signal.c:1095 [inline] do_notify_resume+0x364/0x2c84 arch/arm64/kernel/signal.c:1148 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 irq event stamp: 30376 hardirqs last enabled at (30375): [] folio_memcg_lock+0xe8/0x1f8 mm/memcontrol.c:2113 hardirqs last disabled at (30376): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (30376): [] _raw_spin_lock_irqsave+0xa4/0xb0 kernel/locking/spinlock.c:162 softirqs last enabled at (30346): [] softirq_handle_end kernel/softirq.c:439 [inline] softirqs last enabled at (30346): [] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624 softirqs last disabled at (30083): [] __do_softirq+0x14/0x20 kernel/softirq.c:630 ---[ end trace 0000000000000000 ]---