unregister_netdevice: waiting for syz_tun to become free. Usage count = 3 ref_tracker: netdev@ffff88805c1007d0 has 1/2 users at __netdev_tracker_alloc include/linux/netdevice.h:4538 [inline] netdev_hold include/linux/netdevice.h:4567 [inline] dst_init+0xc0/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 rt_dst_alloc net/ipv4/route.c:1649 [inline] __mkroute_output net/ipv4/route.c:2652 [inline] ip_route_output_key_hash_rcu+0x14ac/0x2720 net/ipv4/route.c:2872 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929 ip_route_output_key include/net/route.h:179 [inline] geneve_link_config+0x1a5/0x660 drivers/net/geneve.c:2262 geneve_newlink+0x1f1/0x260 drivers/net/geneve.c:2321 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 ref_tracker: netdev@ffff88805c1007d0 has 1/2 users at __netdev_tracker_alloc include/linux/netdevice.h:4538 [inline] netdev_hold include/linux/netdevice.h:4567 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1259 [inline] fib_check_nh+0xd0e/0x1af0 net/ipv4/fib_semantics.c:1279 fib_create_info+0x200e/0x3170 net/ipv4/fib_semantics.c:1499 fib_table_insert+0xcb/0x1b10 net/ipv4/fib_trie.c:1212 fib_magic+0x43b/0x530 net/ipv4/fib_frontend.c:1147 fib_add_ifaddr+0x376/0x5d0 net/ipv4/fib_frontend.c:1184 fib_netdev_event+0x382/0x490 net/ipv4/fib_frontend.c:1529 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun@ffff888040494800[1] +1 T5599 at dst_init+0x255/0x490 net/core/dst.c:146 dst_alloc+0x12a/0x170 net/core/dst.c:171 rt_dst_alloc net/ipv4/route.c:1649 [inline] __mkroute_output net/ipv4/route.c:2652 [inline] ip_route_output_key_hash_rcu+0x14ac/0x2720 net/ipv4/route.c:2872 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929 ip_route_output_key include/net/route.h:179 [inline] geneve_link_config+0x1a5/0x660 drivers/net/geneve.c:2262 geneve_newlink+0x1f1/0x260 drivers/net/geneve.c:2321 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun@ffff888040494800[2] +1 T5599 at dst_hold include/net/dst.h:261 [inline] rt_cache_route+0xe3/0x2d0 net/ipv4/route.c:1503 rt_set_nexthop+0x498/0xa70 net/ipv4/route.c:1619 __mkroute_output net/ipv4/route.c:2678 [inline] ip_route_output_key_hash_rcu+0x185c/0x2720 net/ipv4/route.c:2872 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929 ip_route_output_key include/net/route.h:179 [inline] geneve_link_config+0x1a5/0x660 drivers/net/geneve.c:2262 geneve_newlink+0x1f1/0x260 drivers/net/geneve.c:2321 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun@ffff888040494800[3] -1 T5599 at dst_release+0x28/0x1b0 net/core/dst.c:250 ip_rt_put include/net/route.h:285 [inline] geneve_link_config+0x294/0x660 drivers/net/geneve.c:2266 geneve_newlink+0x1f1/0x260 drivers/net/geneve.c:2321 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 balance for syz_tun@dst_entry is 1 Call trace for syz_tun[1] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] rx_queue_add_kobject net/core/net-sysfs.c:1236 [inline] net_rx_queue_update_kobjects+0x166/0x790 net/core/net-sysfs.c:1301 register_queue_kobjects net/core/net-sysfs.c:2093 [inline] netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2341 register_netdevice+0x1455/0x1ed0 net/core/dev.c:11452 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[2] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] netdev_queue_add_kobject net/core/net-sysfs.c:1973 [inline] netdev_queue_update_kobjects+0x16d/0x6b0 net/core/net-sysfs.c:2035 register_queue_kobjects net/core/net-sysfs.c:2098 [inline] netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2341 register_netdevice+0x1455/0x1ed0 net/core/dev.c:11452 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[3] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold+0x27/0xc0 include/linux/netdevice.h:4566 register_netdevice+0x176b/0x1ed0 net/core/dev.c:11476 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[4] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline] netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[5] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline] netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[6] -10 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dev_put include/linux/netdevice.h:4601 [inline] netdevice_event_work_handler+0x136/0x270 drivers/infiniband/core/roce_gid_mgmt.c:652 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[7] -10 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dev_put include/linux/netdevice.h:4601 [inline] netdevice_event_work_handler+0x1c1/0x270 drivers/infiniband/core/roce_gid_mgmt.c:653 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[8] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773 inetdev_init+0x117/0x4e0 net/ipv4/devinet.c:280 inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[9] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] inetdev_init+0x19a/0x4e0 net/ipv4/devinet.c:286 inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[10] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773 ipv6_add_dev+0x44b/0x1420 net/ipv6/addrconf.c:403 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[11] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] ipv6_add_dev+0x4ec/0x1420 net/ipv6/addrconf.c:411 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490 tun_set_iff+0x817/0xec0 drivers/net/tun.c:2881 __tun_chr_ioctl+0x7f5/0x1e90 drivers/net/tun.c:3162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[12] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870 inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:889 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380 __inet_insert_ifa+0x9ef/0xbc0 net/ipv4/devinet.c:566 inet_rtm_newaddr+0x1039/0x19f0 net/ipv4/devinet.c:1001 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[13] -6 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dev_put include/linux/netdevice.h:4601 [inline] update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:834 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[14] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 fib_create_info+0x2a25/0x3170 net/ipv4/fib_semantics.c:1489 fib_table_insert+0xcb/0x1b10 net/ipv4/fib_trie.c:1212 fib_magic+0x43b/0x530 net/ipv4/fib_frontend.c:1147 fib_add_ifaddr+0x139/0x5d0 net/ipv4/fib_frontend.c:1169 fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1483 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380 __inet_insert_ifa+0x9ef/0xbc0 net/ipv4/devinet.c:566 inet_rtm_newaddr+0x1039/0x19f0 net/ipv4/devinet.c:1001 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[15] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2568 addrconf_add_dev net/ipv6/addrconf.c:2586 [inline] inet6_addr_add+0x2b8/0xba0 net/ipv6/addrconf.c:3055 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[16] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] fib6_nh_init+0x1758/0x1e60 net/ipv6/route.c:3716 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2568 addrconf_add_dev net/ipv6/addrconf.c:2586 [inline] inet6_addr_add+0x2b8/0xba0 net/ipv6/addrconf.c:3055 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[17] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4706 ipv6_add_addr+0x59c/0x11b0 net/ipv6/addrconf.c:1132 inet6_addr_add+0x43c/0xba0 net/ipv6/addrconf.c:3073 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[18] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870 inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:903 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223 ipv6_add_addr+0xeb6/0x11b0 net/ipv6/addrconf.c:1193 inet6_addr_add+0x43c/0xba0 net/ipv6/addrconf.c:3073 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[19] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2504 inet6_addr_add+0x504/0xba0 net/ipv6/addrconf.c:3076 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[20] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] fib6_nh_init+0x1758/0x1e60 net/ipv6/route.c:3716 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2504 inet6_addr_add+0x504/0xba0 net/ipv6/addrconf.c:3076 inet6_rtm_newaddr+0x9fc/0xe00 net/ipv6/addrconf.c:5094 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[21] +2 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] ___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661 neigh_add+0xc47/0xf60 net/core/neighbour.c:2129 rtnetlink_rcv_msg+0x7b9/0xc00 net/core/rtnetlink.c:7121 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[22] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dst_init+0x59/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346 mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859 ipv6_mc_dad_complete+0x87/0x410 net/ipv6/mcast.c:2296 addrconf_dad_completed+0x622/0xe60 net/ipv6/addrconf.c:4375 addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[23] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] ___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661 ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246 dst_output include/net/dst.h:489 [inline] NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325 mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870 ipv6_mc_dad_complete+0x87/0x410 net/ipv6/mcast.c:2296 addrconf_dad_completed+0x622/0xe60 net/ipv6/addrconf.c:4375 addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[24] -9 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dst_destroy+0x13e/0x590 net/core/dst.c:192 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core kernel/rcu/tree.c:2897 [inline] rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Call trace for syz_tun[25] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline] netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_set_mac_address+0x393/0x4d0 net/core/dev.c:10008 do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3198 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[26] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline] netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_set_mac_address+0x393/0x4d0 net/core/dev.c:10008 do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3198 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[27] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937 neigh_flush_dev net/core/neighbour.c:433 [inline] neigh_changeaddr+0xe9/0x150 net/core/neighbour.c:457 arp_netdev_event+0x6b/0x330 net/ipv4/arp.c:1333 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_set_mac_address+0x393/0x4d0 net/core/dev.c:10008 do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3198 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[28] -2 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937 neigh_flush_dev net/core/neighbour.c:433 [inline] neigh_changeaddr+0xe9/0x150 net/core/neighbour.c:457 ndisc_netdev_event+0x18f/0x4d0 net/ipv6/ndisc.c:1864 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_set_mac_address+0x393/0x4d0 net/core/dev.c:10008 do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3198 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[29] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] qdisc_alloc+0x682/0xa00 net/sched/sch_generic.c:1030 qdisc_create_dflt+0x8e/0x4e0 net/sched/sch_generic.c:1053 attach_one_default_qdisc net/sched/sch_generic.c:1219 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2745 [inline] attach_default_qdiscs net/sched/sch_generic.c:1237 [inline] dev_activate+0x37a/0x1150 net/sched/sch_generic.c:1296 __dev_open+0x699/0x850 net/core/dev.c:1711 __dev_change_flags+0x329/0x820 net/core/dev.c:9764 netif_change_flags+0x7c/0x1b0 net/core/dev.c:9829 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[30] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline] netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[31] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline] netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[32] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 fib_create_info+0x2a25/0x3170 net/ipv4/fib_semantics.c:1489 fib_table_insert+0xcb/0x1b10 net/ipv4/fib_trie.c:1212 fib_magic+0x43b/0x530 net/ipv4/fib_frontend.c:1147 fib_add_ifaddr+0x139/0x5d0 net/ipv4/fib_frontend.c:1169 fib_netdev_event+0x382/0x490 net/ipv4/fib_frontend.c:1529 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[33] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1259 [inline] fib_check_nh+0xca1/0x1af0 net/ipv4/fib_semantics.c:1279 fib_create_info+0x200e/0x3170 net/ipv4/fib_semantics.c:1499 fib_table_insert+0xcb/0x1b10 net/ipv4/fib_trie.c:1212 fib_magic+0x43b/0x530 net/ipv4/fib_frontend.c:1147 fib_add_ifaddr+0x376/0x5d0 net/ipv4/fib_frontend.c:1184 fib_netdev_event+0x382/0x490 net/ipv4/fib_frontend.c:1529 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[34] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1259 [inline] fib_check_nh+0xca1/0x1af0 net/ipv4/fib_semantics.c:1279 fib_create_info+0x200e/0x3170 net/ipv4/fib_semantics.c:1499 fib_table_insert+0xcb/0x1b10 net/ipv4/fib_trie.c:1212 fib_magic+0x43b/0x530 net/ipv4/fib_frontend.c:1147 fib_add_ifaddr+0x3e6/0x5d0 net/ipv4/fib_frontend.c:1191 fib_netdev_event+0x382/0x490 net/ipv4/fib_frontend.c:1529 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[35] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2504 fixup_permanent_addr net/ipv6/addrconf.c:3626 [inline] addrconf_permanent_addr+0x727/0xa30 net/ipv6/addrconf.c:3662 addrconf_notify+0x864/0x1050 net/ipv6/addrconf.c:3729 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[36] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2568 addrconf_add_dev net/ipv6/addrconf.c:2586 [inline] addrconf_dev_config net/ipv6/addrconf.c:3507 [inline] addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3595 addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[37] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4706 ipv6_add_addr+0x59c/0x11b0 net/ipv6/addrconf.c:1132 addrconf_add_linklocal+0x209/0x490 net/ipv6/addrconf.c:3334 addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470 addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[38] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870 inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:903 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223 ipv6_add_addr+0xeb6/0x11b0 net/ipv6/addrconf.c:1193 addrconf_add_linklocal+0x209/0x490 net/ipv6/addrconf.c:3334 addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470 addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[39] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002 netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025 fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615 ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914 ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966 addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2504 addrconf_add_linklocal+0x262/0x490 net/ipv6/addrconf.c:3336 addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470 addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] __dev_notify_flags+0x31e/0x510 net/core/dev.c:9805 netif_change_flags+0xde/0x1b0 net/core/dev.c:9834 do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246 rtnl_changelink net/core/rtnetlink.c:3885 [inline] __rtnl_newlink net/core/rtnetlink.c:4056 [inline] rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[40] -3 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204 fib_nh_release net/ipv4/fib_semantics.c:217 [inline] free_fib_info_rcu+0xe3/0x2f0 net/ipv4/fib_semantics.c:229 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core kernel/rcu/tree.c:2897 [inline] rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Call trace for syz_tun[41] +3 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dst_init+0x59/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346 mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859 mld_send_cr net/ipv6/mcast.c:2171 [inline] mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[42] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] ___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661 ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246 dst_output include/net/dst.h:489 [inline] NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325 mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870 mld_send_cr net/ipv6/mcast.c:2171 [inline] mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[43] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dst_init+0x59/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346 mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859 mld_dad_work+0x3d/0x480 net/ipv6/mcast.c:2311 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 Call trace for syz_tun[44] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dst_init+0x59/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 rt_dst_alloc net/ipv4/route.c:1649 [inline] __mkroute_output net/ipv4/route.c:2652 [inline] ip_route_output_key_hash_rcu+0x14ac/0x2720 net/ipv4/route.c:2872 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929 ip_route_output_key include/net/route.h:179 [inline] geneve_link_config+0x1a5/0x660 drivers/net/geneve.c:2262 geneve_newlink+0x1f1/0x260 drivers/net/geneve.c:2321 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3949 __rtnl_newlink net/core/rtnetlink.c:4078 [inline] rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4195 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[45] +40 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] tun_get+0x157/0x2f0 drivers/net/tun.c:802 tun_chr_read_iter+0x66/0x270 drivers/net/tun.c:2265 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x59e/0xa90 fs/read_write.c:574 ksys_read+0x156/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[46] -40 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dev_put include/linux/netdevice.h:4601 [inline] tun_put drivers/net/tun.c:810 [inline] tun_chr_read_iter+0x1c0/0x270 drivers/net/tun.c:2279 new_sync_read fs/read_write.c:493 [inline] vfs_read+0x59e/0xa90 fs/read_write.c:574 ksys_read+0x156/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[47] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937 neigh_remove_one+0x44c/0x4a0 net/core/neighbour.c:249 neigh_forced_gc net/core/neighbour.c:280 [inline] neigh_alloc net/core/neighbour.c:509 [inline] ___neigh_create+0x4ac/0x23a0 net/core/neighbour.c:652 ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246 dst_output include/net/dst.h:489 [inline] NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325 mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870 ipv6_mc_dad_complete+0x87/0x410 net/ipv6/mcast.c:2296 addrconf_dad_completed+0x622/0xe60 net/ipv6/addrconf.c:4375 addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Call trace for syz_tun[48] +4 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dst_init+0x59/0x490 net/core/dst.c:128 dst_alloc+0x12a/0x170 net/core/dst.c:171 rt_dst_alloc net/ipv4/route.c:1649 [inline] __mkroute_output net/ipv4/route.c:2652 [inline] ip_route_output_key_hash_rcu+0x14ac/0x2720 net/ipv4/route.c:2872 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929 raw_sendmsg+0x110d/0x1a20 net/ipv4/raw.c:628 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:811 Call trace for syz_tun[49] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] ___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661 ip_neigh_gw4+0x27e/0x3a0 include/net/route.h:407 ip_neigh_for_gw include/net/route.h:425 [inline] ip_finish_output2+0xe6e/0x1100 net/ipv4/ip_output.c:230 ip_send_skb net/ipv4/ip_output.c:1506 [inline] ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1526 raw_sendmsg+0x1486/0x1a20 net/ipv4/raw.c:657 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:811 Call trace for syz_tun[50] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] tun_get+0x157/0x2f0 drivers/net/tun.c:802 tun_chr_poll+0x4f/0x640 drivers/net/tun.c:1392 vfs_poll include/linux/poll.h:82 [inline] do_pollfd fs/select.c:877 [inline] do_poll fs/select.c:920 [inline] do_sys_poll+0x92e/0xf50 fs/select.c:1015 __do_sys_ppoll fs/select.c:1112 [inline] __se_sys_ppoll+0x209/0x2b0 fs/select.c:1092 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[51] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] dev_put include/linux/netdevice.h:4601 [inline] tun_put drivers/net/tun.c:810 [inline] tun_chr_poll+0x39d/0x640 drivers/net/tun.c:1419 vfs_poll include/linux/poll.h:82 [inline] do_pollfd fs/select.c:877 [inline] do_poll fs/select.c:920 [inline] do_sys_poll+0x92e/0xf50 fs/select.c:1015 __do_sys_ppoll fs/select.c:1112 [inline] __se_sys_ppoll+0x209/0x2b0 fs/select.c:1092 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[52] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937 neigh_flush_dev net/core/neighbour.c:433 [inline] __neigh_ifdown+0x1f9/0x8f0 net/core/neighbour.c:466 neigh_ifdown+0x1f/0x30 net/core/neighbour.c:489 fib_netdev_event+0x318/0x490 net/ipv4/fib_frontend.c:-1 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_close_many+0x463/0x660 net/core/dev.c:1807 unregister_netdevice_many_notify+0xb76/0x2120 net/core/dev.c:12452 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] ____sys_sendmsg+0x565/0x870 net/socket.c:2727 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2781 __sys_sendmsg net/socket.c:2813 [inline] __do_sys_sendmsg net/socket.c:2818 [inline] __se_sys_sendmsg net/socket.c:2816 [inline] __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2816 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85 entry_SYSCALL_64_after_hwframe+0x77/0x7f Call trace for syz_tun[53] +2 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870 inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:903 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223 addrconf_ifdown+0xfcf/0x1a00 net/ipv6/addrconf.c:4013 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] netif_close_many+0x463/0x660 net/core/dev.c:1807 unregister_netdevice_many_notify+0xb76/0x2120 net/core/dev.c:12452 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[54] -5 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204 fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core kernel/rcu/tree.c:2897 [inline] rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Call trace for syz_tun[55] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] __qdisc_destroy+0x20e/0x480 net/sched/sch_generic.c:1126 qdisc_put net/sched/sch_generic.c:1150 [inline] dev_shutdown+0x352/0x450 net/sched/sch_generic.c:1515 unregister_netdevice_many_notify+0x11f0/0x2120 net/core/dev.c:12470 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[56] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline] netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[57] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline] netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[58] +1 at __dev_hold include/linux/netdevice.h:4523 [inline] netdev_hold include/linux/netdevice.h:4566 [inline] dev_hold include/linux/netdevice.h:4589 [inline] addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870 inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:889 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380 __inet_del_ifa+0xa69/0x1040 net/ipv4/devinet.c:450 inet_del_ifa net/ipv4/devinet.c:487 [inline] inetdev_destroy net/ipv4/devinet.c:328 [inline] inetdev_event+0x629/0x15e0 net/ipv4/devinet.c:1655 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[59] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812 inetdev_destroy net/ipv4/devinet.c:335 [inline] inetdev_event+0x7d6/0x15e0 net/ipv4/devinet.c:1655 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[60] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258 in_dev_put include/linux/inetdevice.h:290 [inline] inet_rcu_free_ifa+0x72/0xb0 net/ipv4/devinet.c:228 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core kernel/rcu/tree.c:2897 [inline] rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Call trace for syz_tun[61] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812 addrconf_ifdown+0x173a/0x1a00 net/ipv6/addrconf.c:4042 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[62] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:176 in6_dev_put include/net/addrconf.h:426 [inline] addrconf_ifdown+0x178c/0x1a00 net/ipv6/addrconf.c:4044 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2292 [inline] call_netdevice_notifiers net/core/dev.c:2306 [inline] unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[63] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] rx_queue_release+0x11d/0x190 net/core/net-sysfs.c:1160 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 net_rx_queue_update_kobjects+0x6d0/0x790 net/core/net-sysfs.c:1317 remove_queue_kobjects net/core/net-sysfs.c:2148 [inline] netdev_unregister_kobject+0xff/0x450 net/core/net-sysfs.c:2304 unregister_netdevice_many_notify+0x1bb1/0x2120 net/core/dev.c:12515 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[64] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1910 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 netdev_queue_update_kobjects+0x5d1/0x6b0 net/core/net-sysfs.c:2052 remove_queue_kobjects net/core/net-sysfs.c:2149 [inline] netdev_unregister_kobject+0x10b/0x450 net/core/net-sysfs.c:2304 unregister_netdevice_many_notify+0x1bb1/0x2120 net/core/dev.c:12515 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 Call trace for syz_tun[65] -1 at __dev_put include/linux/netdevice.h:4509 [inline] netdev_put include/linux/netdevice.h:4576 [inline] unregister_netdevice_many_notify+0x1df8/0x2120 net/core/dev.c:12535 rtnl_delete_link net/core/rtnetlink.c:3632 [inline] rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3674 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 balance as of syz_tun[65] is 2