------------[ cut here ]------------ ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:177 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: __refcount_sub_and_test include/linux/refcount.h:272 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: __refcount_dec_and_test include/linux/refcount.h:315 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: refcount_dec_and_test include/linux/refcount.h:333 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: kref_put include/linux/kref.h:64 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: batadv_dat_entry_put net/batman-adv/distributed-arp-table.c:133 [inline] ODEBUG: free active (active state 0) object: 0000000004d8d0e3 object type: timer_list hint: batadv_dat_purge+0x0/0x154 net/batman-adv/distributed-arp-table.c:1829 WARNING: CPU: 1 PID: 39 at lib/debugobjects.c:512 debug_print_object lib/debugobjects.c:509 [inline] WARNING: CPU: 1 PID: 39 at lib/debugobjects.c:512 __debug_check_no_obj_freed lib/debugobjects.c:996 [inline] WARNING: CPU: 1 PID: 39 at lib/debugobjects.c:512 debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027 Modules linked in: CPU: 1 PID: 39 Comm: kworker/u4:2 Not tainted 6.3.0-rc1-syzkaller-gfe15c26ee26e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Workqueue: netns cleanup_net pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : debug_print_object lib/debugobjects.c:509 [inline] pc : __debug_check_no_obj_freed lib/debugobjects.c:996 [inline] pc : debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027 lr : debug_print_object lib/debugobjects.c:509 [inline] lr : __debug_check_no_obj_freed lib/debugobjects.c:996 [inline] lr : debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027 sp : ffff80001a8c75d0 x29: ffff80001a8c7620 x28: ffff8000125dee40 x27: dfff800000000000 x26: ffff00012c2794f8 x25: 0000000000000000 x24: ffff80001a0f4270 x23: ffff8000125dee40 x22: ffff00012c2794f8 x21: ffff80001a0f4268 x20: ffff800012a9a9d8 x19: ffff00012c278000 x18: ffff80001a8c6ac0 x17: 626f203365306438 x16: ffff80001246250c x15: 0000000000000000 x14: 0000000000000000 x13: 000000000003b530 x12: 0000000000000001 x11: ff808000081bd230 x10: 0000000000000000 x9 : 7c26e147817c0f00 x8 : 7c26e147817c0f00 x7 : 000000000003b530 x6 : 000000000003b500 x5 : ffff80001a8c6eb8 x4 : ffff800015dba0d0 x3 : ffff80000859c514 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: debug_print_object lib/debugobjects.c:509 [inline] __debug_check_no_obj_freed lib/debugobjects.c:996 [inline] debug_check_no_obj_freed+0x410/0x528 lib/debugobjects.c:1027 slab_free_hook mm/slub.c:1756 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x258/0x4b4 mm/slub.c:3800 kfree+0x104/0x228 mm/slab_common.c:1019 kvfree+0x40/0x50 mm/util.c:649 netdev_freemem+0x4c/0x64 net/core/dev.c:10541 netdev_release+0x88/0xb0 net/core/net-sysfs.c:1938 device_release+0x8c/0x1ac kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x2a8/0x41c lib/kobject.c:729 netdev_run_todo+0xcf0/0xe08 net/core/dev.c:10361 rtnl_unlock+0x14/0x20 net/core/rtnetlink.c:148 default_device_exit_batch+0x6cc/0x744 net/core/dev.c:11353 ops_exit_list net/core/net_namespace.c:174 [inline] cleanup_net+0x5dc/0x8d0 net/core/net_namespace.c:613 process_one_work+0x868/0x16f4 kernel/workqueue.c:2390 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2537 kthread+0x24c/0x2d4 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 irq event stamp: 28350552 hardirqs last enabled at (28350551): [] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345 hardirqs last disabled at (28350552): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (28350478): [] spin_unlock_bh include/linux/spinlock.h:395 [inline] softirqs last enabled at (28350478): [] batadv_tvlv_handler_unregister+0x158/0x254 net/batman-adv/tvlv.c:602 softirqs last disabled at (28350476): [] spin_lock_bh include/linux/spinlock.h:355 [inline] softirqs last disabled at (28350476): [] batadv_tvlv_handler_unregister+0xc4/0x254 net/batman-adv/tvlv.c:600 ---[ end trace 0000000000000000 ]--- netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): Released all slaves netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0