------------[ cut here ]------------
hook not found, pf 3 num 0
WARNING: CPU: 1 PID: 1124 at net/netfilter/core.c:480 __nf_unregister_net_hook+0xac/0x1d0 net/netfilter/core.c:480
Modules linked in:
CPU: 1 PID: 1124 Comm: kworker/u4:6 Not tainted 5.12.0-syzkaller-14859-g1ad77a05cfae #0
Hardware name: linux,dummy-virt (DT)
Workqueue: netns cleanup_net
pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)
pc : __nf_unregister_net_hook+0xac/0x1d0 net/netfilter/core.c:480
lr : __nf_unregister_net_hook+0xac/0x1d0 net/netfilter/core.c:480
sp : ffff800013e83c80
x29: ffff800013e83c80 x28: ffff80001293d510 x27: ffff800012739838
x26: ffff8000128f42c0 x25: ffff8000128f4440 x24: f8ff0000068d0300
x23: faff0000062e09f0 x22: faff0000062e0000 x21: ffff8000128fc410
x20: 0000000000000003 x19: fcff0000059de200 x18: 00000000fffffffe
x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000020
x14: ffffffffffffffff x13: 00000000000002fb x12: ffff800013e83950
x11: ffff8000127f0dd0 x10: ffff80001274cc90 x9 : ffff8000127ec648
x8 : ffff80001273c648 x7 : ffff8000127ec648 x6 : fffffffffffcbe00
x5 : ffff00007fbd0948 x4 : 0000000000015ff5 x3 : 0000000000000001
x2 : 0000000000000000 x1 : 0000000000000000 x0 : f2ff000003371e80
Call trace:
 __nf_unregister_net_hook+0xac/0x1d0 net/netfilter/core.c:480
 nf_unregister_net_hook net/netfilter/core.c:502 [inline]
 nf_unregister_net_hooks+0x88/0xac net/netfilter/core.c:576
 arpt_unregister_table_pre_exit+0x40/0x50 net/ipv4/netfilter/arp_tables.c:1565
 arptable_filter_net_pre_exit+0x20/0x2c net/ipv4/netfilter/arptable_filter.c:57
 ops_pre_exit_list net/core/net_namespace.c:165 [inline]
 cleanup_net+0x200/0x410 net/core/net_namespace.c:583
 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275
 worker_thread+0x70/0x434 kernel/workqueue.c:2421
 kthread+0x174/0x180 kernel/kthread.c:313
 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:995
---[ end trace b15dc78eeee2b9fa ]---
netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
device hsr_slave_0 left promiscuous mode
device hsr_slave_1 left promiscuous mode
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): Released all slaves
==================================================================
BUG: KASAN: invalid-access in hooks_validate+0x38/0x7c net/netfilter/core.c:174
Read at addr f0ff0000068d0248 by task kworker/u4:6/1124
Pointer tag: [f0], memory tag: [fe]

CPU: 0 PID: 1124 Comm: kworker/u4:6 Tainted: G        W         5.12.0-syzkaller-14859-g1ad77a05cfae #0
Hardware name: linux,dummy-virt (DT)
Workqueue: netns cleanup_net
Call trace:
 dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:138
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:217
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xd0/0x12c lib/dump_stack.c:120
 print_address_description+0x70/0x2ac mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report+0x134/0x380 mm/kasan/report.c:436
 report_tag_fault arch/arm64/mm/fault.c:324 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:336 [inline]
 __do_kernel_fault+0x1a8/0x1dc arch/arm64/mm/fault.c:378
 do_bad_area arch/arm64/mm/fault.c:474 [inline]
 do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:745
 do_mem_abort+0x44/0xbc arch/arm64/mm/fault.c:821
 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:171
 el1_sync_handler+0xac/0xd0 arch/arm64/kernel/entry-common.c:255
 el1_sync+0x78/0x100 arch/arm64/kernel/entry.S:710
 hooks_validate+0x38/0x7c net/netfilter/core.c:174
 __nf_unregister_net_hook+0x114/0x1d0 net/netfilter/core.c:483
 nf_unregister_net_hook+0x64/0x74 net/netfilter/core.c:502
 clusterip_net_exit+0x60/0x7c net/ipv4/netfilter/ipt_CLUSTERIP.c:853
 ops_exit_list+0x44/0x80 net/core/net_namespace.c:175
 cleanup_net+0x23c/0x410 net/core/net_namespace.c:595
 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275
 worker_thread+0x70/0x434 kernel/workqueue.c:2421
 kthread+0x174/0x180 kernel/kthread.c:313
 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:995

Allocated by task 3303:
 kasan_save_stack+0x28/0x5c mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 ____kasan_kmalloc mm/kasan/common.c:507 [inline]
 ____kasan_kmalloc mm/kasan/common.c:466 [inline]
 __kasan_kmalloc+0xc8/0x100 mm/kasan/common.c:516
 kasan_kmalloc include/linux/kasan.h:246 [inline]
 kmem_cache_alloc_trace include/linux/slab.h:454 [inline]
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 allocate_cgrp_cset_links+0x98/0x100 kernel/cgroup/cgroup.c:1119
 find_css_set+0x210/0x640 kernel/cgroup/cgroup.c:1197
 cgroup_migrate_prepare_dst+0x5c/0x234 kernel/cgroup/cgroup.c:2641
 cgroup_attach_task+0xbc/0x11c kernel/cgroup/cgroup.c:2747
 __cgroup1_procs_write.constprop.0+0x128/0x170 kernel/cgroup/cgroup-v1.c:519
 cgroup1_procs_write+0x14/0x20 kernel/cgroup/cgroup-v1.c:532
 cgroup_file_write+0x94/0x1a0 kernel/cgroup/cgroup.c:3711
 kernfs_fop_write_iter+0x128/0x1c0 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2114 [inline]
 new_sync_write+0xe8/0x184 fs/read_write.c:518
 vfs_write+0x244/0x2a4 fs/read_write.c:605
 ksys_write+0x68/0xf4 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __arm64_sys_write+0x20/0x2c fs/read_write.c:667
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:52
 el0_svc_common.constprop.0+0x44/0xd0 arch/arm64/kernel/syscall.c:145
 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:184
 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:408
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:424
 el0_sync+0x1b4/0x1c0 arch/arm64/kernel/entry.S:734

Freed by task 1124:
 kasan_save_stack+0x28/0x5c mm/kasan/common.c:38
 kasan_set_track+0x28/0x40 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/hw_tags.c:226
 ____kasan_slab_free.constprop.0+0x1dc/0x254 mm/kasan/common.c:360
 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:368
 kasan_slab_free include/linux/kasan.h:212 [inline]
 slab_free_hook mm/slub.c:1581 [inline]
 slab_free_freelist_hook+0xc0/0x220 mm/slub.c:1606
 slab_free mm/slub.c:3166 [inline]
 kfree+0x350/0x4c4 mm/slub.c:4225
 xt_unregister_table+0x8c/0xcc net/netfilter/x_tables.c:1501
 __arpt_unregister_table+0x2c/0xcc net/ipv4/netfilter/arp_tables.c:1488
 arpt_unregister_table+0x30/0x40 net/ipv4/netfilter/arp_tables.c:1574
 arptable_filter_net_exit+0x18/0x24 net/ipv4/netfilter/arptable_filter.c:62
 ops_exit_list+0x44/0x80 net/core/net_namespace.c:175
 cleanup_net+0x23c/0x410 net/core/net_namespace.c:595
 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275
 worker_thread+0x70/0x434 kernel/workqueue.c:2421
 kthread+0x174/0x180 kernel/kthread.c:313
 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:995

The buggy address belongs to the object at ffff0000068d0200
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 72 bytes inside of
 128-byte region [ffff0000068d0200, ffff0000068d0280)
The buggy address belongs to the page:
page:0000000045416bc7 refcount:1 mapcount:0 mapping:0000000000000000 index:0xf4ff0000068d0100 pfn:0x468d0
flags: 0x1ffc00000000200(slab|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0)
raw: 01ffc00000000200 fffffc0000182880 0000000600000006 f2ff000003001200
raw: f4ff0000068d0100 000000008010000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000068d0000: fb fb fb fb fe fe fe fe fe fe fe fe fe fe fe fe
 ffff0000068d0100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffff0000068d0200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                               ^
 ffff0000068d0300: f8 f8 f8 f8 fe fe fe fe fe fe fe fe fe fe fe fe
 ffff0000068d0400: f4 f4 f4 f4 f4 f4 f4 f4 fe fe fe fe fe fe fe fe
==================================================================