bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves Unable to handle kernel paging request at virtual address 40ffffc1ffbf7fbf Mem abort info: ESR = 0x0000000096000045 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000042703000 [40ffffc1ffbf7fbf] pgd=1000000042bdc003, p4d=0000000042af8003, pud=0000000000000000 Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 7925 Comm: kworker/u8:4 Not tainted 6.11.0-rc7-syzkaller-00097-g196145c606d0 #0 Hardware name: linux,dummy-virt (DT) Workqueue: netns cleanup_net pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __skb_unlink include/linux/skbuff.h:2418 [inline] pc : __skb_dequeue include/linux/skbuff.h:2434 [inline] pc : __skb_queue_purge_reason include/linux/skbuff.h:3288 [inline] pc : __skb_queue_purge include/linux/skbuff.h:3294 [inline] pc : gro_cells_destroy net/core/gro_cells.c:118 [inline] pc : gro_cells_destroy+0xe8/0x164 net/core/gro_cells.c:106 lr : gro_cells_destroy net/core/gro_cells.c:117 [inline] lr : gro_cells_destroy+0xb8/0x164 net/core/gro_cells.c:106 sp : ffff800089373bd0 x29: ffff800089373bd0 x28: f3f00000039b0000 x27: ffffc1ffbf7fb738 x26: fff07ffffd281000 x25: 000f41ffc257a720 x24: 0000000000000001 x23: ffff800082433000 x22: ffff800082693350 x21: fcf0000011e72af0 x20: 0000000000000001 x19: ffffc1ffbf7fb720 x18: 0000000000000001 x17: ffff80008155ac00 x16: ffff800081848b40 x15: ffff8000815a256c x14: ffff8000802bf344 x13: ffff800080015688 x12: ffff8000800d20cc x11: ffff8000800c97dc x10: ffff8000800c8e14 x9 : 0000000000000003 x8 : ffff800089373bc0 x7 : 00000000000002f2 x6 : 00000000fffffff0 x5 : f1f0000002ec0800 x4 : 40ffffc1ffbf7fb7 x3 : ffffffc1ffbf7fb7 x2 : 0000000000000055 x1 : ffffc1ffbf7fb721 x0 : 0000000000000000 Call trace: __skb_unlink include/linux/skbuff.h:2417 [inline] __skb_dequeue include/linux/skbuff.h:2434 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3288 [inline] __skb_queue_purge include/linux/skbuff.h:3294 [inline] gro_cells_destroy net/core/gro_cells.c:118 [inline] gro_cells_destroy+0xe8/0x164 net/core/gro_cells.c:106 ip6_dev_free+0x1c/0x34 net/ipv6/ip6_tunnel.c:248 netdev_run_todo+0x1cc/0x58c net/core/dev.c:10762 rtnl_unlock+0x10/0x1c net/core/rtnetlink.c:152 cleanup_net+0x278/0x4a0 net/core/net_namespace.c:636 process_one_work+0x15c/0x29c kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x24c/0x354 kernel/workqueue.c:3393 kthread+0x114/0x118 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: 51000463 b9001263 a9400c24 a9007c3f (f9000483) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 51000463 sub w3, w3, #0x1 4: b9001263 str w3, [x19, #16] 8: a9400c24 ldp x4, x3, [x1] c: a9007c3f stp xzr, xzr, [x1] * 10: f9000483 str x3, [x4, #8] <-- trapping instruction