------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 0 PID: 28835 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 0 PID: 28835 Comm: kworker/u4:8 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 9e 9c 81 09 31 ff 89 de e8 6d 11 9d fd 84 db 75 e0 e8 84 0d 9d fd 48 c7 c7 60 cb e4 89 c6 05 7e 9c 81 09 01 e8 78 77 1c 05 <0f> 0b eb c4 e8 68 0d 9d fd 0f b6 1d 6d 9c 81 09 31 ff 89 de e8 38
RSP: 0018:ffffc90000007df0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88808412ba00 RSI: ffffffff815f39c8 RDI: fffff52000000fb0
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815ed79e R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880284685b0 R14: 0000000000000006 R15: ffff888073a9d1e8
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 0000000051e70000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_dec include/linux/refcount.h:344 [inline]
refcount_dec include/linux/refcount.h:359 [inline]
dev_put include/linux/netdevice.h:4166 [inline]
in_dev_finish_destroy+0x160/0x1b0 net/ipv4/devinet.c:246
in_dev_put include/linux/inetdevice.h:276 [inline]
in_dev_rcu_put+0x83/0xb0 net/ipv4/devinet.c:303
rcu_do_batch kernel/rcu/tree.c:2506 [inline]
rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2741
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:vrf_device_event+0x20/0x120 drivers/net/vrf.c:1848
Code: 2b e5 fc e9 38 fe ff ff 66 90 41 54 55 48 89 d5 53 48 89 f3 e8 81 73 9e fc 48 89 de bf 06 00 00 00 e8 04 76 9e fc 48 83 fb 06 <74> 0c e8 69 73 9e fc 31 c0 5b 5d 41 5c c3 e8 5d 73 9e fc 48 89 ea
RSP: 0018:ffffc90006057980 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffff88808412ba00 RDI: 0000000000000003
RBP: ffffc90006057ab8 R08: 0000000000000006 R09: 0000000000000001
R10: ffffffff84d952fc R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8c6cf800 R14: 0000000000000000 R15: ffffffff8d7121c0
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2002
call_netdevice_notifiers_extack net/core/dev.c:2014 [inline]
call_netdevice_notifiers net/core/dev.c:2028 [inline]
unregister_netdevice_many+0x94f/0x1790 net/core/dev.c:11077
default_device_exit_batch+0x2fa/0x3c0 net/core/dev.c:11607
ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:593
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 2b e5 sub %ebp,%esp
2: fc cld
3: e9 38 fe ff ff jmpq 0xfffffe40
8: 66 90 xchg %ax,%ax
a: 41 54 push %r12
c: 55 push %rbp
d: 48 89 d5 mov %rdx,%rbp
10: 53 push %rbx
11: 48 89 f3 mov %rsi,%rbx
14: e8 81 73 9e fc callq 0xfc9e739a
19: 48 89 de mov %rbx,%rsi
1c: bf 06 00 00 00 mov $0x6,%edi
21: e8 04 76 9e fc callq 0xfc9e762a
26: 48 83 fb 06 cmp $0x6,%rbx
* 2a: 74 0c je 0x38 <-- trapping instruction
2c: e8 69 73 9e fc callq 0xfc9e739a
31: 31 c0 xor %eax,%eax
33: 5b pop %rbx
34: 5d pop %rbp
35: 41 5c pop %r12
37: c3 retq
38: e8 5d 73 9e fc callq 0xfc9e739a
3d: 48 89 ea mov %rbp,%rdx