device veth1_macvtap left promiscuous mode
device veth0_vlan left promiscuous mode
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline]
BUG: KASAN: null-ptr-deref in atomic_long_set include/linux/atomic/atomic-instrumented.h:1197 [inline]
BUG: KASAN: null-ptr-deref in rwsem_clear_owner kernel/locking/rwsem.c:151 [inline]
BUG: KASAN: null-ptr-deref in __up_write kernel/locking/rwsem.c:1413 [inline]
BUG: KASAN: null-ptr-deref in up_write+0x38/0x1f0 kernel/locking/rwsem.c:1666
Write of size 8 at addr 0000000000000070 by task kworker/u4:3/323
CPU: 1 PID: 323 Comm: kworker/u4:3 Not tainted 5.15.150-syzkaller-00330-g9044d25b8ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
__kasan_report mm/kasan/report.c:431 [inline]
kasan_report+0x16f/0x1c0 mm/kasan/report.c:444
kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189
__kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
instrument_atomic_write include/linux/instrumented.h:86 [inline]
atomic_long_set include/linux/atomic/atomic-instrumented.h:1197 [inline]
rwsem_clear_owner kernel/locking/rwsem.c:151 [inline]
__up_write kernel/locking/rwsem.c:1413 [inline]
up_write+0x38/0x1f0 kernel/locking/rwsem.c:1666
kernfs_drain fs/kernfs/dir.c:475 [inline]
__kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1390
kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1594
kernfs_remove_by_name include/linux/kernfs.h:619 [inline]
remove_files fs/sysfs/group.c:28 [inline]
sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289
sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313
device_remove_groups drivers/base/core.c:2490 [inline]
device_remove_attrs+0x124/0x140 drivers/base/core.c:2696
device_del+0x65b/0xe90 drivers/base/core.c:3591
netdev_unregister_kobject+0x18b/0x260 net/core/net-sysfs.c:1980
unregister_netdevice_many+0x1295/0x17c0 net/core/dev.c:11132
default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11638
ops_exit_list net/core/net_namespace.c:174 [inline]
cleanup_net+0x6ce/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
kthread+0x421/0x510 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
==================================================================
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 1 PID: 323 Comm: kworker/u4:3 Tainted: G B 5.15.150-syzkaller-00330-g9044d25b8ff5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: netns cleanup_net
RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
RIP: 0010:arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
RIP: 0010:atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:151 [inline]
RIP: 0010:__up_write kernel/locking/rwsem.c:1413 [inline]
RIP: 0010:up_write+0x3f/0x1f0 kernel/locking/rwsem.c:1666
Code: fc ff df 0f 1f 44 00 00 bf 01 00 00 00 e8 99 6f f7 ff 49 8d 5f 08 48 89 df be 08 00 00 00 e8 b8 b9 5d 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 42 b8 5d 00 49 c7 47 08 00 00 00
RSP: 0018:ffffc900038975f0 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810b7ba780
RDX: 0000000000000000 RSI: 0000000000000296 RDI: 00000000ffffffff
RBP: ffffc90003897610 R08: ffffffff8141701b R09: 0000000000000003
R10: fffffbfff0e5284c R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888110f4f004 R15: 0000000000000068
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc0756298 CR3: 000000011f001000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kernfs_drain fs/kernfs/dir.c:475 [inline]
__kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1390
kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1594
kernfs_remove_by_name include/linux/kernfs.h:619 [inline]
remove_files fs/sysfs/group.c:28 [inline]
sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289
sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313
device_remove_groups drivers/base/core.c:2490 [inline]
device_remove_attrs+0x124/0x140 drivers/base/core.c:2696
device_del+0x65b/0xe90 drivers/base/core.c:3591
netdev_unregister_kobject+0x18b/0x260 net/core/net-sysfs.c:1980
unregister_netdevice_many+0x1295/0x17c0 net/core/dev.c:11132
default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11638
ops_exit_list net/core/net_namespace.c:174 [inline]
cleanup_net+0x6ce/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
kthread+0x421/0x510 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 45195fd6b9efea6c ]---
RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
RIP: 0010:arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
RIP: 0010:atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:151 [inline]
RIP: 0010:__up_write kernel/locking/rwsem.c:1413 [inline]
RIP: 0010:up_write+0x3f/0x1f0 kernel/locking/rwsem.c:1666
Code: fc ff df 0f 1f 44 00 00 bf 01 00 00 00 e8 99 6f f7 ff 49 8d 5f 08 48 89 df be 08 00 00 00 e8 b8 b9 5d 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 42 b8 5d 00 49 c7 47 08 00 00 00
RSP: 0018:ffffc900038975f0 EFLAGS: 00010202
RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810b7ba780
RDX: 0000000000000000 RSI: 0000000000000296 RDI: 00000000ffffffff
RBP: ffffc90003897610 R08: ffffffff8141701b R09: 0000000000000003
R10: fffffbfff0e5284c R11: dffffc0000000001 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888110f4f004 R15: 0000000000000068
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc0756298 CR3: 000000011f001000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
5: bf 01 00 00 00 mov $0x1,%edi
a: e8 99 6f f7 ff call 0xfff76fa8
f: 49 8d 5f 08 lea 0x8(%r15),%rbx
13: 48 89 df mov %rbx,%rdi
16: be 08 00 00 00 mov $0x8,%esi
1b: e8 b8 b9 5d 00 call 0x5db9d8
20: 48 89 d8 mov %rbx,%rax
23: 48 c1 e8 03 shr $0x3,%rax
* 27: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2c: 74 08 je 0x36
2e: 48 89 df mov %rbx,%rdi
31: e8 42 b8 5d 00 call 0x5db878
36: 49 rex.WB
37: c7 .byte 0xc7
38: 47 08 00 rex.RXB or %r8b,(%r8)