device veth0_vlan left promiscuous mode ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: null-ptr-deref in atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] BUG: KASAN: null-ptr-deref in atomic_long_set include/asm-generic/atomic-long.h:41 [inline] BUG: KASAN: null-ptr-deref in rwsem_clear_owner kernel/locking/rwsem.c:183 [inline] BUG: KASAN: null-ptr-deref in __up_write kernel/locking/rwsem.c:1480 [inline] BUG: KASAN: null-ptr-deref in up_write+0x2e/0x120 kernel/locking/rwsem.c:1621 Write of size 8 at addr 0000000000000070 by task kworker/u4:2/110 CPU: 0 PID: 110 Comm: kworker/u4:2 Tainted: G W 5.10.222-syzkaller-01494-gfd58936f3c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0x167/0x1c0 mm/kasan/report.c:452 kasan_check_range+0x293/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_write include/linux/instrumented.h:86 [inline] atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] atomic_long_set include/asm-generic/atomic-long.h:41 [inline] rwsem_clear_owner kernel/locking/rwsem.c:183 [inline] __up_write kernel/locking/rwsem.c:1480 [inline] up_write+0x2e/0x120 kernel/locking/rwsem.c:1621 kernfs_drain fs/kernfs/dir.c:475 [inline] __kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1394 kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1598 kernfs_remove_by_name include/linux/kernfs.h:623 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289 sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313 device_remove_groups drivers/base/core.c:2371 [inline] device_remove_attrs+0x113/0x130 drivers/base/core.c:2568 device_del+0x683/0xf00 drivers/base/core.c:3451 netdev_unregister_kobject+0x18a/0x250 net/core/net-sysfs.c:1963 unregister_netdevice_many+0x1276/0x17d0 net/core/dev.c:10774 default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11267 ops_exit_list net/core/net_namespace.c:190 [inline] cleanup_net+0x6e9/0xcb0 net/core/net_namespace.c:609 process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301 worker_thread+0xaea/0x1510 kernel/workqueue.c:2447 kthread+0x34b/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 ================================================================== general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 110 Comm: kworker/u4:2 Tainted: G B W 5.10.222-syzkaller-01494-gfd58936f3c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: netns cleanup_net RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] RIP: 0010:atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] RIP: 0010:atomic_long_set include/asm-generic/atomic-long.h:41 [inline] RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:183 [inline] RIP: 0010:__up_write kernel/locking/rwsem.c:1480 [inline] RIP: 0010:up_write+0x35/0x120 kernel/locking/rwsem.c:1621 Code: 49 89 ff 49 bc 00 00 00 00 00 fc ff df 0f 1f 44 00 00 49 8d 5f 08 48 89 df be 08 00 00 00 e8 72 d1 57 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 fc cf 57 00 49 c7 47 08 00 00 00 RSP: 0018:ffffc90000ba7610 EFLAGS: 00010202 RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810d5013c0 RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff RBP: ffffc90000ba7630 R08: ffffffff813e275b R09: 0000000000000003 R10: fffffbfff0e10c48 R11: dffffc0000000001 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888107fed004 R15: 0000000000000068 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd4c9806ab8 CR3: 000000010c879000 CR4: 00000000003526a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain fs/kernfs/dir.c:475 [inline] __kernfs_remove+0x4b2/0x9d0 fs/kernfs/dir.c:1394 kernfs_remove_by_name_ns+0xec/0x160 fs/kernfs/dir.c:1598 kernfs_remove_by_name include/linux/kernfs.h:623 [inline] remove_files fs/sysfs/group.c:28 [inline] sysfs_remove_group+0x10c/0x2a0 fs/sysfs/group.c:289 sysfs_remove_groups+0x56/0xb0 fs/sysfs/group.c:313 device_remove_groups drivers/base/core.c:2371 [inline] device_remove_attrs+0x113/0x130 drivers/base/core.c:2568 device_del+0x683/0xf00 drivers/base/core.c:3451 netdev_unregister_kobject+0x18a/0x250 net/core/net-sysfs.c:1963 unregister_netdevice_many+0x1276/0x17d0 net/core/dev.c:10774 default_device_exit_batch+0x38a/0x3f0 net/core/dev.c:11267 ops_exit_list net/core/net_namespace.c:190 [inline] cleanup_net+0x6e9/0xcb0 net/core/net_namespace.c:609 process_one_work+0x6dc/0xbd0 kernel/workqueue.c:2301 worker_thread+0xaea/0x1510 kernel/workqueue.c:2447 kthread+0x34b/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Modules linked in: ---[ end trace 886394d48d77c520 ]--- RIP: 0010:arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] RIP: 0010:atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] RIP: 0010:atomic_long_set include/asm-generic/atomic-long.h:41 [inline] RIP: 0010:rwsem_clear_owner kernel/locking/rwsem.c:183 [inline] RIP: 0010:__up_write kernel/locking/rwsem.c:1480 [inline] RIP: 0010:up_write+0x35/0x120 kernel/locking/rwsem.c:1621 Code: 49 89 ff 49 bc 00 00 00 00 00 fc ff df 0f 1f 44 00 00 49 8d 5f 08 48 89 df be 08 00 00 00 e8 72 d1 57 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 fc cf 57 00 49 c7 47 08 00 00 00 RSP: 0018:ffffc90000ba7610 EFLAGS: 00010202 RAX: 000000000000000e RBX: 0000000000000070 RCX: ffff88810d5013c0 RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff RBP: ffffc90000ba7630 R08: ffffffff813e275b R09: 0000000000000003 R10: fffffbfff0e10c48 R11: dffffc0000000001 R12: dffffc0000000000 R13: dffffc0000000000 R14: ffff888107fed004 R15: 0000000000000068 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efe1a0e9000 CR3: 000000011d3c1000 CR4: 00000000003526b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 49 89 ff mov %rdi,%r15 3: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 a: fc ff df d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 12: 49 8d 5f 08 lea 0x8(%r15),%rbx 16: 48 89 df mov %rbx,%rdi 19: be 08 00 00 00 mov $0x8,%esi 1e: e8 72 d1 57 00 call 0x57d195 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 fc cf 57 00 call 0x57d035 39: 49 rex.WB 3a: c7 .byte 0xc7 3b: 47 08 00 rex.RXB or %r8b,(%r8)