Extracting prog: 7m38.85776002s Minimizing prog: 59m7.59772687s Simplifying prog options: 15m4.503447132s Extracting C: 5m12.18280573s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, 0x0, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash reproducing took 1h27m3.141757758s repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] dst_init+0xbc/0x3ec net/core/dst.c:52 dst_alloc+0x118/0x168 net/core/dst.c:93 rt_dst_alloc net/ipv4/route.c:1625 [inline] __mkroute_output net/ipv4/route.c:2617 [inline] ip_route_output_key_hash_rcu+0x116c/0x1e88 net/ipv4/route.c:2839 ip_route_output_key_hash+0x174/0x294 net/ipv4/route.c:2668 __ip_route_output_key include/net/route.h:141 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2896 ip_route_output_key include/net/route.h:151 [inline] geneve_link_config+0x174/0x550 drivers/net/geneve.c:1585 geneve_newlink+0x134/0x1a8 drivers/net/geneve.c:1638 rtnl_newlink_create+0x294/0x8e4 net/core/rtnetlink.c:3786 __rtnl_newlink net/core/rtnetlink.c:3896 [inline] rtnl_newlink+0x11fc/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x360/0x4d8 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2200 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] addrconf_add_linklocal+0x4cc/0x8b4 net/ipv6/addrconf.c:3338 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3467 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 ipv6_add_addr+0x4b4/0xde8 net/ipv6/addrconf.c:1120 addrconf_add_linklocal+0x2c4/0x8b4 net/ipv6/addrconf.c:3336 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3467 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_add_mroute net/ipv6/addrconf.c:2550 [inline] addrconf_add_dev+0x2b8/0x458 net/ipv6/addrconf.c:2568 addrconf_dev_config net/ipv6/addrconf.c:3503 [inline] addrconf_init_auto_addrs+0x70c/0xca0 net/ipv6/addrconf.c:3591 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3622 [inline] addrconf_permanent_addr+0x670/0xaf0 net/ipv6/addrconf.c:3646 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3718 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 fixup_permanent_addr net/ipv6/addrconf.c:3607 [inline] addrconf_permanent_addr+0x244/0xaf0 net/ipv6/addrconf.c:3646 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3718 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1217 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1237 fib_create_info+0x11d0/0x1ea4 net/ipv4/fib_semantics.c:1533 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x33c/0x4ec net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1217 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1237 fib_create_info+0x11d0/0x1ea4 net/ipv4/fib_semantics.c:1533 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x2e4/0x4ec net/ipv4/fib_frontend.c:1149 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc+0x68/0xb4 include/linux/netdevice.h:4148 fib_create_info+0x138c/0x1ea4 net/ipv4/fib_semantics.c:1527 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x118/0x4ec net/ipv4/fib_frontend.c:1134 fib_inetaddr_event+0x12c/0x200 net/ipv4/fib_frontend.c:1448 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380 __inet_insert_ifa+0x93c/0xb38 net/ipv4/devinet.c:575 inet_rtm_newaddr+0xf94/0x188c net/ipv4/devinet.c:1010 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x360/0x4d8 net/socket.c:2197 final repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] dst_init+0xbc/0x3ec net/core/dst.c:52 dst_alloc+0x118/0x168 net/core/dst.c:93 rt_dst_alloc net/ipv4/route.c:1625 [inline] __mkroute_output net/ipv4/route.c:2617 [inline] ip_route_output_key_hash_rcu+0x116c/0x1e88 net/ipv4/route.c:2839 ip_route_output_key_hash+0x174/0x294 net/ipv4/route.c:2668 __ip_route_output_key include/net/route.h:141 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2896 ip_route_output_key include/net/route.h:151 [inline] geneve_link_config+0x174/0x550 drivers/net/geneve.c:1585 geneve_newlink+0x134/0x1a8 drivers/net/geneve.c:1638 rtnl_newlink_create+0x294/0x8e4 net/core/rtnetlink.c:3786 __rtnl_newlink net/core/rtnetlink.c:3896 [inline] rtnl_newlink+0x11fc/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x360/0x4d8 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2200 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] addrconf_add_linklocal+0x4cc/0x8b4 net/ipv6/addrconf.c:3338 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3467 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 ipv6_add_addr+0x4b4/0xde8 net/ipv6/addrconf.c:1120 addrconf_add_linklocal+0x2c4/0x8b4 net/ipv6/addrconf.c:3336 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3467 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_add_mroute net/ipv6/addrconf.c:2550 [inline] addrconf_add_dev+0x2b8/0x458 net/ipv6/addrconf.c:2568 addrconf_dev_config net/ipv6/addrconf.c:3503 [inline] addrconf_init_auto_addrs+0x70c/0xca0 net/ipv6/addrconf.c:3591 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3764 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3622 [inline] addrconf_permanent_addr+0x670/0xaf0 net/ipv6/addrconf.c:3646 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3718 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc include/linux/netdevice.h:4148 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 fixup_permanent_addr net/ipv6/addrconf.c:3607 [inline] addrconf_permanent_addr+0x244/0xaf0 net/ipv6/addrconf.c:3646 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3718 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1217 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1237 fib_create_info+0x11d0/0x1ea4 net/ipv4/fib_semantics.c:1533 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x33c/0x4ec net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_hold include/linux/netdevice.h:4165 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1217 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1237 fib_create_info+0x11d0/0x1ea4 net/ipv4/fib_semantics.c:1533 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x2e4/0x4ec net/ipv4/fib_frontend.c:1149 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:9026 do_setlink+0x9f0/0x3640 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3874 [inline] rtnl_newlink+0x1168/0x1914 net/core/rtnetlink.c:4009 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 ref_tracker: syz_tun@000000007fcdd024 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4136 [inline] netdev_tracker_alloc+0x68/0xb4 include/linux/netdevice.h:4148 fib_create_info+0x138c/0x1ea4 net/ipv4/fib_semantics.c:1527 fib_table_insert+0x1a4/0x1570 net/ipv4/fib_trie.c:1231 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x118/0x4ec net/ipv4/fib_frontend.c:1134 fib_inetaddr_event+0x12c/0x200 net/ipv4/fib_frontend.c:1448 notifier_call_chain+0x1c4/0x550 kernel/notifier.c:85 blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380 __inet_insert_ifa+0x93c/0xb38 net/ipv4/devinet.c:575 inet_rtm_newaddr+0xf94/0x188c net/ipv4/devinet.c:1010 rtnetlink_rcv_msg+0x670/0xa9c net/core/rtnetlink.c:6919 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6946 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x360/0x4d8 net/socket.c:2197