Extracting prog: 6m11.890408888s Minimizing prog: 1h0m59.158782245s Simplifying prog options: 12m31.682579457s Extracting C: 5m13.429180769s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, 0x0, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m3.86622751s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash testing program (duration=6m3.86622751s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-timer_create-timer_settime detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) program did not crash reproducing took 1h24m56.160968844s repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] dst_init+0xbc/0x3ec net/core/dst.c:52 dst_alloc+0x118/0x168 net/core/dst.c:93 rt_dst_alloc net/ipv4/route.c:1612 [inline] __mkroute_output net/ipv4/route.c:2573 [inline] ip_route_output_key_hash_rcu+0x116c/0x1e88 net/ipv4/route.c:2795 ip_route_output_key_hash+0x174/0x294 net/ipv4/route.c:2624 __ip_route_output_key include/net/route.h:141 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2852 ip_route_output_key include/net/route.h:151 [inline] geneve_link_config+0x174/0x550 drivers/net/geneve.c:1585 geneve_newlink+0x134/0x1a8 drivers/net/geneve.c:1638 rtnl_newlink_create net/core/rtnetlink.c:3539 [inline] __rtnl_newlink net/core/rtnetlink.c:3759 [inline] rtnl_newlink+0x1188/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1886 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2214 __do_sys_sendto net/socket.c:2226 [inline] __se_sys_sendto net/socket.c:2222 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2222 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] addrconf_add_linklocal+0x4cc/0x8b4 net/ipv6/addrconf.c:3319 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3448 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 ipv6_add_addr+0x4b4/0xde8 net/ipv6/addrconf.c:1120 addrconf_add_linklocal+0x2c4/0x8b4 net/ipv6/addrconf.c:3317 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3448 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_add_mroute net/ipv6/addrconf.c:2550 [inline] addrconf_add_dev+0x2b8/0x458 net/ipv6/addrconf.c:2568 addrconf_dev_config net/ipv6/addrconf.c:3484 [inline] addrconf_init_auto_addrs+0x70c/0xca0 net/ipv6/addrconf.c:3572 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3603 [inline] addrconf_permanent_addr+0x670/0xaf0 net/ipv6/addrconf.c:3627 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3699 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 fixup_permanent_addr net/ipv6/addrconf.c:3588 [inline] addrconf_permanent_addr+0x244/0xaf0 net/ipv6/addrconf.c:3627 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3699 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1238 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1258 fib_create_info+0x105c/0x1e04 net/ipv4/fib_semantics.c:1556 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x33c/0x4ec net/ipv4/fib_frontend.c:1148 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1486 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1238 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1258 fib_create_info+0x105c/0x1e04 net/ipv4/fib_semantics.c:1556 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x2e4/0x4ec net/ipv4/fib_frontend.c:1141 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1486 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc+0x68/0xb4 include/linux/netdevice.h:4074 fib_create_info+0x1214/0x1e04 net/ipv4/fib_semantics.c:1550 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x118/0x4ec net/ipv4/fib_frontend.c:1126 fib_inetaddr_event+0x12c/0x200 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:388 __inet_insert_ifa+0x8b0/0xac8 net/ipv4/devinet.c:586 inet_rtm_newaddr+0xf90/0x18e4 net/ipv4/devinet.c:997 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1886 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2214 final repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] dst_init+0xbc/0x3ec net/core/dst.c:52 dst_alloc+0x118/0x168 net/core/dst.c:93 rt_dst_alloc net/ipv4/route.c:1612 [inline] __mkroute_output net/ipv4/route.c:2573 [inline] ip_route_output_key_hash_rcu+0x116c/0x1e88 net/ipv4/route.c:2795 ip_route_output_key_hash+0x174/0x294 net/ipv4/route.c:2624 __ip_route_output_key include/net/route.h:141 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2852 ip_route_output_key include/net/route.h:151 [inline] geneve_link_config+0x174/0x550 drivers/net/geneve.c:1585 geneve_newlink+0x134/0x1a8 drivers/net/geneve.c:1638 rtnl_newlink_create net/core/rtnetlink.c:3539 [inline] __rtnl_newlink net/core/rtnetlink.c:3759 [inline] rtnl_newlink+0x1188/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1886 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2214 __do_sys_sendto net/socket.c:2226 [inline] __se_sys_sendto net/socket.c:2222 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2222 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] addrconf_add_linklocal+0x4cc/0x8b4 net/ipv6/addrconf.c:3319 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3448 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 ipv6_add_addr+0x4b4/0xde8 net/ipv6/addrconf.c:1120 addrconf_add_linklocal+0x2c4/0x8b4 net/ipv6/addrconf.c:3317 addrconf_addr_gen+0x3d4/0x8f4 net/ipv6/addrconf.c:3448 addrconf_init_auto_addrs+0x798/0xca0 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_add_mroute net/ipv6/addrconf.c:2550 [inline] addrconf_add_dev+0x2b8/0x458 net/ipv6/addrconf.c:2568 addrconf_dev_config net/ipv6/addrconf.c:3484 [inline] addrconf_init_auto_addrs+0x70c/0xca0 net/ipv6/addrconf.c:3572 addrconf_notify+0x8d0/0xce8 net/ipv6/addrconf.c:3745 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 ip6_route_add+0x38/0x194 net/ipv6/route.c:3853 addrconf_prefix_route net/ipv6/addrconf.c:2486 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3603 [inline] addrconf_permanent_addr+0x670/0xaf0 net/ipv6/addrconf.c:3627 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3699 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc include/linux/netdevice.h:4074 [inline] netdev_get_by_index+0x88/0xe4 net/core/dev.c:916 fib6_nh_init+0x1ac/0x1c58 net/ipv6/route.c:3543 ip6_route_info_create+0x790/0xefc net/ipv6/route.c:3809 addrconf_f6i_alloc+0x2c4/0x5d0 net/ipv6/route.c:4588 fixup_permanent_addr net/ipv6/addrconf.c:3588 [inline] addrconf_permanent_addr+0x244/0xaf0 net/ipv6/addrconf.c:3627 addrconf_notify+0x7bc/0xce8 net/ipv6/addrconf.c:3699 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1238 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1258 fib_create_info+0x105c/0x1e04 net/ipv4/fib_semantics.c:1556 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x33c/0x4ec net/ipv4/fib_frontend.c:1148 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1486 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_hold include/linux/netdevice.h:4091 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1238 [inline] fib_check_nh+0xa84/0x17a4 net/ipv4/fib_semantics.c:1258 fib_create_info+0x105c/0x1e04 net/ipv4/fib_semantics.c:1556 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x2e4/0x4ec net/ipv4/fib_frontend.c:1141 fib_netdev_event+0x368/0x4ac net/ipv4/fib_frontend.c:1486 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2c4/0x550 dev_change_flags+0xd0/0x15c net/core/dev.c:8922 do_setlink+0xadc/0x3778 net/core/rtnetlink.c:2929 __rtnl_newlink net/core/rtnetlink.c:3725 [inline] rtnl_newlink+0x14c4/0x1bd0 net/core/rtnetlink.c:3772 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 ref_tracker: syz_tun@00000000a054fbc8 has 1/9 users at __netdev_tracker_alloc include/linux/netdevice.h:4062 [inline] netdev_tracker_alloc+0x68/0xb4 include/linux/netdevice.h:4074 fib_create_info+0x1214/0x1e04 net/ipv4/fib_semantics.c:1550 fib_table_insert+0x1a4/0x1574 net/ipv4/fib_trie.c:1237 fib_magic+0x300/0x4b8 net/ipv4/fib_frontend.c:1104 fib_add_ifaddr+0x118/0x4ec net/ipv4/fib_frontend.c:1126 fib_inetaddr_event+0x12c/0x200 net/ipv4/fib_frontend.c:1440 notifier_call_chain+0x1b4/0x538 kernel/notifier.c:93 blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:388 __inet_insert_ifa+0x8b0/0xac8 net/ipv4/devinet.c:586 inet_rtm_newaddr+0xf90/0x18e4 net/ipv4/devinet.c:997 rtnetlink_rcv_msg+0x630/0xa9c net/core/rtnetlink.c:6675 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2536 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6693 netlink_unicast_kernel net/netlink/af_netlink.c:1316 [inline] netlink_unicast+0x668/0x8a4 net/netlink/af_netlink.c:1342 netlink_sendmsg+0x7a4/0xa8c net/netlink/af_netlink.c:1886 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2214