Extracting prog: 2m37.983120156s Minimizing prog: 43m0.270953509s Simplifying prog options: 8m26.496801397s Extracting C: 1m39.823623946s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-open detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(0x0, 0x14927e, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-prlimit64-sched_setscheduler-open detailed listing: executing program 0: syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x87, &(0x7f0000000180)="$eJzs0TEOQUEYBODxGu7gDnsHRxElnYpInMhVHMENFFoNYWm21Ky8fF/ybzKZZpI930/zxzF5X2O726+Xm/qGURqSTJPMUv//la+L2k0+/eV2WH2v914AAOB3Q0qbS7cxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH/oGQAA//+6dyiR") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) program crashed: unregister_netdevice: waiting for DEV to become free validation run: crashed=true reproducing took 1h5m35.186129924s repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] dst_init+0xc8/0x3c0 net/core/dst.c:52 dst_alloc+0x120/0x170 net/core/dst.c:92 rt_dst_alloc net/ipv4/route.c:1662 [inline] __mkroute_output net/ipv4/route.c:2628 [inline] ip_route_output_key_hash_rcu+0xff4/0x1e38 net/ipv4/route.c:2850 ip_route_output_key_hash+0x1b0/0x300 net/ipv4/route.c:2679 __ip_route_output_key include/net/route.h:137 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2909 ip_route_output_key include/net/route.h:153 [inline] geneve_link_config+0x16c/0x544 drivers/net/geneve.c:1651 geneve_newlink+0x130/0x198 drivers/net/geneve.c:1704 rtnl_newlink_create net/core/rtnetlink.c:3422 [inline] __rtnl_newlink net/core/rtnetlink.c:3642 [inline] rtnl_newlink+0x1058/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline] addrconf_add_linklocal+0x3ac/0x608 net/ipv6/addrconf.c:3259 addrconf_addr_gen+0x3ec/0x4fc net/ipv6/addrconf.c:3388 addrconf_init_auto_addrs+0x5e0/0x94c net/ipv6/addrconf.c:-1 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 addrconf_f6i_alloc+0x1a8/0x36c net/ipv6/route.c:4621 ipv6_add_addr+0x3c8/0xce0 net/ipv6/addrconf.c:1121 addrconf_add_linklocal+0x23c/0x608 net/ipv6/addrconf.c:3257 addrconf_addr_gen+0x3ec/0x4fc net/ipv6/addrconf.c:3388 addrconf_init_auto_addrs+0x5e0/0x94c net/ipv6/addrconf.c:-1 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_add_mroute net/ipv6/addrconf.c:2506 [inline] addrconf_add_dev+0x228/0x324 net/ipv6/addrconf.c:2524 addrconf_dev_config net/ipv6/addrconf.c:3424 [inline] addrconf_init_auto_addrs+0x510/0x94c net/ipv6/addrconf.c:3512 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3543 [inline] addrconf_permanent_addr+0x5d8/0x8d4 net/ipv6/addrconf.c:3567 addrconf_notify+0x7b0/0xc8c net/ipv6/addrconf.c:3639 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1239 [inline] fib_check_nh+0xa0c/0x15fc net/ipv4/fib_semantics.c:1259 fib_create_info+0x1090/0x1e58 net/ipv4/fib_semantics.c:1558 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x33c/0x4f8 net/ipv4/fib_frontend.c:1162 fib_netdev_event+0x360/0x4a0 net/ipv4/fib_frontend.c:1500 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1239 [inline] fib_check_nh+0xa0c/0x15fc net/ipv4/fib_semantics.c:1259 fib_create_info+0x1090/0x1e58 net/ipv4/fib_semantics.c:1558 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x2ec/0x4f8 net/ipv4/fib_frontend.c:1155 fib_netdev_event+0x360/0x4a0 net/ipv4/fib_frontend.c:1500 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 addrconf_f6i_alloc+0x1a8/0x36c net/ipv6/route.c:4621 ipv6_add_addr+0x3c8/0xce0 net/ipv6/addrconf.c:1121 inet6_addr_add+0x388/0x820 net/ipv6/addrconf.c:3013 inet6_rtm_newaddr+0x558/0x76c net/ipv6/addrconf.c:4973 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc+0x68/0xb0 include/linux/netdevice.h:4063 fib_create_info+0x1990/0x1e58 net/ipv4/fib_semantics.c:1552 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x118/0x4f8 net/ipv4/fib_frontend.c:1140 fib_inetaddr_event+0x12c/0x1f8 net/ipv4/fib_frontend.c:1454 notifier_call_chain kernel/notifier.c:87 [inline] blocking_notifier_call_chain+0xf0/0x198 kernel/notifier.c:382 __inet_insert_ifa+0x85c/0xa10 net/ipv4/devinet.c:568 inet_rtm_newaddr+0x8a0/0x15b0 net/ipv4/devinet.c:970 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160 final repro crashed as (corrupted=false): unregister_netdevice: waiting for syz_tun to become free. Usage count = 10 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] dst_init+0xc8/0x3c0 net/core/dst.c:52 dst_alloc+0x120/0x170 net/core/dst.c:92 rt_dst_alloc net/ipv4/route.c:1662 [inline] __mkroute_output net/ipv4/route.c:2628 [inline] ip_route_output_key_hash_rcu+0xff4/0x1e38 net/ipv4/route.c:2850 ip_route_output_key_hash+0x1b0/0x300 net/ipv4/route.c:2679 __ip_route_output_key include/net/route.h:137 [inline] ip_route_output_flow+0x3c/0x160 net/ipv4/route.c:2909 ip_route_output_key include/net/route.h:153 [inline] geneve_link_config+0x16c/0x544 drivers/net/geneve.c:1651 geneve_newlink+0x130/0x198 drivers/net/geneve.c:1704 rtnl_newlink_create net/core/rtnetlink.c:3422 [inline] __rtnl_newlink net/core/rtnetlink.c:3642 [inline] rtnl_newlink+0x1058/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline] addrconf_add_linklocal+0x3ac/0x608 net/ipv6/addrconf.c:3259 addrconf_addr_gen+0x3ec/0x4fc net/ipv6/addrconf.c:3388 addrconf_init_auto_addrs+0x5e0/0x94c net/ipv6/addrconf.c:-1 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 addrconf_f6i_alloc+0x1a8/0x36c net/ipv6/route.c:4621 ipv6_add_addr+0x3c8/0xce0 net/ipv6/addrconf.c:1121 addrconf_add_linklocal+0x23c/0x608 net/ipv6/addrconf.c:3257 addrconf_addr_gen+0x3ec/0x4fc net/ipv6/addrconf.c:3388 addrconf_init_auto_addrs+0x5e0/0x94c net/ipv6/addrconf.c:-1 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_add_mroute net/ipv6/addrconf.c:2506 [inline] addrconf_add_dev+0x228/0x324 net/ipv6/addrconf.c:2524 addrconf_dev_config net/ipv6/addrconf.c:3424 [inline] addrconf_init_auto_addrs+0x510/0x94c net/ipv6/addrconf.c:3512 addrconf_notify+0x8c4/0xc8c net/ipv6/addrconf.c:3685 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 ip6_route_add+0x34/0x154 net/ipv6/route.c:3890 addrconf_prefix_route net/ipv6/addrconf.c:2442 [inline] fixup_permanent_addr net/ipv6/addrconf.c:3543 [inline] addrconf_permanent_addr+0x5d8/0x8d4 net/ipv6/addrconf.c:3567 addrconf_notify+0x7b0/0xc8c net/ipv6/addrconf.c:3639 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1239 [inline] fib_check_nh+0xa0c/0x15fc net/ipv4/fib_semantics.c:1259 fib_create_info+0x1090/0x1e58 net/ipv4/fib_semantics.c:1558 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x33c/0x4f8 net/ipv4/fib_frontend.c:1162 fib_netdev_event+0x360/0x4a0 net/ipv4/fib_frontend.c:1500 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_hold include/linux/netdevice.h:4080 [inline] fib_check_nh_nongw net/ipv4/fib_semantics.c:1239 [inline] fib_check_nh+0xa0c/0x15fc net/ipv4/fib_semantics.c:1259 fib_create_info+0x1090/0x1e58 net/ipv4/fib_semantics.c:1558 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x2ec/0x4f8 net/ipv4/fib_frontend.c:1155 fib_netdev_event+0x360/0x4a0 net/ipv4/fib_frontend.c:1500 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:2014 [inline] call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_notify_flags+0x250/0x480 net/core/dev.c:8702 dev_change_flags+0xc8/0x154 net/core/dev.c:8740 do_setlink+0xa5c/0x3434 net/core/rtnetlink.c:2833 __rtnl_newlink net/core/rtnetlink.c:3608 [inline] rtnl_newlink+0x13cc/0x1a50 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc include/linux/netdevice.h:4063 [inline] fib6_nh_init+0x630/0x1ad4 net/ipv6/route.c:3665 ip6_route_info_create+0x7b0/0xf78 net/ipv6/route.c:3846 addrconf_f6i_alloc+0x1a8/0x36c net/ipv6/route.c:4621 ipv6_add_addr+0x3c8/0xce0 net/ipv6/addrconf.c:1121 inet6_addr_add+0x388/0x820 net/ipv6/addrconf.c:3013 inet6_rtm_newaddr+0x558/0x76c net/ipv6/addrconf.c:4973 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204 leaked reference. __netdev_tracker_alloc include/linux/netdevice.h:4051 [inline] netdev_tracker_alloc+0x68/0xb0 include/linux/netdevice.h:4063 fib_create_info+0x1990/0x1e58 net/ipv4/fib_semantics.c:1552 fib_table_insert+0xac/0x13a8 net/ipv4/fib_trie.c:1217 fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1118 fib_add_ifaddr+0x118/0x4f8 net/ipv4/fib_frontend.c:1140 fib_inetaddr_event+0x12c/0x1f8 net/ipv4/fib_frontend.c:1454 notifier_call_chain kernel/notifier.c:87 [inline] blocking_notifier_call_chain+0xf0/0x198 kernel/notifier.c:382 __inet_insert_ifa+0x85c/0xa10 net/ipv4/devinet.c:568 inet_rtm_newaddr+0x8a0/0x15b0 net/ipv4/devinet.c:970 rtnetlink_rcv_msg+0x698/0xcdc net/core/rtnetlink.c:6150 netlink_rcv_skb+0x218/0x3e8 net/netlink/af_netlink.c:2511 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x60c/0x814 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x6f4/0x9c0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x324/0x440 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160