device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state ================================================================== BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: null-ptr-deref in __tcf_idr_release net/sched/act_api.c:162 [inline] BUG: KASAN: null-ptr-deref in tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:561 Read of size 4 at addr 0000000000000010 by task kworker/u4:0/7 CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted 5.4.283-syzkaller-04981-g1cca65ac6abc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 __kasan_report+0xe9/0x120 mm/kasan/report.c:520 kasan_report+0x30/0x60 mm/kasan/common.c:653 check_memory_region_inline mm/kasan/generic.c:141 [inline] check_memory_region+0x272/0x280 mm/kasan/generic.c:191 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] __tcf_idr_release net/sched/act_api.c:162 [inline] tcf_idrinfo_destroy+0xe2/0x280 net/sched/act_api.c:561 tc_action_net_exit include/net/act_api.h:145 [inline] police_exit_net+0xd7/0x140 net/sched/act_police.c:410 ops_exit_list net/core/net_namespace.c:187 [inline] cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:612 process_one_work+0x765/0xd20 kernel/workqueue.c:2290 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 ================================================================== kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7 Comm: kworker/u4:0 Tainted: G B 5.4.283-syzkaller-04981-g1cca65ac6abc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: netns cleanup_net RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline] RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline] RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:561 Code: ee e8 9b b9 b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 de fe ff fd 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 af 46 RSP: 0018:ffff8881f5dbfb60 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881f5d69f80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff8881f5dbfc30 R08: ffffffff813ae3b5 R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103ebb7f78 R13: ffff8881f5dbfbc0 R14: fffffffffffffff0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42466ad000 CR3: 000000000580e000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tc_action_net_exit include/net/act_api.h:145 [inline] police_exit_net+0xd7/0x140 net/sched/act_police.c:410 ops_exit_list net/core/net_namespace.c:187 [inline] cleanup_net+0x6e2/0xc90 net/core/net_namespace.c:612 process_one_work+0x765/0xd20 kernel/workqueue.c:2290 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Modules linked in: ---[ end trace 50cb9112e5a75b77 ]--- RIP: 0010:__read_once_size include/linux/compiler.h:268 [inline] RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:31 [inline] RIP: 0010:atomic_read include/asm-generic/atomic-instrumented.h:27 [inline] RIP: 0010:__tcf_idr_release net/sched/act_api.c:162 [inline] RIP: 0010:tcf_idrinfo_destroy+0xe9/0x280 net/sched/act_api.c:561 Code: ee e8 9b b9 b6 00 48 85 c0 0f 84 54 01 00 00 49 89 c6 48 8d 58 20 48 89 df be 04 00 00 00 e8 de fe ff fd 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 f5 00 00 00 8b 1b 31 ff 89 de e8 af 46 RSP: 0018:ffff8881f5dbfb60 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff8881f5d69f80 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff8881f5dbfc30 R08: ffffffff813ae3b5 R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 1ffff1103ebb7f78 R13: ffff8881f5dbfbc0 R14: fffffffffffffff0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42466ad000 CR3: 000000000580e000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: ee out %al,(%dx) 1: e8 9b b9 b6 00 call 0xb6b9a1 6: 48 85 c0 test %rax,%rax 9: 0f 84 54 01 00 00 je 0x163 f: 49 89 c6 mov %rax,%r14 12: 48 8d 58 20 lea 0x20(%rax),%rbx 16: 48 89 df mov %rbx,%rdi 19: be 04 00 00 00 mov $0x4,%esi 1e: e8 de fe ff fd call 0xfdffff01 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 f5 00 00 00 jne 0x12c 37: 8b 1b mov (%rbx),%ebx 39: 31 ff xor %edi,%edi 3b: 89 de mov %ebx,%esi 3d: e8 .byte 0xe8 3e: af scas %es:(%rdi),%eax 3f: 46 rex.RX