program:
socket$netlink(0x10, 0x3, 0x10) (async)
r0 = socket$netlink(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async)
sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800)
syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2)
syz_usb_connect(0x2, 0x2d, 0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=@ipv6_newrule={0x24, 0x20, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FIB_RULE_POLICY=@FRA_TABLE={0x8, 0xf, 0xffffffff}]}, 0x24}}, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
[ 103.767458][ T5295] Bluetooth: hci0: command tx timeout
[ 104.034214][ T5336] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 105.436215][ T5336] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 105.629619][ T5336] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 105.683039][ T5336] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 105.785960][ T24] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.790470][ T5295] Bluetooth: hci0: command tx timeout
[ 105.825377][ T24] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.845982][ T24] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.863108][ T24] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.876985][ T5335] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 105.885080][ T24] ==================================================================
[ 105.888587][ T24] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550
[ 105.891925][ T24] Read of size 8 at addr ffff88801fd540a8 by task kworker/u4:2/24
[ 105.895248][ T24]
[ 105.896315][ T24] CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
[ 105.896329][ T24] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 105.896338][ T24] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 105.896361][ T24] Call Trace:
[ 105.896370][ T24]
[ 105.896376][ T24] dump_stack_lvl+0xe8/0x150
[ 105.896391][ T24] print_address_description+0x55/0x1e0
[ 105.896403][ T24] ? __mutex_lock+0x15a/0x1550
[ 105.896416][ T24] print_report+0x58/0x70
[ 105.896426][ T24] kasan_report+0x117/0x150
[ 105.896443][ T24] ? __mutex_lock+0x15a/0x1550
[ 105.896454][ T24] __mutex_lock+0x15a/0x1550
[ 105.896464][ T24] ? __lock_acquire+0x6b5/0x2cf0
[ 105.896475][ T24] ? look_up_lock_class+0x57/0x110
[ 105.896487][ T24] ? __mutex_lock+0x608/0x1550
[ 105.896498][ T24] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 105.896511][ T24] ? __pfx___mutex_lock+0x10/0x10
[ 105.896523][ T24] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 105.896539][ T24] ? process_scheduled_works+0xa70/0x1860
[ 105.896550][ T24] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 105.896564][ T24] ? process_scheduled_works+0xa70/0x1860
[ 105.896574][ T24] ? process_scheduled_works+0xa70/0x1860
[ 105.896584][ T24] process_scheduled_works+0xb5d/0x1860
[ 105.896599][ T24] ? __pfx_process_scheduled_works+0x10/0x10
[ 105.896611][ T24] ? assign_work+0x3d5/0x5e0
[ 105.896621][ T24] worker_thread+0xa53/0xfc0
[ 105.896637][ T24] kthread+0x389/0x470
[ 105.896651][ T24] ? __pfx_worker_thread+0x10/0x10
[ 105.896661][ T24] ? __pfx_kthread+0x10/0x10
[ 105.896673][ T24] ret_from_fork+0x514/0xb70
[ 105.896694][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 105.896704][ T24] ? __switch_to+0xc79/0x1410
[ 105.896720][ T24] ? __pfx_kthread+0x10/0x10
[ 105.896734][ T24] ret_from_fork_asm+0x1a/0x30
[ 105.896751][ T24]
[ 105.896755][ T24]
[ 105.974357][ T24] Allocated by task 5336:
[ 105.976217][ T24] kasan_save_track+0x3e/0x80
[ 105.978457][ T24] __kasan_kmalloc+0x93/0xb0
[ 105.980485][ T24] __kmalloc_noprof+0x35c/0x760
[ 105.982791][ T24] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0
[ 105.985855][ T24] notifier_call_chain+0x1ad/0x3d0
[ 105.988080][ T24] register_netdevice+0x18c9/0x1ec0
[ 105.990607][ T24] nsim_create+0xbed/0x1160
[ 105.992595][ T24] __nsim_dev_port_add+0x857/0xd30
[ 105.994757][ T24] nsim_dev_port_add_all+0x37/0xf0
[ 105.996799][ T24] nsim_dev_reload_up+0x45f/0x7c0
[ 105.998783][ T24] devlink_reload+0x4f8/0x8c0
[ 106.000861][ T24] devlink_nl_reload_doit+0xaaa/0xc80
[ 106.003204][ T24] genl_family_rcv_msg_doit+0x22a/0x330
[ 106.005551][ T24] genl_rcv_msg+0x61c/0x7a0
[ 106.007538][ T24] netlink_rcv_skb+0x232/0x4b0
[ 106.009558][ T24] genl_rcv+0x28/0x40
[ 106.011265][ T24] netlink_unicast+0x75c/0x8e0
[ 106.013441][ T24] netlink_sendmsg+0x813/0xb40
[ 106.015479][ T24] ____sys_sendmsg+0x972/0x9f0
[ 106.017697][ T24] ___sys_sendmsg+0x2a5/0x360
[ 106.019847][ T24] __x64_sys_sendmsg+0x1bd/0x2a0
[ 106.021980][ T24] do_syscall_64+0x174/0x580
[ 106.023960][ T24] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.026560][ T24]
[ 106.027597][ T24] Freed by task 5335:
[ 106.029272][ T24] kasan_save_track+0x3e/0x80
[ 106.031188][ T24] kasan_save_free_info+0x46/0x50
[ 106.033457][ T24] __kasan_slab_free+0x5c/0x80
[ 106.035428][ T24] kfree+0x1c5/0x640
[ 106.037107][ T24] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0
[ 106.039648][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.041806][ T24] unregister_netdevice_many_notify+0x17a5/0x22c0
[ 106.044537][ T24] unregister_netdevice_queue+0x31f/0x360
[ 106.046864][ T24] nsim_destroy+0x26d/0x7f0
[ 106.048836][ T24] __nsim_dev_port_del+0x14f/0x200
[ 106.050971][ T24] nsim_dev_reload_destroy+0x288/0x490
[ 106.053239][ T24] nsim_dev_reload_down+0x8a/0xc0
[ 106.055223][ T24] devlink_reload+0x1eb/0x8c0
[ 106.057198][ T24] devlink_nl_reload_doit+0xaaa/0xc80
[ 106.059528][ T24] genl_family_rcv_msg_doit+0x22a/0x330
[ 106.061869][ T24] genl_rcv_msg+0x61c/0x7a0
[ 106.063605][ T24] netlink_rcv_skb+0x232/0x4b0
[ 106.065470][ T24] genl_rcv+0x28/0x40
[ 106.067053][ T24] netlink_unicast+0x75c/0x8e0
[ 106.069125][ T24] netlink_sendmsg+0x813/0xb40
[ 106.071264][ T24] ____sys_sendmsg+0x972/0x9f0
[ 106.073572][ T24] ___sys_sendmsg+0x2a5/0x360
[ 106.075671][ T24] __x64_sys_sendmsg+0x1bd/0x2a0
[ 106.077777][ T24] do_syscall_64+0x174/0x580
[ 106.079985][ T24] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.082530][ T24]
[ 106.083578][ T24] Last potentially related work creation:
[ 106.085950][ T24] kasan_save_stack+0x3e/0x60
[ 106.087784][ T24] kasan_record_aux_stack+0xbd/0xd0
[ 106.089837][ T24] insert_work+0x3d/0x330
[ 106.091592][ T24] __queue_work+0xbba/0x1040
[ 106.093484][ T24] queue_work_on+0x106/0x1d0
[ 106.095199][ T24] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 106.097567][ T24] udp_tunnel_push_rx_port+0x186/0x210
[ 106.099992][ T24] geneve_offload_rx_ports+0xc7/0x150
[ 106.102276][ T24] geneve_netdevice_event+0x6a/0x80
[ 106.104595][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.106846][ T24] call_netdevice_notifiers+0x90/0xd0
[ 106.109162][ T24] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 106.111815][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.114021][ T24] register_netdevice+0x18c9/0x1ec0
[ 106.116282][ T24] nsim_create+0xbed/0x1160
[ 106.118185][ T24] __nsim_dev_port_add+0x857/0xd30
[ 106.120307][ T24] nsim_dev_port_add_all+0x37/0xf0
[ 106.122572][ T24] nsim_dev_reload_up+0x45f/0x7c0
[ 106.124592][ T24] devlink_reload+0x4f8/0x8c0
[ 106.126620][ T24] devlink_nl_reload_doit+0xaaa/0xc80
[ 106.129027][ T24] genl_family_rcv_msg_doit+0x22a/0x330
[ 106.131939][ T24] genl_rcv_msg+0x61c/0x7a0
[ 106.133872][ T24] netlink_rcv_skb+0x232/0x4b0
[ 106.135879][ T24] genl_rcv+0x28/0x40
[ 106.137595][ T24] netlink_unicast+0x75c/0x8e0
[ 106.139621][ T24] netlink_sendmsg+0x813/0xb40
[ 106.141619][ T24] ____sys_sendmsg+0x972/0x9f0
[ 106.143628][ T24] ___sys_sendmsg+0x2a5/0x360
[ 106.145665][ T24] __x64_sys_sendmsg+0x1bd/0x2a0
[ 106.147808][ T24] do_syscall_64+0x174/0x580
[ 106.149795][ T24] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.152247][ T24]
[ 106.153310][ T24] Second to last potentially related work creation:
[ 106.156082][ T24] kasan_save_stack+0x3e/0x60
[ 106.158113][ T24] kasan_record_aux_stack+0xbd/0xd0
[ 106.160490][ T24] insert_work+0x3d/0x330
[ 106.162439][ T24] __queue_work+0xcef/0x1040
[ 106.164427][ T24] queue_work_on+0x106/0x1d0
[ 106.166293][ T24] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 106.168633][ T24] udp_tunnel_push_rx_port+0x186/0x210
[ 106.170925][ T24] geneve_offload_rx_ports+0xc7/0x150
[ 106.173260][ T24] geneve_netdevice_event+0x6a/0x80
[ 106.175448][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.177613][ T24] call_netdevice_notifiers+0x90/0xd0
[ 106.179902][ T24] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 106.182449][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.184611][ T24] register_netdevice+0x18c9/0x1ec0
[ 106.186809][ T24] nsim_create+0xbed/0x1160
[ 106.188761][ T24] __nsim_dev_port_add+0x857/0xd30
[ 106.190899][ T24] nsim_dev_port_add_all+0x37/0xf0
[ 106.193117][ T24] nsim_dev_reload_up+0x45f/0x7c0
[ 106.195232][ T24] devlink_reload+0x4f8/0x8c0
[ 106.197196][ T24] devlink_nl_reload_doit+0xaaa/0xc80
[ 106.199473][ T24] genl_family_rcv_msg_doit+0x22a/0x330
[ 106.201650][ T24] genl_rcv_msg+0x61c/0x7a0
[ 106.203504][ T24] netlink_rcv_skb+0x232/0x4b0
[ 106.205474][ T24] genl_rcv+0x28/0x40
[ 106.207043][ T24] netlink_unicast+0x75c/0x8e0
[ 106.208967][ T24] netlink_sendmsg+0x813/0xb40
[ 106.210987][ T24] ____sys_sendmsg+0x972/0x9f0
[ 106.213068][ T24] ___sys_sendmsg+0x2a5/0x360
[ 106.214971][ T24] __x64_sys_sendmsg+0x1bd/0x2a0
[ 106.217019][ T24] do_syscall_64+0x174/0x580
[ 106.218868][ T24] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.221938][ T24]
[ 106.223115][ T24] The buggy address belongs to the object at ffff88801fd54000
[ 106.223115][ T24] which belongs to the cache kmalloc-256 of size 256
[ 106.228767][ T24] The buggy address is located 168 bytes inside of
[ 106.228767][ T24] freed 256-byte region [ffff88801fd54000, ffff88801fd54100)
[ 106.234489][ T24]
[ 106.235551][ T24] The buggy address belongs to the physical page:
[ 106.238194][ T24] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fd54
[ 106.241847][ T24] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 106.244813][ T24] page_type: f5(slab)
[ 106.246466][ T24] raw: 00fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000
[ 106.250156][ T24] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 106.253746][ T24] page dumped because: kasan: bad access detected
[ 106.256444][ T24] page_owner tracks the page as allocated
[ 106.258775][ T24] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5294, tgid 5294 (syz-executor), ts 101216113913, free_ts 101171250300
[ 106.267365][ T24] post_alloc_hook+0x22d/0x280
[ 106.269342][ T24] get_page_from_freelist+0x2593/0x2610
[ 106.271735][ T24] __alloc_frozen_pages_noprof+0x18d/0x380
[ 106.274342][ T24] allocate_slab+0x77/0x660
[ 106.276330][ T24] refill_objects+0x339/0x3d0
[ 106.278275][ T24] __pcs_replace_empty_main+0x321/0x720
[ 106.280570][ T24] __kmalloc_cache_noprof+0x392/0x660
[ 106.282880][ T24] ____ip_mc_inc_group+0x518/0xdd0
[ 106.285081][ T24] ip_mc_up+0x115/0x2e0
[ 106.286896][ T24] inetdev_event+0xff6/0x1610
[ 106.288913][ T24] notifier_call_chain+0x1ad/0x3d0
[ 106.291072][ T24] __dev_notify_flags+0x1a9/0x310
[ 106.293378][ T24] netif_change_flags+0xe8/0x1a0
[ 106.295577][ T24] dev_change_flags+0x130/0x270
[ 106.297658][ T24] devinet_ioctl+0x9f2/0x1b30
[ 106.299678][ T24] inet_ioctl+0x42a/0x560
[ 106.301543][ T24] page last free pid 76 tgid 76 stack trace:
[ 106.304130][ T24] free_unref_folios+0xd9f/0x14c0
[ 106.306292][ T24] shrink_folio_list+0x4a88/0x52a0
[ 106.308583][ T24] evict_folios+0x4998/0x5ac0
[ 106.310623][ T24] try_to_shrink_lruvec+0xbca/0x1050
[ 106.312985][ T24] shrink_one+0x25c/0x710
[ 106.314896][ T24] shrink_node+0x31bf/0x3ae0
[ 106.316894][ T24] kswapd+0x1736/0x2de0
[ 106.318713][ T24] kthread+0x389/0x470
[ 106.320521][ T24] ret_from_fork+0x514/0xb70
[ 106.322593][ T24] ret_from_fork_asm+0x1a/0x30
[ 106.324709][ T24]
[ 106.325712][ T24] Memory state around the buggy address:
[ 106.328191][ T24] ffff88801fd53f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 106.331649][ T24] ffff88801fd54000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.335044][ T24] >ffff88801fd54080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 106.338535][ T24] ^
[ 106.341949][ T24] ffff88801fd54100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 106.345471][ T24] ffff88801fd54180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 106.348879][ T24] ==================================================================
[ 106.381376][ T24] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 106.385001][ T24] CPU: 0 UID: 0 PID: 24 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
[ 106.389645][ T24] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 106.394217][ T24] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 106.397245][ T24] Call Trace:
[ 106.398700][ T24]
[ 106.400025][ T24] vpanic+0x56c/0xa60
[ 106.402052][ T24] ? __pfx_vpanic+0x10/0x10
[ 106.404183][ T24] panic+0xc5/0xd0
[ 106.405767][ T24] ? __pfx_panic+0x10/0x10
[ 106.407689][ T24] ? preempt_schedule_thunk+0x16/0x30
[ 106.409982][ T24] ? __mutex_lock+0x15a/0x1550
[ 106.412036][ T24] ? preempt_schedule_thunk+0x16/0x30
[ 106.414507][ T24] ? __mutex_lock+0x15a/0x1550
[ 106.416516][ T24] check_panic_on_warn+0x89/0xb0
[ 106.418692][ T24] ? __mutex_lock+0x15a/0x1550
[ 106.420732][ T24] end_report+0x73/0x170
[ 106.422565][ T24] ? __mutex_lock+0x15a/0x1550
[ 106.424780][ T24] kasan_report+0x128/0x150
[ 106.427355][ T24] ? __mutex_lock+0x15a/0x1550
[ 106.429687][ T24] __mutex_lock+0x15a/0x1550
[ 106.432574][ T24] ? __lock_acquire+0x6b5/0x2cf0
[ 106.434500][ T24] ? look_up_lock_class+0x57/0x110
[ 106.437254][ T24] ? __mutex_lock+0x608/0x1550
[ 106.439106][ T24] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 106.442253][ T24] ? __pfx___mutex_lock+0x10/0x10
[ 106.445168][ T24] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 106.447986][ T24] ? process_scheduled_works+0xa70/0x1860
[ 106.450568][ T24] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 106.453466][ T24] ? process_scheduled_works+0xa70/0x1860
[ 106.456516][ T24] ? process_scheduled_works+0xa70/0x1860
[ 106.459373][ T24] process_scheduled_works+0xb5d/0x1860
[ 106.461920][ T24] ? __pfx_process_scheduled_works+0x10/0x10
[ 106.465075][ T24] ? assign_work+0x3d5/0x5e0
[ 106.467379][ T24] worker_thread+0xa53/0xfc0
[ 106.469355][ T24] kthread+0x389/0x470
[ 106.471236][ T24] ? __pfx_worker_thread+0x10/0x10
[ 106.473422][ T24] ? __pfx_kthread+0x10/0x10
[ 106.475403][ T24] ret_from_fork+0x514/0xb70
[ 106.477387][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 106.479314][ T24] ? __switch_to+0xc79/0x1410
[ 106.481228][ T24] ? __pfx_kthread+0x10/0x10
[ 106.483431][ T24] ret_from_fork_asm+0x1a/0x30
[ 106.485334][ T24]
[ 106.486974][ T24] Kernel Offset: disabled
[ 106.488593][ T24] Rebooting in 86400 seconds..