program:
perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) (async)
perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async)
perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) (async)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0)
write$cgroup_pid(r0, &(0x7f0000000080), 0x12)
r1 = fsopen(&(0x7f0000000080)='nfs4\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x57)
r2 = socket(0x10, 0x3, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async)
sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800)
syz_usb_connect(0x2, 0x2d, 0x0, 0x0)
sendto$inet6(r2, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0xf)
fchmodat(r0, &(0x7f0000000100)='./cgroup/pids.max\x00', 0x120)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x20000, 0xa, 0x20002f7}) (async)
r5 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x20000, 0xa, 0x20002f7})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fea0"], 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94)
r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x3}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x10, &(0x7f0000000000)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@call={0x85, 0x0, 0x0, 0x8f}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94)
io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0)
[ 85.565466][ T5333] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 85.586849][ T5332] cgroup: fork rejected by pids controller in /syz0
[ 85.670039][ T5332] pthread_create failed
[ 85.670077][ T5332] (errno 11)
[ 85.869496][ T4660] Bluetooth: hci0: command tx timeout
[ 86.856676][ T5333] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 87.949293][ T4660] Bluetooth: hci0: command tx timeout
[ 88.088528][ T5333] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.127275][ T5333] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.189716][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.205181][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.217096][ T51] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.231804][ T51] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.243345][ T5334] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 88.255548][ T51] ==================================================================
[ 88.259040][ T51] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550
[ 88.262467][ T51] Read of size 8 at addr ffff888038392aa8 by task kworker/u4:4/51
[ 88.265673][ T51]
[ 88.266671][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 88.266685][ T51] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.266695][ T51] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 88.266717][ T51] Call Trace:
[ 88.266725][ T51]
[ 88.266732][ T51] dump_stack_lvl+0xe8/0x150
[ 88.266745][ T51] print_address_description+0x55/0x1e0
[ 88.266756][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.266767][ T51] print_report+0x58/0x70
[ 88.266778][ T51] kasan_report+0x117/0x150
[ 88.266800][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.266814][ T51] __mutex_lock+0x15a/0x1550
[ 88.266823][ T51] ? __lock_acquire+0x6b5/0x2cf0
[ 88.266833][ T51] ? look_up_lock_class+0x57/0x110
[ 88.266844][ T51] ? __mutex_lock+0x608/0x1550
[ 88.266853][ T51] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.266865][ T51] ? __pfx___mutex_lock+0x10/0x10
[ 88.266877][ T51] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 88.266892][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.266903][ T51] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.266917][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.266927][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.266938][ T51] process_scheduled_works+0xb5d/0x1860
[ 88.266956][ T51] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.266973][ T51] ? assign_work+0x3d5/0x5e0
[ 88.266985][ T51] worker_thread+0xa53/0xfc0
[ 88.267004][ T51] kthread+0x389/0x470
[ 88.267018][ T51] ? __pfx_worker_thread+0x10/0x10
[ 88.267028][ T51] ? __pfx_kthread+0x10/0x10
[ 88.267040][ T51] ret_from_fork+0x514/0xb70
[ 88.267054][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 88.267066][ T51] ? __switch_to+0xc79/0x1410
[ 88.267080][ T51] ? __pfx_kthread+0x10/0x10
[ 88.267094][ T51] ret_from_fork_asm+0x1a/0x30
[ 88.267112][ T51]
[ 88.267116][ T51]
[ 88.346188][ T51] Allocated by task 5333:
[ 88.347992][ T51] kasan_save_track+0x3e/0x80
[ 88.349991][ T51] __kasan_kmalloc+0x93/0xb0
[ 88.351893][ T51] __kmalloc_noprof+0x35c/0x760
[ 88.353869][ T51] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0
[ 88.356405][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.358606][ T51] register_netdevice+0x18c9/0x1ec0
[ 88.360945][ T51] nsim_create+0xbed/0x1160
[ 88.362987][ T51] __nsim_dev_port_add+0x857/0xd30
[ 88.365257][ T51] nsim_dev_port_add_all+0x37/0xf0
[ 88.367429][ T51] nsim_dev_reload_up+0x45f/0x7c0
[ 88.369620][ T51] devlink_reload+0x4f8/0x8c0
[ 88.371729][ T51] devlink_nl_reload_doit+0xaaa/0xc80
[ 88.374081][ T51] genl_family_rcv_msg_doit+0x22a/0x330
[ 88.376529][ T51] genl_rcv_msg+0x61c/0x7a0
[ 88.378536][ T51] netlink_rcv_skb+0x232/0x4b0
[ 88.380593][ T51] genl_rcv+0x28/0x40
[ 88.382265][ T51] netlink_unicast+0x75c/0x8e0
[ 88.384296][ T51] netlink_sendmsg+0x813/0xb40
[ 88.386341][ T51] ____sys_sendmsg+0x972/0x9f0
[ 88.388292][ T51] ___sys_sendmsg+0x2a5/0x360
[ 88.390329][ T51] __x64_sys_sendmsg+0x1bd/0x2a0
[ 88.392491][ T51] do_syscall_64+0x174/0x580
[ 88.394486][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.397013][ T51]
[ 88.398049][ T51] Freed by task 5334:
[ 88.399767][ T51] kasan_save_track+0x3e/0x80
[ 88.401926][ T51] kasan_save_free_info+0x46/0x50
[ 88.404100][ T51] __kasan_slab_free+0x5c/0x80
[ 88.406081][ T51] kfree+0x1c5/0x640
[ 88.407648][ T51] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0
[ 88.410302][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.412493][ T51] unregister_netdevice_many_notify+0x17a5/0x22c0
[ 88.415065][ T51] unregister_netdevice_queue+0x31f/0x360
[ 88.417471][ T51] nsim_destroy+0x26d/0x7f0
[ 88.419600][ T51] __nsim_dev_port_del+0x14f/0x200
[ 88.421831][ T51] nsim_dev_reload_destroy+0x288/0x490
[ 88.424080][ T51] nsim_dev_reload_down+0x8a/0xc0
[ 88.426106][ T51] devlink_reload+0x1eb/0x8c0
[ 88.428028][ T51] devlink_nl_reload_doit+0xaaa/0xc80
[ 88.430460][ T51] genl_family_rcv_msg_doit+0x22a/0x330
[ 88.432973][ T51] genl_rcv_msg+0x61c/0x7a0
[ 88.434998][ T51] netlink_rcv_skb+0x232/0x4b0
[ 88.437131][ T51] genl_rcv+0x28/0x40
[ 88.438805][ T51] netlink_unicast+0x75c/0x8e0
[ 88.440999][ T51] netlink_sendmsg+0x813/0xb40
[ 88.443118][ T51] ____sys_sendmsg+0x972/0x9f0
[ 88.445233][ T51] ___sys_sendmsg+0x2a5/0x360
[ 88.447245][ T51] __x64_sys_sendmsg+0x1bd/0x2a0
[ 88.449281][ T51] do_syscall_64+0x174/0x580
[ 88.451371][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.454818][ T51]
[ 88.455818][ T51] Last potentially related work creation:
[ 88.458077][ T51] kasan_save_stack+0x3e/0x60
[ 88.459985][ T51] kasan_record_aux_stack+0xbd/0xd0
[ 88.462164][ T51] insert_work+0x3d/0x330
[ 88.463752][ T51] __queue_work+0xbba/0x1040
[ 88.465904][ T51] queue_work_on+0x106/0x1d0
[ 88.467905][ T51] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 88.470364][ T51] udp_tunnel_push_rx_port+0x186/0x210
[ 88.472634][ T51] geneve_offload_rx_ports+0xc7/0x150
[ 88.474802][ T51] geneve_netdevice_event+0x6a/0x80
[ 88.476953][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.479032][ T51] call_netdevice_notifiers+0x90/0xd0
[ 88.481332][ T51] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 88.483885][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.486027][ T51] register_netdevice+0x18c9/0x1ec0
[ 88.488659][ T51] nsim_create+0xbed/0x1160
[ 88.490692][ T51] __nsim_dev_port_add+0x857/0xd30
[ 88.493075][ T51] nsim_dev_port_add_all+0x37/0xf0
[ 88.495243][ T51] nsim_dev_reload_up+0x45f/0x7c0
[ 88.497275][ T51] devlink_reload+0x4f8/0x8c0
[ 88.499206][ T51] devlink_nl_reload_doit+0xaaa/0xc80
[ 88.501363][ T51] genl_family_rcv_msg_doit+0x22a/0x330
[ 88.503586][ T51] genl_rcv_msg+0x61c/0x7a0
[ 88.505504][ T51] netlink_rcv_skb+0x232/0x4b0
[ 88.507559][ T51] genl_rcv+0x28/0x40
[ 88.509258][ T51] netlink_unicast+0x75c/0x8e0
[ 88.511219][ T51] netlink_sendmsg+0x813/0xb40
[ 88.513418][ T51] ____sys_sendmsg+0x972/0x9f0
[ 88.515523][ T51] ___sys_sendmsg+0x2a5/0x360
[ 88.517599][ T51] __x64_sys_sendmsg+0x1bd/0x2a0
[ 88.519703][ T51] do_syscall_64+0x174/0x580
[ 88.521717][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.524097][ T51]
[ 88.525136][ T51] Second to last potentially related work creation:
[ 88.527974][ T51] kasan_save_stack+0x3e/0x60
[ 88.530005][ T51] kasan_record_aux_stack+0xbd/0xd0
[ 88.532189][ T51] insert_work+0x3d/0x330
[ 88.534028][ T51] __queue_work+0xcef/0x1040
[ 88.535984][ T51] queue_work_on+0x106/0x1d0
[ 88.537951][ T51] __udp_tunnel_nic_add_port+0xb71/0xd60
[ 88.540327][ T51] udp_tunnel_push_rx_port+0x186/0x210
[ 88.542653][ T51] geneve_offload_rx_ports+0xc7/0x150
[ 88.545034][ T51] geneve_netdevice_event+0x6a/0x80
[ 88.547329][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.549623][ T51] call_netdevice_notifiers+0x90/0xd0
[ 88.552041][ T51] udp_tunnel_nic_netdevice_event+0xdef/0x17d0
[ 88.555029][ T51] notifier_call_chain+0x1ad/0x3d0
[ 88.557595][ T51] register_netdevice+0x18c9/0x1ec0
[ 88.559860][ T51] nsim_create+0xbed/0x1160
[ 88.561901][ T51] __nsim_dev_port_add+0x857/0xd30
[ 88.564070][ T51] nsim_dev_port_add_all+0x37/0xf0
[ 88.566324][ T51] nsim_dev_reload_up+0x45f/0x7c0
[ 88.568492][ T51] devlink_reload+0x4f8/0x8c0
[ 88.570499][ T51] devlink_nl_reload_doit+0xaaa/0xc80
[ 88.572737][ T51] genl_family_rcv_msg_doit+0x22a/0x330
[ 88.575068][ T51] genl_rcv_msg+0x61c/0x7a0
[ 88.577010][ T51] netlink_rcv_skb+0x232/0x4b0
[ 88.578997][ T51] genl_rcv+0x28/0x40
[ 88.580651][ T51] netlink_unicast+0x75c/0x8e0
[ 88.582533][ T51] netlink_sendmsg+0x813/0xb40
[ 88.584424][ T51] ____sys_sendmsg+0x972/0x9f0
[ 88.586423][ T51] ___sys_sendmsg+0x2a5/0x360
[ 88.588532][ T51] __x64_sys_sendmsg+0x1bd/0x2a0
[ 88.590807][ T51] do_syscall_64+0x174/0x580
[ 88.592852][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.595253][ T51]
[ 88.596301][ T51] The buggy address belongs to the object at ffff888038392a00
[ 88.596301][ T51] which belongs to the cache kmalloc-256 of size 256
[ 88.602382][ T51] The buggy address is located 168 bytes inside of
[ 88.602382][ T51] freed 256-byte region [ffff888038392a00, ffff888038392b00)
[ 88.607663][ T51]
[ 88.608687][ T51] The buggy address belongs to the physical page:
[ 88.611361][ T51] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38392
[ 88.614903][ T51] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 88.617825][ T51] page_type: f5(slab)
[ 88.619868][ T51] raw: 04fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000
[ 88.624492][ T51] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 88.628601][ T51] page dumped because: kasan: bad access detected
[ 88.631397][ T51] page_owner tracks the page as allocated
[ 88.633818][ T51] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5294, tgid 5294 (syz-executor), ts 83575696426, free_ts 83575484913
[ 88.642256][ T51] post_alloc_hook+0x22d/0x280
[ 88.644258][ T51] get_page_from_freelist+0x2593/0x2610
[ 88.646585][ T51] __alloc_frozen_pages_noprof+0x18d/0x380
[ 88.649025][ T51] allocate_slab+0x77/0x660
[ 88.650942][ T51] refill_objects+0x339/0x3d0
[ 88.652898][ T51] __pcs_replace_empty_main+0x321/0x720
[ 88.655240][ T51] __kmalloc_noprof+0x474/0x760
[ 88.657331][ T51] __list_lru_init+0xba/0x5d0
[ 88.659346][ T51] alloc_super+0x869/0xab0
[ 88.661320][ T51] sget_fc+0x329/0xa40
[ 88.663032][ T51] get_tree_nodev+0x2a/0x150
[ 88.664996][ T51] vfs_get_tree+0x92/0x2a0
[ 88.666923][ T51] do_new_mount+0x341/0xd30
[ 88.668920][ T51] __se_sys_mount+0x31d/0x420
[ 88.670974][ T51] do_syscall_64+0x174/0x580
[ 88.673010][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.675401][ T51] page last free pid 5294 tgid 5294 stack trace:
[ 88.678027][ T51] __free_frozen_pages+0xc1c/0xd30
[ 88.680373][ T51] __slab_free+0x274/0x2c0
[ 88.682314][ T51] qlist_free_all+0x99/0x100
[ 88.684380][ T51] kasan_quarantine_reduce+0x148/0x160
[ 88.686772][ T51] __kasan_slab_alloc+0x22/0x80
[ 88.688872][ T51] __kmalloc_noprof+0x316/0x760
[ 88.690955][ T51] tomoyo_encode+0x28b/0x550
[ 88.692865][ T51] tomoyo_mount_permission+0x4c1/0x9d0
[ 88.695164][ T51] security_sb_mount+0xe4/0x320
[ 88.697250][ T51] path_mount+0xbc/0x10e0
[ 88.699190][ T51] __se_sys_mount+0x31d/0x420
[ 88.701356][ T51] do_syscall_64+0x174/0x580
[ 88.703406][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.705798][ T51]
[ 88.706789][ T51] Memory state around the buggy address:
[ 88.709016][ T51] ffff888038392980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.712379][ T51] ffff888038392a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.715853][ T51] >ffff888038392a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 88.719230][ T51] ^
[ 88.721580][ T51] ffff888038392b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.724988][ T51] ffff888038392b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 88.728365][ T51] ==================================================================
[ 88.795649][ T51] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.798601][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full)
[ 88.802280][ T51] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.806483][ T51] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work
[ 88.809602][ T51] Call Trace:
[ 88.811157][ T51]
[ 88.812403][ T51] vpanic+0x56c/0xa60
[ 88.814152][ T51] ? __pfx_vpanic+0x10/0x10
[ 88.816073][ T51] panic+0xc5/0xd0
[ 88.817569][ T51] ? __pfx_panic+0x10/0x10
[ 88.819204][ T51] ? preempt_schedule_thunk+0x16/0x30
[ 88.821268][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.823210][ T51] ? preempt_schedule_thunk+0x16/0x30
[ 88.825380][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.827330][ T51] check_panic_on_warn+0x89/0xb0
[ 88.829379][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.831250][ T51] end_report+0x73/0x170
[ 88.832927][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.835244][ T51] kasan_report+0x128/0x150
[ 88.837200][ T51] ? __mutex_lock+0x15a/0x1550
[ 88.839183][ T51] __mutex_lock+0x15a/0x1550
[ 88.841219][ T51] ? __lock_acquire+0x6b5/0x2cf0
[ 88.843393][ T51] ? look_up_lock_class+0x57/0x110
[ 88.845544][ T51] ? __mutex_lock+0x608/0x1550
[ 88.847507][ T51] ? udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.850170][ T51] ? __pfx___mutex_lock+0x10/0x10
[ 88.852144][ T51] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 88.854227][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.856642][ T51] udp_tunnel_nic_device_sync_work+0x39/0xa10
[ 88.859119][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.861562][ T51] ? process_scheduled_works+0xa70/0x1860
[ 88.863879][ T51] process_scheduled_works+0xb5d/0x1860
[ 88.866128][ T51] ? __pfx_process_scheduled_works+0x10/0x10
[ 88.868576][ T51] ? assign_work+0x3d5/0x5e0
[ 88.870522][ T51] worker_thread+0xa53/0xfc0
[ 88.872410][ T51] kthread+0x389/0x470
[ 88.874135][ T51] ? __pfx_worker_thread+0x10/0x10
[ 88.876411][ T51] ? __pfx_kthread+0x10/0x10
[ 88.878334][ T51] ret_from_fork+0x514/0xb70
[ 88.880271][ T51] ? __pfx_ret_from_fork+0x10/0x10
[ 88.882361][ T51] ? __switch_to+0xc79/0x1410
[ 88.884359][ T51] ? __pfx_kthread+0x10/0x10
[ 88.886356][ T51] ret_from_fork_asm+0x1a/0x30
[ 88.888331][ T51]
[ 88.890039][ T51] Kernel Offset: disabled
[ 88.891821][ T51] Rebooting in 86400 seconds..