program: r0 = socket$netlink(0x10, 0x3, 0x10) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000003280), 0x80000, 0x0) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000032c0), 0x2) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000003300)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000003540), 0x80000) read$FUSE(r3, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) (async) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000003d80)={0x1, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) [ 86.843610][ T4656] Bluetooth: hci0: command tx timeout [ 86.956816][ T5327] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.905513][ T4656] Bluetooth: hci0: command tx timeout [ 89.057820][ T5327] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.130811][ T5327] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.213991][ T5327] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.335913][ T1147] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.372841][ T1147] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.409594][ T1147] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.434029][ T41] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.457489][ T5328] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 89.478027][ T41] ================================================================== [ 89.482136][ T41] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550 [ 89.500493][ T41] Read of size 8 at addr ffff88804123b6a8 by task kworker/u4:3/41 [ 89.504034][ T41] [ 89.505255][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) [ 89.505271][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.505280][ T41] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 89.505301][ T41] Call Trace: [ 89.505309][ T41] [ 89.505315][ T41] dump_stack_lvl+0xe8/0x150 [ 89.505328][ T41] print_address_description+0x55/0x1e0 [ 89.505340][ T41] ? __mutex_lock+0x15a/0x1550 [ 89.505351][ T41] print_report+0x58/0x70 [ 89.505360][ T41] kasan_report+0x117/0x150 [ 89.505377][ T41] ? __mutex_lock+0x15a/0x1550 [ 89.505390][ T41] __mutex_lock+0x15a/0x1550 [ 89.505400][ T41] ? __lock_acquire+0x6b5/0x2cf0 [ 89.505411][ T41] ? look_up_lock_class+0x57/0x110 [ 89.505423][ T41] ? __mutex_lock+0x608/0x1550 [ 89.505434][ T41] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 89.505446][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 89.505458][ T41] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 89.505473][ T41] ? process_scheduled_works+0xa70/0x1860 [ 89.505486][ T41] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 89.505500][ T41] ? process_scheduled_works+0xa70/0x1860 [ 89.505510][ T41] ? process_scheduled_works+0xa70/0x1860 [ 89.505521][ T41] process_scheduled_works+0xb5d/0x1860 [ 89.505538][ T41] ? __pfx_process_scheduled_works+0x10/0x10 [ 89.505550][ T41] ? assign_work+0x3d5/0x5e0 [ 89.505561][ T41] worker_thread+0xa53/0xfc0 [ 89.505577][ T41] kthread+0x389/0x470 [ 89.505588][ T41] ? __pfx_worker_thread+0x10/0x10 [ 89.505597][ T41] ? __pfx_kthread+0x10/0x10 [ 89.505610][ T41] ret_from_fork+0x514/0xb70 [ 89.505623][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 89.505633][ T41] ? __switch_to+0xc79/0x1410 [ 89.505648][ T41] ? __pfx_kthread+0x10/0x10 [ 89.505660][ T41] ret_from_fork_asm+0x1a/0x30 [ 89.505676][ T41] [ 89.505679][ T41] [ 89.650476][ T41] Allocated by task 5327: [ 89.652968][ T41] kasan_save_track+0x3e/0x80 [ 89.655717][ T41] __kasan_kmalloc+0x93/0xb0 [ 89.657938][ T41] __kmalloc_noprof+0x35c/0x760 [ 89.660036][ T41] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0 [ 89.662873][ T41] notifier_call_chain+0x1ad/0x3d0 [ 89.673395][ T41] register_netdevice+0x18c9/0x1ec0 [ 89.677278][ T41] nsim_create+0xbed/0x1160 [ 89.679874][ T41] __nsim_dev_port_add+0x857/0xd30 [ 89.682701][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 89.685564][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 89.688521][ T41] devlink_reload+0x4f8/0x8c0 [ 89.691217][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 89.695096][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 89.698348][ T41] genl_rcv_msg+0x61c/0x7a0 [ 89.701383][ T41] netlink_rcv_skb+0x232/0x4b0 [ 89.704088][ T41] genl_rcv+0x28/0x40 [ 89.706342][ T41] netlink_unicast+0x75c/0x8e0 [ 89.709362][ T41] netlink_sendmsg+0x813/0xb40 [ 89.714835][ T41] ____sys_sendmsg+0x972/0x9f0 [ 89.717511][ T41] ___sys_sendmsg+0x2a5/0x360 [ 89.720053][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 89.722787][ T41] do_syscall_64+0x174/0x580 [ 89.725773][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.729044][ T41] [ 89.730435][ T41] Freed by task 5328: [ 89.746595][ T41] kasan_save_track+0x3e/0x80 [ 89.748543][ T41] kasan_save_free_info+0x46/0x50 [ 89.750503][ T41] __kasan_slab_free+0x5c/0x80 [ 89.768394][ T41] kfree+0x1c5/0x640 [ 89.770161][ T41] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0 [ 89.774018][ T41] notifier_call_chain+0x1ad/0x3d0 [ 89.777048][ T41] unregister_netdevice_many_notify+0x17a5/0x22c0 [ 89.780538][ T41] unregister_netdevice_queue+0x31f/0x360 [ 89.783682][ T41] nsim_destroy+0x26d/0x7f0 [ 89.786418][ T41] __nsim_dev_port_del+0x14f/0x200 [ 89.789250][ T41] nsim_dev_reload_destroy+0x288/0x490 [ 89.793294][ T41] nsim_dev_reload_down+0x8a/0xc0 [ 89.797443][ T41] devlink_reload+0x1eb/0x8c0 [ 89.801943][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 89.805415][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 89.808663][ T41] genl_rcv_msg+0x61c/0x7a0 [ 89.811260][ T41] netlink_rcv_skb+0x232/0x4b0 [ 89.814001][ T41] genl_rcv+0x28/0x40 [ 89.816487][ T41] netlink_unicast+0x75c/0x8e0 [ 89.819088][ T41] netlink_sendmsg+0x813/0xb40 [ 89.821932][ T41] ____sys_sendmsg+0x972/0x9f0 [ 89.824260][ T41] ___sys_sendmsg+0x2a5/0x360 [ 89.826163][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 89.828223][ T41] do_syscall_64+0x174/0x580 [ 89.830750][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.834049][ T41] [ 89.835462][ T41] Last potentially related work creation: [ 89.838552][ T41] kasan_save_stack+0x3e/0x60 [ 89.841933][ T41] kasan_record_aux_stack+0xbd/0xd0 [ 89.845457][ T41] insert_work+0x3d/0x330 [ 89.848811][ T41] __queue_work+0xbba/0x1040 [ 89.850690][ T41] queue_work_on+0x106/0x1d0 [ 89.852617][ T41] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 89.854916][ T41] udp_tunnel_push_rx_port+0x186/0x210 [ 89.857102][ T41] geneve_offload_rx_ports+0xc7/0x150 [ 89.859263][ T41] geneve_netdevice_event+0x6a/0x80 [ 89.862099][ T41] notifier_call_chain+0x1ad/0x3d0 [ 89.865488][ T41] call_netdevice_notifiers+0x90/0xd0 [ 89.867648][ T41] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 89.870197][ T41] notifier_call_chain+0x1ad/0x3d0 [ 89.872415][ T41] register_netdevice+0x18c9/0x1ec0 [ 89.874604][ T41] nsim_create+0xbed/0x1160 [ 89.877487][ T41] __nsim_dev_port_add+0x857/0xd30 [ 89.879517][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 89.881634][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 89.883683][ T41] devlink_reload+0x4f8/0x8c0 [ 89.887721][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 89.914092][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 89.918136][ T41] genl_rcv_msg+0x61c/0x7a0 [ 89.920744][ T41] netlink_rcv_skb+0x232/0x4b0 [ 89.923522][ T41] genl_rcv+0x28/0x40 [ 89.925935][ T41] netlink_unicast+0x75c/0x8e0 [ 89.929810][ T41] netlink_sendmsg+0x813/0xb40 [ 89.936594][ T41] ____sys_sendmsg+0x972/0x9f0 [ 89.938798][ T41] ___sys_sendmsg+0x2a5/0x360 [ 89.940923][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 89.943169][ T41] do_syscall_64+0x174/0x580 [ 89.957724][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.960157][ T41] [ 89.961522][ T41] Second to last potentially related work creation: [ 89.979993][ T41] kasan_save_stack+0x3e/0x60 [ 89.986381][ T41] kasan_record_aux_stack+0xbd/0xd0 [ 89.993403][ T41] insert_work+0x3d/0x330 [ 90.028715][ T41] __queue_work+0xcef/0x1040 [ 90.031762][ T41] queue_work_on+0x106/0x1d0 [ 90.035565][ T41] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 90.047499][ T41] udp_tunnel_push_rx_port+0x186/0x210 [ 90.050514][ T41] geneve_offload_rx_ports+0xc7/0x150 [ 90.053341][ T41] geneve_netdevice_event+0x6a/0x80 [ 90.056967][ T41] notifier_call_chain+0x1ad/0x3d0 [ 90.088802][ T41] call_netdevice_notifiers+0x90/0xd0 [ 90.097452][ T41] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 90.100900][ T41] notifier_call_chain+0x1ad/0x3d0 [ 90.107290][ T41] register_netdevice+0x18c9/0x1ec0 [ 90.109405][ T41] nsim_create+0xbed/0x1160 [ 90.111247][ T41] __nsim_dev_port_add+0x857/0xd30 [ 90.113359][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 90.121667][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 90.124688][ T41] devlink_reload+0x4f8/0x8c0 [ 90.127512][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 90.130737][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 90.134051][ T41] genl_rcv_msg+0x61c/0x7a0 [ 90.136588][ T41] netlink_rcv_skb+0x232/0x4b0 [ 90.139202][ T41] genl_rcv+0x28/0x40 [ 90.141805][ T41] netlink_unicast+0x75c/0x8e0 [ 90.145611][ T41] netlink_sendmsg+0x813/0xb40 [ 90.148290][ T41] ____sys_sendmsg+0x972/0x9f0 [ 90.150938][ T41] ___sys_sendmsg+0x2a5/0x360 [ 90.153687][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 90.156484][ T41] do_syscall_64+0x174/0x580 [ 90.159075][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.162453][ T41] [ 90.163807][ T41] The buggy address belongs to the object at ffff88804123b600 [ 90.163807][ T41] which belongs to the cache kmalloc-256 of size 256 [ 90.171524][ T41] The buggy address is located 168 bytes inside of [ 90.171524][ T41] freed 256-byte region [ffff88804123b600, ffff88804123b700) [ 90.204423][ T41] [ 90.215566][ T41] The buggy address belongs to the physical page: [ 90.218106][ T41] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4123b [ 90.221813][ T41] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 90.236076][ T41] page_type: f5(slab) [ 90.237722][ T41] raw: 04fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000 [ 90.241031][ T41] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 90.244251][ T41] page dumped because: kasan: bad access detected [ 90.257449][ T41] page_owner tracks the page as allocated [ 90.266401][ T41] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5290, tgid 5290 (syz-executor), ts 84519392286, free_ts 84516208623 [ 90.281696][ T41] post_alloc_hook+0x22d/0x280 [ 90.290167][ T41] get_page_from_freelist+0x2593/0x2610 [ 90.292718][ T41] __alloc_frozen_pages_noprof+0x18d/0x380 [ 90.299675][ T41] allocate_slab+0x77/0x660 [ 90.301824][ T41] refill_objects+0x339/0x3d0 [ 90.304063][ T41] __pcs_replace_empty_main+0x321/0x720 [ 90.310833][ T41] __kmalloc_noprof+0x474/0x760 [ 90.313013][ T41] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 90.330366][ T41] genl_family_rcv_msg_doit+0xd9/0x330 [ 90.332947][ T41] genl_rcv_msg+0x61c/0x7a0 [ 90.339232][ T41] netlink_rcv_skb+0x232/0x4b0 [ 90.341774][ T41] genl_rcv+0x28/0x40 [ 90.343525][ T41] netlink_unicast+0x75c/0x8e0 [ 90.350215][ T41] netlink_sendmsg+0x813/0xb40 [ 90.353014][ T41] __sys_sendto+0x672/0x710 [ 90.355724][ T41] __x64_sys_sendto+0xde/0x100 [ 90.360502][ T41] page last free pid 41 tgid 41 stack trace: [ 90.371198][ T41] __free_frozen_pages+0xc1c/0xd30 [ 90.374152][ T41] rcu_core+0x7cd/0x1070 [ 90.380839][ T41] handle_softirqs+0x22a/0x840 [ 90.383606][ T41] __irq_exit_rcu+0xca/0x220 [ 90.387446][ T41] irq_exit_rcu+0x9/0x30 [ 90.389462][ T41] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 90.392033][ T41] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 90.394753][ T41] [ 90.395889][ T41] Memory state around the buggy address: [ 90.398488][ T41] ffff88804123b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 90.423064][ T41] ffff88804123b600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 90.426717][ T41] >ffff88804123b680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 90.430340][ T41] ^ [ 90.435930][ T41] ffff88804123b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 90.442804][ T41] ffff88804123b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 90.452577][ T41] ================================================================== [ 90.558124][ T41] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 90.567436][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) [ 90.571081][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 90.585095][ T41] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 90.587998][ T41] Call Trace: [ 90.589323][ T41] [ 90.590528][ T41] vpanic+0x56c/0xa60 [ 90.592156][ T41] ? __pfx_vpanic+0x10/0x10 [ 90.593955][ T41] panic+0xc5/0xd0 [ 90.609348][ T41] ? __pfx_panic+0x10/0x10 [ 90.612574][ T41] ? preempt_schedule_thunk+0x16/0x30 [ 90.617552][ T41] ? __mutex_lock+0x15a/0x1550 [ 90.641323][ T41] ? preempt_schedule_thunk+0x16/0x30 [ 90.644427][ T41] ? __mutex_lock+0x15a/0x1550 [ 90.647373][ T41] check_panic_on_warn+0x89/0xb0 [ 90.650215][ T41] ? __mutex_lock+0x15a/0x1550 [ 90.667586][ T41] end_report+0x73/0x170 [ 90.670460][ T41] ? __mutex_lock+0x15a/0x1550 [ 90.691961][ T41] kasan_report+0x128/0x150 [ 90.694810][ T41] ? __mutex_lock+0x15a/0x1550 [ 90.697537][ T41] __mutex_lock+0x15a/0x1550 [ 90.700144][ T41] ? __lock_acquire+0x6b5/0x2cf0 [ 90.702906][ T41] ? look_up_lock_class+0x57/0x110 [ 90.715512][ T41] ? __mutex_lock+0x608/0x1550 [ 90.717758][ T41] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 90.720079][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 90.721934][ T41] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 90.724794][ T41] ? process_scheduled_works+0xa70/0x1860 [ 90.739208][ T41] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 90.742696][ T41] ? process_scheduled_works+0xa70/0x1860 [ 90.745329][ T41] ? process_scheduled_works+0xa70/0x1860 [ 90.747929][ T41] process_scheduled_works+0xb5d/0x1860 [ 90.756953][ T41] ? __pfx_process_scheduled_works+0x10/0x10 [ 90.765233][ T41] ? assign_work+0x3d5/0x5e0 [ 90.767924][ T41] worker_thread+0xa53/0xfc0 [ 90.770543][ T41] kthread+0x389/0x470 [ 90.773733][ T41] ? __pfx_worker_thread+0x10/0x10 [ 90.786443][ T41] ? __pfx_kthread+0x10/0x10 [ 90.789091][ T41] ret_from_fork+0x514/0xb70 [ 90.791731][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 90.794684][ T41] ? __switch_to+0xc79/0x1410 [ 90.805262][ T41] ? __pfx_kthread+0x10/0x10 [ 90.807832][ T41] ret_from_fork_asm+0x1a/0x30 [ 90.810227][ T41] [ 90.812100][ T41] Kernel Offset: disabled [ 90.814507][ T41] Rebooting in 86400 seconds..