program: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f00000006c0)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', r1}, 0x94) socket$netlink(0x10, 0x3, 0x10) (async) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) syz_usb_connect(0x2, 0x2d, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r2, r1, 0x25, 0x8, @void}, 0x10) sendmsg$AUDIT_SIGNAL_INFO(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3f2, 0x20, 0x70bd29, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4}, 0x10000885) [ 84.767037][ T5327] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.842847][ T5291] Bluetooth: hci0: command tx timeout [ 86.387150][ T5327] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.923376][ T5291] Bluetooth: hci0: command tx timeout [ 87.089178][ T5327] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.137217][ T5327] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.204526][ T127] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.222174][ T127] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.237596][ T127] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.250162][ T127] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.260201][ T5328] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.275041][ T127] ================================================================== [ 87.279327][ T127] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550 [ 87.283420][ T127] Read of size 8 at addr ffff8880384b86a8 by task kworker/u4:5/127 [ 87.287351][ T127] [ 87.288413][ T127] CPU: 0 UID: 0 PID: 127 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 87.288427][ T127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.288435][ T127] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 87.288454][ T127] Call Trace: [ 87.288461][ T127] [ 87.288467][ T127] dump_stack_lvl+0xe8/0x150 [ 87.288481][ T127] print_address_description+0x55/0x1e0 [ 87.288493][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.288503][ T127] print_report+0x58/0x70 [ 87.288511][ T127] kasan_report+0x117/0x150 [ 87.288527][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.288538][ T127] __mutex_lock+0x15a/0x1550 [ 87.288548][ T127] ? __lock_acquire+0x6b5/0x2cf0 [ 87.288559][ T127] ? look_up_lock_class+0x57/0x110 [ 87.288570][ T127] ? __mutex_lock+0x608/0x1550 [ 87.288580][ T127] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 87.288592][ T127] ? __pfx___mutex_lock+0x10/0x10 [ 87.288604][ T127] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 87.288618][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.288629][ T127] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 87.288644][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.288653][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.288663][ T127] process_scheduled_works+0xb5d/0x1860 [ 87.288680][ T127] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.288691][ T127] ? assign_work+0x3d5/0x5e0 [ 87.288701][ T127] worker_thread+0xa53/0xfc0 [ 87.288717][ T127] kthread+0x389/0x470 [ 87.288731][ T127] ? __pfx_worker_thread+0x10/0x10 [ 87.288740][ T127] ? __pfx_kthread+0x10/0x10 [ 87.288753][ T127] ret_from_fork+0x514/0xb70 [ 87.288765][ T127] ? __pfx_ret_from_fork+0x10/0x10 [ 87.288775][ T127] ? __switch_to+0xc79/0x1410 [ 87.288789][ T127] ? __pfx_kthread+0x10/0x10 [ 87.288801][ T127] ret_from_fork_asm+0x1a/0x30 [ 87.288817][ T127] [ 87.288820][ T127] [ 87.367046][ T127] Allocated by task 5327: [ 87.368916][ T127] kasan_save_track+0x3e/0x80 [ 87.370992][ T127] __kasan_kmalloc+0x93/0xb0 [ 87.372942][ T127] __kmalloc_noprof+0x35c/0x760 [ 87.374982][ T127] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0 [ 87.377698][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.380217][ T127] register_netdevice+0x18c9/0x1ec0 [ 87.382632][ T127] nsim_create+0xbed/0x1160 [ 87.384527][ T127] __nsim_dev_port_add+0x857/0xd30 [ 87.386671][ T127] nsim_dev_port_add_all+0x37/0xf0 [ 87.388811][ T127] nsim_dev_reload_up+0x45f/0x7c0 [ 87.390911][ T127] devlink_reload+0x4f8/0x8c0 [ 87.393111][ T127] devlink_nl_reload_doit+0xaaa/0xc80 [ 87.395083][ T127] genl_family_rcv_msg_doit+0x22a/0x330 [ 87.397248][ T127] genl_rcv_msg+0x61c/0x7a0 [ 87.399147][ T127] netlink_rcv_skb+0x232/0x4b0 [ 87.401306][ T127] genl_rcv+0x28/0x40 [ 87.403074][ T127] netlink_unicast+0x75c/0x8e0 [ 87.405140][ T127] netlink_sendmsg+0x813/0xb40 [ 87.407213][ T127] ____sys_sendmsg+0x972/0x9f0 [ 87.409271][ T127] ___sys_sendmsg+0x2a5/0x360 [ 87.411269][ T127] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.413407][ T127] do_syscall_64+0x174/0x580 [ 87.415275][ T127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.417658][ T127] [ 87.418672][ T127] Freed by task 5328: [ 87.420356][ T127] kasan_save_track+0x3e/0x80 [ 87.422327][ T127] kasan_save_free_info+0x46/0x50 [ 87.424446][ T127] __kasan_slab_free+0x5c/0x80 [ 87.426455][ T127] kfree+0x1c5/0x640 [ 87.428056][ T127] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0 [ 87.430546][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.432508][ T127] unregister_netdevice_many_notify+0x17a5/0x22c0 [ 87.435024][ T127] unregister_netdevice_queue+0x31f/0x360 [ 87.437253][ T127] nsim_destroy+0x26d/0x7f0 [ 87.439023][ T127] __nsim_dev_port_del+0x14f/0x200 [ 87.441050][ T127] nsim_dev_reload_destroy+0x288/0x490 [ 87.443181][ T127] nsim_dev_reload_down+0x8a/0xc0 [ 87.445091][ T127] devlink_reload+0x1eb/0x8c0 [ 87.446939][ T127] devlink_nl_reload_doit+0xaaa/0xc80 [ 87.449018][ T127] genl_family_rcv_msg_doit+0x22a/0x330 [ 87.451314][ T127] genl_rcv_msg+0x61c/0x7a0 [ 87.453550][ T127] netlink_rcv_skb+0x232/0x4b0 [ 87.456054][ T127] genl_rcv+0x28/0x40 [ 87.458144][ T127] netlink_unicast+0x75c/0x8e0 [ 87.460652][ T127] netlink_sendmsg+0x813/0xb40 [ 87.462906][ T127] ____sys_sendmsg+0x972/0x9f0 [ 87.465462][ T127] ___sys_sendmsg+0x2a5/0x360 [ 87.467853][ T127] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.470347][ T127] do_syscall_64+0x174/0x580 [ 87.472834][ T127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.475411][ T127] [ 87.476437][ T127] Last potentially related work creation: [ 87.478759][ T127] kasan_save_stack+0x3e/0x60 [ 87.480762][ T127] kasan_record_aux_stack+0xbd/0xd0 [ 87.482917][ T127] insert_work+0x3d/0x330 [ 87.484446][ T127] __queue_work+0xbba/0x1040 [ 87.486232][ T127] queue_work_on+0x106/0x1d0 [ 87.488146][ T127] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 87.490462][ T127] udp_tunnel_push_rx_port+0x186/0x210 [ 87.492870][ T127] geneve_offload_rx_ports+0xc7/0x150 [ 87.495112][ T127] geneve_netdevice_event+0x6a/0x80 [ 87.497373][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.499429][ T127] call_netdevice_notifiers+0x90/0xd0 [ 87.501696][ T127] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 87.504321][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.506478][ T127] register_netdevice+0x18c9/0x1ec0 [ 87.508708][ T127] nsim_create+0xbed/0x1160 [ 87.510682][ T127] __nsim_dev_port_add+0x857/0xd30 [ 87.512908][ T127] nsim_dev_port_add_all+0x37/0xf0 [ 87.515018][ T127] nsim_dev_reload_up+0x45f/0x7c0 [ 87.517003][ T127] devlink_reload+0x4f8/0x8c0 [ 87.518962][ T127] devlink_nl_reload_doit+0xaaa/0xc80 [ 87.521313][ T127] genl_family_rcv_msg_doit+0x22a/0x330 [ 87.523550][ T127] genl_rcv_msg+0x61c/0x7a0 [ 87.525445][ T127] netlink_rcv_skb+0x232/0x4b0 [ 87.527368][ T127] genl_rcv+0x28/0x40 [ 87.529000][ T127] netlink_unicast+0x75c/0x8e0 [ 87.530948][ T127] netlink_sendmsg+0x813/0xb40 [ 87.532901][ T127] ____sys_sendmsg+0x972/0x9f0 [ 87.534799][ T127] ___sys_sendmsg+0x2a5/0x360 [ 87.536629][ T127] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.538551][ T127] do_syscall_64+0x174/0x580 [ 87.540357][ T127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.542795][ T127] [ 87.543818][ T127] Second to last potentially related work creation: [ 87.546412][ T127] kasan_save_stack+0x3e/0x60 [ 87.548371][ T127] kasan_record_aux_stack+0xbd/0xd0 [ 87.550468][ T127] insert_work+0x3d/0x330 [ 87.552206][ T127] __queue_work+0xcef/0x1040 [ 87.554073][ T127] queue_work_on+0x106/0x1d0 [ 87.555995][ T127] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 87.558161][ T127] udp_tunnel_push_rx_port+0x186/0x210 [ 87.560228][ T127] geneve_offload_rx_ports+0xc7/0x150 [ 87.562425][ T127] geneve_netdevice_event+0x6a/0x80 [ 87.564533][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.566481][ T127] call_netdevice_notifiers+0x90/0xd0 [ 87.568572][ T127] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 87.571003][ T127] notifier_call_chain+0x1ad/0x3d0 [ 87.573015][ T127] register_netdevice+0x18c9/0x1ec0 [ 87.575073][ T127] nsim_create+0xbed/0x1160 [ 87.576922][ T127] __nsim_dev_port_add+0x857/0xd30 [ 87.578966][ T127] nsim_dev_port_add_all+0x37/0xf0 [ 87.581131][ T127] nsim_dev_reload_up+0x45f/0x7c0 [ 87.583307][ T127] devlink_reload+0x4f8/0x8c0 [ 87.585314][ T127] devlink_nl_reload_doit+0xaaa/0xc80 [ 87.587585][ T127] genl_family_rcv_msg_doit+0x22a/0x330 [ 87.589910][ T127] genl_rcv_msg+0x61c/0x7a0 [ 87.591830][ T127] netlink_rcv_skb+0x232/0x4b0 [ 87.593778][ T127] genl_rcv+0x28/0x40 [ 87.595605][ T127] netlink_unicast+0x75c/0x8e0 [ 87.598060][ T127] netlink_sendmsg+0x813/0xb40 [ 87.600516][ T127] ____sys_sendmsg+0x972/0x9f0 [ 87.602846][ T127] ___sys_sendmsg+0x2a5/0x360 [ 87.604798][ T127] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.606853][ T127] do_syscall_64+0x174/0x580 [ 87.608745][ T127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.611217][ T127] [ 87.612305][ T127] The buggy address belongs to the object at ffff8880384b8600 [ 87.612305][ T127] which belongs to the cache kmalloc-256 of size 256 [ 87.618068][ T127] The buggy address is located 168 bytes inside of [ 87.618068][ T127] freed 256-byte region [ffff8880384b8600, ffff8880384b8700) [ 87.623571][ T127] [ 87.624621][ T127] The buggy address belongs to the physical page: [ 87.627175][ T127] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x384b8 [ 87.630749][ T127] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 87.633659][ T127] page_type: f5(slab) [ 87.635399][ T127] raw: 04fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000 [ 87.638949][ T127] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 87.642440][ T127] page dumped because: kasan: bad access detected [ 87.645312][ T127] page_owner tracks the page as allocated [ 87.647696][ T127] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5290, tgid 5290 (syz-executor), ts 82875042016, free_ts 82413683629 [ 87.655960][ T127] post_alloc_hook+0x22d/0x280 [ 87.658186][ T127] get_page_from_freelist+0x2593/0x2610 [ 87.660552][ T127] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.663074][ T127] allocate_slab+0x77/0x660 [ 87.664990][ T127] refill_objects+0x339/0x3d0 [ 87.666955][ T127] __pcs_replace_empty_main+0x321/0x720 [ 87.669118][ T127] __kmalloc_noprof+0x474/0x760 [ 87.670991][ T127] __list_lru_init+0xba/0x5d0 [ 87.672981][ T127] alloc_super+0x8b5/0xab0 [ 87.674945][ T127] sget_fc+0x329/0xa40 [ 87.676705][ T127] get_tree_nodev+0x2a/0x150 [ 87.678682][ T127] vfs_get_tree+0x92/0x2a0 [ 87.680371][ T127] do_new_mount+0x341/0xd30 [ 87.682335][ T127] __se_sys_mount+0x31d/0x420 [ 87.684409][ T127] do_syscall_64+0x174/0x580 [ 87.686372][ T127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.688936][ T127] page last free pid 15 tgid 15 stack trace: [ 87.691536][ T127] __free_frozen_pages+0xc1c/0xd30 [ 87.693814][ T127] tlb_remove_table_rcu+0x85/0x100 [ 87.696053][ T127] rcu_core+0x7cd/0x1070 [ 87.697894][ T127] handle_softirqs+0x22a/0x840 [ 87.700051][ T127] __irq_exit_rcu+0xca/0x220 [ 87.702066][ T127] irq_exit_rcu+0x9/0x30 [ 87.703888][ T127] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 87.706284][ T127] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 87.708933][ T127] [ 87.709993][ T127] Memory state around the buggy address: [ 87.712366][ T127] ffff8880384b8580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.715711][ T127] ffff8880384b8600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.719063][ T127] >ffff8880384b8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.722470][ T127] ^ [ 87.724733][ T127] ffff8880384b8700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.728064][ T127] ffff8880384b8780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.731549][ T127] ================================================================== [ 87.754861][ T127] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.757709][ T127] CPU: 0 UID: 0 PID: 127 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) [ 87.761726][ T127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.766107][ T127] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 87.769205][ T127] Call Trace: [ 87.770672][ T127] [ 87.772010][ T127] vpanic+0x56c/0xa60 [ 87.773767][ T127] ? __pfx_vpanic+0x10/0x10 [ 87.775701][ T127] panic+0xc5/0xd0 [ 87.777366][ T127] ? __pfx_panic+0x10/0x10 [ 87.779328][ T127] ? preempt_schedule_thunk+0x16/0x30 [ 87.781610][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.783711][ T127] ? preempt_schedule_thunk+0x16/0x30 [ 87.786103][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.788135][ T127] check_panic_on_warn+0x89/0xb0 [ 87.790250][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.792381][ T127] end_report+0x73/0x170 [ 87.794212][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.796208][ T127] kasan_report+0x128/0x150 [ 87.798143][ T127] ? __mutex_lock+0x15a/0x1550 [ 87.800234][ T127] __mutex_lock+0x15a/0x1550 [ 87.802294][ T127] ? __lock_acquire+0x6b5/0x2cf0 [ 87.804413][ T127] ? look_up_lock_class+0x57/0x110 [ 87.806670][ T127] ? __mutex_lock+0x608/0x1550 [ 87.808781][ T127] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 87.811533][ T127] ? __pfx___mutex_lock+0x10/0x10 [ 87.813719][ T127] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 87.816042][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.818492][ T127] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 87.821109][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.823601][ T127] ? process_scheduled_works+0xa70/0x1860 [ 87.826069][ T127] process_scheduled_works+0xb5d/0x1860 [ 87.828548][ T127] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.831130][ T127] ? assign_work+0x3d5/0x5e0 [ 87.833209][ T127] worker_thread+0xa53/0xfc0 [ 87.835268][ T127] kthread+0x389/0x470 [ 87.837125][ T127] ? __pfx_worker_thread+0x10/0x10 [ 87.839369][ T127] ? __pfx_kthread+0x10/0x10 [ 87.841485][ T127] ret_from_fork+0x514/0xb70 [ 87.843511][ T127] ? __pfx_ret_from_fork+0x10/0x10 [ 87.845760][ T127] ? __switch_to+0xc79/0x1410 [ 87.847852][ T127] ? __pfx_kthread+0x10/0x10 [ 87.849966][ T127] ret_from_fork_asm+0x1a/0x30 [ 87.852115][ T127] [ 87.853851][ T127] Kernel Offset: disabled [ 87.855702][ T127] Rebooting in 86400 seconds..