program: socket(0x2b, 0x80801, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x40e}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x40e}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0x3, 0x0, 0x0, 0x6}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r1, 0x9, &(0x7f0000002580)="b969436010cc8b5d19011e7ac3727f071c6437ad16a77810000000eb881caa55dae5a0000000") sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) (async) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r2 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) (async) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x1c9a82, 0x0) (async) r4 = openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x1c9a82, 0x0) sendfile(r4, r3, 0x0, 0xbc44) (async) sendfile(r4, r3, 0x0, 0xbc44) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r2, &(0x7f0000002540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0x38, r6, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x24008804) socket$pptp(0x18, 0x1, 0x2) socket(0x2b, 0x80801, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r9 = openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socket$netlink(0x10, 0x3, 0xb) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r9, &(0x7f00000024c0)={0x50, 0x0, r10, {0x7, 0x2d, 0x400, 0x1, 0x7ad8, 0x100, 0x1, 0x1, 0x0, 0x0, 0x2, 0x800}}, 0x50) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000881}, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000180)={0x28, 0x0, 0x0, @local}, 0x10) r11 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x14, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) (async) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x14, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) [ 101.846446][ T44] Bluetooth: hci0: command tx timeout [ 101.959200][ T5340] Set syz1 is full, maxelem 1038 reached [ 102.007786][ T5340] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.089566][ T5341] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 102.099873][ T5341] team0: Device ipvlan2 is already an upper device of the team interface [ 103.845859][ T5340] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.891016][ T44] Bluetooth: hci0: command tx timeout [ 104.175605][ T5340] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.231907][ T5340] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.293829][ T30] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.306769][ T30] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.317999][ T41] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.331334][ T41] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.339234][ T5339] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 104.348593][ T41] ================================================================== [ 104.351994][ T41] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15a/0x1550 [ 104.355247][ T41] Read of size 8 at addr ffff888011d6e8a8 by task kworker/u4:3/41 [ 104.358639][ T41] [ 104.359705][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) [ 104.359719][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.359728][ T41] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 104.359747][ T41] Call Trace: [ 104.359754][ T41] [ 104.359759][ T41] dump_stack_lvl+0xe8/0x150 [ 104.359772][ T41] print_address_description+0x55/0x1e0 [ 104.359783][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.359793][ T41] print_report+0x58/0x70 [ 104.359802][ T41] kasan_report+0x117/0x150 [ 104.359818][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.359829][ T41] __mutex_lock+0x15a/0x1550 [ 104.359839][ T41] ? __lock_acquire+0x6b5/0x2cf0 [ 104.359850][ T41] ? look_up_lock_class+0x57/0x110 [ 104.359858][ T41] ? __mutex_lock+0x608/0x1550 [ 104.359865][ T41] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 104.359873][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 104.359880][ T41] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.359894][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.359904][ T41] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 104.359917][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.359926][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.359936][ T41] process_scheduled_works+0xb5d/0x1860 [ 104.359953][ T41] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.359964][ T41] ? assign_work+0x3d5/0x5e0 [ 104.359974][ T41] worker_thread+0xa53/0xfc0 [ 104.359989][ T41] kthread+0x389/0x470 [ 104.360002][ T41] ? __pfx_worker_thread+0x10/0x10 [ 104.360011][ T41] ? __pfx_kthread+0x10/0x10 [ 104.360024][ T41] ret_from_fork+0x514/0xb70 [ 104.360036][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 104.360046][ T41] ? __switch_to+0xc79/0x1410 [ 104.360058][ T41] ? __pfx_kthread+0x10/0x10 [ 104.360068][ T41] ret_from_fork_asm+0x1a/0x30 [ 104.360083][ T41] [ 104.360086][ T41] [ 104.438616][ T41] Allocated by task 5340: [ 104.440496][ T41] kasan_save_track+0x3e/0x80 [ 104.442522][ T41] __kasan_kmalloc+0x93/0xb0 [ 104.444509][ T41] __kmalloc_noprof+0x35c/0x760 [ 104.446704][ T41] udp_tunnel_nic_netdevice_event+0x4c3/0x17d0 [ 104.449608][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.452134][ T41] register_netdevice+0x18c9/0x1ec0 [ 104.454376][ T41] nsim_create+0xbed/0x1160 [ 104.456449][ T41] __nsim_dev_port_add+0x857/0xd30 [ 104.458725][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 104.460935][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 104.463218][ T41] devlink_reload+0x4f8/0x8c0 [ 104.465468][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 104.467985][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 104.470421][ T41] genl_rcv_msg+0x61c/0x7a0 [ 104.472308][ T41] netlink_rcv_skb+0x232/0x4b0 [ 104.474415][ T41] genl_rcv+0x28/0x40 [ 104.476169][ T41] netlink_unicast+0x75c/0x8e0 [ 104.478292][ T41] netlink_sendmsg+0x813/0xb40 [ 104.480326][ T41] ____sys_sendmsg+0x972/0x9f0 [ 104.482278][ T41] ___sys_sendmsg+0x2a5/0x360 [ 104.484315][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 104.486507][ T41] do_syscall_64+0x174/0x580 [ 104.488510][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.491044][ T41] [ 104.492087][ T41] Freed by task 5339: [ 104.493820][ T41] kasan_save_track+0x3e/0x80 [ 104.496234][ T41] kasan_save_free_info+0x46/0x50 [ 104.498396][ T41] __kasan_slab_free+0x5c/0x80 [ 104.500441][ T41] kfree+0x1c5/0x640 [ 104.502151][ T41] udp_tunnel_nic_netdevice_event+0x11ed/0x17d0 [ 104.504792][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.507066][ T41] unregister_netdevice_many_notify+0x17a5/0x22c0 [ 104.509677][ T41] unregister_netdevice_queue+0x31f/0x360 [ 104.512126][ T41] nsim_destroy+0x26d/0x7f0 [ 104.514036][ T41] __nsim_dev_port_del+0x14f/0x200 [ 104.516201][ T41] nsim_dev_reload_destroy+0x288/0x490 [ 104.518644][ T41] nsim_dev_reload_down+0x8a/0xc0 [ 104.520708][ T41] devlink_reload+0x1eb/0x8c0 [ 104.522730][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 104.524844][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 104.527253][ T41] genl_rcv_msg+0x61c/0x7a0 [ 104.529344][ T41] netlink_rcv_skb+0x232/0x4b0 [ 104.531426][ T41] genl_rcv+0x28/0x40 [ 104.533178][ T41] netlink_unicast+0x75c/0x8e0 [ 104.535314][ T41] netlink_sendmsg+0x813/0xb40 [ 104.537405][ T41] ____sys_sendmsg+0x972/0x9f0 [ 104.539539][ T41] ___sys_sendmsg+0x2a5/0x360 [ 104.541581][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 104.543661][ T41] do_syscall_64+0x174/0x580 [ 104.545627][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.548117][ T41] [ 104.549206][ T41] Last potentially related work creation: [ 104.551591][ T41] kasan_save_stack+0x3e/0x60 [ 104.553608][ T41] kasan_record_aux_stack+0xbd/0xd0 [ 104.555705][ T41] insert_work+0x3d/0x330 [ 104.557599][ T41] __queue_work+0xbba/0x1040 [ 104.559752][ T41] queue_work_on+0x106/0x1d0 [ 104.561657][ T41] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 104.564106][ T41] udp_tunnel_push_rx_port+0x186/0x210 [ 104.566436][ T41] geneve_offload_rx_ports+0xc7/0x150 [ 104.568825][ T41] geneve_netdevice_event+0x6a/0x80 [ 104.571127][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.573300][ T41] call_netdevice_notifiers+0x90/0xd0 [ 104.575689][ T41] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 104.578350][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.580578][ T41] register_netdevice+0x18c9/0x1ec0 [ 104.582735][ T41] nsim_create+0xbed/0x1160 [ 104.584656][ T41] __nsim_dev_port_add+0x857/0xd30 [ 104.586785][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 104.588937][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 104.591022][ T41] devlink_reload+0x4f8/0x8c0 [ 104.592972][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 104.595217][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 104.597534][ T41] genl_rcv_msg+0x61c/0x7a0 [ 104.599653][ T41] netlink_rcv_skb+0x232/0x4b0 [ 104.601814][ T41] genl_rcv+0x28/0x40 [ 104.603333][ T41] netlink_unicast+0x75c/0x8e0 [ 104.605371][ T41] netlink_sendmsg+0x813/0xb40 [ 104.607415][ T41] ____sys_sendmsg+0x972/0x9f0 [ 104.609440][ T41] ___sys_sendmsg+0x2a5/0x360 [ 104.611382][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 104.613384][ T41] do_syscall_64+0x174/0x580 [ 104.615271][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.617733][ T41] [ 104.618819][ T41] Second to last potentially related work creation: [ 104.621645][ T41] kasan_save_stack+0x3e/0x60 [ 104.623641][ T41] kasan_record_aux_stack+0xbd/0xd0 [ 104.625841][ T41] insert_work+0x3d/0x330 [ 104.627682][ T41] __queue_work+0xcef/0x1040 [ 104.629733][ T41] queue_work_on+0x106/0x1d0 [ 104.631759][ T41] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 104.634051][ T41] udp_tunnel_push_rx_port+0x186/0x210 [ 104.636329][ T41] geneve_offload_rx_ports+0xc7/0x150 [ 104.638671][ T41] geneve_netdevice_event+0x6a/0x80 [ 104.640832][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.642988][ T41] call_netdevice_notifiers+0x90/0xd0 [ 104.645294][ T41] udp_tunnel_nic_netdevice_event+0xdef/0x17d0 [ 104.647833][ T41] notifier_call_chain+0x1ad/0x3d0 [ 104.650138][ T41] register_netdevice+0x18c9/0x1ec0 [ 104.652411][ T41] nsim_create+0xbed/0x1160 [ 104.654418][ T41] __nsim_dev_port_add+0x857/0xd30 [ 104.656700][ T41] nsim_dev_port_add_all+0x37/0xf0 [ 104.658931][ T41] nsim_dev_reload_up+0x45f/0x7c0 [ 104.661000][ T41] devlink_reload+0x4f8/0x8c0 [ 104.662856][ T41] devlink_nl_reload_doit+0xaaa/0xc80 [ 104.664956][ T41] genl_family_rcv_msg_doit+0x22a/0x330 [ 104.667196][ T41] genl_rcv_msg+0x61c/0x7a0 [ 104.668958][ T41] netlink_rcv_skb+0x232/0x4b0 [ 104.670906][ T41] genl_rcv+0x28/0x40 [ 104.672412][ T41] netlink_unicast+0x75c/0x8e0 [ 104.674224][ T41] netlink_sendmsg+0x813/0xb40 [ 104.676254][ T41] ____sys_sendmsg+0x972/0x9f0 [ 104.678359][ T41] ___sys_sendmsg+0x2a5/0x360 [ 104.680183][ T41] __x64_sys_sendmsg+0x1bd/0x2a0 [ 104.682078][ T41] do_syscall_64+0x174/0x580 [ 104.684091][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.686674][ T41] [ 104.687726][ T41] The buggy address belongs to the object at ffff888011d6e800 [ 104.687726][ T41] which belongs to the cache kmalloc-256 of size 256 [ 104.693572][ T41] The buggy address is located 168 bytes inside of [ 104.693572][ T41] freed 256-byte region [ffff888011d6e800, ffff888011d6e900) [ 104.699185][ T41] [ 104.700206][ T41] The buggy address belongs to the physical page: [ 104.702938][ T41] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d6e [ 104.706491][ T41] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 104.709558][ T41] page_type: f5(slab) [ 104.711200][ T41] raw: 00fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000 [ 104.714649][ T41] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 104.718234][ T41] page dumped because: kasan: bad access detected [ 104.720984][ T41] page_owner tracks the page as allocated [ 104.723450][ T41] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5297, tgid 5297 (syz-executor), ts 99868780826, free_ts 98802426704 [ 104.732152][ T41] post_alloc_hook+0x22d/0x280 [ 104.734200][ T41] get_page_from_freelist+0x2593/0x2610 [ 104.736552][ T41] __alloc_frozen_pages_noprof+0x18d/0x380 [ 104.739120][ T41] allocate_slab+0x77/0x660 [ 104.741148][ T41] refill_objects+0x339/0x3d0 [ 104.743101][ T41] __pcs_replace_empty_main+0x321/0x720 [ 104.745504][ T41] __kmalloc_noprof+0x474/0x760 [ 104.747647][ T41] __list_lru_init+0xba/0x5d0 [ 104.749622][ T41] alloc_super+0x8b5/0xab0 [ 104.751365][ T41] sget_fc+0x329/0xa40 [ 104.752977][ T41] get_tree_nodev+0x2a/0x150 [ 104.754953][ T41] vfs_get_tree+0x92/0x2a0 [ 104.756997][ T41] do_new_mount+0x341/0xd30 [ 104.759036][ T41] __se_sys_mount+0x31d/0x420 [ 104.761059][ T41] do_syscall_64+0x174/0x580 [ 104.763042][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.765503][ T41] page last free pid 5297 tgid 5297 stack trace: [ 104.768701][ T41] __free_frozen_pages+0xc1c/0xd30 [ 104.770826][ T41] __slab_free+0x274/0x2c0 [ 104.772718][ T41] qlist_free_all+0x99/0x100 [ 104.774774][ T41] kasan_quarantine_reduce+0x148/0x160 [ 104.777100][ T41] __kasan_slab_alloc+0x22/0x80 [ 104.779189][ T41] kmem_cache_alloc_node_noprof+0x384/0x690 [ 104.781636][ T41] __alloc_skb+0x1d0/0x7d0 [ 104.783578][ T41] netlink_ack+0x146/0xa50 [ 104.785571][ T41] netlink_rcv_skb+0x2b6/0x4b0 [ 104.787570][ T41] netlink_unicast+0x75c/0x8e0 [ 104.789607][ T41] netlink_sendmsg+0x813/0xb40 [ 104.791667][ T41] __sys_sendto+0x672/0x710 [ 104.793563][ T41] __x64_sys_sendto+0xde/0x100 [ 104.795622][ T41] do_syscall_64+0x174/0x580 [ 104.797649][ T41] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.800087][ T41] [ 104.801121][ T41] Memory state around the buggy address: [ 104.803534][ T41] ffff888011d6e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.806916][ T41] ffff888011d6e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.810315][ T41] >ffff888011d6e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.813591][ T41] ^ [ 104.815813][ T41] ffff888011d6e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.819406][ T41] ffff888011d6e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.822691][ T41] ================================================================== [ 104.847959][ T41] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.850795][ T41] CPU: 0 UID: 0 PID: 41 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full) [ 104.854331][ T41] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.858470][ T41] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 104.861665][ T41] Call Trace: [ 104.863235][ T41] [ 104.864469][ T41] vpanic+0x56c/0xa60 [ 104.866209][ T41] ? __pfx_vpanic+0x10/0x10 [ 104.868256][ T41] panic+0xc5/0xd0 [ 104.869885][ T41] ? __pfx_panic+0x10/0x10 [ 104.872346][ T41] ? preempt_schedule_thunk+0x16/0x30 [ 104.874775][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.876779][ T41] ? preempt_schedule_thunk+0x16/0x30 [ 104.879278][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.881337][ T41] check_panic_on_warn+0x89/0xb0 [ 104.883508][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.885586][ T41] end_report+0x73/0x170 [ 104.887463][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.889512][ T41] kasan_report+0x128/0x150 [ 104.891575][ T41] ? __mutex_lock+0x15a/0x1550 [ 104.893654][ T41] __mutex_lock+0x15a/0x1550 [ 104.895683][ T41] ? __lock_acquire+0x6b5/0x2cf0 [ 104.897752][ T41] ? look_up_lock_class+0x57/0x110 [ 104.900012][ T41] ? __mutex_lock+0x608/0x1550 [ 104.902123][ T41] ? udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 104.904723][ T41] ? __pfx___mutex_lock+0x10/0x10 [ 104.906791][ T41] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 104.909006][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.911333][ T41] udp_tunnel_nic_device_sync_work+0x39/0xa10 [ 104.913835][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.916169][ T41] ? process_scheduled_works+0xa70/0x1860 [ 104.918637][ T41] process_scheduled_works+0xb5d/0x1860 [ 104.920931][ T41] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.923404][ T41] ? assign_work+0x3d5/0x5e0 [ 104.925313][ T41] worker_thread+0xa53/0xfc0 [ 104.927222][ T41] kthread+0x389/0x470 [ 104.928970][ T41] ? __pfx_worker_thread+0x10/0x10 [ 104.931058][ T41] ? __pfx_kthread+0x10/0x10 [ 104.933060][ T41] ret_from_fork+0x514/0xb70 [ 104.935097][ T41] ? __pfx_ret_from_fork+0x10/0x10 [ 104.937162][ T41] ? __switch_to+0xc79/0x1410 [ 104.939097][ T41] ? __pfx_kthread+0x10/0x10 [ 104.941080][ T41] ret_from_fork_asm+0x1a/0x30 [ 104.943140][ T41] [ 104.944769][ T41] Kernel Offset: disabled [ 104.946652][ T41] Rebooting in 86400 seconds..