program: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800000004000400"/28], 0x1c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800000004000400"/28], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES32=r2], 0x20}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES32=r2], 0x20}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) (async) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) syz_usb_connect(0x1, 0xffffff18, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x2, 0x0, {}, [@NHA_OIF={0x8, 0x5, r7}]}, 0x20}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) (async) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0xc0010001, 0x0, 0x400003}]}) syz_usb_connect(0x0, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505", @ANYRESDEC], 0x0) r11 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0x28}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001000)={{{@in6=@mcast1, @in6=@mcast1}}, {{@in=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000001100)=0xe8) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x8000d0, &(0x7f0000001140), 0x1, 0x588, &(0x7f0000000600)="$eJzs3U9sHFcZAPBvdh0ncU3ThEZqyiGBRKR/lNjtSk4DB8IBDhT1UiRUqRysZGOHrGNju6I2F/fGiSIBAlRRNeKABBKxxAE4VBQkDkgECYEQFmolEAf+tIBwD5QARrM7a2+8s84i27vF8/tJm33zZuzvvd18b3ffm/UEUFgn0n+SiOGIuBkRhxqbtx9wonH37cry5I3K8mQSa2tP/jWpH3e9sjzZPLT5c3dFxFJE3BcRP7occXFfe9y5hcWr47VadTbbHpmfmhmZW1g8c2VqfKI6Ub1WqTx2fmzs/Lmx0f+hN8mWez8+8/qRX08+MfHS8X89dW7q639J4kK937GpHzspr0UDScSF3QjWB+W0PxEx1OXxR6vPv7zLTaJLXzyyMpI+d/dGxKl6/h+Kcv3ZjPjAi0///VC8/1ann7258uIfe9lWAGDnrKX2b70b2JtKkX72T0pnI6JRLpXOnm18hr83hkq16bn5hy9PP3PtUmOO4J7YV7p8pVYdzeYK7ol9Sbr9SL28sf3opu1KRByOiM+WD9a3z16crl3q6UgHNA1HvPadT10cvGtT/v+h3Mh/YO9K8/+XP/7eD9Lym+V+twbopTT/v/nm1OMh/6Fw7pz/B3reJqA3vP5Dccl/KK72/N/63Flg7/D6D8Ul/6G45D8Ul/yH4pL/UFyt+S/9oZgOH39lJYmIpfcdrN9Sg9m+nD/bA+wha2uJL/lDQXnvD8U1sFE82M92AL3nMz5wp7P/O34beGbn2wL0RqnfDQD65vQx639QVOb/obgG+t0AoG+8xwfM/0PxmP+H4hrucP2vd7Rcu2s0Iu6OiJ+W9+1vXusL+P81HPHaCze/+3RE6U9J9v7/9KFTw+Ovv/rD1uMGk3/UlwgGI+LTLzz55WfH5+dnH0nr/7ZeP/+VrP7RfvUG6EYzT5t5DBTX3MLi1fFarTqroLCpEPG2aIbCLhaa48D1yvJk89arsef5hyLe+GDjJIQ07o3s1tg7kM1NHqivUQ6tJredq5DswNrl585ELD0XEffl9T/JrnfeWPkYWi23xX9ndp/ejmXzJ+kxR7uMX757e/Hvb4l/vCX+u7qMv/KxLg/cJYe/1d/4L/1mfdlrIO/xH9jmV2KP3GH/49/Y1q/ftt//rr/xTx3vb/wvTUe8ko4/o3n5V0rTcn3ls3X8+cLnG/Omg9uM/5nTG+Pfjbbxr7Q+/pU7jH8nuozzk6eqn8irL/8s4o3nIu7Pjd+Md6Aea2i11Bb/ZMv488AW8f/80V9czau/8GrE2vWI05EfvzXWyPzUzMjcwuKZK1PjE9WJ6rVK5bHzY2Pnz42NjtTnqEeaM9Xtnrh19EN59Se/1uj/UIf4zf53evzXtuhzq8WvfnL43Tn1Pz/WiP/Ayfzn/0gWv/H4D7TFf092n/4/+Xd2Lm96zFsRsT+rfzAivv/y4Yfy2vWRW434lzr0v3Rb/Pb+P9xl/+O3/3kmr/rZD3f7CwCAndR5aqDfLQMAAHZaL1Ya+91HIN/Q6mC0LgMnSy3rCksb6wpp/VvZ+kJ5KeKf2RpDWv9gtkqWlnMXGoC3naOL7/1Vv9sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUHRzC4tXx2u16uxcv1sC9Np/AwAA//8Fjv+b") open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) (async) r12 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r12, 0x40286608, &(0x7f0000000000)={0x200, 0x1, 0xfffffffffffffffc, 0x6, 0x1}) process_vm_writev(0x0, &(0x7f0000003180)=[{&(0x7f0000000f80)=""/80, 0x50}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/32, 0x20}, {&(0x7f0000002fc0)=""/201, 0xc9}, {&(0x7f00000030c0)=""/42, 0x2a}, {&(0x7f0000003100)=""/98, 0x62}], 0x6, &(0x7f0000004540)=[{&(0x7f0000003200)=""/243, 0xf3}, {&(0x7f0000000280)=""/14, 0xe}, {&(0x7f0000003340)=""/4096, 0x1000}, {&(0x7f0000004340)=""/121, 0x79}, {&(0x7f00000043c0)=""/201, 0xc9}, {&(0x7f00000044c0)=""/79, 0x4f}], 0x6, 0x0) (async) process_vm_writev(0x0, &(0x7f0000003180)=[{&(0x7f0000000f80)=""/80, 0x50}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/32, 0x20}, {&(0x7f0000002fc0)=""/201, 0xc9}, {&(0x7f00000030c0)=""/42, 0x2a}, {&(0x7f0000003100)=""/98, 0x62}], 0x6, &(0x7f0000004540)=[{&(0x7f0000003200)=""/243, 0xf3}, {&(0x7f0000000280)=""/14, 0xe}, {&(0x7f0000003340)=""/4096, 0x1000}, {&(0x7f0000004340)=""/121, 0x79}, {&(0x7f00000043c0)=""/201, 0xc9}, {&(0x7f00000044c0)=""/79, 0x4f}], 0x6, 0x0) syz_mount_image$nilfs2(&(0x7f0000000a40), &(0x7f0000000a80)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00a717cf64394a00dc299b573660f498c4d99aac48af10923f703f53e58070c2bf4575228d0e471df7101ac03b8d48a1b0fc276e395f25b63e9a27cd2ab98888989eec154d97b4dbcf"], 0x1, 0xa09, &(0x7f0000001540)="$eJzs3UuMHEfdAPDq2Z31M5/H+WyyOCaxCSThkd14vZiHBXEUX7DiiFukiIvlOMHCMQhHgkQ52D5xI1FkrjzEKZcIEBK5ICsnLpGIJS45BQ4csIwUiQME7EW7WzU7+/eMemZt73h2fj+ptqa6aqaqZ3t6erq7qhIwthpLf+fnp6uULr3z5tG/P/y3LYtLnmiXaC39nexINVNKVU5Phtf7cGI5vv7Raye7xVWaW/pb0umZa+3nbkspnU/70uXUSnsuXXnjvbmnj184dnH/+28dvnpn1h4AAMbLty4fnt/9lz/dv/Pjtx84kja1l5fj81ZOb8/H/UfygX85/m+k1emqI3SaCuUmc2iEchNdynXW0wzlJnvUPxVet9mj3Kaa+ic6lnVbbxhlZTtupaoxsyrdaMzMLP8mT0u/66eqmbOnz7xwbkgNBW67fz6YUtonCMI4hoUdw94DASyL1wtvcj6eWbg17Veb7K/+a082uj8fboP13v7VP1r1/+qCPQ63z0bdmsp6lc/R9pyO1xHi/UuDfv7L68XrEc0+29nrOsKoXF/o1c6JdW7HWvVqf9wuNqqv57i8D98I+Z2fn/g/HZX/MdDdv5z/F4SxDQvD3gEBd61439xCVvLjfX0xf1NN/uaa/C01+Vtr8rfV5MM4++3LP0mvVyu/8+Nv+kHPh5XzbPfk+P8GbE88Hzlo/fG+30Hdav3xfmK4m/3+xLOnvvL8c1eW7/+v2tv/jby978vpVv5sXc4FyvnCeF69fe9/a3U9jR7l7g3tuadL+aXHu1aXq3atvE7q2M/c1I7p1c/b0avc3tXlWqHclhw2h/bG45Ot4Xnl+KPsV8v7NRnWtxnWYyq0o+xXduY4tgPWomyPve7/L9vndGpWL5w+c+rxnC7b6R8nmpsWlx9Y53YDt67f/j/TaXX/n+3t5c1G535hx8ryqnO/0ArL53osP5jT5XvuOxNblpbPnPzemedv98rDmDv3yqvfPXHmzKkfeOCBBx60Hwx7zwTcabMvv/T92XOvvPrY6ZdOvHjqxVNnDx46dHBu7tBXD87PLh3Xz3Ye3QMbycqX/rBbAgAAAAAAAAAAAPTrh8eOXvnzu1/+YLn//0r/v9L/v9z5W/r//zj0/4/95Es/+NIPcGeX/KUyYYDVqVCumcP/h/buCvXsDs/7RI7b8/jl/v+lujiua2nPfWF5HL+3lAvDCdw0XspUGIMkzhf46RxfzPEvEwxRtaX74hzXjW9dtvUyPoVxKUZT+b+VraGMY1L6f/ca16ns/3euQxu5/dajO+Gw1xHo7h/G/xaEsQ0LC2bxAO4Ow57/s5z3LPHZP3xz82Ioxa49uXp/GccvhVtxt88/qf6NNf9ne/67vvd/Yca81trq/ffPrn7QUW3a02/9cf3LONC7Bqv/41x/WZtHUn/1L/wi1B8vCPXpP6H+rX3Wf9P6711b/f/N9Ze37dGH+q1/ucVVY3U74nnjcv0vnjcurof1L2N7Drz+a5yo8UauH8bZqMwzO6hRmf+3l3gfxpdyuuwIy30Ocb6TQdtf7q8o3wO7w+tXNd9v5v8dbV/Lcd3nocz/W7bHVpd0oyPd7PLebtR9DYyqD13/E4SxDQsLC3f2hFaNoVbO0N//Yf9OGHb9w37/68T5f+MxfJz/N+bH+X9jfpz/N+bH+fVifpz/N76fcf7fmH9feN04P/B0Tf4na/L31OTfX5O/tyb/UzX5+2vyH6jJf7Am/96a/Idq8j9Tk//ZmvyHa/Ifrcn/XE3+Rlf6o4zr+sM4i/3zfP5hfJTrP70+/7tq8oHR9dO3Dzz13G++3Vru/z/VPh9SruMdyelm/u38o5yO171TR3ox792c/mvIv9vPd8A4ieNnxO/3R2rygdFV7vPy+YYxVHUfsaffcat6HeczWj6f4y/k+Is5fizHMzmezfGBHM+tU/u4M5769e8Ov16t/N7fEfL7vZ889geK40Qd7LM98fzAoPezx3H8BnWr9a+xOxgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDQNJb+zs9PVyldeufNo88ePz27uOSJdonW0t/JjlSz/byUHs/xRI5/nh9c/+i1k53xjcV4KqUqzaUqVe3l6Zlr7Zq2pZTOp33pcmqlPZeuvPHe3NPHLxy7uP/9tw5fvYNvAQAAAGx4/wsAAP//2XsNow==") ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r13 = open(&(0x7f0000000080)='.\x00', 0x0, 0x1b5) ioctl$EXT4_IOC_GROUP_ADD(r13, 0x40186e8d, &(0x7f0000000040)={0x0, 0x42c0000000003f, 0x400, 0x200000003, 0x6, 0x3, 0x2401}) ioctl$USBDEVFS_SUBMITURB(r11, 0x8038550a, &(0x7f0000000240)=@urb_type_iso={0x0, {0x5}, 0x3, 0x80, 0x0, 0x0, 0x2, 0x6512c6de, 0x4, 0xc, 0x100, 0x0}) [ 84.431677][ T5295] Bluetooth: hci0: command tx timeout [ 84.732365][ T5335] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.497927][ T5295] Bluetooth: hci0: command tx timeout [ 86.923450][ T5335] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.205458][ T5335] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.252675][ T5335] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.308664][ T1156] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.322400][ T1156] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.334712][ T1156] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.352582][ T179] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.362710][ T5340] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.375130][ T179] ================================================================== [ 87.378684][ T179] BUG: KASAN: slab-use-after-free in __mutex_lock+0x154/0x1590 [ 87.381970][ T179] Read of size 8 at addr ffff88801fc984a8 by task kworker/u4:6/179 [ 87.385422][ T179] [ 87.386656][ T179] CPU: 0 UID: 0 PID: 179 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 87.386674][ T179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.386683][ T179] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 87.386712][ T179] Call Trace: [ 87.386720][ T179] [ 87.386727][ T179] dump_stack_lvl+0xe8/0x150 [ 87.386743][ T179] print_address_description+0x55/0x1e0 [ 87.386758][ T179] ? __mutex_lock+0x154/0x1590 [ 87.386770][ T179] print_report+0x58/0x70 [ 87.386781][ T179] kasan_report+0x117/0x150 [ 87.386796][ T179] ? __mutex_lock+0x154/0x1590 [ 87.386806][ T179] __mutex_lock+0x154/0x1590 [ 87.386818][ T179] ? __mutex_lock+0x5c5/0x1590 [ 87.386829][ T179] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 87.386843][ T179] ? __pfx___mutex_lock+0x10/0x10 [ 87.386855][ T179] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.386874][ T179] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 87.386891][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 87.386904][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 87.386915][ T179] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 87.386930][ T179] ? rcu_is_watching+0x15/0xb0 [ 87.386946][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 87.386958][ T179] process_scheduled_works+0xa8e/0x14e0 [ 87.386976][ T179] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.386990][ T179] ? assign_work+0x3cf/0x5d0 [ 87.387003][ T179] worker_thread+0xa47/0xfb0 [ 87.387020][ T179] ? __kthread_parkme+0x71/0x1f0 [ 87.387037][ T179] kthread+0x389/0x470 [ 87.387052][ T179] ? __pfx_worker_thread+0x10/0x10 [ 87.387065][ T179] ? __pfx_kthread+0x10/0x10 [ 87.387079][ T179] ret_from_fork+0x514/0xb70 [ 87.387094][ T179] ? __pfx_ret_from_fork+0x10/0x10 [ 87.387107][ T179] ? __switch_to+0xc89/0x1420 [ 87.387127][ T179] ? __pfx_kthread+0x10/0x10 [ 87.387143][ T179] ret_from_fork_asm+0x1a/0x30 [ 87.387163][ T179] [ 87.387168][ T179] [ 87.475320][ T179] Allocated by task 5335: [ 87.477184][ T179] kasan_save_track+0x3e/0x80 [ 87.479211][ T179] __kasan_kmalloc+0x93/0xb0 [ 87.481113][ T179] __kmalloc_noprof+0x358/0x750 [ 87.483213][ T179] udp_tunnel_nic_netdevice_event+0x4e9/0x1850 [ 87.486664][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.489594][ T179] register_netdevice+0x18db/0x1f00 [ 87.491741][ T179] nsim_create+0xbd7/0x1140 [ 87.493720][ T179] __nsim_dev_port_add+0x7f8/0xcd0 [ 87.495680][ T179] nsim_dev_port_add_all+0x37/0xf0 [ 87.497735][ T179] nsim_dev_reload_up+0x47d/0x780 [ 87.499702][ T179] devlink_reload+0x4b2/0x890 [ 87.501748][ T179] devlink_nl_reload_doit+0xa9c/0xc80 [ 87.504164][ T179] genl_family_rcv_msg_doit+0x233/0x340 [ 87.506857][ T179] genl_rcv_msg+0x614/0x7a0 [ 87.509074][ T179] netlink_rcv_skb+0x226/0x4a0 [ 87.511167][ T179] genl_rcv+0x28/0x40 [ 87.512947][ T179] netlink_unicast+0x7bb/0x940 [ 87.514952][ T179] netlink_sendmsg+0x813/0xb40 [ 87.517346][ T179] ____sys_sendmsg+0x9b9/0xa20 [ 87.519977][ T179] ___sys_sendmsg+0x2a5/0x360 [ 87.522266][ T179] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.524357][ T179] do_syscall_64+0x174/0x580 [ 87.526614][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.529273][ T179] [ 87.530306][ T179] Freed by task 5340: [ 87.531861][ T179] kasan_save_track+0x3e/0x80 [ 87.534201][ T179] kasan_save_free_info+0x40/0x50 [ 87.536804][ T179] __kasan_slab_free+0x5c/0x80 [ 87.539069][ T179] kfree+0x1c5/0x640 [ 87.540786][ T179] udp_tunnel_nic_netdevice_event+0x1236/0x1850 [ 87.543370][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.545427][ T179] unregister_netdevice_many_notify+0x182a/0x2370 [ 87.548328][ T179] unregister_netdevice_queue+0x2f5/0x340 [ 87.551256][ T179] nsim_destroy+0x26d/0x800 [ 87.553474][ T179] __nsim_dev_port_del+0x14e/0x200 [ 87.555843][ T179] nsim_dev_reload_destroy+0x288/0x490 [ 87.558238][ T179] nsim_dev_reload_down+0x8a/0xc0 [ 87.560222][ T179] devlink_reload+0x1c5/0x890 [ 87.562207][ T179] devlink_nl_reload_doit+0xa9c/0xc80 [ 87.564720][ T179] genl_family_rcv_msg_doit+0x233/0x340 [ 87.567380][ T179] genl_rcv_msg+0x614/0x7a0 [ 87.569724][ T179] netlink_rcv_skb+0x226/0x4a0 [ 87.571967][ T179] genl_rcv+0x28/0x40 [ 87.573614][ T179] netlink_unicast+0x7bb/0x940 [ 87.575517][ T179] netlink_sendmsg+0x813/0xb40 [ 87.577594][ T179] ____sys_sendmsg+0x9b9/0xa20 [ 87.579832][ T179] ___sys_sendmsg+0x2a5/0x360 [ 87.582002][ T179] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.584205][ T179] do_syscall_64+0x174/0x580 [ 87.586109][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.588612][ T179] [ 87.589636][ T179] Last potentially related work creation: [ 87.592140][ T179] kasan_save_stack+0x3e/0x60 [ 87.594840][ T179] kasan_record_aux_stack+0xbd/0xd0 [ 87.597524][ T179] insert_work+0x3d/0x330 [ 87.599296][ T179] __queue_work+0xb7c/0xff0 [ 87.601217][ T179] queue_work_on+0x106/0x1d0 [ 87.603262][ T179] __udp_tunnel_nic_add_port+0xba9/0xd90 [ 87.605658][ T179] udp_tunnel_push_rx_port+0x186/0x210 [ 87.607991][ T179] geneve_offload_rx_ports+0xc7/0x150 [ 87.610339][ T179] geneve_netdevice_event+0x6a/0x80 [ 87.613465][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.616200][ T179] call_netdevice_notifiers+0x90/0xd0 [ 87.618409][ T179] udp_tunnel_nic_netdevice_event+0xe33/0x1850 [ 87.621319][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.623503][ T179] register_netdevice+0x18db/0x1f00 [ 87.625825][ T179] nsim_create+0xbd7/0x1140 [ 87.627841][ T179] __nsim_dev_port_add+0x7f8/0xcd0 [ 87.630320][ T179] nsim_dev_port_add_all+0x37/0xf0 [ 87.633019][ T179] nsim_dev_reload_up+0x47d/0x780 [ 87.635336][ T179] devlink_reload+0x4b2/0x890 [ 87.637477][ T179] devlink_nl_reload_doit+0xa9c/0xc80 [ 87.639899][ T179] genl_family_rcv_msg_doit+0x233/0x340 [ 87.642232][ T179] genl_rcv_msg+0x614/0x7a0 [ 87.644387][ T179] netlink_rcv_skb+0x226/0x4a0 [ 87.646885][ T179] genl_rcv+0x28/0x40 [ 87.648814][ T179] netlink_unicast+0x7bb/0x940 [ 87.651316][ T179] netlink_sendmsg+0x813/0xb40 [ 87.653361][ T179] ____sys_sendmsg+0x9b9/0xa20 [ 87.655407][ T179] ___sys_sendmsg+0x2a5/0x360 [ 87.657454][ T179] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.659715][ T179] do_syscall_64+0x174/0x580 [ 87.662113][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.665459][ T179] [ 87.666867][ T179] Second to last potentially related work creation: [ 87.669731][ T179] kasan_save_stack+0x3e/0x60 [ 87.671697][ T179] kasan_record_aux_stack+0xbd/0xd0 [ 87.673853][ T179] insert_work+0x3d/0x330 [ 87.675708][ T179] __queue_work+0xcb6/0xff0 [ 87.677774][ T179] queue_work_on+0x106/0x1d0 [ 87.679772][ T179] __udp_tunnel_nic_add_port+0xba9/0xd90 [ 87.683047][ T179] udp_tunnel_push_rx_port+0x186/0x210 [ 87.686313][ T179] geneve_offload_rx_ports+0xc7/0x150 [ 87.688662][ T179] geneve_netdevice_event+0x6a/0x80 [ 87.690792][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.692850][ T179] call_netdevice_notifiers+0x90/0xd0 [ 87.695077][ T179] udp_tunnel_nic_netdevice_event+0xe33/0x1850 [ 87.697946][ T179] notifier_call_chain+0x1a5/0x3d0 [ 87.700428][ T179] register_netdevice+0x18db/0x1f00 [ 87.702647][ T179] nsim_create+0xbd7/0x1140 [ 87.704542][ T179] __nsim_dev_port_add+0x7f8/0xcd0 [ 87.706874][ T179] nsim_dev_port_add_all+0x37/0xf0 [ 87.709763][ T179] nsim_dev_reload_up+0x47d/0x780 [ 87.712215][ T179] devlink_reload+0x4b2/0x890 [ 87.714555][ T179] devlink_nl_reload_doit+0xa9c/0xc80 [ 87.717035][ T179] genl_family_rcv_msg_doit+0x233/0x340 [ 87.719379][ T179] genl_rcv_msg+0x614/0x7a0 [ 87.721287][ T179] netlink_rcv_skb+0x226/0x4a0 [ 87.723401][ T179] genl_rcv+0x28/0x40 [ 87.725471][ T179] netlink_unicast+0x7bb/0x940 [ 87.728764][ T179] netlink_sendmsg+0x813/0xb40 [ 87.731526][ T179] ____sys_sendmsg+0x9b9/0xa20 [ 87.733654][ T179] ___sys_sendmsg+0x2a5/0x360 [ 87.735768][ T179] __x64_sys_sendmsg+0x1bd/0x2a0 [ 87.738011][ T179] do_syscall_64+0x174/0x580 [ 87.740023][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.742703][ T179] [ 87.743942][ T179] The buggy address belongs to the object at ffff88801fc98400 [ 87.743942][ T179] which belongs to the cache kmalloc-256 of size 256 [ 87.750397][ T179] The buggy address is located 168 bytes inside of [ 87.750397][ T179] freed 256-byte region [ffff88801fc98400, ffff88801fc98500) [ 87.756179][ T179] [ 87.757450][ T179] The buggy address belongs to the physical page: [ 87.760984][ T179] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fc98 [ 87.764984][ T179] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 87.768039][ T179] page_type: f5(slab) [ 87.769930][ T179] raw: 00fff00000000000 ffff88801ac41b40 dead000000000122 0000000000000000 [ 87.773572][ T179] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 87.777577][ T179] page dumped because: kasan: bad access detected [ 87.780636][ T179] page_owner tracks the page as allocated [ 87.783253][ T179] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5294, tgid 5294 (syz-executor), ts 82691945503, free_ts 82670981423 [ 87.792752][ T179] post_alloc_hook+0x22d/0x280 [ 87.794787][ T179] get_page_from_freelist+0x24ae/0x2530 [ 87.797070][ T179] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.799574][ T179] allocate_slab+0x77/0x660 [ 87.801537][ T179] refill_objects+0x336/0x3d0 [ 87.803841][ T179] __pcs_replace_empty_main+0x320/0x720 [ 87.807158][ T179] __kmalloc_noprof+0x464/0x750 [ 87.809372][ T179] __list_lru_init+0xba/0x5d0 [ 87.811420][ T179] alloc_super+0x870/0xa60 [ 87.813330][ T179] sget_fc+0x32b/0xa40 [ 87.814964][ T179] get_tree_nodev+0x2a/0x150 [ 87.816820][ T179] vfs_get_tree+0x92/0x2a0 [ 87.818737][ T179] do_new_mount+0x319/0xdc0 [ 87.820749][ T179] __se_sys_mount+0x31d/0x420 [ 87.822999][ T179] do_syscall_64+0x174/0x580 [ 87.825342][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.828010][ T179] page last free pid 75 tgid 75 stack trace: [ 87.830359][ T179] free_unref_folios+0xdb2/0x14d0 [ 87.832489][ T179] shrink_folio_list+0x4b13/0x5320 [ 87.834816][ T179] evict_folios+0x4827/0x5970 [ 87.837295][ T179] try_to_shrink_lruvec+0xac5/0xf40 [ 87.839697][ T179] shrink_one+0x233/0x700 [ 87.841512][ T179] shrink_node+0x31d6/0x3a40 [ 87.843414][ T179] kswapd+0x170d/0x2d60 [ 87.845253][ T179] kthread+0x389/0x470 [ 87.847112][ T179] ret_from_fork+0x514/0xb70 [ 87.849427][ T179] ret_from_fork_asm+0x1a/0x30 [ 87.852063][ T179] [ 87.853166][ T179] Memory state around the buggy address: [ 87.855576][ T179] ffff88801fc98380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.859116][ T179] ffff88801fc98400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.862886][ T179] >ffff88801fc98480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.866660][ T179] ^ [ 87.869087][ T179] ffff88801fc98500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.872787][ T179] ffff88801fc98580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 87.876920][ T179] ================================================================== [ 87.940451][ T179] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.943923][ T179] CPU: 0 UID: 0 PID: 179 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 87.947978][ T179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.952468][ T179] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 87.956320][ T179] Call Trace: [ 87.957823][ T179] [ 87.959175][ T179] vpanic+0x56c/0xa60 [ 87.961063][ T179] ? __pfx_vpanic+0x10/0x10 [ 87.963071][ T179] panic+0xc5/0xd0 [ 87.964855][ T179] ? __pfx_panic+0x10/0x10 [ 87.966827][ T179] ? preempt_schedule_thunk+0x16/0x30 [ 87.969341][ T179] ? __mutex_lock+0x154/0x1590 [ 87.971578][ T179] ? preempt_schedule_thunk+0x16/0x30 [ 87.974319][ T179] ? __mutex_lock+0x154/0x1590 [ 87.976528][ T179] check_panic_on_warn+0x89/0xb0 [ 87.978753][ T179] ? __mutex_lock+0x154/0x1590 [ 87.980996][ T179] end_report+0x73/0x170 [ 87.983145][ T179] ? __mutex_lock+0x154/0x1590 [ 87.986091][ T179] kasan_report+0x128/0x150 [ 87.987975][ T179] ? __mutex_lock+0x154/0x1590 [ 87.989932][ T179] __mutex_lock+0x154/0x1590 [ 87.991852][ T179] ? __mutex_lock+0x5c5/0x1590 [ 87.994192][ T179] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 87.997453][ T179] ? __pfx___mutex_lock+0x10/0x10 [ 87.999903][ T179] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.002179][ T179] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 88.004537][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 88.006985][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 88.009631][ T179] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 88.013058][ T179] ? rcu_is_watching+0x15/0xb0 [ 88.015465][ T179] ? process_scheduled_works+0xa20/0x14e0 [ 88.017968][ T179] process_scheduled_works+0xa8e/0x14e0 [ 88.020425][ T179] ? __pfx_process_scheduled_works+0x10/0x10 [ 88.023058][ T179] ? assign_work+0x3cf/0x5d0 [ 88.025074][ T179] worker_thread+0xa47/0xfb0 [ 88.027140][ T179] ? __kthread_parkme+0x71/0x1f0 [ 88.029707][ T179] kthread+0x389/0x470 [ 88.031940][ T179] ? __pfx_worker_thread+0x10/0x10 [ 88.034411][ T179] ? __pfx_kthread+0x10/0x10 [ 88.036514][ T179] ret_from_fork+0x514/0xb70 [ 88.038531][ T179] ? __pfx_ret_from_fork+0x10/0x10 [ 88.040779][ T179] ? __switch_to+0xc89/0x1420 [ 88.043099][ T179] ? __pfx_kthread+0x10/0x10 [ 88.045704][ T179] ret_from_fork_asm+0x1a/0x30 [ 88.048188][ T179] [ 88.049880][ T179] Kernel Offset: disabled [ 88.051724][ T179] Rebooting in 86400 seconds..