netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 ================================================================== BUG: KFENCE: use-after-free read in __mutex_lock_common kernel/locking/mutex.c:577 [inline] BUG: KFENCE: use-after-free read in __mutex_lock+0x147/0x1350 kernel/locking/mutex.c:760 Use-after-free read at 0xffff88823bf8efb0 (in kfence-#198): __mutex_lock_common kernel/locking/mutex.c:577 [inline] __mutex_lock+0x147/0x1350 kernel/locking/mutex.c:760 udp_tunnel_nic_device_sync_work+0x39/0xa50 net/ipv4/udp_tunnel_nic.c:737 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 kfence-#198: 0xffff88823bf8ef00-0xffff88823bf8efff, size=256, cache=kmalloc-256 allocated by task 8059 on cpu 0 at 260.074851s (0.132608s ago): kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline] udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline] udp_tunnel_nic_netdevice_event+0x4c3/0x1810 net/ipv4/udp_tunnel_nic.c:931 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] register_netdevice+0x1608/0x1ae0 net/core/dev.c:11379 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1059 [inline] nsim_create+0xb3f/0x1050 drivers/net/netdevsim/netdev.c:1141 __nsim_dev_port_add+0x6b6/0xb10 drivers/net/netdevsim/dev.c:1438 nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1494 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1546 [inline] nsim_dev_reload_up+0x451/0x780 drivers/net/netdevsim/dev.c:1003 devlink_reload+0x4ec/0x8d0 net/devlink/dev.c:474 devlink_nl_reload_doit+0xb35/0xd50 net/devlink/dev.c:584 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x830 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f freed by task 8060 on cpu 1 at 260.128338s (0.193305s ago): udp_tunnel_nic_free net/ipv4/udp_tunnel_nic.c:785 [inline] udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:910 [inline] udp_tunnel_nic_netdevice_event+0x11ab/0x1810 net/ipv4/udp_tunnel_nic.c:942 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] unregister_netdevice_many_notify+0x1860/0x2390 net/core/dev.c:12331 unregister_netdevice_many net/core/dev.c:12394 [inline] unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12208 unregister_netdevice include/linux/netdevice.h:3389 [inline] nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1178 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1473 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1485 [inline] nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1707 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:983 devlink_reload+0x1b6/0x8d0 net/devlink/dev.c:461 devlink_nl_reload_doit+0xb35/0xd50 net/devlink/dev.c:584 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x830 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 6172 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:577 [inline] RIP: 0010:__mutex_lock+0x147/0x1350 kernel/locking/mutex.c:760 Code: 28 84 c0 0f 85 2b 10 00 00 83 3d 23 76 32 0e 00 75 23 49 8d 7c 24 60 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 d9 e6 de f6 <4d> 39 64 24 60 0f 85 51 0f 00 00 bf 01 00 00 00 e8 24 23 49 f6 49 RSP: 0018:ffffc9000c107800 EFLAGS: 00010246 RAX: 1ffff110477f1df6 RBX: ffffc9000c1078e0 RCX: ffffffff99794303 RDX: ffff88802f303c80 RSI: ffffffff8d8f2d2d RDI: ffff88823bf8efb0 RBP: ffffc9000c1079b8 R08: ffffc9000c107927 R09: 0000000000000000 R10: ffffc9000c107900 R11: fffff52001820f25 R12: ffff88823bf8ef50 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126240000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bf8efb0 CR3: 0000000058b64000 CR4: 00000000003526f0 Call Trace: udp_tunnel_nic_device_sync_work+0x39/0xa50 net/ipv4/udp_tunnel_nic.c:737 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ================================================================== ---------------- Code disassembly (best guess): 0: 28 84 c0 0f 85 2b 10 sub %al,0x102b850f(%rax,%rax,8) 7: 00 00 add %al,(%rax) 9: 83 3d 23 76 32 0e 00 cmpl $0x0,0xe327623(%rip) # 0xe327633 10: 75 23 jne 0x35 12: 49 8d 7c 24 60 lea 0x60(%r12),%rdi 17: 48 89 f8 mov %rdi,%rax 1a: 48 c1 e8 03 shr $0x3,%rax 1e: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 23: 74 05 je 0x2a 25: e8 d9 e6 de f6 call 0xf6dee703 * 2a: 4d 39 64 24 60 cmp %r12,0x60(%r12) <-- trapping instruction 2f: 0f 85 51 0f 00 00 jne 0xf86 35: bf 01 00 00 00 mov $0x1,%edi 3a: e8 24 23 49 f6 call 0xf6492363 3f: 49 rex.WB