From: syzbot <syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com>
To: davem@davemloft.net, dsahern@kernel.org, edumazet@google.com,
horms@kernel.org, idosch@nvidia.com, kuba@kernel.org,
kuniyu@google.com, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, pabeni@redhat.com,
penguin-kernel@i-love.sakura.ne.jp, raoxu@uniontech.com,
syzkaller-bugs@googlegroups.com, willemb@google.com
Subject: Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)
Date: Tue, 15 Sep 2026 05:14:38 -0700 [thread overview]
Message-ID: <6aa936ae.f81106d8.2ab401.0065.GAE@google.com> (raw)
In-Reply-To: <6a00e81a.170a0220.1c0296.0218.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1250428e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b32471580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16d742d1580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
unregister_netdevice: waiting for netdevsim2 to become free. Usage count = 2
ref_tracker: netdev@000000004118ac35 has 1/1 users at
__netdev_tracker_alloc include/linux/netdevice.h:4528 [inline]
netdev_tracker_alloc+0x68/0xb4 include/linux/netdevice.h:4540
fib_create_info+0x15cc/0x2184 net/ipv4/fib_semantics.c:1524
fib_table_insert+0xa4/0x12bc net/ipv4/fib_trie.c:1212
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
fib_add_ifaddr+0x114/0x500 net/ipv4/fib_frontend.c:1169
fib_inetaddr_event+0x114/0x1c0 net/ipv4/fib_frontend.c:1483
notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85
blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380
__inet_insert_ifa+0x87c/0xa74 net/ipv4/devinet.c:566
inet_rtm_newaddr+0xba4/0x1140 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7132
netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7159
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg+0xc8/0x17c net/socket.c:815
netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2026-09-15 12:14 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-10 20:18 syzbot
2026-05-14 1:51 ` Forwarded: [syzbot] test patch for unregister_netdevice syzbot
2026-05-14 2:08 ` Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices syzbot
2026-05-14 2:36 ` syzbot
2026-05-14 4:02 ` syzbot
2026-05-14 6:48 ` Forwarded: [syzbot] test net main baseline syzbot
2026-05-14 8:24 ` Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices syzbot
2026-05-14 11:12 ` Forwarded: [syzbot] test WARN_ON for addrconf " syzbot
2026-05-14 11:58 ` Forwarded: [syzbot] test baseline for unregister_netdevice ref leak syzbot
2026-09-15 12:14 ` syzbot [this message]
2026-09-15 12:29 ` Forwarded: Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9) syzbot
[not found] <B2CF7974DC914535+20260514015049.255578-1-raoxu@uniontech.com>
2026-05-14 1:59 ` syzbot
[not found] <950831E2452101D8+20260514020809.275684-1-raoxu@uniontech.com>
2026-05-14 2:17 ` syzbot
[not found] <0CE6AE93FEBA21AC+20260514023628.308904-1-raoxu@uniontech.com>
2026-05-14 2:45 ` syzbot
[not found] <113A84FF927506B4+20260514040220.410747-1-raoxu@uniontech.com>
2026-05-14 5:36 ` syzbot
[not found] <E61E4EBE5175D344+20260514064805.611177-1-raoxu@uniontech.com>
2026-05-14 7:30 ` syzbot
[not found] <BD680186E4DE6711+20260514082426.721996-1-raoxu@uniontech.com>
2026-05-14 9:20 ` syzbot
[not found] <FF91F2BF42AC95B3+20260514111238.1600030-1-raoxu@uniontech.com>
2026-05-14 11:43 ` syzbot
[not found] <FBE6DA28176D6E90+20260514115843.1655377-1-raoxu@uniontech.com>
2026-05-14 12:28 ` syzbot
[not found] <0d52ff78-4135-4761-a54a-d80ecfe1d88e@I-love.SAKURA.ne.jp>
2026-09-15 12:56 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aa936ae.f81106d8.2ab401.0065.GAE@google.com \
--to=syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=raoxu@uniontech.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®