[syzbot] [net?] INFO: trying to register non-static key in neigh_periodic_work

[syzbot <syzbot+2f98196f4b99dca2b979@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    71c3e5409eef Merge remote-tracking branch 'will/for-next/p..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15ae21c9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c7205f05c11fb4dd
dashboard link: https://syzkaller.appspot.com/bug?extid=2f98196f4b99dca2b979
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1305400d580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/20ff6159ce99/disk-71c3e540.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d6172672705/vmlinux-71c3e540.xz
kernel image: https://storage.googleapis.com/syzbot-assets/923d5e083e1b/Image-71c3e540.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2f98196f4b99dca2b979@syzkaller.appspotmail.com

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 3103 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events_power_efficient neigh_periodic_work
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 assign_lock_key+0xcc/0xdc kernel/locking/lockdep.c:1028
 register_lock_class+0xf8/0x31c kernel/locking/lockdep.c:1343
 __lock_acquire+0x140/0x2b08 kernel/locking/lockdep.c:5162
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 __raw_write_lock include/linux/rwlock_api_smp.h:229 [inline]
 _raw_write_lock+0x48/0x60 kernel/locking/spinlock.c:335
 neigh_periodic_work+0x3bc/0x9ec net/core/neighbour.c:1004
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
Unable to handle kernel paging request at virtual address dfff800000000009
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000009] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 3103 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: netns cleanup_net
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : qdisc_reset+0xec/0x594 net/sched/sch_generic.c:1078
lr : trace_qdisc_reset include/trace/events/qdisc.h:128 [inline]
lr : qdisc_reset+0xdc/0x594 net/sched/sch_generic.c:1076
sp : ffff80009a317510
x29: ffff80009a317520 x28: 1fffe00018cc50ad x27: ffff0000c6628568
x26: 0000000000000003 x25: ffff0000c9624800 x24: ffff0000c6628018
x23: 0000000000000000 x22: dfff800000000000 x21: ffff800088a77ec8
x20: 0000000000000048 x19: ffff0000c9624818 x18: 1fffe00035bd7428
x17: 0000000000000003 x16: ffff800088a77000 x15: ffff800088b27700
x14: ffff0001adeba14c x13: 0000000000000001 x12: 0000000000000004
x11: ffff700013462e98 x10: 0000000000000003 x9 : 0000000000000200
x8 : 0000000000000009 x7 : 0000000000000000 x6 : ffff800084df21d4
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800084def98c
x2 : 0000000000000002 x1 : ffff0000cde31d80 x0 : 0000000000000000
Call trace:
 qdisc_reset+0xec/0x594 net/sched/sch_generic.c:1078 (P)
 dev_reset_queue+0x10c/0x1f0 include/net/sch_generic.h:756
 netdev_for_each_tx_queue include/linux/netdevice.h:2752 [inline]
 dev_deactivate_many+0x490/0x9d0 net/sched/sch_generic.c:1394
 __dev_close_many+0x178/0x648 net/core/dev.c:1782
 netif_close_many+0x1d8/0x51c net/core/dev.c:1824
 unregister_netdevice_many_notify+0x740/0x1760 net/core/dev.c:12530
 unregister_netdevice_many+0x28/0x38 net/core/dev.c:12632
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x32c/0x81c net/core/net_namespace.c:249
 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: 14000002 96e12f3e 910122f4 d343fe88 (38766908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	14000002 	b	0x8
   4:	96e12f3e 	bl	0xfffffffffb84bcfc
   8:	910122f4 	add	x20, x23, #0x48
   c:	d343fe88 	lsr	x8, x20, #3
* 10:	38766908 	ldrb	w8, [x8, x22] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup