From: syzbot <syzbot+d7b7f1412c02134efa6d@syzkaller.appspotmail.com>
To: idosch@nvidia.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bridge?] possible deadlock in br_multicast_rcv (3)
Date: Thu, 23 Apr 2026 09:33:01 -0700 [thread overview]
Message-ID: <69ea49bd.a00a0220.17a17.0043.GAE@google.com> (raw)
In-Reply-To: <20260423161034.GA1343000@shredder>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=4553,uid=0
Memory cgroup out of memory: Killed process 4553 (syz-executor.0) total-vm:42280kB, anon-rss:448kB, file-rss:772kB, shmem-rss:4kB, UID:0 pgtables:52kB oom_score_adj:0
unregister_netdevice: waiting for syz_tun to become free. Usage count = 10
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
dst_init+0x90/0x17c net/core/dst.c:52
dst_alloc+0xb8/0xe0 net/core/dst.c:94
rt_dst_alloc net/ipv4/route.c:1651 [inline]
__mkroute_output net/ipv4/route.c:2655 [inline]
ip_route_output_key_hash_rcu+0xa88/0xda0 net/ipv4/route.c:2875
ip_route_output_key_hash+0xe4/0x1a4 net/ipv4/route.c:2705
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x38/0xb0 net/ipv4/route.c:2932
ip_route_output_key include/net/route.h:179 [inline]
geneve_link_config+0x9c/0x268 drivers/net/geneve.c:2106
geneve_newlink+0xf4/0x12c drivers/net/geneve.c:2164
rtnl_newlink_create+0x130/0x43c net/core/rtnetlink.c:3862
__rtnl_newlink net/core/rtnetlink.c:3993 [inline]
rtnl_newlink+0xbec/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2209
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_prefix_route net/ipv6/addrconf.c:2487 [inline]
addrconf_add_linklocal+0x21c/0x324 net/ipv6/addrconf.c:3312
addrconf_addr_gen+0x268/0x2a4 net/ipv6/addrconf.c:3446
addrconf_init_auto_addrs+0x388/0x658 net/ipv6/addrconf.c:-1
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
addrconf_f6i_alloc+0x138/0x1f4 net/ipv6/route.c:4691
ipv6_add_addr+0x2a0/0x600 net/ipv6/addrconf.c:1125
addrconf_add_linklocal+0x114/0x324 net/ipv6/addrconf.c:3310
addrconf_addr_gen+0x268/0x2a4 net/ipv6/addrconf.c:3446
addrconf_init_auto_addrs+0x388/0x658 net/ipv6/addrconf.c:-1
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_add_mroute net/ipv6/addrconf.c:2551 [inline]
addrconf_add_dev+0x150/0x1d8 net/ipv6/addrconf.c:2569
addrconf_dev_config net/ipv6/addrconf.c:3483 [inline]
addrconf_init_auto_addrs+0x31c/0x658 net/ipv6/addrconf.c:3571
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_prefix_route net/ipv6/addrconf.c:2487 [inline]
fixup_permanent_addr net/ipv6/addrconf.c:3602 [inline]
addrconf_permanent_addr+0x3fc/0x57c net/ipv6/addrconf.c:3626
addrconf_notify+0x598/0x858 net/ipv6/addrconf.c:3698
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1262 [inline]
fib_check_nh+0x638/0xd30 net/ipv4/fib_semantics.c:1282
fib_create_info+0xba0/0xfa0 net/ipv4/fib_semantics.c:1502
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x200/0x258 net/ipv4/fib_frontend.c:1178
fib_netdev_event+0x2b4/0x3a4 net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1262 [inline]
fib_check_nh+0x638/0xd30 net/ipv4/fib_semantics.c:1282
fib_create_info+0xba0/0xfa0 net/ipv4/fib_semantics.c:1502
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x1c0/0x258 net/ipv4/fib_frontend.c:1171
fib_netdev_event+0x2b4/0x3a4 net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
addrconf_f6i_alloc+0x138/0x1f4 net/ipv6/route.c:4691
ipv6_add_addr+0x2a0/0x600 net/ipv6/addrconf.c:1125
inet6_addr_add+0x1e4/0x62c net/ipv6/addrconf.c:3049
inet6_rtm_newaddr+0x4f8/0x658 net/ipv6/addrconf.c:5063
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2209
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x64/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x8c/0x164 arch/arm64/kernel/syscall.c:132
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc+0x5c/0xa4 include/linux/netdevice.h:4448
fib_create_info+0xf54/0xfa0 net/ipv4/fib_semantics.c:1496
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x90/0x258 net/ipv4/fib_frontend.c:1156
fib_inetaddr_event+0x8c/0x124 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
blocking_notifier_call_chain+0x54/0x84 kernel/notifier.c:380
__inet_insert_ifa+0x464/0x58c net/ipv4/devinet.c:566
inet_rtm_newaddr+0x790/0x9f0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206
Tested on:
commit: e583f808 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=138912d2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5089b548f519d67
dashboard link: https://syzkaller.appspot.com/bug?extid=d7b7f1412c02134efa6d
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=14cb6c36580000
next parent reply other threads:[~2026-04-23 16:33 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260423161034.GA1343000@shredder>
2026-04-23 16:33 ` syzbot [this message]
2023-01-16 16:40 [Bridge] [syzbot] possible deadlock in br_multicast_rcv (3) syzbot
2023-10-02 13:08 ` [syzbot] [bridge?] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69ea49bd.a00a0220.17a17.0043.GAE@google.com \
--to=syzbot+d7b7f1412c02134efa6d@syzkaller.appspotmail.com \
--cc=idosch@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.