[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5cbb61bf4168 arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=142f40ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103f3dba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04156ec16593/disk-5cbb61bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bfa041e2c79/vmlinux-5cbb61bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a92d82d8a79e/Image-5cbb61bf.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7915d7230a1d/mount_6.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15005a73980000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com

unregister_netdevice: waiting for netdevsim1 to become free. Usage count = 2
ref_tracker: netdev@00000000f11a2c54 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
     ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
     addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [syzbot] test patch for unregister_netdevice

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test patch for unregister_netdevice
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;
 
 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,6 +3694,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

From: Xu Rao <raoxu@uniontech.com>
Date: Tue, 12 May 2026 20:44:10 +0800
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,6 +3694,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

--
2.50.1

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3694,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test net main baseline

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test net main baseline
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3694,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test WARN_ON for addrconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test WARN_ON for addrconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH debug] ipv6: addrconf: warn on autoconf for unregistering devices

Add WARN_ON() checks where the proposed fix skips IPv6 autoconf on
unregistering devices.  This is a diagnostic patch to confirm whether
the syzbot reproducer reaches the MTU / UP / CHANGE paths after the
netdevice has entered NETREG_UNREGISTERING.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 net/ipv6/addrconf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..72a3b17d30a1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		WARN_ON(dev->reg_state == NETREG_UNREGISTERING);
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3693,14 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		WARN_ON(dev->reg_state == NETREG_UNREGISTERING);
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test baseline for unregister_netdevice ref leak

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test baseline for unregister_netdevice ref leak
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
error: corrupt patch at line 24



Tested on:

commit:         59afae20 selftests/tc-testing: Add QFQ/CBS qlen underf..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14415636580000

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
error: corrupt patch at line 24



Tested on:

commit:         b84c5632 net: net_failover: Fix the deadlock in slave ..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15798950580000

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
error: corrupt patch at line 24



Tested on:

commit:         cc21150c Merge branch 'macsec-use-rcu_work-to-fix-cryp..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13458950580000

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "64" "ARCH=arm64" "CROSS_COMPILE=aarch64-linux-gnu-" "LLVM=1" "Image.gz"]: exit status 2


Tested on:

commit:         cc21150c Merge branch 'macsec-use-rcu_work-to-fix-cryp..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15a90d6a580000

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "64" "ARCH=arm64" "CROSS_COMPILE=aarch64-linux-gnu-" "LLVM=1" "Image.gz"]: exit status 2


Tested on:

commit:         cc21150c Merge branch 'macsec-use-rcu_work-to-fix-cryp..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64

Note: no patches were applied.

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Tested-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com

Tested on:

commit:         5cbb61bf arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=147a20ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12255636580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Tested-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com

Tested on:

commit:         5cbb61bf arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10eae996580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1182da73980000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free

unregister_netdevice: waiting for syz_tun to become free. Usage count = 8
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
     addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
     addrconf_add_linklocal+0x238/0x378 net/ipv6/addrconf.c:3313
     addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
     addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
     ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
     addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
     addrconf_add_mroute+0x14c/0x1cc net/ipv6/addrconf.c:2552
     addrconf_add_dev+0xe8/0x1a0 net/ipv6/addrconf.c:2570
     addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
     addrconf_init_auto_addrs+0x304/0x764 net/ipv6/addrconf.c:3572
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
     rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
     addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
     fixup_permanent_addr net/ipv6/addrconf.c:3603 [inline]
     addrconf_permanent_addr+0x5a8/0x824 net/ipv6/addrconf.c:3639
     addrconf_notify+0x690/0xbe4 net/ipv6/addrconf.c:3706
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
     rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
     netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_hold include/linux/netdevice.h:4500 [inline]
     fib_check_nh_nongw net/ipv4/fib_semantics.c:1261 [inline]
     fib_check_nh+0x968/0x1548 net/ipv4/fib_semantics.c:1281
     fib_create_info+0x13d8/0x2100 net/ipv4/fib_semantics.c:1501
     fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
     fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
     fib_add_ifaddr+0x334/0x4e4 net/ipv4/fib_frontend.c:1178
     fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1516
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
     rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
     netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
     rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
     ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
     inet6_addr_add+0x2a4/0x78c net/ipv6/addrconf.c:3050
     inet6_rtm_newaddr+0x738/0xa58 net/ipv6/addrconf.c:5071
     rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
     netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
     rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec net/socket.c:787 [inline]
     __sock_sendmsg+0xc8/0x138 net/socket.c:802
     __sys_sendto+0x254/0x338 net/socket.c:2265
     __do_sys_sendto net/socket.c:2272 [inline]
     __se_sys_sendto net/socket.c:2268 [inline]
     __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2268
     __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
     invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49

ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc+0x68/0xb0 include/linux/netdevice.h:4483
     fib_create_info+0x1b14/0x2100 net/ipv4/fib_semantics.c:1495
     fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
     fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
     fib_add_ifaddr+0x118/0x4e4 net/ipv4/fib_frontend.c:1156
     fib_inetaddr_event+0x114/0x1c0 net/ipv4/fib_frontend.c:1470
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380
     __inet_insert_ifa+0x828/0xa0c net/ipv4/devinet.c:566
     inet_rtm_newaddr+0xb58/0x10e8 net/ipv4/devinet.c:1001
     rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
     netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
     rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec net/socket.c:787 [inline]
     __sock_sendmsg+0xc8/0x138 net/socket.c:802



Tested on:

commit:         5cbb61bf arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15f620ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64

Note: no patches were applied.