[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5cbb61bf4168 arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=142f40ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103f3dba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04156ec16593/disk-5cbb61bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bfa041e2c79/vmlinux-5cbb61bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a92d82d8a79e/Image-5cbb61bf.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7915d7230a1d/mount_6.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15005a73980000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com

unregister_netdevice: waiting for netdevsim1 to become free. Usage count = 2
ref_tracker: netdev@00000000f11a2c54 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
     ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
     addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [syzbot] test patch for unregister_netdevice

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test patch for unregister_netdevice
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;
 
 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,6 +3694,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

From: Xu Rao <raoxu@uniontech.com>
Date: Tue, 12 May 2026 20:44:10 +0800
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,6 +3694,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

--
2.50.1

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3694,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test net main baseline

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test net main baseline
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main

Forwarded: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH net v2] ipv6: addrconf: skip autoconf on unregistering devices

syzbot reports that unregister_netdevice() can wait forever for a
netdevsim device whose reference count never drops to zero.

The leaked reference is held by an IPv6 local route created from
addrconf.  A late NETDEV_CHANGE notification can still reach
addrconf_notify() after the device has entered NETREG_UNREGISTERING.
The handler can then run automatic address configuration, add a
link-local address and install its host route after unregister teardown
has already started.  The route nexthop takes a netdev reference in
fib6_nh_init(), and there might not be a later ifdown pass to remove
the newly created address and route.

Do not run MTU, UP or CHANGE based IPv6 autoconfiguration once the
device is unregistering.  Keep NETDEV_DOWN and NETDEV_UNREGISTER
handling unchanged so the teardown path can still remove existing IPv6
state.

Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
v2:
- Drop READ_ONCE() around dev->reg_state.  addrconf_notify() is called
  from the netdevice notifier path, so a plain load is sufficient.
- Do not add a Fixes tag.  The issue does not appear to be caused by a
  single commit, but by a long-standing unregister-time lifecycle gap.

 net/ipv6/addrconf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..a517e57cf86a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3694,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		if (dev->reg_state == NETREG_UNREGISTERING)
+			break;
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test WARN_ON for addrconf on unregistering devices

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test WARN_ON for addrconf on unregistering devices
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

From: Xu Rao <raoxu@uniontech.com>
Subject: [PATCH debug] ipv6: addrconf: warn on autoconf for unregistering devices

Add WARN_ON() checks where the proposed fix skips IPv6 autoconf on
unregistering devices.  This is a diagnostic patch to confirm whether
the syzbot reproducer reaches the MTU / UP / CHANGE paths after the
netdevice has entered NETREG_UNREGISTERING.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 net/ipv6/addrconf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5476b6536eb7..72a3b17d30a1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3666,6 +3666,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		break;

 	case NETDEV_CHANGEMTU:
+		WARN_ON(dev->reg_state == NETREG_UNREGISTERING);
+
 		/* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
 		if (dev->mtu < IPV6_MIN_MTU) {
 			addrconf_ifdown(dev, dev != net->loopback_dev);
@@ -3691,12 +3693,14 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 		fallthrough;
 	case NETDEV_UP:
 	case NETDEV_CHANGE:
+		WARN_ON(dev->reg_state == NETREG_UNREGISTERING);
+
 		if (idev && idev->cnf.disable_ipv6)
 			break;

 		if (dev->priv_flags & IFF_NO_ADDRCONF) {
 			if (event == NETDEV_UP && !IS_ERR_OR_NULL(idev) &&
 			    dev->flags & IFF_UP && dev->flags & IFF_MULTICAST)
 				ipv6_mc_up(idev);
 			break;
 		}
--
2.50.1

Forwarded: [syzbot] test baseline for unregister_netdevice ref leak

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [syzbot] test baseline for unregister_netdevice ref leak
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci