From: syzbot <syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, raoxu@uniontech.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)
Date: Thu, 14 May 2026 05:28:02 -0700 [thread overview]
Message-ID: <6a05bfd2.170a0220.290639.01ca.GAE@google.com> (raw)
In-Reply-To: <FBE6DA28176D6E90+20260514115843.1655377-1-raoxu@uniontech.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free
unregister_netdevice: waiting for syz_tun to become free. Usage count = 8
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
addrconf_add_linklocal+0x238/0x378 net/ipv6/addrconf.c:3313
addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_add_mroute+0x14c/0x1cc net/ipv6/addrconf.c:2552
addrconf_add_dev+0xe8/0x1a0 net/ipv6/addrconf.c:2570
addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
addrconf_init_auto_addrs+0x304/0x764 net/ipv6/addrconf.c:3572
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
fixup_permanent_addr net/ipv6/addrconf.c:3603 [inline]
addrconf_permanent_addr+0x5a8/0x824 net/ipv6/addrconf.c:3639
addrconf_notify+0x690/0xbe4 net/ipv6/addrconf.c:3706
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_hold include/linux/netdevice.h:4500 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1261 [inline]
fib_check_nh+0x968/0x1548 net/ipv4/fib_semantics.c:1281
fib_create_info+0x13d8/0x2100 net/ipv4/fib_semantics.c:1501
fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x334/0x4e4 net/ipv4/fib_frontend.c:1178
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
inet6_addr_add+0x2a4/0x78c net/ipv6/addrconf.c:3050
inet6_rtm_newaddr+0x738/0xa58 net/ipv6/addrconf.c:5071
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg+0xc8/0x138 net/socket.c:802
__sys_sendto+0x254/0x338 net/socket.c:2265
__do_sys_sendto net/socket.c:2272 [inline]
__se_sys_sendto net/socket.c:2268 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2268
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc+0x68/0xb0 include/linux/netdevice.h:4483
fib_create_info+0x1b14/0x2100 net/ipv4/fib_semantics.c:1495
fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x118/0x4e4 net/ipv4/fib_frontend.c:1156
fib_inetaddr_event+0x114/0x1c0 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380
__inet_insert_ifa+0x828/0xa0c net/ipv4/devinet.c:566
inet_rtm_newaddr+0xb58/0x10e8 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg+0xc8/0x138 net/socket.c:802
Tested on:
commit: 5cbb61bf arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15f620ec580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
Note: no patches were applied.
next parent reply other threads:[~2026-05-14 12:28 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <FBE6DA28176D6E90+20260514115843.1655377-1-raoxu@uniontech.com>
2026-05-14 12:28 ` syzbot [this message]
[not found] <FF91F2BF42AC95B3+20260514111238.1600030-1-raoxu@uniontech.com>
2026-05-14 11:43 ` [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9) syzbot
[not found] <BD680186E4DE6711+20260514082426.721996-1-raoxu@uniontech.com>
2026-05-14 9:20 ` syzbot
[not found] <E61E4EBE5175D344+20260514064805.611177-1-raoxu@uniontech.com>
2026-05-14 7:30 ` syzbot
[not found] <113A84FF927506B4+20260514040220.410747-1-raoxu@uniontech.com>
2026-05-14 5:36 ` syzbot
[not found] <0CE6AE93FEBA21AC+20260514023628.308904-1-raoxu@uniontech.com>
2026-05-14 2:45 ` syzbot
[not found] <950831E2452101D8+20260514020809.275684-1-raoxu@uniontech.com>
2026-05-14 2:17 ` syzbot
[not found] <B2CF7974DC914535+20260514015049.255578-1-raoxu@uniontech.com>
2026-05-14 1:59 ` syzbot
2026-05-10 20:18 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a05bfd2.170a0220.290639.01ca.GAE@google.com \
--to=syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=raoxu@uniontech.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.