From: syzbot <syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, raoxu@uniontech.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)
Date: Thu, 14 May 2026 05:28:02 -0700 [thread overview]
Message-ID: <6a05bfd2.170a0220.290639.01ca.GAE@google.com> (raw)
In-Reply-To: <FBE6DA28176D6E90+20260514115843.1655377-1-raoxu@uniontech.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free
unregister_netdevice: waiting for syz_tun to become free. Usage count = 8
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
addrconf_add_linklocal+0x238/0x378 net/ipv6/addrconf.c:3313
addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_add_mroute+0x14c/0x1cc net/ipv6/addrconf.c:2552
addrconf_add_dev+0xe8/0x1a0 net/ipv6/addrconf.c:2570
addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
addrconf_init_auto_addrs+0x304/0x764 net/ipv6/addrconf.c:3572
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
ip6_route_add+0x8c/0x1b4 net/ipv6/route.c:3957
addrconf_prefix_route+0x1f4/0x2b4 net/ipv6/addrconf.c:2488
fixup_permanent_addr net/ipv6/addrconf.c:3603 [inline]
addrconf_permanent_addr+0x5a8/0x824 net/ipv6/addrconf.c:3639
addrconf_notify+0x690/0xbe4 net/ipv6/addrconf.c:3706
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_hold include/linux/netdevice.h:4500 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1261 [inline]
fib_check_nh+0x968/0x1548 net/ipv4/fib_semantics.c:1281
fib_create_info+0x13d8/0x2100 net/ipv4/fib_semantics.c:1501
fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x334/0x4e4 net/ipv4/fib_frontend.c:1178
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
inet6_addr_add+0x2a4/0x78c net/ipv6/addrconf.c:3050
inet6_rtm_newaddr+0x738/0xa58 net/ipv6/addrconf.c:5071
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg+0xc8/0x138 net/socket.c:802
__sys_sendto+0x254/0x338 net/socket.c:2265
__do_sys_sendto net/socket.c:2272 [inline]
__se_sys_sendto net/socket.c:2268 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2268
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
ref_tracker: netdev@00000000adbd14c8 has 1/7 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc+0x68/0xb0 include/linux/netdevice.h:4483
fib_create_info+0x1b14/0x2100 net/ipv4/fib_semantics.c:1495
fib_table_insert+0xa4/0x11e8 net/ipv4/fib_trie.c:1212
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x118/0x4e4 net/ipv4/fib_frontend.c:1156
fib_inetaddr_event+0x114/0x1c0 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
blocking_notifier_call_chain+0x70/0xa0 kernel/notifier.c:380
__inet_insert_ifa+0x828/0xa0c net/ipv4/devinet.c:566
inet_rtm_newaddr+0xb58/0x10e8 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x64c/0x984 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x22c/0x410 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x610/0x800 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x63c/0x920 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg+0xc8/0x138 net/socket.c:802
Tested on:
commit: 5cbb61bf arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15f620ec580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
Note: no patches were applied.
next parent reply other threads:[~2026-05-14 12:28 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <FBE6DA28176D6E90+20260514115843.1655377-1-raoxu@uniontech.com>
2026-05-14 12:28 ` syzbot [this message]
[not found] <FF91F2BF42AC95B3+20260514111238.1600030-1-raoxu@uniontech.com>
2026-05-14 11:43 ` [syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9) syzbot
[not found] <BD680186E4DE6711+20260514082426.721996-1-raoxu@uniontech.com>
2026-05-14 9:20 ` syzbot
[not found] <E61E4EBE5175D344+20260514064805.611177-1-raoxu@uniontech.com>
2026-05-14 7:30 ` syzbot
[not found] <113A84FF927506B4+20260514040220.410747-1-raoxu@uniontech.com>
2026-05-14 5:36 ` syzbot
[not found] <0CE6AE93FEBA21AC+20260514023628.308904-1-raoxu@uniontech.com>
2026-05-14 2:45 ` syzbot
[not found] <950831E2452101D8+20260514020809.275684-1-raoxu@uniontech.com>
2026-05-14 2:17 ` syzbot
[not found] <B2CF7974DC914535+20260514015049.255578-1-raoxu@uniontech.com>
2026-05-14 1:59 ` syzbot
2026-05-10 20:18 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a05bfd2.170a0220.290639.01ca.GAE@google.com \
--to=syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=raoxu@uniontech.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox