* [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
@ 2026-01-23 10:08 Tetsuo Handa
2026-01-26 22:33 ` Paul Moore
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-01-23 10:08 UTC (permalink / raw)
To: linux-security-module, SELinux
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
returned an error value upon NETDEV_UNREGISTER event, the system will hung
up with
unregister_netdevice: waiting for $dev to become free. Usage count = $count
message because the reference to $dev acquired by
xfrm_dev_{state,policy}_add() cannot be released.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
net/xfrm/xfrm_policy.c | 35 -----------------------------------
net/xfrm/xfrm_state.c | 33 ---------------------------------
2 files changed, 68 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 62486f866975..f4df6491095f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1778,41 +1778,12 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
}
return err;
}
-
-static inline int xfrm_dev_policy_flush_secctx_check(struct net *net,
- struct net_device *dev,
- bool task_valid)
-{
- struct xfrm_policy *pol;
- int err = 0;
-
- list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
- if (pol->walk.dead ||
- xfrm_policy_id2dir(pol->index) >= XFRM_POLICY_MAX ||
- pol->xdo.dev != dev)
- continue;
-
- err = security_xfrm_policy_delete(pol->security);
- if (err) {
- xfrm_audit_policy_delete(pol, 0, task_valid);
- return err;
- }
- }
- return err;
-}
#else
static inline int
xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
{
return 0;
}
-
-static inline int xfrm_dev_policy_flush_secctx_check(struct net *net,
- struct net_device *dev,
- bool task_valid)
-{
- return 0;
-}
#endif
int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
@@ -1861,11 +1832,6 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
struct xfrm_policy *pol;
spin_lock_bh(&net->xfrm.xfrm_policy_lock);
-
- err = xfrm_dev_policy_flush_secctx_check(net, dev, task_valid);
- if (err)
- goto out;
-
again:
list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
if (pol->walk.dead)
@@ -1888,7 +1854,6 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
__xfrm_policy_inexact_flush(net);
else
err = -ESRCH;
-out:
spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
return err;
}
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 98b362d51836..855778177558 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -881,41 +881,12 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
return err;
}
-
-static inline int
-xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
-{
- int i, err = 0;
-
- for (i = 0; i <= net->xfrm.state_hmask; i++) {
- struct xfrm_state *x;
- struct xfrm_dev_offload *xso;
-
- hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
- xso = &x->xso;
-
- if (xso->dev == dev &&
- (err = security_xfrm_state_delete(x)) != 0) {
- xfrm_audit_state_delete(x, 0, task_valid);
- return err;
- }
- }
- }
-
- return err;
-}
#else
static inline int
xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
{
return 0;
}
-
-static inline int
-xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
-{
- return 0;
-}
#endif
int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
@@ -966,9 +937,6 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
int i, err = 0, cnt = 0;
spin_lock_bh(&net->xfrm.xfrm_state_lock);
- err = xfrm_dev_state_flush_secctx_check(net, dev, task_valid);
- if (err)
- goto out;
err = -ESRCH;
for (i = 0; i <= net->xfrm.state_hmask; i++) {
@@ -997,7 +965,6 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
if (cnt)
err = 0;
-out:
spin_unlock_bh(&net->xfrm.xfrm_state_lock);
spin_lock_bh(&xfrm_state_dev_gc_lock);
--
2.47.3
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-23 10:08 [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check() Tetsuo Handa
@ 2026-01-26 22:33 ` Paul Moore
2026-01-27 3:51 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Paul Moore @ 2026-01-26 22:33 UTC (permalink / raw)
To: Tetsuo Handa
Cc: linux-security-module, SELinux, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
>
> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
> returned an error value upon NETDEV_UNREGISTER event, the system will hung
> up with
>
> unregister_netdevice: waiting for $dev to become free. Usage count = $count
>
> message because the reference to $dev acquired by
> xfrm_dev_{state,policy}_add() cannot be released.
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
> net/xfrm/xfrm_policy.c | 35 -----------------------------------
> net/xfrm/xfrm_state.c | 33 ---------------------------------
> 2 files changed, 68 deletions(-)
I didn't make it very far into reviewing this patch, because it looks
like xfrm_dev_state_flush() is called by the bonding driver's
notification handler, and I don't see that reflected in this patch?
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-26 22:33 ` Paul Moore
@ 2026-01-27 3:51 ` Tetsuo Handa
2026-01-27 21:59 ` Paul Moore
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-01-27 3:51 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
On 2026/01/27 7:33, Paul Moore wrote:
> On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
> <penguin-kernel@i-love.sakura.ne.jp> wrote:
>>
>> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
>> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
>> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
>> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
>> returned an error value upon NETDEV_UNREGISTER event, the system will hung
>> up with
>>
>> unregister_netdevice: waiting for $dev to become free. Usage count = $count
>>
>> message because the reference to $dev acquired by
>> xfrm_dev_{state,policy}_add() cannot be released.
>>
>> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
>> ---
>> net/xfrm/xfrm_policy.c | 35 -----------------------------------
>> net/xfrm/xfrm_state.c | 33 ---------------------------------
>> 2 files changed, 68 deletions(-)
>
> I didn't make it very far into reviewing this patch, because it looks
> like xfrm_dev_state_flush() is called by the bonding driver's
> notification handler, and I don't see that reflected in this patch?
xfrm_dev_{state,policy}_flush() are called from only the bonding driver's NETDEV_UNREGISTER
event notification handler and the xfrm module's NETDEV_DOWN event / NETDEV_UNREGISTER event
notification handler ( https://elixir.bootlin.com/linux/v6.19-rc5/A/ident/xfrm_dev_state_flush ).
What this patch kills is not xfrm_dev_{state,policy}_flush() but
xfrm_dev_{state,policy}_flush_secctx_check(). No need to touch the bonding driver.
LSM hook for checking whether to allow deleting a file in tmpfs which is still mounted
makes sense, LSM hook for checking whether to allow starting unmount of tmpfs makes sense,
but LSM hook for checking whether to allow releasing memory in tmpfs while unmount operation
is already in progress causes nothing but a resource leak / denial-of-service kernel bug.
What xfrm_dev_{state,policy}_flush_secctx_check() are causing is something like
"LSM policy is refusing release of memory used by a file in tmpfs which is already under
unmount operation".
xfrm_dev_{state,policy}_flush_secctx_check() are too late to make LSM policy decision.
A must-not-fail operation has already started before LSM hooks are called.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-27 3:51 ` Tetsuo Handa
@ 2026-01-27 21:59 ` Paul Moore
2026-01-28 10:28 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Paul Moore @ 2026-01-27 21:59 UTC (permalink / raw)
To: Tetsuo Handa
Cc: SELinux, linux-security-module, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Mon, Jan 26, 2026 at 10:51 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/27 7:33, Paul Moore wrote:
> > On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> >>
> >> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
> >> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
> >> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
> >> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
> >> returned an error value upon NETDEV_UNREGISTER event, the system will hung
> >> up with
> >>
> >> unregister_netdevice: waiting for $dev to become free. Usage count = $count
> >>
> >> message because the reference to $dev acquired by
> >> xfrm_dev_{state,policy}_add() cannot be released.
> >>
> >> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> >> ---
> >> net/xfrm/xfrm_policy.c | 35 -----------------------------------
> >> net/xfrm/xfrm_state.c | 33 ---------------------------------
> >> 2 files changed, 68 deletions(-)
> >
> > I didn't make it very far into reviewing this patch, because it looks
> > like xfrm_dev_state_flush() is called by the bonding driver's
> > notification handler, and I don't see that reflected in this patch?
>
> xfrm_dev_{state,policy}_flush() are called from only ...
My apologies, I was looking at the patch too quickly and shortened
xfrm_dev_state_flush_secctx_check() into xfrm_dev_state_flush() when
looking at the callers.
> LSM hook for checking whether to allow deleting a file in tmpfs which is still mounted
> makes sense, LSM hook for checking whether to allow starting unmount of tmpfs makes sense,
> but LSM hook for checking whether to allow releasing memory in tmpfs while unmount operation
> is already in progress causes nothing but a resource leak / denial-of-service kernel bug.
>
> What xfrm_dev_{state,policy}_flush_secctx_check() are causing is something like
> "LSM policy is refusing release of memory used by a file in tmpfs which is already under
> unmount operation".
> xfrm_dev_{state,policy}_flush_secctx_check() are too late to make LSM policy decision.
> A must-not-fail operation has already started before LSM hooks are called.
It sounds like we either need to confirm that
security_xfrm_{policy,state}_delete() is already present in all code
paths that result in SPD/SAD deletions (in a place that can safely
fail and return an error), or we need to place
xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
safely fail. The patch doesn't relocate
xfrm_dev_{policy,state}_flush_secctx_check() and I don't really see
any mention about security_xfrm_{policy,state}_delete() in the patch
or description; have you verified that the LSM xfrm hooks are still
being called to authorize the removals?
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-27 21:59 ` Paul Moore
@ 2026-01-28 10:28 ` Tetsuo Handa
2026-01-30 21:56 ` Paul Moore
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-01-28 10:28 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
On 2026/01/28 6:59, Paul Moore wrote:
> It sounds like we either need to confirm that
> security_xfrm_{policy,state}_delete() is already present in all code
> paths that result in SPD/SAD deletions (in a place that can safely
> fail and return an error),
Yes.
> or we need to place
> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> safely fail.
Did you mean xfrm_{policy,state}_flush_secctx_check() ?
Regarding xfrm_policy_flush() as an example, we can observe that we are
calling LSM hooks for must-not-fail callers. If the task_valid argument was
meant to be interpreted as whether to call LSM hooks, xfrm_policy_flush() needs
below change.
int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
{
(...snipped...)
- err = xfrm_policy_flush_secctx_check(net, type, task_valid);
+ err = task_valid ? xfrm_policy_flush_secctx_check(net, type, task_valid) : 0;
(...snipped...)
}
> The patch doesn't relocate
> xfrm_dev_{policy,state}_flush_secctx_check() and I don't really see
> any mention about security_xfrm_{policy,state}_delete() in the patch
> or description;
> have you verified that the LSM xfrm hooks are still
> being called to authorize the removals?
Please distinguish caller for "delete" and caller for "release".
LSM xfrm hooks need to be called for "delete" callers, but
LSM xfrm hooks need to be bypassed for "release" callers.
Maybe task_valid == true is for "delete" callers and task_valid == false is
for "release" callers; though it seems that some locations are passing wrong
task_valid flag (e.g. xfrm_dev_down() is passing task_valid == true despite
it is a "release" caller).
If 'task_valid == true is for "delete" callers and task_valid == false is for
"release" callers' does not hold, we might need to add a "forced" flag
(which is interpreted as whether LSM hooks must be bypassed) like
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4
does.
Anyway, this patch which kills xfrm_dev_{state,policy}_flush_secctx_check()
can be applied as-is because all callers are "release" callers.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-28 10:28 ` Tetsuo Handa
@ 2026-01-30 21:56 ` Paul Moore
2026-01-31 6:00 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Paul Moore @ 2026-01-30 21:56 UTC (permalink / raw)
To: Tetsuo Handa
Cc: SELinux, linux-security-module, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/28 6:59, Paul Moore wrote:
> > It sounds like we either need to confirm that
> > security_xfrm_{policy,state}_delete() is already present in all code
> > paths that result in SPD/SAD deletions (in a place that can safely
> > fail and return an error),
>
> Yes.
To clarify, do you mean "yes, I agree", or "yes, I've already checked
this and can confirm that the LSM hooks are already being called"?
> > or we need to place
> > xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> > safely fail.
>
> Did you mean xfrm_{policy,state}_flush_secctx_check() ?
They both call into the security_xfrm_policy_delete() LSM hook which
is what I care about as that hook is what authorizes the operation.
> Regarding xfrm_policy_flush() as an example, we can observe that we are
> calling LSM hooks for must-not-fail callers ...
We need to make sure the LSM hooks are being called to authorize the
removal of SPD and SAD entries. If you are going to remove LSM hooks
from the existing code, please document how that code path you are
changing is still subject to authorization by the LSM hooks or explain
in great detail how that authorization is not necessary.
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-30 21:56 ` Paul Moore
@ 2026-01-31 6:00 ` Tetsuo Handa
2026-02-02 4:07 ` Paul Moore
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-01-31 6:00 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
On 2026/01/31 6:56, Paul Moore wrote:
> On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
> <penguin-kernel@i-love.sakura.ne.jp> wrote:
>> On 2026/01/28 6:59, Paul Moore wrote:
>>> It sounds like we either need to confirm that
>>> security_xfrm_{policy,state}_delete() is already present in all code
>>> paths that result in SPD/SAD deletions (in a place that can safely
>>> fail and return an error),
>>
>> Yes.
>
> To clarify, do you mean "yes, I agree", or "yes, I've already checked
> this and can confirm that the LSM hooks are already being called"?
I mean "yes, I agree".
>
>>> or we need to place
>>> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
>>> safely fail.
>>
>> Did you mean xfrm_{policy,state}_flush_secctx_check() ?
>
> They both call into the security_xfrm_policy_delete() LSM hook which
> is what I care about as that hook is what authorizes the operation.
I can't understand what your authorization is.
No authorization can be placed during must-not-fail operation.
For example, please consider the following sequence.
mkdir /mnt/tmpfs
unshare -m
mount -t tmpfs none /mnt/tmpfs
touch /mnt/tmpfs/file1
mkdir /mnt/tmpfs/dir1
exit
Although there are LSM hooks for deleting a file/directory and LSM hook for
unmounting, no LSM hook is called before deleting file1, deleting dir1,
and unmounting /mnt/tmpfs because operations that happen during tear-down of
a namespace must not fail.
What "[PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()" is doing
is the same thing for a network device. NETDEV_UNREGISTER is a must-not-fail
operation that happens during tear-down of a network device. LSM hooks are not
allowed to veto must-not-fail operations.
>
>> Regarding xfrm_policy_flush() as an example, we can observe that we are
>> calling LSM hooks for must-not-fail callers ...
>
> We need to make sure the LSM hooks are being called to authorize the
> removal of SPD and SAD entries. If you are going to remove LSM hooks
> from the existing code, please document how that code path you are
> changing is still subject to authorization by the LSM hooks or explain
> in great detail how that authorization is not necessary.
Again, LSM hooks are not allowed to veto operations that happen during
NETDEV_UNREGISTER event. Current XFRM code for NETDEV_UNREGISTER event is broken
because the behavior is
while (security_xfrm_state_delete() != 0) {
schedule_timeout_uninterruptible(10 * HZ);
pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
dev->name, netdev_refcnt_read(dev));
}
while (security_xfrm_policy_delete() != 0) {
schedule_timeout_uninterruptible(10 * HZ);
pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
dev->name, netdev_refcnt_read(dev));
}
which is a denial-of-service kernel bug.
No room for debating "authorize the removal of SPD and SAD entries".
This path is a must-not-fail operation. Removal of SPD and SAD entries has to be done
without authorization when NETDEV_UNREGISTER event fired.
Though, you could argue whether removal of SPD and SAD entries is really what they want
when NETDEV_DOWN event fired. I don't know what the authors of commit d77e38e612a0
("xfrm: Add an IPsec hardware offloading API") are expecting because deleted entries
are not automatically revived when NETDEV_UP event fires
( https://lkml.kernel.org/r/cea4b855-fe94-4b4e-9c2d-3cef7aac1be3@I-love.SAKURA.ne.jp ).
Hmm, does
https://elixir.bootlin.com/linux/v6.19-rc5/source/include/linux/netdevice.h#L3142 mean that
LSM hooks are as well not allowed to veto operations that happen during
NETDEV_UP/NETDEV_DOWN events?
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-01-31 6:00 ` Tetsuo Handa
@ 2026-02-02 4:07 ` Paul Moore
2026-02-03 3:47 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Paul Moore @ 2026-02-02 4:07 UTC (permalink / raw)
To: Tetsuo Handa
Cc: SELinux, linux-security-module, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Sat, Jan 31, 2026 at 1:01 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/31 6:56, Paul Moore wrote:
> > On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> >> On 2026/01/28 6:59, Paul Moore wrote:
> >>> It sounds like we either need to confirm that
> >>> security_xfrm_{policy,state}_delete() is already present in all code
> >>> paths that result in SPD/SAD deletions (in a place that can safely
> >>> fail and return an error),
> >>
> >> Yes.
> >
> > To clarify, do you mean "yes, I agree", or "yes, I've already checked
> > this and can confirm that the LSM hooks are already being called"?
>
> I mean "yes, I agree".
>
> >
> >>> or we need to place
> >>> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> >>> safely fail.
> >>
> >> Did you mean xfrm_{policy,state}_flush_secctx_check() ?
> >
> > They both call into the security_xfrm_policy_delete() LSM hook which
> > is what I care about as that hook is what authorizes the operation.
>
> I can't understand what your authorization is.
I'm asking you to verify that we have the LSM xfrm hooks in all of the
necessary locations to ensure that we are safely and comprehensively
gating all of the operations that result in removal of SPD and SAD
entries.
> No authorization can be placed during must-not-fail operation.
Of course, but that means that we simply need to make sure we have the
authorization hooks placed elsewhere to ensure that users can not
remove SPD and SAD entries if they are not allowed. I'm not arguing
about if returning an error in a place that can not handle an error
condition is correct or not, I'm arguing that you should audit the SPD
and SAD removal code paths to ensure that they all have the proper LSM
xfrm hook authorizations.
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-02 4:07 ` Paul Moore
@ 2026-02-03 3:47 ` Tetsuo Handa
2026-02-03 22:40 ` Paul Moore
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-03 3:47 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
[-- Attachment #1: Type: text/plain, Size: 2686 bytes --]
On 2026/02/02 13:07, Paul Moore wrote:
> I'm asking you to verify that we have the LSM xfrm hooks in all of the
> necessary locations to ensure that we are safely and comprehensively
> gating all of the operations that result in removal of SPD and SAD
> entries.
That is impossible. We can't have the LSM xfrm hooks in all locations
that result in removal of SPD and SAD entries. We must give up trying
to have the LSM xfrm hooks in NETDEV_UNREGISTER event handler despite
NETDEV_UNREGISTER event handler results in removal of SPD and SAD entries.
>> No authorization can be placed during must-not-fail operation.
>
> Of course, but that means that we simply need to make sure we have the
> authorization hooks placed elsewhere to ensure that users can not
> remove SPD and SAD entries if they are not allowed. I'm not arguing
> about if returning an error in a place that can not handle an error
> condition is correct or not, I'm arguing that you should audit the SPD
> and SAD removal code paths to ensure that they all have the proper LSM
> xfrm hook authorizations.
This patch just removes error-returning LSM xfrm hook calls from one of
must-not-fail locations. I attach two syzbot reports that demonstrate
a result of having LSM xfrm hook calls from NETDEV_UNREGISTER event
( https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/net/xfrm?h=next-20260202&id=638361ad7ab20c5740d9637d3a51306f9b2e1461 ) .
As you can see, this must-not-fail operation is triggered by both
"sendmsg() system call (i.e. sending netlink message) by a userspace process"
and "the cleanup_net kernel WQ thread".
You might be able to call LSM xfrm hooks before netlink_sendmsg() is authorized
(assuming that that LSM hook can examine what SPD and SAD entries will be deleted
by allow processing netlink_sendmsg() request), but I guess that it will be
subjected to TOCTOU problem; can we have such giant lock that can serialize all
operations that might be triggered by allow calling netlink_sendmsg()? Even if
you had such giant lock, what about cleanup_net() path that happens without
explicit request from userspace?
It is your role (not my role) to verify that we have the LSM xfrm hooks in all
of the necessary locations, for it is you who is wishing to ensure that we are
safely and comprehensively gating all of the operations that result in removal
of SPD and SAD entries. The reports I attached are suggesting you that we can't
safely and comprehensively gate all of the operations that result in removal of
SPD and SAD entries.
Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
[-- Attachment #2: report-20260202-cleanup_net.txt --]
[-- Type: text/plain, Size: 73840 bytes --]
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff88807ddc4630 has 1/1 users at
xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -7 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -7 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
__dev_open+0x67a/0x830 net/core/dev.c:1704
__dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -2 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -12 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dst_destroy+0x117/0x360 net/core/dst.c:115
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[28] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[29] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[30] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[31] +6 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[32] -4 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[33] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[35] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_name+0xdb/0x210 net/core/dev.c:909
netdev_get_by_name+0x27/0xb0 net/core/dev.c:933
ethnl_parse_header_dev_get+0x445/0x8b0 net/ethtool/netlink.c:194
ethnl_default_parse net/ethtool/netlink.c:457 [inline]
ethnl_default_set_doit+0x224/0xae0 net/ethtool/netlink.c:895
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[36] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
ethnl_parse_header_dev_put net/ethtool/netlink.h:274 [inline]
ethnl_default_set_doit+0x92e/0xae0 net/ethtool/netlink.c:940
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
linkwatch_add_event net/core/link_watch.c:131 [inline]
linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
__dev_close_many+0x368/0x6d0 net/core/dev.c:1768
netif_close_many+0x225/0x420 net/core/dev.c:1793
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[38] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_flush_dev net/core/neighbour.c:433 [inline]
__neigh_ifdown+0x1e8/0x8c0 net/core/neighbour.c:467
neigh_ifdown+0x1f/0x30 net/core/neighbour.c:491
rt6_disable_ip+0x776/0x7f0 net/ipv6/route.c:5018
addrconf_ifdown+0x161/0x1a40 net/ipv6/addrconf.c:3858
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_close_many+0x2ae/0x420 net/core/dev.c:1797
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
Call trace for netdevsim0[39] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_close_many+0x2ae/0x420 net/core/dev.c:1797
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[40] -3 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[41] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
__qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
qdisc_put net/sched/sch_generic.c:1105 [inline]
dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[42] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[43] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[44] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
inetdev_destroy net/ipv4/devinet.c:335 [inline]
inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[45] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
in_dev_put include/linux/inetdevice.h:290 [inline]
inetdev_destroy net/ipv4/devinet.c:338 [inline]
inetdev_event+0x83b/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[46] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[47] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
in6_dev_put include/net/addrconf.h:422 [inline]
addrconf_ifdown+0x17d1/0x1a40 net/ipv6/addrconf.c:4014
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[48] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
kref_put include/linux/kref.h:65 [inline]
batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[49] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[50] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[51] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[52] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[53] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
linkwatch_sync_dev+0x27f/0x390 net/core/link_watch.c:289
netdev_run_todo+0x3fe/0x1130 net/core/dev.c:11705
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[53] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
[-- Attachment #3: report-20260202-netlink_sendmsg.txt --]
[-- Type: text/plain, Size: 76858 bytes --]
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff88805b5fc630 has 1/1 users at
xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -7 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -7 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
__dev_open+0x67a/0x830 net/core/dev.c:1704
__dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -2 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -11 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dst_destroy+0x117/0x360 net/core/dst.c:115
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[28] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[29] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[30] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[31] +5 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[32] -3 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_remove_one+0x46d/0x4c0 net/core/neighbour.c:249
neigh_forced_gc net/core/neighbour.c:280 [inline]
neigh_alloc net/core/neighbour.c:512 [inline]
___neigh_create+0x485/0x2290 net/core/neighbour.c:655
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[33] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
ethnl_default_dumpit+0x1ed/0x630 net/ethtool/netlink.c:626
genl_dumpit+0x10b/0x1b0 net/netlink/genetlink.c:1027
netlink_dump+0x722/0xe80 net/netlink/af_netlink.c:2325
__netlink_dump_start+0x5cb/0x7e0 net/netlink/af_netlink.c:2440
genl_family_rcv_msg_dumpit+0x213/0x310 net/netlink/genetlink.c:1076
genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
genl_rcv_msg+0x5e8/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
ethnl_default_dumpit+0x404/0x630 net/ethtool/netlink.c:632
genl_dumpit+0x10b/0x1b0 net/netlink/genetlink.c:1027
netlink_dump+0x722/0xe80 net/netlink/af_netlink.c:2325
__netlink_dump_start+0x5cb/0x7e0 net/netlink/af_netlink.c:2440
genl_family_rcv_msg_dumpit+0x213/0x310 net/netlink/genetlink.c:1076
genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
genl_rcv_msg+0x5e8/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[35] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[36] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[38] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
linkwatch_add_event net/core/link_watch.c:131 [inline]
linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
__dev_close_many+0x368/0x6d0 net/core/dev.c:1768
netif_close_many+0x225/0x420 net/core/dev.c:1793
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[39] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_flush_dev net/core/neighbour.c:433 [inline]
__neigh_ifdown+0x1e8/0x8c0 net/core/neighbour.c:467
neigh_ifdown+0x1f/0x30 net/core/neighbour.c:491
rt6_disable_ip+0x776/0x7f0 net/ipv6/route.c:5018
addrconf_ifdown+0x161/0x1a40 net/ipv6/addrconf.c:3858
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_close_many+0x2ae/0x420 net/core/dev.c:1797
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
Call trace for netdevsim0[40] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_close_many+0x2ae/0x420 net/core/dev.c:1797
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
Call trace for netdevsim0[41] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
__qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
qdisc_put net/sched/sch_generic.c:1105 [inline]
dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[42] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[43] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[44] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
inetdev_destroy net/ipv4/devinet.c:335 [inline]
inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[45] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
in_dev_put include/linux/inetdevice.h:290 [inline]
inetdev_destroy net/ipv4/devinet.c:338 [inline]
inetdev_event+0x83b/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[46] -3 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[47] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[48] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
in6_dev_put include/net/addrconf.h:422 [inline]
addrconf_ifdown+0x17d1/0x1a40 net/ipv6/addrconf.c:4014
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[49] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
kref_put include/linux/kref.h:65 [inline]
batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[50] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[51] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[52] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[53] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[54] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
__linkwatch_run_queue+0x572/0x7f0 net/core/link_watch.c:244
linkwatch_event+0x4c/0x60 net/core/link_watch.c:304
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[54] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
</TASK>
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-03 3:47 ` Tetsuo Handa
@ 2026-02-03 22:40 ` Paul Moore
2026-02-04 10:15 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Paul Moore @ 2026-02-03 22:40 UTC (permalink / raw)
To: Tetsuo Handa
Cc: SELinux, linux-security-module, Steffen Klassert, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Mon, Feb 2, 2026 at 10:48 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/02/02 13:07, Paul Moore wrote:
> > I'm asking you to verify that we have the LSM xfrm hooks in all of the
> > necessary locations to ensure that we are safely and comprehensively
> > gating all of the operations that result in removal of SPD and SAD
> > entries.
>
> That is impossible. We can't have the LSM xfrm hooks in all locations
> that result in removal of SPD and SAD entries.
It's a good thing that isn't what I said. I said "... LSM xfrm hooks
in all of the
necessary locations to ensure that we are safely and COMPREHENSIVELY
GATING all of the operations that result in removal of SPD and SAD
entries." I used the capitalization to emphasize the idea that the
goal is a comprehensive gating of the operations, not necessarily a
placement of LSM hooks in all of the functions. It can be a subtle
difference, but it is an important one as I think you can understand.
> It is your role (not my role) to verify that we have the LSM xfrm hooks in all
> of the necessary locations, for it is you who is wishing to ensure that we are
> safely and comprehensively gating all of the operations that result in removal
> of SPD and SAD entries.
All of us who contribute upstream have a responsibility to ensure the
proper operation and maintenance of the upstream Linux kernel, this is
especially true for individuals such as yourself who have accepted a
maintainer role.
You have identified what appear to be issues with the upstream kernel,
and have proposed changes to address that. While reviewing those
changes I asked you to verify that the LSM hooks associated with your
proposed change were still working as expected, since it was not clear
from the discussion, or the patch, that an investigation had taken
place. This is not an unusual request for such a proposed change, and
is something that I would expect a LSM maintainer to do without much
hesitation. If you are unwilling to investigate this, can you explain
why?
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-03 22:40 ` Paul Moore
@ 2026-02-04 10:15 ` Tetsuo Handa
2026-02-04 13:57 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-04 10:15 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
[-- Attachment #1: Type: text/plain, Size: 780 bytes --]
On 2026/02/04 7:40, Paul Moore wrote:
> This is not an unusual request for such a proposed change, and
> is something that I would expect a LSM maintainer to do without much
> hesitation. If you are unwilling to investigate this, can you explain
> why?
Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.
I can't judge whether the current code is COMPREHENSIVELY GATING;
I can't imagine what the state you call COMPREHENSIVELY GATING is.
P.S. For your investigation, I attach a new report that syzbot found today, and
I'll drop "xfrm: always fail xfrm_dev_{state,policy}_flush_secctx_check()"
because these three reports will be sufficient for people to understand that
we need to kill xfrm_dev_{state,policy}_flush_secctx_check() calls.
[-- Attachment #2: report-0202-kernfs.txt --]
[-- Type: text/plain, Size: 90653 bytes --]
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff888028c4c630 has 1/1 users at
xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -10 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -10 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
__nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:661
__driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
__device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c5/0x450 drivers/base/dd.c:1033
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
device_add+0x7b6/0xb70 drivers/base/core.c:3689
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
__dev_open+0x67a/0x830 net/core/dev.c:1704
__dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -6 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +5 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -17 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dst_destroy+0x117/0x360 net/core/dst.c:115
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:916
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
__inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[28] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
fib_create_info+0x2296/0x31f0 net/ipv4/fib_semantics.c:1493
fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x144/0x5f0 net/ipv4/fib_frontend.c:1156
fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
__inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[29] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1263 [inline]
fib_check_nh+0xd1e/0x1b60 net/ipv4/fib_semantics.c:1283
fib_create_info+0x2085/0x31f0 net/ipv4/fib_semantics.c:1503
fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x38d/0x5f0 net/ipv4/fib_frontend.c:1171
fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
__inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[30] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1263 [inline]
fib_check_nh+0xd1e/0x1b60 net/ipv4/fib_semantics.c:1283
fib_create_info+0x2085/0x31f0 net/ipv4/fib_semantics.c:1503
fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x3fb/0x5f0 net/ipv4/fib_frontend.c:1178
fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
__inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[31] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
inet6_addr_add+0x2dd/0xb20 net/ipv6/addrconf.c:3032
inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[32] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
inet6_addr_add+0x454/0xb20 net/ipv6/addrconf.c:3050
inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[33] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
inet6_addr_add+0x454/0xb20 net/ipv6/addrconf.c:3050
inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
inet6_addr_add+0x508/0xb20 net/ipv6/addrconf.c:3053
inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[35] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[36] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] -2 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_flush_dev net/core/neighbour.c:433 [inline]
neigh_changeaddr+0xde/0x130 net/core/neighbour.c:457
ndisc_netdev_event+0x18f/0x4d0 net/ipv6/ndisc.c:1862
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
__sys_sendto+0x3ff/0x590 net/socket.c:2221
__do_sys_sendto net/socket.c:2228 [inline]
__se_sys_sendto net/socket.c:2224 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2224
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[38] -6 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[39] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[40] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[41] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[42] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[43] +7 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dst_init+0x6f/0x490 net/core/dst.c:52
dst_alloc+0x12a/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[44] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[45] -6 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[46] +3 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[47] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
dev_get_by_name+0xdb/0x210 net/core/dev.c:909
netdev_get_by_name+0x27/0xb0 net/core/dev.c:933
ethnl_parse_header_dev_get+0x445/0x8b0 net/ethtool/netlink.c:194
ethnl_default_parse net/ethtool/netlink.c:457 [inline]
ethnl_default_set_doit+0x224/0xae0 net/ethtool/netlink.c:895
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[48] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
ethnl_parse_header_dev_put net/ethtool/netlink.h:274 [inline]
ethnl_default_set_doit+0x92e/0xae0 net/ethtool/netlink.c:940
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[49] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
linkwatch_add_event net/core/link_watch.c:131 [inline]
linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
__dev_close_many+0x368/0x6d0 net/core/dev.c:1768
netif_close_many+0x225/0x420 net/core/dev.c:1793
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[50] +2 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netif_close_many+0x2ae/0x420 net/core/dev.c:1797
netif_close_many_and_unlock net/core/dev.c:12317 [inline]
unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[51] -3 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
fib_nh_release net/ipv4/fib_semantics.c:218 [inline]
free_fib_info_rcu+0xdf/0x310 net/ipv4/fib_semantics.c:230
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[52] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
__qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
qdisc_put net/sched/sch_generic.c:1105 [inline]
dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[53] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[54] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[55] +1 at
__dev_hold include/linux/netdevice.h:4403 [inline]
netdev_hold include/linux/netdevice.h:4446 [inline]
dev_hold include/linux/netdevice.h:4469 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:916
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
__inet_del_ifa+0x840/0xfe0 net/ipv4/devinet.c:450
inet_del_ifa net/ipv4/devinet.c:487 [inline]
inetdev_destroy net/ipv4/devinet.c:328 [inline]
inetdev_event+0x647/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[56] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
inetdev_destroy net/ipv4/devinet.c:335 [inline]
inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[57] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[58] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
kref_put include/linux/kref.h:65 [inline]
batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[59] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
in6_dev_put include/net/addrconf.h:422 [inline]
ip6_dst_ifdown+0xed/0x220 net/ipv6/route.c:384
dst_dev_put+0xab/0x2d0 net/core/dst.c:151
fib6_nh_release_dsts net/ipv6/route.c:3740 [inline]
fib6_nh_release+0x36c/0x430 net/ipv6/route.c:3721
fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[60] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
dev_put include/linux/netdevice.h:4481 [inline]
udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[61] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[62] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x228/0x560 lib/kobject.c:737
netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[63] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
in_dev_put include/linux/inetdevice.h:290 [inline]
inet_rcu_free_ifa+0x72/0xb0 net/ipv4/devinet.c:228
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[64] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
netdev_put include/linux/netdevice.h:4456 [inline]
unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
unregister_netdevice_many net/core/dev.c:12480 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
unregister_netdevice include/linux/netdevice.h:3414 [inline]
nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[65] -1 at
__dev_put include/linux/netdevice.h:4389 [inline]
linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
__linkwatch_run_queue+0x572/0x7f0 net/core/link_watch.c:244
linkwatch_event+0x4c/0x60 net/core/link_watch.c:304
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[65] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
</TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
</TASK>
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-04 10:15 ` Tetsuo Handa
@ 2026-02-04 13:57 ` Tetsuo Handa
2026-02-09 9:25 ` Steffen Klassert
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-04 13:57 UTC (permalink / raw)
To: Paul Moore, SELinux, linux-security-module
Cc: Steffen Klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development
On 2026/02/04 19:15, Tetsuo Handa wrote:
> On 2026/02/04 7:40, Paul Moore wrote:
>> This is not an unusual request for such a proposed change, and
>> is something that I would expect a LSM maintainer to do without much
>> hesitation. If you are unwilling to investigate this, can you explain
>> why?
>
> Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.
>
> I can't judge whether the current code is COMPREHENSIVELY GATING;
> I can't imagine what the state you call COMPREHENSIVELY GATING is.
Steffen Klassert worried that killing xfrm_dev_state_flush_secctx_check() and
xfrm_dev_policy_flush_secctx_check() might violate a LSM policy and you agreed
( https://lkml.kernel.org/r/CAHC9VhQ54LRD7k_x6tUju2kPVBEHcdgBh46_hBN8btG0vhfy_w@mail.gmail.com ),
but the reality is that nobody in the world has enforced an LSM policy for almost 9 years
that makes xfrm_dev_{state,policy}_flush() no-op. That is, xfrm_dev_state_flush_secctx_check()
and xfrm_dev_policy_flush_secctx_check() had been effectively unused.
Killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check()
increases "system's stability" without sacrificing "authorization".
It is up to SELinux developers to discuss what actions to take as a compensation for
killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check().
The compensation might be to add LSM hooks to immediately before the point of no return.
But I wonder why you want to authorize deleting resources which are going to be "deleted by
cascade" due to deleting a dependent resource...
>
>
>
> P.S. For your investigation, I attach a new report that syzbot found today, and
> I'll drop "xfrm: always fail xfrm_dev_{state,policy}_flush_secctx_check()"
> because these three reports will be sufficient for people to understand that
> we need to kill xfrm_dev_{state,policy}_flush_secctx_check() calls.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-04 13:57 ` Tetsuo Handa
@ 2026-02-09 9:25 ` Steffen Klassert
2026-02-09 10:02 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Steffen Klassert @ 2026-02-09 9:25 UTC (permalink / raw)
To: Tetsuo Handa
Cc: Paul Moore, SELinux, linux-security-module, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Wed, Feb 04, 2026 at 10:57:30PM +0900, Tetsuo Handa wrote:
> On 2026/02/04 19:15, Tetsuo Handa wrote:
> > On 2026/02/04 7:40, Paul Moore wrote:
> >> This is not an unusual request for such a proposed change, and
> >> is something that I would expect a LSM maintainer to do without much
> >> hesitation. If you are unwilling to investigate this, can you explain
> >> why?
> >
> > Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.
> >
> > I can't judge whether the current code is COMPREHENSIVELY GATING;
> > I can't imagine what the state you call COMPREHENSIVELY GATING is.
>
> Steffen Klassert worried that killing xfrm_dev_state_flush_secctx_check() and
> xfrm_dev_policy_flush_secctx_check() might violate a LSM policy and you agreed
> ( https://lkml.kernel.org/r/CAHC9VhQ54LRD7k_x6tUju2kPVBEHcdgBh46_hBN8btG0vhfy_w@mail.gmail.com ),
> but the reality is that nobody in the world has enforced an LSM policy for almost 9 years
> that makes xfrm_dev_{state,policy}_flush() no-op. That is, xfrm_dev_state_flush_secctx_check()
> and xfrm_dev_policy_flush_secctx_check() had been effectively unused.
>
> Killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check()
> increases "system's stability" without sacrificing "authorization".
>
> It is up to SELinux developers to discuss what actions to take as a compensation for
> killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check().
> The compensation might be to add LSM hooks to immediately before the point of no return.
The problem is that, with adding IPsec offloads to netdevices, security
critical resources came into the netdevices. Someone who has no
capabilities to delete xfrm states or xfrm policies should not be able
to unregister the netdevice if xfrm states or xfrm policies are
offloaded. Unfortunately, unregistering can't be canceled at this stage
anymore. So I think we need some netdevice unregistration hook for
the LSM subsystem so it can check for xfrm states or xfrm policies
and refuse the unregistration before we actually start to remove
the device.
The same happened btw. when xfrm was made per network namespace.
Here we just leak the xfrm states and xfrm policies if some
LSM refuses to remove them.
I guess we need a solution for both cases.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-09 9:25 ` Steffen Klassert
@ 2026-02-09 10:02 ` Tetsuo Handa
2026-02-09 11:22 ` Steffen Klassert
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-09 10:02 UTC (permalink / raw)
To: Steffen Klassert, Paul Moore, SELinux, linux-security-module
Cc: Herbert Xu, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Network Development
On 2026/02/09 18:25, Steffen Klassert wrote:
> The problem is that, with adding IPsec offloads to netdevices, security
> critical resources came into the netdevices. Someone who has no
> capabilities to delete xfrm states or xfrm policies should not be able
> to unregister the netdevice if xfrm states or xfrm policies are
> offloaded. Unfortunately, unregistering can't be canceled at this stage
> anymore. So I think we need some netdevice unregistration hook for
> the LSM subsystem so it can check for xfrm states or xfrm policies
> and refuse the unregistration before we actually start to remove
> the device.
Unfortunately, unregistering is not always triggered by a user's request. ;-)
For example, we don't check permission for unmount when a mount is deleted
due to teardown of a mount namespace. I wonder why you want to check permission
for unregistering a net_device when triggered by a teardown path.
>
> The same happened btw. when xfrm was made per network namespace.
> Here we just leak the xfrm states and xfrm policies if some
> LSM refuses to remove them.
>
> I guess we need a solution for both cases.
Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
If no, there is no choice but break SELinux's expectation.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-09 10:02 ` Tetsuo Handa
@ 2026-02-09 11:22 ` Steffen Klassert
2026-02-09 14:26 ` Tetsuo Handa
0 siblings, 1 reply; 20+ messages in thread
From: Steffen Klassert @ 2026-02-09 11:22 UTC (permalink / raw)
To: Tetsuo Handa
Cc: Paul Moore, SELinux, linux-security-module, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> On 2026/02/09 18:25, Steffen Klassert wrote:
> > The problem is that, with adding IPsec offloads to netdevices, security
> > critical resources came into the netdevices. Someone who has no
> > capabilities to delete xfrm states or xfrm policies should not be able
> > to unregister the netdevice if xfrm states or xfrm policies are
> > offloaded. Unfortunately, unregistering can't be canceled at this stage
> > anymore. So I think we need some netdevice unregistration hook for
> > the LSM subsystem so it can check for xfrm states or xfrm policies
> > and refuse the unregistration before we actually start to remove
> > the device.
>
> Unfortunately, unregistering is not always triggered by a user's request. ;-)
As far as I remember, a security context is not always tied to a
user request. It can also be attached to system tasks or objects.
> For example, we don't check permission for unmount when a mount is deleted
> due to teardown of a mount namespace. I wonder why you want to check permission
> for unregistering a net_device when triggered by a teardown path.
I just try to find out what's the right thing to do here.
If a policy goes away, packets that match this policy will
find another path through the network stack. As best, they
are dropped somewhere, but they can also leave on some other
device without encryption. A LSM that implements xfrm hooks
must be able to check the permission to delete the xfrm policy
or state.
>
> >
> > The same happened btw. when xfrm was made per network namespace.
> > Here we just leak the xfrm states and xfrm policies if some
> > LSM refuses to remove them.
> >
> > I guess we need a solution for both cases.
>
> Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
> ( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
> If no, there is no choice but break SELinux's expectation.
That could be an option to not accidentally send out
unencrypted packets. But finding the right place for
these checks would be preferable IMO.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-09 11:22 ` Steffen Klassert
@ 2026-02-09 14:26 ` Tetsuo Handa
2026-02-13 10:19 ` Steffen Klassert
0 siblings, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-09 14:26 UTC (permalink / raw)
To: Steffen Klassert, Paul Moore, SELinux, linux-security-module
Cc: Herbert Xu, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Network Development
On 2026/02/09 20:22, Steffen Klassert wrote:
> On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
>> On 2026/02/09 18:25, Steffen Klassert wrote:
>>> The problem is that, with adding IPsec offloads to netdevices, security
>>> critical resources came into the netdevices. Someone who has no
>>> capabilities to delete xfrm states or xfrm policies should not be able
>>> to unregister the netdevice if xfrm states or xfrm policies are
>>> offloaded. Unfortunately, unregistering can't be canceled at this stage
>>> anymore. So I think we need some netdevice unregistration hook for
>>> the LSM subsystem so it can check for xfrm states or xfrm policies
>>> and refuse the unregistration before we actually start to remove
>>> the device.
>>
>> Unfortunately, unregistering is not always triggered by a user's request. ;-)
>
> As far as I remember, a security context is not always tied to a
> user request. It can also be attached to system tasks or objects.
That is not what I wanted to say. There are at least three routes (listed below)
that can trigger xfrm_dev_unregister() path. You could insert LSM hooks into the
netlink_sendmsg() route and the del_device_store() route, but the cleanup_net()
route is a result of tear-down action which is too late to insert LSM hooks.
The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
(i.e. implicit cleanup of a network namespace due to termination of init process in
that namespace). We are not allowed to reject the cleanup_net() route.
----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
</TASK>
----------
----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------
----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
__nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
device_remove drivers/base/dd.c:571 [inline]
__device_release_driver drivers/base/dd.c:1284 [inline]
device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
device_del+0x527/0x8f0 drivers/base/core.c:3878
device_unregister+0x21/0xf0 drivers/base/core.c:3919
nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61d/0xb90 fs/read_write.c:688
ksys_write+0x150/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
</TASK>
----------
>
>> For example, we don't check permission for unmount when a mount is deleted
>> due to teardown of a mount namespace. I wonder why you want to check permission
>> for unregistering a net_device when triggered by a teardown path.
>
> I just try to find out what's the right thing to do here.
> If a policy goes away, packets that match this policy will
> find another path through the network stack. As best, they
> are dropped somewhere, but they can also leave on some other
> device without encryption. A LSM that implements xfrm hooks
> must be able to check the permission to delete the xfrm policy
> or state.
Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
result in network traffic to be sent in cleartext ?
If yes, we need to consider updating the other patch at
https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
but instead updates that state/policy to behave as a blackhole. Then,
we won't need to call LSM hooks because we no longer delete).
Also, we need to consider changing xfrm_dev_down() to no-op, for just doing
e.g. "ip link set ens160 down; ip link set ens160 up" (which triggers
NETDEV_DOWN event and NETDEV_UP event) might result in network traffic
to be sent in cleartext because currently xfrm_dev_down() can delete a
state/policy. Such behavior might not what the administrator is expecting.
>
>>
>>>
>>> The same happened btw. when xfrm was made per network namespace.
>>> Here we just leak the xfrm states and xfrm policies if some
>>> LSM refuses to remove them.
>>>
>>> I guess we need a solution for both cases.
>>
>> Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
>> ( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
>> If no, there is no choice but break SELinux's expectation.
>
> That could be an option to not accidentally send out
> unencrypted packets. But finding the right place for
> these checks would be preferable IMO.
Can we have such giant lock if you found the right place for these checks
( https://lkml.kernel.org/r/f9b88268-03dc-4356-8b31-0bab73cc9b1e@I-love.SAKURA.ne.jp ) ?
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-09 14:26 ` Tetsuo Handa
@ 2026-02-13 10:19 ` Steffen Klassert
2026-02-13 13:59 ` Tetsuo Handa
2026-02-27 1:14 ` Paul Moore
0 siblings, 2 replies; 20+ messages in thread
From: Steffen Klassert @ 2026-02-13 10:19 UTC (permalink / raw)
To: Tetsuo Handa
Cc: Paul Moore, SELinux, linux-security-module, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Mon, Feb 09, 2026 at 11:26:14PM +0900, Tetsuo Handa wrote:
> On 2026/02/09 20:22, Steffen Klassert wrote:
> > On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> >> On 2026/02/09 18:25, Steffen Klassert wrote:
> >>> The problem is that, with adding IPsec offloads to netdevices, security
> >>> critical resources came into the netdevices. Someone who has no
> >>> capabilities to delete xfrm states or xfrm policies should not be able
> >>> to unregister the netdevice if xfrm states or xfrm policies are
> >>> offloaded. Unfortunately, unregistering can't be canceled at this stage
> >>> anymore. So I think we need some netdevice unregistration hook for
> >>> the LSM subsystem so it can check for xfrm states or xfrm policies
> >>> and refuse the unregistration before we actually start to remove
> >>> the device.
> >>
> >> Unfortunately, unregistering is not always triggered by a user's request. ;-)
> >
> > As far as I remember, a security context is not always tied to a
> > user request. It can also be attached to system tasks or objects.
>
> That is not what I wanted to say. There are at least three routes (listed below)
> that can trigger xfrm_dev_unregister() path. You could insert LSM hooks into the
> netlink_sendmsg() route and the del_device_store() route, but the cleanup_net()
> route is a result of tear-down action which is too late to insert LSM hooks.
Yes, I know that.
> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
> (i.e. implicit cleanup of a network namespace due to termination of init process in
> that namespace). We are not allowed to reject the cleanup_net() route.
And here we come to the other problem I mentioned. When a LSM policy
rejects to flush the xfrm states and policies on network namespace
exit, we leak all the xfrm states and policies in that namespace.
Here we have no other option, we must flush the xfrm states and
policies regardless of any LSM policy. This can be fixed with
something like that:
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 72678053bd69..8a4b2cbba0e0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1822,9 +1822,11 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
spin_lock_bh(&net->xfrm.xfrm_policy_lock);
- err = xfrm_policy_flush_secctx_check(net, type, task_valid);
- if (err)
- goto out;
+ if (task_valid) {
+ err = xfrm_policy_flush_secctx_check(net, type, task_valid);
+ if (err)
+ goto out;
+ }
again:
list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f2aef404b583..fd00f2d20425 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -923,9 +923,11 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
int i, err = 0, cnt = 0;
spin_lock_bh(&net->xfrm.xfrm_state_lock);
- err = xfrm_state_flush_secctx_check(net, proto, task_valid);
- if (err)
- goto out;
+ if (task_valid) {
+ err = xfrm_state_flush_secctx_check(net, proto, task_valid);
+ if (err)
+ goto out;
+ }
err = -ESRCH;
for (i = 0; i <= net->xfrm.state_hmask; i++) {
> >
> >> For example, we don't check permission for unmount when a mount is deleted
> >> due to teardown of a mount namespace. I wonder why you want to check permission
> >> for unregistering a net_device when triggered by a teardown path.
> >
> > I just try to find out what's the right thing to do here.
> > If a policy goes away, packets that match this policy will
> > find another path through the network stack. As best, they
> > are dropped somewhere, but they can also leave on some other
> > device without encryption. A LSM that implements xfrm hooks
> > must be able to check the permission to delete the xfrm policy
> > or state.
>
> Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
> result in network traffic to be sent in cleartext ?
Yes this can happen, but it is known. You can either install
a global block policy with low priority or use a LSM to
prevent this. The latter does not work unfortunately.
>
> If yes, we need to consider updating the other patch at
> https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
> the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
> xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
> but instead updates that state/policy to behave as a blackhole. Then,
> we won't need to call LSM hooks because we no longer delete).
I think there is a clean way to fix this. We could just unlink
policy and state from the device. Then we could do the same as
we do when a state becomes unavailable due to expiration. We mark
the state as invalid with a flag. On expiration we do this with
XFRM_STATE_EXPIRED. We can add a new flag and do the same as
xfrm_state_check_expire() does on a hard expire. I.e. fire
a timer that notifies the userspace key manager that this
path is not avalable anymore and return an error. This way
userspace is informed about that and all packets matching
the policy are dropped.
This is of course a bit more work and requires testing.
^ permalink raw reply related [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-13 10:19 ` Steffen Klassert
@ 2026-02-13 13:59 ` Tetsuo Handa
2026-02-18 9:22 ` Steffen Klassert
2026-02-27 1:14 ` Paul Moore
1 sibling, 1 reply; 20+ messages in thread
From: Tetsuo Handa @ 2026-02-13 13:59 UTC (permalink / raw)
To: Steffen Klassert, Paul Moore, SELinux, linux-security-module
Cc: Herbert Xu, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Network Development
On 2026/02/13 19:19, Steffen Klassert wrote:
On 2026/02/13 19:19, Steffen Klassert wrote:
>> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
>> (i.e. implicit cleanup of a network namespace due to termination of init process in
>> that namespace). We are not allowed to reject the cleanup_net() route.
>
> And here we come to the other problem I mentioned. When a LSM policy
> rejects to flush the xfrm states and policies on network namespace
> exit, we leak all the xfrm states and policies in that namespace.
> Here we have no other option, we must flush the xfrm states and
> policies regardless of any LSM policy. This can be fixed with
> something like that:
This something is what I explained at
https://lkml.kernel.org/r/1bb453af-3ef2-4ab6-a909-0705bd07c136@I-love.SAKURA.ne.jp .
The "task_valid" argument does not always reflect whether LSM policy can reject or not.
Anyway, the patch to add xfrm_dev_unregister(dev) seems OK if we do like
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4 ?
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-13 13:59 ` Tetsuo Handa
@ 2026-02-18 9:22 ` Steffen Klassert
0 siblings, 0 replies; 20+ messages in thread
From: Steffen Klassert @ 2026-02-18 9:22 UTC (permalink / raw)
To: Tetsuo Handa
Cc: Paul Moore, SELinux, linux-security-module, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Fri, Feb 13, 2026 at 10:59:15PM +0900, Tetsuo Handa wrote:
> On 2026/02/13 19:19, Steffen Klassert wrote:
> On 2026/02/13 19:19, Steffen Klassert wrote:
> >> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
> >> (i.e. implicit cleanup of a network namespace due to termination of init process in
> >> that namespace). We are not allowed to reject the cleanup_net() route.
> >
> > And here we come to the other problem I mentioned. When a LSM policy
> > rejects to flush the xfrm states and policies on network namespace
> > exit, we leak all the xfrm states and policies in that namespace.
> > Here we have no other option, we must flush the xfrm states and
> > policies regardless of any LSM policy. This can be fixed with
> > something like that:
>
> This something is what I explained at
> https://lkml.kernel.org/r/1bb453af-3ef2-4ab6-a909-0705bd07c136@I-love.SAKURA.ne.jp .
> The "task_valid" argument does not always reflect whether LSM policy can reject or not.
That was to fix the memleak on network namespace exit.
The task_valid check should be ok for xfrm_policy_flush()
and xfrm_state_flush().
>
> Anyway, the patch to add xfrm_dev_unregister(dev) seems OK if we do like
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4 ?
That would be OK as a first fix. Later we should
just unlink policies and states from the device,
as explained in my last mail.
^ permalink raw reply [flat|nested] 20+ messages in thread
* Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()
2026-02-13 10:19 ` Steffen Klassert
2026-02-13 13:59 ` Tetsuo Handa
@ 2026-02-27 1:14 ` Paul Moore
1 sibling, 0 replies; 20+ messages in thread
From: Paul Moore @ 2026-02-27 1:14 UTC (permalink / raw)
To: Steffen Klassert
Cc: Tetsuo Handa, SELinux, linux-security-module, Herbert Xu,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Network Development
On Fri, Feb 13, 2026 at 5:19 AM Steffen Klassert
<steffen.klassert@secunet.com> wrote:
> On Mon, Feb 09, 2026 at 11:26:14PM +0900, Tetsuo Handa wrote:
> > On 2026/02/09 20:22, Steffen Klassert wrote:
> > > On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> > >> On 2026/02/09 18:25, Steffen Klassert wrote:
...
> And here we come to the other problem I mentioned. When a LSM policy
> rejects to flush the xfrm states and policies on network namespace
> exit, we leak all the xfrm states and policies in that namespace.
> Here we have no other option, we must flush the xfrm states and
> policies regardless of any LSM policy. This can be fixed with
> something like that:
>
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index 72678053bd69..8a4b2cbba0e0 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -1822,9 +1822,11 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
>
> spin_lock_bh(&net->xfrm.xfrm_policy_lock);
>
> - err = xfrm_policy_flush_secctx_check(net, type, task_valid);
> - if (err)
> - goto out;
> + if (task_valid) {
> + err = xfrm_policy_flush_secctx_check(net, type, task_valid);
> + if (err)
> + goto out;
> + }
>
> again:
> list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index f2aef404b583..fd00f2d20425 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -923,9 +923,11 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
> int i, err = 0, cnt = 0;
>
> spin_lock_bh(&net->xfrm.xfrm_state_lock);
> - err = xfrm_state_flush_secctx_check(net, proto, task_valid);
> - if (err)
> - goto out;
> + if (task_valid) {
> + err = xfrm_state_flush_secctx_check(net, proto, task_valid);
> + if (err)
> + goto out;
> + }
>
> err = -ESRCH;
> for (i = 0; i <= net->xfrm.state_hmask; i++) {
This seems reasonable to me, and please correct me if I'm wrong, but
if the network namespace is gone at this point, we don't really have
to worry about traffic from any applications because there should no
longer be any processes in that namespace, yes? I suppose there is
still a chance we'll see inbound traffic for endpoints in that
namespace, but I imagine the initns stack will reject it.
> > >> For example, we don't check permission for unmount when a mount is deleted
> > >> due to teardown of a mount namespace. I wonder why you want to check permission
> > >> for unregistering a net_device when triggered by a teardown path.
> > >
> > > I just try to find out what's the right thing to do here.
> > > If a policy goes away, packets that match this policy will
> > > find another path through the network stack. As best, they
> > > are dropped somewhere, but they can also leave on some other
> > > device without encryption. A LSM that implements xfrm hooks
> > > must be able to check the permission to delete the xfrm policy
> > > or state.
> >
> > Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
> > result in network traffic to be sent in cleartext ?
>
> Yes this can happen, but it is known. You can either install
> a global block policy with low priority or use a LSM to
> prevent this. The latter does not work unfortunately.
If I understand you correctly, the proposal below would address this
last part, yes?
> > If yes, we need to consider updating the other patch at
> > https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
> > the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
> > xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
> > but instead updates that state/policy to behave as a blackhole. Then,
> > we won't need to call LSM hooks because we no longer delete).
>
> I think there is a clean way to fix this. We could just unlink
> policy and state from the device. Then we could do the same as
> we do when a state becomes unavailable due to expiration. We mark
> the state as invalid with a flag. On expiration we do this with
> XFRM_STATE_EXPIRED. We can add a new flag and do the same as
> xfrm_state_check_expire() does on a hard expire. I.e. fire
> a timer that notifies the userspace key manager that this
> path is not avalable anymore and return an error. This way
> userspace is informed about that and all packets matching
> the policy are dropped.
This looks interesting. The traffic would be dropped, and presumably
userspace could then cleanup the old state and establish any new
policy as required, yes?
> This is of course a bit more work and requires testing.
Tetsuo, Steffen, any chance one of the two of you would be able to
work on some patches for this?
--
paul-moore.com
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2026-02-27 1:14 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-23 10:08 [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check() Tetsuo Handa
2026-01-26 22:33 ` Paul Moore
2026-01-27 3:51 ` Tetsuo Handa
2026-01-27 21:59 ` Paul Moore
2026-01-28 10:28 ` Tetsuo Handa
2026-01-30 21:56 ` Paul Moore
2026-01-31 6:00 ` Tetsuo Handa
2026-02-02 4:07 ` Paul Moore
2026-02-03 3:47 ` Tetsuo Handa
2026-02-03 22:40 ` Paul Moore
2026-02-04 10:15 ` Tetsuo Handa
2026-02-04 13:57 ` Tetsuo Handa
2026-02-09 9:25 ` Steffen Klassert
2026-02-09 10:02 ` Tetsuo Handa
2026-02-09 11:22 ` Steffen Klassert
2026-02-09 14:26 ` Tetsuo Handa
2026-02-13 10:19 ` Steffen Klassert
2026-02-13 13:59 ` Tetsuo Handa
2026-02-18 9:22 ` Steffen Klassert
2026-02-27 1:14 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox