[PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
returned an error value upon NETDEV_UNREGISTER event, the system will hung
up with

  unregister_netdevice: waiting for $dev to become free. Usage count = $count

message because the reference to $dev acquired by
xfrm_dev_{state,policy}_add() cannot be released.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 net/xfrm/xfrm_policy.c | 35 -----------------------------------
 net/xfrm/xfrm_state.c  | 33 ---------------------------------
 2 files changed, 68 deletions(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 62486f866975..f4df6491095f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1778,41 +1778,12 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
 	}
 	return err;
 }
-
-static inline int xfrm_dev_policy_flush_secctx_check(struct net *net,
-						     struct net_device *dev,
-						     bool task_valid)
-{
-	struct xfrm_policy *pol;
-	int err = 0;
-
-	list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
-		if (pol->walk.dead ||
-		    xfrm_policy_id2dir(pol->index) >= XFRM_POLICY_MAX ||
-		    pol->xdo.dev != dev)
-			continue;
-
-		err = security_xfrm_policy_delete(pol->security);
-		if (err) {
-			xfrm_audit_policy_delete(pol, 0, task_valid);
-			return err;
-		}
-	}
-	return err;
-}
 #else
 static inline int
 xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
 {
 	return 0;
 }
-
-static inline int xfrm_dev_policy_flush_secctx_check(struct net *net,
-						     struct net_device *dev,
-						     bool task_valid)
-{
-	return 0;
-}
 #endif
 
 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
@@ -1861,11 +1832,6 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
 	struct xfrm_policy *pol;
 
 	spin_lock_bh(&net->xfrm.xfrm_policy_lock);
-
-	err = xfrm_dev_policy_flush_secctx_check(net, dev, task_valid);
-	if (err)
-		goto out;
-
 again:
 	list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
 		if (pol->walk.dead)
@@ -1888,7 +1854,6 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
 		__xfrm_policy_inexact_flush(net);
 	else
 		err = -ESRCH;
-out:
 	spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
 	return err;
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 98b362d51836..855778177558 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -881,41 +881,12 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
 
 	return err;
 }
-
-static inline int
-xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
-{
-	int i, err = 0;
-
-	for (i = 0; i <= net->xfrm.state_hmask; i++) {
-		struct xfrm_state *x;
-		struct xfrm_dev_offload *xso;
-
-		hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
-			xso = &x->xso;
-
-			if (xso->dev == dev &&
-			   (err = security_xfrm_state_delete(x)) != 0) {
-				xfrm_audit_state_delete(x, 0, task_valid);
-				return err;
-			}
-		}
-	}
-
-	return err;
-}
 #else
 static inline int
 xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
 {
 	return 0;
 }
-
-static inline int
-xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool task_valid)
-{
-	return 0;
-}
 #endif
 
 int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
@@ -966,9 +937,6 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
 	int i, err = 0, cnt = 0;
 
 	spin_lock_bh(&net->xfrm.xfrm_state_lock);
-	err = xfrm_dev_state_flush_secctx_check(net, dev, task_valid);
-	if (err)
-		goto out;
 
 	err = -ESRCH;
 	for (i = 0; i <= net->xfrm.state_hmask; i++) {
@@ -997,7 +965,6 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
 	if (cnt)
 		err = 0;
 
-out:
 	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 
 	spin_lock_bh(&xfrm_state_dev_gc_lock);
-- 
2.47.3

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
>
> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
> returned an error value upon NETDEV_UNREGISTER event, the system will hung
> up with
>
>   unregister_netdevice: waiting for $dev to become free. Usage count = $count
>
> message because the reference to $dev acquired by
> xfrm_dev_{state,policy}_add() cannot be released.
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
>  net/xfrm/xfrm_policy.c | 35 -----------------------------------
>  net/xfrm/xfrm_state.c  | 33 ---------------------------------
>  2 files changed, 68 deletions(-)

I didn't make it very far into reviewing this patch, because it looks
like xfrm_dev_state_flush() is called by the bonding driver's
notification handler, and I don't see that reflected in this patch?

-- 
paul-moore.com

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/01/27 7:33, Paul Moore wrote:
> On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
> <penguin-kernel@i-love.sakura.ne.jp> wrote:
>>
>> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
>> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
>> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
>> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
>> returned an error value upon NETDEV_UNREGISTER event, the system will hung
>> up with
>>
>>   unregister_netdevice: waiting for $dev to become free. Usage count = $count
>>
>> message because the reference to $dev acquired by
>> xfrm_dev_{state,policy}_add() cannot be released.
>>
>> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
>> ---
>>  net/xfrm/xfrm_policy.c | 35 -----------------------------------
>>  net/xfrm/xfrm_state.c  | 33 ---------------------------------
>>  2 files changed, 68 deletions(-)
> 
> I didn't make it very far into reviewing this patch, because it looks
> like xfrm_dev_state_flush() is called by the bonding driver's
> notification handler, and I don't see that reflected in this patch?

xfrm_dev_{state,policy}_flush() are called from only the bonding driver's NETDEV_UNREGISTER
event notification handler and the xfrm module's NETDEV_DOWN event / NETDEV_UNREGISTER event
notification handler ( https://elixir.bootlin.com/linux/v6.19-rc5/A/ident/xfrm_dev_state_flush ).

What this patch kills is not xfrm_dev_{state,policy}_flush() but
xfrm_dev_{state,policy}_flush_secctx_check(). No need to touch the bonding driver.

LSM hook for checking whether to allow deleting a file in tmpfs which is still mounted
makes sense, LSM hook for checking whether to allow starting unmount of tmpfs makes sense,
but LSM hook for checking whether to allow releasing memory in tmpfs while unmount operation
is already in progress causes nothing but a resource leak / denial-of-service kernel bug.

What xfrm_dev_{state,policy}_flush_secctx_check() are causing is something like
"LSM policy is refusing release of memory used by a file in tmpfs which is already under
unmount operation".
xfrm_dev_{state,policy}_flush_secctx_check() are too late to make LSM policy decision.
A must-not-fail operation has already started before LSM hooks are called.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Mon, Jan 26, 2026 at 10:51 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/27 7:33, Paul Moore wrote:
> > On Fri, Jan 23, 2026 at 5:13 AM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> >>
> >> Since xfrm_dev_{state,policy}_flush() are called from only NETDEV_DOWN and
> >> NETDEV_UNREGISTER events, making xfrm_dev_{state,policy}_flush() no-op by
> >> returning an error value from xfrm_dev_{state,policy}_flush_secctx_check()
> >> is pointless. Especially, if xfrm_dev_{state,policy}_flush_secctx_check()
> >> returned an error value upon NETDEV_UNREGISTER event, the system will hung
> >> up with
> >>
> >>   unregister_netdevice: waiting for $dev to become free. Usage count = $count
> >>
> >> message because the reference to $dev acquired by
> >> xfrm_dev_{state,policy}_add() cannot be released.
> >>
> >> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> >> ---
> >>  net/xfrm/xfrm_policy.c | 35 -----------------------------------
> >>  net/xfrm/xfrm_state.c  | 33 ---------------------------------
> >>  2 files changed, 68 deletions(-)
> >
> > I didn't make it very far into reviewing this patch, because it looks
> > like xfrm_dev_state_flush() is called by the bonding driver's
> > notification handler, and I don't see that reflected in this patch?
>
> xfrm_dev_{state,policy}_flush() are called from only ...

My apologies, I was looking at the patch too quickly and shortened
xfrm_dev_state_flush_secctx_check() into xfrm_dev_state_flush() when
looking at the callers.

> LSM hook for checking whether to allow deleting a file in tmpfs which is still mounted
> makes sense, LSM hook for checking whether to allow starting unmount of tmpfs makes sense,
> but LSM hook for checking whether to allow releasing memory in tmpfs while unmount operation
> is already in progress causes nothing but a resource leak / denial-of-service kernel bug.
>
> What xfrm_dev_{state,policy}_flush_secctx_check() are causing is something like
> "LSM policy is refusing release of memory used by a file in tmpfs which is already under
> unmount operation".
> xfrm_dev_{state,policy}_flush_secctx_check() are too late to make LSM policy decision.
> A must-not-fail operation has already started before LSM hooks are called.

It sounds like we either need to confirm that
security_xfrm_{policy,state}_delete() is already present in all code
paths that result in SPD/SAD deletions (in a place that can safely
fail and return an error), or we need to place
xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
safely fail.  The patch doesn't relocate
xfrm_dev_{policy,state}_flush_secctx_check() and I don't really see
any mention about security_xfrm_{policy,state}_delete() in the patch
or description; have you verified that the LSM xfrm hooks are still
being called to authorize the removals?

-- 
paul-moore.com

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/01/28 6:59, Paul Moore wrote:
> It sounds like we either need to confirm that
> security_xfrm_{policy,state}_delete() is already present in all code
> paths that result in SPD/SAD deletions (in a place that can safely
> fail and return an error),

Yes.

>                            or we need to place
> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> safely fail.

Did you mean xfrm_{policy,state}_flush_secctx_check() ?

Regarding xfrm_policy_flush() as an example, we can observe that we are
calling LSM hooks for must-not-fail callers. If the task_valid argument was
meant to be interpreted as whether to call LSM hooks, xfrm_policy_flush() needs
below change.

 int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
 {
 (...snipped...)
-	err = xfrm_policy_flush_secctx_check(net, type, task_valid);
+	err = task_valid ? xfrm_policy_flush_secctx_check(net, type, task_valid) : 0;
 (...snipped...)
 }

>               The patch doesn't relocate
> xfrm_dev_{policy,state}_flush_secctx_check() and I don't really see
> any mention about security_xfrm_{policy,state}_delete() in the patch
> or description;
>                 have you verified that the LSM xfrm hooks are still
> being called to authorize the removals?

Please distinguish caller for "delete" and caller for "release".
LSM xfrm hooks need to be called for "delete" callers, but
LSM xfrm hooks need to be bypassed for "release" callers.

Maybe task_valid == true is for "delete" callers and task_valid == false is
for "release" callers; though it seems that some locations are passing wrong
task_valid flag (e.g. xfrm_dev_down() is passing task_valid == true despite
it is a "release" caller).

If 'task_valid == true is for "delete" callers and task_valid == false is for
"release" callers' does not hold, we might need to add a "forced" flag
(which is interpreted as whether LSM hooks must be bypassed) like
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4
does.

Anyway, this patch which kills xfrm_dev_{state,policy}_flush_secctx_check()
can be applied as-is because all callers are "release" callers.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/28 6:59, Paul Moore wrote:
> > It sounds like we either need to confirm that
> > security_xfrm_{policy,state}_delete() is already present in all code
> > paths that result in SPD/SAD deletions (in a place that can safely
> > fail and return an error),
>
> Yes.

To clarify, do you mean "yes, I agree", or "yes, I've already checked
this and can confirm that the LSM hooks are already being called"?

> >                            or we need to place
> > xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> > safely fail.
>
> Did you mean xfrm_{policy,state}_flush_secctx_check() ?

They both call into the security_xfrm_policy_delete() LSM hook which
is what I care about as that hook is what authorizes the operation.

> Regarding xfrm_policy_flush() as an example, we can observe that we are
> calling LSM hooks for must-not-fail callers ...

We need to make sure the LSM hooks are being called to authorize the
removal of SPD and SAD entries.  If you are going to remove LSM hooks
from the existing code, please document how that code path you are
changing is still subject to authorization by the LSM hooks or explain
in great detail how that authorization is not necessary.

-- 
paul-moore.com

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/01/31 6:56, Paul Moore wrote:
> On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
> <penguin-kernel@i-love.sakura.ne.jp> wrote:
>> On 2026/01/28 6:59, Paul Moore wrote:
>>> It sounds like we either need to confirm that
>>> security_xfrm_{policy,state}_delete() is already present in all code
>>> paths that result in SPD/SAD deletions (in a place that can safely
>>> fail and return an error),
>>
>> Yes.
> 
> To clarify, do you mean "yes, I agree", or "yes, I've already checked
> this and can confirm that the LSM hooks are already being called"?

I mean "yes, I agree".

> 
>>>                            or we need to place
>>> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
>>> safely fail.
>>
>> Did you mean xfrm_{policy,state}_flush_secctx_check() ?
> 
> They both call into the security_xfrm_policy_delete() LSM hook which
> is what I care about as that hook is what authorizes the operation.

I can't understand what your authorization is.
No authorization can be placed during must-not-fail operation.

For example, please consider the following sequence.

  mkdir /mnt/tmpfs
  unshare -m
  mount -t tmpfs none /mnt/tmpfs
  touch /mnt/tmpfs/file1
  mkdir /mnt/tmpfs/dir1
  exit

Although there are LSM hooks for deleting a file/directory and LSM hook for
unmounting, no LSM hook is called before deleting file1, deleting dir1,
and unmounting /mnt/tmpfs because operations that happen during tear-down of
a namespace must not fail.

What "[PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()" is doing
is the same thing for a network device. NETDEV_UNREGISTER is a must-not-fail
operation that happens during tear-down of a network device. LSM hooks are not
allowed to veto must-not-fail operations.

> 
>> Regarding xfrm_policy_flush() as an example, we can observe that we are
>> calling LSM hooks for must-not-fail callers ...
> 
> We need to make sure the LSM hooks are being called to authorize the
> removal of SPD and SAD entries.  If you are going to remove LSM hooks
> from the existing code, please document how that code path you are
> changing is still subject to authorization by the LSM hooks or explain
> in great detail how that authorization is not necessary.

Again, LSM hooks are not allowed to veto operations that happen during
NETDEV_UNREGISTER event. Current XFRM code for NETDEV_UNREGISTER event is broken
because the behavior is

  while (security_xfrm_state_delete() != 0) {
    schedule_timeout_uninterruptible(10 * HZ);
    pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
             dev->name, netdev_refcnt_read(dev));
  }
  while (security_xfrm_policy_delete() != 0) {
    schedule_timeout_uninterruptible(10 * HZ);
    pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
             dev->name, netdev_refcnt_read(dev));
  }

which is a denial-of-service kernel bug.

No room for debating "authorize the removal of SPD and SAD entries".
This path is a must-not-fail operation. Removal of SPD and SAD entries has to be done
without authorization when NETDEV_UNREGISTER event fired.

Though, you could argue whether removal of SPD and SAD entries is really what they want
when NETDEV_DOWN event fired. I don't know what the authors of commit d77e38e612a0
("xfrm: Add an IPsec hardware offloading API") are expecting because deleted entries
are not automatically revived when NETDEV_UP event fires
( https://lkml.kernel.org/r/cea4b855-fe94-4b4e-9c2d-3cef7aac1be3@I-love.SAKURA.ne.jp ).

Hmm, does
https://elixir.bootlin.com/linux/v6.19-rc5/source/include/linux/netdevice.h#L3142 mean that
LSM hooks are as well not allowed to veto operations that happen during
NETDEV_UP/NETDEV_DOWN events?

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Sat, Jan 31, 2026 at 1:01 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/01/31 6:56, Paul Moore wrote:
> > On Wed, Jan 28, 2026 at 5:28 AM Tetsuo Handa
> > <penguin-kernel@i-love.sakura.ne.jp> wrote:
> >> On 2026/01/28 6:59, Paul Moore wrote:
> >>> It sounds like we either need to confirm that
> >>> security_xfrm_{policy,state}_delete() is already present in all code
> >>> paths that result in SPD/SAD deletions (in a place that can safely
> >>> fail and return an error),
> >>
> >> Yes.
> >
> > To clarify, do you mean "yes, I agree", or "yes, I've already checked
> > this and can confirm that the LSM hooks are already being called"?
>
> I mean "yes, I agree".
>
> >
> >>>                            or we need to place
> >>> xfrm_dev_{policy,state}_flush_secctx_check() in a location that can
> >>> safely fail.
> >>
> >> Did you mean xfrm_{policy,state}_flush_secctx_check() ?
> >
> > They both call into the security_xfrm_policy_delete() LSM hook which
> > is what I care about as that hook is what authorizes the operation.
>
> I can't understand what your authorization is.

I'm asking you to verify that we have the LSM xfrm hooks in all of the
necessary locations to ensure that we are safely and comprehensively
gating all of the operations that result in removal of SPD and SAD
entries.

> No authorization can be placed during must-not-fail operation.

Of course, but that means that we simply need to make sure we have the
authorization hooks placed elsewhere to ensure that users can not
remove SPD and SAD entries if they are not allowed.  I'm not arguing
about if returning an error in a place that can not handle an error
condition is correct or not, I'm arguing that you should audit the SPD
and SAD removal code paths to ensure that they all have the proper LSM
xfrm hook authorizations.

-- 
paul-moore.com

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

[-- Attachment #1: Type: text/plain, Size: 2686 bytes --]

On 2026/02/02 13:07, Paul Moore wrote:
> I'm asking you to verify that we have the LSM xfrm hooks in all of the
> necessary locations to ensure that we are safely and comprehensively
> gating all of the operations that result in removal of SPD and SAD
> entries.

That is impossible. We can't have the LSM xfrm hooks in all locations
that result in removal of SPD and SAD entries. We must give up trying
to have the LSM xfrm hooks in NETDEV_UNREGISTER event handler despite
NETDEV_UNREGISTER event handler results in removal of SPD and SAD entries.

>> No authorization can be placed during must-not-fail operation.
> 
> Of course, but that means that we simply need to make sure we have the
> authorization hooks placed elsewhere to ensure that users can not
> remove SPD and SAD entries if they are not allowed.  I'm not arguing
> about if returning an error in a place that can not handle an error
> condition is correct or not, I'm arguing that you should audit the SPD
> and SAD removal code paths to ensure that they all have the proper LSM
> xfrm hook authorizations.

This patch just removes error-returning LSM xfrm hook calls from one of
must-not-fail locations. I attach two syzbot reports that demonstrate
a result of having LSM xfrm hook calls from NETDEV_UNREGISTER event
( https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/net/xfrm?h=next-20260202&id=638361ad7ab20c5740d9637d3a51306f9b2e1461 ) .

As you can see, this must-not-fail operation is triggered by both
"sendmsg() system call (i.e. sending netlink message) by a userspace process"
and "the cleanup_net kernel WQ thread".

You might be able to call LSM xfrm hooks before netlink_sendmsg() is authorized
(assuming that that LSM hook can examine what SPD and SAD entries will be deleted
by allow processing netlink_sendmsg() request), but I guess that it will be
subjected to TOCTOU problem; can we have such giant lock that can serialize all
operations that might be triggered by allow calling netlink_sendmsg()? Even if
you had such giant lock, what about cleanup_net() path that happens without
explicit request from userspace?

It is your role (not my role) to verify that we have the LSM xfrm hooks in all
of the necessary locations, for it is you who is wishing to ensure that we are
safely and comprehensively gating all of the operations that result in removal
of SPD and SAD entries. The reports I attached are suggesting you that we can't
safely and comprehensively gate all of the operations that result in removal of
SPD and SAD entries.



Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84

[-- Attachment #2: report-20260202-cleanup_net.txt --]
[-- Type: text/plain, Size: 73840 bytes --]

 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff88807ddc4630 has 1/1 users at
     xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
     __sock_sendmsg net/socket.c:752 [inline]
     ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
     ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
     __sys_sendmsg net/socket.c:2696 [inline]
     __do_sys_sendmsg net/socket.c:2701 [inline]
     __se_sys_sendmsg net/socket.c:2699 [inline]
     __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
     net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
     register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
     netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
     netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
     register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
     netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
     register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -7 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -7 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
     batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
     udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
     qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
     attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
     netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
     attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
     dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
     __dev_open+0x67a/0x830 net/core/dev.c:1704
     __dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
     netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
     addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
     addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
     addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
     ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -2 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
     addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
     mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -12 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dst_destroy+0x117/0x360 net/core/dst.c:115
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
     addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[28] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[29] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[30] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[31] +6 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[32] -4 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
     process_scheduled_works kernel/workqueue.c:3362 [inline]
     worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
     kthread+0x388/0x470 kernel/kthread.c:467
     ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[33] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[35] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_name+0xdb/0x210 net/core/dev.c:909
     netdev_get_by_name+0x27/0xb0 net/core/dev.c:933
     ethnl_parse_header_dev_get+0x445/0x8b0 net/ethtool/netlink.c:194
     ethnl_default_parse net/ethtool/netlink.c:457 [inline]
     ethnl_default_set_doit+0x224/0xae0 net/ethtool/netlink.c:895
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[36] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     ethnl_parse_header_dev_put net/ethtool/netlink.h:274 [inline]
     ethnl_default_set_doit+0x92e/0xae0 net/ethtool/netlink.c:940
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     linkwatch_add_event net/core/link_watch.c:131 [inline]
     linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
     nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
     __dev_close_many+0x368/0x6d0 net/core/dev.c:1768
     netif_close_many+0x225/0x420 net/core/dev.c:1793
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[38] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_flush_dev net/core/neighbour.c:433 [inline]
     __neigh_ifdown+0x1e8/0x8c0 net/core/neighbour.c:467
     neigh_ifdown+0x1f/0x30 net/core/neighbour.c:491
     rt6_disable_ip+0x776/0x7f0 net/ipv6/route.c:5018
     addrconf_ifdown+0x161/0x1a40 net/ipv6/addrconf.c:3858
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_close_many+0x2ae/0x420 net/core/dev.c:1797
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
     process_scheduled_works kernel/workqueue.c:3362 [inline]
     worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
Call trace for netdevsim0[39] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_close_many+0x2ae/0x420 net/core/dev.c:1797
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[40] -3 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
     fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[41] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     __qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
     qdisc_put net/sched/sch_generic.c:1105 [inline]
     dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
     unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[42] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[43] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[44] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     inetdev_destroy net/ipv4/devinet.c:335 [inline]
     inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[45] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
     in_dev_put include/linux/inetdevice.h:290 [inline]
     inetdev_destroy net/ipv4/devinet.c:338 [inline]
     inetdev_event+0x83b/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[46] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[47] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
     in6_dev_put include/net/addrconf.h:422 [inline]
     addrconf_ifdown+0x17d1/0x1a40 net/ipv6/addrconf.c:4014
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[48] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
     kref_put include/linux/kref.h:65 [inline]
     batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
     batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[49] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
     udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[50] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
     remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
     netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[51] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
     remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
     netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[52] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[53] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
     linkwatch_sync_dev+0x27f/0x390 net/core/link_watch.c:289
     netdev_run_todo+0x3fe/0x1130 net/core/dev.c:11705
     nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[53] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

[-- Attachment #3: report-20260202-netlink_sendmsg.txt --]
[-- Type: text/plain, Size: 76858 bytes --]

unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff88805b5fc630 has 1/1 users at
     xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
     __sock_sendmsg net/socket.c:752 [inline]
     ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
     ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
     __sys_sendmsg net/socket.c:2696 [inline]
     __do_sys_sendmsg net/socket.c:2701 [inline]
     __se_sys_sendmsg net/socket.c:2699 [inline]
     __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
     net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
     register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
     netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
     netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
     register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
     netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
     register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -7 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -7 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
     batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
     udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
     qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
     attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
     netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
     attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
     dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
     __dev_open+0x67a/0x830 net/core/dev.c:1704
     __dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
     netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
     addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
     addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
     addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
     ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -2 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
     addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
     mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -11 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dst_destroy+0x117/0x360 net/core/dst.c:115
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
     addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[28] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[29] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[30] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[31] +5 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[32] -3 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_remove_one+0x46d/0x4c0 net/core/neighbour.c:249
     neigh_forced_gc net/core/neighbour.c:280 [inline]
     neigh_alloc net/core/neighbour.c:512 [inline]
     ___neigh_create+0x485/0x2290 net/core/neighbour.c:655
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[33] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ethnl_default_dumpit+0x1ed/0x630 net/ethtool/netlink.c:626
     genl_dumpit+0x10b/0x1b0 net/netlink/genetlink.c:1027
     netlink_dump+0x722/0xe80 net/netlink/af_netlink.c:2325
     __netlink_dump_start+0x5cb/0x7e0 net/netlink/af_netlink.c:2440
     genl_family_rcv_msg_dumpit+0x213/0x310 net/netlink/genetlink.c:1076
     genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
     genl_rcv_msg+0x5e8/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     ethnl_default_dumpit+0x404/0x630 net/ethtool/netlink.c:632
     genl_dumpit+0x10b/0x1b0 net/netlink/genetlink.c:1027
     netlink_dump+0x722/0xe80 net/netlink/af_netlink.c:2325
     __netlink_dump_start+0x5cb/0x7e0 net/netlink/af_netlink.c:2440
     genl_family_rcv_msg_dumpit+0x213/0x310 net/netlink/genetlink.c:1076
     genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
     genl_rcv_msg+0x5e8/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[35] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[36] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
     process_scheduled_works kernel/workqueue.c:3362 [inline]
     worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
     kthread+0x388/0x470 kernel/kthread.c:467
     ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[38] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     linkwatch_add_event net/core/link_watch.c:131 [inline]
     linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
     nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
     __dev_close_many+0x368/0x6d0 net/core/dev.c:1768
     netif_close_many+0x225/0x420 net/core/dev.c:1793
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[39] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_flush_dev net/core/neighbour.c:433 [inline]
     __neigh_ifdown+0x1e8/0x8c0 net/core/neighbour.c:467
     neigh_ifdown+0x1f/0x30 net/core/neighbour.c:491
     rt6_disable_ip+0x776/0x7f0 net/ipv6/route.c:5018
     addrconf_ifdown+0x161/0x1a40 net/ipv6/addrconf.c:3858
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_close_many+0x2ae/0x420 net/core/dev.c:1797
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
Call trace for netdevsim0[40] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_close_many+0x2ae/0x420 net/core/dev.c:1797
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
Call trace for netdevsim0[41] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     __qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
     qdisc_put net/sched/sch_generic.c:1105 [inline]
     dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
     unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[42] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[43] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[44] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     inetdev_destroy net/ipv4/devinet.c:335 [inline]
     inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[45] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
     in_dev_put include/linux/inetdevice.h:290 [inline]
     inetdev_destroy net/ipv4/devinet.c:338 [inline]
     inetdev_event+0x83b/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[46] -3 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
     fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[47] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[48] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
     in6_dev_put include/net/addrconf.h:422 [inline]
     addrconf_ifdown+0x17d1/0x1a40 net/ipv6/addrconf.c:4014
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[49] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
     kref_put include/linux/kref.h:65 [inline]
     batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
     batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[50] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
     udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[51] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
     remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
     netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[52] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
     remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
     netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[53] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
     devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
     devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[54] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
     __linkwatch_run_queue+0x572/0x7f0 net/core/link_watch.c:244
     linkwatch_event+0x4c/0x60 net/core/link_watch.c:304
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[54] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
 __sys_sendmsg net/socket.c:2696 [inline]
 __do_sys_sendmsg net/socket.c:2701 [inline]
 __se_sys_sendmsg net/socket.c:2699 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
 __sys_sendmsg net/socket.c:2696 [inline]
 __do_sys_sendmsg net/socket.c:2701 [inline]
 __se_sys_sendmsg net/socket.c:2699 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
 </TASK>

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Mon, Feb 2, 2026 at 10:48 PM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> On 2026/02/02 13:07, Paul Moore wrote:
> > I'm asking you to verify that we have the LSM xfrm hooks in all of the
> > necessary locations to ensure that we are safely and comprehensively
> > gating all of the operations that result in removal of SPD and SAD
> > entries.
>
> That is impossible. We can't have the LSM xfrm hooks in all locations
> that result in removal of SPD and SAD entries.

It's a good thing that isn't what I said.  I said "... LSM xfrm hooks
in all of the
necessary locations to ensure that we are safely and COMPREHENSIVELY
GATING all of the operations that result in removal of SPD and SAD
entries."  I used the capitalization to emphasize the idea that the
goal is a comprehensive gating of the operations, not necessarily a
placement of LSM hooks in all of the functions.  It can be a subtle
difference, but it is an important one as I think you can understand.

> It is your role (not my role) to verify that we have the LSM xfrm hooks in all
> of the necessary locations, for it is you who is wishing to ensure that we are
> safely and comprehensively gating all of the operations that result in removal
> of SPD and SAD entries.

All of us who contribute upstream have a responsibility to ensure the
proper operation and maintenance of the upstream Linux kernel, this is
especially true for individuals such as yourself who have accepted a
maintainer role.

You have identified what appear to be issues with the upstream kernel,
and have proposed changes to address that.  While reviewing those
changes I asked you to verify that the LSM hooks associated with your
proposed change were still working as expected, since it was not clear
from the discussion, or the patch, that an investigation had taken
place.  This is not an unusual request for such a proposed change, and
is something that I would expect a LSM maintainer to do without much
hesitation.  If you are unwilling to investigate this, can you explain
why?

-- 
paul-moore.com

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

[-- Attachment #1: Type: text/plain, Size: 780 bytes --]

On 2026/02/04 7:40, Paul Moore wrote:
>         This is not an unusual request for such a proposed change, and
> is something that I would expect a LSM maintainer to do without much
> hesitation.  If you are unwilling to investigate this, can you explain
> why?

Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.

I can't judge whether the current code is COMPREHENSIVELY GATING;
I can't imagine what the state you call COMPREHENSIVELY GATING is.



P.S. For your investigation, I attach a new report that syzbot found today, and
I'll drop "xfrm: always fail xfrm_dev_{state,policy}_flush_secctx_check()"
because these three reports will be sufficient for people to understand that
we need to kill xfrm_dev_{state,policy}_flush_secctx_check() calls.

[-- Attachment #2: report-0202-kernfs.txt --]
[-- Type: text/plain, Size: 90653 bytes --]

unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff888028c4c630 has 1/1 users at
     xfrm_dev_state_add+0x6f4/0xc40 net/xfrm/xfrm_device.c:316
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
     __sock_sendmsg net/socket.c:752 [inline]
     ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
     ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
     __sys_sendmsg net/socket.c:2696 [inline]
     __do_sys_sendmsg net/socket.c:2701 [inline]
     __se_sys_sendmsg net/socket.c:2699 [inline]
     __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

infiniband: balance for netdevsim0@ib_gid_table_entry is 0
balance for netdevsim0@j1939_priv is 0
Call trace for netdevsim0[1] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     rx_queue_add_kobject net/core/net-sysfs.c:1257 [inline]
     net_rx_queue_update_kobjects+0x148/0x750 net/core/net-sysfs.c:1322
     register_queue_kobjects net/core/net-sysfs.c:2114 [inline]
     netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[2] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
     netdev_queue_update_kobjects+0x170/0x6d0 net/core/net-sysfs.c:2056
     register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
     netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
     register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11409
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[3] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold+0x27/0xc0 include/linux/netdevice.h:4446
     register_netdevice+0x15cc/0x1cf0 net/core/dev.c:11433
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
Call trace for netdevsim0[4] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[5] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[6] -10 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x12c/0x260 drivers/infiniband/core/roce_gid_mgmt.c:675
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[7] -10 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     netdevice_event_work_handler+0x1b2/0x260 drivers/infiniband/core/roce_gid_mgmt.c:676
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[8] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     inetdev_init+0x118/0x4f0 net/ipv4/devinet.c:280
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[9] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     inetdev_init+0x19f/0x4f0 net/ipv4/devinet.c:286
     inetdev_event+0x30d/0x1610 net/ipv4/devinet.c:1590
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[10] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     neigh_parms_alloc+0x192/0x530 net/core/neighbour.c:1778
     ipv6_add_dev+0x40d/0x13c0 net/ipv6/addrconf.c:403
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[11] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ipv6_add_dev+0x4ae/0x13c0 net/ipv6/addrconf.c:411
     addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[12] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     batadv_hardif_add_interface net/batman-adv/hard-interface.c:878 [inline]
     batadv_hard_if_event+0xb47/0x1240 net/batman-adv/hard-interface.c:958
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[13] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
     udp_tunnel_nic_netdevice_event+0xaea/0x17e0 net/ipv4/udp_tunnel_nic.c:931
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     register_netdevice+0x173a/0x1cf0 net/core/dev.c:11447
     nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1064 [inline]
     nsim_create+0xb92/0x1100 drivers/net/netdevsim/netdev.c:1146
     __nsim_dev_port_add+0x72a/0xb50 drivers/net/netdevsim/dev.c:1494
     nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1550
     nsim_drv_probe+0x905/0xc20 drivers/net/netdevsim/dev.c:1711
     call_driver_probe drivers/base/dd.c:-1 [inline]
     really_probe+0x267/0xaf0 drivers/base/dd.c:661
     __driver_probe_device+0x18c/0x320 drivers/base/dd.c:803
     driver_probe_device+0x4f/0x240 drivers/base/dd.c:833
     __device_attach_driver+0x2d4/0x4c0 drivers/base/dd.c:961
     bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
     __device_attach+0x2c5/0x450 drivers/base/dd.c:1033
     device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1088
     bus_probe_device+0x12a/0x220 drivers/base/bus.c:574
     device_add+0x7b6/0xb70 drivers/base/core.c:3689
     nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
     new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
Call trace for netdevsim0[14] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     qdisc_alloc+0x631/0x910 net/sched/sch_generic.c:985
     qdisc_create_dflt+0x8e/0x510 net/sched/sch_generic.c:1008
     attach_one_default_qdisc net/sched/sch_generic.c:1174 [inline]
     netdev_for_each_tx_queue include/linux/netdevice.h:2688 [inline]
     attach_default_qdiscs net/sched/sch_generic.c:1192 [inline]
     dev_activate+0x378/0x1150 net/sched/sch_generic.c:1251
     __dev_open+0x67a/0x830 net/core/dev.c:1704
     __dev_change_flags+0x1f7/0x690 net/core/dev.c:9749
     netif_change_flags+0x88/0x1a0 net/core/dev.c:9812
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[15] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[16] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[17] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
     addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
     addrconf_dev_config net/ipv6/addrconf.c:3484 [inline]
     addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3572
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[18] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
     ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[19] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
     addrconf_add_linklocal+0x20c/0x460 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[20] -6 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:861
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[21] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
     addrconf_add_linklocal+0x266/0x460 net/ipv6/addrconf.c:3313
     addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3447
     addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3745
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     __dev_notify_flags+0x1a9/0x310 net/core/dev.c:9788
     netif_change_flags+0xe8/0x1a0 net/core/dev.c:9817
     do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[22] +5 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[23] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
     mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
     mld_send_cr net/ipv6/mcast.c:2154 [inline]
     mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[24] -17 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dst_destroy+0x117/0x360 net/core/dst.c:115
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[25] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[26] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:670
     addrconf_dad_work+0xac4/0x14c0 net/ipv6/addrconf.c:4287
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[27] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:916
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
     __inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
     inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[28] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     fib_create_info+0x2296/0x31f0 net/ipv4/fib_semantics.c:1493
     fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
     fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
     fib_add_ifaddr+0x144/0x5f0 net/ipv4/fib_frontend.c:1156
     fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
     __inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
     inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[29] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     fib_check_nh_nongw net/ipv4/fib_semantics.c:1263 [inline]
     fib_check_nh+0xd1e/0x1b60 net/ipv4/fib_semantics.c:1283
     fib_create_info+0x2085/0x31f0 net/ipv4/fib_semantics.c:1503
     fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
     fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
     fib_add_ifaddr+0x38d/0x5f0 net/ipv4/fib_frontend.c:1171
     fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
     __inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
     inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[30] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     fib_check_nh_nongw net/ipv4/fib_semantics.c:1263 [inline]
     fib_check_nh+0xd1e/0x1b60 net/ipv4/fib_semantics.c:1283
     fib_create_info+0x2085/0x31f0 net/ipv4/fib_semantics.c:1503
     fib_table_insert+0xc8/0x1b50 net/ipv4/fib_trie.c:1212
     fib_magic+0x434/0x510 net/ipv4/fib_frontend.c:1134
     fib_add_ifaddr+0x3fb/0x5f0 net/ipv4/fib_frontend.c:1178
     fib_inetaddr_event+0x12e/0x190 net/ipv4/fib_frontend.c:1470
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
     __inet_insert_ifa+0x9e9/0xbc0 net/ipv4/devinet.c:566
     inet_rtm_newaddr+0x10d8/0x1ad0 net/ipv4/devinet.c:1001
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[31] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2552
     addrconf_add_dev net/ipv6/addrconf.c:2570 [inline]
     inet6_addr_add+0x2dd/0xb20 net/ipv6/addrconf.c:3032
     inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[32] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4690
     ipv6_add_addr+0x59c/0x1100 net/ipv6/addrconf.c:1126
     inet6_addr_add+0x454/0xb20 net/ipv6/addrconf.c:3050
     inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[33] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     ipv6_add_addr+0xe08/0x1100 net/ipv6/addrconf.c:1186
     inet6_addr_add+0x454/0xb20 net/ipv6/addrconf.c:3050
     inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[34] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     netdev_get_by_index+0x25/0xb0 net/core/dev.c:1018
     fib6_nh_init+0x1f2/0x2010 net/ipv6/route.c:3598
     ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3898
     ip6_route_add+0x6e/0x1b0 net/ipv6/route.c:3950
     addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2488
     inet6_addr_add+0x508/0xb20 net/ipv6/addrconf.c:3053
     inet6_rtm_newaddr+0xa17/0xe30 net/ipv6/addrconf.c:5064
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[35] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
     do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[36] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
     do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[37] -2 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_flush_dev net/core/neighbour.c:433 [inline]
     neigh_changeaddr+0xde/0x130 net/core/neighbour.c:457
     ndisc_netdev_event+0x18f/0x4d0 net/ipv6/ndisc.c:1862
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_set_mac_address+0x39f/0x4e0 net/core/dev.c:9990
     do_setlink+0x9b1/0x4590 net/core/rtnetlink.c:3110
     rtnl_changelink net/core/rtnetlink.c:3776 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
     rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
     rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
     __sock_sendmsg net/socket.c:752 [inline]
     __sys_sendto+0x3ff/0x590 net/socket.c:2221
     __do_sys_sendto net/socket.c:2228 [inline]
     __se_sys_sendto net/socket.c:2224 [inline]
     __x64_sys_sendto+0xde/0x100 net/socket.c:2224
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[38] -6 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
     fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[39] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     ipv6_mc_dad_complete+0x88/0x540 net/ipv6/mcast.c:2279
     addrconf_dad_completed+0x8a7/0xe60 net/ipv6/addrconf.c:4345
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[40] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[41] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_dad_completed+0x909/0xe60 net/ipv6/addrconf.c:4365
     addrconf_dad_work+0xc5e/0x14c0 net/ipv6/addrconf.c:-1
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[42] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     mld_sendpack+0x6ba/0xe40 net/ipv6/mcast.c:1844
     mld_dad_work+0x45/0x5b0 net/ipv6/mcast.c:2294
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
Call trace for netdevsim0[43] +7 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dst_init+0x6f/0x490 net/core/dst.c:52
     dst_alloc+0x12a/0x170 net/core/dst.c:94
     ip6_dst_alloc net/ipv6/route.c:342 [inline]
     icmp6_dst_alloc+0x75/0x440 net/ipv6/route.c:3333
     ndisc_send_skb+0x42d/0x14e0 net/ipv6/ndisc.c:491
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[44] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_index+0x1b3/0x2f0 net/core/dev.c:995
     xfrm_dev_state_add+0x33a/0xc40 net/xfrm/xfrm_device.c:268
     xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
     xfrm_add_sa+0x34ca/0x4230 net/xfrm/xfrm_user.c:1022
     xfrm_user_rcv_msg+0x746/0xb20 net/xfrm/xfrm_user.c:3507
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3529
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[45] -6 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_destroy+0x35c/0x5d0 net/core/neighbour.c:940
     neigh_periodic_work+0xb4f/0xe50 net/core/neighbour.c:1029
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
     process_scheduled_works kernel/workqueue.c:3362 [inline]
     worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
     kthread+0x388/0x470 kernel/kthread.c:467
     ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim0[46] +3 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     ___neigh_create+0xc3d/0x2290 net/core/neighbour.c:664
     ip6_finish_output2+0x1038/0x1360 net/ipv6/ip6_output.c:128
     NF_HOOK_COND include/linux/netfilter.h:307 [inline]
     ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
     NF_HOOK include/linux/netfilter.h:318 [inline]
     ndisc_send_skb+0xbaa/0x14e0 net/ipv6/ndisc.c:512
     addrconf_rs_timer+0x395/0x6d0 net/ipv6/addrconf.c:4042
     call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
     expire_timers kernel/time/timer.c:1799 [inline]
     __run_timers kernel/time/timer.c:2373 [inline]
     __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
     run_timer_base kernel/time/timer.c:2394 [inline]
     run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[47] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     dev_get_by_name+0xdb/0x210 net/core/dev.c:909
     netdev_get_by_name+0x27/0xb0 net/core/dev.c:933
     ethnl_parse_header_dev_get+0x445/0x8b0 net/ethtool/netlink.c:194
     ethnl_default_parse net/ethtool/netlink.c:457 [inline]
     ethnl_default_set_doit+0x224/0xae0 net/ethtool/netlink.c:895
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[48] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     ethnl_parse_header_dev_put net/ethtool/netlink.h:274 [inline]
     ethnl_default_set_doit+0x92e/0xae0 net/ethtool/netlink.c:940
     genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
     netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
     netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
     sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
Call trace for netdevsim0[49] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     linkwatch_add_event net/core/link_watch.c:131 [inline]
     linkwatch_fire_event+0x166/0x220 net/core/link_watch.c:314
     nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:595
     __dev_close_many+0x368/0x6d0 net/core/dev.c:1768
     netif_close_many+0x225/0x420 net/core/dev.c:1793
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[50] +2 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:930
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
     addrconf_ifdown+0xeb3/0x1a40 net/ipv6/addrconf.c:3983
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     netif_close_many+0x2ae/0x420 net/core/dev.c:1797
     netif_close_many_and_unlock net/core/dev.c:12317 [inline]
     unregister_netdevice_many_notify+0x81f/0x2380 net/core/dev.c:12381
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
Call trace for netdevsim0[51] -3 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
     fib_nh_release net/ipv4/fib_semantics.c:218 [inline]
     free_fib_info_rcu+0xdf/0x310 net/ipv4/fib_semantics.c:230
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[52] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     __qdisc_destroy+0x1c9/0x450 net/sched/sch_generic.c:1081
     qdisc_put net/sched/sch_generic.c:1105 [inline]
     dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
     unregister_netdevice_many_notify+0x11a9/0x2380 net/core/dev.c:12405
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[53] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:698 [inline]
     netdevice_event+0x4ea/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[54] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:699 [inline]
     netdevice_event+0x593/0x8d0 drivers/infiniband/core/roce_gid_mgmt.c:849
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[55] +1 at
     __dev_hold include/linux/netdevice.h:4403 [inline]
     netdev_hold include/linux/netdevice.h:4446 [inline]
     dev_hold include/linux/netdevice.h:4469 [inline]
     addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:897
     inetaddr_event+0xef/0x150 drivers/infiniband/core/roce_gid_mgmt.c:916
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
     __inet_del_ifa+0x840/0xfe0 net/ipv4/devinet.c:450
     inet_del_ifa net/ipv4/devinet.c:487 [inline]
     inetdev_destroy net/ipv4/devinet.c:328 [inline]
     inetdev_event+0x647/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
Call trace for netdevsim0[56] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     inetdev_destroy net/ipv4/devinet.c:335 [inline]
     inetdev_event+0x7f4/0x1610 net/ipv4/devinet.c:1655
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[57] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     neigh_parms_release+0x170/0x200 net/core/neighbour.c:1817
     addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[58] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     batadv_hardif_release net/batman-adv/hard-interface.c:55 [inline]
     kref_put include/linux/kref.h:65 [inline]
     batadv_hardif_put+0x8f/0x140 net/batman-adv/hard-interface.h:94
     batadv_hard_if_event+0x624/0x1240 net/batman-adv/hard-interface.c:1008
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[59] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:273
     in6_dev_put include/net/addrconf.h:422 [inline]
     ip6_dst_ifdown+0xed/0x220 net/ipv6/route.c:384
     dst_dev_put+0xab/0x2d0 net/core/dst.c:151
     fib6_nh_release_dsts net/ipv6/route.c:3740 [inline]
     fib6_nh_release+0x36c/0x430 net/ipv6/route.c:3721
     fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[60] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     dev_put include/linux/netdevice.h:4481 [inline]
     udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
     udp_tunnel_nic_netdevice_event+0x1582/0x17e0 net/ipv4/udp_tunnel_nic.c:942
     notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
     call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
     call_netdevice_notifiers net/core/dev.c:2295 [inline]
     unregister_netdevice_many_notify+0x186a/0x2380 net/core/dev.c:12417
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[61] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     rx_queue_release+0x126/0x1a0 net/core/net-sysfs.c:1181
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     net_rx_queue_update_kobjects+0x6a6/0x750 net/core/net-sysfs.c:1338
     remove_queue_kobjects net/core/net-sysfs.c:2169 [inline]
     netdev_unregister_kobject+0x113/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[62] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1931
     kobject_cleanup lib/kobject.c:689 [inline]
     kobject_release lib/kobject.c:720 [inline]
     kref_put include/linux/kref.h:65 [inline]
     kobject_put+0x228/0x560 lib/kobject.c:737
     netdev_queue_update_kobjects+0x5e8/0x6d0 net/core/net-sysfs.c:2073
     remove_queue_kobjects net/core/net-sysfs.c:2170 [inline]
     netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2325
     unregister_netdevice_many_notify+0x1e0e/0x2380 net/core/dev.c:12452
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[63] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
     in_dev_put include/linux/inetdevice.h:290 [inline]
     inet_rcu_free_ifa+0x72/0xb0 net/ipv4/devinet.c:228
     rcu_do_batch kernel/rcu/tree.c:2617 [inline]
     rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
     handle_softirqs+0x22a/0x870 kernel/softirq.c:626
Call trace for netdevsim0[64] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     netdev_put include/linux/netdevice.h:4456 [inline]
     unregister_netdevice_many_notify+0x2068/0x2380 net/core/dev.c:12462
     unregister_netdevice_many net/core/dev.c:12480 [inline]
     unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12294
     unregister_netdevice include/linux/netdevice.h:3414 [inline]
     nsim_destroy+0x1e5/0x680 drivers/net/netdevsim/netdev.c:1183
     __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
     nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
     nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
     nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
     device_remove drivers/base/dd.c:571 [inline]
     __device_release_driver drivers/base/dd.c:1284 [inline]
     device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
     bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
     device_del+0x527/0x8f0 drivers/base/core.c:3878
     device_unregister+0x21/0xf0 drivers/base/core.c:3919
     nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
     del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
     kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
     new_sync_write fs/read_write.c:595 [inline]
     vfs_write+0x61d/0xb90 fs/read_write.c:688
     ksys_write+0x150/0x270 fs/read_write.c:740
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim0[65] -1 at
     __dev_put include/linux/netdevice.h:4389 [inline]
     linkwatch_do_dev+0x89/0x180 net/core/link_watch.c:191
     __linkwatch_run_queue+0x572/0x7f0 net/core/link_watch.c:244
     linkwatch_event+0x4c/0x60 net/core/link_watch.c:304
     process_one_work+0x949/0x1650 kernel/workqueue.c:3279
balance as of netdevsim0[65] is 1
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1284 [inline]
 device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
 bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
 device_del+0x527/0x8f0 drivers/base/core.c:3878
 device_unregister+0x21/0xf0 drivers/base/core.c:3919
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
 del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
 kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61d/0xb90 fs/read_write.c:688
 ksys_write+0x150/0x270 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1284 [inline]
 device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
 bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
 device_del+0x527/0x8f0 drivers/base/core.c:3878
 device_unregister+0x21/0xf0 drivers/base/core.c:3919
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
 del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
 kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61d/0xb90 fs/read_write.c:688
 ksys_write+0x150/0x270 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
 </TASK>
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1284 [inline]
 device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
 bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
 device_del+0x527/0x8f0 drivers/base/core.c:3878
 device_unregister+0x21/0xf0 drivers/base/core.c:3919
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
 del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
 kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61d/0xb90 fs/read_write.c:688
 ksys_write+0x150/0x270 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
 </TASK>

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/02/04 19:15, Tetsuo Handa wrote:
> On 2026/02/04 7:40, Paul Moore wrote:
>>         This is not an unusual request for such a proposed change, and
>> is something that I would expect a LSM maintainer to do without much
>> hesitation.  If you are unwilling to investigate this, can you explain
>> why?
> 
> Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.
> 
> I can't judge whether the current code is COMPREHENSIVELY GATING;
> I can't imagine what the state you call COMPREHENSIVELY GATING is.

Steffen Klassert worried that killing xfrm_dev_state_flush_secctx_check() and
xfrm_dev_policy_flush_secctx_check() might violate a LSM policy and you agreed
( https://lkml.kernel.org/r/CAHC9VhQ54LRD7k_x6tUju2kPVBEHcdgBh46_hBN8btG0vhfy_w@mail.gmail.com ),
but the reality is that nobody in the world has enforced an LSM policy for almost 9 years
that makes xfrm_dev_{state,policy}_flush() no-op. That is, xfrm_dev_state_flush_secctx_check()
and xfrm_dev_policy_flush_secctx_check() had been effectively unused.

Killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check()
increases "system's stability" without sacrificing "authorization".

It is up to SELinux developers to discuss what actions to take as a compensation for
killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check().
The compensation might be to add LSM hooks to immediately before the point of no return.
But I wonder why you want to authorize deleting resources which are going to be "deleted by
cascade" due to deleting a dependent resource...

> 
> 
> 
> P.S. For your investigation, I attach a new report that syzbot found today, and
> I'll drop "xfrm: always fail xfrm_dev_{state,policy}_flush_secctx_check()"
> because these three reports will be sufficient for people to understand that
> we need to kill xfrm_dev_{state,policy}_flush_secctx_check() calls.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Steffen Klassert]

On Wed, Feb 04, 2026 at 10:57:30PM +0900, Tetsuo Handa wrote:
> On 2026/02/04 19:15, Tetsuo Handa wrote:
> > On 2026/02/04 7:40, Paul Moore wrote:
> >>         This is not an unusual request for such a proposed change, and
> >> is something that I would expect a LSM maintainer to do without much
> >> hesitation.  If you are unwilling to investigate this, can you explain
> >> why?
> > 
> > Because I'm not familiar with how XFRM works; I'm not a user of LSM XFRM hooks.
> > 
> > I can't judge whether the current code is COMPREHENSIVELY GATING;
> > I can't imagine what the state you call COMPREHENSIVELY GATING is.
> 
> Steffen Klassert worried that killing xfrm_dev_state_flush_secctx_check() and
> xfrm_dev_policy_flush_secctx_check() might violate a LSM policy and you agreed
> ( https://lkml.kernel.org/r/CAHC9VhQ54LRD7k_x6tUju2kPVBEHcdgBh46_hBN8btG0vhfy_w@mail.gmail.com ),
> but the reality is that nobody in the world has enforced an LSM policy for almost 9 years
> that makes xfrm_dev_{state,policy}_flush() no-op. That is, xfrm_dev_state_flush_secctx_check()
> and xfrm_dev_policy_flush_secctx_check() had been effectively unused.
> 
> Killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check()
> increases "system's stability" without sacrificing "authorization".
> 
> It is up to SELinux developers to discuss what actions to take as a compensation for
> killing xfrm_dev_state_flush_secctx_check() and xfrm_dev_policy_flush_secctx_check().
> The compensation might be to add LSM hooks to immediately before the point of no return.

The problem is that, with adding IPsec offloads to netdevices, security
critical resources came into the netdevices. Someone who has no
capabilities to delete xfrm states or xfrm policies should not be able
to unregister the netdevice if xfrm states or xfrm policies are
offloaded. Unfortunately, unregistering can't be canceled at this stage
anymore. So I think we need some netdevice unregistration hook for
the LSM subsystem so it can check for xfrm states or xfrm policies
and refuse the unregistration before we actually start to remove
the device.

The same happened btw. when xfrm was made per network namespace.
Here we just leak the xfrm states and xfrm policies if some
LSM refuses to remove them.

I guess we need a solution for both cases.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/02/09 18:25, Steffen Klassert wrote:
> The problem is that, with adding IPsec offloads to netdevices, security
> critical resources came into the netdevices. Someone who has no
> capabilities to delete xfrm states or xfrm policies should not be able
> to unregister the netdevice if xfrm states or xfrm policies are
> offloaded. Unfortunately, unregistering can't be canceled at this stage
> anymore. So I think we need some netdevice unregistration hook for
> the LSM subsystem so it can check for xfrm states or xfrm policies
> and refuse the unregistration before we actually start to remove
> the device.

Unfortunately, unregistering is not always triggered by a user's request. ;-)

For example, we don't check permission for unmount when a mount is deleted
due to teardown of a mount namespace. I wonder why you want to check permission
for unregistering a net_device when triggered by a teardown path.

> 
> The same happened btw. when xfrm was made per network namespace.
> Here we just leak the xfrm states and xfrm policies if some
> LSM refuses to remove them.
> 
> I guess we need a solution for both cases.

Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
If no, there is no choice but break SELinux's expectation.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Steffen Klassert]

On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> On 2026/02/09 18:25, Steffen Klassert wrote:
> > The problem is that, with adding IPsec offloads to netdevices, security
> > critical resources came into the netdevices. Someone who has no
> > capabilities to delete xfrm states or xfrm policies should not be able
> > to unregister the netdevice if xfrm states or xfrm policies are
> > offloaded. Unfortunately, unregistering can't be canceled at this stage
> > anymore. So I think we need some netdevice unregistration hook for
> > the LSM subsystem so it can check for xfrm states or xfrm policies
> > and refuse the unregistration before we actually start to remove
> > the device.
> 
> Unfortunately, unregistering is not always triggered by a user's request. ;-)

As far as I remember, a security context is not always tied to a
user request. It can also be attached to system tasks or objects.

> For example, we don't check permission for unmount when a mount is deleted
> due to teardown of a mount namespace. I wonder why you want to check permission
> for unregistering a net_device when triggered by a teardown path.

I just try to find out what's the right thing to do here.
If a policy goes away, packets that match this policy will
find another path through the network stack. As best, they
are dropped somewhere, but they can also leave on some other
device without encryption. A LSM that implements xfrm hooks
must be able to check the permission to delete the xfrm policy
or state.

> 
> > 
> > The same happened btw. when xfrm was made per network namespace.
> > Here we just leak the xfrm states and xfrm policies if some
> > LSM refuses to remove them.
> > 
> > I guess we need a solution for both cases.
> 
> Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
> ( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
> If no, there is no choice but break SELinux's expectation.

That could be an option to not accidentally send out
unencrypted packets. But finding the right place for
these checks would be preferable IMO.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/02/09 20:22, Steffen Klassert wrote:
> On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
>> On 2026/02/09 18:25, Steffen Klassert wrote:
>>> The problem is that, with adding IPsec offloads to netdevices, security
>>> critical resources came into the netdevices. Someone who has no
>>> capabilities to delete xfrm states or xfrm policies should not be able
>>> to unregister the netdevice if xfrm states or xfrm policies are
>>> offloaded. Unfortunately, unregistering can't be canceled at this stage
>>> anymore. So I think we need some netdevice unregistration hook for
>>> the LSM subsystem so it can check for xfrm states or xfrm policies
>>> and refuse the unregistration before we actually start to remove
>>> the device.
>>
>> Unfortunately, unregistering is not always triggered by a user's request. ;-)
> 
> As far as I remember, a security context is not always tied to a
> user request. It can also be attached to system tasks or objects.

That is not what I wanted to say. There are at least three routes (listed below)
that can trigger xfrm_dev_unregister() path. You could insert LSM hooks into the
netlink_sendmsg() route and the del_device_store() route, but the cleanup_net()
route is a result of tear-down action which is too late to insert LSM hooks.

The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
(i.e. implicit cleanup of a network namespace due to termination of init process in
that namespace). We are not allowed to reject the cleanup_net() route.

----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 16195 Comm: syz.3.3878 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_nl_reload_doit+0xaaa/0xc80 net/devlink/dev.c:584
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
 __sock_sendmsg net/socket.c:752 [inline]
 ____sys_sendmsg+0x589/0x8c0 net/socket.c:2610
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2664
 __sys_sendmsg net/socket.c:2696 [inline]
 __do_sys_sendmsg net/socket.c:2701 [inline]
 __se_sys_sendmsg net/socket.c:2699 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2699
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7feb10f9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007feb11efc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007feb11215fa0 RCX: 00007feb10f9aeb9
RDX: 0000000006048800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007feb11008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007feb11216038 R14: 00007feb11215fa0 R15: 00007ffdd0b07b18
 </TASK>
----------

----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 1 UID: 0 PID: 11340 Comm: kworker/u8:17 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------

----------
xfrm_dev_state_flush_secctx_check: LSM policy is rejecting this operation.
CPU: 0 UID: 0 PID: 18368 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 xfrm_dev_state_flush_secctx_check net/xfrm/xfrm_state.c:900 [inline]
 xfrm_dev_state_flush+0x5fa/0x740 net/xfrm/xfrm_state.c:971
 xfrm_dev_unregister net/xfrm/xfrm_device.c:549 [inline]
 xfrm_dev_event+0x1bc/0x3f0 net/xfrm/xfrm_device.c:570
 notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
 call_netdevice_notifiers net/core/dev.c:2295 [inline]
 netdev_wait_allrefs_any net/core/dev.c:11589 [inline]
 netdev_run_todo+0x778/0x1130 net/core/dev.c:11710
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1190
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_drv_remove+0x58/0x170 drivers/net/netdevsim/dev.c:1780
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1284 [inline]
 device_release_driver_internal+0x46f/0x860 drivers/base/dd.c:1307
 bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
 device_del+0x527/0x8f0 drivers/base/core.c:3878
 device_unregister+0x21/0xf0 drivers/base/core.c:3919
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:491 [inline]
 del_device_store+0x2b0/0x370 drivers/net/netdevsim/bus.c:244
 kernfs_fop_write_iter+0x3af/0x540 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61d/0xb90 fs/read_write.c:688
 ksys_write+0x150/0x270 fs/read_write.c:740
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd13375b78e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc52b936a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555567157500 RCX: 00007fd13375b78e
RDX: 0000000000000001 RSI: 00007ffc52b93730 RDI: 0000000000000005
RBP: 00007fd133808a88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc52b93730 R14: 00007fd134544620 R15: 0000000000000003
 </TASK>
----------



> 
>> For example, we don't check permission for unmount when a mount is deleted
>> due to teardown of a mount namespace. I wonder why you want to check permission
>> for unregistering a net_device when triggered by a teardown path.
> 
> I just try to find out what's the right thing to do here.
> If a policy goes away, packets that match this policy will
> find another path through the network stack. As best, they
> are dropped somewhere, but they can also leave on some other
> device without encryption. A LSM that implements xfrm hooks
> must be able to check the permission to delete the xfrm policy
> or state.

Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
result in network traffic to be sent in cleartext ?

If yes, we need to consider updating the other patch at
https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
but instead updates that state/policy to behave as a blackhole. Then,
we won't need to call LSM hooks because we no longer delete).

Also, we need to consider changing xfrm_dev_down() to no-op, for just doing
e.g. "ip link set ens160 down; ip link set ens160 up" (which triggers
NETDEV_DOWN event and NETDEV_UP event) might result in network traffic
to be sent in cleartext because currently xfrm_dev_down() can delete a
state/policy. Such behavior might not what the administrator is expecting.



> 
>>
>>>
>>> The same happened btw. when xfrm was made per network namespace.
>>> Here we just leak the xfrm states and xfrm policies if some
>>> LSM refuses to remove them.
>>>
>>> I guess we need a solution for both cases.
>>
>> Is replacing the NETDEV_UNREGISTER net_device with the blackhole_netdev applicable
>> ( https://elixir.bootlin.com/linux/v6.19-rc5/source/net/xfrm/xfrm_policy.c#L3948 ) ?
>> If no, there is no choice but break SELinux's expectation.
> 
> That could be an option to not accidentally send out
> unencrypted packets. But finding the right place for
> these checks would be preferable IMO.

Can we have such giant lock if you found the right place for these checks
( https://lkml.kernel.org/r/f9b88268-03dc-4356-8b31-0bab73cc9b1e@I-love.SAKURA.ne.jp ) ?

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Steffen Klassert]

On Mon, Feb 09, 2026 at 11:26:14PM +0900, Tetsuo Handa wrote:
> On 2026/02/09 20:22, Steffen Klassert wrote:
> > On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> >> On 2026/02/09 18:25, Steffen Klassert wrote:
> >>> The problem is that, with adding IPsec offloads to netdevices, security
> >>> critical resources came into the netdevices. Someone who has no
> >>> capabilities to delete xfrm states or xfrm policies should not be able
> >>> to unregister the netdevice if xfrm states or xfrm policies are
> >>> offloaded. Unfortunately, unregistering can't be canceled at this stage
> >>> anymore. So I think we need some netdevice unregistration hook for
> >>> the LSM subsystem so it can check for xfrm states or xfrm policies
> >>> and refuse the unregistration before we actually start to remove
> >>> the device.
> >>
> >> Unfortunately, unregistering is not always triggered by a user's request. ;-)
> > 
> > As far as I remember, a security context is not always tied to a
> > user request. It can also be attached to system tasks or objects.
> 
> That is not what I wanted to say. There are at least three routes (listed below)
> that can trigger xfrm_dev_unregister() path. You could insert LSM hooks into the
> netlink_sendmsg() route and the del_device_store() route, but the cleanup_net()
> route is a result of tear-down action which is too late to insert LSM hooks.

Yes, I know that.

> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
> (i.e. implicit cleanup of a network namespace due to termination of init process in
> that namespace). We are not allowed to reject the cleanup_net() route.

And here we come to the other problem I mentioned. When a LSM policy
rejects to flush the xfrm states and policies on network namespace
exit, we leak all the xfrm states and policies in that namespace.
Here we have no other option, we must flush the xfrm states and
policies regardless of any LSM policy. This can be fixed with
something like that:

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 72678053bd69..8a4b2cbba0e0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1822,9 +1822,11 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
 
 	spin_lock_bh(&net->xfrm.xfrm_policy_lock);
 
-	err = xfrm_policy_flush_secctx_check(net, type, task_valid);
-	if (err)
-		goto out;
+	if (task_valid) {
+		err = xfrm_policy_flush_secctx_check(net, type, task_valid);
+		if (err)
+			goto out;
+	}
 
 again:
 	list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f2aef404b583..fd00f2d20425 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -923,9 +923,11 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
 	int i, err = 0, cnt = 0;
 
 	spin_lock_bh(&net->xfrm.xfrm_state_lock);
-	err = xfrm_state_flush_secctx_check(net, proto, task_valid);
-	if (err)
-		goto out;
+	if (task_valid) {
+		err = xfrm_state_flush_secctx_check(net, proto, task_valid);
+		if (err)
+			goto out;
+	}
 
 	err = -ESRCH;
 	for (i = 0; i <= net->xfrm.state_hmask; i++) {

> > 
> >> For example, we don't check permission for unmount when a mount is deleted
> >> due to teardown of a mount namespace. I wonder why you want to check permission
> >> for unregistering a net_device when triggered by a teardown path.
> > 
> > I just try to find out what's the right thing to do here.
> > If a policy goes away, packets that match this policy will
> > find another path through the network stack. As best, they
> > are dropped somewhere, but they can also leave on some other
> > device without encryption. A LSM that implements xfrm hooks
> > must be able to check the permission to delete the xfrm policy
> > or state.
> 
> Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
> result in network traffic to be sent in cleartext ?

Yes this can happen, but it is known. You can either install
a global block policy with low priority or use a LSM to
prevent this. The latter does not work unfortunately.

> 
> If yes, we need to consider updating the other patch at
> https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
> the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
> xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
> but instead updates that state/policy to behave as a blackhole. Then,
> we won't need to call LSM hooks because we no longer delete).

I think there is a clean way to fix this. We could just unlink
policy and state from the device. Then we could do the same as
we do when a state becomes unavailable due to expiration. We mark
the state as invalid with a flag. On expiration we do this with
XFRM_STATE_EXPIRED. We can add a new flag and do the same as
xfrm_state_check_expire() does on a hard expire. I.e. fire
a timer that notifies the userspace key manager that this
path is not avalable anymore and return an error. This way
userspace is informed about that and all packets matching
the policy are dropped.

This is of course a bit more work and requires testing.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Tetsuo Handa]

On 2026/02/13 19:19, Steffen Klassert wrote:
On 2026/02/13 19:19, Steffen Klassert wrote:
>> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
>> (i.e. implicit cleanup of a network namespace due to termination of init process in
>> that namespace). We are not allowed to reject the cleanup_net() route.
> 
> And here we come to the other problem I mentioned. When a LSM policy
> rejects to flush the xfrm states and policies on network namespace
> exit, we leak all the xfrm states and policies in that namespace.
> Here we have no other option, we must flush the xfrm states and
> policies regardless of any LSM policy. This can be fixed with
> something like that:

This something is what I explained at
https://lkml.kernel.org/r/1bb453af-3ef2-4ab6-a909-0705bd07c136@I-love.SAKURA.ne.jp .
The "task_valid" argument does not always reflect whether LSM policy can reject or not.

Anyway, the patch to add xfrm_dev_unregister(dev) seems OK if we do like
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4 ?

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Steffen Klassert]

On Fri, Feb 13, 2026 at 10:59:15PM +0900, Tetsuo Handa wrote:
> On 2026/02/13 19:19, Steffen Klassert wrote:
> On 2026/02/13 19:19, Steffen Klassert wrote:
> >> The NETDEV_UNREGISTER path can be triggered by just doing "unshare -n ip addr show"
> >> (i.e. implicit cleanup of a network namespace due to termination of init process in
> >> that namespace). We are not allowed to reject the cleanup_net() route.
> > 
> > And here we come to the other problem I mentioned. When a LSM policy
> > rejects to flush the xfrm states and policies on network namespace
> > exit, we leak all the xfrm states and policies in that namespace.
> > Here we have no other option, we must flush the xfrm states and
> > policies regardless of any LSM policy. This can be fixed with
> > something like that:
> 
> This something is what I explained at
> https://lkml.kernel.org/r/1bb453af-3ef2-4ab6-a909-0705bd07c136@I-love.SAKURA.ne.jp .
> The "task_valid" argument does not always reflect whether LSM policy can reject or not.

That was to fix the memleak on network namespace exit.
The task_valid check should be ok for xfrm_policy_flush()
and xfrm_state_flush().

> 
> Anyway, the patch to add xfrm_dev_unregister(dev) seems OK if we do like
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit?h=next-20260123&id=fc0f090e41e652d158f946c616cdd82baed3c8f4 ?

That would be OK as a first fix. Later we should
just unlink policies and states from the device,
as explained in my last mail.

Re: [PATCH] xfrm: kill xfrm_dev_{state,policy}_flush_secctx_check()

[Paul Moore]

On Fri, Feb 13, 2026 at 5:19 AM Steffen Klassert
<steffen.klassert@secunet.com> wrote:
> On Mon, Feb 09, 2026 at 11:26:14PM +0900, Tetsuo Handa wrote:
> > On 2026/02/09 20:22, Steffen Klassert wrote:
> > > On Mon, Feb 09, 2026 at 07:02:47PM +0900, Tetsuo Handa wrote:
> > >> On 2026/02/09 18:25, Steffen Klassert wrote:

...

> And here we come to the other problem I mentioned. When a LSM policy
> rejects to flush the xfrm states and policies on network namespace
> exit, we leak all the xfrm states and policies in that namespace.
> Here we have no other option, we must flush the xfrm states and
> policies regardless of any LSM policy. This can be fixed with
> something like that:
>
> diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
> index 72678053bd69..8a4b2cbba0e0 100644
> --- a/net/xfrm/xfrm_policy.c
> +++ b/net/xfrm/xfrm_policy.c
> @@ -1822,9 +1822,11 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
>
>         spin_lock_bh(&net->xfrm.xfrm_policy_lock);
>
> -       err = xfrm_policy_flush_secctx_check(net, type, task_valid);
> -       if (err)
> -               goto out;
> +       if (task_valid) {
> +               err = xfrm_policy_flush_secctx_check(net, type, task_valid);
> +               if (err)
> +                       goto out;
> +       }
>
>  again:
>         list_for_each_entry(pol, &net->xfrm.policy_all, walk.all) {
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index f2aef404b583..fd00f2d20425 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -923,9 +923,11 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
>         int i, err = 0, cnt = 0;
>
>         spin_lock_bh(&net->xfrm.xfrm_state_lock);
> -       err = xfrm_state_flush_secctx_check(net, proto, task_valid);
> -       if (err)
> -               goto out;
> +       if (task_valid) {
> +               err = xfrm_state_flush_secctx_check(net, proto, task_valid);
> +               if (err)
> +                       goto out;
> +       }
>
>         err = -ESRCH;
>         for (i = 0; i <= net->xfrm.state_hmask; i++) {

This seems reasonable to me, and please correct me if I'm wrong, but
if the network namespace is gone at this point, we don't really have
to worry about traffic from any applications because there should no
longer be any processes in that namespace, yes?  I suppose there is
still a chance we'll see inbound traffic for endpoints in that
namespace, but I imagine the initns stack will reject it.

> > >> For example, we don't check permission for unmount when a mount is deleted
> > >> due to teardown of a mount namespace. I wonder why you want to check permission
> > >> for unregistering a net_device when triggered by a teardown path.
> > >
> > > I just try to find out what's the right thing to do here.
> > > If a policy goes away, packets that match this policy will
> > > find another path through the network stack. As best, they
> > > are dropped somewhere, but they can also leave on some other
> > > device without encryption. A LSM that implements xfrm hooks
> > > must be able to check the permission to delete the xfrm policy
> > > or state.
> >
> > Do you mean that calling xfrm_dev_down()/xfrm_dev_unregister() might
> > result in network traffic to be sent in cleartext ?
>
> Yes this can happen, but it is known. You can either install
> a global block policy with low priority or use a LSM to
> prevent this. The latter does not work unfortunately.

If I understand you correctly, the proposal below would address this
last part, yes?

> > If yes, we need to consider updating the other patch at
> > https://lkml.kernel.org/r/20260202123655.GK34749@unreal to replace
> > the NETDEV_UNREGISTER net_device with the blackhole_netdev. (That is,
> > xfrm_dev_{state,policy}_flush() does not actually delete a state/policy
> > but instead updates that state/policy to behave as a blackhole. Then,
> > we won't need to call LSM hooks because we no longer delete).
>
> I think there is a clean way to fix this. We could just unlink
> policy and state from the device. Then we could do the same as
> we do when a state becomes unavailable due to expiration. We mark
> the state as invalid with a flag. On expiration we do this with
> XFRM_STATE_EXPIRED. We can add a new flag and do the same as
> xfrm_state_check_expire() does on a hard expire. I.e. fire
> a timer that notifies the userspace key manager that this
> path is not avalable anymore and return an error. This way
> userspace is informed about that and all packets matching
> the policy are dropped.

This looks interesting.  The traffic would be dropped, and presumably
userspace could then cleanup the old state and establish any new
policy as required, yes?

> This is of course a bit more work and requires testing.

Tetsuo, Steffen, any chance one of the two of you would be able to
work on some patches for this?

-- 
paul-moore.com