netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] CPU: 1 PID: 1092 Comm: kworker/u32:8 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x150/0x4f0 net/ipv6/ip6_fib.c:987 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 2e 03 00 00 4d 8b 3f 4d 85 ff 74 31 e8 8e 8b 03 f8 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 57 03 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc90006dd7070 EFLAGS: 00010206 RAX: 0000000000000018 RBX: 0000000000000000 RCX: ffffffff898b03b4 RDX: ffff8880194fa440 RSI: ffffffff898b0442 RDI: 00000000000000c1 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000000 R11: 0000000000000006 R12: ffff888056929cb8 R13: fffffbfff1a92e7d R14: ffffed100ad253a2 R15: 0000000000000031 FS: 0000000000000000(0000) GS:ffff88802c100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000eea76000 CR3: 000000000d97a000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1030 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1031 [inline] fib6_purge_rt+0x7ef/0x9f0 net/ipv6/ip6_fib.c:1042 fib6_del_route net/ipv6/ip6_fib.c:2002 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2047 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2209 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2131 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2179 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2259 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2275 rt6_sync_down_dev net/ipv6/route.c:4908 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4913 addrconf_ifdown.isra.0+0x117/0x1a70 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11194 unregister_netdevice_many net/core/dev.c:11277 [inline] default_device_exit_batch+0x731/0x9b0 net/core/dev.c:11760 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__fib6_drop_pcpu_from.part.0+0x150/0x4f0 net/ipv6/ip6_fib.c:987 Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 2e 03 00 00 4d 8b 3f 4d 85 ff 74 31 e8 8e 8b 03 f8 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 57 03 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48 RSP: 0018:ffffc90006dd7070 EFLAGS: 00010206 RAX: 0000000000000018 RBX: 0000000000000000 RCX: ffffffff898b03b4 RDX: ffff8880194fa440 RSI: ffffffff898b0442 RDI: 00000000000000c1 RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000000 R11: 0000000000000006 R12: ffff888056929cb8 R13: fffffbfff1a92e7d R14: ffffed100ad253a2 R15: 0000000000000031 FS: 0000000000000000(0000) GS:ffff88802c100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000eea76000 CR3: 000000000d97a000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f8 clc 1: 48 c1 e8 03 shr $0x3,%rax 5: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 9: 0f 85 2e 03 00 00 jne 0x33d f: 4d 8b 3f mov (%r15),%r15 12: 4d 85 ff test %r15,%r15 15: 74 31 je 0x48 17: e8 8e 8b 03 f8 call 0xf8038baa 1c: 49 8d bf 90 00 00 00 lea 0x90(%r15),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction 2e: 0f 85 57 03 00 00 jne 0x38b 34: 49 8b 87 90 00 00 00 mov 0x90(%r15),%rax 3b: 48 8b 0c 24 mov (%rsp),%rcx 3f: 48 rex.W