veth0_vlan: left promiscuous mode non-slab/vmalloc memory list_del corruption. prev->next should be 85524300, but was 00000000. (prev=82c1713c) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:62! Internal error: Oops - BUG: 0 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 2942 Comm: kworker/u8:2 Not tainted 6.15.0-syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Workqueue: netns cleanup_net PC is at __list_del_entry_valid_or_report+0xb0/0x108 lib/list_debug.c:62 LR is at __wake_up_klogd.part.0+0x7c/0xac kernel/printk/printk.c:4556 pc : [<808cd858>] lr : [<802e2a48>] psr: 60060013 sp : ec749ab8 ip : ec749a00 fp : ec749ad4 r10: 00000000 r9 : 85524308 r8 : 848b924c r7 : 85524300 r6 : 00000000 r5 : 82c1713c r4 : 848b924c r3 : 8415b000 r2 : 00000000 r1 : 00000000 r0 : 00000055 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85859380 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: slab task_struct start 8415b000 pointer offset 0 size 3072 Register r4 information: slab kmalloc-cg-2k start 848b9000 pointer offset 588 size 2048 Register r5 information: non-slab/vmalloc memory Register r6 information: NULL pointer Register r7 information: slab kmalloc-128 start 85524300 pointer offset 0 size 128 Register r8 information: slab kmalloc-cg-2k start 848b9000 pointer offset 588 size 2048 Register r9 information: slab kmalloc-128 start 85524300 pointer offset 8 size 128 Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xec748000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2859 Register r12 information: 2-page vmalloc region starting at 0xec748000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2859 Process kworker/u8:2 (pid: 2942, stack limit = 0xec748000) Stack: (0xec749ab8 to 0xec74a000) 9aa0: 85524300 848b924c 9ac0: 00000001 00000004 ec749aec ec749ad8 8156503c 808cd7b4 ec749b54 00000006 9ae0: ec749b24 ec749af0 81565140 81564fc4 ec749b24 00000000 ec749b54 848b9000 9b00: ec749b54 848b9238 00000100 80000010 855e13e4 00000000 ec749b4c ec749b28 9b20: 81565c48 815650a4 00000000 00000000 81a6a874 85524100 848b9000 84abd530 9b40: ec749b94 ec749b50 81843008 81565c08 8027d25c 00003333 00000100 00000000 9b60: 00000000 00000000 00000000 00000000 00000000 3ae85dc3 00000000 85524100 9b80: 84abd400 84abd530 ec749bb4 ec749b98 81845ef0 81842f04 84abd400 00000000 9ba0: 84abd400 00000100 ec749c24 ec749bb8 818137f4 81845ecc 00000000 00000201 9bc0: 81a6a950 00000000 80000010 84b08dc0 848b9000 84abd548 ec749bd8 ec749bd8 9be0: 80795e54 ec749c74 ec749c58 8029652c 80795e54 3ae85dc3 00000000 848b9000 9c00: 84abd400 84b08dc0 00000002 818198c4 00000000 ec749cfc ec749c74 ec749c28 9c20: 8181995c 818130a4 ec749c74 ec749c38 8167e620 80304e8c ec749c74 ec749c48 9c40: 816f7660 3ae85dc3 81c00000 829e5124 829e42cc ffffffd1 00000000 818198c4 9c60: 00000000 ec749cfc ec749cac ec749c78 80289e30 818198d0 8415b000 00000002 9c80: 00000cc0 ec749cfc 00000002 84b08dc0 00000001 848b9000 00000000 82421da0 9ca0: ec749cc4 ec749cb0 8028a068 80289ddc 00000000 802d2004 ec749cec ec749cc8 9cc0: 81556a5c 8028a054 00000000 00000000 00000000 848b9114 850ed800 ec749d70 9ce0: ec749d2c ec749cf0 8155706c 81556a14 00000000 00000000 00000000 848b9000 9d00: 00000000 3ae85dc3 ec749ce4 85768114 849c3114 ec749df0 ec749d70 00000001 9d20: ec749dc4 ec749d30 81562034 81556f7c 00000001 ec749e78 ec749d8c ec749d48 9d40: 8050154c 80500f00 00000001 819e8c9c 829d1924 00000000 00000000 00000000 9d60: 8415b000 82422a28 81562a98 808cd6dc 848b9114 849c3114 ec749df0 849c3000 9d80: ec749dc4 ec749d90 81562a98 808cd6dc 00000000 3ae85dc3 ec749dc4 84b08dbc 9da0: 84b08eb8 ec749e78 82c1e840 ec749e98 00000001 ec749e78 ec749e3c ec749dc8 9dc0: 8156376c 81561e58 ec749de4 ec749dd8 81a6a780 ec749e98 84b08dc0 82422ae4 9de0: 81a5d244 81a6a760 84b08dbc 61c88647 84b9c90c 849c310c 81234f14 00000000 9e00: 00000000 00000000 00000000 3ae85dc3 ec749e3c ec749e98 ec749e78 829d1380 9e20: 829d198c 829d1380 00000001 00000001 ec749e7c ec749e40 815449f8 81563474 9e40: 00000100 00000122 ec749e6c 3ae85dc3 80262bf4 84b08de0 82c1e800 829d1280 9e60: 829d12a8 84b09b80 ffffffd4 00000000 ec749ed4 ec749e80 81546d10 815448f8 9e80: ec749ed4 ec749e90 808ce900 82c1e800 829d1280 81544888 84b08de0 84b08de0 9ea0: 00000000 3ae85dc3 81c01f24 842fe200 829d1298 8301bc00 8300e600 8415b000 9ec0: 8301bc15 8300f070 ec749f2c ec749ed8 8027eb9c 81546b10 81c01ac0 8415b000 9ee0: ec749f14 ec749ef0 829d129c 829d1298 829d129c 829d1298 ec749f2c 00000000 9f00: 8027a4d8 842fe200 8300e620 8300e600 82804d40 842fe22c 8415b000 61c88647 9f20: ec749f6c ec749f30 8027f7e4 8027e9f4 81a6a874 61c88647 82804d40 61c88647 9f40: 8028632c 00000001 8415b000 842fe100 df849e60 8027f5e8 842fe200 00000000 9f60: ec749fac ec749f70 80286810 8027f5f4 8026c664 81a6a7fc 8415b000 3ae85dc3 9f80: ec749fac 84774740 802866e4 00000000 00000000 00000000 00000000 00000000 9fa0: 00000000 ec749fb0 80200114 802866f0 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Call trace: [<808cd7a8>] (__list_del_entry_valid_or_report) from [<8156503c>] (__list_del_entry_valid include/linux/list.h:124 [inline]) [<808cd7a8>] (__list_del_entry_valid_or_report) from [<8156503c>] (__list_del_entry include/linux/list.h:215 [inline]) [<808cd7a8>] (__list_del_entry_valid_or_report) from [<8156503c>] (list_del_rcu include/linux/rculist.h:168 [inline]) [<808cd7a8>] (__list_del_entry_valid_or_report) from [<8156503c>] (__hw_addr_del_entry+0x84/0xe0 net/core/dev_addr_lists.c:160) r7:00000004 r6:00000001 r5:848b924c r4:85524300 [<81564fb8>] (__hw_addr_del_entry) from [<81565140>] (__hw_addr_del_ex+0xa8/0xb0 net/core/dev_addr_lists.c:200) r5:00000006 r4:ec749b54 [<81565098>] (__hw_addr_del_ex) from [<81565c48>] (__dev_mc_del net/core/dev_addr_lists.c:909 [inline]) [<81565098>] (__hw_addr_del_ex) from [<81565c48>] (dev_mc_del+0x4c/0x74 net/core/dev_addr_lists.c:927) r10:00000000 r9:855e13e4 r8:80000010 r7:00000100 r6:848b9238 r5:ec749b54 r4:848b9000 [<81565bfc>] (dev_mc_del) from [<81843008>] (igmp6_group_dropped+0x110/0x238 net/ipv6/mcast.c:719) r6:84abd530 r5:848b9000 r4:85524100 [<81842ef8>] (igmp6_group_dropped) from [<81845ef0>] (ipv6_mc_down+0x30/0x1cc net/ipv6/mcast.c:2768) r6:84abd530 r5:84abd400 r4:85524100 [<81845ec0>] (ipv6_mc_down) from [<818137f4>] (addrconf_ifdown+0x75c/0x76c net/ipv6/addrconf.c:4002) r7:00000100 r6:84abd400 r5:00000000 r4:84abd400 [<81813098>] (addrconf_ifdown) from [<8181995c>] (addrconf_notify+0x98/0x770 net/ipv6/addrconf.c:3780) r10:ec749cfc r9:00000000 r8:818198c4 r7:00000002 r6:84b08dc0 r5:84abd400 r4:848b9000 [<818198c4>] (addrconf_notify) from [<80289e30>] (notifier_call_chain+0x60/0x1b4 kernel/notifier.c:85) r10:ec749cfc r9:00000000 r8:818198c4 r7:00000000 r6:ffffffd1 r5:829e42cc r4:829e5124 [<80289dd0>] (notifier_call_chain) from [<8028a068>] (raw_notifier_call_chain+0x20/0x28 kernel/notifier.c:453) r10:82421da0 r9:00000000 r8:848b9000 r7:00000001 r6:84b08dc0 r5:00000002 r4:ec749cfc [<8028a048>] (raw_notifier_call_chain) from [<81556a5c>] (call_netdevice_notifiers_info+0x54/0xa0 net/core/dev.c:2230) [<81556a08>] (call_netdevice_notifiers_info) from [<8155706c>] (call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]) [<81556a08>] (call_netdevice_notifiers_info) from [<8155706c>] (call_netdevice_notifiers net/core/dev.c:2282 [inline]) [<81556a08>] (call_netdevice_notifiers_info) from [<8155706c>] (dev_close_many+0xfc/0x150 net/core/dev.c:1785) r6:ec749d70 r5:850ed800 r4:848b9114 [<81556f70>] (dev_close_many) from [<81562034>] (unregister_netdevice_many_notify+0x1e8/0xbc0 net/core/dev.c:12046) r9:00000001 r8:ec749d70 r7:ec749df0 r6:849c3114 r5:85768114 r4:ec749ce4 [<81561e4c>] (unregister_netdevice_many_notify) from [<8156376c>] (unregister_netdevice_many net/core/dev.c:12139 [inline]) [<81561e4c>] (unregister_netdevice_many_notify) from [<8156376c>] (default_device_exit_batch+0x304/0x384 net/core/dev.c:12643) r10:ec749e78 r9:00000001 r8:ec749e98 r7:82c1e840 r6:ec749e78 r5:84b08eb8 r4:84b08dbc [<81563468>] (default_device_exit_batch) from [<815449f8>] (ops_exit_list net/core/net_namespace.c:206 [inline]) [<81563468>] (default_device_exit_batch) from [<815449f8>] (ops_undo_list+0x10c/0x238 net/core/net_namespace.c:253) r10:00000001 r9:00000001 r8:829d1380 r7:829d198c r6:829d1380 r5:ec749e78 r4:ec749e98 [<815448ec>] (ops_undo_list) from [<81546d10>] (cleanup_net+0x20c/0x384 net/core/net_namespace.c:686) r10:00000000 r9:ffffffd4 r8:84b09b80 r7:829d12a8 r6:829d1280 r5:82c1e800 r4:84b08de0 [<81546b04>] (cleanup_net) from [<8027eb9c>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3238) r10:8300f070 r9:8301bc15 r8:8415b000 r7:8300e600 r6:8301bc00 r5:829d1298 r4:842fe200 [<8027e9e8>] (process_one_work) from [<8027f7e4>] (process_scheduled_works kernel/workqueue.c:3321 [inline]) [<8027e9e8>] (process_one_work) from [<8027f7e4>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3402) r10:61c88647 r9:8415b000 r8:842fe22c r7:82804d40 r6:8300e600 r5:8300e620 r4:842fe200 [<8027f5e8>] (worker_thread) from [<80286810>] (kthread+0x12c/0x280 kernel/kthread.c:464) r10:00000000 r9:842fe200 r8:8027f5e8 r7:df849e60 r6:842fe100 r5:8415b000 r4:00000001 [<802866e4>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xec749fb0 to 0xec749ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802866e4 r4:84774740 Code: e1a01007 e303008c e348022b ebe4dc5f (e7f001f2) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e1a01007 mov r1, r7 4: e303008c movw r0, #12428 @ 0x308c 8: e348022b movt r0, #33323 @ 0x822b c: ebe4dc5f bl 0xff937190 * 10: e7f001f2 udf #18 <-- trapping instruction