[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5cbb61bf4168 arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=142f40ec580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=103f3dba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04156ec16593/disk-5cbb61bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bfa041e2c79/vmlinux-5cbb61bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a92d82d8a79e/Image-5cbb61bf.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7915d7230a1d/mount_6.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15005a73980000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2af46...@syzkaller.appspotmail.com

unregister_netdevice: waiting for netdevsim1 to become free. Usage count = 2
ref_tracker: netdev@00000000f11a2c54 has 1/1 users at
__netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
notifier_call_chain+0x194/0x60c kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x160/0x27c net/core/dev.c:9794
netif_change_flags+0xd0/0x15c net/core/dev.c:9823
do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3799 [inline]
__rtnl_newlink net/core/rtnetlink.c:3972 [inline]
rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup