Re: [syzbot] [bridge?] possible deadlock in br_multicast_rcv (3)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free

oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=4553,uid=0
Memory cgroup out of memory: Killed process 4553 (syz-executor.0) total-vm:42280kB, anon-rss:448kB, file-rss:772kB, shmem-rss:4kB, UID:0 pgtables:52kB oom_score_adj:0
unregister_netdevice: waiting for syz_tun to become free. Usage count = 10
ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
dst_init+0x90/0x17c net/core/dst.c:52
dst_alloc+0xb8/0xe0 net/core/dst.c:94
rt_dst_alloc net/ipv4/route.c:1651 [inline]
__mkroute_output net/ipv4/route.c:2655 [inline]
ip_route_output_key_hash_rcu+0xa88/0xda0 net/ipv4/route.c:2875
ip_route_output_key_hash+0xe4/0x1a4 net/ipv4/route.c:2705
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x38/0xb0 net/ipv4/route.c:2932
ip_route_output_key include/net/route.h:179 [inline]
geneve_link_config+0x9c/0x268 drivers/net/geneve.c:2106
geneve_newlink+0xf4/0x12c drivers/net/geneve.c:2164
rtnl_newlink_create+0x130/0x43c net/core/rtnetlink.c:3862
__rtnl_newlink net/core/rtnetlink.c:3993 [inline]
rtnl_newlink+0xbec/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2209

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_prefix_route net/ipv6/addrconf.c:2487 [inline]
addrconf_add_linklocal+0x21c/0x324 net/ipv6/addrconf.c:3312
addrconf_addr_gen+0x268/0x2a4 net/ipv6/addrconf.c:3446
addrconf_init_auto_addrs+0x388/0x658 net/ipv6/addrconf.c:-1
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
addrconf_f6i_alloc+0x138/0x1f4 net/ipv6/route.c:4691
ipv6_add_addr+0x2a0/0x600 net/ipv6/addrconf.c:1125
addrconf_add_linklocal+0x114/0x324 net/ipv6/addrconf.c:3310
addrconf_addr_gen+0x268/0x2a4 net/ipv6/addrconf.c:3446
addrconf_init_auto_addrs+0x388/0x658 net/ipv6/addrconf.c:-1
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_add_mroute net/ipv6/addrconf.c:2551 [inline]
addrconf_add_dev+0x150/0x1d8 net/ipv6/addrconf.c:2569
addrconf_dev_config net/ipv6/addrconf.c:3483 [inline]
addrconf_init_auto_addrs+0x31c/0x658 net/ipv6/addrconf.c:3571
addrconf_notify+0x678/0x858 net/ipv6/addrconf.c:3744
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
ip6_route_add+0x8c/0x1a0 net/ipv6/route.c:3951
addrconf_prefix_route net/ipv6/addrconf.c:2487 [inline]
fixup_permanent_addr net/ipv6/addrconf.c:3602 [inline]
addrconf_permanent_addr+0x3fc/0x57c net/ipv6/addrconf.c:3626
addrconf_notify+0x598/0x858 net/ipv6/addrconf.c:3698
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1262 [inline]
fib_check_nh+0x638/0xd30 net/ipv4/fib_semantics.c:1282
fib_create_info+0xba0/0xfa0 net/ipv4/fib_semantics.c:1502
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x200/0x258 net/ipv4/fib_frontend.c:1178
fib_netdev_event+0x2b4/0x3a4 net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_hold include/linux/netdevice.h:4465 [inline]
fib_check_nh_nongw net/ipv4/fib_semantics.c:1262 [inline]
fib_check_nh+0x638/0xd30 net/ipv4/fib_semantics.c:1282
fib_create_info+0xba0/0xfa0 net/ipv4/fib_semantics.c:1502
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x1c0/0x258 net/ipv4/fib_frontend.c:1171
fib_netdev_event+0x2b4/0x3a4 net/ipv4/fib_frontend.c:1516
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
call_netdevice_notifiers_info net/core/dev.c:2249 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x174/0x32c net/core/dev.c:-1
netif_change_flags+0x80/0xa4 net/core/dev.c:9849
do_setlink+0x568/0x1a88 net/core/rtnetlink.c:3180
rtnl_changelink net/core/rtnetlink.c:3798 [inline]
__rtnl_newlink net/core/rtnetlink.c:3971 [inline]
rtnl_newlink+0xb94/0xdf8 net/core/rtnetlink.c:4108
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4448 [inline]
netdev_get_by_index+0x7c/0xd4 net/core/dev.c:1027
fib6_nh_init+0xac/0xed0 net/ipv6/route.c:3600
ip6_route_info_create_nh+0xa0/0x654 net/ipv6/route.c:3899
addrconf_f6i_alloc+0x138/0x1f4 net/ipv6/route.c:4691
ipv6_add_addr+0x2a0/0x600 net/ipv6/addrconf.c:1125
inet6_addr_add+0x1e4/0x62c net/ipv6/addrconf.c:3049
inet6_rtm_newaddr+0x4f8/0x658 net/ipv6/addrconf.c:5063
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__arm64_sys_sendto+0x30/0x44 net/socket.c:2209
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x64/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x8c/0x164 arch/arm64/kernel/syscall.c:132

ref_tracker: netdev@000000008f35972d has 1/9 users at
__netdev_tracker_alloc include/linux/netdevice.h:4436 [inline]
netdev_tracker_alloc+0x5c/0xa4 include/linux/netdevice.h:4448
fib_create_info+0xf54/0xfa0 net/ipv4/fib_semantics.c:1496
fib_table_insert+0x6c/0x914 net/ipv4/fib_trie.c:1212
fib_magic+0x14c/0x1a8 net/ipv4/fib_frontend.c:1134
fib_add_ifaddr+0x90/0x258 net/ipv4/fib_frontend.c:1156
fib_inetaddr_event+0x8c/0x124 net/ipv4/fib_frontend.c:1470
notifier_call_chain+0x110/0x3c0 kernel/notifier.c:85
blocking_notifier_call_chain+0x54/0x84 kernel/notifier.c:380
__inet_insert_ifa+0x464/0x58c net/ipv4/devinet.c:566
inet_rtm_newaddr+0x790/0x9f0 net/ipv4/devinet.c:1001
rtnetlink_rcv_msg+0x4b4/0x648 net/core/rtnetlink.c:6994
netlink_rcv_skb+0xf8/0x1dc net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7021
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x36c/0x4c4 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x408/0x510 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x1b0/0x274 net/socket.c:2206



Tested on:

commit: e583f808 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=138912d2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5089b548f519d67
dashboard link: https://syzkaller.appspot.com/bug?extid=d7b7f1412c02134efa6d
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=14cb6c36580000