[syzbot] [net?] memory leak in udp_tunnel_nic_netdevice_event

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dd3210c47e8d Merge tag 'regulator-fix-v7.2-rc2' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11b4f0b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b80376788da8bcda
dashboard link: https://syzkaller.appspot.com/bug?extid=eca845fb8c18dd6b44c1
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b4f0b9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17e0d432580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5fb3ad85541d/disk-dd3210c4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/df0f959008a1/vmlinux-dd3210c4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/383375b1d360/bzImage-dd3210c4.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+eca845...@syzkaller.appspotmail.com

2026/07/12 04:07:42 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888127d5f840 (size 96):
comm "syz-executor", pid 5806, jiffies 4294942188
hex dump (first 32 bytes):
00 00 00 01 00 00 00 00 48 f8 d5 27 81 88 ff ff ........H..'....
48 f8 d5 27 81 88 ff ff 10 7d da 84 ff ff ff ff H..'.....}......
backtrace (crc 99fdb6c8):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4625 [inline]
slab_alloc_node mm/slub.c:4945 [inline]
__do_kmalloc_node mm/slub.c:5361 [inline]
__kmalloc_noprof+0x3bf/0x550 mm/slub.c:5387
_kmalloc_noprof include/linux/slab.h:973 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]
udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x59/0x160 kernel/notifier.c:85
call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250
call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
call_netdevice_notifiers net/core/dev.c:2302 [inline]
register_netdevice+0xc10/0xeb0 net/core/dev.c:11478
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0x424/0x5b0 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x266/0x450 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1570 [inline]
nsim_drv_probe+0x79c/0x930 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:706
__driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1098
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup