[syzbot] [net?] unregister_netdevice: waiting for DEV to become free (9)

Hello,

syzbot found the following issue on:

HEAD commit:    5cbb61bf4168 arm64/fpsimd: ptrace: zero target's fpsimd_st..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=142f40ec580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a834c6344141a58b
dashboard link: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103f3dba580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04156ec16593/disk-5cbb61bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bfa041e2c79/vmlinux-5cbb61bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a92d82d8a79e/Image-5cbb61bf.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7915d7230a1d/mount_6.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=15005a73980000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com

unregister_netdevice: waiting for netdevsim1 to become free. Usage count = 2
ref_tracker: netdev@00000000f11a2c54 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4471 [inline]
     netdev_tracker_alloc include/linux/netdevice.h:4483 [inline]
     netdev_get_by_index+0x88/0xe0 net/core/dev.c:1027
     fib6_nh_init+0x258/0x14bc net/ipv6/route.c:3606
     ip6_route_info_create_nh+0x120/0x9a8 net/ipv6/route.c:3905
     addrconf_f6i_alloc+0x1e4/0x3b4 net/ipv6/route.c:4697
     ipv6_add_addr+0x458/0xd70 net/ipv6/addrconf.c:1126
     addrconf_add_linklocal+0x1e0/0x378 net/ipv6/addrconf.c:3311
     addrconf_addr_gen+0x27c/0x2e0 net/ipv6/addrconf.c:-1
     addrconf_init_auto_addrs+0x390/0x764 net/ipv6/addrconf.c:-1
     addrconf_notify+0x7a0/0xbe4 net/ipv6/addrconf.c:3752
     notifier_call_chain+0x194/0x60c kernel/notifier.c:85
     raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
     call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2249
     call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
     call_netdevice_notifiers net/core/dev.c:2301 [inline]
     __dev_notify_flags+0x160/0x27c net/core/dev.c:9794
     netif_change_flags+0xd0/0x15c net/core/dev.c:9823
     do_setlink+0xab0/0x31c0 net/core/rtnetlink.c:3180
     rtnl_changelink net/core/rtnetlink.c:3799 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3972 [inline]
     rtnl_newlink+0xd24/0x113c net/core/rtnetlink.c:4109

netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup