syzbot
WARNING in ib_cq_pool_cleanup
Status:
upstream: reported on 2026/08/28 00:23
Subsystems:
rdma
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+d396918a29afb8543e1c@syzkaller.appspotmail.com
First crash: 5d04h, last: 1d05h
Sample crash report:
smbdirect: ib_dev[syz2] removed
------------[ cut here ]------------
cq->cqe_used
WARNING: drivers/infiniband/core/cq.c:370 at ib_cq_pool_cleanup+0x248/0x370 drivers/infiniband/core/cq.c:370, CPU#1: kworker/u8:22/17817
Modules linked in:
CPU: 1 UID: 0 PID: 17817 Comm: kworker/u8:22 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:ib_cq_pool_cleanup+0x248/0x370 drivers/infiniband/core/cq.c:370
Code: 41 f9 41 83 fe 03 0f 85 01 fe ff ff e8 21 92 41 f9 48 83 c4 20 5b 5d 41 5c 41 5d 41 5e 41 5f e9 fe b1 06 03 e8 09 92 41 f9 90 <0f> 0b 90 eb 84 e8 3e 76 b4 f9 e9 67 ff ff ff 48 8b 34 24 48 c7 c7
RSP: 0018:ffffc90004bcfac8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: ffff88802e53a580 RSI: ffffffff88ca43e7 RDI: ffff88802e53a580
RBP: ffff888028e1c000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000804 R11: 0000000000000000 R12: ffff888058b09840
R13: ffff88807d614ed0 R14: 0000000000000804 R15: ffff888058b09800
FS: 0000000000000000(0000) GS:ffff888123c6b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efff0e27dac CR3: 000000005a096000 CR4: 00000000003526f0
Call Trace:
<TASK>
disable_device+0x161/0x280 drivers/infiniband/core/device.c:1328
__ib_unregister_device+0x2b4/0x480 drivers/infiniband/core/device.c:1571
ib_unregister_work+0x19/0x30 drivers/infiniband/core/device.c:1683
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
process_scheduled_works kernel/workqueue.c:3470 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
* Struck through repros no longer work on HEAD.