program: r0 = socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) write(r1, &(0x7f0000000600), 0xffffff4a) pselect6(0x40, &(0x7f0000000640)={0x8, 0x5, 0x4, 0x8001, 0x8, 0x10000, 0xc, 0xfffffffffffffff8}, 0x0, 0x0, &(0x7f0000000680)={0x0, 0x3938700}, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x683406a7099ccd59}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x30, 0x1412, 0x100, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000840}, 0x84) r2 = socket$nl_rdma(0x10, 0x3, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x10001}, 0x0) io_setup(0x8, &(0x7f00000000c0)=0x0) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101002) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/nd/devices/pfn0.0/mode\x00', 0x1, 0x8) io_submit(r3, 0x1, &(0x7f0000000400)=[&(0x7f0000000440)={0x0, 0x4, 0x0, 0x1, 0x0, r4, &(0x7f0000000480)="01", 0xffffff1f}]) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r5, &(0x7f0000000100)='+p', 0x2) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x38, 0x1403, 0xc23, 0x70bd2e, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'syz_tun\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) [ 102.691986][ T5307] Bluetooth: hci0: command tx timeout [ 103.176516][ T5352] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 103.176535][ T5352] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 103.176555][ T5352] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 103.282191][ T5352] smc: removing ib device rxe0 [ 103.308055][ T5352] smbdirect: ib_dev[rxe0] removed [ 103.633258][ T5352] ------------[ cut here ]------------ [ 103.633267][ T5352] !xa_empty(&pool->xa) [ 103.633272][ T5352] WARNING: drivers/infiniband/sw/rxe/rxe_pool.c:116 at rxe_pool_cleanup+0x48/0x60, CPU#0: syz.0.0/5352 [ 103.653149][ T5352] Modules linked in: [ 103.654904][ T5352] CPU: 0 UID: 0 PID: 5352 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.658865][ T5352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.663386][ T5352] RIP: 0010:rxe_pool_cleanup+0x48/0x60 [ 103.665757][ T5352] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d0 d8 2e f9 48 83 3b 00 75 0c e8 d5 a6 b6 f8 5b e9 3f a3 f3 02 cc e8 c9 a6 b6 f8 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 [ 103.675463][ T5352] RSP: 0018:ffffc9000e4f7000 EFLAGS: 00010246 [ 103.678705][ T5352] RAX: ffffffff891276e7 RBX: ffff888013a9d458 RCX: 0000000000100000 [ 103.682124][ T5352] RDX: ffffc90020001000 RSI: 00000000000fffff RDI: 0000000000100000 [ 103.685520][ T5352] RBP: ffff888013a9d138 R08: ffff888013a9c7e3 R09: 1ffff110027538fc [ 103.689098][ T5352] R10: dffffc0000000000 R11: ffffffff8910a390 R12: ffff888013a9d138 [ 103.692502][ T5352] R13: 1ffff110027539f7 R14: ffffffff8910a390 R15: dffffc0000000000 [ 103.695738][ T5352] FS: 00007fb6633c56c0(0000) GS:ffff88808ac1d000(0000) knlGS:0000000000000000 [ 103.699443][ T5352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.702276][ T5352] CR2: 0000562e58bfe8d0 CR3: 00000000455b3000 CR4: 0000000000352ef0 [ 103.705653][ T5352] Call Trace: [ 103.707002][ T5352] [ 103.708341][ T5352] rxe_dealloc+0x27/0xc0 [ 103.710103][ T5352] ? __pfx_rxe_dealloc+0x10/0x10 [ 103.711994][ T5352] ib_dealloc_device+0x54/0x200 [ 103.714039][ T5352] __ib_unregister_device+0x38f/0x400 [ 103.716196][ T5352] ib_unregister_device_and_put+0xb8/0xf0 [ 103.718581][ T5352] nldev_dellink+0x3a4/0x440 [ 103.720532][ T5352] ? __pfx_nldev_dellink+0x10/0x10 [ 103.722875][ T5352] ? apparmor_capable+0x126/0x170 [ 103.725246][ T5352] ? bpf_lsm_capable+0x9/0x20 [ 103.727411][ T5352] ? security_capable+0x7e/0x2c0 [ 103.731120][ T5352] ? __pfx_nldev_dellink+0x10/0x10 [ 103.733460][ T5352] rdma_nl_rcv+0x6ef/0xa40 [ 103.735507][ T5352] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 103.737900][ T5352] ? netlink_deliver_tap+0x2e/0x1b0 [ 103.740381][ T5352] ? netlink_deliver_tap+0x2e/0x1b0 [ 103.742739][ T5352] netlink_unicast+0x8ef/0xa80 [ 103.744954][ T5352] netlink_sendmsg+0x7f0/0xb20 [ 103.747679][ T5352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 103.750582][ T5352] ? aa_sock_msg_perm+0x144/0x210 [ 103.753141][ T5352] ? apparmor_socket_sendmsg+0x98/0x360 [ 103.755521][ T5352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 103.757840][ T5352] sock_sendmsg_nosec+0x14e/0x190 [ 103.759943][ T5352] ____sys_sendmsg+0x54e/0x850 [ 103.761883][ T5352] ? __pfx_____sys_sendmsg+0x10/0x10 [ 103.764073][ T5352] ? import_iovec+0x73/0xa0 [ 103.765995][ T5352] ___sys_sendmsg+0x2a5/0x360 [ 103.768050][ T5352] ? __lock_acquire+0x747/0x2de0 [ 103.770248][ T5352] ? __pfx____sys_sendmsg+0x10/0x10 [ 103.772440][ T5352] ? futex_wait+0x2a2/0x390 [ 103.774361][ T5352] ? __fget_files+0x3a2/0x420 [ 103.776387][ T5352] ? __fget_files+0x2a/0x420 [ 103.778464][ T5352] __x64_sys_sendmsg+0x1b1/0x290 [ 103.780556][ T5352] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 103.782893][ T5352] do_syscall_64+0x166/0x520 [ 103.785054][ T5352] ? trace_irq_disable+0x3b/0x140 [ 103.787208][ T5352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.789982][ T5352] ? clear_bhb_loop+0x70/0xc0 [ 103.792056][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.794641][ T5352] RIP: 0033:0x7fb66259f559 [ 103.796541][ T5352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.804405][ T5352] RSP: 002b:00007fb6633c4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 103.808659][ T5352] RAX: ffffffffffffffda RBX: 00007fb662826090 RCX: 00007fb66259f559 [ 103.812067][ T5352] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 103.815425][ T5352] RBP: 00007fb662636b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.819039][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.822479][ T5352] R13: 00007fb662826128 R14: 00007fb662826090 R15: 00007ffc2ffae358 [ 103.825959][ T5352] [ 103.827261][ T5352] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.830311][ T5352] CPU: 0 UID: 0 PID: 5352 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.834172][ T5352] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.838619][ T5352] Call Trace: [ 103.840106][ T5352] [ 103.841395][ T5352] vpanic+0x56d/0xa60 [ 103.843248][ T5352] ? __pfx__printk+0x10/0x10 [ 103.845348][ T5352] ? __pfx_vpanic+0x10/0x10 [ 103.847284][ T5352] ? is_bpf_text_address+0x292/0x2b0 [ 103.849644][ T5352] ? is_bpf_text_address+0x26/0x2b0 [ 103.851979][ T5352] panic+0xc5/0xd0 [ 103.853738][ T5352] ? __pfx_panic+0x10/0x10 [ 103.855770][ T5352] __warn+0x315/0x4c0 [ 103.857583][ T5352] ? rxe_pool_cleanup+0x48/0x60 [ 103.859785][ T5352] ? rxe_pool_cleanup+0x48/0x60 [ 103.861913][ T5352] __report_bug+0x276/0x570 [ 103.863883][ T5352] ? rxe_pool_cleanup+0x48/0x60 [ 103.866122][ T5352] ? __pfx___report_bug+0x10/0x10 [ 103.868426][ T5352] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 103.871147][ T5352] ? touch_wq_lockdep_map+0xb5/0x180 [ 103.873567][ T5352] ? touch_wq_lockdep_map+0xb5/0x180 [ 103.876001][ T5352] ? rxe_pool_cleanup+0x48/0x60 [ 103.878218][ T5352] report_bug+0x16b/0x220 [ 103.880218][ T5352] ? rxe_pool_cleanup+0x48/0x60 [ 103.882432][ T5352] ? rxe_pool_cleanup+0x4a/0x60 [ 103.884635][ T5352] handle_bug+0x9c/0x200 [ 103.886569][ T5352] exc_invalid_op+0x1a/0x50 [ 103.888603][ T5352] asm_exc_invalid_op+0x1a/0x20 [ 103.890423][ T5352] RIP: 0010:rxe_pool_cleanup+0x48/0x60 [ 103.892559][ T5352] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d0 d8 2e f9 48 83 3b 00 75 0c e8 d5 a6 b6 f8 5b e9 3f a3 f3 02 cc e8 c9 a6 b6 f8 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 66 66 66 2e 0f 1f 84 00 00 00 [ 103.900830][ T5352] RSP: 0018:ffffc9000e4f7000 EFLAGS: 00010246 [ 103.903218][ T5352] RAX: ffffffff891276e7 RBX: ffff888013a9d458 RCX: 0000000000100000 [ 103.906308][ T5352] RDX: ffffc90020001000 RSI: 00000000000fffff RDI: 0000000000100000 [ 103.909817][ T5352] RBP: ffff888013a9d138 R08: ffff888013a9c7e3 R09: 1ffff110027538fc [ 103.913019][ T5352] R10: dffffc0000000000 R11: ffffffff8910a390 R12: ffff888013a9d138 [ 103.916518][ T5352] R13: 1ffff110027539f7 R14: ffffffff8910a390 R15: dffffc0000000000 [ 103.920041][ T5352] ? __pfx_rxe_dealloc+0x10/0x10 [ 103.922285][ T5352] ? __pfx_rxe_dealloc+0x10/0x10 [ 103.924411][ T5352] ? rxe_pool_cleanup+0x47/0x60 [ 103.926555][ T5352] rxe_dealloc+0x27/0xc0 [ 103.928335][ T5352] ? __pfx_rxe_dealloc+0x10/0x10 [ 103.930455][ T5352] ib_dealloc_device+0x54/0x200 [ 103.932569][ T5352] __ib_unregister_device+0x38f/0x400 [ 103.934896][ T5352] ib_unregister_device_and_put+0xb8/0xf0 [ 103.937432][ T5352] nldev_dellink+0x3a4/0x440 [ 103.939372][ T5352] ? __pfx_nldev_dellink+0x10/0x10 [ 103.941672][ T5352] ? apparmor_capable+0x126/0x170 [ 103.943820][ T5352] ? bpf_lsm_capable+0x9/0x20 [ 103.945780][ T5352] ? security_capable+0x7e/0x2c0 [ 103.947806][ T5352] ? __pfx_nldev_dellink+0x10/0x10 [ 103.949822][ T5352] rdma_nl_rcv+0x6ef/0xa40 [ 103.951571][ T5352] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 103.953625][ T5352] ? netlink_deliver_tap+0x2e/0x1b0 [ 103.955719][ T5352] ? netlink_deliver_tap+0x2e/0x1b0 [ 103.957873][ T5352] netlink_unicast+0x8ef/0xa80 [ 103.959903][ T5352] netlink_sendmsg+0x7f0/0xb20 [ 103.961949][ T5352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 103.964208][ T5352] ? aa_sock_msg_perm+0x144/0x210 [ 103.966320][ T5352] ? apparmor_socket_sendmsg+0x98/0x360 [ 103.968571][ T5352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 103.970799][ T5352] sock_sendmsg_nosec+0x14e/0x190 [ 103.972962][ T5352] ____sys_sendmsg+0x54e/0x850 [ 103.974947][ T5352] ? __pfx_____sys_sendmsg+0x10/0x10 [ 103.977119][ T5352] ? import_iovec+0x73/0xa0 [ 103.979012][ T5352] ___sys_sendmsg+0x2a5/0x360 [ 103.981017][ T5352] ? __lock_acquire+0x747/0x2de0 [ 103.983109][ T5352] ? __pfx____sys_sendmsg+0x10/0x10 [ 103.985711][ T5352] ? futex_wait+0x2a2/0x390 [ 103.988083][ T5352] ? __fget_files+0x3a2/0x420 [ 103.990144][ T5352] ? __fget_files+0x2a/0x420 [ 103.992332][ T5352] __x64_sys_sendmsg+0x1b1/0x290 [ 103.994829][ T5352] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 103.997734][ T5352] do_syscall_64+0x166/0x520 [ 104.000183][ T5352] ? trace_irq_disable+0x3b/0x140 [ 104.002455][ T5352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.005286][ T5352] ? clear_bhb_loop+0x70/0xc0 [ 104.007306][ T5352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.009643][ T5352] RIP: 0033:0x7fb66259f559 [ 104.011397][ T5352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.019324][ T5352] RSP: 002b:00007fb6633c4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 104.022754][ T5352] RAX: ffffffffffffffda RBX: 00007fb662826090 RCX: 00007fb66259f559 [ 104.025886][ T5352] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 104.028986][ T5352] RBP: 00007fb662636b20 R08: 0000000000000000 R09: 0000000000000000 [ 104.032146][ T5352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.035193][ T5352] R13: 00007fb662826128 R14: 00007fb662826090 R15: 00007ffc2ffae358 [ 104.038345][ T5352] [ 104.040186][ T5352] Kernel Offset: disabled [ 104.042207][ T5352] Rebooting in 86400 seconds..