[ 35.395920][ T40] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.424695][ T40] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.495200][ T40] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 35.618999][ T40] bridge_slave_1: left allmulticast mode [ 35.620338][ T40] bridge_slave_1: left promiscuous mode [ 35.621820][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.625019][ T40] bridge_slave_0: left allmulticast mode [ 35.626146][ T40] bridge_slave_0: left promiscuous mode [ 35.626241][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.677204][ T40] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 35.682731][ T40] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 35.722019][ T40] bond0 (unregistering): Released all slaves [ 35.843743][ T4396] 8021q: adding VLAN 0 to HW filter on device eth4 [ 35.970965][ T4396] 8021q: adding VLAN 0 to HW filter on device eth5 [ 36.009555][ T40] hsr_slave_0: left promiscuous mode [ 36.011024][ T40] hsr_slave_1: left promiscuous mode [ 36.013423][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 36.014964][ T40] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 36.016817][ T40] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 36.018317][ T40] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 36.023756][ T40] veth1_macvtap: left promiscuous mode [ 36.024869][ T40] veth0_macvtap: left promiscuous mode [ 36.025981][ T40] veth1_vlan: left promiscuous mode [ 36.027013][ T40] veth0_vlan: left promiscuous mode [ 36.116765][ T40] team0 (unregistering): Port device team_slave_1 removed [ 36.120461][ T40] team0 (unregistering): Port device team_slave_0 removed [ 36.166735][ T4396] 8021q: adding VLAN 0 to HW filter on device eth6 [ 36.309630][ T4396] 8021q: adding VLAN 0 to HW filter on device eth7 Warning: Permanently added '10.128.0.229' (ED25519) to the list of known hosts. [ 40.346056][ T5030] dummy0 speed is unknown, defaulting to 1000 [ 40.346444][ T5030] dummy0 speed is unknown, defaulting to 1000 [ 40.346884][ T5030] dummy0 speed is unknown, defaulting to 1000 [ 40.382178][ T5030] infiniband rxe0: set active [ 40.382515][ T10] dummy0 speed is unknown, defaulting to 1000 [ 40.385599][ T5030] infiniband rxe0: added dummy0 [ 40.395261][ T5030] RDS/IB: rxe0: added [ 40.395370][ T5030] smc: adding ib device rxe0 with port count 1 [ 40.395395][ T5030] smc: ib device rxe0 port 1 has no pnetid [ 40.395785][ T4851] dummy0 speed is unknown, defaulting to 1000 [ 40.432893][ T5030] rnbd_client L610: Mapping device test on session test, (access_mode: rw, nr_poll_queues: 0) [ 40.435828][ T12] rtrs_client L2020: : CM error (CM event: address error, err: -ENODEV) [ 40.435847][ T12] ================================================================== [ 40.435853][ T12] BUG: KASAN: null-ptr-deref in trace_event_raw_event_rtrs_clt_conn_class+0x220/0x480 [ 40.435872][ T12] Read of size 255 at addr 0000000000000000 by task kworker/u8:0/12 [ 40.435880][ T12] [ 40.435884][ T12] CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT [ 40.435893][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 40.435897][ T12] Workqueue: ib_addr process_one_req [ 40.435912][ T12] Call trace: [ 40.435915][ T12] show_stack+0x2c/0x3c (C) [ 40.435930][ T12] __dump_stack+0x30/0x40 [ 40.435942][ T12] dump_stack_lvl+0xd8/0x12c [ 40.435952][ T12] print_report+0x58/0x84 [ 40.435959][ T12] kasan_report+0x8c/0xc4 [ 40.435968][ T12] kasan_check_range+0x17c/0x1ac [ 40.435977][ T12] __asan_memcpy+0x3c/0x84 [ 40.435986][ T12] trace_event_raw_event_rtrs_clt_conn_class+0x220/0x480 [ 40.435995][ T12] __traceiter_rtrs_rdma_error_recovery+0x74/0xc8 [ 40.436004][ T12] rtrs_rdma_error_recovery+0x2d4/0x400 [ 40.436013][ T12] rtrs_clt_rdma_cm_handler+0x498/0x1a18 [ 40.436020][ T12] cma_cm_event_handler+0xbc/0x4c8 [ 40.436031][ T12] addr_handler+0x210/0x3b4 [ 40.436040][ T12] process_one_req+0x26c/0x440 [ 40.436050][ T12] process_scheduled_works+0x91c/0x1250 [ 40.436060][ T12] worker_thread+0x798/0xbd0 [ 40.436068][ T12] kthread+0x304/0x3d4 [ 40.436076][ T12] ret_from_fork+0x10/0x20 [ 40.436084][ T12] ================================================================== [ 40.436088][ T12] Disabling lock debugging due to kernel taint [ 40.437897][ T5030] rtrs_client L2638: : init_conns() failed: err=-EHOSTUNREACH path=@ip:192.168.111.2 [:0] [ 45.882005][ T4764] dummy0 speed is unknown, defaulting to 1000 [+] Starting reproducer... [+] Created dummy interface dummy0 [+] Configured interface dummy0 with IP 192.168.111.1 [+] Attached rdma_rxe rxe0 to dummy0 [+] Enabled tracepoint at /sys/kernel/tracing/events/rtrs_clt/rtrs_rdma_error_recovery/enable [+] open map_device successful. [-] Failed to write: No route to host [+] close successful. [+] Waiting for asynchronous CM event to trigger the bug...