==================================================================
BUG: KASAN: invalid-free in release_gid_table drivers/infiniband/core/cache.c:804 [inline]
BUG: KASAN: invalid-free in gid_table_release_one+0x384/0x470 drivers/infiniband/core/cache.c:877
Free of addr ffff888075aa80d8 by task kworker/u8:3/49

CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: ib-unreg-wq ib_unregister_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report_invalid_free+0xea/0x110 mm/kasan/report.c:557
 kasan_kfree_large include/linux/kasan.h:244 [inline]
 free_large_kmalloc+0x3c/0x110 mm/slub.c:6476
 release_gid_table drivers/infiniband/core/cache.c:804 [inline]
 gid_table_release_one+0x384/0x470 drivers/infiniband/core/cache.c:877
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:482
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x228/0x560 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3302 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888075aab400 pfn:0x75aa8
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f8(unknown)
raw: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
raw: ffff888075aab400 0000000000000000 00000000f8000000 0000000000000000
head: 00fff00000000040 0000000000000000 dead000000000122 0000000000000000
head: ffff888075aab400 0000000000000000 00000000f8000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 9929, tgid 9928 (syz.2.1164), ts 357188340017, free_ts 357177047040
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x24ba/0x2540 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_pages_mpol+0x235/0x490 mm/mempolicy.c:2490
 ___kmalloc_large_node+0x4e/0x120 mm/slub.c:5233
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5264
 __do_kmalloc_node mm/slub.c:5280 [inline]
 __kmalloc_noprof+0x3e8/0x760 mm/slub.c:5304
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 alloc_gid_table drivers/infiniband/core/cache.c:773 [inline]
 _gid_table_setup_one drivers/infiniband/core/cache.c:888 [inline]
 gid_table_setup_one drivers/infiniband/core/cache.c:916 [inline]
 ib_cache_setup_one+0x198/0x570 drivers/infiniband/core/cache.c:1606
 ib_register_device+0xfbd/0x13e0 drivers/infiniband/core/device.c:1426
 rxe_register_device+0x1e3/0x350 drivers/infiniband/sw/rxe/rxe_verbs.c:1552
 rxe_net_add+0x81/0x110 drivers/infiniband/sw/rxe/rxe_net.c:625
 rxe_newlink+0xf4/0x1c0 drivers/infiniband/sw/rxe/rxe.c:243
 nldev_newlink+0x5bc/0x650 drivers/infiniband/core/nldev.c:1812
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0x6d1/0xa10 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
page last free pid 9929 tgid 9928 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2943
 stack_depot_save_flags+0x40e/0x810 lib/stackdepot.c:735
 ref_tracker_free+0x12d/0x840 lib/ref_tracker.c:307
 netdev_tracker_free include/linux/netdevice.h:4465 [inline]
 netdev_put include/linux/netdevice.h:4482 [inline]
 neigh_parms_release+0x163/0x1f0 net/core/neighbour.c:1817
 addrconf_ifdown+0x177b/0x1a40 net/ipv6/addrconf.c:4012
 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
 notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_mtu net/core/dev.c:2322 [inline]
 netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9933
 netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9954
 dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
 dev_ioctl+0x7b4/0x1150 net/core/dev_ioctl.c:814
 sock_do_ioctl+0x23e/0x320 net/socket.c:1326
 sock_ioctl+0x5c6/0x7f0 net/socket.c:1433
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888075aa7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888075aa8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888075aa8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                    ^
 ffff888075aa8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888075aa8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================