Re: [syzbot] [rdma?] WARNING in gid_table_release

linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <185e135e-0e17-4ef8-91a2-15e69897cd01@linux.dev>
@ 2025-11-05 17:06 ` syzbot
  2025-11-05 17:14   ` Jason Gunthorpe
  0 siblings, 1 reply; 51+ messages in thread
From: syzbot @ 2025-11-05 17:06 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=363, state: 3
WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
Modules linked in:
CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-05 17:06 ` [syzbot] [rdma?] WARNING in gid_table_release_one (3) syzbot
@ 2025-11-05 17:14   ` Jason Gunthorpe
  2025-11-05 17:24     ` Yanjun.Zhu
  2025-11-05 18:50     ` Leon Romanovsky
  0 siblings, 2 replies; 51+ messages in thread
From: Jason Gunthorpe @ 2025-11-05 17:14 UTC (permalink / raw)
  To: syzbot; +Cc: leon, linux-kernel, syzkaller-bugs, yanjun.zhu

On Wed, Nov 05, 2025 at 09:06:04AM -0800, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in gid_table_release_one
> 
> ------------[ cut here ]------------
> GID entry ref leak for dev syz1 index 2 ref=363, state: 3
> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
> Modules linked in:
> CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> Workqueue: ib-unreg-wq ib_unregister_work
> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
> RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
> Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
> RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
> RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
> R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
> R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
> FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>  device_release+0x9c/0x1c0 drivers/base/core.c:-1
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x22b/0x480 lib/kobject.c:737
>  process_one_work kernel/workqueue.c:3263 [inline]
>  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>  kthread+0x711/0x8a0 kernel/kthread.c:463
>  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
> 
> 
> Tested on:
> 
> commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
> console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

I think this disproves the theory that the the gid is sitting in a
work queue waiting to be cleaned up..

So we still need to find out what is holding on to the reference...

Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-05 17:14   ` Jason Gunthorpe
@ 2025-11-05 17:24     ` Yanjun.Zhu
  2025-11-05 18:50     ` Leon Romanovsky
  1 sibling, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-11-05 17:24 UTC (permalink / raw)
  To: Jason Gunthorpe, syzbot; +Cc: leon, linux-kernel, syzkaller-bugs


On 11/5/25 9:14 AM, Jason Gunthorpe wrote:
> On Wed, Nov 05, 2025 at 09:06:04AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> WARNING in gid_table_release_one
>>
>> ------------[ cut here ]------------
>> GID entry ref leak for dev syz1 index 2 ref=363, state: 3
>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>> Workqueue: ib-unreg-wq ib_unregister_work
>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>> RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>> Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
>> RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
>> RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
>> R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
>> R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
>> FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
>> Call Trace:
>>   <TASK>
>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>   device_release+0x9c/0x1c0 drivers/base/core.c:-1
>>   kobject_cleanup lib/kobject.c:689 [inline]
>>   kobject_release lib/kobject.c:720 [inline]
>>   kref_put include/linux/kref.h:65 [inline]
>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>   process_one_work kernel/workqueue.c:3263 [inline]
>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>>   kthread+0x711/0x8a0 kernel/kthread.c:463
>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>   </TASK>
>>
>>
>> Tested on:
>>
>> commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
>> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> I think this disproves the theory that the the gid is sitting in a
> work queue waiting to be cleaned up..
>
> So we still need to find out what is holding on to the reference...

Got it.

Thanks a lot.

Yanjun.Zhu

>
> Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-05 17:14   ` Jason Gunthorpe
  2025-11-05 17:24     ` Yanjun.Zhu
@ 2025-11-05 18:50     ` Leon Romanovsky
  2025-11-05 20:10       ` Yanjun.Zhu
  2025-11-06  0:44       ` Yanjun.Zhu
  1 sibling, 2 replies; 51+ messages in thread
From: Leon Romanovsky @ 2025-11-05 18:50 UTC (permalink / raw)
  To: Jason Gunthorpe, syzbot
  Cc: linux-kernel, syzkaller-bugs, yanjun.zhu@linux.dev



On Wed, Nov 5, 2025, at 19:14, Jason Gunthorpe wrote:
> On Wed, Nov 05, 2025 at 09:06:04AM -0800, syzbot wrote:
>> Hello,
>> 
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> WARNING in gid_table_release_one
>> 
>> ------------[ cut here ]------------
>> GID entry ref leak for dev syz1 index 2 ref=363, state: 3
>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>> Workqueue: ib-unreg-wq ib_unregister_work
>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>> RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>> Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
>> RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
>> RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
>> R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
>> R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
>> FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
>> Call Trace:
>>  <TASK>
>>  ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>  device_release+0x9c/0x1c0 drivers/base/core.c:-1
>>  kobject_cleanup lib/kobject.c:689 [inline]
>>  kobject_release lib/kobject.c:720 [inline]
>>  kref_put include/linux/kref.h:65 [inline]
>>  kobject_put+0x22b/0x480 lib/kobject.c:737
>>  process_one_work kernel/workqueue.c:3263 [inline]
>>  process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>>  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>>  kthread+0x711/0x8a0 kernel/kthread.c:463
>>  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>  </TASK>
>> 
>> 
>> Tested on:
>> 
>> commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
>> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>
> I think this disproves the theory that the the gid is sitting in a
> work queue waiting to be cleaned up..

Yes, this is makes more sense to me when multiple ib_wq flush.

>
> So we still need to find out what is holding on to the reference...
>
> Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-05 18:50     ` Leon Romanovsky
@ 2025-11-05 20:10       ` Yanjun.Zhu
  2025-11-06  0:44       ` Yanjun.Zhu
  1 sibling, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-11-05 20:10 UTC (permalink / raw)
  To: Leon Romanovsky, Jason Gunthorpe, syzbot; +Cc: linux-kernel, syzkaller-bugs


On 11/5/25 10:50 AM, Leon Romanovsky wrote:
>
> On Wed, Nov 5, 2025, at 19:14, Jason Gunthorpe wrote:
>> On Wed, Nov 05, 2025 at 09:06:04AM -0800, syzbot wrote:
>>> Hello,
>>>
>>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>>> WARNING in gid_table_release_one
>>>
>>> ------------[ cut here ]------------
>>> GID entry ref leak for dev syz1 index 2 ref=363, state: 3
>>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>>> Modules linked in:
>>> CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>>> Workqueue: ib-unreg-wq ib_unregister_work
>>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>>> RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>>> Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
>>> RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
>>> RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
>>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>>> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
>>> R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
>>> R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
>>> FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
>>> Call Trace:
>>>   <TASK>
>>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>>   device_release+0x9c/0x1c0 drivers/base/core.c:-1
>>>   kobject_cleanup lib/kobject.c:689 [inline]
>>>   kobject_release lib/kobject.c:720 [inline]
>>>   kref_put include/linux/kref.h:65 [inline]
>>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>>   process_one_work kernel/workqueue.c:3263 [inline]
>>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>>>   kthread+0x711/0x8a0 kernel/kthread.c:463
>>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>   </TASK>
>>>
>>>
>>> Tested on:
>>>
>>> commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
>>> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>> I think this disproves the theory that the the gid is sitting in a
>> work queue waiting to be cleaned up..
> Yes, this is makes more sense to me when multiple ib_wq flush.
>> So we still need to find out what is holding on to the reference...

It’s still unclear what is holding the reference. From my tests, if we 
wait here for a short time, all the references are eventually released. 
It’s quite strange.

Yanjun.Zhu

>>
>> Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-05 18:50     ` Leon Romanovsky
  2025-11-05 20:10       ` Yanjun.Zhu
@ 2025-11-06  0:44       ` Yanjun.Zhu
  1 sibling, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-11-06  0:44 UTC (permalink / raw)
  To: Leon Romanovsky, Jason Gunthorpe, syzbot; +Cc: linux-kernel, syzkaller-bugs


On 11/5/25 10:50 AM, Leon Romanovsky wrote:
>
> On Wed, Nov 5, 2025, at 19:14, Jason Gunthorpe wrote:
>> On Wed, Nov 05, 2025 at 09:06:04AM -0800, syzbot wrote:
>>> Hello,
>>>
>>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>>> WARNING in gid_table_release_one
>>>
>>> ------------[ cut here ]------------
>>> GID entry ref leak for dev syz1 index 2 ref=363, state: 3
>>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>>> WARNING: CPU: 1 PID: 50 at drivers/infiniband/core/cache.c:827 gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>>> Modules linked in:
>>> CPU: 1 UID: 0 PID: 50 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
>>> Workqueue: ib-unreg-wq ib_unregister_work
>>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:824 [inline]
>>> RIP: 0010:gid_table_release_one+0x5ae/0x6c0 drivers/infiniband/core/cache.c:904
>>> Code: e8 03 0f b6 04 28 84 c0 0f 85 cc 00 00 00 44 8b 03 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 73 e7 35 f9 90 <0f> 0b 90 90 44 8b 74 24 04 4c 8b 7c 24 20 4c 8b 64 24 48 e9 15 fe
>>> RSP: 0018:ffffc90000bb78f8 EFLAGS: 00010246
>>> RAX: 124fa0acf3bf2700 RBX: ffff8880268c1990 RCX: ffff888020289e40
>>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>>> RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
>>> R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: ffff88802ed4e2d8
>>> R13: 00000000000001a8 R14: ffff88806a158010 R15: 0000000000000002
>>> FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00005555712ce808 CR3: 000000006b6c8000 CR4: 00000000003526f0
>>> Call Trace:
>>>   <TASK>
>>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>>   device_release+0x9c/0x1c0 drivers/base/core.c:-1
>>>   kobject_cleanup lib/kobject.c:689 [inline]
>>>   kobject_release lib/kobject.c:720 [inline]
>>>   kref_put include/linux/kref.h:65 [inline]
>>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>>   process_one_work kernel/workqueue.c:3263 [inline]
>>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>>>   kthread+0x711/0x8a0 kernel/kthread.c:463
>>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>   </TASK>
>>>
>>>
>>> Tested on:
>>>
>>> commit:         ad2cc78b RDMA/core: Fix WARNING in gid_table_release_one
>>> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=11dfa17c580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>> I think this disproves the theory that the the gid is sitting in a
>> work queue waiting to be cleaned up..
> Yes, this is makes more sense to me when multiple ib_wq flush.


ib_unreg_wq also has to handle gid. Thus the 2 workqueues (ib_wq and 
ib_unreg_wq) handle gid.

Thus it is not enough to just flush ib_wq.

Yanjun.Zhu

>
>> So we still need to find out what is holding on to the reference...
>>
>> Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <ffdab397-0096-4946-a7d5-073300cc34a3@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <ffdab397-0096-4946-a7d5-073300cc34a3@linux.dev>
@ 2025-11-06 21:02 ` syzbot
  2025-11-06 21:08   ` Yanjun.Zhu
  0 siblings, 1 reply; 51+ messages in thread
From: syzbot @ 2025-11-06 21:02 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
Possibly kref leak, ref:403, state: 3
WARNING: CPU: 0 PID: 12 at drivers/infiniband/core/cache.c:820 release_gid_table drivers/infiniband/core/cache.c:819 [inline]
WARNING: CPU: 0 PID: 12 at drivers/infiniband/core/cache.c:820 gid_table_release_one+0x4fb/0x800 drivers/infiniband/core/cache.c:897
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:819 [inline]
RIP: 0010:gid_table_release_one+0x4fb/0x800 drivers/infiniband/core/cache.c:897
Code: 49 01 c6 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 be 01 00 00 41 8b 16 48 c7 c7 60 7d 2b 8c 44 89 e6 e8 16 e2 35 f9 90 <0f> 0b 90 90 e9 c4 fe ff ff e8 f7 76 72 f9 4c 8b 7c 24 48 4c 89 f8
RSP: 0018:ffffc90000117900 EFLAGS: 00010246
RAX: a2ec906fdf0a5800 RBX: ffff888030cab6d8 RCX: ffff88801c6e5ac0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffff888079d48010 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1b7a680 R12: 0000000000000193
R13: dffffc0000000000 R14: ffff888028a68690 R15: ffff888030cab600
FS:  0000000000000000(0000) GS:ffff88812636a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f49bf3056c0 CR3: 00000000772e8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         690e9fda RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=16bbb012580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-11-06 21:02 ` syzbot
@ 2025-11-06 21:08   ` Yanjun.Zhu
  0 siblings, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-11-06 21:08 UTC (permalink / raw)
  To: syzbot, jgg, leon, linux-kernel, syzkaller-bugs


On 11/6/25 1:02 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in gid_table_release_one
>
> ------------[ cut here ]------------
> Possibly kref leak, ref:403, state: 3
> WARNING: CPU: 0 PID: 12 at drivers/infiniband/core/cache.c:820 release_gid_table drivers/infiniband/core/cache.c:819 [inline]
> WARNING: CPU: 0 PID: 12 at drivers/infiniband/core/cache.c:820 gid_table_release_one+0x4fb/0x800 drivers/infiniband/core/cache.c:897
> Modules linked in:
> CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> Workqueue: ib-unreg-wq ib_unregister_work

The problem occurred in ib_unreg_wq. It is a workqueue in ib device.

I will work on this problem.

Yanjun.Zhu

> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:819 [inline]
> RIP: 0010:gid_table_release_one+0x4fb/0x800 drivers/infiniband/core/cache.c:897
> Code: 49 01 c6 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 be 01 00 00 41 8b 16 48 c7 c7 60 7d 2b 8c 44 89 e6 e8 16 e2 35 f9 90 <0f> 0b 90 90 e9 c4 fe ff ff e8 f7 76 72 f9 4c 8b 7c 24 48 4c 89 f8
> RSP: 0018:ffffc90000117900 EFLAGS: 00010246
> RAX: a2ec906fdf0a5800 RBX: ffff888030cab6d8 RCX: ffff88801c6e5ac0
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
> RBP: ffff888079d48010 R08: 0000000000000003 R09: 0000000000000004
> R10: dffffc0000000000 R11: fffffbfff1b7a680 R12: 0000000000000193
> R13: dffffc0000000000 R14: ffff888028a68690 R15: ffff888030cab600
> FS:  0000000000000000(0000) GS:ffff88812636a000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f49bf3056c0 CR3: 00000000772e8000 CR4: 00000000003526f0
> Call Trace:
>   <TASK>
>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>   device_release+0x9c/0x1c0 drivers/base/core.c:-1
>   kobject_cleanup lib/kobject.c:689 [inline]
>   kobject_release lib/kobject.c:720 [inline]
>   kref_put include/linux/kref.h:65 [inline]
>   kobject_put+0x22b/0x480 lib/kobject.c:737
>   process_one_work kernel/workqueue.c:3263 [inline]
>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>   </TASK>
>
>
> Tested on:
>
> commit:         690e9fda RDMA/core: Fix WARNING in gid_table_release_one
> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
> console output: https://syzkaller.appspot.com/x/log.txt?x=16bbb012580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>
> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <81fedfc2-8e6e-44f3-94d4-2c694c759ded@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <81fedfc2-8e6e-44f3-94d4-2c694c759ded@linux.dev>
@ 2025-11-06  4:02 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-06  4:02 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=353, state: 3
WARNING: CPU: 1 PID: 36 at drivers/infiniband/core/cache.c:817 release_gid_table drivers/infiniband/core/cache.c:814 [inline]
WARNING: CPU: 1 PID: 36 at drivers/infiniband/core/cache.c:817 gid_table_release_one+0x39e/0x570 drivers/infiniband/core/cache.c:894
Modules linked in:
CPU: 1 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:814 [inline]
RIP: 0010:gid_table_release_one+0x39e/0x570 drivers/infiniband/core/cache.c:894
Code: 04 28 84 c0 0f 85 9d 00 00 00 45 8b 06 48 c7 c7 60 7c 2b 8c 48 8b 74 24 28 4c 8b 74 24 08 44 89 f2 44 89 e1 e8 83 e9 35 f9 90 <0f> 0b 90 90 e9 c5 fe ff ff e8 64 7e 72 f9 4c 8b 64 24 40 4c 89 e0
RSP: 0018:ffffc90000ac7900 EFLAGS: 00010246
RAX: d89947cea50d0900 RBX: ffff888076c960d8 RCX: ffff8881436c9e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffff888076c96000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1b7a678 R12: 0000000000000161
R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff1100ed92c1b
FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b2bf056c0 CR3: 000000000db38000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         e365ec00 RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=17a24a92580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <38f2a630-7edc-4e9b-b5aa-3e983d67d024@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <38f2a630-7edc-4e9b-b5aa-3e983d67d024@linux.dev>
@ 2025-11-06  1:11 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-06  1:11 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=381, state: 3
WARNING: CPU: 0 PID: 3018 at drivers/infiniband/core/cache.c:829 release_gid_table drivers/infiniband/core/cache.c:826 [inline]
WARNING: CPU: 0 PID: 3018 at drivers/infiniband/core/cache.c:829 gid_table_release_one+0x64c/0x780 drivers/infiniband/core/cache.c:908
Modules linked in:
CPU: 0 UID: 0 PID: 3018 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:826 [inline]
RIP: 0010:gid_table_release_one+0x64c/0x780 drivers/infiniband/core/cache.c:908
Code: e8 03 0f b6 04 28 84 c0 0f 85 f1 00 00 00 44 8b 03 48 c7 c7 00 7d 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 05 e5 35 f9 90 <0f> 0b 90 90 44 8b 74 24 0c 4c 8b 64 24 48 48 8b 1c 24 e9 1a fe ff
RSP: 0018:ffffc9000bf478f0 EFLAGS: 00010246
RAX: eb4f68ae1be28b00 RBX: ffff888028b86a90 RCX: ffff88802e945ac0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1b7a680 R12: ffff8880746374d8
R13: 00000000000001a8 R14: ffff888054220010 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88812636a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1cff997f98 CR3: 000000007478c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         af436594 RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=15f6ca58580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <d8cba3c4-117b-4e7c-a442-d38d5289680f@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <d8cba3c4-117b-4e7c-a442-d38d5289680f@linux.dev>
@ 2025-11-05 19:36 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-05 19:36 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=328, state: 3
WARNING: CPU: 1 PID: 49 at drivers/infiniband/core/cache.c:829 release_gid_table drivers/infiniband/core/cache.c:826 [inline]
WARNING: CPU: 1 PID: 49 at drivers/infiniband/core/cache.c:829 gid_table_release_one+0x64c/0x780 drivers/infiniband/core/cache.c:908
Modules linked in:
CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:826 [inline]
RIP: 0010:gid_table_release_one+0x64c/0x780 drivers/infiniband/core/cache.c:908
Code: e8 03 0f b6 04 28 84 c0 0f 85 f1 00 00 00 44 8b 03 48 c7 c7 00 7d 2b 8c 48 8b 74 24 28 44 89 fa 8b 4c 24 50 e8 35 e5 35 f9 90 <0f> 0b 90 90 44 8b 74 24 0c 4c 8b 64 24 48 48 8b 1c 24 e9 1a fe ff
RSP: 0018:ffffc90000b978f0 EFLAGS: 00010246
RAX: 79fe70c1b2777a00 RBX: ffff88802780ac90 RCX: ffff888021eb0000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1b7a680 R12: ffff888075294cd8
R13: 00000000000001a8 R14: ffff88802e928010 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88812646a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 000000007e658000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         25f4e06f RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=109f532f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <c2d8fc24-08a7-47fe-8f68-cc9bbe6c55a4@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <c2d8fc24-08a7-47fe-8f68-cc9bbe6c55a4@linux.dev>
@ 2025-11-05 18:45 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-05 18:45 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         1c3df6de RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=10908532580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <198ed0eb-2451-4651-b723-a506e3cf853b@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <198ed0eb-2451-4651-b723-a506e3cf853b@linux.dev>
@ 2025-11-04 23:50 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-04 23:50 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         dd6adb14 RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=11041342580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <f5a387d4-eae3-4932-b170-37ff38ebe78d@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <f5a387d4-eae3-4932-b170-37ff38ebe78d@linux.dev>
@ 2025-11-04 23:22 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-11-04 23:22 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         dd6adb14 RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=16d81342580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2c614fa9e6f5bdc1
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <b0988506-dbc6-4d28-8f19-9c50bdc44f84@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <b0988506-dbc6-4d28-8f19-9c50bdc44f84@linux.dev>
@ 2025-09-18  6:13 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-18  6:13 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         1924f741 RDMA/core: Check kref leak
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=11feae42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <689cd5e4-1ebe-4b81-8036-68393d61f4ce@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <689cd5e4-1ebe-4b81-8036-68393d61f4ce@linux.dev>
@ 2025-09-16 22:21 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-16 22:21 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         e48b344c RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=16844534580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <295acd4d-1f40-455a-9d2f-27393cd047bd@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <295acd4d-1f40-455a-9d2f-27393cd047bd@linux.dev>
@ 2025-09-16 21:39 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-16 21:39 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=426, state: 3
WARNING: CPU: 1 PID: 36 at drivers/infiniband/core/cache.c:815 release_gid_table drivers/infiniband/core/cache.c:812 [inline]
WARNING: CPU: 1 PID: 36 at drivers/infiniband/core/cache.c:815 gid_table_release_one+0x606/0x7c0 drivers/infiniband/core/cache.c:898
Modules linked in:
CPU: 1 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:812 [inline]
RIP: 0010:gid_table_release_one+0x606/0x7c0 drivers/infiniband/core/cache.c:898
Code: 0f b6 04 28 84 c0 0f 85 80 00 00 00 44 8b 45 00 48 c7 c7 60 4b 71 8c 48 8b 74 24 38 48 8b 54 24 18 44 89 e1 e8 5b 7e fa f8 90 <0f> 0b 90 90 e9 f0 fb ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 8f
RSP: 0018:ffffc90000ac78f8 EFLAGS: 00010246
RAX: fc4e2f5b20774800 RBX: ffff8880786046d8 RCX: ffff8881442b1e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffff888024e8ee90 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: 00000000000001aa
R13: dffffc0000000000 R14: ffff8880227ec778 R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555b331808 CR3: 0000000026c94000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         59f2dceb RDMA/core: Fix WARNING in gid_table_release_one
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=133dfb12580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <bc6d2cd1-39a3-4b95-b8b1-92fecf28679d@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <bc6d2cd1-39a3-4b95-b8b1-92fecf28679d@linux.dev>
@ 2025-09-16 15:48 ` syzbot
  2025-09-16 16:12   ` Yanjun.Zhu
  0 siblings, 1 reply; 51+ messages in thread
From: syzbot @ 2025-09-16 15:48 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         cceb4136 RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=1242f762580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-16 15:48 ` syzbot
@ 2025-09-16 16:12   ` Yanjun.Zhu
  0 siblings, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-09-16 16:12 UTC (permalink / raw)
  To: syzbot, jgg, leon, linux-kernel, syzkaller-bugs

Thanks a lot. I will make an official patch for this and send it out 
very soon.

Yanjun.Zhu

On 9/16/25 8:48 AM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
> Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
>
> Tested on:
>
> commit:         cceb4136 RDMA/rxe: Add logs to find out the root cause
> git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
> console output: https://syzkaller.appspot.com/x/log.txt?x=1242f762580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>
> Note: no patches were applied.
> Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <a3dcd664-b39c-47ff-a61c-f834ba130a16@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <a3dcd664-b39c-47ff-a61c-f834ba130a16@linux.dev>
@ 2025-09-16  5:59 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-16  5:59 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=391, state: 3
WARNING: CPU: 0 PID: 36 at drivers/infiniband/core/cache.c:813 release_gid_table drivers/infiniband/core/cache.c:810 [inline]
WARNING: CPU: 0 PID: 36 at drivers/infiniband/core/cache.c:813 gid_table_release_one+0x34e/0x4f0 drivers/infiniband/core/cache.c:890
Modules linked in:
CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:810 [inline]
RIP: 0010:gid_table_release_one+0x34e/0x4f0 drivers/infiniband/core/cache.c:890
Code: 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 64 45 8b 06 48 c7 c7 60 4b 71 8c 48 8b 74 24 20 44 89 fa 89 e9 e8 13 81 fa f8 90 <0f> 0b 90 90 e9 ab fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90000ac78f8 EFLAGS: 00010246
RAX: 4a34fa8552892100 RBX: ffff888031fba0d8 RCX: ffff88801d6f3c00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000187 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: dffffc0000000000
R13: ffff888031fba000 R14: ffff8880744f8990 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125c16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f44957d5fa4 CR3: 000000002849e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         067ce8f1 RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=16304e42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <6aed82d8-8e65-402d-909e-b8cfbfbb41e4@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <6aed82d8-8e65-402d-909e-b8cfbfbb41e4@linux.dev>
@ 2025-09-16  2:10 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-16  2:10 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=450
WARNING: CPU: 1 PID: 59 at drivers/infiniband/core/cache.c:813 release_gid_table drivers/infiniband/core/cache.c:810 [inline]
WARNING: CPU: 1 PID: 59 at drivers/infiniband/core/cache.c:813 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:890
Modules linked in:
CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:810 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:890
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 60 4b 71 8c 4c 89 e6 44 89 fa e8 1b 81 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc9000210f908 EFLAGS: 00010246
RAX: 1a406f1d516b1b00 RBX: ffff88807d4a44d8 RCX: ffff88801bbf9e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100fa9489b R08: ffff8880b8724253 R09: 1ffff110170e484a
R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff8880202c6e80
R13: ffff88807d4a4400 R14: ffff88802566aa00 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 0000000024970000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         10a39576 RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=114d8e42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <d61c07c8-c5c1-4cfe-ad23-d972eaff8b9b@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <d61c07c8-c5c1-4cfe-ad23-d972eaff8b9b@linux.dev>
@ 2025-09-16  1:12 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-16  1:12 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=414
WARNING: CPU: 1 PID: 61 at drivers/infiniband/core/cache.c:813 release_gid_table drivers/infiniband/core/cache.c:810 [inline]
WARNING: CPU: 1 PID: 61 at drivers/infiniband/core/cache.c:813 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:890
Modules linked in:
CPU: 1 UID: 0 PID: 61 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:810 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:890
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 60 4b 71 8c 4c 89 e6 44 89 fa e8 1b 81 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc9000212f908 EFLAGS: 00010246
RAX: 083e9d4088da4900 RBX: ffff888077e080d8 RCX: ffff88801cb65a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100efc101b R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: ffff8880335d2fa0
R13: ffff888077e08000 R14: ffff8880305cae00 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c003586000 CR3: 0000000031e18000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         77403d3f RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=1399547c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <e50a6a79-6c0c-4313-a09e-a69d8456b202@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <e50a6a79-6c0c-4313-a09e-a69d8456b202@linux.dev>
@ 2025-09-15 22:14 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 22:14 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=468
WARNING: CPU: 0 PID: 1038 at drivers/infiniband/core/cache.c:811 release_gid_table drivers/infiniband/core/cache.c:808 [inline]
WARNING: CPU: 0 PID: 1038 at drivers/infiniband/core/cache.c:811 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:888
Modules linked in:
CPU: 0 UID: 0 PID: 1038 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:808 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:888
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 4b 71 8c 4c 89 e6 44 89 fa e8 2b 82 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90003aaf908 EFLAGS: 00010246
RAX: d857da1c4d948b00 RBX: ffff88807e2b14d8 RCX: ffff8880265b5a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100fc5629b R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: ffff888027d6d8e0
R13: ffff88807e2b1400 R14: ffff888025ba0100 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125c16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe16e9d7dac CR3: 000000000df36000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         3a2493fa RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=1662547c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <7d02a204-fcf6-42c5-b9ad-b7238b9c703b@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <7d02a204-fcf6-42c5-b9ad-b7238b9c703b@linux.dev>
@ 2025-09-15 21:14 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 21:14 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git\u00a0v6.17_fix_gid_table_release_one"


^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <dfb7c3c3-dba2-4c99-9347-50715e652c59@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <dfb7c3c3-dba2-4c99-9347-50715e652c59@linux.dev>
@ 2025-09-15 20:55 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 20:55 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git"

>
> On 9/15/25 12:07 PM, Yanjun.Zhu wrote:
>> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> On 9/12/25 3:04 PM, syzbot wrote:
>>> Hello,
>>>
>>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>>> WARNING in gid_table_release_one
>>>
>>> ------------[ cut here ]------------
>>> GID entry ref leak for dev syz1 index 2 ref=445
>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>>> Modules linked in:
>>> CPU: 1 UID: 0 PID: 1088 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full)
>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>>> Workqueue: ib-unreg-wq ib_unregister_work
>>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>>> RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>>> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
>>> RSP: 0018:ffffc90003d0f908 EFLAGS: 00010246
>>> RAX: 11007f8b953ea200 RBX: ffff88802d562cd8 RCX: ffff888026adda00
>>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>>> RBP: 1ffff11005aac59b R08: ffff8880b8724253 R09: 1ffff110170e484a
>>> R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888028265480
>>> R13: ffff88802d562c00 R14: ffff8880779b1800 R15: 0000000000000002
>>> FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 0000200000000240 CR3: 000000007612e000 CR4: 00000000003526f0
>>> Call Trace:
>>>   <TASK>
>>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>>   device_release+0x99/0x1c0 drivers/base/core.c:-1
>>>   kobject_cleanup lib/kobject.c:689 [inline]
>>>   kobject_release lib/kobject.c:720 [inline]
>>>   kref_put include/linux/kref.h:65 [inline]
>>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>>   process_one_work kernel/workqueue.c:3236 [inline]
>>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
>>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>>>   kthread+0x70e/0x8a0 kernel/kthread.c:463
>>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
>>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>   </TASK>
>>>
>>>
>>> Tested on:
>>>
>>> commit:         dd87fd3f RDMA/rxe: Add logs to find out the root cause
>>> git tree:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>>> console output:https://syzkaller.appspot.com/x/log.txt?x=144a9934580000
>>> kernel config:https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
>>> dashboard link:https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>>
>>> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <1ea1efd9-4c9d-4432-82b7-f8998bd4e421@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <1ea1efd9-4c9d-4432-82b7-f8998bd4e421@linux.dev>
@ 2025-09-15 19:39 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 19:39 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git"

>
>
> On 9/15/25 12:16 PM, Yanjun.Zhu wrote:
>> #syz test:https://github.com/zhuyj/linux.git 
>> v6.17_fix_gid_table_release_one
>>
>>
>> On 9/15/25 12:07 PM, syzbot wrote:
>>>> #syz test:https://github.com/zhuyj/linux.git 
>>>> v6.17_fix_gid_table_release_one
>>> unknown command "test:https://github.com/zhuyj/linux.git"
>>>
>>>> On 9/12/25 3:04 PM, syzbot wrote:
>>>>> Hello,
>>>>>
>>>>> syzbot has tested the proposed patch but the reproducer is still 
>>>>> triggering an issue:
>>>>> WARNING in gid_table_release_one
>>>>>
>>>>> ------------[ cut here ]------------
>>>>> GID entry ref leak for dev syz1 index 2 ref=445
>>>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 
>>>>> release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>>>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 
>>>>> gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>>>>> Modules linked in:
>>>>> CPU: 1 UID: 0 PID: 1088 Comm: kworker/u8:5 Not tainted syzkaller #0 
>>>>> PREEMPT(full)
>>>>> Hardware name: Google Google Compute Engine/Google Compute Engine, 
>>>>> BIOS Google 08/18/2025
>>>>> Workqueue: ib-unreg-wq ib_unregister_work
>>>>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 
>>>>> [inline]
>>>>> RIP: 0010:gid_table_release_one+0x346/0x4d0 
>>>>> drivers/infiniband/core/cache.c:886
>>>>> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 
>>>>> 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 
>>>>> <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
>>>>> RSP: 0018:ffffc90003d0f908 EFLAGS: 00010246
>>>>> RAX: 11007f8b953ea200 RBX: ffff88802d562cd8 RCX: ffff888026adda00
>>>>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>>>>> RBP: 1ffff11005aac59b R08: ffff8880b8724253 R09: 1ffff110170e484a
>>>>> R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888028265480
>>>>> R13: ffff88802d562c00 R14: ffff8880779b1800 R15: 0000000000000002
>>>>> FS:  0000000000000000(0000) GS:ffff888125d16000(0000) 
>>>>> knlGS:0000000000000000
>>>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>> CR2: 0000200000000240 CR3: 000000007612e000 CR4: 00000000003526f0
>>>>> Call Trace:
>>>>>    <TASK>
>>>>>    ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>>>>    device_release+0x99/0x1c0 drivers/base/core.c:-1
>>>>>    kobject_cleanup lib/kobject.c:689 [inline]
>>>>>    kobject_release lib/kobject.c:720 [inline]
>>>>>    kref_put include/linux/kref.h:65 [inline]
>>>>>    kobject_put+0x22b/0x480 lib/kobject.c:737
>>>>>    process_one_work kernel/workqueue.c:3236 [inline]
>>>>>    process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
>>>>>    worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>>>>>    kthread+0x70e/0x8a0 kernel/kthread.c:463
>>>>>    ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
>>>>>    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>>>    </TASK>
>>>>>
>>>>>
>>>>> Tested on:
>>>>>
>>>>> commit:         dd87fd3f RDMA/rxe: Add logs to find out the root cause
>>>>> git tree:https://github.com/zhuyj/linux.git 
>>>>> v6.17_fix_gid_table_release_one
>>>>> console 
>>>>> output:https://syzkaller.appspot.com/x/log.txt?x=144a9934580000
>>>>> kernel 
>>>>> config:https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
>>>>> dashboard 
>>>>> link:https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>>>>> compiler:       Debian clang version 20.1.8 
>>>>> (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian 
>>>>> LLD 20.1.8
>>>>>
>>>>> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <b06c5a01-839f-47bf-9530-705ec838fcbe@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <b06c5a01-839f-47bf-9530-705ec838fcbe@linux.dev>
@ 2025-09-15 19:16 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 19:16 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git"

>
>
> On 9/15/25 12:07 PM, syzbot wrote:
>>> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> unknown command "test:https://github.com/zhuyj/linux.git"
>>
>>> On 9/12/25 3:04 PM, syzbot wrote:
>>>> Hello,
>>>>
>>>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>>>> WARNING in gid_table_release_one
>>>>
>>>> ------------[ cut here ]------------
>>>> GID entry ref leak for dev syz1 index 2 ref=445
>>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>>>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>>>> Modules linked in:
>>>> CPU: 1 UID: 0 PID: 1088 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full)
>>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>>>> Workqueue: ib-unreg-wq ib_unregister_work
>>>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>>>> RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>>>> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
>>>> RSP: 0018:ffffc90003d0f908 EFLAGS: 00010246
>>>> RAX: 11007f8b953ea200 RBX: ffff88802d562cd8 RCX: ffff888026adda00
>>>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>>>> RBP: 1ffff11005aac59b R08: ffff8880b8724253 R09: 1ffff110170e484a
>>>> R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888028265480
>>>> R13: ffff88802d562c00 R14: ffff8880779b1800 R15: 0000000000000002
>>>> FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
>>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>> CR2: 0000200000000240 CR3: 000000007612e000 CR4: 00000000003526f0
>>>> Call Trace:
>>>>    <TASK>
>>>>    ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>>>    device_release+0x99/0x1c0 drivers/base/core.c:-1
>>>>    kobject_cleanup lib/kobject.c:689 [inline]
>>>>    kobject_release lib/kobject.c:720 [inline]
>>>>    kref_put include/linux/kref.h:65 [inline]
>>>>    kobject_put+0x22b/0x480 lib/kobject.c:737
>>>>    process_one_work kernel/workqueue.c:3236 [inline]
>>>>    process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
>>>>    worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>>>>    kthread+0x70e/0x8a0 kernel/kthread.c:463
>>>>    ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
>>>>    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>>>    </TASK>
>>>>
>>>>
>>>> Tested on:
>>>>
>>>> commit:         dd87fd3f RDMA/rxe: Add logs to find out the root cause
>>>> git tree:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>>>> console output:https://syzkaller.appspot.com/x/log.txt?x=144a9934580000
>>>> kernel config:https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
>>>> dashboard link:https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>>>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>>>
>>>> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <5fb34b0f-435e-4584-abe0-bbf7839b44df@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <5fb34b0f-435e-4584-abe0-bbf7839b44df@linux.dev>
@ 2025-09-15 19:07 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-15 19:07 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git"

>
> On 9/12/25 3:04 PM, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> WARNING in gid_table_release_one
>>
>> ------------[ cut here ]------------
>> GID entry ref leak for dev syz1 index 2 ref=445
>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>> WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 1088 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>> Workqueue: ib-unreg-wq ib_unregister_work
>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>> RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
>> RSP: 0018:ffffc90003d0f908 EFLAGS: 00010246
>> RAX: 11007f8b953ea200 RBX: ffff88802d562cd8 RCX: ffff888026adda00
>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>> RBP: 1ffff11005aac59b R08: ffff8880b8724253 R09: 1ffff110170e484a
>> R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888028265480
>> R13: ffff88802d562c00 R14: ffff8880779b1800 R15: 0000000000000002
>> FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 0000200000000240 CR3: 000000007612e000 CR4: 00000000003526f0
>> Call Trace:
>>   <TASK>
>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>   device_release+0x99/0x1c0 drivers/base/core.c:-1
>>   kobject_cleanup lib/kobject.c:689 [inline]
>>   kobject_release lib/kobject.c:720 [inline]
>>   kref_put include/linux/kref.h:65 [inline]
>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>   process_one_work kernel/workqueue.c:3236 [inline]
>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>>   kthread+0x70e/0x8a0 kernel/kthread.c:463
>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>   </TASK>
>>
>>
>> Tested on:
>>
>> commit:         dd87fd3f RDMA/rxe: Add logs to find out the root cause
>> git tree:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> console output:https://syzkaller.appspot.com/x/log.txt?x=144a9934580000
>> kernel config:https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
>> dashboard link:https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>
>> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <b678b916-ad9f-4845-91b5-2e5d1f79fe24@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <b678b916-ad9f-4845-91b5-2e5d1f79fe24@linux.dev>
@ 2025-09-12 22:04 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12 22:04 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=445
WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
WARNING: CPU: 1 PID: 1088 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Modules linked in:
CPU: 1 UID: 0 PID: 1088 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90003d0f908 EFLAGS: 00010246
RAX: 11007f8b953ea200 RBX: ffff88802d562cd8 RCX: ffff888026adda00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff11005aac59b R08: ffff8880b8724253 R09: 1ffff110170e484a
R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888028265480
R13: ffff88802d562c00 R14: ffff8880779b1800 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 000000007612e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x99/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         dd87fd3f RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=144a9934580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <19d2990f-ba92-4fef-891d-26baf03afe18@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <19d2990f-ba92-4fef-891d-26baf03afe18@linux.dev>
@ 2025-09-12 21:43 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12 21:43 UTC (permalink / raw)
  To: yanjun.zhu; +Cc: jgg, leon, yanjun.zhu, linux-kernel, syzkaller-bugs

> #syz test:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one

unknown command "test:https://github.com/zhuyj/linux.git"

>
> On 9/12/25 2:20 PM, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> WARNING in gid_table_release_one
>>
>> WARNING: CPU: 1 PID: 1342 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>> WARNING: CPU: 1 PID: 1342 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 1342 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
>> Workqueue: ib-unreg-wq ib_unregister_work
>> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
>> RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
>> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
>> RSP: 0018:ffffc90004bff908 EFLAGS: 00010246
>> RAX: 6115427e6ab01100 RBX: ffff88807855c2d8 RCX: ffff888027abbc00
>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
>> RBP: 1ffff1100f0ab85b R08: 0000000000000003 R09: 0000000000000004
>> R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: ffff8880206a4b40
>> R13: ffff88807855c200 R14: ffff88801ffd5a00 R15: 0000000000000002
>> FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 0000200000000240 CR3: 000000005e54a000 CR4: 00000000003526f0
>> Call Trace:
>>   <TASK>
>>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>>   device_release+0x99/0x1c0 drivers/base/core.c:-1
>>   kobject_cleanup lib/kobject.c:689 [inline]
>>   kobject_release lib/kobject.c:720 [inline]
>>   kref_put include/linux/kref.h:65 [inline]
>>   kobject_put+0x22b/0x480 lib/kobject.c:737
>>   process_one_work kernel/workqueue.c:3236 [inline]
>>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
>>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>>   kthread+0x70e/0x8a0 kernel/kthread.c:463
>>   ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
>>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>>   </TASK>
>>
>>
>> Tested on:
>>
>> commit:         e5320428 RDMA/rxe: Add logs to find out the root cause
>> git tree:https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
>> console output:https://syzkaller.appspot.com/x/log.txt?x=12829934580000
>> kernel config:https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
>> dashboard link:https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
>> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>
>> Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

[parent not found: <c9778714-2966-4b61-b371-9d831bd2492e@linux.dev>]

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
       [not found] <c9778714-2966-4b61-b371-9d831bd2492e@linux.dev>
@ 2025-09-12 21:20 ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12 21:20 UTC (permalink / raw)
  To: linux-kernel, syzkaller-bugs, yanjun.zhu

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

WARNING: CPU: 1 PID: 1342 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
WARNING: CPU: 1 PID: 1342 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Modules linked in:
CPU: 1 UID: 0 PID: 1342 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 00 46 71 8c 4c 89 e6 44 89 fa e8 3b a5 fa f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90004bff908 EFLAGS: 00010246
RAX: 6115427e6ab01100 RBX: ffff88807855c2d8 RCX: ffff888027abbc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100f0ab85b R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa24c R12: ffff8880206a4b40
R13: ffff88807855c200 R14: ffff88801ffd5a00 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000240 CR3: 000000005e54a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x99/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         e5320428 RDMA/rxe: Add logs to find out the root cause
git tree:       https://github.com/zhuyj/linux.git v6.17_fix_gid_table_release_one
console output: https://syzkaller.appspot.com/x/log.txt?x=12829934580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4239c29711f936f
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* [syzbot] [rdma?] WARNING in gid_table_release_one (3)
@ 2025-05-13 11:35 syzbot
  2025-05-14  8:54 ` Leon Romanovsky
                   ` (2 more replies)
  0 siblings, 3 replies; 51+ messages in thread
From: syzbot @ 2025-05-13 11:35 UTC (permalink / raw)
  To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    c32f8dc5aaf9 Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10789768580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ea4635ffd6ad5b4a
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b921498959d4/disk-c32f8dc5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/04e6ad946c4b/vmlinux-c32f8dc5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d4f0d8db50ee/Image-c32f8dc5.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

--
------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=573
WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
Modules linked in:
CPU: 1 UID: 0 PID: 655 Comm: kworker/u8:10 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: ib-unreg-wq ib_unregister_work
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
pc : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
lr : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
lr : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
sp : ffff80009c927860
x29: ffff80009c9278b0 x28: ffff0000d2b52f00 x27: ffff0000d77ee8d8
x26: ffff0000d77ee800 x25: 0000000000000010 x24: 0000000000000001
x23: ffff800092818000 x22: dfff800000000000 x21: 0000000000000003
x20: 1fffe0001aefdd1b x19: 1fffe0001aefdd00 x18: 00000000ffffffff
x17: 0000000000000000 x16: ffff80008adb410c x15: 0000000000000001
x14: 1fffe000338716e2 x13: 0000000000000000 x12: 0000000000000000
x11: ffff6000338716e3 x10: 0000000000ff0100 x9 : 1b90c18326689500
x8 : 1b90c18326689500 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009c9271b8 x4 : ffff80008f405b40 x3 : ffff8000807b1330
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
 release_gid_table drivers/infiniband/core/cache.c:806 [inline] (P)
 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 (P)
 ib_cache_release_one+0x144/0x174 drivers/infiniband/core/cache.c:1636
 ib_device_release+0xc4/0x194 drivers/infiniband/core/device.c:482
 device_release+0x8c/0x1ac drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x2b0/0x438 lib/kobject.c:737
 put_device+0x28/0x40 drivers/base/core.c:3800
 ib_unregister_work+0x28/0x38 drivers/infiniband/core/device.c:1629
 process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3400
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
irq event stamp: 1499918
hardirqs last  enabled at (1499917): [<ffff80008054cc08>] __up_console_sem kernel/printk/printk.c:344 [inline]
hardirqs last  enabled at (1499917): [<ffff80008054cc08>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2885
hardirqs last disabled at (1499918): [<ffff80008adaf5e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511
softirqs last  enabled at (1496318): [<ffff8000803cbf1c>] softirq_handle_end kernel/softirq.c:425 [inline]
softirqs last  enabled at (1496318): [<ffff8000803cbf1c>] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607
softirqs last disabled at (1496303): [<ffff800080020efc>] __do_softirq+0x14/0x20 kernel/softirq.c:613
---[ end trace 0000000000000000 ]---
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-05-13 11:35 syzbot
@ 2025-05-14  8:54 ` Leon Romanovsky
  2025-09-17 12:45   ` Jason Gunthorpe
  2025-09-11 15:34 ` syzbot
  2025-09-12  4:42 ` syzbot
  2 siblings, 1 reply; 51+ messages in thread
From: Leon Romanovsky @ 2025-05-14  8:54 UTC (permalink / raw)
  To: jgg; +Cc: syzbot, linux-kernel, linux-rdma, syzkaller-bugs

On Tue, May 13, 2025 at 04:35:23AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    c32f8dc5aaf9 Merge branch 'for-next/core' into for-kernelci
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=10789768580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=ea4635ffd6ad5b4a
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b921498959d4/disk-c32f8dc5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/04e6ad946c4b/vmlinux-c32f8dc5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/d4f0d8db50ee/Image-c32f8dc5.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
> 
> --
> ------------[ cut here ]------------
> GID entry ref leak for dev syz1 index 2 ref=573

Jason,

According to repro https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000, we joined multicast group,
but never left it. This is how we can get "ref=573".

write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={<r2=>0xffffffffffffffff}, 0x13f, 0x4}}, 0x20)
write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r2}}, 0x30)
write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r2, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0)

Thanks

> WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> Modules linked in:
> CPU: 1 UID: 0 PID: 655 Comm: kworker/u8:10 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> Workqueue: ib-unreg-wq ib_unregister_work
> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> pc : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> lr : release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> lr : gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
> sp : ffff80009c927860
> x29: ffff80009c9278b0 x28: ffff0000d2b52f00 x27: ffff0000d77ee8d8
> x26: ffff0000d77ee800 x25: 0000000000000010 x24: 0000000000000001
> x23: ffff800092818000 x22: dfff800000000000 x21: 0000000000000003
> x20: 1fffe0001aefdd1b x19: 1fffe0001aefdd00 x18: 00000000ffffffff
> x17: 0000000000000000 x16: ffff80008adb410c x15: 0000000000000001
> x14: 1fffe000338716e2 x13: 0000000000000000 x12: 0000000000000000
> x11: ffff6000338716e3 x10: 0000000000ff0100 x9 : 1b90c18326689500
> x8 : 1b90c18326689500 x7 : 0000000000000001 x6 : 0000000000000001
> x5 : ffff80009c9271b8 x4 : ffff80008f405b40 x3 : ffff8000807b1330
> x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
> Call trace:
>  release_gid_table drivers/infiniband/core/cache.c:806 [inline] (P)
>  gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 (P)
>  ib_cache_release_one+0x144/0x174 drivers/infiniband/core/cache.c:1636
>  ib_device_release+0xc4/0x194 drivers/infiniband/core/device.c:482
>  device_release+0x8c/0x1ac drivers/base/core.c:-1
>  kobject_cleanup lib/kobject.c:689 [inline]
>  kobject_release lib/kobject.c:720 [inline]
>  kref_put include/linux/kref.h:65 [inline]
>  kobject_put+0x2b0/0x438 lib/kobject.c:737
>  put_device+0x28/0x40 drivers/base/core.c:3800
>  ib_unregister_work+0x28/0x38 drivers/infiniband/core/device.c:1629
>  process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
>  process_scheduled_works kernel/workqueue.c:3319 [inline]
>  worker_thread+0x958/0xed8 kernel/workqueue.c:3400
>  kthread+0x5fc/0x75c kernel/kthread.c:464
>  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
> irq event stamp: 1499918
> hardirqs last  enabled at (1499917): [<ffff80008054cc08>] __up_console_sem kernel/printk/printk.c:344 [inline]
> hardirqs last  enabled at (1499917): [<ffff80008054cc08>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2885
> hardirqs last disabled at (1499918): [<ffff80008adaf5e0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511
> softirqs last  enabled at (1496318): [<ffff8000803cbf1c>] softirq_handle_end kernel/softirq.c:425 [inline]
> softirqs last  enabled at (1496318): [<ffff8000803cbf1c>] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:607
> softirqs last disabled at (1496303): [<ffff800080020efc>] __do_softirq+0x14/0x20 kernel/softirq.c:613
> ---[ end trace 0000000000000000 ]---
> wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
> wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-05-14  8:54 ` Leon Romanovsky
@ 2025-09-17 12:45   ` Jason Gunthorpe
  0 siblings, 0 replies; 51+ messages in thread
From: Jason Gunthorpe @ 2025-09-17 12:45 UTC (permalink / raw)
  To: Leon Romanovsky; +Cc: syzbot, linux-kernel, linux-rdma, syzkaller-bugs

On Wed, May 14, 2025 at 11:54:21AM +0300, Leon Romanovsky wrote:

> According to repro https://syzkaller.appspot.com/x/repro.syz?x=15a08cf4580000, we joined multicast group,
> but never left it. This is how we can get "ref=573".
> 
> write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={<r2=>0xffffffffffffffff}, 0x13f, 0x4}}, 0x20)
> write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r2}}, 0x30)
> write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x5, r2, 0x10, 0x1, @in={0x2, 0x4e23, @loopback}}}, 0xa0)

This should be fine, it is supposed to get cleaned up.

I think it is more likely there is a refcount leak on an error path..

Jason

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-05-13 11:35 syzbot
  2025-05-14  8:54 ` Leon Romanovsky
@ 2025-09-11 15:34 ` syzbot
  2025-09-12  3:39   ` Hillf Danton
                     ` (5 more replies)
  2025-09-12  4:42 ` syzbot
  2 siblings, 6 replies; 51+ messages in thread
From: syzbot @ 2025-09-11 15:34 UTC (permalink / raw)
  To: edwards, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs

syzbot has found a reproducer for the following issue on:

HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/df0dfb072f52/disk-5f540c4a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/20649042ae30/vmlinux-5f540c4a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4c16358268b8/bzImage-5f540c4a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=615
WARNING: drivers/infiniband/core/cache.c:809 at release_gid_table drivers/infiniband/core/cache.c:806 [inline], CPU#0: kworker/u8:2/36
WARNING: drivers/infiniband/core/cache.c:809 at gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886, CPU#0: kworker/u8:2/36
Modules linked in:
CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 a0 43 91 8c 4c 89 e6 44 89 fa e8 fb 67 f5 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90000ac7908 EFLAGS: 00010246
RAX: 621d731dcb27e200 RBX: ffff88806241b8d8 RCX: ffff888141289e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100c48371b R08: ffff8880b8724253 R09: 1ffff110170e484a
R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888027503e00
R13: ffff88806241b800 R14: ffff8880289a2400 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8881259f0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555569847588 CR3: 00000000338c8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
 device_release+0x99/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x228/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
@ 2025-09-12  3:39   ` Hillf Danton
  2025-09-12  4:05     ` syzbot
  2025-09-12  8:33   ` Hillf Danton
                     ` (4 subsequent siblings)
  5 siblings, 1 reply; 51+ messages in thread
From: Hillf Danton @ 2025-09-12  3:39 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

> Date: Thu, 11 Sep 2025 08:34:25 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

#syz test

--- x/drivers/infiniband/core/device.c
+++ y/drivers/infiniband/core/device.c
@@ -506,6 +506,7 @@ static void ib_device_release(struct dev
 	if (dev->hw_stats_data)
 		ib_device_release_hw_stats(dev->hw_stats_data);
 	if (dev->port_data) {
+		ib_cache_cleanup_one(dev);
 		ib_cache_release_one(dev);
 		ib_security_release_port_pkey_list(dev);
 		rdma_counter_release(dev);
--

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12  3:39   ` Hillf Danton
@ 2025-09-12  4:05     ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12  4:05 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

mm/slub.c:3960:27: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes]


Tested on:

commit:         8f21d9da Add linux-next specific files for 20250911
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=168ba362580000


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
  2025-09-12  3:39   ` Hillf Danton
@ 2025-09-12  8:33   ` Hillf Danton
  2025-09-12  8:36     ` syzbot
  2025-09-12  9:42   ` Hillf Danton
                     ` (3 subsequent siblings)
  5 siblings, 1 reply; 51+ messages in thread
From: Hillf Danton @ 2025-09-12  8:33 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

> Date: Thu, 11 Sep 2025 08:34:25 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

#syz test

--- x/drivers/infiniband/core/device.c
+++ y/drivers/infiniband/core/device.c
@@ -506,6 +506,7 @@ static void ib_device_release(struct dev
 	if (dev->hw_stats_data)
 		ib_device_release_hw_stats(dev->hw_stats_data);
 	if (dev->port_data) {
+		ib_cache_cleanup_one(dev);
 		ib_cache_release_one(dev);
 		ib_security_release_port_pkey_list(dev);
 		rdma_counter_release(dev);
--- x/mm/slub.c
+++ y/mm/slub.c
@@ -3957,7 +3957,7 @@ static void flush_rcu_sheaf(struct work_
 
 
 /* needed for kvfree_rcu_barrier() */
-void flush_all_rcu_sheaves()
+void flush_all_rcu_sheaves(void)
 {
 	struct slub_percpu_sheaves *pcs;
 	struct slub_flush_work *sfw;
--

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12  8:33   ` Hillf Danton
@ 2025-09-12  8:36     ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12  8:36 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file drivers/infiniband/core/device.c
checking file mm/slub.c
Hunk #1 FAILED at 3957.
1 out of 1 hunk FAILED



Tested on:

commit:         590b221e Add linux-next specific files for 20250912
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17bfe934580000


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
  2025-09-12  3:39   ` Hillf Danton
  2025-09-12  8:33   ` Hillf Danton
@ 2025-09-12  9:42   ` Hillf Danton
  2025-09-12 13:23     ` syzbot
  2025-09-13  1:25   ` Hillf Danton
                     ` (2 subsequent siblings)
  5 siblings, 1 reply; 51+ messages in thread
From: Hillf Danton @ 2025-09-12  9:42 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

> Date: Thu, 11 Sep 2025 08:34:25 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

#syz test

--- x/drivers/infiniband/core/device.c
+++ y/drivers/infiniband/core/device.c
@@ -506,6 +506,7 @@ static void ib_device_release(struct dev
 	if (dev->hw_stats_data)
 		ib_device_release_hw_stats(dev->hw_stats_data);
 	if (dev->port_data) {
+		ib_cache_cleanup_one(dev);
 		ib_cache_release_one(dev);
 		ib_security_release_port_pkey_list(dev);
 		rdma_counter_release(dev);
--

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12  9:42   ` Hillf Danton
@ 2025-09-12 13:23     ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-12 13:23 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=580
WARNING: drivers/infiniband/core/cache.c:809 at release_gid_table drivers/infiniband/core/cache.c:806 [inline], CPU#0: kworker/u8:1/13
WARNING: drivers/infiniband/core/cache.c:809 at gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886, CPU#0: kworker/u8:1/13
Modules linked in:
CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 a0 56 91 8c 4c 89 e6 44 89 fa e8 1b a8 f4 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc90000127908 EFLAGS: 00010246
RAX: a8b5d3ea91c5d400 RBX: ffff888026a6b6d8 RCX: ffff88801d298000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff11004d4d6db R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1c3a6c8 R12: ffff88802f551b00
R13: ffff888026a6b600 R14: ffff88802899a700 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8881259e8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555f9ed808 CR3: 0000000033a60000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xda/0x1d0 drivers/infiniband/core/device.c:510
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         590b221e Add linux-next specific files for 20250912
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=151eeb12580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12a1d1f3a8199632
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15381934580000


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
                     ` (2 preceding siblings ...)
  2025-09-12  9:42   ` Hillf Danton
@ 2025-09-13  1:25   ` Hillf Danton
  2025-09-13  2:48     ` syzbot
  2025-09-13  7:25   ` Hillf Danton
  2025-09-16 16:15   ` yanjun.zhu
  5 siblings, 1 reply; 51+ messages in thread
From: Hillf Danton @ 2025-09-13  1:25 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

> Date: Thu, 11 Sep 2025 08:34:25 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

#syz test

--- x/drivers/infiniband/core/device.c
+++ y/drivers/infiniband/core/device.c
@@ -506,6 +506,7 @@ static void ib_device_release(struct dev
 	if (dev->hw_stats_data)
 		ib_device_release_hw_stats(dev->hw_stats_data);
 	if (dev->port_data) {
+		ib_cache_cleanup_one(dev);
 		ib_cache_release_one(dev);
 		ib_security_release_port_pkey_list(dev);
 		rdma_counter_release(dev);
--- x/drivers/infiniband/core/cache.c
+++ y/drivers/infiniband/core/cache.c
@@ -824,7 +824,7 @@ static void cleanup_gid_table_port(struc
 
 	mutex_lock(&table->lock);
 	for (i = 0; i < table->sz; ++i) {
-		if (is_gid_entry_valid(table->data_vec[i]))
+		if (table->data_vec[i])
 			del_gid(ib_dev, port, table, i);
 	}
 	mutex_unlock(&table->lock);
--

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-13  1:25   ` Hillf Danton
@ 2025-09-13  2:48     ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-13  2:48 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gid_table_release_one

------------[ cut here ]------------
GID entry ref leak for dev syz1 index 2 ref=452
WARNING: drivers/infiniband/core/cache.c:809 at release_gid_table drivers/infiniband/core/cache.c:806 [inline], CPU#1: kworker/u8:6/2125
WARNING: drivers/infiniband/core/cache.c:809 at gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886, CPU#1: kworker/u8:6/2125
Modules linked in:
CPU: 1 UID: 0 PID: 2125 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: ib-unreg-wq ib_unregister_work
RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 a0 56 91 8c 4c 89 e6 44 89 fa e8 7b a8 f4 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
RSP: 0018:ffffc900050a7908 EFLAGS: 00010246
RAX: aa4d2ac68a741700 RBX: ffff888075471cd8 RCX: ffff888029ac9e40
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 1ffff1100ea8e39b R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1c3a6c8 R12: ffff888028a5fe20
R13: ffff888075471c00 R14: ffff8880291e4000 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888125ae8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556a47588 CR3: 000000007a4a8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ib_device_release+0xda/0x1d0 drivers/infiniband/core/device.c:510
 device_release+0x9c/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22b/0x480 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


Tested on:

commit:         590b221e Add linux-next specific files for 20250912
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=16939934580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12a1d1f3a8199632
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12a76b62580000


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
                     ` (3 preceding siblings ...)
  2025-09-13  1:25   ` Hillf Danton
@ 2025-09-13  7:25   ` Hillf Danton
  2025-09-13  8:06     ` syzbot
  2025-09-16 16:15   ` yanjun.zhu
  5 siblings, 1 reply; 51+ messages in thread
From: Hillf Danton @ 2025-09-13  7:25 UTC (permalink / raw)
  To: syzbot; +Cc: linux-kernel, syzkaller-bugs

> Date: Thu, 11 Sep 2025 08:34:25 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

#syz test

--- x/drivers/infiniband/core/device.c
+++ y/drivers/infiniband/core/device.c
@@ -506,6 +506,7 @@ static void ib_device_release(struct dev
 	if (dev->hw_stats_data)
 		ib_device_release_hw_stats(dev->hw_stats_data);
 	if (dev->port_data) {
+		ib_cache_cleanup_one(dev);
 		ib_cache_release_one(dev);
 		ib_security_release_port_pkey_list(dev);
 		rdma_counter_release(dev);
--- x/drivers/infiniband/core/cache.c
+++ y/drivers/infiniband/core/cache.c
@@ -393,11 +393,7 @@ static void del_gid(struct ib_device *ib
 	write_lock_irq(&table->rwlock);
 	entry = table->data_vec[ix];
 	entry->state = GID_TABLE_ENTRY_PENDING_DEL;
-	/*
-	 * For non RoCE protocol, GID entry slot is ready to use.
-	 */
-	if (!rdma_protocol_roce(ib_dev, port))
-		table->data_vec[ix] = NULL;
+	table->data_vec[ix] = NULL;
 	write_unlock_irq(&table->rwlock);
 
 	if (rdma_cap_roce_gid_table(ib_dev, port))
@@ -824,7 +820,7 @@ static void cleanup_gid_table_port(struc
 
 	mutex_lock(&table->lock);
 	for (i = 0; i < table->sz; ++i) {
-		if (is_gid_entry_valid(table->data_vec[i]))
+		if (table->data_vec[i])
 			del_gid(ib_dev, port, table, i);
 	}
 	mutex_unlock(&table->lock);
--

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-13  7:25   ` Hillf Danton
@ 2025-09-13  8:06     ` syzbot
  0 siblings, 0 replies; 51+ messages in thread
From: syzbot @ 2025-09-13  8:06 UTC (permalink / raw)
  To: hdanton, linux-kernel, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Tested-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

Tested on:

commit:         590b221e Add linux-next specific files for 20250912
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14009b12580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=12a1d1f3a8199632
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1135d642580000

Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-11 15:34 ` syzbot
                     ` (4 preceding siblings ...)
  2025-09-13  7:25   ` Hillf Danton
@ 2025-09-16 16:15   ` yanjun.zhu
  5 siblings, 0 replies; 51+ messages in thread
From: yanjun.zhu @ 2025-09-16 16:15 UTC (permalink / raw)
  To: syzbot, edwards, jgg, leon, linux-kernel, linux-rdma,
	syzkaller-bugs

On 9/11/25 8:34 AM, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/df0dfb072f52/disk-5f540c4a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/20649042ae30/vmlinux-5f540c4a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4c16358268b8/bzImage-5f540c4a.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com

This problem is fixed by a fix in https://github.com/zhuyj/linux.git 
v6.17_fix_gid_table_release_one

I will make an official patch and send it out very soon.

Zhu Yanjun

> 
> ------------[ cut here ]------------
> GID entry ref leak for dev syz1 index 2 ref=615
> WARNING: drivers/infiniband/core/cache.c:809 at release_gid_table drivers/infiniband/core/cache.c:806 [inline], CPU#0: kworker/u8:2/36
> WARNING: drivers/infiniband/core/cache.c:809 at gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886, CPU#0: kworker/u8:2/36
> Modules linked in:
> CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
> Workqueue: ib-unreg-wq ib_unregister_work
> RIP: 0010:release_gid_table drivers/infiniband/core/cache.c:806 [inline]
> RIP: 0010:gid_table_release_one+0x346/0x4d0 drivers/infiniband/core/cache.c:886
> Code: e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 3d 41 8b 0e 48 c7 c7 a0 43 91 8c 4c 89 e6 44 89 fa e8 fb 67 f5 f8 90 <0f> 0b 90 90 e9 e3 fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c
> RSP: 0018:ffffc90000ac7908 EFLAGS: 00010246
> RAX: 621d731dcb27e200 RBX: ffff88806241b8d8 RCX: ffff888141289e40
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
> RBP: 1ffff1100c48371b R08: ffff8880b8724253 R09: 1ffff110170e484a
> R10: dffffc0000000000 R11: ffffed10170e484b R12: ffff888027503e00
> R13: ffff88806241b800 R14: ffff8880289a2400 R15: 0000000000000002
> FS:  0000000000000000(0000) GS:ffff8881259f0000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000555569847588 CR3: 00000000338c8000 CR4: 00000000003526f0
> Call Trace:
>   <TASK>
>   ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:509
>   device_release+0x99/0x1c0 drivers/base/core.c:-1
>   kobject_cleanup lib/kobject.c:689 [inline]
>   kobject_release lib/kobject.c:720 [inline]
>   kref_put include/linux/kref.h:65 [inline]
>   kobject_put+0x228/0x480 lib/kobject.c:737
>   process_one_work kernel/workqueue.c:3263 [inline]
>   process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
>   worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
>   kthread+0x711/0x8a0 kernel/kthread.c:463
>   ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>   </TASK>
> 
> 
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-05-13 11:35 syzbot
  2025-05-14  8:54 ` Leon Romanovsky
  2025-09-11 15:34 ` syzbot
@ 2025-09-12  4:42 ` syzbot
  2025-09-12 19:38   ` yanjun.zhu
  2 siblings, 1 reply; 51+ messages in thread
From: syzbot @ 2025-09-12  4:42 UTC (permalink / raw)
  To: edwards, hdanton, jgg, leon, leonro, linux-kernel, linux-rdma,
	syzkaller-bugs

syzbot has bisected this issue to:

commit a92fbeac7e94a420b55570c10fe1b90e64da4025
Author: Leon Romanovsky <leonro@nvidia.com>
Date:   Tue May 28 12:52:51 2024 +0000

    RDMA/cache: Release GID table even if leak is detected

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13fc9642580000
start commit:   5f540c4aade9 Add linux-next specific files for 20250910
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10029642580000
console output: https://syzkaller.appspot.com/x/log.txt?x=17fc9642580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000

Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
Fixes: a92fbeac7e94 ("RDMA/cache: Release GID table even if leak is detected")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12  4:42 ` syzbot
@ 2025-09-12 19:38   ` yanjun.zhu
  2025-09-12 20:01     ` Yanjun.Zhu
  0 siblings, 1 reply; 51+ messages in thread
From: yanjun.zhu @ 2025-09-12 19:38 UTC (permalink / raw)
  To: syzbot, edwards, hdanton, jgg, leon, leonro, linux-kernel,
	linux-rdma, syzkaller-bugs

On 9/11/25 9:42 PM, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit a92fbeac7e94a420b55570c10fe1b90e64da4025
> Author: Leon Romanovsky <leonro@nvidia.com>
> Date:   Tue May 28 12:52:51 2024 +0000
> 
>      RDMA/cache: Release GID table even if leak is detected

Maybe this commit just detects ref leaks and reports ref leak.
Even though this commit is reverted, this ref leak still occurs.

The root cause is not in this commit.

"
GID entry ref leak for dev syz1 index 2 ref=615
"

Ref leaks in dev syz1.

Zhu Yanjun

> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13fc9642580000
> start commit:   5f540c4aade9 Add linux-next specific files for 20250910
> git tree:       linux-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=10029642580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=17fc9642580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5ed48faa2cb8510d
> dashboard link: https://syzkaller.appspot.com/bug?extid=b0da83a6c0e2e2bddbd4
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15b52362580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000
> 
> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
> Fixes: a92fbeac7e94 ("RDMA/cache: Release GID table even if leak is detected")
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12 19:38   ` yanjun.zhu
@ 2025-09-12 20:01     ` Yanjun.Zhu
  2025-09-12 22:33       ` Yanjun.Zhu
  0 siblings, 1 reply; 51+ messages in thread
From: Yanjun.Zhu @ 2025-09-12 20:01 UTC (permalink / raw)
  To: syzbot, edwards, hdanton, jgg, leon, leonro, linux-kernel,
	linux-rdma, syzkaller-bugs



On 9/12/25 12:38 PM, yanjun.zhu wrote:
> On 9/11/25 9:42 PM, syzbot wrote:
>> syzbot has bisected this issue to:
>>
>> commit a92fbeac7e94a420b55570c10fe1b90e64da4025
>> Author: Leon Romanovsky <leonro@nvidia.com>
>> Date:   Tue May 28 12:52:51 2024 +0000
>>
>>      RDMA/cache: Release GID table even if leak is detected
> 
> Maybe this commit just detects ref leaks and reports ref leak.
> Even though this commit is reverted, this ref leak still occurs.
> 
> The root cause is not in this commit.
> 
> "
> GID entry ref leak for dev syz1 index 2 ref=615
> "
> 
> Ref leaks in dev syz1.
In this link: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000

"
[  184.209420][ T6164] infiniband syz1: set active
[  184.215960][ T6164] infiniband syz1: added syz_tun
[  184.222514][ T6001] veth0_macvtap: entered promiscuous mode
[  184.231935][   T42] wlan0: Created IBSS using preconfigured BSSID 
50:50:50:50:50:50
[  184.239777][   T42] wlan0: Creating new IBSS network, BSSID 
50:50:50:50:50:50
[  184.256962][ T6001] veth1_macvtap: entered promiscuous mode
[  184.276479][ T6164] syz1: rxe_create_cq: returned err = -12 < -- 
rxe_create_cq failed, the test should not continue.

[  184.288430][ T6008] veth0_vlan: entered promiscuous mode
"

err = -12, is -ENOMEM.

It means that memory allocation fails.

Zhu Yanjun

> 
> Zhu Yanjun
> 
>>
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt? 
>> x=13fc9642580000
>> start commit:   5f540c4aade9 Add linux-next specific files for 20250910
>> git tree:       linux-next
>> final oops:     https://syzkaller.appspot.com/x/report.txt? 
>> x=10029642580000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fc9642580000
>> kernel config:  https://syzkaller.appspot.com/x/.config? 
>> x=5ed48faa2cb8510d
>> dashboard link: https://syzkaller.appspot.com/bug? 
>> extid=b0da83a6c0e2e2bddbd4
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz? 
>> x=15b52362580000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000
>>
>> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
>> Fixes: a92fbeac7e94 ("RDMA/cache: Release GID table even if leak is 
>> detected")
>>
>> For information about bisection process see: https://goo.gl/ 
>> tpsmEJ#bisection
> 


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12 20:01     ` Yanjun.Zhu
@ 2025-09-12 22:33       ` Yanjun.Zhu
  2025-09-12 22:55         ` Yanjun.Zhu
  0 siblings, 1 reply; 51+ messages in thread
From: Yanjun.Zhu @ 2025-09-12 22:33 UTC (permalink / raw)
  To: syzbot, edwards, hdanton, jgg, leon, leonro, linux-kernel,
	linux-rdma, syzkaller-bugs



On 9/12/25 1:01 PM, Yanjun.Zhu wrote:
> 
> 
> On 9/12/25 12:38 PM, yanjun.zhu wrote:
>> On 9/11/25 9:42 PM, syzbot wrote:
>>> syzbot has bisected this issue to:
>>>
>>> commit a92fbeac7e94a420b55570c10fe1b90e64da4025
>>> Author: Leon Romanovsky <leonro@nvidia.com>
>>> Date:   Tue May 28 12:52:51 2024 +0000
>>>
>>>      RDMA/cache: Release GID table even if leak is detected
>>
>> Maybe this commit just detects ref leaks and reports ref leak.
>> Even though this commit is reverted, this ref leak still occurs.
>>
>> The root cause is not in this commit.
>>
>> "
>> GID entry ref leak for dev syz1 index 2 ref=615
>> "
>>
>> Ref leaks in dev syz1.
> In this link: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
> 
> "
> [  184.209420][ T6164] infiniband syz1: set active
> [  184.215960][ T6164] infiniband syz1: added syz_tun
> [  184.222514][ T6001] veth0_macvtap: entered promiscuous mode
> [  184.231935][   T42] wlan0: Created IBSS using preconfigured BSSID 
> 50:50:50:50:50:50
> [  184.239777][   T42] wlan0: Creating new IBSS network, BSSID 
> 50:50:50:50:50:50
> [  184.256962][ T6001] veth1_macvtap: entered promiscuous mode
> [  184.276479][ T6164] syz1: rxe_create_cq: returned err = -12 < -- 
> rxe_create_cq failed, the test should not continue.
> 
> [  184.288430][ T6008] veth0_vlan: entered promiscuous mode
> "
> 
> err = -12, is -ENOMEM.

"
[  139.009314][ T6730] infiniband syz1: added syz_tun
[  139.015974][ T6730] rdma_rxe: vmalloc_user failed, buf_size: 131456, 
num_slots: 1024, elem_size: 128
[  139.016142][ T6730] syz1: rxe_cq_from_init: unable to create cq
"

 From the above logs, vmalloc_user() fails when trying to allocate 
131,456 bytes of memory.

Is there a specific limit on vmalloc allocations in this test case?

Also, what is the size of memory available on this machine? (Hardware 
name: Google Google Compute Engine/Google Compute Engine, BIOS Google 
08/18/2025)

Thanks,
Zhu Yanjun

> 
> It means that memory allocation fails.
> 
> Zhu Yanjun
> 
>>
>> Zhu Yanjun
>>
>>>
>>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt? 
>>> x=13fc9642580000
>>> start commit:   5f540c4aade9 Add linux-next specific files for 20250910
>>> git tree:       linux-next
>>> final oops:     https://syzkaller.appspot.com/x/report.txt? 
>>> x=10029642580000
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=17fc9642580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config? 
>>> x=5ed48faa2cb8510d
>>> dashboard link: https://syzkaller.appspot.com/bug? 
>>> extid=b0da83a6c0e2e2bddbd4
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz? 
>>> x=15b52362580000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b41642580000
>>>
>>> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
>>> Fixes: a92fbeac7e94 ("RDMA/cache: Release GID table even if leak is 
>>> detected")
>>>
>>> For information about bisection process see: https://goo.gl/ 
>>> tpsmEJ#bisection
>>
> 


^ permalink raw reply	[flat|nested] 51+ messages in thread

* Re: [syzbot] [rdma?] WARNING in gid_table_release_one (3)
  2025-09-12 22:33       ` Yanjun.Zhu
@ 2025-09-12 22:55         ` Yanjun.Zhu
  0 siblings, 0 replies; 51+ messages in thread
From: Yanjun.Zhu @ 2025-09-12 22:55 UTC (permalink / raw)
  To: syzbot, edwards, hdanton, jgg, leon, leonro, linux-kernel,
	linux-rdma, syzkaller-bugs



On 9/12/25 3:33 PM, Yanjun.Zhu wrote:
> 
> 
> On 9/12/25 1:01 PM, Yanjun.Zhu wrote:
>>
>>
>> On 9/12/25 12:38 PM, yanjun.zhu wrote:
>>> On 9/11/25 9:42 PM, syzbot wrote:
>>>> syzbot has bisected this issue to:
>>>>
>>>> commit a92fbeac7e94a420b55570c10fe1b90e64da4025
>>>> Author: Leon Romanovsky <leonro@nvidia.com>
>>>> Date:   Tue May 28 12:52:51 2024 +0000
>>>>
>>>>      RDMA/cache: Release GID table even if leak is detected
>>>
>>> Maybe this commit just detects ref leaks and reports ref leak.
>>> Even though this commit is reverted, this ref leak still occurs.
>>>
>>> The root cause is not in this commit.
>>>
>>> "
>>> GID entry ref leak for dev syz1 index 2 ref=615
>>> "
>>>
>>> Ref leaks in dev syz1.
>> In this link: https://syzkaller.appspot.com/x/log.txt?x=157dab12580000
>>
>> "
>> [  184.209420][ T6164] infiniband syz1: set active
>> [  184.215960][ T6164] infiniband syz1: added syz_tun
>> [  184.222514][ T6001] veth0_macvtap: entered promiscuous mode
>> [  184.231935][   T42] wlan0: Created IBSS using preconfigured BSSID 
>> 50:50:50:50:50:50
>> [  184.239777][   T42] wlan0: Creating new IBSS network, BSSID 
>> 50:50:50:50:50:50
>> [  184.256962][ T6001] veth1_macvtap: entered promiscuous mode
>> [  184.276479][ T6164] syz1: rxe_create_cq: returned err = -12 < -- 
>> rxe_create_cq failed, the test should not continue.
>>
>> [  184.288430][ T6008] veth0_vlan: entered promiscuous mode
>> "
>>
>> err = -12, is -ENOMEM.
> 
> "
> [  139.009314][ T6730] infiniband syz1: added syz_tun
> [  139.015974][ T6730] rdma_rxe: vmalloc_user failed, buf_size: 131456, 
> num_slots: 1024, elem_size: 128
> [  139.016142][ T6730] syz1: rxe_cq_from_init: unable to create cq
> "

The above logs are in the link: 
https://syzkaller.appspot.com/x/log.txt?x=144a9934580000

Please check it.

Zhu Yanjun

> 
>  From the above logs, vmalloc_user() fails when trying to allocate 
> 131,456 bytes of memory.
> 
> Is there a specific limit on vmalloc allocations in this test case?
> 
> Also, what is the size of memory available on this machine? (Hardware 
> name: Google Google Compute Engine/Google Compute Engine, BIOS Google 
> 08/18/2025)
> 
> Thanks,
> Zhu Yanjun
> 
>>
>> It means that memory allocation fails.
>>
>> Zhu Yanjun
>>
>>>
>>> Zhu Yanjun
>>>
>>>>
>>>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt? 
>>>> x=13fc9642580000
>>>> start commit:   5f540c4aade9 Add linux-next specific files for 20250910
>>>> git tree:       linux-next
>>>> final oops:     https://syzkaller.appspot.com/x/report.txt? 
>>>> x=10029642580000
>>>> console output: https://syzkaller.appspot.com/x/log.txt? 
>>>> x=17fc9642580000
>>>> kernel config:  https://syzkaller.appspot.com/x/.config? 
>>>> x=5ed48faa2cb8510d
>>>> dashboard link: https://syzkaller.appspot.com/bug? 
>>>> extid=b0da83a6c0e2e2bddbd4
>>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz? 
>>>> x=15b52362580000
>>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c? 
>>>> x=16b41642580000
>>>>
>>>> Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
>>>> Fixes: a92fbeac7e94 ("RDMA/cache: Release GID table even if leak is 
>>>> detected")
>>>>
>>>> For information about bisection process see: https://goo.gl/ 
>>>> tpsmEJ#bisection
>>>
>>
> 


^ permalink raw reply	[flat|nested] 51+ messages in thread

end of thread, other threads:[~2025-11-06 21:09 UTC | newest]

Thread overview: 51+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <185e135e-0e17-4ef8-91a2-15e69897cd01@linux.dev>
2025-11-05 17:06 ` [syzbot] [rdma?] WARNING in gid_table_release_one (3) syzbot
2025-11-05 17:14   ` Jason Gunthorpe
2025-11-05 17:24     ` Yanjun.Zhu
2025-11-05 18:50     ` Leon Romanovsky
2025-11-05 20:10       ` Yanjun.Zhu
2025-11-06  0:44       ` Yanjun.Zhu
     [not found] <ffdab397-0096-4946-a7d5-073300cc34a3@linux.dev>
2025-11-06 21:02 ` syzbot
2025-11-06 21:08   ` Yanjun.Zhu
     [not found] <81fedfc2-8e6e-44f3-94d4-2c694c759ded@linux.dev>
2025-11-06  4:02 ` syzbot
     [not found] <38f2a630-7edc-4e9b-b5aa-3e983d67d024@linux.dev>
2025-11-06  1:11 ` syzbot
     [not found] <d8cba3c4-117b-4e7c-a442-d38d5289680f@linux.dev>
2025-11-05 19:36 ` syzbot
     [not found] <c2d8fc24-08a7-47fe-8f68-cc9bbe6c55a4@linux.dev>
2025-11-05 18:45 ` syzbot
     [not found] <198ed0eb-2451-4651-b723-a506e3cf853b@linux.dev>
2025-11-04 23:50 ` syzbot
     [not found] <f5a387d4-eae3-4932-b170-37ff38ebe78d@linux.dev>
2025-11-04 23:22 ` syzbot
     [not found] <b0988506-dbc6-4d28-8f19-9c50bdc44f84@linux.dev>
2025-09-18  6:13 ` syzbot
     [not found] <689cd5e4-1ebe-4b81-8036-68393d61f4ce@linux.dev>
2025-09-16 22:21 ` syzbot
     [not found] <295acd4d-1f40-455a-9d2f-27393cd047bd@linux.dev>
2025-09-16 21:39 ` syzbot
     [not found] <bc6d2cd1-39a3-4b95-b8b1-92fecf28679d@linux.dev>
2025-09-16 15:48 ` syzbot
2025-09-16 16:12   ` Yanjun.Zhu
     [not found] <a3dcd664-b39c-47ff-a61c-f834ba130a16@linux.dev>
2025-09-16  5:59 ` syzbot
     [not found] <6aed82d8-8e65-402d-909e-b8cfbfbb41e4@linux.dev>
2025-09-16  2:10 ` syzbot
     [not found] <d61c07c8-c5c1-4cfe-ad23-d972eaff8b9b@linux.dev>
2025-09-16  1:12 ` syzbot
     [not found] <e50a6a79-6c0c-4313-a09e-a69d8456b202@linux.dev>
2025-09-15 22:14 ` syzbot
     [not found] <7d02a204-fcf6-42c5-b9ad-b7238b9c703b@linux.dev>
2025-09-15 21:14 ` syzbot
     [not found] <dfb7c3c3-dba2-4c99-9347-50715e652c59@linux.dev>
2025-09-15 20:55 ` syzbot
     [not found] <1ea1efd9-4c9d-4432-82b7-f8998bd4e421@linux.dev>
2025-09-15 19:39 ` syzbot
     [not found] <b06c5a01-839f-47bf-9530-705ec838fcbe@linux.dev>
2025-09-15 19:16 ` syzbot
     [not found] <5fb34b0f-435e-4584-abe0-bbf7839b44df@linux.dev>
2025-09-15 19:07 ` syzbot
     [not found] <b678b916-ad9f-4845-91b5-2e5d1f79fe24@linux.dev>
2025-09-12 22:04 ` syzbot
     [not found] <19d2990f-ba92-4fef-891d-26baf03afe18@linux.dev>
2025-09-12 21:43 ` syzbot
     [not found] <c9778714-2966-4b61-b371-9d831bd2492e@linux.dev>
2025-09-12 21:20 ` syzbot
2025-05-13 11:35 syzbot
2025-05-14  8:54 ` Leon Romanovsky
2025-09-17 12:45   ` Jason Gunthorpe
2025-09-11 15:34 ` syzbot
2025-09-12  3:39   ` Hillf Danton
2025-09-12  4:05     ` syzbot
2025-09-12  8:33   ` Hillf Danton
2025-09-12  8:36     ` syzbot
2025-09-12  9:42   ` Hillf Danton
2025-09-12 13:23     ` syzbot
2025-09-13  1:25   ` Hillf Danton
2025-09-13  2:48     ` syzbot
2025-09-13  7:25   ` Hillf Danton
2025-09-13  8:06     ` syzbot
2025-09-16 16:15   ` yanjun.zhu
2025-09-12  4:42 ` syzbot
2025-09-12 19:38   ` yanjun.zhu
2025-09-12 20:01     ` Yanjun.Zhu
2025-09-12 22:33       ` Yanjun.Zhu
2025-09-12 22:55         ` Yanjun.Zhu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).