program:
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x541802, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x4000)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
listen(0xffffffffffffffff, 0x5)
syz_open_dev$video4linux(&(0x7f0000000080), 0x458d, 0x20500)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'syz_tun\x00'})
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000740)=ANY=[], 0x32600)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="38000000031401002dbd7000ffdbdf250900020073797a300000000008004100736977001400330064756d6d793000000001000000000000ae17370d"], 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000084)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x18, 0x1404, 0x1, 0x709d2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000001040)=""/241, &(0x7f0000001140)=0xf1)
r3 = socket(0x2, 0x80805, 0x0)
sendmmsg$inet_sctp(r3, &(0x7f0000001180)=[{&(0x7f00000011c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001200)=[@sndrcv={0x2c, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x2c}], 0x1, 0x0)
setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f00000012c0)=[@in={0x2, 0x4e24, @empty}]}, &(0x7f0000001300)=0xc)
setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f0000001340), 0x4)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000001380)={0x1, [0x0]}, &(0x7f00000013c0)=0x8)
r7 = syz_open_dev$dri(&(0x7f0000001400), 0xd21, 0x0)
ioctl$DRM_IOCTL_GET_MAGIC(r7, 0x80046402, 0x0)
[ 109.147817][ T5305] Bluetooth: hci0: command tx timeout
[ 110.868871][ T5351] dummy0 speed is unknown, defaulting to 1000
[ 110.868929][ T5351] dummy0 speed is unknown, defaulting to 1000
[ 110.869864][ T5351] dummy0 speed is unknown, defaulting to 1000
[ 110.870579][ T5351] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000
[ 110.870597][ T5351] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6
[ 110.870652][ T5351] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008
[ 110.912078][ T5351] dummy0 speed is unknown, defaulting to 1000
[ 110.937102][ T5351] smc: removing ib device rxe0
[ 110.953485][ T5351] smbdirect: ib_dev[rxe0] removed
[ 111.235752][ T5351] ------------[ cut here ]------------
[ 111.235765][ T5351] !xa_empty(&pool->xa)
[ 111.235781][ T5351] WARNING: drivers/infiniband/sw/rxe/rxe_pool.c:116 at rxe_pool_cleanup+0x48/0x60, CPU#0: syz.0.0/5351
[ 111.245208][ T5351] Modules linked in:
[ 111.246984][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 111.251091][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 111.256322][ T5351] RIP: 0010:rxe_pool_cleanup+0x48/0x60
[ 111.258869][ T5351] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 e0 09 2b f9 48 83 3b 00 75 0c e8 f5 b9 b1 f8 5b c3 cc cc cc cc cc e8 e9 b9 b1 f8 90 <0f> 0b 90 5b e9 0f 62 f4 02 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00
[ 111.267793][ T5351] RSP: 0018:ffffc9000deef000 EFLAGS: 00010246
[ 111.270422][ T5351] RAX: ffffffff89177847 RBX: ffff888034b1d458 RCX: 0000000000100000
[ 111.273719][ T5351] RDX: ffffc9000ef02000 RSI: 00000000000fffff RDI: 0000000000100000
[ 111.277711][ T5351] RBP: ffff888034b1d138 R08: ffff888034b1c7e3 R09: 1ffff110069638fc
[ 111.281430][ T5351] R10: dffffc0000000000 R11: ffffffff8915a4f0 R12: ffff888034b1d138
[ 111.284274][ T5351] R13: 1ffff110069639f7 R14: ffffffff8915a4f0 R15: dffffc0000000000
[ 111.287731][ T5351] FS: 00007ff84e0356c0(0000) GS:ffff88808a9f9000(0000) knlGS:0000000000000000
[ 111.291847][ T5351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 111.294718][ T5351] CR2: 000055d6054fbe50 CR3: 0000000045413000 CR4: 0000000000352ef0
[ 111.297831][ T5351] Call Trace:
[ 111.299410][ T5351]
[ 111.300672][ T5351] rxe_dealloc+0x27/0xc0
[ 111.302467][ T5351] ? __pfx_rxe_dealloc+0x10/0x10
[ 111.304530][ T5351] ib_dealloc_device+0x54/0x200
[ 111.306656][ T5351] __ib_unregister_device+0x38f/0x400
[ 111.308884][ T5351] ib_unregister_device_and_put+0xb8/0xf0
[ 111.313247][ T5351] nldev_dellink+0x3a4/0x440
[ 111.315336][ T5351] ? __pfx_nldev_dellink+0x10/0x10
[ 111.317583][ T5351] ? apparmor_capable+0x126/0x170
[ 111.319909][ T5351] ? bpf_lsm_capable+0x9/0x20
[ 111.322043][ T5351] ? security_capable+0x7e/0x2c0
[ 111.324162][ T5351] ? __pfx_nldev_dellink+0x10/0x10
[ 111.326386][ T5351] rdma_nl_rcv+0x6ef/0xa40
[ 111.328320][ T5351] ? __pfx_rdma_nl_rcv+0x10/0x10
[ 111.330455][ T5351] ? netlink_deliver_tap+0x2e/0x1b0
[ 111.332788][ T5351] ? netlink_deliver_tap+0x2e/0x1b0
[ 111.335075][ T5351] netlink_unicast+0x8ef/0xa80
[ 111.337227][ T5351] netlink_sendmsg+0x7f0/0xb20
[ 111.339619][ T5351] ? __pfx_netlink_sendmsg+0x10/0x10
[ 111.341997][ T5351] ? aa_sock_msg_perm+0x144/0x210
[ 111.343983][ T5351] ? apparmor_socket_sendmsg+0x98/0x360
[ 111.346171][ T5351] ? __pfx_netlink_sendmsg+0x10/0x10
[ 111.348402][ T5351] sock_sendmsg_nosec+0x14e/0x190
[ 111.350758][ T5351] ____sys_sendmsg+0x54e/0x850
[ 111.352964][ T5351] ? __pfx_____sys_sendmsg+0x10/0x10
[ 111.355046][ T5351] ? import_iovec+0x73/0xa0
[ 111.357697][ T5351] ___sys_sendmsg+0x2a5/0x360
[ 111.359939][ T5351] ? __lock_acquire+0x747/0x2de0
[ 111.362093][ T5351] ? __pfx____sys_sendmsg+0x10/0x10
[ 111.364296][ T5351] ? futex_wait+0x2a2/0x390
[ 111.366203][ T5351] ? __fget_files+0x3a2/0x420
[ 111.368330][ T5351] ? __fget_files+0x2a/0x420
[ 111.370570][ T5351] __x64_sys_sendmsg+0x1b1/0x290
[ 111.372894][ T5351] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 111.375337][ T5351] do_syscall_64+0x16a/0x530
[ 111.377505][ T5351] ? trace_irq_disable+0x3b/0x140
[ 111.379857][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.382631][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 111.384713][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.387394][ T5351] RIP: 0033:0x7ff84d19fb19
[ 111.390758][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 111.399305][ T5351] RSP: 002b:00007ff84e034fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 111.402941][ T5351] RAX: ffffffffffffffda RBX: 00007ff84d425fa0 RCX: 00007ff84d19fb19
[ 111.406352][ T5351] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007
[ 111.410005][ T5351] RBP: 00007ff84d237b70 R08: 0000000000000000 R09: 0000000000000000
[ 111.413651][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 111.417179][ T5351] R13: 00007ff84d426038 R14: 00007ff84d425fa0 R15: 00007ffd69ea0678
[ 111.420530][ T5351]
[ 111.421949][ T5351] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 111.425235][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 111.429329][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 111.433830][ T5351] Call Trace:
[ 111.435319][ T5351]
[ 111.436614][ T5351] vpanic+0x26f/0x710
[ 111.438396][ T5351] panic+0xc5/0xd0
[ 111.440124][ T5351] ? __pfx_panic+0x10/0x10
[ 111.442149][ T5351] __warn+0x315/0x4c0
[ 111.443930][ T5351] ? rxe_pool_cleanup+0x48/0x60
[ 111.445961][ T5351] ? rxe_pool_cleanup+0x48/0x60
[ 111.448027][ T5351] __report_bug+0x276/0x570
[ 111.449930][ T5351] ? rxe_pool_cleanup+0x48/0x60
[ 111.452041][ T5351] ? __pfx___report_bug+0x10/0x10
[ 111.454287][ T5351] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 111.456841][ T5351] ? touch_wq_lockdep_map+0xb5/0x180
[ 111.458984][ T5351] ? touch_wq_lockdep_map+0xb5/0x180
[ 111.461096][ T5351] ? rxe_pool_cleanup+0x48/0x60
[ 111.463148][ T5351] report_bug+0x16b/0x220
[ 111.464962][ T5351] ? rxe_pool_cleanup+0x48/0x60
[ 111.467392][ T5351] ? rxe_pool_cleanup+0x4a/0x60
[ 111.469608][ T5351] handle_bug+0x9c/0x200
[ 111.471576][ T5351] exc_invalid_op+0x1a/0x50
[ 111.473685][ T5351] asm_exc_invalid_op+0x1a/0x20
[ 111.475965][ T5351] RIP: 0010:rxe_pool_cleanup+0x48/0x60
[ 111.478379][ T5351] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 e0 09 2b f9 48 83 3b 00 75 0c e8 f5 b9 b1 f8 5b c3 cc cc cc cc cc e8 e9 b9 b1 f8 90 <0f> 0b 90 5b e9 0f 62 f4 02 cc 66 66 66 66 66 2e 0f 1f 84 00 00 00
[ 111.487126][ T5351] RSP: 0018:ffffc9000deef000 EFLAGS: 00010246
[ 111.489806][ T5351] RAX: ffffffff89177847 RBX: ffff888034b1d458 RCX: 0000000000100000
[ 111.493347][ T5351] RDX: ffffc9000ef02000 RSI: 00000000000fffff RDI: 0000000000100000
[ 111.496982][ T5351] RBP: ffff888034b1d138 R08: ffff888034b1c7e3 R09: 1ffff110069638fc
[ 111.500562][ T5351] R10: dffffc0000000000 R11: ffffffff8915a4f0 R12: ffff888034b1d138
[ 111.504049][ T5351] R13: 1ffff110069639f7 R14: ffffffff8915a4f0 R15: dffffc0000000000
[ 111.507357][ T5351] ? __pfx_rxe_dealloc+0x10/0x10
[ 111.509629][ T5351] ? __pfx_rxe_dealloc+0x10/0x10
[ 111.511899][ T5351] ? rxe_pool_cleanup+0x47/0x60
[ 111.514110][ T5351] rxe_dealloc+0x27/0xc0
[ 111.519401][ T5351] ? __pfx_rxe_dealloc+0x10/0x10
[ 111.521764][ T5351] ib_dealloc_device+0x54/0x200
[ 111.524024][ T5351] __ib_unregister_device+0x38f/0x400
[ 111.526439][ T5351] ib_unregister_device_and_put+0xb8/0xf0
[ 111.528580][ T5351] nldev_dellink+0x3a4/0x440
[ 111.530501][ T5351] ? __pfx_nldev_dellink+0x10/0x10
[ 111.532901][ T5351] ? apparmor_capable+0x126/0x170
[ 111.535245][ T5351] ? bpf_lsm_capable+0x9/0x20
[ 111.537387][ T5351] ? security_capable+0x7e/0x2c0
[ 111.539623][ T5351] ? __pfx_nldev_dellink+0x10/0x10
[ 111.541836][ T5351] rdma_nl_rcv+0x6ef/0xa40
[ 111.543807][ T5351] ? __pfx_rdma_nl_rcv+0x10/0x10
[ 111.546057][ T5351] ? netlink_deliver_tap+0x2e/0x1b0
[ 111.548289][ T5351] ? netlink_deliver_tap+0x2e/0x1b0
[ 111.550461][ T5351] netlink_unicast+0x8ef/0xa80
[ 111.552545][ T5351] netlink_sendmsg+0x7f0/0xb20
[ 111.554641][ T5351] ? __pfx_netlink_sendmsg+0x10/0x10
[ 111.557000][ T5351] ? aa_sock_msg_perm+0x144/0x210
[ 111.559226][ T5351] ? apparmor_socket_sendmsg+0x98/0x360
[ 111.561584][ T5351] ? __pfx_netlink_sendmsg+0x10/0x10
[ 111.563874][ T5351] sock_sendmsg_nosec+0x14e/0x190
[ 111.565874][ T5351] ____sys_sendmsg+0x54e/0x850
[ 111.567789][ T5351] ? __pfx_____sys_sendmsg+0x10/0x10
[ 111.569908][ T5351] ? import_iovec+0x73/0xa0
[ 111.571718][ T5351] ___sys_sendmsg+0x2a5/0x360
[ 111.573679][ T5351] ? __lock_acquire+0x747/0x2de0
[ 111.575797][ T5351] ? __pfx____sys_sendmsg+0x10/0x10
[ 111.578216][ T5351] ? futex_wait+0x2a2/0x390
[ 111.580683][ T5351] ? __fget_files+0x3a2/0x420
[ 111.582876][ T5351] ? __fget_files+0x2a/0x420
[ 111.585172][ T5351] __x64_sys_sendmsg+0x1b1/0x290
[ 111.587229][ T5351] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 111.589581][ T5351] do_syscall_64+0x16a/0x530
[ 111.591750][ T5351] ? trace_irq_disable+0x3b/0x140
[ 111.593898][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.596375][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 111.598420][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.600853][ T5351] RIP: 0033:0x7ff84d19fb19
[ 111.602727][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 111.611155][ T5351] RSP: 002b:00007ff84e034fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 111.614865][ T5351] RAX: ffffffffffffffda RBX: 00007ff84d425fa0 RCX: 00007ff84d19fb19
[ 111.618341][ T5351] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007
[ 111.621967][ T5351] RBP: 00007ff84d237b70 R08: 0000000000000000 R09: 0000000000000000
[ 111.625579][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 111.628756][ T5351] R13: 00007ff84d426038 R14: 00007ff84d425fa0 R15: 00007ffd69ea0678
[ 111.631910][ T5351]
[ 111.633538][ T5351] Kernel Offset: disabled
[ 111.635282][ T5351] Rebooting in 86400 seconds..