general protection fault, probably for non-canonical address 0xe0edfcee00ee0010: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x0770077007700080-0x0770077007700087]
CPU: 0 PID: 25092 Comm: kworker/u4:11 Not tainted 5.15.0-next-20211103-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:266 [inline]
RIP: 0010:rb_erase+0xb7/0x1210 lib/rbtree.c:443
Code: 5e 10 4c 89 f5 48 ba 00 00 00 00 00 fc ff df 48 85 db 75 0b e9 9f 04 00 00 48 89 dd 48 89 c3 4c 8d 63 10 4c 89 e0 48 c1 e8 03 <80> 3c 10 00 0f 85 f3 0b 00 00 48 8b 43 10 48 85 c0 75 dc 48 8d 7b
RSP: 0018:ffffc90004bf78e0 EFLAGS: 00010203
RAX: 00ee00ee00ee0010 RBX: 0770077007700077 RCX: 1ffff1100002092c
RDX: dffffc0000000000 RSI: ffff88809809c4f8 RDI: ffff888000104960
RBP: ffff888000104950 R08: ffff888098106dd8 R09: 0000000000000002
R10: ffffffff81f40586 R11: 0000000000000001 R12: 0770077007700087
R13: ffff8880980a0780 R14: ffff888000104950 R15: ffff88809809c4f8
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c3692fa180 CR3: 000000007f6c2000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 kernfs_unlink_sibling fs/kernfs/dir.c:400 [inline]
 __kernfs_remove+0x659/0xab0 fs/kernfs/dir.c:1359
 kernfs_remove_by_name_ns+0x4f/0xa0 fs/kernfs/dir.c:1544
 kernfs_remove_by_name include/linux/kernfs.h:570 [inline]
 remove_files+0x96/0x1c0 fs/sysfs/group.c:28
 sysfs_remove_group+0x87/0x170 fs/sysfs/group.c:288
 sysfs_remove_groups fs/sysfs/group.c:312 [inline]
 sysfs_remove_groups+0x5c/0xa0 fs/sysfs/group.c:304
 destroy_gid_attrs drivers/infiniband/core/sysfs.c:1188 [inline]
 ib_free_port_attrs+0x1dd/0x460 drivers/infiniband/core/sysfs.c:1408
 remove_one_compat_dev drivers/infiniband/core/device.c:1001 [inline]
 rdma_dev_exit_net+0x2b2/0x550 drivers/infiniband/core/device.c:1139
 ops_exit_list+0xb0/0x160 net/core/net_namespace.c:168
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:593
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 5a90a875ad93495e ]---
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:266 [inline]
RIP: 0010:rb_erase+0xb7/0x1210 lib/rbtree.c:443
Code: 5e 10 4c 89 f5 48 ba 00 00 00 00 00 fc ff df 48 85 db 75 0b e9 9f 04 00 00 48 89 dd 48 89 c3 4c 8d 63 10 4c 89 e0 48 c1 e8 03 <80> 3c 10 00 0f 85 f3 0b 00 00 48 8b 43 10 48 85 c0 75 dc 48 8d 7b
RSP: 0018:ffffc90004bf78e0 EFLAGS: 00010203
RAX: 00ee00ee00ee0010 RBX: 0770077007700077 RCX: 1ffff1100002092c
RDX: dffffc0000000000 RSI: ffff88809809c4f8 RDI: ffff888000104960
RBP: ffff888000104950 R08: ffff888098106dd8 R09: 0000000000000002
R10: ffffffff81f40586 R11: 0000000000000001 R12: 0770077007700087
R13: ffff8880980a0780 R14: ffff888000104950 R15: ffff88809809c4f8
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c3692fa180 CR3: 000000007f6c2000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	5e                   	pop    %rsi
   1:	10 4c 89 f5          	adc    %cl,-0xb(%rcx,%rcx,4)
   5:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   c:	fc ff df
   f:	48 85 db             	test   %rbx,%rbx
  12:	75 0b                	jne    0x1f
  14:	e9 9f 04 00 00       	jmpq   0x4b8
  19:	48 89 dd             	mov    %rbx,%rbp
  1c:	48 89 c3             	mov    %rax,%rbx
  1f:	4c 8d 63 10          	lea    0x10(%rbx),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	0f 85 f3 0b 00 00    	jne    0xc27
  34:	48 8b 43 10          	mov    0x10(%rbx),%rax
  38:	48 85 c0             	test   %rax,%rax
  3b:	75 dc                	jne    0x19
  3d:	48                   	rex.W
  3e:	8d                   	.byte 0x8d
  3f:	7b                   	.byte 0x7b