vivid-001: reconnect
list_add corruption. prev->next should be next (ffffffff89db41c0), but was 0000000000000000. (prev=ffff8881d828d8e0).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:28!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4989 Comm: syz-executor0 Not tainted 4.20.0-rc6+ #371
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_add_valid.cold.2+0x23/0x2a lib/list_debug.c:26
Code: e8 b0 97 d2 fd 0f 0b 48 89 d9 48 c7 c7 a0 d4 60 88 e8 9f 97 d2 fd 0f 0b 48 89 f1 48 c7 c7 20 d5 60 88 48 89 de e8 8b 97 d2 fd <0f> 0b 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 be 00 00 00 00 00
RSP: 0018:ffff8881c25af948 EFLAGS: 00010286
RAX: 0000000000000075 RBX: ffffffff89db41c0 RCX: ffffc90007210000
kernel msg: ebtables bug: please report to author: Total nentries is wrong
RDX: 0000000000000000 RSI: ffffffff8165e495 RDI: 0000000000000005
RBP: ffff8881c25af960 R08: ffff8881b7c2c500 R09: 0000000000000006
R10: 0000000000000000 R11: ffff8881b7c2c500 R12: ffff8881ba5d8ce0
R13: ffff8881ba5d8ce0 R14: ffff8881d828d8e0 R15: ffff8881ba5d8eb0
kernel msg: ebtables bug: please report to author: Total nentries is wrong
FS:  00007f7d70d7e700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000072c000 CR3: 00000001809de000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_add include/linux/list.h:60 [inline]
 list_add_tail include/linux/list.h:93 [inline]
 cma_listen_on_all drivers/infiniband/core/cma.c:2474 [inline]
 rdma_listen+0x6dc/0x990 drivers/infiniband/core/cma.c:3489
vivid-001: disconnect
 ucma_listen+0x1a4/0x260 drivers/infiniband/core/ucma.c:1100
vivid-001: reconnect
 ucma_write+0x365/0x460 drivers/infiniband/core/ucma.c:1689
 __vfs_write+0x119/0x9f0 fs/read_write.c:485
kobject: 'vti0' (000000000cbc06bb): kobject_add_internal: parent: 'net', set: 'devices'
kobject: 'vti0' (000000000cbc06bb): kobject_uevent_env
kobject: 'vti0' (000000000cbc06bb): fill_kobj_path: path = '/devices/virtual/net/vti0'
 vfs_write+0x1fc/0x560 fs/read_write.c:549
 ksys_write+0x101/0x260 fs/read_write.c:598
kobject: 'queues' (00000000bc8bb7c5): kobject_add_internal: parent: 'vti0', set: '<NULL>'
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
kobject: 'queues' (00000000bc8bb7c5): kobject_uevent_env
kobject: 'queues' (00000000bc8bb7c5): kobject_uevent_env: filter function caused the event to drop!
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457679
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
kobject: 'rx-0' (0000000073b5c100): kobject_add_internal: parent: 'queues', set: 'queues'
RSP: 002b:00007f7d70d7dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457679
RDX: 0000000000000010 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d70d7e6d4
R13: 00000000004c5f30 R14: 00000000004da9f0 R15: 00000000ffffffff
Modules linked in:
kobject: 'rx-0' (0000000073b5c100): kobject_uevent_env
kobject: 'loop5' (00000000010b07c8): kobject_uevent_env
---[ end trace 14cd69cd40a344b7 ]---
kobject: 'loop5' (00000000010b07c8): fill_kobj_path: path = '/devices/virtual/block/loop5'
RIP: 0010:__list_add_valid.cold.2+0x23/0x2a lib/list_debug.c:26
kobject: 'event5' (00000000d8803f8f): kobject_cleanup, parent           (null)
Code: e8 b0 97 d2 fd 0f 0b 48 89 d9 48 c7 c7 a0 d4 60 88 e8 9f 97 d2 fd 0f 0b 48 89 f1 48 c7 c7 20 d5 60 88 48 89 de e8 8b 97 d2 fd <0f> 0b 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 be 00 00 00 00 00
kobject: 'event5' (00000000d8803f8f): calling ktype release
kobject: 'event5': free name
kobject: 'rx-0' (0000000073b5c100): fill_kobj_path: path = '/devices/virtual/net/vti0/queues/rx-0'
kobject: 'loop1' (00000000966e75f9): kobject_uevent_env
kobject: 'tx-0' (000000009bd11b3a): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'loop1' (00000000966e75f9): fill_kobj_path: path = '/devices/virtual/block/loop1'
kobject: 'loop5' (00000000010b07c8): kobject_uevent_env
RSP: 0018:ffff8881c25af948 EFLAGS: 00010286
kobject: 'input290' (000000007d947ff7): kobject_uevent_env
kobject: 'tx-0' (000000009bd11b3a): kobject_uevent_env
kobject: 'input290' (000000007d947ff7): fill_kobj_path: path = '/devices/virtual/input/input290'
kobject: 'tx-0' (000000009bd11b3a): fill_kobj_path: path = '/devices/virtual/net/vti0/queues/tx-0'
kobject: 'input290' (000000007d947ff7): kobject_cleanup, parent           (null)
RAX: 0000000000000075 RBX: ffffffff89db41c0 RCX: ffffc90007210000
kobject: 'loop5' (00000000010b07c8): fill_kobj_path: path = '/devices/virtual/block/loop5'
RDX: 0000000000000000 RSI: ffffffff8165e495 RDI: 0000000000000005
kobject: 'loop1' (00000000966e75f9): kobject_uevent_env
RBP: ffff8881c25af960 R08: ffff8881b7c2c500 R09: 0000000000000006
kobject: 'loop1' (00000000966e75f9): fill_kobj_path: path = '/devices/virtual/block/loop1'
R10: 0000000000000000 R11: ffff8881b7c2c500 R12: ffff8881ba5d8ce0
kobject: 'input290' (000000007d947ff7): calling ktype release
R13: ffff8881ba5d8ce0 R14: ffff8881d828d8e0 R15: ffff8881ba5d8eb0
kobject: 'input290': free name
kobject: 'rx-0' (0000000073b5c100): kobject_cleanup, parent 00000000bc8bb7c5
kobject: 'loop5' (00000000010b07c8): kobject_uevent_env
FS:  00007f7d70d7e700(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
kobject: 'loop5' (00000000010b07c8): fill_kobj_path: path = '/devices/virtual/block/loop5'
kobject: 'rx-0' (0000000073b5c100): auto cleanup 'remove' event
kobject: 'loop4' (0000000010655003): kobject_uevent_env
kobject: 'input291' (000000008dcb06bd): kobject_add_internal: parent: 'input', set: 'devices'
kobject: 'loop4' (0000000010655003): fill_kobj_path: path = '/devices/virtual/block/loop4'
kobject: 'rx-0' (0000000073b5c100): kobject_uevent_env
kobject: 'input291' (000000008dcb06bd): kobject_uevent_env
kobject: 'rx-0' (0000000073b5c100): fill_kobj_path: path = '/devices/virtual/net/vti0/queues/rx-0'
kobject: 'input291' (000000008dcb06bd): fill_kobj_path: path = '/devices/virtual/input/input291'
kobject: 'rx-0' (0000000073b5c100): auto cleanup kobject_del
kobject: 'input291' (000000008dcb06bd): fill_kobj_path: path = '/devices/virtual/input/input291'
kobject: 'rx-0' (0000000073b5c100): calling ktype release
input: syz1 as /devices/virtual/input/input291
kobject: 'rx-0': free name
kobject: 'event4' (00000000274c9d72): kobject_add_internal: parent: 'input291', set: 'devices'
kobject: 'tx-0' (000000009bd11b3a): kobject_cleanup, parent 00000000bc8bb7c5
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kobject: 'tx-0' (000000009bd11b3a): auto cleanup 'remove' event
kobject: 'event4' (00000000274c9d72): kobject_uevent_env
kobject: 'tx-0' (000000009bd11b3a): kobject_uevent_env
CR2: 00000000200000c0 CR3: 00000001809de000 CR4: 00000000001406f0
kobject: 'tx-0' (000000009bd11b3a): fill_kobj_path: path = '/devices/virtual/net/vti0/queues/tx-0'
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kobject: 'tx-0' (000000009bd11b3a): auto cleanup kobject_del
kobject: 'event4' (00000000274c9d72): fill_kobj_path: path = '/devices/virtual/input/input291/event4'
kobject: 'tx-0' (000000009bd11b3a): calling ktype release
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'tx-0': free name