BUG: unable to handle page fault for address: ffff888007777780 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 10a01067 P4D 10a01067 PUD 10a02067 PMD 80000000076001e1 Oops: 0003 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8591 Comm: syz-executor.3 Not tainted 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:____rb_erase_color lib/rbtree.c:254 [inline] RIP: 0010:rb_erase+0x48b/0x1210 lib/rbtree.c:445 Code: 00 0f 84 07 ff ff ff 48 89 ef 48 89 14 24 e8 ec dc bd fd 48 8b 14 24 e9 f2 fe ff ff 4c 89 e8 49 89 ee 4c 89 6d 08 48 c1 e8 03 <49> 89 6c 24 10 49 83 ce 01 80 3c 18 00 0f 85 b9 09 00 00 48 89 e8 RSP: 0018:ffffc90004ec7938 EFLAGS: 00010202 RAX: 091f51291bffff80 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffffed100349438f RSI: ffff88814908f210 RDI: ffff888007777780 RBP: ffff888000103990 R08: ffff88814d0fadd9 R09: 0000000000000002 R10: ffffffff81f27416 R11: 0000000000000001 R12: ffff888007777770 R13: 48fa8948dffffc00 R14: ffff888000103990 R15: ffff88801a4a1c78 FS: 00007fccd15ab700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888007777780 CR3: 0000000019954000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_unlink_sibling fs/kernfs/dir.c:400 [inline] __kernfs_remove+0x659/0xab0 fs/kernfs/dir.c:1359 kernfs_remove_by_name_ns+0x4f/0xa0 fs/kernfs/dir.c:1544 kernfs_remove_by_name include/linux/kernfs.h:570 [inline] remove_files+0x96/0x1c0 fs/sysfs/group.c:28 sysfs_remove_group+0x87/0x170 fs/sysfs/group.c:288 sysfs_remove_groups fs/sysfs/group.c:312 [inline] sysfs_remove_groups+0x5c/0xa0 fs/sysfs/group.c:304 destroy_port drivers/infiniband/core/sysfs.c:1284 [inline] ib_free_port_attrs+0x162/0x460 drivers/infiniband/core/sysfs.c:1409 remove_one_compat_dev drivers/infiniband/core/device.c:1001 [inline] rdma_dev_exit_net+0x2b2/0x550 drivers/infiniband/core/device.c:1139 ops_exit_list+0xb0/0x160 net/core/net_namespace.c:168 setup_net+0x639/0xa30 net/core/net_namespace.c:349 copy_net_ns+0x318/0x760 net/core/net_namespace.c:470 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3075 __do_sys_unshare kernel/fork.c:3146 [inline] __se_sys_unshare kernel/fork.c:3144 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3144 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fccd4035ae9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fccd15ab188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fccd4148f60 RCX: 00007fccd4035ae9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007fccd408ff6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc5ee419af R14: 00007fccd15ab300 R15: 0000000000022000 Modules linked in: CR2: ffff888007777780 ---[ end trace b5a0bd8762f854d7 ]--- RIP: 0010:____rb_erase_color lib/rbtree.c:254 [inline] RIP: 0010:rb_erase+0x48b/0x1210 lib/rbtree.c:445 Code: 00 0f 84 07 ff ff ff 48 89 ef 48 89 14 24 e8 ec dc bd fd 48 8b 14 24 e9 f2 fe ff ff 4c 89 e8 49 89 ee 4c 89 6d 08 48 c1 e8 03 <49> 89 6c 24 10 49 83 ce 01 80 3c 18 00 0f 85 b9 09 00 00 48 89 e8 RSP: 0018:ffffc90004ec7938 EFLAGS: 00010202 RAX: 091f51291bffff80 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffffed100349438f RSI: ffff88814908f210 RDI: ffff888007777780 RBP: ffff888000103990 R08: ffff88814d0fadd9 R09: 0000000000000002 R10: ffffffff81f27416 R11: 0000000000000001 R12: ffff888007777770 R13: 48fa8948dffffc00 R14: ffff888000103990 R15: ffff88801a4a1c78 FS: 00007fccd15ab700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff888007777780 CR3: 0000000019954000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 0f 84 07 ff ff ff je 0xffffff0d 6: 48 89 ef mov %rbp,%rdi 9: 48 89 14 24 mov %rdx,(%rsp) d: e8 ec dc bd fd callq 0xfdbddcfe 12: 48 8b 14 24 mov (%rsp),%rdx 16: e9 f2 fe ff ff jmpq 0xffffff0d 1b: 4c 89 e8 mov %r13,%rax 1e: 49 89 ee mov %rbp,%r14 21: 4c 89 6d 08 mov %r13,0x8(%rbp) 25: 48 c1 e8 03 shr $0x3,%rax * 29: 49 89 6c 24 10 mov %rbp,0x10(%r12) <-- trapping instruction 2e: 49 83 ce 01 or $0x1,%r14 32: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 36: 0f 85 b9 09 00 00 jne 0x9f5 3c: 48 89 e8 mov %rbp,%rax