[syzbot] [rdma?] KFENCE: invalid free in gid_table_release_one

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    36ece9697e89 Add linux-next specific files for 20260331
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1415f5da580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e5c508e55e8ef9a7
dashboard link: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/46de62fad824/disk-36ece969.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/88dd71e1e51a/vmlinux-36ece969.xz
kernel image: https://storage.googleapis.com/syzbot-assets/51e7e482e157/bzImage-36ece969.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4334f9a250019c1b79b4@xxxxxxxxxxxxxxxxxxxxxxxxx

smbdirect: ib_dev[syz2] removed
==================================================================
BUG: KFENCE: invalid free in release_gid_table drivers/infiniband/core/cache.c:804 [inline]
BUG: KFENCE: invalid free in gid_table_release_one+0x384/0x470 drivers/infiniband/core/cache.c:877

Invalid free of 0xffff88823bf88fd8 (in kfence-#195):
 release_gid_table drivers/infiniband/core/cache.c:804 [inline]
 gid_table_release_one+0x384/0x470 drivers/infiniband/core/cache.c:877
 ib_device_release+0xd2/0x1c0 drivers/infiniband/core/device.c:482
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x228/0x560 lib/kobject.c:737
 process_one_work kernel/workqueue.c:3278 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3361
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3442
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

kfence-#195: 0xffff88823bf88f00-0xffff88823bf88fdf, size=224, cache=kmalloc-256

allocated by task 14262 on cpu 0 at 508.565598s (487.512186s ago):
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 alloc_gid_table drivers/infiniband/core/cache.c:773 [inline]
 _gid_table_setup_one drivers/infiniband/core/cache.c:888 [inline]
 gid_table_setup_one drivers/infiniband/core/cache.c:916 [inline]
 ib_cache_setup_one+0x198/0x570 drivers/infiniband/core/cache.c:1606
 ib_register_device+0xfbd/0x13e0 drivers/infiniband/core/device.c:1426
 siw_device_register drivers/infiniband/sw/siw/siw_main.c:71 [inline]
 siw_newlink+0x8fe/0xde0 drivers/infiniband/sw/siw/siw_main.c:430
 nldev_newlink+0x5bc/0x650 drivers/infiniband/core/nldev.c:1812
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0x6d1/0xa10 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:786 [inline]
 __sock_sendmsg net/socket.c:801 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2650
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2704
 __sys_sendmsg net/socket.c:2736 [inline]
 __do_sys_sendmsg net/socket.c:2741 [inline]
 __se_sys_sendmsg net/socket.c:2739 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 57 Comm: kworker/u8:4 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: ib-unreg-wq ib_unregister_work
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup