From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f174.google.com (mail-qt1-f174.google.com [209.85.160.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B9013375ADE for ; Mon, 13 Apr 2026 17:42:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776102160; cv=none; b=Ctg0ZbKTECUbCoGCG7NR2zGisv+61rQPkAniZfsSvJdZf2699mU4VjKNHDfljrm9fElJl1x8iLr0XbYA4gU9R65cqBjpMEuXdj+Bp4KYowvwG2uYrqcXxP0mEEYBr2JbC2ic8E6dqZqZ3HlA82kYJY58loFi0QO8FJApcxT+SbM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776102160; c=relaxed/simple; bh=40D9/sGMozIjmtBqWMzTTl8LH1+xqFnrILKvDECrlQk=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=moQKb59PNWzlR1PsNw70gYyZkKhXl/fKQlryIDQpMxDMNkxuKUwOEFIMnvsF72v5uNfeT4tgwBqI0/TvEccGr6SWMkMPqPHp7cAvvha0u28qEimylwT4Q/c3Tvb/6aEJtEHiQOUmb8HWk5UGSt4uqz4k5dQmOpOWzBn1RR3bn8w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=BRjyAO0k; arc=none smtp.client-ip=209.85.160.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="BRjyAO0k" Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-50d8da3e656so46086701cf.1 for ; Mon, 13 Apr 2026 10:42:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1776102156; x=1776706956; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=9P15ZvH/WcKMIIoGY4JlV5XMiItkZb3l1DLJfQHNL7c=; b=BRjyAO0kCrhZlmK/5AG/GCc/WkADcg2VCjiIT0WMVze1VZk6C7QM7eOnBkwipk8JDC kSCpsj/HYrCSrlvxnrwl1O0Sw0n5DCpxG5/m8KRp4i2XiTfxh803zi/rLcuRS/DC6FmX zW0OxSVunu4GPhtPBY40DMeWMH5KFut7AnvJ1VOoCv2Rvuf8wyfXR8JmqUhFUFfVyAUR s/e/DIevRMfrxr3kAI7PgHITNSawwZGIizmIIDb2WJElCpHKYVdfaPBQsMc+9OmDslOR yK9/zpxmdeAmhd4589xZm6wyTLWyt1yD2c36rb5tEwdMszzk2PolqJASeMv5pirVelFn uTLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776102156; x=1776706956; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=9P15ZvH/WcKMIIoGY4JlV5XMiItkZb3l1DLJfQHNL7c=; b=Wgj/bxuI8KLz3bEBje5WahBANwQhYmHJGf7okk8rFnUIh3INCqv5ZljQ10OsCqNUKd ueJiOwNOk9cFyJJcr/z4vOx4RamvNr/BE8O99WEBCboThBQFojpm9mICWt1OjcJiKI// 6hZDYIcgKCaXNgJ02ZcYuNn1AZevedsS7owCXDIbLECxwhwglZUiWJaeFT91DCNWqWx0 PvJb3knIBkq1vv8Gp/SwTRXy5e4X312+C+S2FaS+QomnGIm7KBoIaT1Pu0UqTYOOSgb+ jNWbHIvy4vmfa2BtPaZofSwdI9BE41Cng70DEJkqISePxPf/Inje6/n5I2zQgu+Pen9V DgEQ== X-Forwarded-Encrypted: i=1; AFNElJ+3OTk+ou/l2Q/C21Rrac2nlZYCDLIyZN9/JK/8QTYaUvhprL1oWd4m8fdlB1r8IkMwt1OSau8/s5aZNkA=@vger.kernel.org X-Gm-Message-State: AOJu0YyhSmXBmOgv3Zpa1xr66mAFxQqdMCGDzT5FCNbSonVrcKwIswX/ oge/O18zP/fMO/0NYxwElXlKzZLg3mXVvaXlTJHil7d9ZEvdJw6clAa8dxhr5jnx4zo= X-Gm-Gg: AeBDiet1SaoKunkQzPFvbI05p/O570NPdGZJcSYOS6exbX2sbSHodYOZijy02ECBwcy lGudF8EJycMHL36S4QZIBQN/VVaAMvO0NVMzg74Y6z82q/2Ivuy2XP9tugfxg03Fq16QmQWK4V2 k/QBB//i3Re0TwBLTuZBdBK4G7UXScyp8Nhx+2cL3V6/dnjl2Gq6iaX8nvC/f/2VbiTgNMIO2sT awFHkJyvtd2DZ6+1bT4v+iTK3pKPyMSou/TJTE6JjhCGKGAT/Bgw8tyWrkhs/R4r0XNOIV5BKFc gB7wm7r5LDiKdUGEvpUQgLEi6nhajLIljDVWmL0jsmh4ynU55g2+dFDIN80KAV0DArs2pK0lomd 2u8736c5i4G4WaL28tpkzcnHczxHOPb0Vq0vFgMtkdSQ4RtkYRlDUvdskk7cH6q/Tc1mkNqXxjw QbM7FXfCADsbyv+hAAdyZJaahWy/9QWrk7E0w7j1fH+4zUcGjnd8J6Ub98BZjPaEfi0D0C9NDQr 60iwA== X-Received: by 2002:a05:622a:2305:b0:509:1009:e7a6 with SMTP id d75a77b69052e-50dd5ba317fmr229021571cf.43.1776102149554; Mon, 13 Apr 2026 10:42:29 -0700 (PDT) Received: from ziepe.ca (crbknf0213w-47-54-130-67.pppoe-dynamic.high-speed.nl.bellaliant.net. [47.54.130.67]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ac84a180a2sm104198376d6.15.2026.04.13.10.42.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 10:42:28 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wCLIq-00000005q47-1UXO; Mon, 13 Apr 2026 14:42:28 -0300 Date: Mon, 13 Apr 2026 14:42:28 -0300 From: Jason Gunthorpe To: Jiri Pirko Cc: Leon Romanovsky , syzbot , "linux-kernel@vger.kernel.org" , "linux-rdma@vger.kernel.org" , "syzkaller-bugs@googlegroups.com" Subject: Re: [syzbot] [rdma?] WARNING in ib_dealloc_device Message-ID: <20260413174228.GQ3694781@ziepe.ca> References: <69dc3310.a00a0220.475f0.0018.GAE@google.com> <20260413154353.GK21470@unreal> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Mon, Apr 13, 2026 at 04:12:09PM +0000, Jiri Pirko wrote: > Will check it tmrw I fed it to Claude and after 40 mins it is stumped too.. It should not be possible for this to happen. __ib_unregister_device() always calls down to disable_device() Which always removes it from all visibility, drives the refcount to 0 and then cleans the xarray: xa_for_each (&device->compat_devs, index, cdev) remove_one_compat_dev(device, index); Then ib_dealloc_device() checks it is empty: WARN_ON(!xa_empty(&device->compat_devs)); At the point the xa_for_each is run there should be no cocurrent threads that can see the device. The refcount is zero, it was removed from the xarray. The add_one_compat_dev() is never called in an condition that could see a stray device. It should not be possible for the compat_devs of a 0 refcount ib_device removed from the device's xarray to be mutated between those two checks. One notable thing about xarray is you can have a xa_for_each() iterate over nothing and also have xa_empty() be false. Maybe that is happening here, but I could not find any way that should happen. I guess just keep watching this and see if it happens ever again. Add some debugging to print out the xarray. Maybe the way we are using xarray is unexpectedly triggering a stray 0 entry? Jason diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c index 4c174f7f1070cb..592e29b0cccf39 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -1020,6 +1020,71 @@ static void remove_compat_devs(struct ib_device *device) xa_for_each (&device->compat_devs, index, cdev) remove_one_compat_dev(device, index); + + if (!xa_empty(&device->compat_devs)) { + struct xa_node *node; + void *head; + unsigned int i; + + dev_warn(&device->dev, + "compat_devs xarray not empty after removal!\n"); + + xa_lock(&device->compat_devs); + head = xa_head_locked(&device->compat_devs); + dev_warn(&device->dev, " xa_head=%px xa_flags=%x\n", + head, device->compat_devs.xa_flags); + + if (!xa_is_node(head)) { + /* Single entry at index 0 stored directly in head */ + if (xa_is_zero(head)) + dev_warn(&device->dev, + " head[0]: zero entry (leaked xa_reserve)\n"); + else if (!xa_is_internal(head)) + dev_warn(&device->dev, + " head[0]: pointer %px\n", head); + else + dev_warn(&device->dev, + " head[0]: internal %px (%lu)\n", + head, xa_to_internal(head)); + } else { + node = xa_to_node(head); + dev_warn(&device->dev, + " node %px shift %d count %d nr_values %d\n", + node, node->shift, node->count, + node->nr_values); + for (i = 0; i < XA_CHUNK_SIZE; i++) { + void *entry = xa_entry_locked( + &device->compat_devs, node, i); + + if (!entry) + continue; + if (xa_is_zero(entry)) + dev_warn(&device->dev, + " slot[%u]: zero entry (leaked xa_reserve)\n", + i); + else if (xa_is_sibling(entry)) + dev_warn(&device->dev, + " slot[%u]: sibling -> slot %lu\n", + i, xa_to_sibling(entry)); + else if (xa_is_retry(entry)) + dev_warn(&device->dev, + " slot[%u]: retry\n", i); + else if (xa_is_node(entry)) + dev_warn(&device->dev, + " slot[%u]: node %px (deeper tree)\n", + i, xa_to_node(entry)); + else if (!xa_is_internal(entry)) + dev_warn(&device->dev, + " slot[%u]: pointer %px\n", + i, entry); + else + dev_warn(&device->dev, + " slot[%u]: unknown internal %px\n", + i, entry); + } + } + xa_unlock(&device->compat_devs); + } } static int add_compat_devs(struct ib_device *device)