__rds_conn_create() calls trans->conn_free() with rds_conn_lock held and IRQs disabled when it loses the race to insert a connection. rds_ib_conn_free() takes the device list lock with spin_lock_irq() and releases it with spin_unlock_irq(), so IRQs are turned on while rds_conn_lock is still held: raw_local_irq_restore() called with IRQs enabled WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20 _raw_spin_unlock_irqrestore+0x67/0x80 __rds_conn_create+0x1de5/0x2290 rds_conn_create_outgoing+0x43/0x60 rds_sendmsg+0xfca/0x20e0 __sys_sendto+0x408/0x5a0 It needs an RDS socket bound to an address on an RDMA device (e.g. rxe) and two concurrent sendto() calls to the same new destination. The TCP and loopback ->conn_free() callbacks already use irqsave, so do the same here. Fixes: 745cbccac3fe ("RDS: Rewrite connection cleanup, fixing oops on rmmod") Reported-by: syzbot+c3741bb338b5c6d6a4aa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c3741bb338b5c6d6a4aa Cc: stable@vger.kernel.org Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>