syzbot

------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 6510 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 6510 Comm: syz.1.194 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 lib/refcount.c:28
Code: e0 c7 bf 8b e8 a7 ad f2 fc 90 0f 0b 90 90 eb d7 e8 8b 90 2f fd c6 05 ea 75 f7 0a 01 90 48 c7 c7 40 c8 bf 8b e8 87 ad f2 fc 90 <0f> 0b 90 90 eb b7 e8 6b 90 2f fd c6 05 c7 75 f7 0a 01 90 48 c7 c7
RSP: 0018:ffffc90000a08b88 EFLAGS: 00010246
RAX: eaaf014f6535ae00 RBX: 0000000000000003 RCX: ffff888044121e40
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000a08c90 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa650 R12: 1ffff92000141178
R13: ffff888031edf1b8 R14: ffff888031edf020 R15: 0000000000000001
FS:  00007f250b2986c0(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fb33a4c240 CR3: 000000004553e000 CR4: 00000000003526f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x286/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:raw_spin_rq_unlock_irq+0x13/0x90 kernel/sched/sched.h:1559
Code: cc e8 41 ae b9 09 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 53 66 90 e8 84 43 bc 09 e8 3f a0 35 00 fb 5b <41> 5e 41 5f e9 d4 91 bc 09 cc f3 0f 1e fa 49 be 00 00 00 00 00 fc
RSP: 0018:ffffc9001a6d7648 EFLAGS: 00000286
RAX: eaaf014f6535ae00 RBX: ffff8880b873a040 RCX: eaaf014f6535ae00
RDX: 0000000000000007 RSI: ffffffff8d7e8396 RDI: ffffffff8bc076e0
RBP: ffffc9001a6d7870 R08: ffffffff8f9e1177 R09: 1ffffffff1f3c22e
R10: dffffc0000000000 R11: fffffbfff1f3c22f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888044121e40 R15: 1ffff110170e7568
 __schedule+0x19e0/0x4cc0 kernel/sched/core.c:6937
 preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7256
 irqentry_exit+0x6f/0x90 kernel/entry/common.c:211
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:put_cpu_partial+0x234/0x2e0 mm/slub.c:3931
Code: 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 90 0f 0b 90 e9 e7 fe ff ff e8 49 a4 30 09 41 f7 c5 00 02 00 00 74 b2 fb 4d 85 ff <75> b1 eb ba e8 33 a4 30 09 e9 4f fe ff ff 90 0f 0b 90 e9 66 ff ff
RSP: 0018:ffffc9001a6d79f8 EFLAGS: 00000246
RAX: eaaf014f6535ae00 RBX: ffff88801aebeb40 RCX: eaaf014f6535ae00
RDX: 0000000000000007 RSI: ffffffff8d7e8396 RDI: ffffffff8bc076e0
RBP: 0000000000000001 R08: ffffffff8f9e1177 R09: 1ffffffff1f3c22e
R10: dffffc0000000000 R11: fffffbfff1f3c22f R12: 0000000000000001
R13: 0000000000000282 R14: ffff8880b8740ce0 R15: 0000000000000000
 __slab_free+0x2b9/0x390 mm/slub.c:5906
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4955 [inline]
 slab_alloc_node mm/slub.c:5265 [inline]
 __kmalloc_cache_noprof+0x36f/0x6f0 mm/slub.c:5743
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 ref_tracker_alloc+0x133/0x460 lib/ref_tracker.c:271
 __netns_tracker_alloc include/net/net_namespace.h:362 [inline]
 netns_tracker_alloc include/net/net_namespace.h:371 [inline]
 get_net_track include/net/net_namespace.h:388 [inline]
 sk_alloc+0x1b1/0x370 net/core/sock.c:2307
 __netlink_create+0x65/0x260 net/netlink/af_netlink.c:628
 netlink_create+0x3ca/0x590 net/netlink/af_netlink.c:686
 __sock_create+0x4b3/0x9f0 net/socket.c:1605
 sock_create net/socket.c:1663 [inline]
 __sys_socket_create net/socket.c:1700 [inline]
 __sys_socket+0xd7/0x1b0 net/socket.c:1747
 __do_sys_socket net/socket.c:1761 [inline]
 __se_sys_socket net/socket.c:1759 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1759
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f250a38efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f250b298038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007f250a5e5fa0 RCX: 00007f250a38efc9
RDX: 0000000000000014 RSI: 0000000000000003 RDI: 0000000000000010
RBP: 00007f250a411f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f250a5e6038 R14: 00007f250a5e5fa0 R15: 00007fff6e788df8
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	e8 41 ae b9 09       	call   0x9b9ae47
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	41 57                	push   %r15
  19:	41 56                	push   %r14
  1b:	53                   	push   %rbx
  1c:	66 90                	xchg   %ax,%ax
  1e:	e8 84 43 bc 09       	call   0x9bc43a7
  23:	e8 3f a0 35 00       	call   0x35a067
  28:	fb                   	sti
  29:	5b                   	pop    %rbx
* 2a:	41 5e                	pop    %r14 <-- trapping instruction
  2c:	41 5f                	pop    %r15
  2e:	e9 d4 91 bc 09       	jmp    0x9bc9207
  33:	cc                   	int3
  34:	f3 0f 1e fa          	endbr64
  38:	49                   	rex.WB
  39:	be 00 00 00 00       	mov    $0x0,%esi
  3e:	00 fc                	add    %bh,%ah