------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 24055 at lib/refcount.c:25 refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Modules linked in:
CPU: 3 UID: 0 PID: 24055 Comm: syz-executor Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Code: ff 89 de e8 e8 cc e4 fc 84 db 0f 85 e6 fe ff ff e8 fb d1 e4 fc c6 05 ae 95 99 0b 01 90 48 c7 c7 00 df f4 8b e8 57 f0 a3 fc 90 <0f> 0b 90 90 e9 c3 fe ff ff e8 d8 d1 e4 fc c6 05 89 95 99 0b 01 90
RSP: 0018:ffffc900005e88b0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a92c8
RDX: ffff888048bb4880 RSI: ffffffff817a92d5 RDI: 0000000000000001
RBP: ffff88804cb8426c R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88804cb8426c
R13: ffff88804cb84100 R14: ffff88806c093800 R15: ffff88805916f600
FS: 0000000000000000(0000) GS:ffff888097a72000(0063) knlGS:0000000057339440
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7413230 CR3: 000000005d19e000 CR4: 0000000000352ef0
DR0: 0000000000000007 DR1: 000000000000000b DR2: 0000000000000002
DR3: 0000000000000009 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_add include/linux/refcount.h:289 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_net include/net/net_namespace.h:268 [inline]
tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
tipc_crypto_xmit+0x20c1/0x2550 net/tipc/crypto.c:1761
tipc_bearer_xmit_skb+0x15f/0x430 net/tipc/bearer.c:572
tipc_disc_timeout+0x5b2/0x850 net/tipc/discover.c:338
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5875
Code: e8 12 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 02 df ef 0e 0f 82 74 02 00 00 8b 35 ca 10 f0 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 99 e8 12 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc90007697180 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e3c4b40 RCX: 00000000461f8657
RDX: 0000000000000000 RSI: ffffffff8dbe5250 RDI: ffffffff8bf533a0
RBP: 0000000000000002 R08: fd55b2198b05037c R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
kmalloc_node_noprof include/linux/slab.h:928 [inline]
__get_vm_area_node+0x101/0x330 mm/vmalloc.c:3168
__vmalloc_node_range_noprof+0x271/0x14b0 mm/vmalloc.c:3845
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:3948
xt_compat_init_offsets+0xe6/0x1f0 net/netfilter/x_tables.c:733
ebt_compat_init_offsets net/bridge/netfilter/ebtables.c:1832 [inline]
compat_table_info+0x11b/0x830 net/bridge/netfilter/ebtables.c:1843
compat_do_ebt_get_ctl+0x1d0/0x5a0 net/bridge/netfilter/ebtables.c:2397
do_ebt_get_ctl+0x2c4/0x6d0 net/bridge/netfilter/ebtables.c:2460
nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x18c/0x1e0 net/ipv4/ip_sockglue.c:1777
tcp_getsockopt+0xa1/0x100 net/ipv4/tcp.c:4760
do_sock_getsockopt+0x3fc/0x800 net/socket.c:2357
__sys_getsockopt+0x123/0x1b0 net/socket.c:2386
__do_compat_sys_socketcall net/compat.c:494 [inline]
__se_compat_sys_socketcall net/compat.c:423 [inline]
__ia32_compat_sys_socketcall+0x4ba/0x770 net/compat.c:423
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf70ae579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffcb6250 EFLAGS: 00000286 ORIG_RAX: 0000000000000066
RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000ffcb6288
RDX: 00000000ffcb630c RSI: 00000000ffcb6310 RDI: 00000000f7412ff4
RBP: 00000000ffcb6310 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 12 12 adc (%rdx),%dl
2: 83 f8 07 cmp $0x7,%eax
5: 0f 87 bc 02 00 00 ja 0x2c7
b: 89 c0 mov %eax,%eax
d: 48 0f a3 05 02 df ef bt %rax,0xeefdf02(%rip) # 0xeefdf17
14: 0e
15: 0f 82 74 02 00 00 jb 0x28f
1b: 8b 35 ca 10 f0 0e mov 0xef010ca(%rip),%esi # 0xef010eb
21: 85 f6 test %esi,%esi
23: 0f 85 8d 00 00 00 jne 0xb6
* 29: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2e: 65 48 2b 05 99 e8 12 sub %gs:0x1212e899(%rip),%rax # 0x1212e8cf
35: 12
36: 0f 85 c7 02 00 00 jne 0x303
3c: 48 rex.W
3d: 83 .byte 0x83
3e: c4 .byte 0xc4