------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 7782 at lib/refcount.c:25 refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Modules linked in:
CPU: 1 UID: 0 PID: 7782 Comm: syz.2.550 Not tainted 6.15.0-syzkaller-11796-g5abc7438f1e9 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Code: ff 89 de e8 f8 5c e4 fc 84 db 0f 85 e6 fe ff ff e8 0b 62 e4 fc c6 05 ce 94 98 0b 01 90 48 c7 c7 40 e1 f4 8b e8 17 2e a3 fc 90 <0f> 0b 90 90 e9 c3 fe ff ff e8 e8 61 e4 fc c6 05 a9 94 98 0b 01 90
RSP: 0000:ffffc90000a086e0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ad368
RDX: ffff88803146bc00 RSI: ffffffff817ad375 RDI: 0000000000000001
RBP: ffff888034b5c26c R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888034b5c26c
R13: ffff888034b5c100 R14: ffff888030318f00 R15: ffff8880343c7e00
FS: 000055556c549500(0000) GS:ffff888124a6c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c259197 CR3: 000000005df5a000 CR4: 0000000000350ef0
Call Trace:
__refcount_add include/linux/refcount.h:289 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_net include/net/net_namespace.h:268 [inline]
tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
tipc_crypto_xmit+0x20c1/0x2550 net/tipc/crypto.c:1761
tipc_crypto_clone_msg net/tipc/crypto.c:1656 [inline]
tipc_crypto_xmit+0x1f09/0x2550 net/tipc/crypto.c:1717
tipc_bearer_xmit_skb+0x15f/0x430 net/tipc/bearer.c:572
tipc_disc_timeout+0x5b2/0x850 net/tipc/discover.c:338
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: e6 3a 55 00 48 89 df 5b e9 9d c0 5a 00 be 03 00 00 00 5b e9 52 9c 1b 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 34 24 65 48 8b 15 58 3a ef 11 65 8b 05 69 3a ef
RSP: 0000:ffffc90003097990 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffffea0001a467c0 RCX: ffffffff822d794d
RDX: ffff88803146bc00 RSI: ffffffff822d795b RDI: 0000000000000007
RBP: ffffffff8dd10440 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffea0001a467c0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
folio_test_slab include/linux/page-flags.h:1074 [inline]
PageSlab include/linux/page-flags.h:1085 [inline]
page_table_check_set+0xc8/0x750 mm/page_table_check.c:109
__page_table_check_ptes_set+0x318/0x420 mm/page_table_check.c:209
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
set_pte_range+0x4e8/0x740 mm/memory.c:5350
filemap_map_order0_folio mm/filemap.c:3692 [inline]
filemap_map_pages+0x56c/0x1680 mm/filemap.c:3746
do_fault_around mm/memory.c:5568 [inline]
do_read_fault mm/memory.c:5601 [inline]
do_fault mm/memory.c:5744 [inline]
do_pte_missing mm/memory.c:4251 [inline]
handle_pte_fault mm/memory.c:6089 [inline]
__handle_mm_fault+0x3b3b/0x5490 mm/memory.c:6232
handle_mm_fault+0x589/0xd10 mm/memory.c:6401
do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f648066ecad
Code: ff 48 83 e8 01 48 89 ee bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 e9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 11 fd ff ff e9 c0 fd ff ff e8 7b 2b
RSP: 002b:00007fffef641300 EFLAGS: 00010212
RAX: 000000110c254000 RBX: 00007f64814e5720 RCX: 0000000000000001
RDX: 0000000000001dc8 RSI: 0000000000003177 RDI: 0000000000000002
RBP: ffffffff812c5dc8 R08: 00007f64809b6038 R09: 00007f64809a2000
R10: 00007f647fdff008 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff812c54b3 R15: 0000000000000004
----------------
Code disassembly (best guess):
0: e6 3a out %al,$0x3a
2: 55 push %rbp
3: 00 48 89 add %cl,-0x77(%rax)
6: df 5b e9 fistps -0x17(%rbx)
9: 9d popf
a: c0 5a 00 be rcrb $0xbe,0x0(%rdx)
e: 03 00 add (%rax),%eax
10: 00 00 add %al,(%rax)
12: 5b pop %rbx
13: e9 52 9c 1b 03 jmp 0x31b9c6a
18: 66 90 xchg %ax,%ax
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: f3 0f 1e fa endbr64 <-- trapping instruction
2e: 48 8b 34 24 mov (%rsp),%rsi
32: 65 48 8b 15 58 3a ef mov %gs:0x11ef3a58(%rip),%rdx # 0x11ef3a92
39: 11
3a: 65 gs
3b: 8b .byte 0x8b
3c: 05 .byte 0x5
3d: 69 .byte 0x69
3e: 3a ef cmp %bh,%ch