------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 8064 at lib/refcount.c:25 refcount_warn_saturate+0xff/0x1a0 lib/refcount.c:25 Modules linked in: CPU: 1 PID: 8064 Comm: syz.2.911 Not tainted 5.15.185-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:refcount_warn_saturate+0xff/0x1a0 lib/refcount.c:25 Code: 09 01 48 c7 c7 40 6b 59 8a e8 dd 27 bb 05 0f 0b eb e0 e8 04 42 9c fd c6 05 ae 8f 79 09 01 48 c7 c7 80 6a 59 8a e8 c1 27 bb 05 <0f> 0b eb c4 e8 e8 41 9c fd c6 05 93 8f 79 09 01 48 c7 c7 e0 6a 59 RSP: 0000:ffffc900027377a8 EFLAGS: 00010246 RAX: b8d818bdda10dc00 RBX: 0000000000000002 RCX: ffff88807e801dc0 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: ffffc90002737910 R08: dffffc0000000000 R09: fffff520004e6e59 R10: fffff520004e6e59 R11: 1ffff920004e6e58 R12: ffff8880770d9a80 R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 FS: 00007f681d5ed6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f68157d4000 CR3: 00000000624c0000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] get_net include/net/net_namespace.h:252 [inline] tipc_aead_encrypt net/tipc/crypto.c:832 [inline] tipc_crypto_xmit+0x1949/0x2560 net/tipc/crypto.c:1772 tipc_bearer_xmit_skb+0x228/0x3c0 net/tipc/bearer.c:574 tipc_disc_timeout+0x568/0x6b0 net/tipc/discover.c:338 call_timer_fn+0x16c/0x530 kernel/time/timer.c:1451 expire_timers kernel/time/timer.c:1496 [inline] __run_timers+0x525/0x7c0 kernel/time/timer.c:1767 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780 handle_softirqs+0x328/0x820 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0033:0x7f681f647d4b Code: cd 48 01 c1 49 39 4f 08 72 4c 8d 4d ff 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 47 0f b6 0c 08 <45> 84 c9 74 08 45 88 0c 00 49 8b 47 10 48 83 c0 01 49 89 47 10 83 RSP: 002b:00007f681d5ec4a0 EFLAGS: 00000202 RAX: 00000000006077d1 RBX: 00007f681d5ec540 RCX: 0000000000000008 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f681d5ec5e0 RBP: 0000000000000102 R08: 00007f68151cd000 R09: 0000000000000000 R10: 0000000000000000 R11: 00007f681d5ec550 R12: 0000000000000001 R13: 00007f681f823020 R14: 0000000000000000 R15: 00007f681d5ec5e0