------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 11982 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 11982 Comm: syz.3.1719 Not tainted 6.11.0-rc1-syzkaller-00233-g948752d2e010 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 b8 f0 07 fd 84 db 0f 85 66 ff ff ff e8 0b f6 07 fd c6 05 2c 0b 79 0b 01 90 48 c7 c7 40 21 b0 8b e8 a7 3c ca fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 e8 f5 07 fd 0f b6 1d 07 0b 79 0b 31
RSP: 0018:ffffc90000908d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814cc379
RDX: ffff888054554880 RSI: ffffffff814cc386 RDI: 0000000000000001
RBP: ffff88802fdaa448 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88802fdaa448 R14: ffff888046d67800 R15: 0000000000000000
FS: 00007fa94c9d26c0(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020c61000 CR3: 000000005453e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:275 [inline]
__refcount_dec_and_test include/linux/refcount.h:307 [inline]
refcount_dec_and_test include/linux/refcount.h:325 [inline]
p9_req_put+0x1f4/0x250 net/9p/client.c:404
req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2595 [inline]
vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2570
__handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:put_flush_tlb_info arch/x86/mm/tlb.c:994 [inline]
RIP: 0010:flush_tlb_mm_range+0x176/0x330 arch/x86/mm/tlb.c:1035
Code: 03 0f b6 14 16 38 d0 7c 08 84 d2 0f 85 72 01 00 00 3b 0d 3d 1b d4 0e 0f 82 f6 00 00 00 65 48 8b 05 ff 3b c5 7e 48 39 c3 74 72 <65> ff 0d c3 e6 c3 7e bf 01 00 00 00 e8 49 b9 1b 00 65 8b 05 ea 3a
RSP: 0018:ffffc900032cf490 EFLAGS: 00000206
RAX: 000000000000fa93 RBX: ffff88801b2ad580 RCX: 1ffffffff28c5cae
RDX: 0000000000000000 RSI: ffffffff8b4cc500 RDI: ffffffff8bb08400
RBP: 0000000020c62000 R08: 0000000000000001 R09: fffffbfff28c56d8
R10: ffffffff9462b6c7 R11: 0000000000000000 R12: 0000000020c61000
R13: ffff88806b33dc80 R14: ffff88801b2ade40 R15: 0000000000000003
flush_tlb_page arch/x86/include/asm/tlbflush.h:254 [inline]
ptep_clear_flush+0x136/0x180 mm/pgtable-generic.c:101
wp_page_copy mm/memory.c:3401 [inline]
do_wp_page+0x1501/0x3430 mm/memory.c:3727
handle_pte_fault mm/memory.c:5538 [inline]
__handle_mm_fault+0x2468/0x5660 mm/memory.c:5665
handle_mm_fault+0x44e/0x7b0 mm/memory.c:5833
do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1389
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
RIP: 0010:copy_to_user_iter lib/iov_iter.c:25 [inline]
RIP: 0010:iterate_iovec include/linux/iov_iter.h:51 [inline]
RIP: 0010:iterate_and_advance2 include/linux/iov_iter.h:247 [inline]
RIP: 0010:iterate_and_advance include/linux/iov_iter.h:271 [inline]
RIP: 0010:_copy_to_iter+0x4cd/0x1150 lib/iov_iter.c:185
Code: 45 e8 47 bc 09 fd 48 8b 4c 24 18 89 ee 48 8b 44 24 28 4c 8d 34 01 4c 89 f7 e8 bf ea 66 fd 0f 01 cb 48 89 e9 4c 89 ff 4c 89 f6 a4 0f 1f 00 0f 01 ca 48 89 e8 48 29 eb 48 29 c8 48 01 cb 48 01
RSP: 0018:ffffc900032cf960 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000e80
RDX: 0000000000000000 RSI: ffff888013234180 RDI: 0000000020c61000
RBP: 0000000000001000 R08: 0000000000000000 R09: ffffed10026469ff
R10: ffff888013234fff R11: 0000000000000000 R12: 0000000000c60b80
R13: ffffc900032cfd50 R14: ffff888013234000 R15: 0000000020c60e80
copy_page_to_iter lib/iov_iter.c:362 [inline]
copy_page_to_iter+0xf1/0x180 lib/iov_iter.c:349
process_vm_rw_pages mm/process_vm_access.c:45 [inline]
process_vm_rw_single_vec mm/process_vm_access.c:118 [inline]
process_vm_rw_core.constprop.0+0x5c9/0xa10 mm/process_vm_access.c:216
process_vm_rw+0x301/0x360 mm/process_vm_access.c:284
__do_sys_process_vm_readv mm/process_vm_access.c:296 [inline]
__se_sys_process_vm_readv mm/process_vm_access.c:292 [inline]
__x64_sys_process_vm_readv+0xe2/0x1c0 mm/process_vm_access.c:292
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa94bb779f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa94c9d2048 EFLAGS: 00000246 ORIG_RAX: 0000000000000136
RAX: ffffffffffffffda RBX: 00007fa94bd05f80 RCX: 00007fa94bb779f9
RDX: 0000000000000002 RSI: 0000000020008400 RDI: 00000000000005f5
RBP: 00007fa94bbe58ee R08: 0000000000000286 R09: 0000000000000000
R10: 0000000020008640 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fa94bd05f80 R15: 00007fff8d227428
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 0f b6 14 16 movzbl (%rsi,%rdx,1),%edx
4: 38 d0 cmp %dl,%al
6: 7c 08 jl 0x10
8: 84 d2 test %dl,%dl
a: 0f 85 72 01 00 00 jne 0x182
10: 3b 0d 3d 1b d4 0e cmp 0xed41b3d(%rip),%ecx # 0xed41b53
16: 0f 82 f6 00 00 00 jb 0x112
1c: 65 48 8b 05 ff 3b c5 mov %gs:0x7ec53bff(%rip),%rax # 0x7ec53c23
23: 7e
24: 48 39 c3 cmp %rax,%rbx
27: 74 72 je 0x9b
* 29: 65 ff 0d c3 e6 c3 7e decl %gs:0x7ec3e6c3(%rip) # 0x7ec3e6f3 <-- trapping instruction
30: bf 01 00 00 00 mov $0x1,%edi
35: e8 49 b9 1b 00 call 0x1bb983
3a: 65 gs
3b: 8b .byte 0x8b
3c: 05 .byte 0x5
3d: ea (bad)
3e: 3a .byte 0x3a