------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.14.0-syzkaller-13408-g9f867ba24d36 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 48 9c eb fc 84 db 0f 85 66 ff ff ff e8 5b a1 eb fc c6 05 4e 14 9f 0b 01 90 48 c7 c7 80 11 f4 8b e8 07 30 ab fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 38 a1 eb fc 0f b6 1d 29 14 9f 0b 31
RSP: 0018:ffffc900006f8248 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ad098
RDX: ffff88801de98000 RSI: ffffffff817ad0a5 RDI: 0000000000000001
RBP: ffff88803682ba98 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88803682ba98
R13: ffff8880648e5800 R14: 0000000000000014 R15: 1ffff110049c680c
FS: 0000000000000000(0000) GS:ffff8880d6cb3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8a9cf8bf98 CR3: 0000000046c6e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
p9_req_put+0x1ec/0x250 net/9p/client.c:404
req_done+0x1dc/0x2e0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:254 [inline]
call_irq_handler arch/x86/kernel/irq.c:266 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:292
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:285
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline]
RIP: 0010:lock_release+0x8f/0x2f0 kernel/locking/lockdep.c:5883
Code: 01 00 00 65 4c 8b 35 b8 b7 0e 12 41 8b b6 ec 0a 00 00 85 f6 0f 85 ff 00 00 00 48 81 3b 00 7b ad 93 0f 84 f2 00 00 00 9c 41 5d 48 c7 c7 e7 fc cd 8d e8 54 24 da 09 65 ff 05 f5 f4 0e 12 8b 0d
RSP: 0018:ffffc900006f8580 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffffffff8e3c1580 RCX: ffffffff91ce7a01
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffff91ce7a44 R09: 0000000000000000
R10: 0000000000000002 R11: 00000000000a721c R12: ffffffff8169dd14
R13: 0000000000000206 R14: ffff88801de98000 R15: ffffc900006f866c
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:871 [inline]
class_rcu_destructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0x3f9/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4151 [inline]
slab_alloc_node mm/slub.c:4200 [inline]
kmem_cache_alloc_node_noprof+0x1d5/0x3b0 mm/slub.c:4252
kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:577
__alloc_skb+0x166/0x380 net/core/skbuff.c:668
__netdev_alloc_skb+0x213/0x920 net/core/skbuff.c:732
netdev_alloc_skb include/linux/skbuff.h:3413 [inline]
dev_alloc_skb include/linux/skbuff.h:3426 [inline]
__ieee80211_beacon_get+0xc21/0x1720 net/mac80211/tx.c:5475
ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5597
ieee80211_beacon_get include/net/mac80211.h:5648 [inline]
mac80211_hwsim_beacon_tx+0x4dc/0xa40 drivers/net/wireless/virtual/mac80211_hwsim.c:2313
__iterate_interfaces+0x2e2/0x650 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:797
mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2347
__run_hrtimer kernel/time/hrtimer.c:1791 [inline]
__hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1855
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1872
handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:81
Code: 95 5d 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d d3 bc 17 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197df8 EFLAGS: 00000286
RAX: 000000000010d05d RBX: 0000000000000003 RCX: ffffffff8b723439
RDX: 0000000000000000 RSI: ffffffff8dbeeb53 RDI: ffffffff8bf46580
RBP: ffffed1003bd3000 R08: 0000000000000001 R09: ffffed100d4e65bd
R10: ffff88806a732deb R11: 0000000000000000 R12: 0000000000000003
R13: ffff88801de98000 R14: ffffffff90865310 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:748
default_idle_call+0x6d/0xb0 kernel/sched/idle.c:117
cpuidle_idle_call kernel/sched/idle.c:185 [inline]
do_idle+0x391/0x510 kernel/sched/idle.c:325
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:423
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:315
common_startup_64+0x13e/0x148
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 00 65 4c add %ah,0x4c(%rbp)
5: 8b 35 b8 b7 0e 12 mov 0x120eb7b8(%rip),%esi # 0x120eb7c3
b: 41 8b b6 ec 0a 00 00 mov 0xaec(%r14),%esi
12: 85 f6 test %esi,%esi
14: 0f 85 ff 00 00 00 jne 0x119
1a: 48 81 3b 00 7b ad 93 cmpq $0xffffffff93ad7b00,(%rbx)
21: 0f 84 f2 00 00 00 je 0x119
27: 9c pushf
28: 41 5d pop %r13
* 2a: fa cli <-- trapping instruction
2b: 48 c7 c7 e7 fc cd 8d mov $0xffffffff8dcdfce7,%rdi
32: e8 54 24 da 09 call 0x9da248b
37: 65 ff 05 f5 f4 0e 12 incl %gs:0x120ef4f5(%rip) # 0x120ef533
3e: 8b .byte 0x8b
3f: 0d .byte 0xd