------------[ cut here ]------------
WARNING: CPU: 1 PID: 7525 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28
refcount_t: underflow; use-after-free.
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 1 UID: 0 PID: 7525 Comm: syz.2.1054 Not tainted 6.12.0-rc7-syzkaller #0
Hardware name: ARM-Versatile Express
Call trace: 
[<8199ca98>] (dump_backtrace) from [<8199cb94>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:00000000 r6:82622f44 r5:00000000 r4:8203dc20
[<8199cb7c>] (show_stack) from [<819bb028>] (__dump_stack lib/dump_stack.c:94 [inline])
[<8199cb7c>] (show_stack) from [<819bb028>] (dump_stack_lvl+0x54/0x7c lib/dump_stack.c:120)
[<819bafd4>] (dump_stack_lvl) from [<819bb068>] (dump_stack+0x18/0x1c lib/dump_stack.c:129)
 r5:00000000 r4:82870d18
[<819bb050>] (dump_stack) from [<8199d6c0>] (panic+0x120/0x374 kernel/panic.c:354)
[<8199d5a0>] (panic) from [<80242118>] (check_panic_on_warn kernel/panic.c:243 [inline])
[<8199d5a0>] (panic) from [<80242118>] (get_taint+0x0/0x1c kernel/panic.c:238)
 r3:8260c5c4 r2:00000001 r1:82025ff4 r0:8202da5c
 r7:808408b8
[<802420a4>] (check_panic_on_warn) from [<8024227c>] (__warn+0x80/0x188 kernel/panic.c:748)
[<802421fc>] (__warn) from [<8024256c>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:783)
 r8:00000009 r7:8208c430 r6:e4771c24 r5:853cb000 r4:00000000
[<80242388>] (warn_slowpath_fmt) from [<808408b8>] (refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28)
 r10:853cb000 r9:84b13280 r8:00000064 r7:00000000 r6:8182a15c r5:00000002
 r4:85406540
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (__refcount_sub_and_test include/linux/refcount.h:275 [inline])
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (__refcount_dec_and_test include/linux/refcount.h:307 [inline])
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (refcount_dec_and_test include/linux/refcount.h:325 [inline])
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (skb_unref include/linux/skbuff.h:1232 [inline])
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (__sk_skb_reason_drop net/core/skbuff.c:1213 [inline])
[<8084077c>] (refcount_warn_saturate) from [<8149bc18>] (sk_skb_reason_drop+0x1d8/0x248 net/core/skbuff.c:1241)
[<8149ba40>] (sk_skb_reason_drop) from [<8182a15c>] (kfree_skb_reason include/linux/skbuff.h:1262 [inline])
[<8149ba40>] (sk_skb_reason_drop) from [<8182a15c>] (kfree_skb include/linux/skbuff.h:1271 [inline])
[<8149ba40>] (sk_skb_reason_drop) from [<8182a15c>] (j1939_session_destroy+0x78/0x200 net/can/j1939/transport.c:282)
 r9:84b13280 r8:00000064 r7:84b13284 r6:8514cc50 r5:8514cc00 r4:85406540
[<8182a0e4>] (j1939_session_destroy) from [<8182b478>] (__j1939_session_release net/can/j1939/transport.c:294 [inline])
[<8182a0e4>] (j1939_session_destroy) from [<8182b478>] (kref_put include/linux/kref.h:65 [inline])
[<8182a0e4>] (j1939_session_destroy) from [<8182b478>] (j1939_session_put+0x54/0x58 net/can/j1939/transport.c:299)
 r6:84b13278 r5:84b13278 r4:84b13278
[<8182b424>] (j1939_session_put) from [<81828538>] (j1939_sk_queue_drop_all+0x7c/0xc4 net/can/j1939/socket.c:144)
[<818284bc>] (j1939_sk_queue_drop_all) from [<81829a74>] (j1939_sk_netdev_event_netdown+0x50/0x8c net/can/j1939/socket.c:1296)
 r9:00000000 r8:854d7824 r7:00000064 r6:854d7828 r5:854d7000 r4:84b13000
[<81829a24>] (j1939_sk_netdev_event_netdown) from [<81826ea4>] (j1939_netdev_notify+0x110/0x150 net/can/j1939/main.c:377)
 r9:00000000 r8:ffffffcd r7:843e4148 r6:854d7000 r5:00000002 r4:854d7810
[<81826d94>] (j1939_netdev_notify) from [<80271530>] (notifier_call_chain+0x74/0x1ac kernel/notifier.c:93)
 r7:843e4148 r6:827e8f24 r5:827e8f44 r4:81826d94
[<802714bc>] (notifier_call_chain) from [<8027174c>] (raw_notifier_call_chain+0x20/0x28 kernel/notifier.c:461)
 r10:00000000 r9:e4771ecb r8:00000081 r7:843e4148 r6:843d1a00 r5:00000002
 r4:e4771dd8
[<8027172c>] (raw_notifier_call_chain) from [<814b68bc>] (call_netdevice_notifiers_info+0x54/0xa0 net/core/dev.c:1996)
[<814b6868>] (call_netdevice_notifiers_info) from [<814bedec>] (call_netdevice_notifiers_extack net/core/dev.c:2034 [inline])
[<814b6868>] (call_netdevice_notifiers_info) from [<814bedec>] (call_netdevice_notifiers net/core/dev.c:2048 [inline])
[<814b6868>] (call_netdevice_notifiers_info) from [<814bedec>] (__dev_notify_flags+0x64/0xe4 net/core/dev.c:8886)
 r6:00000000 r5:00000081 r4:843e4000
[<814bed88>] (__dev_notify_flags) from [<814bf7ac>] (dev_change_flags+0x54/0x60 net/core/dev.c:8922)
 r5:00000000 r4:843e4000
[<814bf758>] (dev_change_flags) from [<814f41dc>] (dev_ifsioc+0x528/0x6bc net/core/dev_ioctl.c:526)
 r8:843d1a00 r7:00000000 r6:e4771ecc r5:843e4000 r4:00008914
[<814f3cb4>] (dev_ifsioc) from [<814f466c>] (dev_ioctl+0x2fc/0x678 net/core/dev_ioctl.c:783)
 r9:e4771ecb r8:00000000 r7:843d1a00 r6:e4771ecc r5:00000014 r4:00008914
[<814f4370>] (dev_ioctl) from [<81487fb4>] (sock_do_ioctl net/socket.c:1241 [inline])
[<814f4370>] (dev_ioctl) from [<81487fb4>] (sock_ioctl+0x564/0x608 net/socket.c:1346)
 r10:853cb000 r9:81c7e6cc r8:e4771ecc r7:b5403587 r6:843d1a00 r5:20000080
 r4:00008914 r3:00000000
[<81487a50>] (sock_ioctl) from [<805302cc>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<81487a50>] (sock_ioctl) from [<805302cc>] (__do_sys_ioctl fs/ioctl.c:907 [inline])
[<81487a50>] (sock_ioctl) from [<805302cc>] (sys_ioctl+0x134/0xd98 fs/ioctl.c:893)
 r9:842f4540 r8:00000006 r7:20000080 r6:842f4541 r5:00000000 r4:00008914
[<80530198>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xe4771fa8 to 0xe4771ff0)
1fa0:                   00000000 00000000 00000006 00008914 20000080 00000000
1fc0: 00000000 00000000 002862f0 00000036 00000000 00006364 003d0f00 76bf70bc
1fe0: 76bf6ec0 76bf6eb0 00018af0 00133450
 r10:00000036 r9:853cb000 r8:8020029c r7:00000036 r6:002862f0 r5:00000000
 r4:00000000
Rebooting in 86400 seconds..