------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 112 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 112 Comm: kswapd0 Not tainted 6.11.0-rc5-syzkaller-00050-g3ec3f5fc4a91 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 18 17 0c fd 84 db 0f 85 66 ff ff ff e8 2b 15 0c fd c6 05 5f 16 7b 0b 01 90 48 c7 c7 60 ff af 8b e8 d7 cd ce fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 08 15 0c fd 0f b6 1d 3a 16 7b 0b 31
RSP: 0018:ffffc90000007d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814dd3f9
RDX: ffff88801ba68000 RSI: ffffffff814dd406 RDI: 0000000000000001
RBP: ffff88805700ccc8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805700ccc8
R13: ffff88805a6d3000 R14: 0000000000000015 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802c000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f0e92bb4 CR3: 000000007601e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 p9_req_put+0x1ec/0x250 net/9p/client.c:404
 req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2595 [inline]
 vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2570
 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:247 [inline]
 call_irq_handler arch/x86/kernel/irq.c:259 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:rcu_is_watching+0x5/0xc0 kernel/rcu/tree.c:722
Code: e8 d0 e6 93 09 65 8a 05 35 5d 92 7e 0f b6 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <53> 65 ff 05 ab 39 92 7e e8 6e e6 93 09 48 c7 c3 c8 7e 03 00 83 f8
RSP: 0018:ffffc9000111f9c8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff888012562000 RCX: ffffffff81c75b6b
RDX: ffff88801ba68000 RSI: ffffffff81c75d8d RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88802a70f040 R15: ffff888028ebb630
 rcu_read_lock include/linux/rcupdate.h:839 [inline]
 percpu_ref_put_many include/linux/percpu-refcount.h:330 [inline]
 percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
 css_put include/linux/cgroup_refcnt.h:79 [inline]
 mem_cgroup_put include/linux/memcontrol.h:819 [inline]
 shrink_many mm/vmscan.c:4859 [inline]
 lru_gen_shrink_node+0xb52/0x1510 mm/vmscan.c:4954
 shrink_node mm/vmscan.c:5934 [inline]
 kswapd_shrink_node mm/vmscan.c:6762 [inline]
 balance_pgdat+0x110f/0x1950 mm/vmscan.c:6954
 kswapd+0x5ea/0xbf0 mm/vmscan.c:7223
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 d0 e6 93 09       	call   0x993e6d5
   5:	65 8a 05 35 5d 92 7e 	mov    %gs:0x7e925d35(%rip),%al        # 0x7e925d41
   c:	0f b6 c0             	movzbl %al,%eax
   f:	c3                   	ret
  10:	cc                   	int3
  11:	cc                   	int3
  12:	cc                   	int3
  13:	cc                   	int3
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	f3 0f 1e fa          	endbr64
  29:	55                   	push   %rbp
* 2a:	53                   	push   %rbx <-- trapping instruction
  2b:	65 ff 05 ab 39 92 7e 	incl   %gs:0x7e9239ab(%rip)        # 0x7e9239dd
  32:	e8 6e e6 93 09       	call   0x993e6a5
  37:	48 c7 c3 c8 7e 03 00 	mov    $0x37ec8,%rbx
  3e:	83                   	.byte 0x83
  3f:	f8                   	clc