------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 18634 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 18634 Comm: syz.7.3517 Not tainted 6.14.0-rc6-syzkaller-00003-g4d872d51bc9d #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 98 44 f7 fc 84 db 0f 85 66 ff ff ff e8 eb 49 f7 fc c6 05 e7 69 88 0b 01 90 48 c7 c7 e0 06 d3 8b e8 67 7a b7 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 c8 49 f7 fc 0f b6 1d c2 69 88 0b 31
RSP: 0018:ffffc900000074f8 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a2269
RDX: ffff8880248e8000 RSI: ffffffff817a2276 RDI: 0000000000000001
RBP: ffff888069a90448 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: ffff888069a90448
R13: ffff888021e98800 R14: 0000000000000015 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802b400000(0063) knlGS:00000000f5065b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f732e8c4 CR3: 00000000718d8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:275 [inline]
__refcount_dec_and_test include/linux/refcount.h:307 [inline]
refcount_dec_and_test include/linux/refcount.h:325 [inline]
p9_req_put+0x1ec/0x250 net/9p/client.c:404
req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:249 [inline]
call_irq_handler arch/x86/kernel/irq.c:261 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:287
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:280
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:queue_work_on+0x98/0x140 kernel/workqueue.c:2397
Code: e8 0d f8 36 00 48 85 ed 75 44 e8 d3 fc 36 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 f1 f7 36 00 48 85 db 0f 85 8d 00 00 00 b3 fc 36 00 44 89 e0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc e8
RSP: 0018:ffffc90000007838 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8182f3c8
RDX: ffff8880248e8000 RSI: ffffffff8182f3d2 RDI: 0000000000000007
RBP: 0000000000000200 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff818bbb8e R12: 0000000000000001
R13: 0000000000000008 R14: ffff88801b091000 R15: ffffc90000007d18
__ieee80211_queue_skb_to_iface net/mac80211/rx.c:233 [inline]
ieee80211_queue_skb_to_iface net/mac80211/rx.c:244 [inline]
ieee80211_rx_h_mgmt net/mac80211/rx.c:4069 [inline]
ieee80211_rx_handlers+0x6613/0x98b0 net/mac80211/rx.c:4227
ieee80211_invoke_rx_handlers net/mac80211/rx.c:4257 [inline]
ieee80211_prepare_and_rx_handle+0x2c4a/0x6fd0 net/mac80211/rx.c:5107
ieee80211_rx_for_interface+0x10a/0x1f0 net/mac80211/rx.c:5192
__ieee80211_rx_handle_packet net/mac80211/rx.c:5348 [inline]
ieee80211_rx_list+0x10d4/0x2970 net/mac80211/rx.c:5483
ieee80211_rx_napi+0xdd/0x400 net/mac80211/rx.c:5506
ieee80211_rx include/net/mac80211.h:5172 [inline]
ieee80211_handle_queued_frames+0xd5/0x130 net/mac80211/main.c:441
tasklet_action_common+0x251/0x3f0 kernel/softirq.c:811
handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 bb 3e f6 48 89 df e8 de 3a 3f f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 a5 11 30 f6 65 8b 05 e6 e4 ab 74 85 c0 74 16 5b
RSP: 0018:ffffc9002654f7d8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff88804a204900 RCX: 1ffffffff2de1aa6
RDX: 0000000000000000 RSI: ffffffff8b6cfc80 RDI: ffffffff8bd359e0
RBP: 0000000000000286 R08: 0000000000000001 R09: fffffbfff2dd7fb0
R10: ffffffff96ebfd87 R11: 0000000000000004 R12: 0000000000000002
R13: ffff88804a204940 R14: ffff88804a2042e8 R15: ffff88804a204768
__unix_dgram_recvmsg+0x32a/0xe50 net/unix/af_unix.c:2457
unix_dgram_recvmsg+0xd0/0x110 net/unix/af_unix.c:2532
sock_recvmsg_nosec net/socket.c:1023 [inline]
____sys_recvmsg+0x5f8/0x6b0 net/socket.c:2791
___sys_recvmsg+0x115/0x1a0 net/socket.c:2835
do_recvmmsg+0x55d/0x740 net/socket.c:2922
__sys_recvmmsg+0x21e/0x280 net/socket.c:3004
__do_compat_sys_recvmmsg_time32 net/compat.c:418 [inline]
__se_compat_sys_recvmmsg_time32 net/compat.c:414 [inline]
__ia32_compat_sys_recvmmsg_time32+0xc4/0x160 net/compat.c:414
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:387
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:412
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f67579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f506555c EFLAGS: 00000296 ORIG_RAX: 0000000000000151
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800000c0
RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: e8 0d f8 36 00 call 0x36f812
5: 48 85 ed test %rbp,%rbp
8: 75 44 jne 0x4e
a: e8 d3 fc 36 00 call 0x36fce2
f: 9c pushf
10: 5b pop %rbx
11: 81 e3 00 02 00 00 and $0x200,%ebx
17: 31 ff xor %edi,%edi
19: 48 89 de mov %rbx,%rsi
1c: e8 f1 f7 36 00 call 0x36f812
21: 48 85 db test %rbx,%rbx
24: 0f 85 8d 00 00 00 jne 0xb7
* 2a: e8 b3 fc 36 00 call 0x36fce2 <-- trapping instruction
2f: 44 89 e0 mov %r12d,%eax
32: 5b pop %rbx
33: 5d pop %rbp
34: 41 5c pop %r12
36: 41 5d pop %r13
38: 41 5e pop %r14
3a: c3 ret
3b: cc int3
3c: cc int3
3d: cc int3
3e: cc int3
3f: e8 .byte 0xe8