------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 5951 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 5951 Comm: sshd Not tainted 6.14.0-rc3-syzkaller-00012-g2408a807bfc3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 88 6f f7 fc 84 db 0f 85 66 ff ff ff e8 db 74 f7 fc c6 05 cf 92 88 0b 01 90 48 c7 c7 40 f1 d2 8b e8 17 a7 b7 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 b8 74 f7 fc 0f b6 1d aa 92 88 0b 31
RSP: 0018:ffffc90000007d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a1229
RDX: ffff888021f78000 RSI: ffffffff817a1236 RDI: 0000000000000001
RBP: ffff888074b8e008 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000007 R12: ffff888074b8e008
R13: ffff88806b00dc00 R14: 0000000000000015 R15: 0000000000000000
FS: 00007f63af8a0d00(0000) GS:ffff88802b400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f44dc4d0 CR3: 0000000022f50000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:275 [inline]
__refcount_dec_and_test include/linux/refcount.h:307 [inline]
refcount_dec_and_test include/linux/refcount.h:325 [inline]
p9_req_put+0x1ec/0x250 net/9p/client.c:404
req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:247 [inline]
call_irq_handler arch/x86/kernel/irq.c:259 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:writel arch/x86/include/asm/io.h:67 [inline]
RIP: 0010:e1000_xmit_frame+0x37bf/0x5800 drivers/net/ethernet/intel/e1000/e1000_main.c:3276
Code: c1 ea 03 48 01 c3 48 b8 00 00 00 00 00 fc ff df 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 0f 1f 00 00 48 8b 44 24 08 8b 40 18 89 03 db e9 ff ff e8 37 54 34 fb 48 8d 6b 20 be 04 00 00 00 48 89 ef
RSP: 0018:ffffc9000111eef0 EFLAGS: 00000246
RAX: 000000000000001d RBX: ffffc90006e63818 RCX: ffffffff86858950
RDX: 1ffff110042d6c93 RSI: ffffffff8685895d RDI: ffff8880216b64aa
RBP: 000000000000001d R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000006 R12: 00000000af100004
R13: dffffc0000000000 R14: ffff888022180000 R15: ffffc900001a91c0
__netdev_start_xmit include/linux/netdevice.h:5150 [inline]
netdev_start_xmit include/linux/netdevice.h:5159 [inline]
xmit_one net/core/dev.c:3735 [inline]
dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3751
sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343
__dev_xmit_skb net/core/dev.c:3974 [inline]
__dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4550
dev_queue_xmit include/linux/netdevice.h:3311 [inline]
neigh_hh_output include/net/neighbour.h:523 [inline]
neigh_output include/net/neighbour.h:537 [inline]
ip_finish_output2+0xc34/0x2180 net/ipv4/ip_output.c:236
__ip_finish_output net/ipv4/ip_output.c:314 [inline]
__ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:296
ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:324
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:434
dst_output include/net/dst.h:459 [inline]
ip_local_out net/ipv4/ip_output.c:130 [inline]
__ip_queue_xmit+0x1a8d/0x22d0 net/ipv4/ip_output.c:528
__tcp_transmit_skb+0x2b39/0x3ec0 net/ipv4/tcp_output.c:1471
tcp_transmit_skb net/ipv4/tcp_output.c:1489 [inline]
tcp_write_xmit+0x12b1/0x8560 net/ipv4/tcp_output.c:2832
tcp_sendmsg_locked+0x2b15/0x37c0 net/ipv4/tcp.c:1306
tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1358
inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:733 [inline]
sock_write_iter+0x4ac/0x5b0 net/socket.c:1137
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0x5ae/0x1150 fs/read_write.c:679
ksys_write+0x207/0x250 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f63af516bf2
Code: 89 c7 48 89 44 24 08 e8 7b 34 fa ff 48 8b 44 24 08 48 83 c4 28 c3 c3 64 8b 04 25 18 00 00 00 85 c0 75 20 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 6f 48 8b 15 07 a2 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffefbbb4c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007f63af516bf2
RDX: 0000000000008024 RSI: 0000563376f842d0 RDI: 0000000000000004
RBP: 0000563376f32210 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000563362f51aa4
R13: 0000000000000112 R14: 0000563362f523e8 R15: 00007ffefbbb4cc8
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 48 01 c3 add %rax,%rbx
6: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
d: fc ff df
10: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
14: 84 c0 test %al,%al
16: 74 08 je 0x20
18: 3c 03 cmp $0x3,%al
1a: 0f 8e 0f 1f 00 00 jle 0x1f2f
20: 48 8b 44 24 08 mov 0x8(%rsp),%rax
25: 8b 40 18 mov 0x18(%rax),%eax
28: 89 03 mov %eax,(%rbx)
* 2a: e9 db e9 ff ff jmp 0xffffea0a <-- trapping instruction
2f: e8 37 54 34 fb call 0xfb34546b
34: 48 8d 6b 20 lea 0x20(%rbx),%rbp
38: be 04 00 00 00 mov $0x4,%esi
3d: 48 89 ef mov %rbp,%rdi