------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 12 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Modules linked in:
CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: netns cleanup_net
RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Code: 00 00 e8 09 2d ff fc 5b 41 5e e9 d1 4a a7 06 cc e8 fb 2c ff fc c6 05 63 ca c9 0a 01 90 48 c7 c7 c0 38 e2 8b e8 17 db c2 fc 90 <0f> 0b 90 90 eb d7 e8 db 2c ff fc c6 05 44 ca c9 0a 01 90 48 c7 c7
RSP: 0018:ffffc90000a08668 EFLAGS: 00010246
RAX: f4bf3b6b8f427900 RBX: 0000000000000002 RCX: ffff88801ceb5a00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000a087e8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfaa44 R12: ffff88801b3a0000
R13: dffffc0000000000 R14: ffff88801b3a016c R15: ffff88805c76f000
FS: 0000000000000000(0000) GS:ffff888125d55000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffff02ce000 CR3: 0000000033fbe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 00000000d88e0b5f DR2: 0000000000003706
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_net include/net/net_namespace.h:268 [inline]
tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
tipc_crypto_xmit+0x1820/0x22c0 net/tipc/crypto.c:1761
tipc_crypto_clone_msg+0x90/0x170 net/tipc/crypto.c:1656
tipc_crypto_xmit+0x1998/0x22c0 net/tipc/crypto.c:1717
tipc_bearer_xmit_skb+0x245/0x400 net/tipc/bearer.c:572
tipc_disc_timeout+0x580/0x6d0 net/tipc/discover.c:338
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:32 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_acquire+0xd5/0x360 kernel/locking/lockdep.c:5867
Code: 8b 04 25 08 b0 9c 92 83 b8 ec 0a 00 00 00 0f 85 d5 00 00 00 48 c7 44 24 30 00 00 00 00 9c 8f 44 24 30 4c 89 74 24 10 4d 89 fe <4c> 8b 7c 24 30 fa 48 c7 c7 73 06 99 8d e8 e9 8d c7 09 65 ff 05 e2
RSP: 0018:ffffc90000116938 EFLAGS: 00000246
RAX: ffff88801ceb5a00 RBX: 0000000000000000 RCX: f4bf3b6b8f427900
RDX: 0000000000000000 RSI: ffffffff81729e02 RDI: 1ffffffff1c27e0c
RBP: ffffffff81729de5 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc90000116af8 R11: ffffffff81acf670 R12: 0000000000000002
R13: ffffffff8e13f060 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4148 [inline]
slab_alloc_node mm/slub.c:4197 [inline]
kmem_cache_alloc_lru_noprof+0x1c6/0x3d0 mm/slub.c:4216
__d_alloc+0x31/0x6f0 fs/dcache.c:1690
d_alloc fs/dcache.c:1769 [inline]
d_alloc_parallel+0xe0/0x14e0 fs/dcache.c:2533
__lookup_slow+0x116/0x3d0 fs/namei.c:1802
start_creating+0x22e/0x3c0 fs/debugfs/inode.c:391
__debugfs_create_file+0x79/0x4f0 fs/debugfs/inode.c:437
debugfs_create_file_unsafe+0x3a/0x50 fs/debugfs/inode.c:523
nsim_udp_tunnels_info_create+0x15b/0x770 drivers/net/netdevsim/udp_tunnels.c:152
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:948 [inline]
nsim_create+0x7a5/0xef0 drivers/net/netdevsim/netdev.c:1032
__nsim_dev_port_add+0x70a/0xb20 drivers/net/netdevsim/dev.c:1393
nsim_dev_port_add_all+0x35/0xe0 drivers/net/netdevsim/dev.c:1449
nsim_dev_reload_create drivers/net/netdevsim/dev.c:1501 [inline]
nsim_dev_reload_up+0x451/0x780 drivers/net/netdevsim/dev.c:988
devlink_reload+0x4ec/0x8d0 net/devlink/dev.c:474
devlink_pernet_pre_exit+0x1d9/0x3d0 net/devlink/core.c:509
ops_pre_exit_list net/core/net_namespace.c:162 [inline]
ops_undo_list+0x184/0x990 net/core/net_namespace.c:235
cleanup_net+0x4c5/0x800 net/core/net_namespace.c:686
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 8b 04 25 08 b0 9c 92 mov 0xffffffff929cb008,%eax
7: 83 b8 ec 0a 00 00 00 cmpl $0x0,0xaec(%rax)
e: 0f 85 d5 00 00 00 jne 0xe9
14: 48 c7 44 24 30 00 00 movq $0x0,0x30(%rsp)
1b: 00 00
1d: 9c pushf
1e: 8f 44 24 30 pop 0x30(%rsp)
22: 4c 89 74 24 10 mov %r14,0x10(%rsp)
27: 4d 89 fe mov %r15,%r14
* 2a: 4c 8b 7c 24 30 mov 0x30(%rsp),%r15 <-- trapping instruction
2f: fa cli
30: 48 c7 c7 73 06 99 8d mov $0xffffffff8d990673,%rdi
37: e8 e9 8d c7 09 call 0x9c78e25
3c: 65 gs
3d: ff .byte 0xff
3e: 05 .byte 0x5
3f: e2 .byte 0xe2