vxcan1: j1939_tp_rxtimer: 0x84be1f00: rx timeout, send abort vxcan1: j1939_xtp_rx_abort_one: 0x84be1f00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 14492 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28 refcount_t: underflow; use-after-free. Modules linked in: Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 0 UID: 0 PID: 14492 Comm: syz-executor Not tainted 6.12.0-rc6-syzkaller #0 Hardware name: ARM-Versatile Express Call trace: frame pointer underflow [<8199c7f8>] (dump_backtrace) from [<8199c8f4>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:82622f44 r5:00000000 r4:8203db14 [<8199c8dc>] (show_stack) from [<819bad88>] (__dump_stack lib/dump_stack.c:94 [inline]) [<8199c8dc>] (show_stack) from [<819bad88>] (dump_stack_lvl+0x54/0x7c lib/dump_stack.c:120) [<819bad34>] (dump_stack_lvl) from [<819badc8>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000000 r4:82870d18 [<819badb0>] (dump_stack) from [<8199d420>] (panic+0x120/0x374 kernel/panic.c:354) [<8199d300>] (panic) from [<80242118>] (check_panic_on_warn kernel/panic.c:243 [inline]) [<8199d300>] (panic) from [<80242118>] (get_taint+0x0/0x1c kernel/panic.c:238) r3:8260c5c4 r2:00000001 r1:82025ee8 r0:8202d950 r7:80840670 [<802420a4>] (check_panic_on_warn) from [<8024227c>] (__warn+0x80/0x188 kernel/panic.c:748) [<802421fc>] (__warn) from [<8024256c>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:783) r8:00000009 r7:8208c310 r6:df801c3c r5:836bc800 r4:00000000 [<80242388>] (warn_slowpath_fmt) from [<80840670>] (refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28) r10:dddd10c8 r9:00000003 r8:00000001 r7:00000000 r6:81829ec4 r5:00000002 r4:85a4c180 [<80840534>] (refcount_warn_saturate) from [<8149b980>] (__refcount_sub_and_test include/linux/refcount.h:275 [inline]) [<80840534>] (refcount_warn_saturate) from [<8149b980>] (__refcount_dec_and_test include/linux/refcount.h:307 [inline]) [<80840534>] (refcount_warn_saturate) from [<8149b980>] (refcount_dec_and_test include/linux/refcount.h:325 [inline]) [<80840534>] (refcount_warn_saturate) from [<8149b980>] (skb_unref include/linux/skbuff.h:1232 [inline]) [<80840534>] (refcount_warn_saturate) from [<8149b980>] (__sk_skb_reason_drop net/core/skbuff.c:1213 [inline]) [<80840534>] (refcount_warn_saturate) from [<8149b980>] (sk_skb_reason_drop+0x1d8/0x248 net/core/skbuff.c:1241) [<8149b7a8>] (sk_skb_reason_drop) from [<81829ec4>] (kfree_skb_reason include/linux/skbuff.h:1262 [inline]) [<8149b7a8>] (sk_skb_reason_drop) from [<81829ec4>] (kfree_skb include/linux/skbuff.h:1271 [inline]) [<8149b7a8>] (sk_skb_reason_drop) from [<81829ec4>] (j1939_session_destroy+0x78/0x200 net/can/j1939/transport.c:282) r9:00000003 r8:00000001 r7:8453681c r6:84be1f50 r5:84be1f00 r4:85a4c180 [<81829e4c>] (j1939_session_destroy) from [<8182a6b0>] (__j1939_session_release net/can/j1939/transport.c:294 [inline]) [<81829e4c>] (j1939_session_destroy) from [<8182a6b0>] (kref_put include/linux/kref.h:65 [inline]) [<81829e4c>] (j1939_session_destroy) from [<8182a6b0>] (j1939_session_put net/can/j1939/transport.c:299 [inline]) [<81829e4c>] (j1939_session_destroy) from [<8182a6b0>] (j1939_xtp_rx_abort_one+0xbc/0x2a4 net/can/j1939/transport.c:1354) r6:84536000 r5:84be1f00 r4:85a4c240 [<8182a5f4>] (j1939_xtp_rx_abort_one) from [<8182d468>] (j1939_xtp_rx_abort net/can/j1939/transport.c:1362 [inline]) [<8182a5f4>] (j1939_xtp_rx_abort_one) from [<8182d468>] (j1939_tp_cmd_recv net/can/j1939/transport.c:2128 [inline]) [<8182a5f4>] (j1939_xtp_rx_abort_one) from [<8182d468>] (j1939_tp_recv+0x4c4/0x530 net/can/j1939/transport.c:2161) r9:00000040 r8:85b96010 r7:84536000 r6:84536008 r5:84536000 r4:85a4c240 [<8182cfa4>] (j1939_tp_recv) from [<81826e30>] (j1939_can_recv+0x1e4/0x2dc net/can/j1939/main.c:108) r7:84536000 r6:84536008 r5:84536810 r4:85a4c240 [<81826c4c>] (j1939_can_recv) from [<8181cc00>] (deliver net/can/af_can.c:572 [inline]) [<81826c4c>] (j1939_can_recv) from [<8181cc00>] (can_rcv_filter+0x9c/0x218 net/can/af_can.c:606) r9:00000040 r8:851d46a0 r7:98ec0001 r6:85a4cf00 r5:00000001 r4:8495a7e0 [<8181cb64>] (can_rcv_filter) from [<8181d5a4>] (can_receive+0xb4/0xf0 net/can/af_can.c:663) r9:00000040 r8:00000000 r7:851d4000 r6:84224500 r5:84623400 r4:85a4cf00 [<8181d4f0>] (can_receive) from [<8181d664>] (can_rcv+0x84/0xac net/can/af_can.c:687) r9:00000040 r8:00000002 r7:00000000 r6:00000000 r5:8181d5e0 r4:85a4cf00 [<8181d5e0>] (can_rcv) from [<814bc8f4>] (__netif_receive_skb_one_core+0x5c/0x80 net/core/dev.c:5670) r5:8181d5e0 r4:851d4000 [<814bc898>] (__netif_receive_skb_one_core) from [<814bc960>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:5783) r5:dddd11b0 r4:85a4cf00 [<814bc948>] (__netif_receive_skb) from [<814bcc68>] (process_backlog+0xa0/0x17c net/core/dev.c:6115) r5:dddd11b0 r4:85a4cf00 [<814bcbc8>] (process_backlog) from [<814bdb74>] (__napi_poll+0x34/0x240 net/core/dev.c:6779) r10:dddd10c0 r9:dddd1300 r8:df801ea0 r7:df801e9b r6:00000040 r5:dddd11b0 r4:00000001 [<814bdb40>] (__napi_poll) from [<814be3e8>] (napi_poll net/core/dev.c:6848 [inline]) [<814bdb40>] (__napi_poll) from [<814be3e8>] (net_rx_action+0x358/0x440 net/core/dev.c:6970) r9:dddd1300 r8:df801ea0 r7:0000012c r6:0003fa06 r5:dddd11b0 r4:00000000 [<814be090>] (net_rx_action) from [<8024b55c>] (handle_softirqs+0x158/0x464 kernel/softirq.c:554) r10:00000008 r9:836bc800 r8:00000101 r7:00400140 r6:00000003 r5:00000004 r4:8260408c [<8024b404>] (handle_softirqs) from [<8024b958>] (__do_softirq kernel/softirq.c:588 [inline]) [<8024b404>] (handle_softirqs) from [<8024b958>] (invoke_softirq kernel/softirq.c:428 [inline]) [<8024b404>] (handle_softirqs) from [<8024b958>] (__irq_exit_rcu+0xa4/0x164 kernel/softirq.c:637) r10:00000000 r9:836bc800 r8:00000000 r7:dffd9d68 r6:821df6f0 r5:8221ff04 r4:836bc800 [<8024b8b4>] (__irq_exit_rcu) from [<8024bc58>] (irq_exit+0x10/0x18 kernel/softirq.c:661) r5:8221ff04 r4:824bbcdc [<8024bc48>] (irq_exit) from [<819bb764>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:240) [<819bb6e8>] (generic_handle_arch_irq) from [<8196bc84>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:836bc800 r8:8261b4c0 r7:dffd9d9c r6:ffffffff r5:20000013 r4:8027d4bc [<8196bc68>] (call_with_stack) from [<80200bcc>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:227) Exception stack(0xdffd9d68 to 0xdffd9db0) 9d60: 00000001 8203db14 00000001 836bc800 00000000 dddd0400 9d80: 819bf0e0 a3e9eb60 8261b4c0 836bc800 00000000 dffd9dfc dffd9da8 dffd9db8 9da0: 819c803c 8027d4bc 20000013 ffffffff [<8027d430>] (finish_task_switch) from [<819bf0e0>] (context_switch kernel/sched/core.c:5331 [inline]) [<8027d430>] (finish_task_switch) from [<819bf0e0>] (__schedule+0x424/0xc2c kernel/sched/core.c:6690) r10:00000000 r9:00000000 r8:85384f00 r7:a3e9eb60 r6:836bc800 r5:dddd0400 r4:8261b4c0 [<819becbc>] (__schedule) from [<819bf914>] (__schedule_loop kernel/sched/core.c:6767 [inline]) [<819becbc>] (__schedule) from [<819bf914>] (schedule+0x2c/0xfc kernel/sched/core.c:6782) r10:00000109 r9:836bc800 r8:00000000 r7:00000001 r6:00002001 r5:836bc800 r4:836bc800 [<819bf8e8>] (schedule) from [<819c71c0>] (do_nanosleep+0x90/0x15c kernel/time/hrtimer.c:2032) r5:836bc800 r4:dffd9ee8 [<819c7130>] (do_nanosleep) from [<80305b94>] (hrtimer_nanosleep+0xc8/0x144 kernel/time/hrtimer.c:2080) r8:00000000 r7:00000001 r6:836bc800 r5:00989680 r4:00000000 [<80305acc>] (hrtimer_nanosleep) from [<8031021c>] (common_nsleep+0x5c/0x6c kernel/time/posix-timers.c:1365) r8:7ebe29d4 r7:836bc800 r6:00000000 r5:00000000 r4:3b9aca00 [<803101c0>] (common_nsleep) from [<80312574>] (__do_sys_clock_nanosleep_time32 kernel/time/posix-timers.c:1439 [inline]) [<803101c0>] (common_nsleep) from [<80312574>] (sys_clock_nanosleep_time32+0xf8/0x154 kernel/time/posix-timers.c:1416) r5:81a044a8 r4:00000000 [<8031247c>] (sys_clock_nanosleep_time32) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdffd9fa8 to 0xdffd9ff0) 9fa0: 00000000 7ebe29d4 00000000 00000000 7ebe29dc 7ebe29d4 9fc0: 00000000 7ebe29d4 00000000 00000109 00000000 7ebe2ac8 00000000 00000502 9fe0: 00000000 7ebe29d0 00000001 00160724 r8:8020029c r7:00000109 r6:00000000 r5:7ebe29d4 r4:00000000 Rebooting in 86400 seconds..