------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 6510 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 6510 Comm: syz.1.194 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 lib/refcount.c:28
Code: e0 c7 bf 8b e8 a7 ad f2 fc 90 0f 0b 90 90 eb d7 e8 8b 90 2f fd c6 05 ea 75 f7 0a 01 90 48 c7 c7 40 c8 bf 8b e8 87 ad f2 fc 90 <0f> 0b 90 90 eb b7 e8 6b 90 2f fd c6 05 c7 75 f7 0a 01 90 48 c7 c7
RSP: 0018:ffffc90000a08b88 EFLAGS: 00010246
RAX: eaaf014f6535ae00 RBX: 0000000000000003 RCX: ffff888044121e40
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000a08c90 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa650 R12: 1ffff92000141178
R13: ffff888031edf1b8 R14: ffff888031edf020 R15: 0000000000000001
FS: 00007f250b2986c0(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055fb33a4c240 CR3: 000000004553e000 CR4: 00000000003526f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:raw_spin_rq_unlock_irq+0x13/0x90 kernel/sched/sched.h:1559
Code: cc e8 41 ae b9 09 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 53 66 90 e8 84 43 bc 09 e8 3f a0 35 00 fb 5b <41> 5e 41 5f e9 d4 91 bc 09 cc f3 0f 1e fa 49 be 00 00 00 00 00 fc
RSP: 0018:ffffc9001a6d7648 EFLAGS: 00000286
RAX: eaaf014f6535ae00 RBX: ffff8880b873a040 RCX: eaaf014f6535ae00
RDX: 0000000000000007 RSI: ffffffff8d7e8396 RDI: ffffffff8bc076e0
RBP: ffffc9001a6d7870 R08: ffffffff8f9e1177 R09: 1ffffffff1f3c22e
R10: dffffc0000000000 R11: fffffbfff1f3c22f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888044121e40 R15: 1ffff110170e7568
__schedule+0x19e0/0x4cc0 kernel/sched/core.c:6937
preempt_schedule_irq+0xb5/0x150 kernel/sched/core.c:7256
irqentry_exit+0x6f/0x90 kernel/entry/common.c:211
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:put_cpu_partial+0x234/0x2e0 mm/slub.c:3931
Code: 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 90 0f 0b 90 e9 e7 fe ff ff e8 49 a4 30 09 41 f7 c5 00 02 00 00 74 b2 fb 4d 85 ff <75> b1 eb ba e8 33 a4 30 09 e9 4f fe ff ff 90 0f 0b 90 e9 66 ff ff
RSP: 0018:ffffc9001a6d79f8 EFLAGS: 00000246
RAX: eaaf014f6535ae00 RBX: ffff88801aebeb40 RCX: eaaf014f6535ae00
RDX: 0000000000000007 RSI: ffffffff8d7e8396 RDI: ffffffff8bc076e0
RBP: 0000000000000001 R08: ffffffff8f9e1177 R09: 1ffffffff1f3c22e
R10: dffffc0000000000 R11: fffffbfff1f3c22f R12: 0000000000000001
R13: 0000000000000282 R14: ffff8880b8740ce0 R15: 0000000000000000
__slab_free+0x2b9/0x390 mm/slub.c:5906
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4955 [inline]
slab_alloc_node mm/slub.c:5265 [inline]
__kmalloc_cache_noprof+0x36f/0x6f0 mm/slub.c:5743
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
ref_tracker_alloc+0x133/0x460 lib/ref_tracker.c:271
__netns_tracker_alloc include/net/net_namespace.h:362 [inline]
netns_tracker_alloc include/net/net_namespace.h:371 [inline]
get_net_track include/net/net_namespace.h:388 [inline]
sk_alloc+0x1b1/0x370 net/core/sock.c:2307
__netlink_create+0x65/0x260 net/netlink/af_netlink.c:628
netlink_create+0x3ca/0x590 net/netlink/af_netlink.c:686
__sock_create+0x4b3/0x9f0 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd7/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f250a38efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f250b298038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007f250a5e5fa0 RCX: 00007f250a38efc9
RDX: 0000000000000014 RSI: 0000000000000003 RDI: 0000000000000010
RBP: 00007f250a411f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f250a5e6038 R14: 00007f250a5e5fa0 R15: 00007fff6e788df8
----------------
Code disassembly (best guess):
0: cc int3
1: e8 41 ae b9 09 call 0x9b9ae47
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 41 57 push %r15
19: 41 56 push %r14
1b: 53 push %rbx
1c: 66 90 xchg %ax,%ax
1e: e8 84 43 bc 09 call 0x9bc43a7
23: e8 3f a0 35 00 call 0x35a067
28: fb sti
29: 5b pop %rbx
* 2a: 41 5e pop %r14 <-- trapping instruction
2c: 41 5f pop %r15
2e: e9 d4 91 bc 09 jmp 0x9bc9207
33: cc int3
34: f3 0f 1e fa endbr64
38: 49 rex.WB
39: be 00 00 00 00 mov $0x0,%esi
3e: 00 fc add %bh,%ah