------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 10617 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Modules linked in:
CPU: 1 UID: 0 PID: 10617 Comm: syz.2.1651 Not tainted 6.15.0-syzkaller-12331-gcfc4ca8986bb #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Code: 00 00 e8 09 2d ff fc 5b 41 5e e9 3c 12 4f fc cc e8 fb 2c ff fc c6 05 e3 ca c9 0a 01 90 48 c7 c7 c0 38 e2 8b e8 17 db c2 fc 90 <0f> 0b 90 90 eb d7 e8 db 2c ff fc c6 05 c4 ca c9 0a 01 90 48 c7 c7
RSP: 0018:ffffc90000a08828 EFLAGS: 00010246
RAX: 69147da89d9ac800 RBX: 0000000000000002 RCX: ffff88802bba1e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000a089b0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfaa44 R12: ffff888077b18000
R13: dffffc0000000000 R14: ffff888077b1816c R15: ffff88802fe7b000
FS:  00007fec216cc6c0(0000) GS:ffff888125d55000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562a32673168 CR3: 00000000328c6000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __refcount_add include/linux/refcount.h:-1 [inline]
 __refcount_inc include/linux/refcount.h:366 [inline]
 refcount_inc include/linux/refcount.h:383 [inline]
 get_net include/net/net_namespace.h:268 [inline]
 tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
 tipc_crypto_xmit+0x1820/0x22c0 net/tipc/crypto.c:1761
 tipc_bearer_xmit_skb+0x245/0x400 net/tipc/bearer.c:572
 tipc_disc_timeout+0x580/0x6d0 net/tipc/discover.c:338
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x286/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x9f/0x2c0 mm/kasan/generic.c:189
Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 de 01 00 00 49 ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd
RSP: 0018:ffffc900045af548 EFLAGS: 00000246
RAX: ffffffff823f7a01 RBX: fffffffffffffffe RCX: ffffffff823f7a5d
RDX: 0000000000000001 RSI: 0000000000000018 RDI: ffffc900045af620
RBP: 0000000000000000 R08: ffffc900045af637 R09: 1ffff920008b5ec6
R10: dffffc0000000000 R11: fffff520008b5ec5 R12: 0000000000000003
R13: 000000000000d7a4 R14: fffff520008b5ec7 R15: 1ffff920008b5ec4
 __asan_memset+0x22/0x50 mm/kasan/shadow.c:84
 seq_printf+0xad/0x270 fs/seq_file.c:403
 __io_uring_show_fdinfo io_uring/fdinfo.c:139 [inline]
 io_uring_show_fdinfo+0xa63/0x1560 io_uring/fdinfo.c:224
 seq_show+0x5e6/0x750 fs/proc/fd.c:68
 traverse+0x1e9/0x570 fs/seq_file.c:111
 seq_read_iter+0xcfe/0xe10 fs/seq_file.c:195
 seq_read+0x2e2/0x3d0 fs/seq_file.c:162
 do_loop_readv_writev fs/read_write.c:847 [inline]
 vfs_readv+0x5aa/0x850 fs/read_write.c:1020
 do_preadv fs/read_write.c:1132 [inline]
 __do_sys_preadv fs/read_write.c:1179 [inline]
 __se_sys_preadv fs/read_write.c:1174 [inline]
 __x64_sys_preadv+0x197/0x2a0 fs/read_write.c:1174
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec2078e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec216cc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00007fec209b5fa0 RCX: 00007fec2078e929
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000004
RBP: 00007fec20810b39 R08: 000000000000000a R09: 0000000000000000
R10: 0000000000000085 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fec209b5fa0 R15: 00007ffc54b12928
 </TASK>
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	df 4d 8d             	fisttps -0x73(%rbp)
   3:	34 19                	xor    $0x19,%al
   5:	4d 89 f4             	mov    %r14,%r12
   8:	4d 29 dc             	sub    %r11,%r12
   b:	49 83 fc 10          	cmp    $0x10,%r12
   f:	7f 29                	jg     0x3a
  11:	4d 85 e4             	test   %r12,%r12
  14:	0f 84 41 01 00 00    	je     0x15b
  1a:	4c 89 cb             	mov    %r9,%rbx
  1d:	48 f7 d3             	not    %rbx
  20:	4c 01 fb             	add    %r15,%rbx
  23:	41 80 3b 00          	cmpb   $0x0,(%r11)
* 27:	0f 85 de 01 00 00    	jne    0x20b <-- trapping instruction
  2d:	49 ff c3             	inc    %r11
  30:	48 ff c3             	inc    %rbx
  33:	75 ee                	jne    0x23
  35:	e9 21 01 00 00       	jmp    0x15b
  3a:	44 89 dd             	mov    %r11d,%ebp