------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 6881 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 6881 Comm: syz.1.228 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 78 33 e0 fc 84 db 0f 85 66 ff ff ff e8 8b 38 e0 fc c6 05 77 8e b4 0b 01 90 48 c7 c7 20 1c 15 8c e8 97 fd 9e fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 68 38 e0 fc 0f b6 1d 52 8e b4 0b 31
RSP: 0018:ffffc900006f8be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae368
RDX: ffff888056fc2440 RSI: ffffffff817ae375 RDI: 0000000000000001
RBP: ffff8880281d2008 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880281d2008
R13: ffff8880486e3000 R14: 0000000000000015 R15: 1ffff11004d0680c
FS: 0000000000000000(0000) GS:ffff8880d6a54000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000003000 CR3: 00000000379f0000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
p9_req_put+0x1ec/0x250 net/9p/client.c:404
req_done+0x1dc/0x2e0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
vring_interrupt+0x31e/0x400 drivers/virtio/virtio_ring.c:2690
__handle_irq_event_percpu+0x22c/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x28e/0xab0 kernel/irq/chip.c:789
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:254 [inline]
call_irq_handler arch/x86/kernel/irq.c:266 [inline]
__common_interrupt+0xe2/0x250 arch/x86/kernel/irq.c:292
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:285
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:handle_softirqs+0x1dd/0x8e0 kernel/softirq.c:565
Code: 88 6c 24 26 4c 89 7c 24 18 48 c7 c7 20 a0 ab 8b e8 c8 f8 02 0a 65 66 c7 05 b6 e3 4f 12 00 00 e8 d9 10 47 00 fb bb ff ff ff ff <49> c7 c7 c0 c0 20 8e 41 0f bc dc 83 c3 01 0f 85 a4 00 00 00 e9 b1
RSP: 0018:ffffc900006f8f28 EFLAGS: 00000206
RAX: 0000000000002d5c RBX: 00000000ffffffff RCX: ffffffff81c3ec5f
RDX: 0000000000000000 RSI: ffffffff8de18f2c RDI: ffffffff8c157060
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90a80c57 R11: 0000000000000001 R12: 0000000000000202
R13: 000000000000000a R14: 1ffff920000df1ed R15: ffffed100adf8488
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7108
Code: df 55 65 48 8b 2d ec c8 4b 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 9f 6c 08 f6 e8 1a f6 42 f6 fb bf 01 00 00 00 af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 ed f3 07
RSP: 0018:ffffc90003d1f448 EFLAGS: 00000206
RAX: 0000000000002d59 RBX: ffffed100adf8488 RCX: ffffffff81c3ec5f
RDX: 0000000000000000 RSI: ffffffff8de18f2c RDI: 0000000000000001
RBP: ffff888056fc2440 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90a80c57 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x36/0x90 kernel/entry/common.c:307
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:write_comp_data+0x8b/0x90 kernel/kcov.c:272
Code: 00 00 4a 8d 34 dd 28 00 00 00 48 39 f2 72 1b 48 83 c7 01 48 89 38 4c 89 44 30 e0 4c 89 4c 30 e8 4c 89 54 30 f0 4a 89 4c d8 20 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc90003d1f518 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81f4d80c
RDX: ffff888056fc2440 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffea00011335c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff920007a3ead
R13: ffffc90003d1f588 R14: fffffffffffffffe R15: 0000000000000018
find_get_entry mm/filemap.c:2047 [inline]
find_lock_entries+0x1ac/0xbf0 mm/filemap.c:2140
shmem_undo_range+0x216/0x1150 mm/shmem.c:1107
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e3/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:466
__dentry_kill+0x1d0/0x600 fs/dcache.c:669
dput.part.0+0x4b1/0x9b0 fs/dcache.c:911
dput+0x1f/0x30 fs/dcache.c:901
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x14d/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x864/0x2bd0 kernel/exit.c:955
do_group_exit+0xd3/0x2a0 kernel/exit.c:1104
__do_sys_exit_group kernel/exit.c:1115 [inline]
__se_sys_exit_group kernel/exit.c:1113 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1113
x64_sys_call+0x1530/0x1730 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f68f4d8e929
Code: Unable to access opcode bytes at 0x7f68f4d8e8ff.
RSP: 002b:00007ffe441f2938 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f68f4d8e929
RDX: 00007f68f4d45f37 RSI: 0000000000000000 RDI: 000000000000000b
RBP: 0000000000000003 R08: 00007ffe441f3507 R09: 000000000000000b
R10: 00007f68f4fb5fa0 R11: 0000000000000246 R12: 00007f68f4fb624c
R13: 00007f68f4fb6240 R14: 00000000000015f9 R15: 0000000000000003
----------------
Code disassembly (best guess):
0: 88 6c 24 26 mov %ch,0x26(%rsp)
4: 4c 89 7c 24 18 mov %r15,0x18(%rsp)
9: 48 c7 c7 20 a0 ab 8b mov $0xffffffff8baba020,%rdi
10: e8 c8 f8 02 0a call 0xa02f8dd
15: 65 66 c7 05 b6 e3 4f movw $0x0,%gs:0x124fe3b6(%rip) # 0x124fe3d5
1c: 12 00 00
1f: e8 d9 10 47 00 call 0x4710fd
24: fb sti
25: bb ff ff ff ff mov $0xffffffff,%ebx
* 2a: 49 c7 c7 c0 c0 20 8e mov $0xffffffff8e20c0c0,%r15 <-- trapping instruction
31: 41 0f bc dc bsf %r12d,%ebx
35: 83 c3 01 add $0x1,%ebx
38: 0f 85 a4 00 00 00 jne 0xe2
3e: e9 .byte 0xe9
3f: b1 .byte 0xb1