------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 5339 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 5339 Comm: kworker/3:3 Not tainted 6.11.0-rc1-syzkaller-00046-gc91a7dee0555 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 a8 05 08 fd 84 db 0f 85 66 ff ff ff e8 fb 0a 08 fd c6 05 57 14 79 0b 01 90 48 c7 c7 80 1f b0 8b e8 97 51 ca fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 d8 0a 08 fd 0f b6 1d 32 14 79 0b 31
RSP: 0018:ffffc90000908d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814cc379
RDX: ffff88801d484880 RSI: ffffffff814cc386 RDI: 0000000000000001
RBP: ffff888052bca888 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888052bca888 R14: ffff888024e84000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3391dff8 CR3: 0000000060cea000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 p9_req_put+0x1f4/0x250 net/9p/client.c:404
 req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2595 [inline]
 vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2570
 __handle_irq_event_percpu+0x229/0x7c0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:247 [inline]
 call_irq_handler arch/x86/kernel/irq.c:259 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
 common_interrupt+0xab/0xd0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:console_flush_all+0xa19/0xd70 kernel/printk/printk.c:3055
Code: e8 5c 72 26 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 ca 22 1f 00 48 85 db 0f 85 8b 01 00 00 e8 8c 27 1f 00 fb 48 8b 04 24 <4c> 89 fa 83 e2 07 0f b6 00 38 d0 7f 08 84 c0 0f 85 a9 02 00 00 41
RSP: 0018:ffffc9000352f508 EFLAGS: 00000293
RAX: fffff520006a5ec8 RBX: 0000000000000000 RCX: ffffffff816b5396
RDX: ffff88801d484880 RSI: ffffffff816b53a4 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000200
R13: ffffffff8e9cd8b8 R14: ffffffff8e9cd860 R15: ffffc9000352f640
 console_unlock+0xae/0x290 kernel/printk/printk.c:3118
 vprintk_emit kernel/printk/printk.c:2348 [inline]
 vprintk_emit+0x11a/0x5a0 kernel/printk/printk.c:2303
 dev_vprintk_emit drivers/base/core.c:4909 [inline]
 dev_printk_emit+0xfb/0x140 drivers/base/core.c:4920
 __dev_printk+0xf5/0x270 drivers/base/core.c:4932
 _dev_info+0xe5/0x120 drivers/base/core.c:4978
 announce_device drivers/usb/core/hub.c:2364 [inline]
 usb_new_device+0x85f/0x1a10 drivers/usb/core/hub.c:2632
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2db0/0x4e20 drivers/usb/core/hub.c:5903
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 5c 72 26 00       	call   0x267261
   5:	9c                   	pushf
   6:	5b                   	pop    %rbx
   7:	81 e3 00 02 00 00    	and    $0x200,%ebx
   d:	31 ff                	xor    %edi,%edi
   f:	48 89 de             	mov    %rbx,%rsi
  12:	e8 ca 22 1f 00       	call   0x1f22e1
  17:	48 85 db             	test   %rbx,%rbx
  1a:	0f 85 8b 01 00 00    	jne    0x1ab
  20:	e8 8c 27 1f 00       	call   0x1f27b1
  25:	fb                   	sti
  26:	48 8b 04 24          	mov    (%rsp),%rax
* 2a:	4c 89 fa             	mov    %r15,%rdx <-- trapping instruction
  2d:	83 e2 07             	and    $0x7,%edx
  30:	0f b6 00             	movzbl (%rax),%eax
  33:	38 d0                	cmp    %dl,%al
  35:	7f 08                	jg     0x3f
  37:	84 c0                	test   %al,%al
  39:	0f 85 a9 02 00 00    	jne    0x2e8
  3f:	41                   	rex.B