------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7513 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 7513 Comm: syz-executor Not tainted 6.14.0-rc7-syzkaller-00205-g586de92313fc #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 58 34 f7 fc 84 db 0f 85 66 ff ff ff e8 ab 39 f7 fc c6 05 5f 62 88 0b 01 90 48 c7 c7 e0 06 d3 8b e8 97 6a b7 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 88 39 f7 fc 0f b6 1d 3a 62 88 0b 31
RSP: 0018:ffffc90000007d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a2269
RDX: ffff8880255e8000 RSI: ffffffff817a2276 RDI: 0000000000000001
RBP: ffff888067682ff8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: ffff888067682ff8
R13: ffff88801f7e0400 R14: 0000000000000015 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802b400000(0063) knlGS:000000005819b440
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7f255c0 CR3: 000000006da2a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 p9_req_put+0x1ec/0x250 net/9p/client.c:404
 req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
 vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
 __handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:249 [inline]
 call_irq_handler arch/x86/kernel/irq.c:261 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:287
 common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:280
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:console_flush_all+0x9a4/0xc60 kernel/printk/printk.c:3211
Code: 00 e8 f0 00 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 be 43 20 00 48 85 db 0f 85 55 01 00 00 e8 80 48 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 15 86 82
RSP: 0018:ffffc9000360ec38 EFLAGS: 00000293
RAX: ffffffff8eeaeeb8 RBX: 0000000000000000 RCX: ffffffff8199a742
RDX: ffff8880255e8000 RSI: ffffffff8199a750 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: ffffffff8eeaeeb8
R13: ffffffff8eeaee60 R14: ffffc9000360ecc8 R15: dffffc0000000000
 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
 console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
 vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
 dev_vprintk_emit drivers/base/core.c:4891 [inline]
 dev_printk_emit+0xfb/0x140 drivers/base/core.c:4902
 __netdev_printk+0x1f7/0x500 net/core/dev.c:12299
 netdev_info+0xe5/0x120 net/core/dev.c:12354
 dev_change_name+0x734/0x920 net/core/dev.c:1404
 do_setlink.constprop.0+0x2fe9/0x3f80 net/core/rtnetlink.c:3098
 rtnl_changelink net/core/rtnetlink.c:3733 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3885 [inline]
 rtnl_newlink+0x1306/0x1d60 net/core/rtnetlink.c:4022
 rtnetlink_rcv_msg+0x95b/0xea0 net/core/rtnetlink.c:6912
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2533
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1882
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:733 [inline]
 __sys_sendto+0x488/0x4f0 net/socket.c:2187
 __do_compat_sys_socketcall+0x5e2/0x700 net/compat.c:475
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:387
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:412
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f00579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffbbb330 EFLAGS: 00000293 ORIG_RAX: 0000000000000066
RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000ffbbb344
RDX: 0000000000000000 RSI: 00000000f7ef3528 RDI: 00000000f738cff4
RBP: 00000000f7ef3528 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 e8                	add    %ch,%al
   2:	f0 00 28             	lock add %ch,(%rax)
   5:	00 9c 5b 81 e3 00 02 	add    %bl,0x200e381(%rbx,%rbx,2)
   c:	00 00                	add    %al,(%rax)
   e:	31 ff                	xor    %edi,%edi
  10:	48 89 de             	mov    %rbx,%rsi
  13:	e8 be 43 20 00       	call   0x2043d6
  18:	48 85 db             	test   %rbx,%rbx
  1b:	0f 85 55 01 00 00    	jne    0x176
  21:	e8 80 48 20 00       	call   0x2048a6
  26:	fb                   	sti
  27:	4c 89 e0             	mov    %r12,%rax
* 2a:	48 c1 e8 03          	shr    $0x3,%rax <-- trapping instruction
  2e:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  33:	0f 84 11 ff ff ff    	je     0xffffff4a
  39:	4c 89 e7             	mov    %r12,%rdi
  3c:	e8                   	.byte 0xe8
  3d:	15                   	.byte 0x15
  3e:	86                   	.byte 0x86
  3f:	82                   	.byte 0x82