------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#1: syz.4.4766/26073
Modules linked in:
CPU: 1 UID: 0 PID: 26073 Comm: syz.4.4766 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28
Code: 24 9c 6d 0b 67 48 0f b9 3a eb 4a e8 68 f1 16 fd 48 8d 3d 21 9c 6d 0b 67 48 0f b9 3a eb 37 e8 55 f1 16 fd 48 8d 3d 1e 9c 6d 0b <67> 48 0f b9 3a eb 24 e8 42 f1 16 fd 48 8d 3d 1b 9c 6d 0b 67 48 0f
RSP: 0018:ffffc90000a08c88 EFLAGS: 00010246
RAX: ffffffff84aeac5b RBX: 0000000000000003 RCX: ffff888046af0000
RDX: 0000000000000100 RSI: ffffffff8ef00c80 RDI: ffffffff901c4880
RBP: ffffc90000a08d90 R08: ffff888046af0000 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000100 R12: 0000000000000001
R13: 0000000100011d70 R14: ffff888055000020 R15: ffff8880550001b8
FS: 00007fde7bff66c0(0000) GS:ffff888125563000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff0e3fee70 CR3: 000000004f84c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:instrument_atomic_read include/linux/instrumented.h:82 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
RIP: 0010:page_expected_state mm/page_alloc.c:1074 [inline]
RIP: 0010:check_new_page mm/page_alloc.c:1789 [inline]
RIP: 0010:check_new_pages mm/page_alloc.c:1803 [inline]
RIP: 0010:__rmqueue_pcplist+0x1869/0x1c40 mm/page_alloc.c:3361
Code: c5 4d 09 e5 0f 85 cf 01 00 00 4d 89 fe 83 7c 24 04 20 0f 83 66 01 00 00 4d 8d 7e 40 4c 39 bc 24 e8 00 00 00 0f 84 ce 03 00 00 <4e> 8d 24 33 49 83 c4 28 4c 89 e7 be 04 00 00 00 e8 62 54 0e 00 4c
RSP: 0018:ffffc9000589edb8 EFLAGS: 00000202
RAX: ffffea00015b4c80 RBX: ffffea00015b4c88 RCX: 00000000ffffffff
RDX: 1ffffffff2023818 RSI: dffffc0000000000 RDI: ffff8880b8740bc0
RBP: 0000000000000000 R08: 0000000000000080 R09: ffff8880b8740b01
R10: 00000000ffffffff R11: fffff52000b13dd0 R12: ffffea0000d08150
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040
rmqueue_pcplist mm/page_alloc.c:3388 [inline]
rmqueue mm/page_alloc.c:3418 [inline]
get_page_from_freelist+0x91d/0x2580 mm/page_alloc.c:3959
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2484
alloc_frozen_pages_noprof mm/mempolicy.c:2555 [inline]
alloc_pages_noprof+0xa8/0x190 mm/mempolicy.c:2575
pagetable_alloc_noprof include/linux/mm.h:3404 [inline]
__pte_alloc_one_noprof include/asm-generic/pgalloc.h:76 [inline]
pte_alloc_one+0x23/0x370 arch/x86/mm/pgtable.c:18
__pte_alloc+0x25/0x430 mm/memory.c:466
copy_pte_range mm/memory.c:1250 [inline]
copy_pmd_range+0x77d2/0x8050 mm/memory.c:1405
copy_pud_range mm/memory.c:1442 [inline]
copy_p4d_range mm/memory.c:1466 [inline]
copy_page_range+0xbe8/0x11f0 mm/memory.c:1552
dup_mmap+0xf40/0x1d90 mm/mmap.c:1841
dup_mm kernel/fork.c:1530 [inline]
copy_mm+0x13b/0x4b0 kernel/fork.c:1582
copy_process+0x18b6/0x3cf0 kernel/fork.c:2223
kernel_clone+0x248/0x8e0 kernel/fork.c:2654
__do_sys_clone kernel/fork.c:2795 [inline]
__se_sys_clone kernel/fork.c:2779 [inline]
__x64_sys_clone+0x1b6/0x230 kernel/fork.c:2779
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fde7dd9c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fde7bff5fd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fde7e015fa0 RCX: 00007fde7dd9c799
RDX: 0000200000000140 RSI: 0000000000000000 RDI: 00000000000c2080
RBP: 00007fde7de32c99 R08: 0000200000000280 R09: 0000200000000280
R10: 0000200000000240 R11: 0000000000000202 R12: 0000000000000000
R13: 00007fde7e016038 R14: 00007fde7e015fa0 R15: 00007ffebaadfbf8
----------------
Code disassembly (best guess):
0: 24 9c and $0x9c,%al
2: 6d insl (%dx),%es:(%rdi)
3: 0b 67 48 or 0x48(%rdi),%esp
6: 0f b9 3a ud1 (%rdx),%edi
9: eb 4a jmp 0x55
b: e8 68 f1 16 fd call 0xfd16f178
10: 48 8d 3d 21 9c 6d 0b lea 0xb6d9c21(%rip),%rdi # 0xb6d9c38
17: 67 48 0f b9 3a ud1 (%edx),%rdi
1c: eb 37 jmp 0x55
1e: e8 55 f1 16 fd call 0xfd16f178
23: 48 8d 3d 1e 9c 6d 0b lea 0xb6d9c1e(%rip),%rdi # 0xb6d9c48
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb 24 jmp 0x55
31: e8 42 f1 16 fd call 0xfd16f178
36: 48 8d 3d 1b 9c 6d 0b lea 0xb6d9c1b(%rip),%rdi # 0xb6d9c58
3d: 67 addr32
3e: 48 rex.W
3f: 0f .byte 0xf