------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 5346 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 5346 Comm: udevd Not tainted 6.15.0-rc5-syzkaller-00204-g0e1329d4045c #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 b8 49 ea fc 84 db 0f 85 66 ff ff ff e8 cb 4e ea fc c6 05 a8 8b 9c 0b 01 90 48 c7 c7 e0 2e f4 8b e8 37 da a9 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 a8 4e ea fc 0f b6 1d 83 8b 9c 0b 31
RSP: 0018:ffffc900006f8be8 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817aaff8
RDX: ffff888024c54880 RSI: ffffffff817ab005 RDI: 0000000000000001
RBP: ffff8880526bba98 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880526bba98
R13: ffff88805baf1400 R14: 0000000000000015 R15: 1ffff1102176300c
FS: 00007f3e9f7cc880(0000) GS:ffff8880d6ce1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c35ae2e CR3: 00000000245f1000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
p9_req_put+0x1ec/0x250 net/9p/client.c:404
req_done+0x1dc/0x2e0 net/9p/trans_virtio.c:147
vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
__handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
handle_irq arch/x86/kernel/irq.c:254 [inline]
call_irq_handler arch/x86/kernel/irq.c:266 [inline]
__common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:292
common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:285
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:handle_softirqs+0x1dd/0x8e0 kernel/softirq.c:565
Code: 88 6c 24 26 4c 89 7c 24 18 48 c7 c7 a0 83 8b 8b e8 68 23 f0 09 65 66 c7 05 d6 46 27 12 00 00 e8 49 3d 46 00 fb bb ff ff ff ff <49> c7 c7 c0 c0 00 8e 41 0f bc dc 83 c3 01 0f 85 a4 00 00 00 e9 b1
RSP: 0018:ffffc900006f8f28 EFLAGS: 00000206
RAX: 00000000002fb40a RBX: 00000000ffffffff RCX: 0000000000000003
RDX: 0000000000000000 RSI: ffffffff8dbe13ef RDI: ffffffff8bf482e0
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9084f017 R11: 0000000000000000 R12: 0000000000000002
R13: 000000000000000a R14: 1ffff920000df1ed R15: ffffed100498a910
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7090
Code: df 55 65 48 8b 2d ec 02 36 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 2f 23 1b f6 e8 6a f9 54 f6 fb bf 01 00 00 00 af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 7d cd 1a
RSP: 0018:ffffc90004d676a8 EFLAGS: 00000206
RAX: 00000000002fb405 RBX: ffffed100498a910 RCX: 0000000000000007
RDX: 0000000000000000 RSI: ffffffff8dbe13ef RDI: 0000000000000001
RBP: ffff888024c54880 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9084f017 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x36/0x90 kernel/entry/common.c:354
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:check_kcov_mode kernel/kcov.c:185 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:217
Code: 8b 05 39 cd e8 11 a9 00 01 ff 00 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 3c 16 00 00 85 c0 74 2b <8b> 82 18 16 00 00 83 f8 02 75 20 48 8b 8a 20 16 00 00 8b 92 1c 16
RSP: 0018:ffffc90004d67778 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffff88802877899c RCX: ffffffff84904a45
RDX: ffff888024c54880 RSI: ffffffff849049e2 RDI: 0000000000000001
RBP: 000000000000006f R08: 0000000000000001 R09: 0000000000000000
R10: 000000000000006f R11: 0000000000000000 R12: ffffc90004d677e8
R13: 0000000000000024 R14: 000000000000001c R15: ffff888028778980
tomoyo_const_part_length security/tomoyo/util.c:643 [inline]
tomoyo_fill_path_info+0xa2/0x420 security/tomoyo/util.c:682
tomoyo_get_realpath security/tomoyo/file.c:153 [inline]
tomoyo_check_open_permission+0x2d8/0x3c0 security/tomoyo/file.c:771
tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334
security_file_open+0x84/0x1e0 security/security.c:3114
do_dentry_open+0x596/0x1c10 fs/open.c:933
vfs_open+0x82/0x3f0 fs/open.c:1086
do_open fs/namei.c:3880 [inline]
path_openat+0x1e5e/0x2d40 fs/namei.c:4039
do_filp_open+0x20b/0x470 fs/namei.c:4066
do_sys_openat2+0x11b/0x1d0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e9f115c3a
Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24
RSP: 002b:00007fffcadc6a38 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00005621b753fc40 RCX: 00007f3e9f115c3a
RDX: 0000000000090800 RSI: 00005621b73e4260 RDI: 00000000ffffff9c
RBP: 00005621b73e4260 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000206 R12: 00005621b73e5130
R13: 00000000000000ff R14: 000056217d556be0 R15: 00007fffcadc6cc0
----------------
Code disassembly (best guess):
0: 88 6c 24 26 mov %ch,0x26(%rsp)
4: 4c 89 7c 24 18 mov %r15,0x18(%rsp)
9: 48 c7 c7 a0 83 8b 8b mov $0xffffffff8b8b83a0,%rdi
10: e8 68 23 f0 09 call 0x9f0237d
15: 65 66 c7 05 d6 46 27 movw $0x0,%gs:0x122746d6(%rip) # 0x122746f5
1c: 12 00 00
1f: e8 49 3d 46 00 call 0x463d6d
24: fb sti
25: bb ff ff ff ff mov $0xffffffff,%ebx
* 2a: 49 c7 c7 c0 c0 00 8e mov $0xffffffff8e00c0c0,%r15 <-- trapping instruction
31: 41 0f bc dc bsf %r12d,%ebx
35: 83 c3 01 add $0x1,%ebx
38: 0f 85 a4 00 00 00 jne 0xe2
3e: e9 .byte 0xe9
3f: b1 .byte 0xb1