------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 12249 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Modules linked in:
CPU: 1 UID: 0 PID: 12249 Comm: udevd Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Code: 00 00 e8 09 2d ff fc 5b 41 5e e9 d1 4a a7 06 cc e8 fb 2c ff fc c6 05 63 ca c9 0a 01 90 48 c7 c7 c0 38 e2 8b e8 17 db c2 fc 90 <0f> 0b 90 90 eb d7 e8 db 2c ff fc c6 05 44 ca c9 0a 01 90 48 c7 c7
RSP: 0018:ffffc90000a08668 EFLAGS: 00010246
RAX: fc4591934b5f5f00 RBX: 0000000000000002 RCX: ffff88802ee43c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000a087e8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfaa44 R12: ffff888032248000
R13: dffffc0000000000 R14: ffff88803224816c R15: ffff8880579f4000
FS: 00007f17ef551880(0000) GS:ffff888125d55000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2f635f CR3: 000000006a7c8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_net include/net/net_namespace.h:268 [inline]
tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
tipc_crypto_xmit+0x1820/0x22c0 net/tipc/crypto.c:1761
tipc_crypto_clone_msg+0x90/0x170 net/tipc/crypto.c:1656
tipc_crypto_xmit+0x1998/0x22c0 net/tipc/crypto.c:1717
tipc_bearer_xmit_skb+0x245/0x400 net/tipc/bearer.c:572
tipc_disc_timeout+0x580/0x6d0 net/tipc/discover.c:338
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kasan_check_range+0x1d6/0x2c0 mm/kasan/generic.c:189
Code: 49 8d 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 12 41 80 3b 00 0f 85 b8 00 00 00 49 ff c3 49 ff cc 75 ee 5b 41 5c <41> 5d 41 5e 41 5f 5d e9 be c2 44 09 cc 45 84 ff 75 63 41 f7 c7 00
RSP: 0018:ffffc9000436f7a0 EFLAGS: 00000256
RAX: 8000000000000001 RBX: ffff88801b2ff120 RCX: ffffffff8b675fb1
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88801b2ff120
RBP: dffffc0000000000 R08: ffff88801b2ff127 R09: 1ffff1100365fe24
R10: dffffc0000000000 R11: ffffed100365fe25 R12: dffffc0000000000
R13: ffff888022d72dd0 R14: ffffed100365fe25 R15: 1ffff1100365fe24
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_long_read include/linux/atomic/atomic-instrumented.h:3188 [inline]
__rwsem_set_reader_owned kernel/locking/rwsem.c:174 [inline]
rwsem_set_reader_owned kernel/locking/rwsem.c:181 [inline]
rwsem_read_trylock kernel/locking/rwsem.c:256 [inline]
__down_read_common kernel/locking/rwsem.c:1247 [inline]
__down_read kernel/locking/rwsem.c:1261 [inline]
down_read+0x161/0x2e0 kernel/locking/rwsem.c:1526
kernfs_dop_revalidate+0x9e/0x5d0 fs/kernfs/dir.c:1180
d_revalidate fs/namei.c:929 [inline]
lookup_fast+0x250/0x5b0 fs/namei.c:-1
walk_component fs/namei.c:2134 [inline]
link_path_walk+0x642/0xea0 fs/namei.c:2506
path_openat+0x28c/0x3830 fs/namei.c:4042
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f17eeea7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffc91889e60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f17ef551880 RCX: 00007f17eeea7407
RDX: 0000000000080000 RSI: 00007ffc91889fe0 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055b9d749c7f5
R13: 000055b9d749c7f5 R14: 0000000000000001 R15: 000055b9d74b7140
----------------
Code disassembly (best guess):
0: 49 8d 5c 24 07 lea 0x7(%r12),%rbx
5: 4d 85 e4 test %r12,%r12
8: 49 0f 49 dc cmovns %r12,%rbx
c: 48 83 e3 f8 and $0xfffffffffffffff8,%rbx
10: 49 29 dc sub %rbx,%r12
13: 74 12 je 0x27
15: 41 80 3b 00 cmpb $0x0,(%r11)
19: 0f 85 b8 00 00 00 jne 0xd7
1f: 49 ff c3 inc %r11
22: 49 ff cc dec %r12
25: 75 ee jne 0x15
27: 5b pop %rbx
28: 41 5c pop %r12
* 2a: 41 5d pop %r13 <-- trapping instruction
2c: 41 5e pop %r14
2e: 41 5f pop %r15
30: 5d pop %rbp
31: e9 be c2 44 09 jmp 0x944c2f4
36: cc int3
37: 45 84 ff test %r15b,%r15b
3a: 75 63 jne 0x9f
3c: 41 rex.B
3d: f7 .byte 0xf7
3e: c7 .byte 0xc7