[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.29' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 63.164632][ T6853] ------------[ cut here ]------------ [ 63.170264][ T6853] refcount_t: underflow; use-after-free. [ 63.195053][ T6853] WARNING: CPU: 0 PID: 6853 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 [ 63.209204][ T6853] Kernel panic - not syncing: panic_on_warn set ... [ 63.215833][ T6853] CPU: 0 PID: 6853 Comm: syz-executor287 Not tainted 5.9.0-rc1-syzkaller #0 [ 63.224505][ T6853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.234563][ T6853] Call Trace: [ 63.237876][ T6853] dump_stack+0x18f/0x20d [ 63.242224][ T6853] panic+0x2e3/0x75c [ 63.246240][ T6853] ? __warn_printk+0xf3/0xf3 [ 63.250854][ T6853] ? __warn.cold+0x5/0x4a [ 63.255193][ T6853] ? __warn+0xd6/0x1f2 [ 63.259272][ T6853] ? refcount_warn_saturate+0x1d1/0x1e0 [ 63.264827][ T6853] __warn.cold+0x20/0x4a [ 63.269082][ T6853] ? refcount_warn_saturate+0x1d1/0x1e0 [ 63.274639][ T6853] report_bug+0x1bd/0x210 [ 63.278982][ T6853] handle_bug+0x38/0x90 [ 63.283149][ T6853] ? __warn_printk+0xc6/0xf3 [ 63.287745][ T6853] exc_invalid_op+0x14/0x40 [ 63.292251][ T6853] asm_exc_invalid_op+0x12/0x20 [ 63.297108][ T6853] RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 [ 63.303264][ T6853] Code: e9 db fe ff ff 48 89 df e8 ec f2 18 fe e9 8a fe ff ff e8 f2 d9 d8 fd 48 c7 c7 00 db 93 88 c6 05 77 15 12 07 01 e8 e1 ea a9 fd <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 [ 63.322871][ T6853] RSP: 0018:ffffc900010774a0 EFLAGS: 00010282 [ 63.328947][ T6853] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 63.336929][ T6853] RDX: ffff88808fcba380 RSI: ffffffff815dafc7 RDI: fffff5200020ee86 [ 63.344903][ T6853] RBP: 0000000000000003 R08: 0000000000000001 R09: ffff8880ae6318e7 [ 63.353060][ T6853] R10: 0000000000000000 R11: 0000000035383654 R12: ffff888096d51064 [ 63.361036][ T6853] R13: 00000000ffffffea R14: ffff8880a60e2000 R15: ffff88809e276824 [ 63.369044][ T6853] ? vprintk_func+0x97/0x1a6 [ 63.373908][ T6853] qdisc_put+0xbe/0xe0 [ 63.377994][ T6853] ? red_offload.isra.0+0x480/0x480 [ 63.383203][ T6853] qdisc_create+0xcd9/0x12e0 [ 63.387805][ T6853] ? tc_get_qdisc+0xad0/0xad0 [ 63.392503][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 63.397453][ T6853] tc_modify_qdisc+0x4c8/0x1990 [ 63.402328][ T6853] ? rtnetlink_rcv_msg+0x3f9/0xad0 [ 63.407449][ T6853] ? qdisc_create+0x12e0/0x12e0 [ 63.412326][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 63.417276][ T6853] ? qdisc_create+0x12e0/0x12e0 [ 63.422141][ T6853] rtnetlink_rcv_msg+0x44e/0xad0 [ 63.427093][ T6853] ? rtnetlink_put_metrics+0x510/0x510 [ 63.432565][ T6853] ? lock_acquire+0x1f1/0xad0 [ 63.437253][ T6853] ? netlink_deliver_tap+0x146/0xb70 [ 63.442548][ T6853] netlink_rcv_skb+0x15a/0x430 [ 63.447319][ T6853] ? rtnetlink_put_metrics+0x510/0x510 [ 63.452787][ T6853] ? netlink_ack+0xa10/0xa10 [ 63.457392][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 63.462345][ T6853] netlink_unicast+0x533/0x7d0 [ 63.467122][ T6853] ? netlink_attachskb+0x810/0x810 [ 63.472251][ T6853] ? _copy_from_iter_full+0x247/0x890 [ 63.477630][ T6853] ? __phys_addr+0x9a/0x110 [ 63.482141][ T6853] ? __phys_addr_symbol+0x2c/0x70 [ 63.487170][ T6853] ? __check_object_size+0x171/0x3e4 [ 63.492466][ T6853] netlink_sendmsg+0x856/0xd90 [ 63.497259][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 63.502269][ T6853] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 63.507539][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 63.512466][ T6853] sock_sendmsg+0xcf/0x120 [ 63.517114][ T6853] ____sys_sendmsg+0x6e8/0x810 [ 63.522114][ T6853] ? kernel_sendmsg+0x50/0x50 [ 63.526856][ T6853] ? do_recvmmsg+0x6d0/0x6d0 [ 63.531437][ T6853] ? mark_lock+0xbc/0x1710 [ 63.535845][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 63.540774][ T6853] ? __lock_acquire+0xbb5/0x5640 [ 63.545692][ T6853] ___sys_sendmsg+0xf3/0x170 [ 63.550260][ T6853] ? sendmsg_copy_msghdr+0x160/0x160 [ 63.555540][ T6853] ? percpu_counter_add_batch+0x126/0x180 [ 63.561250][ T6853] ? lock_acquire+0x1f1/0xad0 [ 63.565912][ T6853] ? __get_unused_fd_flags+0x60/0x60 [ 63.571172][ T6853] ? find_held_lock+0x2d/0x110 [ 63.575930][ T6853] ? __fd_install+0x1b4/0x600 [ 63.580594][ T6853] ? lock_downgrade+0x830/0x830 [ 63.585419][ T6853] ? __fget_light+0x215/0x280 [ 63.590073][ T6853] __sys_sendmsg+0xe5/0x1b0 [ 63.594558][ T6853] ? __sys_sendmsg_sock+0xb0/0xb0 [ 63.599565][ T6853] ? trace_hardirqs_on+0x5f/0x220 [ 63.604568][ T6853] ? lockdep_hardirqs_on+0x76/0xf0 [ 63.609655][ T6853] do_syscall_64+0x2d/0x70 [ 63.614050][ T6853] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.619918][ T6853] RIP: 0033:0x4404a9 [ 63.623793][ T6853] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.643462][ T6853] RSP: 002b:00007ffc514c9da8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 63.651864][ T6853] RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404a9 [ 63.659827][ T6853] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004 [ 63.667776][ T6853] RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 [ 63.675741][ T6853] R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401cb0 [ 63.683704][ T6853] R13: 0000000000401d40 R14: 0000000000000000 R15: 0000000000000000 [ 63.693141][ T6853] Kernel Offset: disabled [ 63.697536][ T6853] Rebooting in 86400 seconds..