EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block
EXT4-fs warning (device loop6): ext4_empty_dir:3139: inode #11: lblock 0: comm syz-executor: error -12 reading directory block
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7211 at lib/refcount.c:28 refcount_warn_saturate+0x11b/0x1a0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 7211 Comm: syz-executor Not tainted 6.1.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:refcount_warn_saturate+0x11b/0x1a0 lib/refcount.c:28
Code: 0a 01 48 c7 c7 a0 da de 8a e8 a1 11 45 fd 0f 0b eb c4 e8 08 00 79 fd c6 05 72 2b 03 0a 01 48 c7 c7 00 db de 8a e8 85 11 45 fd <0f> 0b eb a8 e8 ec ff 78 fd c6 05 53 2b 03 0a 01 48 c7 c7 40 da de
RSP: 0018:ffffc90003297858 EFLAGS: 00010246
RAX: f0ab3f9809b41e00 RBX: 0000000000000003 RCX: ffff88802ea99dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffff52000652e9d
R10: fffff52000652e9d R11: 1ffff92000652e9c R12: 1ffff1100ac5e08c
R13: ffff8880562f0460 R14: 0000000000000003 R15: ffff8880243e4c00
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558ef83808 CR3: 000000002eb36000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__refcount_sub_and_test include/linux/refcount.h:283 [inline]
__refcount_dec_and_test include/linux/refcount.h:315 [inline]
refcount_dec_and_test include/linux/refcount.h:333 [inline]
kref_put include/linux/kref.h:64 [inline]
klist_dec_and_del+0x3c0/0x3d0 lib/klist.c:206
klist_put lib/klist.c:217 [inline]
klist_del lib/klist.c:230 [inline]
klist_remove+0x1d1/0x380 lib/klist.c:249
device_move+0x18f/0x6f0 drivers/base/core.c:4633
hci_conn_del_sysfs+0xab/0x160 net/bluetooth/hci_sysfs.c:73
hci_conn_cleanup+0x575/0x730 net/bluetooth/hci_conn.c:172
hci_conn_del+0x515/0x720 net/bluetooth/hci_conn.c:1151
hci_conn_hash_flush+0x203/0x290 net/bluetooth/hci_conn.c:2510
hci_dev_close_sync+0x930/0xf40 net/bluetooth/hci_sync.c:5184
hci_dev_do_close net/bluetooth/hci_core.c:510 [inline]
hci_unregister_dev+0x202/0x4f0 net/bluetooth/hci_core.c:2705
vhci_release+0x7f/0xd0 drivers/bluetooth/hci_vhci.c:573
__fput+0x22c/0x920 fs/file_table.c:320
task_work_run+0x1ca/0x250 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x93e/0x2400 kernel/exit.c:880
do_group_exit+0x217/0x2d0 kernel/exit.c:1022
__do_sys_exit_group kernel/exit.c:1033 [inline]
__se_sys_exit_group kernel/exit.c:1031 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1031
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1bcc38e929
Code: Unable to access opcode bytes at 0x7f1bcc38e8ff.
RSP: 002b:00007fffc1d0eda8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f1bcc4109a9 RCX: 00007f1bcc38e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000027 R08: 00007fffc1d0cb46 R09: 00007fffc1d10060
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffc1d10060
R13: 00007f1bcc410925 R14: 000055557219b4a8 R15: 00007fffc1d12220
</TASK>