------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 17530 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Modules linked in:
CPU: 1 UID: 0 PID: 17530 Comm: syz.2.3353 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Code: 00 00 e8 29 62 45 fd 5b 41 5e e9 81 a3 4a 06 cc e8 1b 62 45 fd c6 05 03 0b 47 0a 01 90 48 c7 c7 c0 2c 3d 8b e8 37 a9 09 fd 90 <0f> 0b 90 90 eb d7 e8 fb 61 45 fd c6 05 e4 0a 47 0a 01 90 48 c7 c7
RSP: 0018:ffffc900049376d8 EFLAGS: 00010246
RAX: 2c3724c29ad7ae00 RBX: 0000000000000002 RCX: ffff88802d9e8000
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000001934 R09: 0000000000400000
R10: 0000000000032688 R11: ffffed101712487b R12: ffffffff8b97ee48
R13: dffffc0000000000 R14: ffff888061011188 R15: dffffc0000000000
FS: 00007efc264966c0(0000) GS:ffff888126efc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000591a4000 CR4: 00000000003526f0
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
kref_get include/linux/kref.h:45 [inline]
kobject_get+0xfd/0x120 lib/kobject.c:643
i2c_get_adapter+0x6d/0xa0 drivers/i2c/i2c-core-base.c:2612
i2cdev_open+0x48/0x190 drivers/i2c/i2c-dev.c:604
chrdev_open+0x4cf/0x5e0 fs/char_dev.c:414
do_dentry_open+0x9b1/0x1350 fs/open.c:965
vfs_open+0x3b/0x350 fs/open.c:1097
do_open fs/namei.c:3975 [inline]
path_openat+0x2ef1/0x3840 fs/namei.c:4134
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efc2822d810
Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 69 95 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 bc 95 02 00 8b 44
RSP: 002b:00007efc26495b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000402 RCX: 00007efc2822d810
RDX: 0000000000000402 RSI: 00007efc26495c10 RDI: 00000000ffffff9c
RBP: 00007efc26495c10 R08: 0000000000000000 R09: 00232d6332692f76
R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd
R13: 00007efc28486038 R14: 00007efc28485fa0 R15: 00007fffbed3af58
</TASK>