WARNING: refcount bug in config_item_get

Status: upstream: reported C repro on 2026/07/29 00:08
Subsystems: fs
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+35790eb7861f8fc57382@syzkaller.appspotmail.com
First crash: 101d, last: 63d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: fixed by (bisect log) :
commit f06c2d26d1999d37e93299db0ecead04ca7d0b9f
Author: Vasileios Almpanis <vasilisalmpanis@gmail.com>
Date: Thu Jul 30 09:30:25 2026 +0000

  configfs: unhash the dentry before dropping the item in rmdir

  
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
847b14a6 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ WARNING: refcount bug in config_item_get 2026/07/24 21:38 2026/07/24 21:38 2026/07/24 22:08 1bdb5c57
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [fs?] WARNING: refcount bug in config_item_get 0 (5) 2026/10/15 19:59
[PATCH] configfs: fix refcount warning in configfs_get_config_item() 8 (8) 2026/07/30 07:30
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING: refcount bug in config_item_get origin:lts-only 13 syz, C 3 50d 97d 0/3 upstream: reported C repro on 2026/07/28 10:20
linux-6.6 WARNING: refcount bug in config_item_get origin:upstream 13 syz, C done 2 53d 85d 2/2 fixed on 2026/11/01 01:52
android-6-12 WARNING: refcount bug in config_item_get origin:lts 13 syz, C 5 74d 97d 0/1 premoderation: reported C repro on 2026/07/28 17:48
linux-5.15 WARNING: refcount bug in config_item_get origin:upstream 13 syz, C error 1 100d 100d 0/3 upstream: reported C repro on 2026/07/25 20:51
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/10/16 05:51 24m retest repro upstream no crash job log log
2026/09/20 18:09 0m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci error job log
2026/09/14 19:02 18m retest repro upstream no crash job log log
2026/09/14 19:02 18m retest repro upstream no crash job log log
2026/09/14 15:44 21m retest repro upstream no crash job log log
2026/09/14 15:44 21m retest repro upstream no crash job log log
2026/09/14 15:44 21m retest repro upstream no crash job log log
2026/09/14 15:44 20m retest repro upstream no crash job log log
2026/09/14 15:44 21m retest repro upstream no crash job log log
2026/07/29 08:51 26m joshua.crofts1@gmail.com patch upstream log
2026/07/29 08:51 20m jeffinphilip14@gmail.com patch upstream log
2026/07/29 08:21 20m joshua.crofts1@gmail.com patch upstream log

Sample crash report:
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25, CPU#1: syz.4.247/5302
Modules linked in:
CPU: 1 UID: 0 PID: 5302 Comm: syz.4.247 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25
lr : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25
sp : ffff800092597a90
x29: ffff800092597a90 x28: ffff7000124b2f68 x27: dfff800000000000
x26: ffff800092597b40 x25: 0000000000000000 x24: ffff0000f3288eb0
x23: ffff0000dad8d7c0 x22: ffff0000dace4758 x21: ffff0000c89fb030
x20: ffff0000d247741c x19: ffff80008a19d000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 000000008690ce14 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 1037b63b58e42c00
x8 : 1037b63b58e42c00 x7 : ffff80008048c60c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f6830
x2 : 0000000000000001 x1 : ffff0000c50a57c0 x0 : 0000000000000000
Call trace:
 refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25 (P)
 __refcount_add include/linux/refcount.h:-1 [inline]
 __refcount_inc include/linux/refcount.h:366 [inline]
 refcount_inc include/linux/refcount.h:383 [inline]
 kref_get include/linux/kref.h:45 [inline]
 config_item_get+0xa8/0xcc fs/configfs/item.c:104
 configfs_get_config_item fs/configfs/configfs_internal.h:127 [inline]
 get_target fs/configfs/symlink.c:128 [inline]
 configfs_symlink+0x34c/0xde0 fs/configfs/symlink.c:185
 vfs_symlink+0x16c/0x290 fs/namei.c:5660
 filename_symlinkat+0x18c/0x328 fs/namei.c:5685
 __do_sys_symlinkat fs/namei.c:5705 [inline]
 __se_sys_symlinkat fs/namei.c:5700 [inline]
 __arm64_sys_symlinkat+0xb0/0xdc fs/namei.c:5700
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
irq event stamp: 856
hardirqs last  enabled at (855): [<ffff800086910d38>] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline]
hardirqs last  enabled at (855): [<ffff800086910d38>] __arm64_exit_to_kernel_mode+0x64/0x78 arch/arm64/kernel/entry-common.c:60
hardirqs last disabled at (856): [<ffff80008690cc28>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last  enabled at (810): [<ffff80008013891c>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last  enabled at (810): [<ffff80008013891c>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last  enabled at (810): [<ffff80008013891c>] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1349
softirqs last disabled at (808): [<ffff8000801386fc>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (808): [<ffff8000801386fc>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (808): [<ffff8000801386fc>] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1325
---[ end trace 0000000000000000 ]---
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
BUG: KASAN: slab-use-after-free in config_item_put+0x2c/0xc8 fs/configfs/item.c:149
Write of size 4 at addr ffff0000d247741c by task syz.4.247/5302

CPU: 0 UID: 0 PID: 5302 Comm: syz.4.247 Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
 atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
 __refcount_sub_and_test include/linux/refcount.h:389 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 config_item_put+0x2c/0xc8 fs/configfs/item.c:149
 configfs_symlink+0x3dc/0xde0 fs/configfs/symlink.c:206
 vfs_symlink+0x16c/0x290 fs/namei.c:5660
 filename_symlinkat+0x18c/0x328 fs/namei.c:5685
 __do_sys_symlinkat fs/namei.c:5705 [inline]
 __se_sys_symlinkat fs/namei.c:5700 [inline]
 __arm64_sys_symlinkat+0xb0/0xdc fs/namei.c:5700
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590

Allocated by task 5298:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5489
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 geth_alloc_inst+0x54/0x120 drivers/usb/gadget/function/f_subset.c:425
 try_get_usb_function_instance+0xe4/0x164 drivers/usb/gadget/functions.c:28
 usb_get_function_instance+0x24/0xb0 drivers/usb/gadget/functions.c:44
 function_make+0x110/0x300 drivers/usb/gadget/configfs.c:626
 configfs_mkdir+0x374/0x7d4 fs/configfs/dir.c:1360
 vfs_mkdir+0x2dc/0x464 fs/namei.c:5276
 filename_mkdirat+0x228/0x3f4 fs/namei.c:5309
 __do_sys_mkdirat fs/namei.c:5330 [inline]
 __se_sys_mkdirat fs/namei.c:5327 [inline]
 __arm64_sys_mkdirat+0x9c/0xc0 fs/namei.c:5327
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590

Freed by task 5298:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2677 [inline]
 slab_free mm/slub.c:6377 [inline]
 kfree+0x188/0x690 mm/slub.c:6692
 geth_free_inst+0x94/0xb8 drivers/usb/gadget/function/f_subset.c:418
 usb_put_function_instance+0x88/0xac drivers/usb/gadget/functions.c:77
 gether_attr_release+0x20/0x30 drivers/usb/gadget/function/f_subset.c:381
 config_item_cleanup fs/configfs/item.c:128 [inline]
 config_item_release+0x124/0x278 fs/configfs/item.c:137
 kref_put include/linux/kref.h:65 [inline]
 config_item_put+0x60/0xc8 fs/configfs/item.c:149
 configfs_rmdir+0x604/0x6b8 fs/configfs/dir.c:1571
 vfs_rmdir+0x354/0x590 fs/namei.c:5381
 filename_rmdir+0x208/0x3d0 fs/namei.c:5438
 __do_sys_unlinkat fs/namei.c:5613 [inline]
 __se_sys_unlinkat fs/namei.c:5606 [inline]
 __arm64_sys_unlinkat+0xcc/0x108 fs/namei.c:5606
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590

The buggy address belongs to the object at ffff0000d2477400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 28 bytes inside of
 freed 512-byte region [ffff0000d2477400, ffff0000d2477600)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112474
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000002 fffffdffc3491d01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d2477300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000d2477380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000d2477400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff0000d2477480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000d2477500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28, CPU#1: syz.4.247/5302
Modules linked in:
CPU: 1 UID: 0 PID: 5302 Comm: syz.4.247 Tainted: G    B   W           syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
lr : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
sp : ffff800092597aa0
x29: ffff800092597aa0 x28: ffff7000124b2f68 x27: dfff800000000000
x26: ffff800092597b40 x25: 00000000ffffffea x24: ffff0000f3288eb0
x23: ffff80008734fba8 x22: ffff0000dace4758 x21: ffff0000d2477400
x20: ffff0000d247741c x19: ffff80008a19d000 x18: 1fffe00034bbbe28
x17: 0000000000000003 x16: ffff800088b37000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000002 x9 : 1037b63b58e42c00
x8 : 1037b63b58e42c00 x7 : 0000000000000000 x6 : ffff80008048c60c
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f6830
x2 : 0000000100000000 x1 : ffff0000c50a57c0 x0 : 0000000000000000
Call trace:
 refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 (P)
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 config_item_put+0xa4/0xc8 fs/configfs/item.c:149
 configfs_symlink+0x3dc/0xde0 fs/configfs/symlink.c:206
 vfs_symlink+0x16c/0x290 fs/namei.c:5660
 filename_symlinkat+0x18c/0x328 fs/namei.c:5685
 __do_sys_symlinkat fs/namei.c:5705 [inline]
 __se_sys_symlinkat fs/namei.c:5700 [inline]
 __arm64_sys_symlinkat+0xb0/0xdc fs/namei.c:5700
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
irq event stamp: 991
hardirqs last  enabled at (991): [<ffff8000803b7068>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1673 [inline]
hardirqs last  enabled at (991): [<ffff8000803b7068>] finish_lock_switch kernel/sched/core.c:5241 [inline]
hardirqs last  enabled at (991): [<ffff8000803b7068>] finish_task_switch+0x234/0x858 kernel/sched/core.c:5359
hardirqs last disabled at (990): [<ffff80008691bf14>] __schedule+0x2f8/0x2d80 kernel/sched/core.c:7087
softirqs last  enabled at (930): [<ffff80008030e6e4>] softirq_handle_end kernel/softirq.c:468 [inline]
softirqs last  enabled at (930): [<ffff80008030e6e4>] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650
softirqs last disabled at (859): [<ffff8000800204c0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---

Crashes (41):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/30 04:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING: refcount bug in config_item_get
2026/08/31 14:47 upstream cee9395acd80 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: refcount bug in config_item_get
2026/08/14 16:00 upstream 2f1baf1fc892 6f9b3e89 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-fs WARNING: refcount bug in config_item_get
2026/08/13 00:35 upstream 3d6d817622b0 7ae4acc7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: refcount bug in config_item_get
2026/08/08 10:55 upstream 9a143525f62b e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: refcount bug in config_item_get
2026/08/04 11:02 upstream c8e0d43058e6 a68cb31b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root WARNING: refcount bug in config_item_get
2026/07/28 01:58 upstream 62cc90241548 45ae1df4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs WARNING: refcount bug in config_item_get
2026/07/27 19:35 upstream f5098b6bae76 4cb2b096 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root WARNING: refcount bug in config_item_get
2026/07/27 14:54 upstream f5098b6bae76 4cb2b096 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: refcount bug in config_item_get
2026/07/26 04:14 upstream 0ce37745d4bf 492bab15 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-upstream-fs WARNING: refcount bug in config_item_get
2026/08/26 07:26 upstream 818bebeb63dd 6a91adb4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/08/26 06:17 upstream 818bebeb63dd 6a91adb4 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/08/25 19:07 upstream 818bebeb63dd a9a1fc32 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/08/14 12:24 upstream 2f1baf1fc892 2cf1fbb7 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/08/06 06:00 upstream 0d8395707651 cd5b1963 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING: refcount bug in config_item_get
2026/08/01 16:40 upstream 02dc699f83d0 e611ffe1 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/07/24 22:11 upstream 48a5a7ab8d6a 4a865b71 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/07/24 21:38 upstream 48a5a7ab8d6a 4a865b71 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream WARNING: refcount bug in config_item_get
2026/08/07 03:50 upstream fcaeecb8b0cd c38879ea .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/06 07:21 upstream 0d8395707651 cd5b1963 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/02 05:22 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/02 05:22 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/02 05:20 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:54 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:53 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:53 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:53 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:49 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:47 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:47 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:46 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:45 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:45 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:44 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:43 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:42 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:42 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/01 14:42 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/07/28 03:35 upstream 62cc90241548 4a865b71 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/07/28 03:34 upstream 62cc90241548 4a865b71 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING: refcount bug in config_item_get
2026/08/02 00:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci e2d5e23967d0 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING: refcount bug in config_item_get
* Struck through repros no longer work on HEAD.