syzbot

------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 9939 at lib/refcount.c:187 refcount_sub_and_test_checked+0x2c9/0x310 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...

kobject: 'loop3' (00000000cfaac9cb): kobject_uevent_env
CPU: 1 PID: 9939 Comm: syz-executor0 Not tainted 4.19.0-rc8+ #285
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
kobject: 'loop3' (00000000cfaac9cb): fill_kobj_path: path = '/devices/virtual/block/loop3'
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 panic+0x238/0x4e7 kernel/panic.c:184
kobject: 'loop2' (00000000f8622e20): kobject_uevent_env
 __warn.cold.8+0x163/0x1ba kernel/panic.c:536
 report_bug+0x254/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
kobject: 'loop2' (00000000f8622e20): fill_kobj_path: path = '/devices/virtual/block/loop2'
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993
RIP: 0010:refcount_sub_and_test_checked+0x2c9/0x310 lib/refcount.c:187
Code: 89 de e8 ca b6 f2 fd 84 db 74 07 31 db e9 4d ff ff ff e8 ea b5 f2 fd 48 c7 c7 80 70 40 88 c6 05 af a2 62 06 01 e8 07 85 bc fd <0f> 0b 31 db e9 2c ff ff ff 48 89 cf e8 56 26 36 fe e9 41 fe ff ff
RSP: 0018:ffff8801daf075a0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff8164d435 RDI: 0000000000000005
kobject: 'loop4' (0000000035cb13b0): kobject_uevent_env
RBP: ffff8801daf07688 R08: ffff8801822fa600 R09: 0000000000000002
R10: 0000000000000000 R11: ffff8801822fa600 R12: ffff8801d3f724a0
R13: 00000000ffffffff R14: ffff8801daf07660 R15: ffff8801d5803248
kobject: 'loop4' (0000000035cb13b0): fill_kobj_path: path = '/devices/virtual/block/loop4'
 refcount_dec_and_test_checked+0x1a/0x20 lib/refcount.c:212
 sctp_transport_put+0x76/0x1f0 net/sctp/transport.c:339
 sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416
 call_timer_fn+0x272/0x920 kernel/time/timer.c:1326
 expire_timers kernel/time/timer.c:1363 [inline]
 __run_timers+0x7e5/0xc70 kernel/time/timer.c:1682
 run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695
 __do_softirq+0x30b/0xad8 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x17f/0x1c0 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788 [inline]
RIP: 0010:lock_is_held_type+0x18b/0x210 kernel/locking/lockdep.c:3940
Code: ff df 41 c7 84 24 7c 08 00 00 00 00 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 75 63 48 83 3d 44 17 d2 07 00 74 30 48 89 df 57 9d <0f> 1f 44 00 00 48 83 c4 08 44 89 e8 5b 41 5c 41 5d 5d c3 48 83 c4
RSP: 0018:ffff880182286700 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000000
RDX: 1ffffffff1263e41 RSI: 0000000000000000 RDI: 0000000000000282
RBP: ffff880182286720 R08: 0000000000000002 R09: 1ffffffff1273955
R10: ffffed003b5e4732 R11: ffff8801daf23993 R12: ffff8801822fa600
R13: 0000000000000001 R14: ffffed0030450d0c R15: ffff880182286a60
 lock_is_held include/linux/lockdep.h:344 [inline]
 rcu_read_lock_held+0xa9/0xc0 kernel/rcu/update.c:285
 rt6_get_cookie include/net/ip6_fib.h:257 [inline]
 sctp_v6_get_dst+0xa39/0x22d0 net/sctp/ipv6.c:375
 sctp_transport_route+0x132/0x360 net/sctp/transport.c:311
 sctp_assoc_add_peer+0x5fd/0x10d0 net/sctp/associola.c:671
 sctp_process_param net/sctp/sm_make_chunk.c:2540 [inline]
 sctp_process_init+0xfc0/0x29e0 net/sctp/sm_make_chunk.c:2356
 sctp_cmd_process_init net/sctp/sm_sideeffect.c:682 [inline]
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1410 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
 sctp_do_sm+0x13b9/0x7190 net/sctp/sm_sideeffect.c:1191
 sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
 sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
 sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
 sk_backlog_rcv include/net/sock.h:931 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2336
 release_sock+0xad/0x2c0 net/core/sock.c:2849
 sctp_wait_for_connect+0x391/0x640 net/sctp/socket.c:8666
 sctp_sendmsg_to_asoc+0x1cf7/0x2220 net/sctp/socket.c:1984
 sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2130
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 __sys_sendto+0x3d7/0x670 net/socket.c:1788
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f79f6ac5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569
RDX: 0000000000000001 RSI: 0000000020847fff RDI: 000000000000000a
RBP: 000000000072bfa0 R08: 000000002005ffe4 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f79f6ac66d4
R13: 00000000004c3921 R14: 00000000004d57d8 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..