syzbot

panic: Decrementing non-positive ref count 0xc0004ef5c0, owned by *mm.SpecialMappable

goroutine 188502 [running]:
panic(0x100cc20, 0xc008ed6000)
	GOROOT/src/runtime/panic.go:1064 +0x46d fp=0xc0077e5cd8 sp=0xc0077e5c20 pc=0x43438d
gvisor.dev/gvisor/pkg/sentry/mm.(*SpecialMappableRefs).DecRef(0xc0004ef5c0, 0xc0077e5d50)
	bazel-out/k8-fastbuild/bin/pkg/sentry/mm/special_mappable_refs.go:127 +0x10a fp=0xc0077e5d40 sp=0xc0077e5cd8 pc=0x7dc6da
gvisor.dev/gvisor/pkg/sentry/mm.(*SpecialMappable).DecRef(0xc0004ef5c0, 0x14043a0, 0x1e045f0)
	pkg/sentry/mm/special_mappable.go:57 +0x5a fp=0xc0077e5d70 sp=0xc0077e5d40 pc=0x7dbaca
gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).removeVMAsLocked(0xc00a6b6000, 0x14043a0, 0x1e045f0, 0x10000, 0x7fffffff0000, 0x1246668, 0xc021dc5180)
	pkg/sentry/mm/vma.go:505 +0x3cd fp=0xc0077e5df8 sp=0xc0077e5d70 pc=0x7e6c9d
gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).unmapLocked(0xc00a6b6000, 0x14043a0, 0x1e045f0, 0x10000, 0x7fffffff0000, 0x44828e, 0xc0002c2544)
	pkg/sentry/mm/vma.go:465 +0x8f fp=0xc0077e5e40 sp=0xc0077e5df8 pc=0x7e689f
gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).DecUsers(0xc00a6b6000, 0x14043a0, 0x1e045f0)
	pkg/sentry/mm/lifecycle.go:352 +0x23a fp=0xc0077e5ed0 sp=0xc0077e5e40 pc=0x7c4afa
gvisor.dev/gvisor/pkg/sentry/kernel.(*TaskContext).release(0xc00a92dcb8)
	pkg/sentry/kernel/task_context.go:65 +0xa2 fp=0xc0077e5ef8 sp=0xc0077e5ed0 pc=0x956f62
gvisor.dev/gvisor/pkg/sentry/kernel.(*runExitMain).execute(0x0, 0xc00a92d500, 0x13d20c0, 0x0)
	pkg/sentry/kernel/task_exit.go:306 +0x182 fp=0xc0077e5f60 sp=0xc0077e5ef8 pc=0x9599a2
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc00a92d500, 0xa96)
	pkg/sentry/kernel/task_run.go:97 +0x1bd fp=0xc0077e5fd0 sp=0xc0077e5f60 pc=0x963bad
runtime.goexit()
	src/runtime/asm_amd64.s:1373 +0x1 fp=0xc0077e5fd8 sp=0xc0077e5fd0 pc=0x467da1
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:371 +0x112