Debian GNU/Linux 7 syzkaller ttyS0 executing program syzkaller login: [ 25.885158] refcount_t: underflow; use-after-free. [ 25.885622] ------------[ cut here ]------------ [ 25.885953] WARNING: CPU: 3 PID: 3027 at lib/refcount.c:186 refcount_sub_and_test+0x167/0x1b0 [ 25.886782] Kernel panic - not syncing: panic_on_warn set ... [ 25.886782] [ 25.887357] CPU: 3 PID: 3027 Comm: syzkaller225878 Not tainted 4.13.0-rc6-next-20170825+ #9 [ 25.887959] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 25.888552] Call Trace: [ 25.888736] dump_stack+0x194/0x257 [ 25.888995] ? arch_local_irq_restore+0x53/0x53 [ 25.889352] panic+0x1e4/0x41c [ 25.889604] ? refcount_error_report+0x214/0x214 [ 25.889948] ? show_regs_print_info+0x65/0x65 [ 25.890282] ? refcount_sub_and_test+0x167/0x1b0 [ 25.890640] __warn+0x1c4/0x1e0 [ 25.890899] ? refcount_sub_and_test+0x167/0x1b0 [ 25.891745] report_bug+0x211/0x2d0 [ 25.892073] fixup_bug+0x40/0x90 [ 25.892370] do_trap+0x260/0x390 [ 25.892669] do_error_trap+0x120/0x390 [ 25.893015] ? do_trap+0x390/0x390 [ 25.893545] ? refcount_sub_and_test+0x167/0x1b0 [ 25.893919] ? vprintk_emit+0x3ea/0x590 [ 25.894296] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 25.894685] do_invalid_op+0x1b/0x20 [ 25.894998] invalid_op+0x18/0x20 [ 25.895326] RIP: 0010:refcount_sub_and_test+0x167/0x1b0 [ 25.895752] RSP: 0018:ffff88003a926920 EFLAGS: 00010286 [ 25.896183] RAX: 0000000000000026 RBX: 0000000000000001 RCX: 0000000000000000 [ 25.896730] RDX: 0000000000000026 RSI: 1ffff10007524ce4 RDI: ffffed0007524d18 [ 25.897326] RBP: ffff88003a9269b0 R08: ffff88003a926010 R09: 0000000000000000 [ 25.897902] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff10007524d25 [ 25.898472] R13: 00000000ffffff01 R14: 0000000000000100 R15: ffff88006a08eae4 [ 25.899099] ? refcount_inc+0x50/0x50 [ 25.899417] ? __sctp_outq_teardown+0xc7d/0x15a0 [ 25.899808] ? sctp_association_free+0x2d0/0x930 [ 25.900201] ? sctp_do_sm+0x28e7/0x6dd0 [ 25.900515] ? sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 25.901025] ? sctp_close+0x3c6/0x980 [ 25.901471] ? inet_release+0xed/0x1c0 [ 25.901875] sctp_wfree+0x183/0x620 [ 25.902387] ? __sctp_write_space+0x910/0x910 [ 25.903040] skb_release_head_state+0x124/0x200 [ 25.903711] skb_release_all+0x15/0x60 [ 25.904225] consume_skb+0x153/0x490 [ 25.904821] ? sctp_chunk_put+0x99/0x420 [ 25.905358] ? alloc_skb_with_frags+0x710/0x710 [ 25.906028] ? sctp_chunk_hold+0x20/0x20 [ 25.906568] ? refcount_sub_and_test+0x115/0x1b0 [ 25.907285] ? refcount_inc+0x50/0x50 [ 25.907780] ? mark_held_locks+0xb2/0x100 [ 25.908315] ? sctp_datamsg_put+0x456/0x560 [ 25.908923] sctp_chunk_put+0x29c/0x420 [ 25.909447] ? sctp_chunk_hold+0x20/0x20 [ 25.909973] ? sctp_transport_dst_confirm+0x50/0x50 [ 25.910543] sctp_chunk_free+0x53/0x60 [ 25.911098] __sctp_outq_teardown+0xc7d/0x15a0 [ 25.911769] ? inet6_release+0x50/0x70 [ 25.912261] ? sctp_inq_set_th_handler+0x1b0/0x1b0 [ 25.912775] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 25.913355] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 25.914055] ? unwind_dump+0x4c0/0x4c0 [ 25.915546] ? unwind_dump+0x4c0/0x4c0 [ 25.915860] ? copy_trace+0x1d0/0x1d0 [ 25.916141] ? check_noncircular+0x20/0x20 [ 25.916474] ? check_noncircular+0x20/0x20 [ 25.916834] ? unwind_get_return_address+0x61/0xa0 [ 25.917292] ? __save_stack_trace+0x61/0xd0 [ 25.917669] ? check_noncircular+0x20/0x20 [ 25.918037] ? print_usage_bug+0x480/0x480 [ 25.918428] ? find_held_lock+0x39/0x1d0 [ 25.918789] ? lock_downgrade+0x990/0x990 [ 25.919159] ? sk_dst_check+0x560/0x560 [ 25.919504] ? rcu_read_lock_sched_held+0x108/0x120 [ 25.919938] ? lock_release+0xd70/0xd70 [ 25.920287] sctp_outq_free+0x15/0x20 [ 25.920619] sctp_association_free+0x2d0/0x930 [ 25.921021] ? sctp_asconf_queue_teardown+0x700/0x700 [ 25.921465] ? sock_def_wakeup+0x222/0x350 [ 25.921835] ? sk_dst_check+0x560/0x560 [ 25.922187] ? sctp_association_put+0x74/0x2f0 [ 25.922580] ? sctp_association_hold+0x20/0x20 [ 25.922974] ? unwind_dump+0x4c0/0x4c0 [ 25.923305] ? sctp_sm_lookup_event+0x95/0x3c0 [ 25.923707] sctp_do_sm+0x28e7/0x6dd0 [ 25.924058] ? sctp_do_8_2_transport_strike.isra.16+0x8a0/0x8a0 [ 25.924598] ? print_usage_bug+0x480/0x480 [ 25.924985] ? __lock_acquire+0x20f4/0x4620 [ 25.925363] ? print_usage_bug+0x480/0x480 [ 25.925732] ? find_held_lock+0x39/0x1d0 [ 25.926094] ? lock_downgrade+0x990/0x990 [ 25.926458] ? skb_dequeue+0x22/0x180 [ 25.926797] ? do_raw_spin_trylock+0x190/0x190 [ 25.927196] ? mark_held_locks+0xb2/0x100 [ 25.927571] ? trace_hardirqs_on+0xd/0x10 [ 25.927948] sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 25.928350] sctp_close+0x3c6/0x980 [ 25.928676] ? sctp_apply_peer_addr_params+0xf30/0xf30 [ 25.929151] ? unwind_get_return_address+0x61/0xa0 [ 25.929581] ? check_noncircular+0x20/0x20 [ 25.929951] ? depot_save_stack+0x12c/0x490 [ 25.930327] ? ipv6_sock_ac_close+0x2e8/0x3e0 [ 25.930717] ? ipv6_sock_mc_close+0x148/0x1a0 [ 25.931103] ? ipv6_sock_ac_drop+0x580/0x580 [ 25.931489] ? ip_mc_drop_socket+0x1ce/0x230 [ 25.931873] ? __fsnotify_parent+0xb4/0x3a0 [ 25.932251] inet_release+0xed/0x1c0 [ 25.932578] inet6_release+0x50/0x70 [ 25.932908] sock_release+0x8d/0x1e0 [ 25.933232] ? sock_release+0x1e0/0x1e0 [ 25.933582] sock_close+0x16/0x20 [ 25.933890] __fput+0x333/0x7f0 [ 25.934259] ? fput+0x140/0x140 [ 25.934566] ? _raw_spin_unlock_irq+0x27/0x70 [ 25.934973] ____fput+0x15/0x20 [ 25.935260] task_work_run+0x199/0x270 [ 25.935588] ? task_work_cancel+0x210/0x210 [ 25.936307] ? _raw_spin_unlock+0x22/0x30 [ 25.936676] ? switch_task_namespaces+0x87/0xc0 [ 25.937115] do_exit+0xa52/0x1b40 [ 25.937447] ? lock_downgrade+0x990/0x990 [ 25.937837] ? mm_update_next_owner+0x930/0x930 [ 25.938271] ? __lock_is_held+0xbc/0x140 [ 25.938722] ? __fd_install+0x2f7/0x6a0 [ 25.939077] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.939512] ? get_unused_fd_flags+0x190/0x190 [ 25.939959] ? copy_user_generic_string+0x2c/0x40 [ 25.940343] ? _copy_to_user+0xa2/0xc0 [ 25.940699] ? fd_install+0x4d/0x60 [ 25.941047] ? SYSC_accept4+0x4f2/0x850 [ 25.941421] ? kernel_accept+0x2f0/0x2f0 [ 25.941780] ? do_page_fault+0x70/0x70 [ 25.942132] ? selinux_socket_listen+0x36/0x40 [ 25.942535] ? security_socket_listen+0x81/0xb0 [ 25.942953] do_group_exit+0x149/0x400 [ 25.943289] ? SyS_bind+0x30/0x30 [ 25.943702] ? SyS_exit+0x30/0x30 [ 25.944015] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 25.944471] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 25.944901] SyS_exit_group+0x1d/0x20 [ 25.945265] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 25.945722] RIP: 0033:0x433aa9 [ 25.946018] RSP: 002b:00007ffe6609df38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 25.946692] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433aa9 [ 25.947322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.947956] RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 [ 25.948589] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 [ 25.949224] R13: 00000000004018e0 R14: 0000000000401970 R15: 0000000000000000 [ 25.950214] Dumping ftrace buffer: [ 25.950603] (ftrace buffer empty) [ 25.950945] Kernel Offset: disabled [ 25.951281] Rebooting in 86400 seconds..