Warning: Permanently added '10.128.0.170' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 77.096528][ T8837] ------------[ cut here ]------------ [ 77.102936][ T8837] refcount_t: underflow; use-after-free. [ 77.108896][ T8837] WARNING: CPU: 1 PID: 8837 at lib/refcount.c:190 refcount_sub_and_test_checked+0x1d0/0x200 [ 77.118985][ T8837] Kernel panic - not syncing: panic_on_warn set ... [ 77.125569][ T8837] CPU: 1 PID: 8837 Comm: syz-executor723 Not tainted 5.4.0-rc8-syzkaller #0 [ 77.134233][ T8837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.144292][ T8837] Call Trace: [ 77.147579][ T8837] dump_stack+0x197/0x210 [ 77.151920][ T8837] ? refcount_sub_and_test_checked+0x100/0x200 [ 77.158089][ T8837] panic+0x2e3/0x75c [ 77.162170][ T8837] ? add_taint.cold+0x16/0x16 [ 77.167090][ T8837] ? __kasan_check_write+0x14/0x20 [ 77.172211][ T8837] ? __warn.cold+0x14/0x35 [ 77.176634][ T8837] ? __warn+0xd9/0x1d0 [ 77.180696][ T8837] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 77.186829][ T8837] __warn.cold+0x2f/0x35 [ 77.191158][ T8837] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 77.197319][ T8837] report_bug+0x289/0x300 [ 77.201649][ T8837] do_error_trap+0x11b/0x200 [ 77.206564][ T8837] do_invalid_op+0x37/0x50 [ 77.210992][ T8837] ? refcount_sub_and_test_checked+0x1d0/0x200 [ 77.217136][ T8837] invalid_op+0x23/0x30 [ 77.221301][ T8837] RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 [ 77.228071][ T8837] Code: 1d 30 da 7d 06 31 ff 89 de e8 3c 9b 2e fe 84 db 75 94 e8 f3 99 2e fe 48 c7 c7 40 b9 e6 87 c6 05 10 da 7d 06 01 e8 08 cd ff fd <0f> 0b e9 75 ff ff ff e8 d4 99 2e fe e9 6e ff ff ff 48 89 df e8 17 [ 77.247828][ T8837] RSP: 0018:ffff8880990ff540 EFLAGS: 00010282 [ 77.253883][ T8837] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 77.261967][ T8837] RDX: 0000000000000000 RSI: ffffffff815cf766 RDI: ffffed101321fe9a [ 77.269929][ T8837] RBP: ffff8880990ff5d8 R08: ffff88809799a400 R09: ffffed1015d24101 [ 77.277898][ T8837] R10: ffffed1015d24100 R11: ffff8880ae920807 R12: 00000000ffffff01 [ 77.285860][ T8837] R13: 0000000000000001 R14: ffff8880990ff5b0 R15: 0000000000008001 [ 77.293848][ T8837] ? vprintk_func+0x86/0x189 [ 77.298433][ T8837] ? refcount_dec_not_one+0x1f0/0x1f0 [ 77.303796][ T8837] ? refcount_sub_and_test_checked+0x154/0x200 [ 77.309944][ T8837] ? refcount_dec_not_one+0x1f0/0x1f0 [ 77.315341][ T8837] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 77.321576][ T8837] sock_wfree+0xc3/0x190 [ 77.326039][ T8837] sctp_wfree+0x336/0x920 [ 77.330372][ T8837] ? __sctp_write_space+0x5e0/0x5e0 [ 77.335584][ T8837] skb_release_head_state+0xeb/0x260 [ 77.340871][ T8837] skb_release_all+0x16/0x60 [ 77.345467][ T8837] consume_skb+0xfb/0x3b0 [ 77.349784][ T8837] sctp_chunk_put+0x192/0x280 [ 77.354449][ T8837] sctp_chunk_free+0x56/0x70 [ 77.359024][ T8837] __sctp_outq_teardown+0x1d0/0xc60 [ 77.364212][ T8837] sctp_outq_free+0x16/0x20 [ 77.368699][ T8837] sctp_association_free+0x208/0x79a [ 77.373968][ T8837] sctp_do_sm+0x3a75/0x5170 [ 77.378452][ T8837] ? __kmalloc_node_track_caller+0x3d/0x70 [ 77.384681][ T8837] ? sctp_do_8_2_transport_strike.isra.0+0x940/0x940 [ 77.391353][ T8837] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 77.397782][ T8837] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 77.404076][ T8837] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 77.409825][ T8837] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 77.415802][ T8837] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 77.421625][ T8837] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 77.427348][ T8837] ? sctp_init_cause+0x1ae/0x230 [ 77.432273][ T8837] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 77.437986][ T8837] ? skb_put+0x177/0x1d0 [ 77.442210][ T8837] ? memcpy+0x46/0x50 [ 77.446190][ T8837] sctp_primitive_ABORT+0xa0/0xd0 [ 77.451209][ T8837] sctp_close+0x259/0x880 [ 77.455534][ T8837] ? sctp_accept+0x710/0x710 [ 77.460113][ T8837] ? __kasan_check_write+0x14/0x20 [ 77.465224][ T8837] ? down_write+0xdf/0x150 [ 77.469625][ T8837] ? ip_mc_drop_socket+0x211/0x270 [ 77.474728][ T8837] inet_release+0xed/0x200 [ 77.479144][ T8837] __sock_release+0xce/0x280 [ 77.483731][ T8837] sock_close+0x1e/0x30 [ 77.487883][ T8837] __fput+0x2ff/0x890 [ 77.491850][ T8837] ? __sock_release+0x280/0x280 [ 77.496688][ T8837] ____fput+0x16/0x20 [ 77.500652][ T8837] task_work_run+0x145/0x1c0 [ 77.505246][ T8837] do_exit+0x904/0x2e60 [ 77.509387][ T8837] ? mm_update_next_owner+0x640/0x640 [ 77.514764][ T8837] ? __sys_getsockopt+0x1b2/0x310 [ 77.519874][ T8837] ? kernel_accept+0x310/0x310 [ 77.524623][ T8837] ? handle_mm_fault+0x4b0/0xaa0 [ 77.529593][ T8837] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 77.535048][ T8837] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 77.540503][ T8837] do_group_exit+0x135/0x360 [ 77.545086][ T8837] __x64_sys_exit_group+0x44/0x50 [ 77.550090][ T8837] do_syscall_64+0xfa/0x760 [ 77.554594][ T8837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.560465][ T8837] RIP: 0033:0x43f268 [ 77.564370][ T8837] Code: Bad RIP value. [ 77.568438][ T8837] RSP: 002b:00007ffd1a5727f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 77.576995][ T8837] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f268 [ 77.584981][ T8837] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 77.593010][ T8837] RBP: 00000000004bea68 R08: 00000000000000e7 R09: ffffffffffffffd0 [ 77.602212][ T8837] R10: 000000002059aff8 R11: 0000000000000246 R12: 0000000000000001 [ 77.610169][ T8837] R13: 00000000006d01a0 R14: 0000000000000000 R15: 0000000000000000 [ 77.619799][ T8837] Kernel Offset: disabled [ 77.624211][ T8837] Rebooting in 86400 seconds..