[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.15.195' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 59.624291][ T6875] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 59.716338][ T274] ------------[ cut here ]------------ [ 59.721909][ T274] refcount_t: addition on 0; use-after-free. [ 59.728096][ T274] WARNING: CPU: 1 PID: 274 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 [ 59.737351][ T274] Kernel panic - not syncing: panic_on_warn set ... [ 59.744015][ T274] CPU: 1 PID: 274 Comm: kworker/u4:5 Not tainted 5.9.0-rc3-syzkaller #0 [ 59.752326][ T274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.762377][ T274] Workqueue: qrtr_ns_handler qrtr_ns_worker [ 59.768240][ T274] Call Trace: [ 59.771523][ T274] dump_stack+0x198/0x1fd [ 59.775855][ T274] panic+0x347/0x7c0 [ 59.779731][ T274] ? __warn_printk+0xf3/0xf3 [ 59.784386][ T274] ? _raw_spin_unlock+0x24/0x40 [ 59.789224][ T274] ? __printk_safe_exit+0x5/0x10 [ 59.794133][ T274] ? console_unlock+0x733/0xe60 [ 59.798972][ T274] ? __warn.cold+0x5/0x46 [ 59.803277][ T274] ? __warn+0xd6/0x1f2 [ 59.807336][ T274] ? refcount_warn_saturate+0x169/0x1e0 [ 59.812858][ T274] __warn.cold+0x20/0x46 [ 59.817232][ T274] ? wake_up_klogd.part.0+0x8c/0xc0 [ 59.822409][ T274] ? refcount_warn_saturate+0x169/0x1e0 [ 59.827933][ T274] report_bug+0x1bd/0x210 [ 59.832243][ T274] handle_bug+0x38/0x90 [ 59.836378][ T274] exc_invalid_op+0x14/0x40 [ 59.840858][ T274] asm_exc_invalid_op+0x12/0x20 [ 59.845696][ T274] RIP: 0010:refcount_warn_saturate+0x169/0x1e0 [ 59.851927][ T274] Code: 07 31 ff 89 de e8 17 d5 d8 fd 84 db 0f 85 36 ff ff ff e8 ca d8 d8 fd 48 c7 c7 c0 dc 93 88 c6 05 97 09 12 07 01 e8 39 dc a9 fd <0f> 0b e9 17 ff ff ff e8 ab d8 d8 fd 0f b6 1d 7c 09 12 07 31 ff 89 [ 59.871523][ T274] RSP: 0018:ffffc90001c879d8 EFLAGS: 00010086 [ 59.877565][ T274] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 59.885523][ T274] RDX: ffff8880a85143c0 RSI: ffffffff815db9a7 RDI: fffff52000390f2d [ 59.893571][ T274] RBP: 0000000000000002 R08: 0000000000000001 R09: ffff8880ae720f8b [ 59.901527][ T274] R10: 0000000000000000 R11: 0000000034373254 R12: ffff8880a9223640 [ 59.909473][ T274] R13: ffff8880a8e43c00 R14: ffff888094604070 R15: ffff888094604074 [ 59.917444][ T274] ? vprintk_func+0x97/0x1a6 [ 59.922025][ T274] ? refcount_warn_saturate+0x169/0x1e0 [ 59.927550][ T274] qrtr_recvmsg+0x845/0x970 [ 59.932037][ T274] ? qrtr_node_enqueue+0x1240/0x1240 [ 59.937301][ T274] ? lock_is_held_type+0xbb/0xf0 [ 59.942226][ T274] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 59.947488][ T274] ? security_socket_recvmsg+0x8f/0xc0 [ 59.952922][ T274] ? qrtr_node_enqueue+0x1240/0x1240 [ 59.958185][ T274] kernel_recvmsg+0x110/0x160 [ 59.962840][ T274] qrtr_ns_worker+0x15a/0x14fc [ 59.967587][ T274] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 59.973550][ T274] ? ctrl_cmd_del_client+0x730/0x730 [ 59.978817][ T274] ? lock_acquire+0x1f3/0xae0 [ 59.983471][ T274] ? process_one_work+0x85f/0x1670 [ 59.988577][ T274] ? _raw_spin_unlock_irq+0x1f/0x80 [ 59.993850][ T274] ? lock_is_held_type+0xbb/0xf0 [ 59.998867][ T274] process_one_work+0x94c/0x1670 [ 60.003802][ T274] ? lock_release+0x8f0/0x8f0 [ 60.008482][ T274] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 60.013831][ T274] ? rwlock_bug.part.0+0x90/0x90 [ 60.018751][ T274] ? lockdep_hardirqs_off+0x96/0xd0 [ 60.024031][ T274] worker_thread+0x64c/0x1120 [ 60.028697][ T274] ? process_one_work+0x1670/0x1670 [ 60.033891][ T274] kthread+0x3b5/0x4a0 [ 60.037948][ T274] ? __kthread_bind_mask+0xc0/0xc0 [ 60.043056][ T274] ret_from_fork+0x1f/0x30 [ 61.122180][ T274] Shutting down cpus with NMI [ 61.128085][ T274] Kernel Offset: disabled [ 61.132461][ T274] Rebooting in 86400 seconds..