[ 9.185423][ T2616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 9.187981][ T2616] eql: remember to turn off Van-Jacobson compression on your slave devices [ 9.216243][ T1212] gvnic 0000:00:00.0 enp0s0: Device link is up. [ 9.219136][ T21] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s0: link becomes ready Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.27' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 27.944312][ T3038] loop0: detected capacity change from 0 to 2048 [ 27.950044][ T3039] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 27.959278][ T3038] ------------[ cut here ]------------ [ 27.960549][ T3038] refcount_t: underflow; use-after-free. [ 27.961964][ T3038] WARNING: CPU: 1 PID: 3038 at lib/refcount.c:87 refcount_dec_and_lock+0x180/0x1ec [ 27.964103][ T3038] Modules linked in: [ 27.964997][ T3038] CPU: 1 PID: 3038 Comm: syz-executor274 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 [ 27.967422][ T3038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 27.969819][ T3038] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 27.971658][ T3038] pc : refcount_dec_and_lock+0x180/0x1ec [ 27.973018][ T3038] lr : refcount_dec_and_lock+0x17c/0x1ec [ 27.974350][ T3038] sp : ffff800012893a30 [ 27.975314][ T3038] x29: ffff800012893a30 x28: ffff80000cc15042 x27: ffff0000cc376640 [ 27.977185][ T3038] x26: 0000000000000002 x25: 00000000ffffffff x24: 0000000000000000 [ 27.979052][ T3038] x23: 00000000c0000000 x22: 0000000000000000 x21: ffff80000d5eb4a0 [ 27.980947][ T3038] x20: ffff0000cc2b5520 x19: ffff80000d8c8000 x18: 00000000000000c0 [ 27.982825][ T3038] x17: ffff80000dd0b198 x16: ffff80000db49158 x15: ffff0000c7128000 [ 27.984687][ T3038] x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c7128000 [ 27.986599][ T3038] x11: ff808000081c0d5c x10: 0000000000000000 x9 : 7c5041a976250900 [ 27.988348][ T3038] x8 : 7c5041a976250900 x7 : ffff80000819545c x6 : 0000000000000000 [ 27.990261][ T3038] x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 [ 27.992284][ T3038] x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000000 [ 27.994133][ T3038] Call trace: [ 27.994884][ T3038] refcount_dec_and_lock+0x180/0x1ec [ 27.996114][ T3038] nilfs_put_root+0x30/0x80 [ 27.997175][ T3038] nilfs_detach_log_writer+0x3b8/0x4d0 [ 27.998543][ T3038] nilfs_put_super+0x28/0x9c [ 27.999613][ T3038] generic_shutdown_super+0x8c/0x190 [ 28.000880][ T3038] kill_block_super+0x30/0x78 [ 28.002042][ T3038] deactivate_locked_super+0x70/0xe8 [ 28.003463][ T3038] deactivate_super+0xd0/0xd4 [ 28.004573][ T3038] cleanup_mnt+0x1f8/0x234 [ 28.005661][ T3038] __cleanup_mnt+0x20/0x30 [ 28.006675][ T3038] task_work_run+0xc4/0x14c [ 28.007895][ T3038] do_exit+0x26c/0xbe0 [ 28.008922][ T3038] do_group_exit+0x60/0xe8 [ 28.010015][ T3038] __wake_up_parent+0x0/0x40 [ 28.011095][ T3038] el0_svc_common+0x138/0x220 [ 28.012197][ T3038] do_el0_svc+0x48/0x164 [ 28.013252][ T3038] el0_svc+0x58/0x150 [ 28.014238][ T3038] el0t_64_sync_handler+0x84/0xf0 [ 28.015391][ T3038] el0t_64_sync+0x18c/0x190 [ 28.016472][ T3038] irq event stamp: 9228 [ 28.017501][ T3038] hardirqs last enabled at (9227): [] __up_console_sem+0xb0/0xfc [ 28.019696][ T3038] hardirqs last disabled at (9228): [] el1_dbg+0x24/0x5c [ 28.021967][ T3038] softirqs last enabled at (7974): [] local_bh_enable+0x10/0x34 [ 28.024200][ T3038] softirqs last disabled at (7972): [] local_bh_disable+0x10/0x34 [ 28.026438][ T3038] ---[