[ 36.000442] default_idle+0xbf/0x460 [ 36.004117] ? __sched_text_end+0x4/0x4 [ 36.008055] ? tick_nohz_idle_enter+0xde/0x160 [ 36.012602] arch_cpu_idle+0xa/0x10 [ 36.016191] default_idle_call+0x36/0x90 [ 36.020224] do_idle+0x24e/0x3b0 [ 36.023553] ? complete+0x62/0x80 [ 36.026968] cpu_startup_entry+0x18/0x20 [ 36.030994] start_secondary+0x2ea/0x3f0 [ 36.035019] secondary_startup_64+0xa5/0xa5 Warning: Permanently added 'ci-upstream-net-kasan-gce-9,10.128.0.3' (ECDSA) to the list of known hosts. executing program [ 49.273237] refcount_t: underflow; use-after-free. [ 49.278264] ------------[ cut here ]------------ [ 49.283018] WARNING: CPU: 0 PID: 2992 at lib/refcount.c:186 refcount_sub_and_test+0x167/0x1b0 [ 49.291652] Kernel panic - not syncing: panic_on_warn set ... [ 49.291652] [ 49.298979] CPU: 0 PID: 2992 Comm: syzkaller637675 Not tainted 4.14.0-rc5+ #92 [ 49.306310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.315627] Call Trace: [ 49.318179] dump_stack+0x194/0x257 [ 49.321776] ? arch_local_irq_restore+0x53/0x53 [ 49.326416] panic+0x1e4/0x417 [ 49.329573] ? __warn+0x1d9/0x1d9 [ 49.332992] ? show_regs_print_info+0x65/0x65 [ 49.337458] ? refcount_sub_and_test+0x167/0x1b0 [ 49.342180] __warn+0x1c4/0x1d9 [ 49.345425] ? refcount_sub_and_test+0x167/0x1b0 [ 49.350144] report_bug+0x211/0x2d0 [ 49.353740] fixup_bug+0x40/0x90 [ 49.357075] do_trap+0x260/0x390 [ 49.360409] do_error_trap+0x120/0x390 [ 49.364260] ? vprintk_emit+0x49b/0x590 [ 49.368202] ? do_trap+0x390/0x390 [ 49.371706] ? refcount_sub_and_test+0x167/0x1b0 [ 49.376425] ? vprintk_emit+0x3ea/0x590 [ 49.380366] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 49.385175] do_invalid_op+0x1b/0x20 [ 49.388855] invalid_op+0x18/0x20 [ 49.392271] RIP: 0010:refcount_sub_and_test+0x167/0x1b0 [ 49.397595] RSP: 0018:ffff8801d1fa69c8 EFLAGS: 00010282 [ 49.402923] RAX: 0000000000000026 RBX: 0000000000000001 RCX: 0000000000000000 [ 49.410158] RDX: 0000000000000026 RSI: 1ffff1003a3f4cf9 RDI: ffffed003a3f4d2d [ 49.417391] RBP: ffff8801d1fa6a58 R08: 0000000000000000 R09: 1ffff1003a3f4ccb [ 49.424625] R10: ffff8801d1fa67f8 R11: ffffffff85b2cb78 R12: 1ffff1003a3f4d3a [ 49.431859] R13: 00000000ffffff01 R14: 0000000000000100 R15: ffff8801d2abda3c [ 49.439106] ? refcount_sub_and_test+0x167/0x1b0 [ 49.443826] ? refcount_inc+0x50/0x50 [ 49.447590] ? __sctp_outq_teardown+0xa5b/0x1230 [ 49.452311] ? sctp_association_free+0x2d0/0x930 [ 49.457028] ? sctp_do_sm+0x271b/0x6a30 [ 49.460968] ? sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 49.465686] ? sctp_close+0x3c6/0x980 [ 49.469452] ? inet_release+0xed/0x1c0 [ 49.473304] ? sock_release+0x8d/0x1e0 [ 49.477155] ? sock_close+0x16/0x20 [ 49.480749] sctp_wfree+0x183/0x620 [ 49.484339] ? entry_SYSCALL_64_fastpath+0xbc/0xbe [ 49.489233] ? __sctp_write_space+0x910/0x910 [ 49.493696] skb_release_head_state+0x124/0x200 [ 49.498329] skb_release_all+0x15/0x60 [ 49.502182] consume_skb+0x153/0x490 [ 49.505858] ? sctp_chunk_put+0x99/0x420 [ 49.509882] ? alloc_skb_with_frags+0x750/0x750 [ 49.514515] ? sctp_chunk_hold+0x20/0x20 [ 49.518540] ? sctp_sched_dequeue_common+0x2aa/0x5d0 [ 49.523605] ? refcount_sub_and_test+0x115/0x1b0 [ 49.528323] ? refcount_inc+0x50/0x50 [ 49.532087] ? trace_hardirqs_off+0xd/0x10 [ 49.536285] ? quarantine_put+0xeb/0x190 [ 49.540315] sctp_chunk_put+0x29c/0x420 [ 49.544255] ? sctp_chunk_hold+0x20/0x20 [ 49.548284] ? sctp_transport_dst_confirm+0x50/0x50 [ 49.553263] ? sctp_sched_fcfs_dequeue+0x198/0x290 [ 49.558157] ? sctp_sched_dequeue_common+0x5d0/0x5d0 [ 49.563228] sctp_chunk_free+0x53/0x60 [ 49.567078] __sctp_outq_teardown+0xa5b/0x1230 [ 49.571626] ? sctp_inq_set_th_handler+0x1b0/0x1b0 [ 49.576519] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.581674] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.586830] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.591986] ? default_wake_function+0x30/0x50 [ 49.596531] ? autoremove_wake_function+0x78/0x350 [ 49.601424] ? finish_wait+0x490/0x490 [ 49.605276] ? lock_acquire+0x1d5/0x580 [ 49.609215] ? lock_acquire+0x1d5/0x580 [ 49.613161] ? lock_acquire+0x1d5/0x580 [ 49.617098] ? __wake_up_common_lock+0x1c2/0x310 [ 49.621828] ? lock_acquire+0x1d5/0x580 [ 49.625775] ? sock_def_wakeup+0x1f9/0x350 [ 49.629978] ? lock_downgrade+0x990/0x990 [ 49.634096] ? lock_release+0xa40/0xa40 [ 49.638036] ? trace_raw_output_tick_stop+0x130/0x130 [ 49.643193] sctp_outq_free+0x15/0x20 [ 49.646957] sctp_association_free+0x2d0/0x930 [ 49.651508] ? sctp_asconf_queue_teardown+0x700/0x700 [ 49.656663] ? sock_def_wakeup+0x222/0x350 [ 49.660861] ? sk_dst_check+0x560/0x560 [ 49.664801] ? lock_release+0xa40/0xa40 [ 49.668744] ? bpf_prog_kallsyms_find+0xbd/0x440 [ 49.673464] sctp_do_sm+0x271b/0x6a30 [ 49.677227] ? lock_acquire+0x1d5/0x580 [ 49.681166] ? is_bpf_text_address+0x7b/0x120 [ 49.685628] ? sctp_do_8_2_transport_strike.isra.16+0x8a0/0x8a0 [ 49.691652] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.696810] ? do_raw_spin_trylock+0x190/0x190 [ 49.701361] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.706519] ? lock_acquire+0x1d5/0x580 [ 49.710457] ? lock_acquire+0x1d5/0x580 [ 49.714394] ? skb_dequeue+0x12a/0x180 [ 49.718244] ? lock_downgrade+0x990/0x990 [ 49.722358] ? do_raw_spin_trylock+0x190/0x190 [ 49.726905] ? lock_release+0xa40/0xa40 [ 49.730845] ? trace_hardirqs_on+0xd/0x10 [ 49.734960] sctp_primitive_SHUTDOWN+0xa0/0xd0 [ 49.739509] sctp_close+0x3c6/0x980 [ 49.743103] ? sctp_apply_peer_addr_params+0xf30/0xf30 [ 49.748349] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 49.753500] ? lock_downgrade+0x990/0x990 [ 49.757610] ? lock_downgrade+0x990/0x990 [ 49.761725] ? locks_remove_file+0x3fa/0x5a0 [ 49.766098] ? fcntl_setlk+0x10c0/0x10c0 [ 49.770126] ? bsearch+0x83/0xa0 [ 49.773456] ? __fsnotify_parent+0xb4/0x3a0 [ 49.777745] ? ip_mc_drop_socket+0x1ce/0x230 [ 49.782121] inet_release+0xed/0x1c0 [ 49.785800] sock_release+0x8d/0x1e0 [ 49.789478] ? sock_release+0x1e0/0x1e0 [ 49.793879] sock_close+0x16/0x20 [ 49.797297] __fput+0x327/0x7e0 [ 49.800543] ? fput+0x140/0x140 [ 49.803798] ____fput+0x15/0x20 [ 49.807043] task_work_run+0x199/0x270 [ 49.810897] ? task_work_cancel+0x210/0x210 [ 49.815183] ? __do_page_fault+0x3d6/0xd60 [ 49.819385] get_signal+0x1343/0x16d0 [ 49.823153] ? mm_fault_error+0x2c0/0x2c0 [ 49.827266] ? ptrace_notify+0x130/0x130 [ 49.831291] ? do_page_fault+0xee/0x720 [ 49.835229] ? __do_page_fault+0xd60/0xd60 [ 49.839426] ? do_page_fault+0xee/0x720 [ 49.843369] ? __do_page_fault+0xd60/0xd60 [ 49.847570] ? lock_acquire+0x1d5/0x580 [ 49.851506] ? lock_acquire+0x1d5/0x580 [ 49.855452] do_signal+0x94/0x1ee0 [ 49.858957] ? lock_acquire+0x1d5/0x580 [ 49.862896] ? lock_acquire+0x1d5/0x580 [ 49.866834] ? put_unused_fd+0x62/0x70 [ 49.870686] ? lock_downgrade+0x990/0x990 [ 49.874802] ? setup_sigcontext+0x7d0/0x7d0 [ 49.879088] ? do_raw_spin_trylock+0x190/0x190 [ 49.883633] ? task_work_add+0x10e/0x1b0 [ 49.887657] ? __put_unused_fd+0x183/0x250 [ 49.891856] ? alloc_fdtable+0x280/0x280 [ 49.895894] ? cpumask_weight.constprop.3+0x45/0x45 [ 49.900875] ? _copy_to_user+0xa2/0xc0 [ 49.904729] ? _raw_spin_unlock+0x22/0x30 [ 49.908840] ? fput+0xd2/0x140 [ 49.911996] ? SYSC_accept4+0x4ec/0x850 [ 49.915944] ? kernel_accept+0x2f0/0x2f0 [ 49.919971] exit_to_usermode_loop+0x214/0x310 [ 49.924519] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 49.930027] syscall_return_slowpath+0x42f/0x510 [ 49.934745] ? finish_task_switch+0x1aa/0x740 [ 49.939206] ? prepare_exit_to_usermode+0x2d0/0x2d0 [ 49.944185] ? prepare_exit_to_usermode+0x1a0/0x2d0 [ 49.949163] ? perf_trace_sys_enter+0xc20/0xc20 [ 49.953796] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 49.958520] entry_SYSCALL_64_fastpath+0xbc/0xbe [ 49.963239] RIP: 0033:0x446539 [ 49.966393] RSP: 002b:00007fd45d88fdc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000120 [ 49.974063] RAX: fffffffffffffff2 RBX: 0000000000000000 RCX: 0000000000446539 [ 49.981295] RDX: 0000000020137ffc RSI: 0000000020b53ff0 RDI: 0000000000000003 [ 49.988529] RBP: 0000000000000000 R08: 00007fd45d890700 R09: 00007fd45d890700 [ 49.995761] R10: 0000000000080000 R11: 0000000000000202 R12: 0000000000000000 [ 50.002993] R13: 00000000007efe7f R14: 00007fd45d8909c0 R15: 0000000000000000 [ 50.010268] Dumping ftrace buffer: [ 50.013773] (ftrace buffer empty) [ 50.017448] Kernel Offset: disabled [ 50.021041] Rebooting in 86400 seconds..