Warning: Permanently added '10.128.0.190' (ECDSA) to the list of known hosts. [ 29.493209][ T3078] cgroup: Unknown subsys name 'net' [ 29.776037][ T3078] cgroup: Unknown subsys name 'rlimit' executing program [ 32.210381][ T3081] ------------[ cut here ]------------ [ 32.211866][ T3081] refcount_t: underflow; use-after-free. [ 32.213561][ T3081] WARNING: CPU: 0 PID: 3081 at lib/refcount.c:28 refcount_warn_saturate+0x1a0/0x1c8 [ 32.216069][ T3081] Modules linked in: [ 32.217096][ T3081] CPU: 0 PID: 3081 Comm: syz-executor209 Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 [ 32.219833][ T3081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 32.222586][ T3081] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 32.224678][ T3081] pc : refcount_warn_saturate+0x1a0/0x1c8 [ 32.226206][ T3081] lr : refcount_warn_saturate+0x1a0/0x1c8 [ 32.227711][ T3081] sp : ffff80000fba3b90 [ 32.228838][ T3081] x29: ffff80000fba3b90 x28: 00000000000a201d x27: 0000000000002000 [ 32.230942][ T3081] x26: dead000000000100 x25: 0000000000000000 x24: 0000000000000001 [ 32.233080][ T3081] x23: 0000000000000001 x22: 0000000000000000 x21: 0000000000000000 [ 32.235245][ T3081] x20: 0000000000000003 x19: ffff80000d95e000 x18: 00000000000000c0 [ 32.237394][ T3081] x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff0000c97b1a40 [ 32.239497][ T3081] x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c97b1a40 [ 32.241624][ T3081] x11: ff808000081c4d64 x10: 0000000000000000 x9 : fbf8080e62680f00 [ 32.243678][ T3081] x8 : fbf8080e62680f00 x7 : ffff80000c091ebc x6 : 0000000000000000 [ 32.245791][ T3081] x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 [ 32.247892][ T3081] x2 : 0000000000000000 x1 : 0000000100000000 x0 : 0000000000000026 [ 32.250019][ T3081] Call trace: [ 32.250859][ T3081] refcount_warn_saturate+0x1a0/0x1c8 [ 32.252303][ T3081] drm_gem_object_handle_put_unlocked+0x178/0x1a0 [ 32.254038][ T3081] drm_gem_object_release_handle+0x68/0x80 [ 32.255570][ T3081] idr_for_each+0xf0/0x174 [ 32.256762][ T3081] drm_gem_release+0x30/0x48 [ 32.258010][ T3081] drm_file_free+0x224/0x2d0 [ 32.259267][ T3081] drm_release+0x10c/0x24c [ 32.260471][ T3081] __fput+0x198/0x3e4 [ 32.261516][ T3081] ____fput+0x20/0x30 [ 32.262565][ T3081] task_work_run+0x100/0x148 [ 32.263787][ T3081] do_notify_resume+0x174/0x1f0 [ 32.265112][ T3081] el0_svc+0x9c/0x150 [ 32.266161][ T3081] el0t_64_sync_handler+0x84/0xf0 [ 32.267482][ T3081] el0t_64_sync+0x190/0x194 [ 32.268657][ T3081] irq event stamp: 1292988 [ 32.269848][ T3081] hardirqs last enabled at (1292987): [] __up_console_sem+0xb0/0xfc [ 32.272440][ T3081] hardirqs last disabled at (1292988): [] el1_dbg+0x24/0x80 [ 32.274902][ T3081] softirqs last enabled at (1289522): [] _stext+0x2e4/0x37c [ 32.277355][ T3081] softirqs last disabled at (1289513): [] ____do_softirq+0x14/0x20 [ 32.279880][ T3081] ---[ end trace 0000000000000000 ]--- executing program executing program executing program executing program executing program