[ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.136' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 46.963225][ T6832] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 47.388112][ T4133] ------------[ cut here ]------------ [ 47.393803][ T4133] refcount_t: addition on 0; use-after-free. [ 47.400004][ T4133] WARNING: CPU: 1 PID: 4133 at lib/refcount.c:25 refcount_warn_saturate+0x13d/0x1a0 [ 47.409353][ T4133] Kernel panic - not syncing: panic_on_warn set ... [ 47.415926][ T4133] CPU: 1 PID: 4133 Comm: kworker/u4:8 Not tainted 5.9.0-rc6-syzkaller #0 [ 47.424705][ T4133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.434938][ T4133] Workqueue: qrtr_ns_handler qrtr_ns_worker [ 47.440814][ T4133] Call Trace: [ 47.444171][ T4133] dump_stack+0x1d6/0x29e [ 47.448482][ T4133] panic+0x2c0/0x800 [ 47.452367][ T4133] ? __warn+0x102/0x250 [ 47.456679][ T4133] ? refcount_warn_saturate+0x13d/0x1a0 [ 47.462216][ T4133] ? refcount_warn_saturate+0x13d/0x1a0 [ 47.467930][ T4133] __warn+0x227/0x250 [ 47.471893][ T4133] ? refcount_warn_saturate+0x13d/0x1a0 [ 47.477423][ T4133] report_bug+0x1b1/0x2e0 [ 47.481748][ T4133] handle_bug+0x42/0x80 [ 47.485891][ T4133] exc_invalid_op+0x16/0x40 [ 47.490472][ T4133] asm_exc_invalid_op+0x12/0x20 [ 47.495310][ T4133] RIP: 0010:refcount_warn_saturate+0x13d/0x1a0 [ 47.501435][ T4133] Code: c7 03 f4 37 89 31 c0 e8 01 5f 88 fd 0f 0b eb a3 e8 c8 bf b6 fd c6 05 1a 33 ed 05 01 48 c7 c7 3a f4 37 89 31 c0 e8 e3 5e 88 fd <0f> 0b eb 85 e8 aa bf b6 fd c6 05 fd 32 ed 05 01 48 c7 c7 66 f4 37 [ 47.521318][ T4133] RSP: 0018:ffffc900072f79c0 EFLAGS: 00010046 [ 47.527364][ T4133] RAX: 1ceabb8756dc6c00 RBX: 0000000000000002 RCX: ffff8880a3208300 [ 47.535360][ T4133] RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 [ 47.543308][ T4133] RBP: 0000000000000002 R08: ffffffff815e37c0 R09: ffffed1015d241c3 [ 47.551352][ T4133] R10: ffffed1015d241c3 R11: 0000000000000000 R12: ffff888096c23098 [ 47.559300][ T4133] R13: 1ffff1101454b39e R14: 0000000000000282 R15: ffff888096c23000 [ 47.567258][ T4133] ? vprintk_emit+0x2f0/0x370 [ 47.571915][ T4133] qrtr_node_lookup+0xc0/0xd0 [ 47.576571][ T4133] qrtr_recvmsg+0x429/0xa80 [ 47.581935][ T4133] qrtr_ns_worker+0x176/0x45f0 [ 47.586697][ T4133] ? __lock_acquire+0x110b/0x2ae0 [ 47.591728][ T4133] ? lock_acquire+0x148/0x720 [ 47.596392][ T4133] ? process_one_work+0x733/0xfc0 [ 47.601405][ T4133] ? lock_is_held_type+0xb3/0xe0 [ 47.606340][ T4133] process_one_work+0x789/0xfc0 [ 47.611177][ T4133] worker_thread+0xaa4/0x1460 [ 47.615869][ T4133] kthread+0x37e/0x3a0 [ 47.619925][ T4133] ? rcu_lock_release+0x20/0x20 [ 47.624799][ T4133] ? kthread_blkcg+0xd0/0xd0 [ 47.629396][ T4133] ret_from_fork+0x1f/0x30 [ 48.734102][ T4133] Shutting down cpus with NMI [ 48.740397][ T4133] Kernel Offset: disabled [ 48.744768][ T4133] Rebooting in 86400 seconds..