Warning: Permanently added '10.128.0.75' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 60.881608][ T6805] ------------[ cut here ]------------ [ 60.887421][ T6805] refcount_t: underflow; use-after-free. [ 60.918569][ T6805] WARNING: CPU: 1 PID: 6805 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 [ 60.927961][ T6805] Kernel panic - not syncing: panic_on_warn set ... [ 60.934552][ T6805] CPU: 1 PID: 6805 Comm: syz-executor768 Not tainted 5.9.0-rc2-syzkaller #0 [ 60.943214][ T6805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.953266][ T6805] Call Trace: [ 60.956557][ T6805] dump_stack+0x18f/0x20d [ 60.960896][ T6805] panic+0x2e3/0x75c [ 60.964792][ T6805] ? __warn_printk+0xf3/0xf3 [ 60.969394][ T6805] ? __warn.cold+0x5/0x4a [ 60.973725][ T6805] ? __warn+0xd6/0x1f2 [ 60.977796][ T6805] ? refcount_warn_saturate+0x1d1/0x1e0 [ 60.983341][ T6805] __warn.cold+0x20/0x4a [ 60.987607][ T6805] ? wake_up_klogd.part.0+0x8c/0xc0 [ 60.992803][ T6805] ? refcount_warn_saturate+0x1d1/0x1e0 [ 60.998349][ T6805] report_bug+0x1bd/0x210 [ 61.002704][ T6805] handle_bug+0x38/0x90 [ 61.006862][ T6805] exc_invalid_op+0x14/0x40 [ 61.011367][ T6805] asm_exc_invalid_op+0x12/0x20 [ 61.016219][ T6805] RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 [ 61.022369][ T6805] Code: e9 db fe ff ff 48 89 df e8 dc ee 18 fe e9 8a fe ff ff e8 e2 d5 d8 fd 48 c7 c7 00 db 93 88 c6 05 da e4 11 07 01 e8 d1 e6 a9 fd <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 [ 61.041969][ T6805] RSP: 0018:ffffc90000f77488 EFLAGS: 00010282 [ 61.048115][ T6805] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 61.056089][ T6805] RDX: ffff88809f6964c0 RSI: ffffffff815dafc7 RDI: fffff520001eee83 [ 61.064060][ T6805] RBP: 0000000000000003 R08: 0000000000000001 R09: ffff8880ae7318e7 [ 61.072032][ T6805] R10: 0000000000000000 R11: 0000000030383654 R12: ffff8880a2b6b864 [ 61.080002][ T6805] R13: 00000000ffffffea R14: ffff8880a679d000 R15: ffff8880a8057824 [ 61.087990][ T6805] ? vprintk_func+0x97/0x1a6 [ 61.092586][ T6805] ? refcount_warn_saturate+0x1d1/0x1e0 [ 61.098126][ T6805] qdisc_put+0xbe/0xe0 [ 61.102198][ T6805] ? red_offload.isra.0+0x480/0x480 [ 61.108002][ T6805] qdisc_create+0xcd9/0x12e0 [ 61.112601][ T6805] ? tc_get_qdisc+0xad0/0xad0 [ 61.117280][ T6805] ? lock_is_held_type+0xbb/0xf0 [ 61.122233][ T6805] tc_modify_qdisc+0x4c8/0x1990 [ 61.127093][ T6805] ? rtnetlink_rcv_msg+0x3f9/0xad0 [ 61.132234][ T6805] ? qdisc_create+0x12e0/0x12e0 [ 61.137124][ T6805] ? lock_is_held_type+0xbb/0xf0 [ 61.142068][ T6805] ? qdisc_create+0x12e0/0x12e0 [ 61.146919][ T6805] rtnetlink_rcv_msg+0x44e/0xad0 [ 61.151860][ T6805] ? rtnetlink_put_metrics+0x510/0x510 [ 61.157350][ T6805] ? lock_acquire+0x1f1/0xad0 [ 61.162051][ T6805] ? netlink_deliver_tap+0x146/0xb70 [ 61.167350][ T6805] netlink_rcv_skb+0x15a/0x430 [ 61.172119][ T6805] ? rtnetlink_put_metrics+0x510/0x510 [ 61.177578][ T6805] ? netlink_ack+0xa10/0xa10 [ 61.182180][ T6805] ? lock_is_held_type+0xbb/0xf0 [ 61.187124][ T6805] netlink_unicast+0x533/0x7d0 [ 61.191898][ T6805] ? netlink_attachskb+0x810/0x810 [ 61.197010][ T6805] ? _copy_from_iter_full+0x247/0x890 [ 61.202380][ T6805] ? __phys_addr+0x9a/0x110 [ 61.206880][ T6805] ? __phys_addr_symbol+0x2c/0x70 [ 61.211901][ T6805] ? __check_object_size+0x171/0x3e4 [ 61.217231][ T6805] netlink_sendmsg+0x856/0xd90 [ 61.221996][ T6805] ? netlink_unicast+0x7d0/0x7d0 [ 61.226933][ T6805] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 61.232215][ T6805] ? netlink_unicast+0x7d0/0x7d0 [ 61.237154][ T6805] sock_sendmsg+0xcf/0x120 [ 61.241562][ T6805] ____sys_sendmsg+0x6e8/0x810 [ 61.246305][ T6805] ? kernel_sendmsg+0x50/0x50 [ 61.250955][ T6805] ? do_recvmmsg+0x6d0/0x6d0 [ 61.255551][ T6805] ? mark_lock+0xbc/0x1710 [ 61.259948][ T6805] ? lock_is_held_type+0xbb/0xf0 [ 61.264870][ T6805] ? __lock_acquire+0xbb5/0x5640 [ 61.269793][ T6805] ___sys_sendmsg+0xf3/0x170 [ 61.274392][ T6805] ? sendmsg_copy_msghdr+0x160/0x160 [ 61.279659][ T6805] ? percpu_counter_add_batch+0x126/0x180 [ 61.285417][ T6805] ? lock_acquire+0x1f1/0xad0 [ 61.290087][ T6805] ? __get_unused_fd_flags+0x60/0x60 [ 61.295349][ T6805] ? find_held_lock+0x2d/0x110 [ 61.300123][ T6805] ? __fd_install+0x1b4/0x600 [ 61.304776][ T6805] ? lock_downgrade+0x830/0x830 [ 61.309607][ T6805] ? __fget_light+0x215/0x280 [ 61.314264][ T6805] __sys_sendmsg+0xe5/0x1b0 [ 61.318757][ T6805] ? __sys_sendmsg_sock+0xb0/0xb0 [ 61.323762][ T6805] ? trace_hardirqs_on+0x5f/0x220 [ 61.328773][ T6805] ? lockdep_hardirqs_on+0x76/0xf0 [ 61.333860][ T6805] __do_fast_syscall_32+0x57/0x80 [ 61.338860][ T6805] do_fast_syscall_32+0x2f/0x70 [ 61.343699][ T6805] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 61.350002][ T6805] RIP: 0023:0xf7f4a549 [ 61.354064][ T6805] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 61.373660][ T6805] RSP: 002b:00000000ffdb7e1c EFLAGS: 00000246 ORIG_RAX: 0000000000000172 [ 61.382054][ T6805] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000020000240 [ 61.390004][ T6805] RDX: 0000000000000000 RSI: 00000000080ea080 RDI: 00000000ffdb7e70 [ 61.397959][ T6805] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 61.405940][ T6805] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 61.413905][ T6805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.423120][ T6805] Kernel Offset: disabled [ 61.427516][ T6805] Rebooting in 86400 seconds..