Warning: Permanently added '10.128.1.56' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 59.169033][ T6863] IPVS: ftp: loaded support on port[0] = 21 executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 59.268866][ T7] ------------[ cut here ]------------ [ 59.274474][ T7] refcount_t: addition on 0; use-after-free. [ 59.280759][ T7] WARNING: CPU: 0 PID: 7 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 [ 59.289842][ T7] Modules linked in: [ 59.293724][ T7] CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.9.0-rc6-next-20200923-syzkaller #0 [ 59.303062][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.313103][ T7] Workqueue: qrtr_ns_handler qrtr_ns_worker [ 59.318996][ T7] RIP: 0010:refcount_warn_saturate+0x169/0x1e0 [ 59.325129][ T7] Code: 07 31 ff 89 de e8 07 5a b9 fd 84 db 0f 85 36 ff ff ff e8 da 5d b9 fd 48 c7 c7 a0 fb f8 88 c6 05 17 2d f2 07 01 e8 42 89 59 04 <0f> 0b e9 17 ff ff ff e8 bb 5d b9 fd 0f b6 1d fc 2c f2 07 31 ff 89 [ 59.344713][ T7] RSP: 0018:ffffc90000cdf9f8 EFLAGS: 00010086 [ 59.350777][ T7] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 59.358725][ T7] RDX: ffff8880a95c41c0 RSI: ffffffff815e0155 RDI: fffff5200019bf31 [ 59.366696][ T7] RBP: 0000000000000002 R08: 0000000000000001 R09: ffff8880ae420f8b [ 59.374652][ T7] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a91f5640 [ 59.382607][ T7] R13: ffff8880961b5000 R14: ffff8880a2ca55b0 R15: ffff8880a2ca55b4 [ 59.390564][ T7] FS: 0000000000000000(0000) GS:ffff8880ae400000(0000) knlGS:0000000000000000 [ 59.399647][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.406263][ T7] CR2: 00007ffdf7c52d10 CR3: 000000009f379000 CR4: 00000000001506f0 [ 59.414218][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.422185][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.430132][ T7] Call Trace: [ 59.433407][ T7] qrtr_recvmsg+0x845/0x970 [ 59.437893][ T7] ? qrtr_node_enqueue+0x1250/0x1250 [ 59.443161][ T7] ? mark_held_locks+0x9f/0xe0 [ 59.447910][ T7] ? lock_is_held_type+0xbb/0xf0 [ 59.452828][ T7] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 59.458089][ T7] ? security_socket_recvmsg+0x8f/0xc0 [ 59.463527][ T7] ? qrtr_node_enqueue+0x1250/0x1250 [ 59.468814][ T7] kernel_recvmsg+0x110/0x160 [ 59.473471][ T7] qrtr_ns_worker+0x15a/0x1430 [ 59.478216][ T7] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 59.484189][ T7] ? ctrl_cmd_del_client+0x730/0x730 [ 59.489469][ T7] ? lock_acquire+0x1f2/0xaa0 [ 59.494127][ T7] ? process_one_work+0x854/0x15a0 [ 59.499226][ T7] ? lock_is_held_type+0xbb/0xf0 [ 59.504161][ T7] process_one_work+0x933/0x15a0 [ 59.509083][ T7] ? pwq_dec_nr_in_flight+0x320/0x320 [ 59.514438][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 59.519360][ T7] worker_thread+0x64c/0x1120 [ 59.524043][ T7] ? process_one_work+0x15a0/0x15a0 [ 59.529238][ T7] kthread+0x3af/0x4a0 [ 59.533287][ T7] ? __kthread_bind_mask+0xc0/0xc0 [ 59.538456][ T7] ret_from_fork+0x1f/0x30 [ 59.542870][ T7] Kernel panic - not syncing: panic_on_warn set ... [ 59.549458][ T7] CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.9.0-rc6-next-20200923-syzkaller #0 [ 59.558827][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.568874][ T7] Workqueue: qrtr_ns_handler qrtr_ns_worker [ 59.574745][ T7] Call Trace: [ 59.578046][ T7] dump_stack+0x198/0x1fb [ 59.582533][ T7] panic+0x382/0x7fb [ 59.586423][ T7] ? __warn_printk+0xf3/0xf3 [ 59.590999][ T7] ? __warn.cold+0x1d/0xbb [ 59.595394][ T7] ? __warn.cold+0x14/0xbb [ 59.599966][ T7] ? refcount_warn_saturate+0x169/0x1e0 [ 59.605491][ T7] __warn.cold+0x38/0xbb [ 59.609713][ T7] ? wake_up_klogd.part.0+0x8e/0xd0 [ 59.614891][ T7] ? refcount_warn_saturate+0x169/0x1e0 [ 59.620414][ T7] report_bug+0x1bd/0x210 [ 59.624747][ T7] handle_bug+0x38/0x90 [ 59.628899][ T7] exc_invalid_op+0x14/0x40 [ 59.633438][ T7] asm_exc_invalid_op+0x12/0x20 [ 59.638336][ T7] RIP: 0010:refcount_warn_saturate+0x169/0x1e0 [ 59.644495][ T7] Code: 07 31 ff 89 de e8 07 5a b9 fd 84 db 0f 85 36 ff ff ff e8 da 5d b9 fd 48 c7 c7 a0 fb f8 88 c6 05 17 2d f2 07 01 e8 42 89 59 04 <0f> 0b e9 17 ff ff ff e8 bb 5d b9 fd 0f b6 1d fc 2c f2 07 31 ff 89 [ 59.664087][ T7] RSP: 0018:ffffc90000cdf9f8 EFLAGS: 00010086 [ 59.670133][ T7] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 59.678096][ T7] RDX: ffff8880a95c41c0 RSI: ffffffff815e0155 RDI: fffff5200019bf31 [ 59.686043][ T7] RBP: 0000000000000002 R08: 0000000000000001 R09: ffff8880ae420f8b [ 59.694009][ T7] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a91f5640 [ 59.701979][ T7] R13: ffff8880961b5000 R14: ffff8880a2ca55b0 R15: ffff8880a2ca55b4 [ 59.710552][ T7] ? vprintk_func+0x95/0x1e0 [ 59.715487][ T7] ? refcount_warn_saturate+0x169/0x1e0 [ 59.721014][ T7] qrtr_recvmsg+0x845/0x970 [ 59.725499][ T7] ? qrtr_node_enqueue+0x1250/0x1250 [ 59.730799][ T7] ? mark_held_locks+0x9f/0xe0 [ 59.735562][ T7] ? lock_is_held_type+0xbb/0xf0 [ 59.740699][ T7] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 59.745971][ T7] ? security_socket_recvmsg+0x8f/0xc0 [ 59.751419][ T7] ? qrtr_node_enqueue+0x1250/0x1250 [ 59.756696][ T7] kernel_recvmsg+0x110/0x160 [ 59.761356][ T7] qrtr_ns_worker+0x15a/0x1430 [ 59.766100][ T7] ? lockdep_hardirqs_on_prepare+0x530/0x530 [ 59.772058][ T7] ? ctrl_cmd_del_client+0x730/0x730 [ 59.777347][ T7] ? lock_acquire+0x1f2/0xaa0 [ 59.782004][ T7] ? process_one_work+0x854/0x15a0 [ 59.787113][ T7] ? lock_is_held_type+0xbb/0xf0 [ 59.792070][ T7] process_one_work+0x933/0x15a0 [ 59.797022][ T7] ? pwq_dec_nr_in_flight+0x320/0x320 [ 59.802396][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 59.807328][ T7] worker_thread+0x64c/0x1120 [ 59.812053][ T7] ? process_one_work+0x15a0/0x15a0 [ 59.817613][ T7] kthread+0x3af/0x4a0 [ 59.821663][ T7] ? __kthread_bind_mask+0xc0/0xc0 [ 59.826754][ T7] ret_from_fork+0x1f/0x30 [ 60.921824][ T7] Shutting down cpus with NMI [ 60.927929][ T7] Kernel Offset: disabled [ 60.932348][ T7] Rebooting in 86400 seconds..