------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 26851 at lib/refcount.c:187 refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 26851 Comm: syz-executor0 Not tainted 4.18.0-rc3+ #57
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 panic+0x238/0x4e7 kernel/panic.c:184
 __warn.cold.8+0x163/0x1ba kernel/panic.c:536
 report_bug+0x252/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:refcount_sub_and_test+0x2e7/0x350 lib/refcount.c:187
Code: 89 de e8 ec c0 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 0c c0 1c fe 48 c7 c7 20 42 1a 88 c6 05 d9 8e 3a 06 01 e8 d9 e2 e7 fd <0f> 0b 31 db e9 25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff 
RSP: 0018:ffff8801cec0f798 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81631851 RDI: ffff8801cec0f470
RBP: ffff8801cec0f880 R08: ffff8801cace6140 R09: fffffbfff11f1220
R10: fffffbfff11f1220 R11: ffffffff88f89103 R12: 00000000ffffffff
R13: ffff8801cec0f858 R14: 0000000000000001 R15: ffff8801c13b0718
 refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
 smap_release_sock+0x76/0x320 kernel/bpf/sockmap.c:1453
 bpf_tcp_close+0x9ec/0x1050 kernel/bpf/sockmap.c:366
 inet_release+0x104/0x1f0 net/ipv4/af_inet.c:428
 inet6_release+0x50/0x70 net/ipv6/af_inet6.c:459
 __sock_release+0xd7/0x260 net/socket.c:599
 sock_close+0x19/0x20 net/socket.c:1150
 __fput+0x355/0x8b0 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:243
 task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:192 [inline]
 exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x40fb91
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 
RSP: 002b:00007ffc07263280 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000016 RCX: 000000000040fb91
RDX: 0000000000000000 RSI: 00000000007307a0 RDI: 0000000000000015
RBP: 0000000000000013 R08: 00007ffc07263200 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffc07263930 R15: 00000000007034c0
Dumping ftrace buffer:
---------------------------------
syz-exec-25352   0...3 213568258us : 0: }D
---------------------------------
Kernel Offset: disabled
Rebooting in 86400 seconds..