------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 7870 at lib/refcount.c:28 refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 7870 Comm: syz.3.254 Not tainted 6.12.0-syzkaller-g7b1d1d4cfac0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28
lr : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28
sp : ffff8000a37576e0
x29: ffff8000a37576e0 x28: 0000000000000001 x27: 00000000ffffffff
x26: 1fffe000197ea698 x25: dfff800000000000 x24: 0000000000000000
x23: ffff0000d472fea4 x22: ffff80008a63b670 x21: 0000000000000003
x20: ffff0000d472fea4 x19: ffff800092b74000 x18: 1fffe000366c8076
x17: ffff80008f8cd000 x16: ffff800080355c58 x15: 0000000000000001
x14: 1fffe000366cab20 x13: ffff8000a3758000 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000003 x9 : 7b9c8b015ea52000
x8 : 7b9c8b015ea52000 x7 : ffff8000802c419c x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80008b6c4000 x0 : ffff800123e21000
Call trace:
 refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 (P)
 refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 (L)
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 skb_unref include/linux/skbuff.h:1232 [inline]
 __sk_skb_reason_drop net/core/skbuff.c:1213 [inline]
 sk_skb_reason_drop+0x210/0x43c net/core/skbuff.c:1241
 kfree_skb_reason include/linux/skbuff.h:1262 [inline]
 kfree_skb include/linux/skbuff.h:1271 [inline]
 j1939_session_destroy net/can/j1939/transport.c:282 [inline]
 __j1939_session_release net/can/j1939/transport.c:294 [inline]
 kref_put include/linux/kref.h:65 [inline]
 j1939_session_put+0x1c8/0x460 net/can/j1939/transport.c:299
 j1939_sk_send_loop net/can/j1939/socket.c:1202 [inline]
 j1939_sk_sendmsg+0xe88/0x10d0 net/can/j1939/socket.c:1277
 sock_sendmsg_nosec net/socket.c:729 [inline]
 __sock_sendmsg net/socket.c:744 [inline]
 ____sys_sendmsg+0x56c/0x840 net/socket.c:2607
 ___sys_sendmsg net/socket.c:2661 [inline]
 __sys_sendmsg+0x26c/0x33c net/socket.c:2690
 __do_sys_sendmsg net/socket.c:2699 [inline]
 __se_sys_sendmsg net/socket.c:2697 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2697
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
irq event stamp: 398
hardirqs last  enabled at (397): [<ffff8000802c423c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1518 [inline]
hardirqs last  enabled at (397): [<ffff8000802c423c>] finish_lock_switch+0xbc/0x1e4 kernel/sched/core.c:5082
hardirqs last disabled at (398): [<ffff80008b54386c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488
softirqs last  enabled at (378): [<ffff80008020396c>] softirq_handle_end kernel/softirq.c:400 [inline]
softirqs last  enabled at (378): [<ffff80008020396c>] handle_softirqs+0xa38/0xbf8 kernel/softirq.c:582
softirqs last disabled at (361): [<ffff800080020db4>] __do_softirq+0x14/0x20 kernel/softirq.c:588
---[ end trace 0000000000000000 ]---