------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 8222 at lib/refcount.c:28 refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 Modules linked in: CPU: 0 UID: 0 PID: 8222 Comm: rm Not tainted 6.12.0-syzkaller-g7b1d1d4cfac0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 lr : refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 sp : ffff800080007660 x29: ffff800080007660 x28: 0000000000000001 x27: 00000000ffffffff x26: 1fffe0001b011498 x25: dfff800000000000 x24: 0000000000000000 x23: ffff0000d0fee9a4 x22: ffff80008a63b670 x21: 0000000000000003 x20: ffff0000d0fee9a4 x19: ffff800092b74000 x18: 0000000000000008 x17: 0000000000000000 x16: ffff80008b47f65c x15: ffff700011f29534 x14: 1ffff00011f29534 x13: 0000000000000004 x12: ffffffffffffffff x11: 0000000000000102 x10: 0000000000ff0100 x9 : 5d2bb75011f22700 x8 : 5d2bb75011f22700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800080006d98 x4 : ffff80008f9bd220 x3 : ffff8000803921b4 x2 : 0000000000000000 x1 : 0000000000000100 x0 : 0000000000000000 Call trace: refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 (P) refcount_warn_saturate+0x1c8/0x20c lib/refcount.c:28 (L) __refcount_sub_and_test include/linux/refcount.h:275 [inline] __refcount_dec_and_test include/linux/refcount.h:307 [inline] refcount_dec_and_test include/linux/refcount.h:325 [inline] skb_unref include/linux/skbuff.h:1232 [inline] __sk_skb_reason_drop net/core/skbuff.c:1213 [inline] sk_skb_reason_drop+0x210/0x43c net/core/skbuff.c:1241 kfree_skb_reason include/linux/skbuff.h:1262 [inline] kfree_skb include/linux/skbuff.h:1271 [inline] j1939_session_destroy net/can/j1939/transport.c:282 [inline] __j1939_session_release net/can/j1939/transport.c:294 [inline] kref_put include/linux/kref.h:65 [inline] j1939_session_put+0x1c8/0x460 net/can/j1939/transport.c:299 j1939_xtp_rx_dat_one+0x680/0xdb4 j1939_xtp_rx_dat net/can/j1939/transport.c:1957 [inline] j1939_tp_recv+0x2c8/0xe14 net/can/j1939/transport.c:2151 j1939_can_recv+0x5bc/0x934 net/can/j1939/main.c:108 deliver net/can/af_can.c:572 [inline] can_rcv_filter+0x308/0x714 net/can/af_can.c:606 can_receive+0x328/0x488 net/can/af_can.c:663 can_rcv+0x128/0x240 net/can/af_can.c:687 __netif_receive_skb_one_core net/core/dev.c:5670 [inline] __netif_receive_skb+0x18c/0x3c8 net/core/dev.c:5783 process_backlog+0x640/0x123c net/core/dev.c:6115 __napi_poll+0xb4/0x3fc net/core/dev.c:6779 napi_poll net/core/dev.c:6848 [inline] net_rx_action+0x6a8/0xf4c net/core/dev.c:6970 handle_softirqs+0x2e0/0xbf8 kernel/softirq.c:554 __do_softirq+0x14/0x20 kernel/softirq.c:588 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86 invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x1d8/0x544 kernel/softirq.c:655 irq_exit_rcu+0x14/0x84 kernel/softirq.c:671 __el1_irq arch/arm64/kernel/entry-common.c:561 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:575 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:580 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:596 __pi_memset_generic+0xcc/0x188 arch/arm64/lib/memset.S:123 (P) kasan_poison+0x44/0x60 mm/kasan/shadow.c:146 (L) __kasan_poison_pages+0x4c/0x5c mm/kasan/common.c:141 kasan_poison_pages include/linux/kasan.h:114 [inline] free_pages_prepare mm/page_alloc.c:1149 [inline] free_unref_page+0x540/0xf3c mm/page_alloc.c:2657 __free_pages+0x18c/0x1a4 mm/page_alloc.c:4838 __free_slab+0x124/0x1fc mm/slub.c:2648 free_slab+0x28/0x130 mm/slub.c:2671 discard_slab mm/slub.c:2677 [inline] __put_partials+0x1a8/0x250 mm/slub.c:3145 put_cpu_partial+0x164/0x1c0 mm/slub.c:3220 __slab_free+0x1a8/0x278 mm/slub.c:4449 do_slab_free mm/slub.c:4531 [inline] ___cache_free+0x144/0x16c mm/slub.c:4637 qlink_free+0x48/0x94 mm/kasan/quarantine.c:163 qlist_free_all+0x44/0xb8 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x118/0x124 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x2c/0x8c mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x1c0/0x354 mm/slub.c:4141 anon_vma_chain_alloc mm/rmap.c:143 [inline] __anon_vma_prepare+0xc4/0x400 mm/rmap.c:196 __vmf_anon_prepare mm/memory.c:3307 [inline] vmf_anon_prepare mm/internal.h:371 [inline] do_anonymous_page mm/memory.c:4780 [inline] do_pte_missing mm/memory.c:3963 [inline] handle_pte_fault mm/memory.c:5766 [inline] __handle_mm_fault+0x58ac/0x66e8 mm/memory.c:5909 handle_mm_fault+0x29c/0x8b4 mm/memory.c:6077 do_page_fault+0x404/0x10a8 arch/arm64/mm/fault.c:647 do_translation_fault+0xc4/0x114 arch/arm64/mm/fault.c:783 do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:919 el0_da+0x60/0x178 arch/arm64/kernel/entry-common.c:604 el0t_64_sync_handler+0xcc/0x108 arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 irq event stamp: 4179 hardirqs last enabled at (4178): [<ffff80008039a9c4>] __up_console_sem kernel/printk/printk.c:344 [inline] hardirqs last enabled at (4178): [<ffff80008039a9c4>] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2844 hardirqs last disabled at (4179): [<ffff80008b54386c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (3974): [<ffff80008002f3d8>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (4103): [<ffff800080020db4>] __do_softirq+0x14/0x20 kernel/softirq.c:588 ---[ end trace 0000000000000000 ]---