------------[ cut here ]------------ refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 3 PID: 5452 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 3 PID: 5452 Comm: syz-executor387 Not tainted 6.9.0-rc2-syzkaller-00413-gf2f80ac80987 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Code: 8b e8 a7 e3 d0 fc 90 0f 0b 90 90 e9 c3 fe ff ff e8 18 76 0e fd c6 05 d8 de 4b 0b 01 90 48 c7 c7 80 0f 8f 8b e8 84 e3 d0 fc 90 <0f> 0b 90 90 e9 a0 fe ff ff 48 89 ef e8 72 a6 69 fd e9 44 fe ff ff RSP: 0018:ffffc90003f874a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814fe349 RDX: ffff88801b702440 RSI: ffffffff814fe356 RDI: 0000000000000001 RBP: ffff888025a45ecc R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888025a45ecc R13: 0000000000000000 R14: 0000000003d601ee R15: ffff8880181c05c8 FS: 0000555592003380(0000) GS:ffff88806b300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc4ae6c2723 CR3: 000000002ccea000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:336 [inline] refcount_dec include/linux/refcount.h:351 [inline] dec_stack_record_count mm/page_owner.c:228 [inline] __reset_page_owner+0x2ea/0x370 mm/page_owner.c:266 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1141 [inline] free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347 free_unref_folios+0x256/0xad0 mm/page_alloc.c:2536 folios_put_refs+0x49c/0x750 mm/swap.c:1034 free_pages_and_swap_cache+0x262/0x4b0 mm/swap_state.c:329 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu mm/mmu_gather.c:373 [inline] tlb_finish_mmu+0x168/0x7b0 mm/mmu_gather.c:465 unmap_region+0x342/0x420 mm/mmap.c:2315 do_vmi_align_munmap+0x11b3/0x1ad0 mm/mmap.c:2628 do_vmi_munmap+0x20b/0x450 mm/mmap.c:2696 __vm_munmap+0x145/0x3a0 mm/mmap.c:2972 __do_sys_munmap mm/mmap.c:2989 [inline] __se_sys_munmap mm/mmap.c:2986 [inline] __x64_sys_munmap+0x61/0x90 mm/mmap.c:2986 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7f7461cc0c57 Code: 00 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd7af209f8 EFLAGS: 00000246 ORIG_RAX: 000000000000000b RAX: ffffffffffffffda RBX: 00007ffd7af20a10 RCX: 00007f7461cc0c57 RDX: 0000000008000000 RSI: 0000000008400000 RDI: 00007f7459800000 RBP: 00007f7459800000 R08: 000000000002220f R09: 000000000002220b R10: 0000000020000002 R11: 0000000000000246 R12: 00007f7461d091d8 R13: 00007ffd7af20a50 R14: 0000000000000003 R15: 0000000008000000