------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 5761 at lib/refcount.c:25 refcount_warn_saturate+0xf3/0x1b0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 5761 Comm: syz-executor Not tainted 6.6.93-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:refcount_warn_saturate+0xf3/0x1b0 lib/refcount.c:25
Code: 15 0a 01 0f 85 98 00 00 00 e8 39 41 66 fd 5b 41 5e c3 e8 30 41 66 fd c6 05 e1 00 15 0a 01 48 c7 c7 40 0f fc 8a e8 0d a5 30 fd <0f> 0b eb e0 e8 14 41 66 fd c6 05 c6 00 15 0a 01 48 c7 c7 a0 0f fc
RSP: 0018:ffffc900000078e8 EFLAGS: 00010246
RAX: 41f6f696c5347f00 RBX: 0000000000000002 RCX: ffff888078108000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000007a70 R08: ffffc900000074e7 R09: 1ffff92000000e9c
R10: dffffc0000000000 R11: fffff52000000e9d R12: ffff88802f8e1d40
R13: dffffc0000000000 R14: ffff88802f8e1e94 R15: ffff888068285000
FS:  0000555568487500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ca1aff8 CR3: 0000000064321000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_add include/linux/refcount.h:-1 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_net include/net/net_namespace.h:261 [inline]
 tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
 tipc_crypto_xmit+0x17cf/0x2250 net/tipc/crypto.c:1761
 tipc_bearer_xmit_skb+0x246/0x3f0 net/tipc/bearer.c:572
 tipc_disc_timeout+0x581/0x6d0 net/tipc/discover.c:338
 call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x52d/0x7d0 kernel/time/timer.c:2022
 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 do_softirq+0xed/0x180 kernel/softirq.c:479
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x178/0x1c0 kernel/softirq.c:406
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 nf_conntrack_tcp_packet+0x2e7d/0x5940 net/netfilter/nf_conntrack_proto_tcp.c:1293
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1923 [inline]
 nf_conntrack_in+0x870/0x15c0 net/netfilter/nf_conntrack_core.c:2013
 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
 nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
 nf_hook+0x215/0x370 include/linux/netfilter.h:259
 __ip_local_out+0x4db/0x5f0 net/ipv4/ip_output.c:118
 ip_local_out net/ipv4/ip_output.c:127 [inline]
 __ip_queue_xmit+0xfca/0x1a00 net/ipv4/ip_output.c:535
 __tcp_transmit_skb+0x1cb1/0x32c0 net/ipv4/tcp_output.c:1422
 tcp_cleanup_rbuf net/ipv4/tcp.c:1505 [inline]
 tcp_recvmsg_locked+0x1af1/0x2300 net/ipv4/tcp.c:2571
 tcp_recvmsg+0x216/0x810 net/ipv4/tcp.c:2601
 inet_recvmsg+0x130/0x1e0 net/ipv4/af_inet.c:882
 sock_recvmsg_nosec net/socket.c:1046 [inline]
 sock_recvmsg net/socket.c:1068 [inline]
 sock_read_iter+0x2b7/0x3b0 net/socket.c:1138
 call_read_iter include/linux/fs.h:2012 [inline]
 new_sync_read fs/read_write.c:389 [inline]
 vfs_read+0x431/0x920 fs/read_write.c:470
 ksys_read+0x147/0x250 fs/read_write.c:613
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fbf1e78d2fd
Code: a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb b5 e8 a8 48 00 00 0f 1f 84 00 00 00 00 00 80 3d 41 82 1f 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec
RSP: 002b:00007ffdaf613468 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fbf1e78d2fd
RDX: 000000000000007c RSI: 00005555684a9460 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00000000000000c0 R09: 0000000000745a1d
R10: 000000649a2a6823 R11: 0000000000000246 R12: 00007ffdaf613890
R13: 000000000000007c R14: 00005555684a9460 R15: 00007ffdaf613510
 </TASK>