------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-syzkaller-09567-g7eef7e306d3c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Code: e0 05 61 8c e8 b7 17 96 fc 90 0f 0b 90 90 eb 99 e8 ab 6e d5 fc c6 05 e9 08 48 0b 01 90 48 c7 c7 40 06 61 8c e8 97 17 96 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 88 6e d5 fc c6 05 c3 08 48 0b 01 90
RSP: 0018:ffffc90000a18640 EFLAGS: 00010246
RAX: 30c8a5bc61ed8500 RBX: ffff88807db81724 RCX: ffff88801d2d0000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: ffffffff815688b2 R09: fffffbfff1cfa8a0
R10: dffffc0000000000 R11: fffffbfff1cfa8a0 R12: ffff88807bbef000
R13: ffff88807db81724 R14: ffff88807bbef000 R15: ffff888021f1d218
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2ade2b CR3: 0000000025546000 CR4: 0000000000350ef0
Call Trace:
kfree_skb_reason include/linux/skbuff.h:1263 [inline]
kfree_skb include/linux/skbuff.h:1272 [inline]
j1939_session_skb_drop_old net/can/j1939/transport.c:347 [inline]
j1939_xtp_rx_cts_one net/can/j1939/transport.c:1445 [inline]
j1939_xtp_rx_cts+0x552/0xc70 net/can/j1939/transport.c:1484
j1939_tp_cmd_recv net/can/j1939/transport.c:2089 [inline]
j1939_tp_recv+0x8ae/0x1050 net/can/j1939/transport.c:2161
j1939_can_recv+0x732/0xb20 net/can/j1939/main.c:108
deliver net/can/af_can.c:573 [inline]
can_rcv_filter+0x35b/0x7f0 net/can/af_can.c:607
can_receive+0x327/0x480 net/can/af_can.c:664
can_rcv+0x144/0x260 net/can/af_can.c:688
__netif_receive_skb_one_core net/core/dev.c:5672 [inline]
__netif_receive_skb+0x2e2/0x650 net/core/dev.c:5785
process_backlog+0x662/0x15b0 net/core/dev.c:6117
__napi_poll+0xcd/0x490 net/core/dev.c:6877
napi_poll net/core/dev.c:6946 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:7068
handle_softirqs+0x2c7/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:655
irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:tick_nohz_idle_exit+0x378/0x480 kernel/time/tick-sched.c:1473
Code: 74 14 4d 39 f7 73 0f e8 56 98 0e 00 4c 89 ff e8 8e 43 e4 ff eb 05 e8 47 98 0e 00 e8 92 60 16 00 fb 48 c7 44 24 20 0e 36 e0 45 <48> 8b 44 24 18 49 c7 44 05 00 00 00 00 00 65 48 8b 04 25 28 00 00
RSP: 0018:ffffc900001a7d20 EFLAGS: 00000282
RAX: 30c8a5bc61ed8500 RBX: 0000000000000004 RCX: ffffffff9a426903
RDX: dffffc0000000000 RSI: ffffffff8c0ad8a0 RDI: ffffffff8c614ae0
RBP: ffffc900001a7dd0 R08: ffffffff901e39b7 R09: 1ffffffff203c736
R10: dffffc0000000000 R11: fffffbfff203c737 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880b872d180 R15: 00000017800341e5
do_idle+0x558/0x5c0 kernel/sched/idle.c:338
cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:423
start_secondary+0x102/0x110 arch/x86/kernel/smpboot.c:314
common_startup_64+0x13e/0x147
----------------
Code disassembly (best guess):
0: 74 14 je 0x16
2: 4d 39 f7 cmp %r14,%r15
5: 73 0f jae 0x16
7: e8 56 98 0e 00 call 0xe9862
c: 4c 89 ff mov %r15,%rdi
f: e8 8e 43 e4 ff call 0xffe443a2
14: eb 05 jmp 0x1b
16: e8 47 98 0e 00 call 0xe9862
1b: e8 92 60 16 00 call 0x1660b2
20: fb sti
21: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
28: e0 45
* 2a: 48 8b 44 24 18 mov 0x18(%rsp),%rax <-- trapping instruction
2f: 49 c7 44 05 00 00 00 movq $0x0,0x0(%r13,%rax,1)
36: 00 00
38: 65 gs
39: 48 rex.W
3a: 8b .byte 0x8b
3b: 04 25 add $0x25,%al
3d: 28 00 sub %al,(%rax)