------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 15181 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 15181 Comm: syz-executor.1 Not tainted 6.1.0-rc2-syzkaller-00078-g98555239e4c3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 4c c0 c4 fd e9 8a fe ff ff e8 82 6f 78 fd 48 c7 c7 c0 59 49 8a c6 05 8a 3b c8 09 01 e8 db 90 45 05 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0000:ffffc90006fe7cc0 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801bff9d40 RSI: ffffffff81621b98 RDI: fffff52000dfcf8a
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080010001 R11: 0000000063666572 R12: 0000000000000000
R13: ffff8880579b7308 R14: ffff88804371f800 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802c900000(0063) knlGS:0000000056860380
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033733000 CR3: 000000006e233000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 p9_req_put+0x1f2/0x250 net/9p/client.c:392
 req_done+0x1de/0x2e0 net/9p/trans_virtio.c:148
 vring_interrupt drivers/virtio/virtio_ring.c:2470 [inline]
 vring_interrupt+0x29d/0x3d0 drivers/virtio/virtio_ring.c:2445
 __handle_irq_event_percpu+0x260/0x970 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xa7/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x25f/0xd00 kernel/irq/chip.c:819
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq arch/x86/kernel/irq.c:231 [inline]
 __common_interrupt+0x9d/0x210 arch/x86/kernel/irq.c:250
 common_interrupt+0x4d/0xc0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0023:0xf721f7b1
Code: 00 00 8b 44 24 50 8b 5c 24 0c 89 7c 24 10 8b 7c 24 14 8b 40 18 99 03 04 df 13 54 df 04 80 be b4 e0 02 00 00 89 c7 89 d5 89 c3 <75> 43 05 00 00 00 80 b9 ff ff ff 7e 83 d2 00 39 c1 b9 00 00 00 00
RSP: 002b:00000000ffb4fb20 EFLAGS: 00000246
RAX: 0000000081be6b05 RBX: 0000000081be6b05 RCX: 0000000000000f8c
RDX: 00000000ffffffff RSI: 00000000f734a000 RDI: 0000000081be6b05
RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	8b 44 24 50          	mov    0x50(%rsp),%eax
   6:	8b 5c 24 0c          	mov    0xc(%rsp),%ebx
   a:	89 7c 24 10          	mov    %edi,0x10(%rsp)
   e:	8b 7c 24 14          	mov    0x14(%rsp),%edi
  12:	8b 40 18             	mov    0x18(%rax),%eax
  15:	99                   	cltd
  16:	03 04 df             	add    (%rdi,%rbx,8),%eax
  19:	13 54 df 04          	adc    0x4(%rdi,%rbx,8),%edx
  1d:	80 be b4 e0 02 00 00 	cmpb   $0x0,0x2e0b4(%rsi)
  24:	89 c7                	mov    %eax,%edi
  26:	89 d5                	mov    %edx,%ebp
  28:	89 c3                	mov    %eax,%ebx
* 2a:	75 43                	jne    0x6f <-- trapping instruction
  2c:	05 00 00 00 80       	add    $0x80000000,%eax
  31:	b9 ff ff ff 7e       	mov    $0x7effffff,%ecx
  36:	83 d2 00             	adc    $0x0,%edx
  39:	39 c1                	cmp    %eax,%ecx
  3b:	b9 00 00 00 00       	mov    $0x0,%ecx