------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 13908 at lib/refcount.c:190 refcount_sub_and_test_checked lib/refcount.c:190 [inline] WARNING: CPU: 0 PID: 13908 at lib/refcount.c:190 refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 13908 Comm: syz-executor.1 Not tainted 5.4.0-rc2-next-20191008 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x35 kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline] RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180 Code: 1d b0 f0 7f 06 31 ff 89 de e8 6c d7 30 fe 84 db 75 94 e8 23 d6 30 fe 48 c7 c7 20 81 e6 87 c6 05 90 f0 7f 06 01 e8 e8 15 02 fe <0f> 0b e9 75 ff ff ff e8 04 d6 30 fe e9 6e ff ff ff 48 89 df e8 e7 RSP: 0018:ffff888060947a28 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 000000000001a736 RSI: ffffffff815cb676 RDI: ffffed100c128f37 RBP: ffff888060947ac0 R08: ffff888062a58400 R09: ffffed1015d06161 R10: ffffed1015d06160 R11: ffff8880ae830b07 R12: 00000000fffffd02 R13: 0000000000000001 R14: ffff888060947a98 R15: 0000000000000001 sock_wfree+0x10c/0x190 net/core/sock.c:1958 unix_destruct_scm+0x115/0x170 net/unix/scm.c:149 io_destruct_skb+0x62/0x80 fs/io_uring.c:2995 skb_release_head_state+0xeb/0x260 net/core/skbuff.c:652 skb_release_all+0x16/0x60 net/core/skbuff.c:663 __kfree_skb net/core/skbuff.c:679 [inline] kfree_skb net/core/skbuff.c:697 [inline] kfree_skb+0x101/0x3c0 net/core/skbuff.c:691 __io_sqe_files_scm+0x429/0x640 fs/io_uring.c:3049 io_sqe_files_scm fs/io_uring.c:3071 [inline] io_sqe_files_register fs/io_uring.c:3154 [inline] __io_uring_register+0x1f69/0x2d70 fs/io_uring.c:4152 __do_sys_io_uring_register fs/io_uring.c:4204 [inline] __se_sys_io_uring_register fs/io_uring.c:4186 [inline] __x64_sys_io_uring_register+0x193/0x1f0 fs/io_uring.c:4186 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a59 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2af41adc78 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a59 RDX: 0000000020000280 RSI: 0000000000000002 RDI: 0000000000000004 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007f2af41ae6d4 R13: 00000000004cd4f0 R14: 00000000004d43b0 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds..