------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 32116 at lib/refcount.c:28 refcount_warn_saturate+0x1e4/0x1e8 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 32116 Comm: syz-executor.0 Not tainted 5.12.0-rc8-syzkaller-00194-g18a3c5f7abfd #0
Hardware name: riscv-virtio,qemu (DT)
epc : refcount_warn_saturate+0x1e4/0x1e8 lib/refcount.c:28
 ra : refcount_warn_saturate+0x1e4/0x1e8 lib/refcount.c:28
epc : ffffffe000977304 ra : ffffffe000977304 sp : ffffffe01fabb6c0
 gp : ffffffe004588c00 tp : ffffffe02107af80 t0 : ffffffe004ffdbb7
 t1 : ffffffc403f57674 t2 : 0000000000000000 s0 : ffffffe01fabb6e0
 s1 : 0000000000000000 a0 : 0000000000000026 a1 : 00000000000f0000
 a2 : 0000000000000002 a3 : ffffffe0000e1458 a4 : a96d8b6fe9786d00
 a5 : a96d8b6fe9786d00 a6 : 0000000000f00000 a7 : ffffffe01fabb3a7
 s2 : ffffffe0044c16ed s3 : ffffffe00d60d018 s4 : ffffffe00dc965b0
 s5 : ffffffe00dc965a8 s6 : 00000000000002ff s7 : ffffffe00dc954c0
 s8 : ffffffe0057a67a0 s9 : ffffffe018b1e5e0 s10: 0000000000000008
 s11: ffffffe00d60d000 t3 : a96d8b6fe9786d00 t4 : ffffffc403f57673
 t5 : ffffffc403f57675 t6 : ffffffe01fabb3a8
status: 0000000000000120 badaddr: 0000000000000000 cause: 0000000000000003
Call Trace:
[<ffffffe000977304>] refcount_warn_saturate+0x1e4/0x1e8 lib/refcount.c:28
[<ffffffe0029dac92>] __refcount_sub_and_test include/linux/refcount.h:283 [inline]
[<ffffffe0029dac92>] __refcount_dec_and_test include/linux/refcount.h:315 [inline]
[<ffffffe0029dac92>] refcount_dec_and_test include/linux/refcount.h:333 [inline]
[<ffffffe0029dac92>] kref_put include/linux/kref.h:64 [inline]
[<ffffffe0029dac92>] nfc_llcp_local_put net/nfc/llcp_core.c:183 [inline]
[<ffffffe0029dac92>] nfc_llcp_local_put+0x15c/0x15e net/nfc/llcp_core.c:178
[<ffffffe0029e4fd6>] nfc_llcp_sock_free+0xfa/0x10c net/nfc/llcp_sock.c:1005
[<ffffffe0029e5052>] llcp_sock_destruct+0x6a/0x112 net/nfc/llcp_sock.c:950
[<ffffffe0020f6adc>] __sk_destruct+0x42/0x546 net/core/sock.c:1795
[<ffffffe0020f7100>] sk_destruct net/core/sock.c:1839 [inline]
[<ffffffe0020f7100>] __sk_free+0x120/0x29a net/core/sock.c:1850
[<ffffffe0020f8370>] sock_wfree+0x18a/0x1c8 net/core/sock.c:2074
[<ffffffe0021098aa>] skb_release_head_state+0x96/0x1a6 net/core/skbuff.c:712
[<ffffffe002109ab6>] skb_release_all net/core/skbuff.c:723 [inline]
[<ffffffe002109ab6>] __kfree_skb net/core/skbuff.c:739 [inline]
[<ffffffe002109ab6>] kfree_skb net/core/skbuff.c:757 [inline]
[<ffffffe002109ab6>] kfree_skb+0xfc/0x3f8 net/core/skbuff.c:751
[<ffffffe002111dca>] skb_queue_purge+0x1e/0x44 net/core/skbuff.c:3133
[<ffffffe0029d9e9e>] nfc_llcp_socket_release+0x3a/0x51c net/nfc/llcp_core.c:73
[<ffffffe0029da39e>] local_cleanup+0x1e/0x9c net/nfc/llcp_core.c:155
[<ffffffe0029dac6c>] local_release net/nfc/llcp_core.c:174 [inline]
[<ffffffe0029dac6c>] kref_put include/linux/kref.h:65 [inline]
[<ffffffe0029dac6c>] nfc_llcp_local_put net/nfc/llcp_core.c:183 [inline]
[<ffffffe0029dac6c>] nfc_llcp_local_put+0x136/0x15e net/nfc/llcp_core.c:178
[<ffffffe0029e4fd6>] nfc_llcp_sock_free+0xfa/0x10c net/nfc/llcp_sock.c:1005
[<ffffffe0029e5052>] llcp_sock_destruct+0x6a/0x112 net/nfc/llcp_sock.c:950
[<ffffffe0020f6adc>] __sk_destruct+0x42/0x546 net/core/sock.c:1795
[<ffffffe0020f7100>] sk_destruct net/core/sock.c:1839 [inline]
[<ffffffe0020f7100>] __sk_free+0x120/0x29a net/core/sock.c:1850
[<ffffffe0020f730a>] sk_free+0x90/0xa8 net/core/sock.c:1861
[<ffffffe0029e4206>] sock_put include/net/sock.h:1807 [inline]
[<ffffffe0029e4206>] llcp_sock_release+0x2c2/0x378 net/nfc/llcp_sock.c:644
[<ffffffe0020e95b0>] __sock_release+0x88/0x17e net/socket.c:599
[<ffffffe0020e96c4>] sock_close+0x1e/0x2a net/socket.c:1258
[<ffffffe0003fe10c>] __fput+0x166/0x49a fs/file_table.c:280
[<ffffffe0003fe4a6>] ____fput+0x1a/0x24 fs/file_table.c:313
[<ffffffe00006d354>] task_work_run+0xd0/0x148 kernel/task_work.c:140
[<ffffffe000031fba>] exit_task_work include/linux/task_work.h:30 [inline]
[<ffffffe000031fba>] do_exit+0x770/0x1846 kernel/exit.c:825
[<ffffffe00003319a>] do_group_exit+0xa0/0x198 kernel/exit.c:922
[<ffffffe00004c558>] get_signal+0x31e/0x14ba kernel/signal.c:2781
[<ffffffe000007e06>] do_signal arch/riscv/kernel/signal.c:271 [inline]
[<ffffffe000007e06>] do_notify_resume+0xa8/0x930 arch/riscv/kernel/signal.c:317
[<ffffffe000005586>] ret_from_exception+0x0/0x14