------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 21422 at lib/refcount.c:25 refcount_warn_saturate+0x108/0x1a0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 21422 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller-07637-g3dbdb38e2869 #0
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
pc : refcount_warn_saturate+0x108/0x1a0 lib/refcount.c:25
lr : refcount_warn_saturate+0x108/0x1a0 lib/refcount.c:25
sp : ffff80001b107b40
x29: ffff80001b107b40 x28: ffff000031864000 x27: ffff000016c60000
x26: 0000000000000004 x25: ffff000015ad99c0 x24: 1fffe00002fc9953
x23: ffff80001b107d00 x22: 1ffff00003620fa0 x21: ffff80001736f7a0
x20: ffff000031865108 x19: 0000000000000002 x18: ffff00006a9b4bc8
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 1ffff00003620e96 x13: 0000000000000001 x12: ffff60000d536994
x11: 1fffe0000d536993 x10: ffff60000d536993 x9 : dfff800000000000
x8 : ffff00006a9b4c9b x7 : 0000000000000001 x6 : 00009ffff2ac966d
x5 : ffff00006a9b4c98 x4 : 1fffe000015269d9 x3 : dfff800000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00000a934ec0
Call trace:
 refcount_warn_saturate+0x108/0x1a0 lib/refcount.c:25
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 kref_get include/linux/kref.h:45 [inline]
 j1939_netdev_start+0x4d4/0x710 net/can/j1939/main.c:254
 j1939_sk_bind+0x2dc/0xb40 net/can/j1939/socket.c:482
 __sys_bind+0x16c/0x1d0 net/socket.c:1672
 __do_sys_bind net/socket.c:1683 [inline]
 __se_sys_bind net/socket.c:1681 [inline]
 __arm64_sys_bind+0x6c/0xa0 net/socket.c:1681
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x6c/0x260 arch/arm64/kernel/syscall.c:52
 el0_svc_common.constprop.0+0xc4/0x1e4 arch/arm64/kernel/syscall.c:145
 do_el0_svc_compat+0x40/0x80 arch/arm64/kernel/syscall.c:190
 el0_svc_compat+0x24/0x34 arch/arm64/kernel/entry-common.c:636
 el0t_32_sync_handler+0x90/0x140 arch/arm64/kernel/entry-common.c:645
 el0t_32_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:579
irq event stamp: 1864
hardirqs last  enabled at (1863): [<ffff8000102b0438>] console_unlock+0x7f8/0xbf4 kernel/printk/printk.c:2668
hardirqs last disabled at (1864): [<ffff80001453fcd4>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:296
softirqs last  enabled at (1850): [<ffff8000100109c4>] _stext+0x9c4/0x1054
softirqs last disabled at (1843): [<ffff8000101617c0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (1843): [<ffff8000101617c0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (1843): [<ffff8000101617c0>] __irq_exit_rcu+0x470/0x520 kernel/softirq.c:636
---[ end trace 6321f39ba975f750 ]---