------------[ cut here ]------------
WARNING: CPU: 0 PID: 7569 at lib/ref_tracker.c:228 ref_tracker_free+0x5fe/0x7e0 lib/ref_tracker.c:228
Modules linked in:
CPU: 0 PID: 7569 Comm: syz-executor.2 Not tainted 6.8.0-rc5-syzkaller-01567-gd662c5b3ce6d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:ref_tracker_free+0x5fe/0x7e0 lib/ref_tracker.c:228
Code: 80 28 01 8c e8 23 63 8d 06 43 0f b6 04 3e 84 c0 0f 85 ca 01 00 00 41 8b 7d 00 e8 ad da ff ff e9 7c ff ff ff e8 53 a7 b9 fc 90 <0f> 0b 90 4d 85 e4 0f 85 c1 fa ff ff 4c 8b 64 24 08 4d 8d 74 24 48
RSP: 0018:ffffc90000007a80 EFLAGS: 00010246
RAX: ffffffff84d9c61d RBX: 0000000000000001 RCX: ffff88802fe85940
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000007bb0 R08: ffffffff84d9c0d5 R09: 0000000000000000
R10: ffffc90000007ac0 R11: fffff52000000f68 R12: ffff88807b019ef8
R13: 1ffff92000000f54 R14: ffffc90000007ac0 R15: dffffc0000000000
FS: 00005555574b6480(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555574bf938 CR3: 000000004a41c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__netns_tracker_free include/net/net_namespace.h:348 [inline]
__sk_destruct+0x4fd/0x5f0 net/core/sock.c:2204
rcu_do_batch kernel/rcu/tree.c:2190 [inline]
rcu_core+0xd76/0x1810 kernel/rcu/tree.c:2465
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:percpu_counter_add_batch+0x29b/0x2f0 lib/percpu_counter.c:103
Code: 4d 85 e4 75 16 e8 15 7f bb fc eb 15 e8 0e 7f bb fc e8 99 40 92 06 4d 85 e4 74 ea e8 ff 7e bb fc fb 48 c7 44 24 40 0e 36 e0 45 <48> 8b 44 24 38 49 c7 04 07 00 00 00 00 66 41 c7 44 07 09 00 00 41
RSP: 0018:ffffc900030c7dc0 EFLAGS: 00000293
RAX: ffffffff84d7ee71 RBX: 0000000000000000 RCX: ffff88802fe85940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900030c7ea8 R08: ffffffff84d7ee47 R09: 1ffffffff1f0bc0d
R10: dffffc0000000000 R11: fffffbfff1f0bc0e R12: 0000000000000200
R13: 1ffffffff1bc28cb R14: 0000000000000046 R15: dffffc0000000000
percpu_counter_add include/linux/percpu_counter.h:71 [inline]
percpu_counter_dec include/linux/percpu_counter.h:272 [inline]
file_free+0x91/0x1f0 fs/file_table.c:68
__do_sys_close fs/open.c:1554 [inline]
__se_sys_close fs/open.c:1539 [inline]
__x64_sys_close+0x7e/0x110 fs/open.c:1539
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f55cb27d667
Code: 44 00 00 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb bc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc851f3bf8 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007f55cb27d667
RDX: fffffffffffff000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f55cb2c93b9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc851f4d70
R13: 00007f55cb2c93b9 R14: 0000000000346b18 R15: 0000000000000002
----------------
Code disassembly (best guess):
0: 4d 85 e4 test %r12,%r12
3: 75 16 jne 0x1b
5: e8 15 7f bb fc call 0xfcbb7f1f
a: eb 15 jmp 0x21
c: e8 0e 7f bb fc call 0xfcbb7f1f
11: e8 99 40 92 06 call 0x69240af
16: 4d 85 e4 test %r12,%r12
19: 74 ea je 0x5
1b: e8 ff 7e bb fc call 0xfcbb7f1f
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 48 8b 44 24 38 mov 0x38(%rsp),%rax <-- trapping instruction
2f: 49 c7 04 07 00 00 00 movq $0x0,(%r15,%rax,1)
36: 00
37: 66 41 c7 44 07 09 00 movw $0x0,0x9(%r15,%rax,1)
3e: 00
3f: 41 rex.B