------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 15417 at lib/refcount.c:25 refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Modules linked in:
CPU: 0 UID: 0 PID: 15417 Comm: syz.5.1959 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1ca/0x210 lib/refcount.c:25
Code: ff 89 de e8 e8 cc e4 fc 84 db 0f 85 e6 fe ff ff e8 fb d1 e4 fc c6 05 ae 95 99 0b 01 90 48 c7 c7 00 df f4 8b e8 57 f0 a3 fc 90 <0f> 0b 90 90 e9 c3 fe ff ff e8 d8 d1 e4 fc c6 05 89 95 99 0b 01 90
RSP: 0018:ffffc900000078b0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a92c8
RDX: ffff8880241c2440 RSI: ffffffff817a92d5 RDI: 0000000000000001
RBP: ffff8880516c21ec R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880516c21ec
R13: ffff8880516c2080 R14: ffff88805849de00 R15: ffff88804f9c2000
FS: 0000000000000000(0000) GS:ffff888097772000(0063) knlGS:00000000f508eb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f508d510 CR3: 0000000027af0000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_add include/linux/refcount.h:289 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_net include/net/net_namespace.h:268 [inline]
tipc_aead_encrypt net/tipc/crypto.c:821 [inline]
tipc_crypto_xmit+0x20c1/0x2550 net/tipc/crypto.c:1761
tipc_bearer_xmit_skb+0x15f/0x430 net/tipc/bearer.c:572
tipc_disc_timeout+0x5b2/0x850 net/tipc/discover.c:338
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_read_unlock_irqrestore include/linux/rwlock_api_smp.h:242 [inline]
RIP: 0010:_raw_read_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:268
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 b3 1b f6 48 89 df e8 6e 0b 1c f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 27 0c f6 65 8b 05 5e a3 2e 08 85 c0 74 16 5b
RSP: 0018:ffffc9000d5e7938 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff901eb460 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dc0a7a0 RDI: ffffffff8bf533a0
RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff9087d657 R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: 1ffff92001abcf39 R15: ffff888050887000
netlink_lock_table net/netlink/af_netlink.c:455 [inline]
netlink_broadcast_filtered+0x105/0xf10 net/netlink/af_netlink.c:1519
netlink_broadcast+0x39/0x50 net/netlink/af_netlink.c:1546
uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline]
kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
kobject_uevent_env+0xc6a/0x1870 lib/kobject_uevent.c:608
gadget_bind_driver+0x78b/0xc40 drivers/usb/gadget/udc/core.c:1628
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x241/0xa90 drivers/base/dd.c:657
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:799
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:829
__driver_attach+0x283/0x580 drivers/base/dd.c:1215
bus_for_each_dev+0x13e/0x1d0 drivers/base/bus.c:370
bus_add_driver+0x2e9/0x690 drivers/base/bus.c:678
driver_register+0x15c/0x4b0 drivers/base/driver.c:249
usb_gadget_register_driver_owner+0x132/0x330 drivers/usb/gadget/udc/core.c:1700
raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:595 [inline]
raw_ioctl+0x17d0/0x2c30 drivers/usb/gadget/legacy/raw_gadget.c:1306
__do_compat_sys_ioctl fs/ioctl.c:1005 [inline]
__se_compat_sys_ioctl fs/ioctl.c:948 [inline]
__ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:948
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306
do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf709e579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f508c484 EFLAGS: 00000292 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005501
RDX: 0000000000000000 RSI: 00000000f7402ff4 RDI: 00000000f508c4e8
RBP: 00000000f7402ff4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 a6 b3 1b f6 call 0xf61bb3b9
13: 48 89 df mov %rbx,%rdi
16: e8 6e 0b 1c f6 call 0xf61c0b89
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 c5 27 0c f6 call 0xf60c27f9
34: 65 8b 05 5e a3 2e 08 mov %gs:0x82ea35e(%rip),%eax # 0x82ea399
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx