------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 1970 at lib/refcount.c:187 refcount_sub_and_test_checked+0x2e7/0x350 lib/refcount.c:187 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 1970 Comm: syz-executor1 Not tainted 4.19.0-rc1+ #115 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x252/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993 RIP: 0010:refcount_sub_and_test_checked+0x2e7/0x350 lib/refcount.c:187 Code: 89 de e8 cc 47 1c fe 84 db 74 07 31 db e9 46 ff ff ff e8 ec 46 1c fe 48 c7 c7 c0 95 3a 87 c6 05 a0 56 26 05 01 e8 f9 09 e7 fd <0f> 0b 31 db e9 25 ff ff ff 48 8b bd 28 ff ff ff 89 85 34 ff ff ff RSP: 0018:ffff8801db1075a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000100 RSI: ffffffff8163ac01 RDI: ffff8801db107290 RBP: ffff8801db107688 R08: ffff8801d6db0180 R09: 0000000000000002 R10: ffff8801d6db0180 R11: 0000000000000000 R12: 00000000ffffffff R13: ffff8801db107660 R14: 0000000000000001 R15: ffff88016a6a6748 refcount_dec_and_test_checked+0x1a/0x20 lib/refcount.c:212 sctp_transport_put+0x76/0x200 net/sctp/transport.c:331 sctp_generate_heartbeat_event+0x2d7/0x450 net/sctp/sm_sideeffect.c:416 call_timer_fn+0x254/0x810 kernel/time/timer.c:1326 expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x7d2/0xc60 kernel/time/timer.c:1682 run_timer_softirq+0x1d/0x40 kernel/time/timer.c:1695 __do_softirq+0x2eb/0xa74 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x1d6/0x210 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x18e/0x6a0 arch/x86/kernel/apic/apic.c:1056 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864 </IRQ> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:788 [inline] RIP: 0010:lock_acquire+0x25f/0x4f0 kernel/locking/lockdep.c:3904 Code: 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 41 02 00 00 48 83 3d b8 13 92 06 00 0f 84 a6 01 00 00 48 8b bd 20 ff ff ff 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 RSP: 0018:ffff880198655a40 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 1ffff100330cab4d RCX: 0000000000000000 RDX: 1ffffffff0fe37b5 RSI: 0000000000000000 RDI: 0000000000000282 RBP: ffff880198655b30 R08: 0000000000000008 R09: 0000000000000002 R10: ffff8801d6db0a10 R11: 4693cced5de0638b R12: ffff8801d6db0180 R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:244 [inline] rcu_read_lock include/linux/rcupdate.h:629 [inline] hctx_lock+0xae/0x1d0 block/blk-mq.c:603 __blk_mq_run_hw_queue+0x156/0x210 block/blk-mq.c:1296 __blk_mq_delay_run_hw_queue+0x488/0x520 block/blk-mq.c:1365 blk_mq_run_hw_queue+0x1cd/0x390 block/blk-mq.c:1402 blk_mq_sched_insert_requests+0x31e/0x460 block/blk-mq-sched.c:422 blk_mq_flush_plug_list+0xa81/0x1080 block/blk-mq.c:1652 blk_flush_plug_list+0x1c7/0x9a0 block/blk-core.c:3694 blk_finish_plug+0x58/0xa2 block/blk-core.c:3751 do_blockdev_direct_IO+0x2ca3/0x9db0 fs/direct-io.c:1360 __blockdev_direct_IO+0x9d/0xc6 fs/direct-io.c:1417 ext4_direct_IO_read fs/ext4/inode.c:3832 [inline] ext4_direct_IO+0xf1e/0x2000 fs/ext4/inode.c:3864 generic_file_read_iter+0x515/0x2f20 mm/filemap.c:2341 ext4_file_read_iter+0x18b/0x3c0 fs/ext4/file.c:77 call_read_iter include/linux/fs.h:1801 [inline] generic_file_splice_read+0x5a5/0x9a0 fs/splice.c:308 do_splice_to+0x12e/0x190 fs/splice.c:881 splice_direct_to_actor+0x270/0x8f0 fs/splice.c:953 do_splice_direct+0x2d4/0x420 fs/splice.c:1062 do_sendfile+0x62a/0xe20 fs/read_write.c:1440 __do_compat_sys_sendfile fs/read_write.c:1516 [inline] __se_compat_sys_sendfile fs/read_write.c:1505 [inline] __ia32_compat_sys_sendfile+0x190/0x2a0 fs/read_write.c:1505 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline] do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f9aca9 Code: 55 08 8b 88 64 cd ff ff 8b 98 68 cd ff ff 89 c8 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 1c 24 c3 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f5f960cc EFLAGS: 00000296 ORIG_RAX: 00000000000000bb RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000005 RDX: 0000000020000040 RSI: 0000000080004000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds..