------------[ cut here ]------------
WARNING: CPU: 1 PID: 9156 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28
refcount_t: underflow; use-after-free.
Modules linked in:
Kernel panic - not syncing: kernel: panic_on_warn set ...
CPU: 1 UID: 0 PID: 9156 Comm: syz.0.941 Not tainted 6.11.0-syzkaller #0
Hardware name: ARM-Versatile Express
Call trace: frame pointer underflow
[<81966cb8>] (dump_backtrace) from [<81966db4>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257)
 r7:00000000 r6:826228c4 r5:00000000 r4:8200e404
[<81966d9c>] (show_stack) from [<81984a58>] (__dump_stack lib/dump_stack.c:93 [inline])
[<81966d9c>] (show_stack) from [<81984a58>] (dump_stack_lvl+0x54/0x7c lib/dump_stack.c:119)
[<81984a04>] (dump_stack_lvl) from [<81984a98>] (dump_stack+0x18/0x1c lib/dump_stack.c:128)
 r5:00000000 r4:8286ed18
[<81984a80>] (dump_stack) from [<8196785c>] (panic+0x120/0x368 kernel/panic.c:354)
[<8196773c>] (panic) from [<802421d4>] (check_panic_on_warn kernel/panic.c:243 [inline])
[<8196773c>] (panic) from [<802421d4>] (get_taint+0x0/0x1c kernel/panic.c:238)
 r3:8260c5c4 r2:00000001 r1:81ff6c38 r0:81ffea04
 r7:8081a110
[<80242160>] (check_panic_on_warn) from [<80242328>] (__warn+0x7c/0x180 kernel/panic.c:741)
[<802422ac>] (__warn) from [<80242614>] (warn_slowpath_fmt+0x1e8/0x1f4 kernel/panic.c:774)
 r8:00000009 r7:8205cdc4 r6:df805c64 r5:84565400 r4:00000000
[<80242430>] (warn_slowpath_fmt) from [<8081a110>] (refcount_warn_saturate+0x13c/0x174 lib/refcount.c:28)
 r10:20000113 r9:85703c5c r8:851a8cc0 r7:00000000 r6:817f7394 r5:00000002
 r4:851a8cc0
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (__refcount_sub_and_test include/linux/refcount.h:275 [inline])
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (__refcount_dec_and_test include/linux/refcount.h:307 [inline])
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (refcount_dec_and_test include/linux/refcount.h:325 [inline])
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (skb_unref include/linux/skbuff.h:1232 [inline])
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (__sk_skb_reason_drop net/core/skbuff.c:1213 [inline])
[<80819fd4>] (refcount_warn_saturate) from [<8146782c>] (sk_skb_reason_drop+0x1d8/0x248 net/core/skbuff.c:1241)
[<81467654>] (sk_skb_reason_drop) from [<817f7394>] (kfree_skb_reason include/linux/skbuff.h:1262 [inline])
[<81467654>] (sk_skb_reason_drop) from [<817f7394>] (kfree_skb include/linux/skbuff.h:1271 [inline])
[<81467654>] (sk_skb_reason_drop) from [<817f7394>] (j1939_session_skb_drop_old net/can/j1939/transport.c:347 [inline])
[<81467654>] (sk_skb_reason_drop) from [<817f7394>] (j1939_xtp_rx_cts_one net/can/j1939/transport.c:1445 [inline])
[<81467654>] (sk_skb_reason_drop) from [<817f7394>] (j1939_xtp_rx_cts+0x220/0x3d0 net/can/j1939/transport.c:1484)
 r9:85703c5c r8:851a8cc0 r7:85b8b698 r6:00000df2 r5:85703c00 r4:85703c14
[<817f7174>] (j1939_xtp_rx_cts) from [<817f8308>] (j1939_tp_cmd_recv net/can/j1939/transport.c:2089 [inline])
[<817f7174>] (j1939_xtp_rx_cts) from [<817f8308>] (j1939_tp_recv+0x3f4/0x530 net/can/j1939/transport.c:2161)
 r10:ddde4ec8 r9:00000040 r8:85b8b690 r7:83d50000 r6:83d50008 r5:83d50000
 r4:842bd3c0
[<817f7f14>] (j1939_tp_recv) from [<817f1da0>] (j1939_can_recv+0x1e4/0x2dc net/can/j1939/main.c:108)
 r7:83d50000 r6:83d50008 r5:83d50810 r4:842bd3c0
[<817f1bbc>] (j1939_can_recv) from [<817e7b6c>] (deliver net/can/af_can.c:572 [inline])
[<817f1bbc>] (j1939_can_recv) from [<817e7b6c>] (can_rcv_filter+0x9c/0x218 net/can/af_can.c:606)
 r9:00000040 r8:8491c6a0 r7:98c80000 r6:842bd600 r5:00000001 r4:84851a20
[<817e7ad0>] (can_rcv_filter) from [<817e8510>] (can_receive+0xb4/0xf0 net/can/af_can.c:663)
 r9:00000040 r8:00000000 r7:8491c000 r6:8446bac0 r5:84502700 r4:842bd600
[<817e845c>] (can_receive) from [<817e85d0>] (can_rcv+0x84/0xac net/can/af_can.c:687)
 r9:00000040 r8:00000002 r7:00000000 r6:00000000 r5:817e854c r4:842bd600
[<817e854c>] (can_rcv) from [<814886a4>] (__netif_receive_skb_one_core+0x5c/0x80 net/core/dev.c:5662)
 r5:817e854c r4:8491c000
[<81488648>] (__netif_receive_skb_one_core) from [<81488710>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:5775)
 r5:ddde4fb0 r4:842bd600
[<814886f8>] (__netif_receive_skb) from [<81488a00>] (process_backlog+0x88/0x15c net/core/dev.c:6107)
 r5:ddde4fb0 r4:842bd600
[<81488978>] (process_backlog) from [<81489904>] (__napi_poll+0x34/0x240 net/core/dev.c:6771)
 r10:ddde4ec0 r9:ddde5100 r8:df805ea0 r7:df805e9b r6:00000040 r5:ddde4fb0
 r4:00000001
[<814898d0>] (__napi_poll) from [<8148a13c>] (napi_poll net/core/dev.c:6840 [inline])
[<814898d0>] (__napi_poll) from [<8148a13c>] (net_rx_action+0x338/0x420 net/core/dev.c:6962)
 r9:ddde5100 r8:df805ea0 r7:0000012c r6:00014753 r5:ddde4fb0 r4:00000000
[<81489e04>] (net_rx_action) from [<8024b5d8>] (handle_softirqs+0x15c/0x468 kernel/softirq.c:554)
 r10:00000008 r9:84565400 r8:00000101 r7:00400140 r6:00000003 r5:00000004
 r4:8260408c
[<8024b47c>] (handle_softirqs) from [<8024b9d4>] (__do_softirq kernel/softirq.c:588 [inline])
[<8024b47c>] (handle_softirqs) from [<8024b9d4>] (invoke_softirq kernel/softirq.c:428 [inline])
[<8024b47c>] (handle_softirqs) from [<8024b9d4>] (__irq_exit_rcu+0xa4/0x164 kernel/softirq.c:637)
 r10:00000001 r9:84565400 r8:00000000 r7:ea751a98 r6:821af29c r5:821ef71c
 r4:84565400
[<8024b930>] (__irq_exit_rcu) from [<8024bcd4>] (irq_exit+0x10/0x18 kernel/softirq.c:661)
 r5:821ef71c r4:824b8b5c
[<8024bcc4>] (irq_exit) from [<81985354>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:240)
[<819852d8>] (generic_handle_arch_irq) from [<81936768>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40)
 r9:84565400 r8:82e42400 r7:ea751acc r6:ffffffff r5:20000013 r4:8027d08c
[<8193674c>] (call_with_stack) from [<80200bcc>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:227)
Exception stack(0xea751a98 to 0xea751ae0)
1a80:                                                       00000001 8200e404
1aa0: 00000001 84565400 00000000 ddde4280 81988c18 a3e99910 82e42400 84565400
1ac0: 00000001 ea751b2c ea751ad8 ea751ae8 81991ad8 8027d08c 20000013 ffffffff
[<8027d000>] (finish_task_switch) from [<81988c18>] (context_switch kernel/sched/core.c:5191 [inline])
[<8027d000>] (finish_task_switch) from [<81988c18>] (__schedule+0x40c/0xb6c kernel/sched/core.c:6529)
 r10:00000001 r9:840e7300 r8:f398dfc6 r7:a3e99910 r6:84565400 r5:ddde4280
 r4:82e42400
[<8198880c>] (__schedule) from [<819897a4>] (preempt_schedule_irq+0x40/0xa8 kernel/sched/core.c:6851)
 r10:00082cc0 r9:84565400 r8:80200be4 r7:ea751bec r6:ffffffff r5:84565400
 r4:00000000
[<81989764>] (preempt_schedule_irq) from [<80200c04>] (svc_preempt+0x8/0x18)
Exception stack(0xea751bb8 to 0xea751c00)
1ba0:                                                       8451e000 8200e404
1bc0: 00000000 00000000 82c016c0 00001000 00000000 00082cc0 84565400 00000000
1be0: 00082cc0 ea751c64 ea751bd8 ea751c08 804bfc74 804c1d98 60000113 ffffffff
 r5:60000113 r4:804c1d98
[<804c1c2c>] (__kmalloc_node_track_caller_noprof) from [<8145ebf0>] (kmalloc_reserve+0x68/0xfc net/core/skbuff.c:609)
 r10:00082cc0 r9:00001000 r8:8145fca4 r7:ffffffff r6:ea751ca3 r5:ea751c9c
 r4:00000cc0
[<8145eb88>] (kmalloc_reserve) from [<8145fca4>] (__alloc_skb+0x94/0x160 net/core/skbuff.c:678)
 r10:ea751d88 r9:00000000 r8:00000cc0 r7:00000000 r6:82cab780 r5:ffffffff
 r4:8450e180 r3:ea751ca3
[<8145fc10>] (__alloc_skb) from [<81467f1c>] (alloc_skb include/linux/skbuff.h:1322 [inline])
[<8145fc10>] (__alloc_skb) from [<81467f1c>] (alloc_skb_with_frags+0x44/0x1ec net/core/skbuff.c:6612)
 r8:802a5134 r7:ea751d24 r6:00000000 r5:00001000 r4:00000000
[<81467ed8>] (alloc_skb_with_frags) from [<8145961c>] (sock_alloc_send_pskb+0x1f4/0x228 net/core/sock.c:2883)
 r10:ea751d88 r9:00000000 r8:802a5134 r7:ea751d24 r6:84565400 r5:7fffffff
 r4:85765400
[<81459428>] (sock_alloc_send_pskb) from [<817f3f3c>] (sock_alloc_send_skb include/net/sock.h:1780 [inline])
[<81459428>] (sock_alloc_send_pskb) from [<817f3f3c>] (j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline])
[<81459428>] (sock_alloc_send_pskb) from [<817f3f3c>] (j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline])
[<81459428>] (sock_alloc_send_pskb) from [<817f3f3c>] (j1939_sk_sendmsg+0x1d4/0x548 net/can/j1939/socket.c:1277)
 r10:000048a5 r9:8491c000 r8:00000000 r7:ea751de0 r6:85703c00 r5:000006f9
 r4:8450e000
[<817f3d68>] (j1939_sk_sendmsg) from [<8145253c>] (sock_sendmsg_nosec net/socket.c:730 [inline])
[<817f3d68>] (j1939_sk_sendmsg) from [<8145253c>] (__sock_sendmsg+0x44/0x78 net/socket.c:745)
 r10:00000000 r9:84565400 r8:00000001 r7:84cc6000 r6:84cc6000 r5:ea751de0
 r4:00000000
[<814524f8>] (__sock_sendmsg) from [<81452610>] (sock_write_iter+0xa0/0xfc net/socket.c:1166)
 r7:84cc6000 r6:851f5a80 r5:ea751e58 r4:ea751ed0
[<81452570>] (sock_write_iter) from [<80505a70>] (do_iter_readv_writev+0x11c/0x200 fs/read_write.c:834)
 r7:00000000 r6:851f5a80 r5:00000000 r4:00000000
[<80505954>] (do_iter_readv_writev) from [<80506e70>] (vfs_writev+0x134/0x3c0 fs/read_write.c:1064)
 r10:00000092 r9:00000001 r8:84565400 r7:00000000 r6:851f5a80 r5:81452570
 r4:00000000
[<80506d3c>] (vfs_writev) from [<80507208>] (do_writev+0x10c/0x138 fs/read_write.c:1111)
 r9:00000001 r8:20000240 r7:851f5a80 r6:851f5a81 r5:00000000 r4:84565400
[<805070fc>] (do_writev) from [<80508ab0>] (__do_sys_writev fs/read_write.c:1184 [inline])
[<805070fc>] (do_writev) from [<80508ab0>] (sys_writev+0x14/0x18 fs/read_write.c:1181)
 r9:84565400 r8:8020029c r7:00000092 r6:002862f0 r5:00000000 r4:00000000
[<80508a9c>] (sys_writev) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xea751fa8 to 0xea751ff0)
1fa0:                   00000000 00000000 00000006 20000240 00000001 00000000
1fc0: 00000000 00000000 002862f0 00000092 00000000 00006364 003d0f00 76b3a0bc
1fe0: 76b39ec0 76b39eb0 000189d0 00132da0
Rebooting in 86400 seconds..