------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 1 PID: 23004 at lib/refcount.c:31 refcount_warn_saturate+0x1d7/0x1f0 lib/refcount.c:31
Modules linked in:
CPU: 1 PID: 23004 Comm: sed Not tainted 6.1.0-rc8-next-20221207-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:refcount_warn_saturate+0x1d7/0x1f0 lib/refcount.c:31
Code: 05 5a 60 51 0a 01 e8 35 0a b5 05 0f 0b e9 d3 fe ff ff e8 6c 9b 75 fd 48 c7 c7 c0 6d a6 8a c6 05 37 60 51 0a 01 e8 16 0a b5 05 <0f> 0b e9 b4 fe ff ff 48 89 ef e8 5a b5 c3 fd e9 5c fe ff ff 0f 1f
RSP: 0018:ffffc900001e0ce8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807ddf0000 RSI: ffffffff8166b1dc RDI: fffff5200003c18f
RBP: ffff888032ec0600 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000001 R12: 1ffff9200003c1a2
R13: 0000000000000000 R14: ffff888032ec0600 R15: 0000000000000003
FS:  00007f18aaa8d800(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f18aaba2850 CR3: 0000000064703000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 ref_tracker_free+0x539/0x6b0 lib/ref_tracker.c:118
 netdev_tracker_free include/linux/netdevice.h:4039 [inline]
 netdev_put include/linux/netdevice.h:4056 [inline]
 dev_put include/linux/netdevice.h:4082 [inline]
 put_gid_ndev+0x5a/0xc0 drivers/infiniband/core/cache.c:233
 rcu_do_batch kernel/rcu/tree.c:2244 [inline]
 rcu_core+0x81f/0x1980 kernel/rcu/tree.c:2504
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:200
Code: f6 62 8a 02 66 0f 1f 44 00 00 f3 0f 1e fa 48 8b be a8 01 00 00 e8 b0 ff ff ff 31 c0 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <f3> 0f 1e fa 65 8b 05 fd 08 82 7e 89 c1 48 8b 34 24 81 e1 00 01 00
RSP: 0018:ffffc900031afb20 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffff88803e23ba0c RCX: ffffffff89ba6238
RDX: ffff88807ddf0000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: 0000000000000007 R08: 0000000000000007 R09: 0000000000000000
R10: 00007f18aaaf2fff R11: 0000000000000000 R12: 00007f18aaaf2fff
R13: 0000000000000038 R14: dffffc0000000000 R15: 0000000000000007
 mas_validate_gaps lib/maple_tree.c:6914 [inline]
 mt_validate+0x1d06/0x3230 lib/maple_tree.c:7147
 validate_mm_mt+0xa7/0x1b0 mm/mmap.c:295
 do_brk_flags+0x6a/0xca0 mm/mmap.c:2929
 __do_sys_brk+0x58d/0x9e0 mm/mmap.c:262
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f18aac1efe7
Code: ff ff 90 64 83 3b 0d 75 07 64 c7 03 01 00 00 00 5b b8 ff ff ff ff 5d 41 5c c3 66 0f 1f 84 00 00 00 00 00 b8 0c 00 00 00 0f 05 <48> 8b 15 c2 9e 0c 00 48 89 02 48 39 f8 72 0a 31 c0 c3 0f 1f 80 00
RSP: 002b:00007ffcf67a93b8 EFLAGS: 00000206 ORIG_RAX: 000000000000000c
RAX: ffffffffffffffda RBX: 0000562989d7e000 RCX: 00007f18aac1efe7
RDX: 00007f18aacec760 RSI: 0000000000021000 RDI: 0000562989d7e000
RBP: 00007f18aacec760 R08: 0000000000000003 R09: 00007f18aace9a60
R10: 00000000000002b0 R11: 0000000000000206 R12: 0000562989d5d000
R13: fffffffffffff000 R14: 00007f18aace9a60 R15: 00000000000002b0
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	8a 02                	mov    (%rdx),%al
   2:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
   8:	f3 0f 1e fa          	endbr64
   c:	48 8b be a8 01 00 00 	mov    0x1a8(%rsi),%rdi
  13:	e8 b0 ff ff ff       	callq  0xffffffc8
  18:	31 c0                	xor    %eax,%eax
  1a:	c3                   	retq
  1b:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
  22:	00 00 00 00
  26:	66 90                	xchg   %ax,%ax
* 28:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2c:	65 8b 05 fd 08 82 7e 	mov    %gs:0x7e8208fd(%rip),%eax        # 0x7e820930
  33:	89 c1                	mov    %eax,%ecx
  35:	48 8b 34 24          	mov    (%rsp),%rsi
  39:	81                   	.byte 0x81
  3a:	e1 00                	loope  0x3c
  3c:	01 00                	add    %eax,(%rax)