------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 7393 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 7393 Comm: syz.2.380 Not tainted 6.16.0-syzkaller-00857-gced1b9e0392d #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 d8 7f da fc 84 db 0f 85 66 ff ff ff e8 eb 84 da fc c6 05 19 50 b0 0b 01 90 48 c7 c7 e0 6a 15 8c e8 d7 8b 99 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 c8 84 da fc 0f b6 1d f4 4f b0 0b 31
RSP: 0018:ffffc900006f8d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817b01b8
RDX: ffff88804501c880 RSI: ffffffff817b01c5 RDI: 0000000000000001
RBP: ffff88802d23e998 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88802d23e998
R13: ffff888043e0bc00 R14: 0000000000000015 R15: 1ffff110044df00c
FS:  0000000000000000(0000) GS:ffff8880d69f9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000034be5000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 p9_req_put+0x1ec/0x250 net/9p/client.c:404
 req_done+0x1dc/0x2e0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
 vring_interrupt+0x31e/0x400 drivers/virtio/virtio_ring.c:2690
 __handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x28e/0xab0 kernel/irq/chip.c:797
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:254 [inline]
 call_irq_handler arch/x86/kernel/irq.c:266 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:292
 common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:285
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:csd_lock_wait kernel/smp.c:340 [inline]
RIP: 0010:smp_call_function_single+0x1fb/0x6b0 kernel/smp.c:679
Code: 24 ce 00 00 00 48 89 de e8 82 fa ff ff 41 89 c5 0f 1f 44 00 00 e8 25 00 0c 00 eb 07 e8 1e 00 0c 00 f3 90 8b 9c 24 c8 00 00 00 <31> ff 83 e3 01 89 de e8 49 fb 0b 00 85 db 75 e2 e8 00 00 0c 00 e8
RSP: 0018:ffffc90004bf7800 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000011 RCX: ffffffff81aff917
RDX: ffff88804501c880 RSI: ffffffff81aff902 RDI: 0000000000000005
RBP: ffffc90004bf7960 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 1ffff9200097ef08
R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000
 rcu_barrier kernel/rcu/tree.c:3838 [inline]
 rcu_barrier+0x28d/0x6e0 kernel/rcu/tree.c:3775
 kvm_mmu_uninit_vm+0x5b/0x60 arch/x86/kvm/mmu/mmu.c:6714
 kvm_arch_destroy_vm+0x207/0x2f0 arch/x86/kvm/x86.c:12971
 kvm_destroy_vm virt/kvm/kvm_main.c:1308 [inline]
 kvm_put_kvm+0x4f2/0xb40 virt/kvm/kvm_main.c:1344
 kvm_vm_release+0x3c/0x50 virt/kvm/kvm_main.c:1367
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x14d/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x86c/0x2bd0 kernel/exit.c:964
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1105
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:111
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffbe298e9a9
Code: Unable to access opcode bytes at 0x7ffbe298e97f.
RSP: 002b:00007ffbe385d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 00007ffbe2bb5fa0 RCX: 00007ffbe298e9a9
RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003
RBP: 00007ffbe2a10d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffbe2bb5fa0 R15: 00007ffeedae6618
 </TASK>
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	48 89 de             	mov    %rbx,%rsi
   5:	e8 82 fa ff ff       	call   0xfffffa8c
   a:	41 89 c5             	mov    %eax,%r13d
   d:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  12:	e8 25 00 0c 00       	call   0xc003c
  17:	eb 07                	jmp    0x20
  19:	e8 1e 00 0c 00       	call   0xc003c
  1e:	f3 90                	pause
  20:	8b 9c 24 c8 00 00 00 	mov    0xc8(%rsp),%ebx
* 27:	31 ff                	xor    %edi,%edi <-- trapping instruction
  29:	83 e3 01             	and    $0x1,%ebx
  2c:	89 de                	mov    %ebx,%esi
  2e:	e8 49 fb 0b 00       	call   0xbfb7c
  33:	85 db                	test   %ebx,%ebx
  35:	75 e2                	jne    0x19
  37:	e8 00 00 0c 00       	call   0xc003c
  3c:	e8                   	.byte 0xe8