vxcan0: j1939_tp_rxtimer: 0x000000008d886791: rx timeout, send abort
vxcan0: j1939_tp_rxtimer: 0x000000008d886791: abort rx timeout. Force session deactivation
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 21279 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 21279 Comm: syz.0.5059 Tainted: G    B              6.12.0-rc1-syzkaller-00042-gf23aa4c0761a #0
Tainted: [B]=BAD_PAGE
Hardware name: linux,dummy-virt (DT)
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28
lr : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28
sp : ffff800080003e20
x29: ffff800080003e20 x28: 0000000000000000 x27: ffff8000818dc010
x26: 0000000000000001 x25: 0000000000000000 x24: 0000042909e18c60
x23: 00000000ffffffff x22: f2f00000065e4e68 x21: f2f00000065e4e00
x20: 0000000000000001 x19: f2f00000062c4500 x18: ffffffffffffffff
x17: 202e74756f656d69 x16: 742078722074726f x15: ffff800080003860
x14: 0000000000000000 x13: ffff80008274db38 x12: 000000000000589b
x11: 0000000000001d89 x10: ffff80008282a010 x9 : ffff80008274db38
x8 : 0000000100001d89 x7 : ffff8000827fdb38 x6 : 0000000000003d89
x5 : fff000007f8cb3c8 x4 : c000000100001d89 x3 : fff07ffffd1d6000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : f8f0000005daed80
Call trace:
 refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 skb_unref include/linux/skbuff.h:1232 [inline]
 __sk_skb_reason_drop net/core/skbuff.c:1213 [inline]
 sk_skb_reason_drop+0xc4/0xcc net/core/skbuff.c:1241
 kfree_skb_reason include/linux/skbuff.h:1262 [inline]
 kfree_skb include/linux/skbuff.h:1271 [inline]
 j1939_session_destroy+0x7c/0x1b4 net/can/j1939/transport.c:282
 __j1939_session_release net/can/j1939/transport.c:294 [inline]
 kref_put include/linux/kref.h:65 [inline]
 j1939_session_put net/can/j1939/transport.c:299 [inline]
 j1939_tp_rxtimer+0xd8/0x24c net/can/j1939/transport.c:1265
 __run_hrtimer kernel/time/hrtimer.c:1691 [inline]
 __hrtimer_run_queues+0x138/0x1bc kernel/time/hrtimer.c:1755
 hrtimer_run_softirq+0x6c/0xc4 kernel/time/hrtimer.c:1772
 handle_softirqs+0x108/0x240 kernel/softirq.c:554
 __do_softirq+0x14/0x20 kernel/softirq.c:588
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:81
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:86
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0x8c/0xc4 kernel/softirq.c:649
 __el1_irq arch/arm64/kernel/entry-common.c:537 [inline]
 el1_interrupt+0x38/0x64 arch/arm64/kernel/entry-common.c:551
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __memset+0x0/0x188
 do_recvmmsg+0xc4/0x2d0 net/socket.c:2957
 __sys_recvmmsg net/socket.c:3036 [inline]
 __do_sys_recvmmsg net/socket.c:3059 [inline]
 __se_sys_recvmmsg net/socket.c:3052 [inline]
 __arm64_sys_recvmmsg+0xd0/0xec net/socket.c:3052
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
---[ end trace 0000000000000000 ]---