------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 6264 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Modules linked in:
CPU: 0 UID: 0 PID: 6264 Comm: syz.1.107 Not tainted 6.14.0-syzkaller-g06a22366d6a1 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28
Code: 20 65 a1 8c e8 87 b2 7d fc 90 0f 0b 90 90 eb 99 e8 4b 92 be fc c6 05 74 fd 44 0b 01 90 48 c7 c7 80 65 a1 8c e8 67 b2 7d fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 28 92 be fc c6 05 4e fd 44 0b 01 90
RSP: 0018:ffffc90000007b68 EFLAGS: 00010246
RAX: 89c1079057e7fb00 RBX: ffff88805c96b820 RCX: ffff88801e7d8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000003 R08: ffffffff81827a52 R09: 1ffff110170c47d2
R10: dffffc0000000000 R11: ffffed10170c47d3 R12: 1ffff92000000f74
R13: ffff88805c96b9b8 R14: 0000000000000001 R15: 0000000000000103
FS: 0000000000000000(0000) GS:ffff888124f97000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3095ffff CR3: 000000000eb38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
call_timer_fn+0x189/0x650 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x66e/0x8e0 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfb/0x220 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:perf_trace_run_bpf_submit+0xfb/0x180 kernel/events/core.c:10812
Code: 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 70 0f b7 3b 48 8b 74 24 10 4c 89 e2 8b 4c 24 04 4d 89 e8 49 89 e9 41 56 ff 74 24 10 90 00 00 00 48 83 c4 28 eb 3b e8 65 4e cd ff eb 05 e8 5e 4e cd
RSP: 0018:ffffc9000efb6f90 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff8ec0d2b0 RCX: 000000000000002c
RDX: ffffe8ffffca5000 RSI: 0000000000000001 RDI: 00000000000000f1
RBP: ffffe8ffffc38070 R08: ffff8880b8632560 R09: ffffe8ffffc38070
R10: 6f6c5f646165725f R11: 64656863735f6b63 R12: ffffe8ffffca5000
R13: ffff8880b8632560 R14: 0000000000000000 R15: dffffc0000000000
do_perf_trace_lock include/trace/events/lock.h:50 [inline]
perf_trace_lock+0x39c/0x4a0 include/trace/events/lock.h:50
__do_trace_lock_release include/trace/events/lock.h:69 [inline]
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0x3b4/0x3e0 kernel/locking/lockdep.c:5877
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock_sched include/linux/rcupdate.h:953 [inline]
pfn_valid+0x3eb/0x450 include/linux/mmzone.h:2126
page_table_check_clear+0x21/0x6f0 mm/page_table_check.c:70
ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
get_and_clear_full_ptes include/linux/pgtable.h:714 [inline]
zap_present_folio_ptes mm/memory.c:1501 [inline]
zap_present_ptes mm/memory.c:1586 [inline]
do_zap_pte_range mm/memory.c:1687 [inline]
zap_pte_range mm/memory.c:1731 [inline]
zap_pmd_range mm/memory.c:1823 [inline]
zap_pud_range mm/memory.c:1852 [inline]
zap_p4d_range mm/memory.c:1873 [inline]
unmap_page_range+0x33cf/0x44d0 mm/memory.c:1894
unmap_vmas+0x3ce/0x5f0 mm/memory.c:1984
exit_mmap+0x2bc/0xde0 mm/mmap.c:1284
__mmput+0x115/0x420 kernel/fork.c:1379
exit_mm+0x221/0x310 kernel/exit.c:589
do_exit+0x994/0x27f0 kernel/exit.c:940
do_group_exit+0x207/0x2c0 kernel/exit.c:1102
get_signal+0x1696/0x1730 kernel/signal.c:3034
arch_do_signal_or_restart+0x98/0x840 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f520c18d169
Code: Unable to access opcode bytes at 0x7f520c18d13f.
RSP: 002b:00007f520d081038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000004 RBX: 00007f520c3a5fa0 RCX: 00007f520c18d169
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000040
RBP: 00007f520c20e2a0 R08: 0000000000000003 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f520c3a5fa0 R15: 00007ffc158781a8
----------------
Code disassembly (best guess):
0: 89 d8 mov %ebx,%eax
2: 48 c1 e8 03 shr $0x3,%rax
6: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
b: 84 c0 test %al,%al
d: 75 70 jne 0x7f
f: 0f b7 3b movzwl (%rbx),%edi
12: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
17: 4c 89 e2 mov %r12,%rdx
1a: 8b 4c 24 04 mov 0x4(%rsp),%ecx
1e: 4d 89 e8 mov %r13,%r8
21: 49 89 e9 mov %rbp,%r9
24: 41 56 push %r14
26: ff 74 24 10 push 0x10(%rsp)
* 2a: e8 90 00 00 00 call 0xbf <-- trapping instruction
2f: 48 83 c4 28 add $0x28,%rsp
33: eb 3b jmp 0x70
35: e8 65 4e cd ff call 0xffcd4e9f
3a: eb 05 jmp 0x41
3c: e8 .byte 0xe8
3d: 5e pop %rsi
3e: 4e rex.WRX
3f: cd .byte 0xcd