------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 21048 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 3 PID: 21048 Comm: syz-executor.0 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 9c a9 e3 fd e9 8a fe ff ff e8 62 f1 9c fd 48 c7 c7 40 d1 04 8a c6 05 29 f9 a1 09 01 e8 09 fa 32 05 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc900005b8d00 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888015be5700 RSI: ffffffff815f5aa8 RDI: fffff520000b7192
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff815ef87e R11: 0000000000000000 R12: ffff888077b6c820
R13: 1ffff920000b71a8 R14: ffffffff886fa670 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44a5b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f445b000 CR3: 000000001a1fb000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 sctp_transport_put+0x138/0x180 net/sctp/transport.c:486
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:finish_task_switch.isra.0+0x323/0xb80 kernel/sched/core.c:4852
Code: 33 45 01 08 85 c0 75 02 0f 0b 48 85 db 0f 85 25 01 00 00 4c 89 f7 e8 fc f7 ff ff e8 a7 44 2d 00 fb 65 48 8b 1c 25 40 70 02 00 <48> 8d bb 80 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc9000c33fa68 EFLAGS: 00000202
RAX: 0000000000000829 RBX: ffff888015be5700 RCX: 1ffffffff1b228e9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000c33fab0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817e2bc8 R11: 0000000000000000 R12: ffff88802cd3a7d8
R13: ffff888011420000 R14: ffff88802cd39a80 R15: ffff88802cd3a4b8
 context_switch kernel/sched/core.c:4975 [inline]
 __schedule+0xaa2/0x4940 kernel/sched/core.c:6253
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6668
 irqentry_exit+0x31/0x80 kernel/entry/common.c:425
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:aio_write+0x2/0x7a0 fs/aio.c:1544
Code: 84 98 ff e8 90 3c df ff eb 9e e8 89 3c df ff eb e2 e8 22 3c df ff e9 5f ff ff ff e8 18 3c df ff e9 31 ff ff ff 0f 1f 00 41 57 <49> bf 00 00 00 00 00 fc ff df 41 56 41 89 d6 41 55 49 89 f5 41 54
RSP: 0018:ffffc9000c33fcb0 EFLAGS: 00000246
RAX: 000000000000134b RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffc9000c33fd88 RDI: ffff888018dcaa00
RBP: 0000000000000001 R08: ffffffff89baf500 R09: ffffffff81dfe0e8
R10: 0000000000000007 R11: 0000000000000001 R12: ffff888018dcaac8
R13: 0000000000000001 R14: ffff888018dcaab8 R15: ffff888018dcaa00
 __io_submit_one fs/aio.c:1832 [inline]
 io_submit_one+0xe09/0x1b80 fs/aio.c:1879
 __do_compat_sys_io_submit fs/aio.c:1980 [inline]
 __se_compat_sys_io_submit fs/aio.c:1950 [inline]
 __ia32_compat_sys_io_submit+0x197/0x390 fs/aio.c:1950
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf6eab549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f44a55fc EFLAGS: 00000296 ORIG_RAX: 00000000000000f8
RAX: ffffffffffffffda RBX: 00000000f445b000 RCX: 0000000000004000
RDX: 0000000020000540 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	33 45 01             	xor    0x1(%rbp),%eax
   3:	08 85 c0 75 02 0f    	or     %al,0xf0275c0(%rbp)
   9:	0b 48 85             	or     -0x7b(%rax),%ecx
   c:	db 0f                	fisttpl (%rdi)
   e:	85 25 01 00 00 4c    	test   %esp,0x4c000001(%rip)        # 0x4c000015
  14:	89 f7                	mov    %esi,%edi
  16:	e8 fc f7 ff ff       	callq  0xfffff817
  1b:	e8 a7 44 2d 00       	callq  0x2d44c7
  20:	fb                   	sti
  21:	65 48 8b 1c 25 40 70 	mov    %gs:0x27040,%rbx
  28:	02 00
* 2a:	48 8d bb 80 15 00 00 	lea    0x1580(%rbx),%rdi <-- trapping instruction
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48 89 fa             	mov    %rdi,%rdx
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1