WARNING: CPU: 1 PID: 13477 at lib/refcount.c:28 refcount_warn_saturate+0x107/0x1f0 lib/refcount.c:28
Modules linked in:
CPU: 1 PID: 13477 Comm: syz-executor.1 Not tainted 6.1.0-rc5-syzkaller-00307-gfe24a97cf254 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x107/0x1f0 lib/refcount.c:28
Code: 1d 7a 76 33 0a 31 ff 89 de e8 95 78 75 fd 84 db 75 a3 e8 1c 7c 75 fd 48 c7 c7 a0 bf a7 8a c6 05 5a 76 33 0a 01 e8 f6 67 a0 05 <0f> 0b eb 87 e8 00 7c 75 fd 0f b6 1d 43 76 33 0a 31 ff 89 de e8 60
RSP: 0018:ffffc90000528d88 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801754ba80 RSI: ffffffff816574fc RDI: fffff520000a51a3
RBP: ffff888061dfc008 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080010003 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888061dfc008 R14: ffff88801cc01000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802c700000(0063) knlGS:0000000057f70380
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033a29000 CR3: 0000000069228000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 p9_req_put+0x1f6/0x250 net/9p/client.c:392
 req_done+0x1e2/0x2e0 net/9p/trans_virtio.c:148
 vring_interrupt drivers/virtio/virtio_ring.c:2470 [inline]
 vring_interrupt+0x2a1/0x3d0 drivers/virtio/virtio_ring.c:2445
 __handle_irq_event_percpu+0x264/0x970 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd00 kernel/irq/chip.c:819
 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
 handle_irq arch/x86/kernel/irq.c:231 [inline]
 __common_interrupt+0xa1/0x210 arch/x86/kernel/irq.c:250
 common_interrupt+0xa8/0xd0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:640
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 d6 74 6e f7 48 89 ef e8 7e e1 6e f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 8f 69 61 f7 65 8b 05 f8 ed 0d 76 85 c0 74 0a 5b 5d c3 e8 7c 08
RSP: 0018:ffffc9002418fb58 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000200 RCX: 1ffffffff1ca63e9
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88801c61a6b0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffed10038c34d6 R11: 0000000000000001 R12: ffffffff8e5350c0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88802c63b140
 try_to_wake_up+0x7d5/0x20f0 kernel/sched/core.c:4194
 wake_up_process kernel/sched/core.c:4308 [inline]
 wake_up_q+0x82/0xf0 kernel/sched/core.c:1007
 futex_wake+0x3ed/0x490 kernel/futex/waitwake.c:184
 do_futex+0x268/0x360 kernel/futex/syscalls.c:111
 __do_sys_futex_time32 kernel/futex/syscalls.c:373 [inline]
 __se_sys_futex_time32 kernel/futex/syscalls.c:356 [inline]
 __ia32_sys_futex_time32+0x1d5/0x470 kernel/futex/syscalls.c:356
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f2c549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ff94f33c EFLAGS: 00000246 ORIG_RAX: 00000000000000f0
RAX: ffffffffffffffda RBX: 00000000f737afc8 RCX: 0000000000000081
RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	24 10                	and    $0x10,%al
   2:	e8 d6 74 6e f7       	callq  0xf76e74dd
   7:	48 89 ef             	mov    %rbp,%rdi
   a:	e8 7e e1 6e f7       	callq  0xf76ee18d
   f:	81 e3 00 02 00 00    	and    $0x200,%ebx
  15:	75 25                	jne    0x3c
  17:	9c                   	pushfq
  18:	58                   	pop    %rax
  19:	f6 c4 02             	test   $0x2,%ah
  1c:	75 2d                	jne    0x4b
  1e:	48 85 db             	test   %rbx,%rbx
  21:	74 01                	je     0x24
  23:	fb                   	sti
  24:	bf 01 00 00 00       	mov    $0x1,%edi
* 29:	e8 8f 69 61 f7       	callq  0xf76169bd <-- trapping instruction
  2e:	65 8b 05 f8 ed 0d 76 	mov    %gs:0x760dedf8(%rip),%eax        # 0x760dee2d
  35:	85 c0                	test   %eax,%eax
  37:	74 0a                	je     0x43
  39:	5b                   	pop    %rbx
  3a:	5d                   	pop    %rbp
  3b:	c3                   	retq
  3c:	e8                   	.byte 0xe8
  3d:	7c 08                	jl     0x47