WARNING: CPU: 0 PID: 5964 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 5964 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28
Code: e9 db fe ff ff 48 89 df e8 6c e4 e4 fd e9 8a fe ff ff e8 d2 40 9e fd 48 c7 c7 c0 4e e4 89 c6 05 a2 c2 81 09 01 e8 86 4c 1c 05 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55
RSP: 0018:ffffc90000007d00 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888012398000 RSI: ffffffff815f3708 RDI: fffff52000000f92
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff815ed4de R11: 0000000000000000 R12: ffff88804915b820
R13: 1ffff92000000fa8 R14: ffffffff88578c10 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88802ca00000(0063) knlGS:00000000f453ab40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000031a29000 CR3: 0000000076721000 CR4: 0000000000150ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:283 [inline]
 __refcount_dec_and_test include/linux/refcount.h:315 [inline]
 refcount_dec_and_test include/linux/refcount.h:333 [inline]
 sctp_transport_put+0x138/0x180 net/sctp/transport.c:486
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:generic_exec_single+0xfe/0x3a0 kernel/smp.c:521
Code: 01 00 0f 85 75 02 00 00 48 03 14 dd a0 08 35 8b 4c 89 e6 4c 89 e7 e8 71 52 6c 02 31 ff 89 c3 89 c6 e8 26 8b 0b 00 84 db 75 18 <45> 31 e4 e8 da 84 0b 00 44 89 e0 48 83 c4 08 5b 5d 41 5c 41 5d 41
RSP: 0018:ffffc90023befae8 EFLAGS: 00000216
RAX: 000000000000045a RBX: 0000000000000200 RCX: ffffc90026848000
RDX: 0000000000040000 RSI: ffffffff816c411e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fd45b0f
R10: ffffffff816c4110 R11: 0000000000000000 R12: ffffc90023befb60
R13: ffffc90023befc20 R14: ffffc90023befb68 R15: ffff888012398014
 smp_call_function_single+0x1a4/0x4b0 kernel/smp.c:755
 task_function_call+0xe5/0x170 kernel/events/core.c:119
 perf_install_in_context+0x2cb/0x550 kernel/events/core.c:2918
 __do_sys_perf_event_open+0x1cdf/0x3130 kernel/events/core.c:12409
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf6f40549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f453a5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000150
RAX: ffffffffffffffda RBX: 0000000020000040 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 00000000ffffffff RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	01 00                	add    %eax,(%rax)
   2:	0f 85 75 02 00 00    	jne    0x27d
   8:	48 03 14 dd a0 08 35 	add    -0x74caf760(,%rbx,8),%rdx
   f:	8b
  10:	4c 89 e6             	mov    %r12,%rsi
  13:	4c 89 e7             	mov    %r12,%rdi
  16:	e8 71 52 6c 02       	callq  0x26c528c
  1b:	31 ff                	xor    %edi,%edi
  1d:	89 c3                	mov    %eax,%ebx
  1f:	89 c6                	mov    %eax,%esi
  21:	e8 26 8b 0b 00       	callq  0xb8b4c
  26:	84 db                	test   %bl,%bl
  28:	75 18                	jne    0x42
* 2a:	45 31 e4             	xor    %r12d,%r12d <-- trapping instruction
  2d:	e8 da 84 0b 00       	callq  0xb850c
  32:	44 89 e0             	mov    %r12d,%eax
  35:	48 83 c4 08          	add    $0x8,%rsp
  39:	5b                   	pop    %rbx
  3a:	5d                   	pop    %rbp
  3b:	41 5c                	pop    %r12
  3d:	41 5d                	pop    %r13
  3f:	41                   	rex.B