Extracting prog: 2m17.118778591s Minimizing prog: 20m52.954076822s Simplifying prog options: 0s Extracting C: 39.027860406s Simplifying C: 22m54.64268643s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) close(r3) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000480)={0x1d, r5, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000000)={0x1d, r5}, 0x18) sendfile(r3, r2, 0x0, 0x80005) program crashed: WARNING: refcount bug in j1939_session_put single: successfully extracted reproducer found reproducer with 11 syscalls minimizing guilty program testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939 detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket(0x18, 0x0, 0x0) close(r2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000480)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r2, &(0x7f0000000000)={0x1d, r4}, 0x18) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) close(r3) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000480)={0x1d, r5, 0x0, {}, 0xfe}, 0x18) sendfile(r3, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) close(r3) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) connect$can_j1939(r3, &(0x7f0000000000)={0x1d, r5}, 0x18) sendfile(r3, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-socket$can_j1939-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) close(r3) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000480)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000000), 0x18) sendfile(r3, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-close-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) close(r3) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000480)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000000)={0x1d, r4}, 0x18) sendfile(r3, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-socket-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = socket(0x18, 0x0, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000480)={0x1d, r5, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r3, &(0x7f0000000000)={0x1d, r5}, 0x18) sendfile(r3, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-openat$nullb-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) close(0xffffffffffffffff) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000480)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000000)={0x1d, r4}, 0x18) sendfile(0xffffffffffffffff, r2, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000480)={0x1d, r1}, 0x18) r2 = socket(0x18, 0x0, 0x0) close(r2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000480)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r2, &(0x7f0000000000)={0x1d, r4}, 0x18) sendfile(r2, 0xffffffffffffffff, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = socket(0x18, 0x0, 0x0) close(r2) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000480)={0x1d, r4, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r2, &(0x7f0000000000)={0x1d, r4}, 0x18) sendfile(r2, r1, 0x0, 0x80005) program crashed: WARNING: refcount bug in j1939_session_put testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: socket$can_j1939(0x1d, 0x2, 0x7) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000480)={0x1d, r3, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000000)={0x1d, r3}, 0x18) sendfile(r1, r0, 0x0, 0x80005) program crashed: WARNING: refcount bug in j1939_session_put testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000480)={0x1d, r3, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000000)={0x1d, r3}, 0x18) sendfile(r1, r0, 0x0, 0x80005) program crashed: WARNING: refcount bug in j1939_session_put testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000480)={0x1d, r3, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000000)={0x1d, r3}, 0x18) sendfile(r1, r0, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) bind$can_j1939(r2, &(0x7f0000000480)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000000), 0x18) sendfile(r1, r0, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r2, 0x0, 0x0) connect$can_j1939(r1, &(0x7f0000000000)={0x1d, r3}, 0x18) sendfile(r1, r0, 0x0, 0x80005) program did not crash testing program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket(0x18, 0x0, 0x0) close(r1) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000480)={0x1d, r3, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r1, 0x0, 0x0) sendfile(r1, r0, 0x0, 0x80005) program did not crash extracting C reproducer testing compiled C program (duration=1m5.155883371s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put simplifying C reproducer testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program did not crash testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program did not crash testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put testing compiled C program (duration=1m5.155883371s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-socket-close-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-bind$can_j1939-connect$can_j1939-sendfile program crashed: WARNING: refcount bug in j1939_session_put reproducing took 46m43.743419292s repro crashed as (corrupted=false): vcan0: j1939_tp_rxtimer: 0xffff88807b201400: rx timeout, send abort vcan0: j1939_tp_rxtimer: 0xffff88807b201400: abort rx timeout. Force session deactivation ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Code: 60 ef 5f 8c e8 87 fc a0 fc 90 0f 0b 90 90 eb 99 e8 eb 06 e0 fc c6 05 ff d6 50 0b 01 90 48 c7 c7 c0 ef 5f 8c e8 67 fc a0 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 c8 06 e0 fc c6 05 d9 d6 50 0b 01 90 RSP: 0018:ffffc90000007c08 EFLAGS: 00010246 RAX: 40d5370092a66100 RBX: ffff88807b2875e4 RCX: ffffffff8e694640 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: ffffffff8155d222 R09: 1ffff92000000f1c R10: dffffc0000000000 R11: fffff52000000f1d R12: ffff88807b201468 R13: ffff88807b2875e4 R14: 1ffff1100f640298 R15: ffff88807b201400 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f16507509d0 CR3: 000000000e734000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kfree_skb_reason include/linux/skbuff.h:1262 [inline] kfree_skb include/linux/skbuff.h:1271 [inline] j1939_session_destroy net/can/j1939/transport.c:282 [inline] __j1939_session_release net/can/j1939/transport.c:294 [inline] kref_put include/linux/kref.h:65 [inline] j1939_session_put+0x1ed/0x440 net/can/j1939/transport.c:299 j1939_tp_rxtimer+0x184/0x3d0 net/can/j1939/transport.c:1265 __run_hrtimer kernel/time/hrtimer.c:1691 [inline] __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1755 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1772 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline] RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 80 d7 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d 55 27 ab 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffffff8e607ca8 EFLAGS: 00000246 RAX: ffffffff8e694640 RBX: ffff888143aa2864 RCX: 00000000000147b9 RDX: 0000000000000001 RSI: ffff888143aa2800 RDI: ffff888143aa2864 RBP: 000000000003a978 R08: ffff8880b8637e9b R09: 1ffff110170c6fd3 R10: dffffc0000000000 R11: ffffffff8bbeda00 R12: ffff888140f50800 R13: 0000000000000001 R14: 0000000000000001 R15: ffffffff8f11c460 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:702 cpuidle_enter_state+0x109/0x470 drivers/cpuidle/cpuidle.c:264 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:385 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x375/0x5d0 kernel/sched/idle.c:326 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424 rest_init+0x2dc/0x300 init/main.c:747 start_kernel+0x47f/0x500 init/main.c:1105 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x147 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 65 48 8b 04 25 80 d7 mov %gs:0x3d780,%rax 10: 03 00 12: 48 f7 00 08 00 00 00 testq $0x8,(%rax) 19: 75 10 jne 0x2b 1b: 66 90 xchg %ax,%ax 1d: 0f 00 2d 55 27 ab 00 verw 0xab2755(%rip) # 0xab2779 24: f3 0f 1e fa endbr64 28: fb sti 29: f4 hlt * 2a: fa cli <-- trapping instruction 2b: c3 ret 2c: cc int3 2d: cc int3 2e: cc int3 2f: cc int3 30: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 37: 00 00 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop final repro crashed as (corrupted=false): vcan0: j1939_tp_rxtimer: 0xffff88807b201400: rx timeout, send abort vcan0: j1939_tp_rxtimer: 0xffff88807b201400: abort rx timeout. Force session deactivation ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 lib/refcount.c:28 Code: 60 ef 5f 8c e8 87 fc a0 fc 90 0f 0b 90 90 eb 99 e8 eb 06 e0 fc c6 05 ff d6 50 0b 01 90 48 c7 c7 c0 ef 5f 8c e8 67 fc a0 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 c8 06 e0 fc c6 05 d9 d6 50 0b 01 90 RSP: 0018:ffffc90000007c08 EFLAGS: 00010246 RAX: 40d5370092a66100 RBX: ffff88807b2875e4 RCX: ffffffff8e694640 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: ffffffff8155d222 R09: 1ffff92000000f1c R10: dffffc0000000000 R11: fffff52000000f1d R12: ffff88807b201468 R13: ffff88807b2875e4 R14: 1ffff1100f640298 R15: ffff88807b201400 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f16507509d0 CR3: 000000000e734000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kfree_skb_reason include/linux/skbuff.h:1262 [inline] kfree_skb include/linux/skbuff.h:1271 [inline] j1939_session_destroy net/can/j1939/transport.c:282 [inline] __j1939_session_release net/can/j1939/transport.c:294 [inline] kref_put include/linux/kref.h:65 [inline] j1939_session_put+0x1ed/0x440 net/can/j1939/transport.c:299 j1939_tp_rxtimer+0x184/0x3d0 net/can/j1939/transport.c:1265 __run_hrtimer kernel/time/hrtimer.c:1691 [inline] __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1755 hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1772 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:92 [inline] RIP: 0010:acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:112 Code: 90 90 90 90 90 90 90 90 90 65 48 8b 04 25 80 d7 03 00 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d 55 27 ab 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffffff8e607ca8 EFLAGS: 00000246 RAX: ffffffff8e694640 RBX: ffff888143aa2864 RCX: 00000000000147b9 RDX: 0000000000000001 RSI: ffff888143aa2800 RDI: ffff888143aa2864 RBP: 000000000003a978 R08: ffff8880b8637e9b R09: 1ffff110170c6fd3 R10: dffffc0000000000 R11: ffffffff8bbeda00 R12: ffff888140f50800 R13: 0000000000000001 R14: 0000000000000001 R15: ffffffff8f11c460 acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:702 cpuidle_enter_state+0x109/0x470 drivers/cpuidle/cpuidle.c:264 cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:385 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:230 [inline] do_idle+0x375/0x5d0 kernel/sched/idle.c:326 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424 rest_init+0x2dc/0x300 init/main.c:747 start_kernel+0x47f/0x500 init/main.c:1105 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507 x86_64_start_kernel+0x9f/0xa0 arch/x86/kernel/head64.c:488 common_startup_64+0x13e/0x147 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 65 48 8b 04 25 80 d7 mov %gs:0x3d780,%rax 10: 03 00 12: 48 f7 00 08 00 00 00 testq $0x8,(%rax) 19: 75 10 jne 0x2b 1b: 66 90 xchg %ax,%ax 1d: 0f 00 2d 55 27 ab 00 verw 0xab2755(%rip) # 0xab2779 24: f3 0f 1e fa endbr64 28: fb sti 29: f4 hlt * 2a: fa cli <-- trapping instruction 2b: c3 ret 2c: cc int3 2d: cc int3 2e: cc int3 2f: cc int3 30: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) 37: 00 00 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop