------------[ cut here ]------------ refcount_t: decrement hit 0; leaking memory. WARNING: lib/refcount.c:31 at refcount_warn_saturate+0x7c/0x130 lib/refcount.c:31, CPU#1: kworker/1:0/23 Modules linked in: CPU: 1 UID: 0 PID: 23 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:refcount_warn_saturate+0x7c/0x130 lib/refcount.c:31 Code: e0 17 b0 87 e8 15 1c e3 fe 83 fd 02 0f 84 a1 00 00 00 76 27 83 fd 03 74 7d 83 fd 04 75 3e e8 eb 20 e3 fe 48 8d 3d 04 54 25 08 <67> 48 0f b9 3a e8 da 20 e3 fe 5b 5d e9 13 4b a1 04 85 ed 74 3a e8 RSP: 0018:ffffc9000018f430 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888125280610 RCX: ffffffff82cfc49b RDX: ffff888102688000 RSI: ffffffff82cfc4b5 RDI: ffffffff8af518c0 RBP: 0000000000000004 R08: 0000000000000005 R09: 0000000000000004 R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff888125280c40 R15: ffff888125280610 FS: 0000000000000000(0000) GS:ffff8882687a4000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0553d92238 CR3: 0000000117754000 CR4: 00000000003506f0 Call Trace: __refcount_dec include/linux/refcount.h:461 [inline] refcount_dec include/linux/refcount.h:476 [inline] __dev_put include/linux/netdevice.h:4450 [inline] netdev_put include/linux/netdevice.h:4514 [inline] netdev_put include/linux/netdevice.h:4509 [inline] unregister_netdevice_many_notify+0x1da4/0x23f0 net/core/dev.c:12466 unregister_netdevice_many net/core/dev.c:12484 [inline] unregister_netdevice_queue net/core/dev.c:12294 [inline] unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12284 unregister_netdevice include/linux/netdevice.h:3444 [inline] unregister_netdev+0x1f/0x60 net/core/dev.c:12502 usbnet_disconnect+0x10a/0x300 drivers/net/usb/usbnet.c:1685 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:621 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:613 __device_release_driver drivers/base/dd.c:1352 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1375 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:657 device_del+0x376/0x9b0 drivers/base/core.c:3895 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314 process_scheduled_works kernel/workqueue.c:3397 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 ---------------- Code disassembly (best guess): 0: e0 17 loopne 0x19 2: b0 87 mov $0x87,%al 4: e8 15 1c e3 fe call 0xfee31c1e 9: 83 fd 02 cmp $0x2,%ebp c: 0f 84 a1 00 00 00 je 0xb3 12: 76 27 jbe 0x3b 14: 83 fd 03 cmp $0x3,%ebp 17: 74 7d je 0x96 19: 83 fd 04 cmp $0x4,%ebp 1c: 75 3e jne 0x5c 1e: e8 eb 20 e3 fe call 0xfee3210e 23: 48 8d 3d 04 54 25 08 lea 0x8255404(%rip),%rdi # 0x825542e * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: e8 da 20 e3 fe call 0xfee3210e 34: 5b pop %rbx 35: 5d pop %rbp 36: e9 13 4b a1 04 jmp 0x4a14b4e 3b: 85 ed test %ebp,%ebp 3d: 74 3a je 0x79 3f: e8 .byte 0xe8