program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000280)="65650f01cfc4c2c5a638b8ffffffff0f23d80f21f835400000700f23f80f01cbb9800000c00f3235000800000f300fc79c070000000066baa100b000ee65360f01cbd9d0360f01c9", 0x48}], 0x1, 0x22, &(0x7f00000003c0), 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xffffffffffffffff)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYRESHEX=r0], 0x50) (async)
r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYRESHEX=r0], 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) (async)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94)
r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) (async)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
r6 = fsmount(r5, 0x1, 0x2)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r4, r6, 0xd, 0x0, @void}, 0x10)
r7 = socket$nl_rdma(0x10, 0x3, 0x14)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x800000}, 0x20)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl(r8, 0x8b32, &(0x7f0000000040))
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vcan0\x00'}}]}, 0x38}}, 0x0) (async)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vcan0\x00'}}]}, 0x38}}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) (async)
r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0xe4428, &(0x7f0000000080)={[{@nr_inodes={'nr_inodes', 0x3d, [0x32]}}]})
ioctl$int_out(r9, 0x5460, &(0x7f00000000c0))
socket$nl_rdma(0x10, 0x3, 0x14) (async)
r10 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_SET(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001500)=ANY=[@ANYBLOB="240000001a1401002abd700001dcdf250800010000000000090002"], 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810)
bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x8, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0xbb}}}, &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, 0x94)
[ 84.733428][ T4651] Bluetooth: hci0: command tx timeout
[ 84.949097][ T5326] warning: `syz.0.0' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[ 84.959226][ T5326] rdma_rxe: Failed to create IPv6 UDP tunnel
[ 84.965595][ T5327] ------------[ cut here ]------------
[ 84.968199][ T5327] refcount_t: addition on 0; use-after-free.
[ 84.970854][ T5327] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110, CPU#0: syz.0.0/5327
[ 84.975817][ T5327] Modules linked in:
[ 84.978295][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 84.983340][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 84.988010][ T5327] RIP: 0010:refcount_warn_saturate+0x9f/0x110
[ 84.990892][ T5327] Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 db e1 11 fd 48 8d 3d b4 e4 87 0b 67 48 0f b9 3a eb 4a e8 c8 e1 11 fd 48 8d 3d b1 e4 87 0b <67> 48 0f b9 3a eb 37 e8 b5 e1 11 fd 48 8d 3d ae e4 87 0b 67 48 0f
[ 84.999648][ T5327] RSP: 0018:ffffc90005587030 EFLAGS: 00010293
[ 85.002472][ T5327] RAX: ffffffff84b3f238 RBX: 0000000000000002 RCX: ffff888000468000
[ 85.006228][ T5327] RDX: 0000000000000000 RSI: ffffffff8f1123e0 RDI: ffffffff903bd6f0
[ 85.009851][ T5327] RBP: 0000000000000000 R08: ffff888000468000 R09: 0000000000000005
[ 85.013467][ T5327] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
[ 85.017274][ T5327] R13: ffffc90005587510 R14: ffff888000931a00 R15: ffff888000931980
[ 85.020817][ T5327] FS: 00007fa865ff56c0(0000) GS:ffff88808c87e000(0000) knlGS:0000000000000000
[ 85.025118][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 85.028042][ T5327] CR2: 00007f39a641f490 CR3: 0000000043f68000 CR4: 0000000000352ef0
[ 85.031565][ T5327] Call Trace:
[ 85.033345][ T5327]
[ 85.034730][ T5327] rxe_net_init+0x2c8/0x330
[ 85.036821][ T5327] rxe_newlink+0xd3/0x1c0
[ 85.038810][ T5327] nldev_newlink+0x5bc/0x650
[ 85.040798][ T5327] ? __pfx_nldev_newlink+0x10/0x10
[ 85.043088][ T5327] ? bpf_lsm_capable+0x9/0x20
[ 85.045241][ T5327] ? security_capable+0x7e/0x2c0
[ 85.047449][ T5327] ? __pfx_nldev_newlink+0x10/0x10
[ 85.049953][ T5327] rdma_nl_rcv+0x6d1/0xa10
[ 85.052049][ T5327] ? __pfx_rdma_nl_rcv+0x10/0x10
[ 85.054201][ T5327] ? netlink_deliver_tap+0x2e/0x1b0
[ 85.056436][ T5327] ? netlink_deliver_tap+0x2e/0x1b0
[ 85.058650][ T5327] netlink_unicast+0x75c/0x8e0
[ 85.060905][ T5327] netlink_sendmsg+0x813/0xb40
[ 85.062782][ T5327] ? __pfx_netlink_sendmsg+0x10/0x10
[ 85.064794][ T5327] ? aa_sock_msg_perm+0xf1/0x1b0
[ 85.066835][ T5327] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 85.069023][ T5327] ____sys_sendmsg+0x972/0x9f0
[ 85.071135][ T5327] ? __might_fault+0xaf/0x130
[ 85.073284][ T5327] ? __pfx_____sys_sendmsg+0x10/0x10
[ 85.075601][ T5327] ? import_iovec+0x73/0xa0
[ 85.077474][ T5327] ___sys_sendmsg+0x2a5/0x360
[ 85.079484][ T5327] ? __pfx____sys_sendmsg+0x10/0x10
[ 85.081803][ T5327] ? __fget_files+0x2a/0x420
[ 85.083779][ T5327] ? __fget_files+0x3a0/0x420
[ 85.085893][ T5327] __x64_sys_sendmsg+0x1bd/0x2a0
[ 85.088108][ T5327] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 85.090397][ T5327] ? rcu_is_watching+0x15/0xb0
[ 85.092426][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.095137][ T5327] do_syscall_64+0x15f/0xf80
[ 85.097075][ T5327] ? trace_irq_disable+0x3b/0x140
[ 85.099292][ T5327] ? clear_bhb_loop+0x40/0x90
[ 85.101349][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.103857][ T5327] RIP: 0033:0x7fa869b9ce59
[ 85.105901][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 85.113913][ T5327] RSP: 002b:00007fa865ff4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 85.117305][ T5327] RAX: ffffffffffffffda RBX: 00007fa869e16090 RCX: 00007fa869b9ce59
[ 85.120538][ T5327] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 000000000000000b
[ 85.124148][ T5327] RBP: 00007fa869c32d6f R08: 0000000000000000 R09: 0000000000000000
[ 85.128325][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.131879][ T5327] R13: 00007fa869e16128 R14: 00007fa869e16090 R15: 00007ffe44c79e68
[ 85.136220][ T5327]
[ 85.137478][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 85.140424][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 85.143972][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 85.147741][ T5327] Call Trace:
[ 85.148966][ T5327]
[ 85.150227][ T5327] vpanic+0x56c/0xa60
[ 85.152001][ T5327] ? __pfx__printk+0x10/0x10
[ 85.154058][ T5327] ? __pfx_vpanic+0x10/0x10
[ 85.156095][ T5327] ? is_bpf_text_address+0x292/0x2b0
[ 85.158418][ T5327] ? is_bpf_text_address+0x26/0x2b0
[ 85.160776][ T5327] panic+0xc5/0xd0
[ 85.162457][ T5327] ? __pfx_panic+0x10/0x10
[ 85.164487][ T5327] __warn+0x315/0x4c0
[ 85.166274][ T5327] ? refcount_warn_saturate+0x9f/0x110
[ 85.168605][ T5327] ? refcount_warn_saturate+0x9f/0x110
[ 85.171120][ T5327] __report_bug+0x29a/0x540
[ 85.173198][ T5327] ? refcount_warn_saturate+0x9f/0x110
[ 85.175621][ T5327] ? __pfx___report_bug+0x10/0x10
[ 85.177901][ T5327] ? __lock_acquire+0x6b5/0x2cf0
[ 85.179943][ T5327] ? ib_device_get_by_netdev+0x81/0x4f0
[ 85.182340][ T5327] report_bug_entry+0x19a/0x290
[ 85.184471][ T5327] ? refcount_warn_saturate+0x9f/0x110
[ 85.186905][ T5327] ? refcount_warn_saturate+0xa4/0x110
[ 85.189327][ T5327] handle_bug+0xce/0x200
[ 85.191276][ T5327] exc_invalid_op+0x1a/0x50
[ 85.193342][ T5327] asm_exc_invalid_op+0x1a/0x20
[ 85.195537][ T5327] RIP: 0010:refcount_warn_saturate+0x9f/0x110
[ 85.198217][ T5327] Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 db e1 11 fd 48 8d 3d b4 e4 87 0b 67 48 0f b9 3a eb 4a e8 c8 e1 11 fd 48 8d 3d b1 e4 87 0b <67> 48 0f b9 3a eb 37 e8 b5 e1 11 fd 48 8d 3d ae e4 87 0b 67 48 0f
[ 85.205354][ T5327] RSP: 0018:ffffc90005587030 EFLAGS: 00010293
[ 85.208004][ T5327] RAX: ffffffff84b3f238 RBX: 0000000000000002 RCX: ffff888000468000
[ 85.211487][ T5327] RDX: 0000000000000000 RSI: ffffffff8f1123e0 RDI: ffffffff903bd6f0
[ 85.214915][ T5327] RBP: 0000000000000000 R08: ffff888000468000 R09: 0000000000000005
[ 85.218412][ T5327] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
[ 85.221848][ T5327] R13: ffffc90005587510 R14: ffff888000931a00 R15: ffff888000931980
[ 85.225279][ T5327] ? refcount_warn_saturate+0x98/0x110
[ 85.227875][ T5327] rxe_net_init+0x2c8/0x330
[ 85.230430][ T5327] rxe_newlink+0xd3/0x1c0
[ 85.232911][ T5327] nldev_newlink+0x5bc/0x650
[ 85.235391][ T5327] ? __pfx_nldev_newlink+0x10/0x10
[ 85.237784][ T5327] ? bpf_lsm_capable+0x9/0x20
[ 85.239964][ T5327] ? security_capable+0x7e/0x2c0
[ 85.242177][ T5327] ? __pfx_nldev_newlink+0x10/0x10
[ 85.244475][ T5327] rdma_nl_rcv+0x6d1/0xa10
[ 85.246402][ T5327] ? __pfx_rdma_nl_rcv+0x10/0x10
[ 85.248613][ T5327] ? netlink_deliver_tap+0x2e/0x1b0
[ 85.250871][ T5327] ? netlink_deliver_tap+0x2e/0x1b0
[ 85.253154][ T5327] netlink_unicast+0x75c/0x8e0
[ 85.255081][ T5327] netlink_sendmsg+0x813/0xb40
[ 85.257161][ T5327] ? __pfx_netlink_sendmsg+0x10/0x10
[ 85.259420][ T5327] ? aa_sock_msg_perm+0xf1/0x1b0
[ 85.261559][ T5327] ? bpf_lsm_socket_sendmsg+0x9/0x20
[ 85.263798][ T5327] ____sys_sendmsg+0x972/0x9f0
[ 85.265803][ T5327] ? __might_fault+0xaf/0x130
[ 85.267726][ T5327] ? __pfx_____sys_sendmsg+0x10/0x10
[ 85.270071][ T5327] ? import_iovec+0x73/0xa0
[ 85.272108][ T5327] ___sys_sendmsg+0x2a5/0x360
[ 85.274242][ T5327] ? __pfx____sys_sendmsg+0x10/0x10
[ 85.276588][ T5327] ? __fget_files+0x2a/0x420
[ 85.278545][ T5327] ? __fget_files+0x3a0/0x420
[ 85.280475][ T5327] __x64_sys_sendmsg+0x1bd/0x2a0
[ 85.282581][ T5327] ? __pfx___x64_sys_sendmsg+0x10/0x10
[ 85.284977][ T5327] ? rcu_is_watching+0x15/0xb0
[ 85.287010][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.289620][ T5327] do_syscall_64+0x15f/0xf80
[ 85.291549][ T5327] ? trace_irq_disable+0x3b/0x140
[ 85.293670][ T5327] ? clear_bhb_loop+0x40/0x90
[ 85.295678][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.298149][ T5327] RIP: 0033:0x7fa869b9ce59
[ 85.299955][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 85.307808][ T5327] RSP: 002b:00007fa865ff4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 85.311140][ T5327] RAX: ffffffffffffffda RBX: 00007fa869e16090 RCX: 00007fa869b9ce59
[ 85.314397][ T5327] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 000000000000000b
[ 85.317737][ T5327] RBP: 00007fa869c32d6f R08: 0000000000000000 R09: 0000000000000000
[ 85.320994][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 85.324201][ T5327] R13: 00007fa869e16128 R14: 00007fa869e16090 R15: 00007ffe44c79e68
[ 85.327541][ T5327]
[ 85.329317][ T5327] Kernel Offset: disabled
[ 85.331231][ T5327] Rebooting in 86400 seconds..