Dear developers and maintainers,
I found a new possible kernel bug titiled "WARNING: refcount bug in sctp_transport_put " while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc7)related to sctp protocol, and it was able to be triggered.
The bug info is:
kernel revision: v6.13-rc7
OOPS message: KASAN: WARNING: refcount bug in sctp_transport_put
reproducer:NO
After preliminary analysis, I found this refcount-UAF bug is about struct sctp_transport and maybe a concurrent bug:
thread0: thread1: (IRQ)
sysvec_apic_timer_interrupt
…… run_timer_softirq
sctp_association_free expire_timers
sctp_transport_free call_timer_fn refcnt=1
sctp_transport_put sctp_generate_heartbeat_event
kfree sctp_transport_put
refcount_dec_and_test refcnt=0 [Error]
I hope this info will help you .
If you fix this issue, please add the following tag to the commit:
Reported-by: yan kang <kangyan91@xxxxxxxxxxx>
Reported-by: yue sun <samsun1006219@xxxxxxxxx
I hope it helps.
Best regards
yan kang
Kernel crash log is below.
==================================================================
[ 392.221643][ C1] ------------[ cut here ]------------
[ 392.222326][ C1] refcount_t: underflow; use-after-free.
[ 392.222925][ C1] WARNING: CPU: 1 PID: 32801 at lib/refcount.c:32 refcount_warn_saturate+0x2e6/0x330
[ 392.223665][ C1] Modules linked in:
[ 392.224011][ C1] CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
[ 392.225039][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 392.225815][ C1] RIP: 0010:refcount_warn_saturate+0x2e6/0x330
[ 392.226297][ C1] Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
[ 392.228110][T32797] kcov: [INFO_KY_KERNEL] krefcnt ioctl KCOV_ENABLE Begin
[ 392.240314][ C1] RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
[ 392.240355][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
[ 392.240360][ C1] RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
[ 392.240364][ C1] RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
[ 392.240368][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
[ 392.240372][ C1] R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
[ 392.240376][ C1] FS: 00007f848d8d6640(0000) GS:ffff888135e00000(0000) knlGS:0000000000000000
[ 392.240400][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 392.240413][ C1] CR2: 00007f848220f000 CR3: 0000000050830000 CR4: 0000000000752ef0
[ 392.240445][ C1] DR0: 0000000000000006 DR1: 000000000000000d DR2: 0000000000000003
[ 392.240459][ C1] DR3: 0000000000000001 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 392.240474][ C1] PKRU: 80000000
[ 392.240488][ C1] Call Trace:
[ 392.240496][ C1] <IRQ>
[ 392.240560][ C1] ? __warn+0xea/0x3d0
[ 392.240620][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.240660][ C1] ? report_bug+0x2e1/0x500
[ 392.240832][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.240908][ C1] ? refcount_warn_saturate+0x2e7/0x330
[ 392.240934][ C1] ? handle_bug+0xe5/0x180
[ 392.240990][ C1] ? exc_invalid_op+0x35/0x80
[ 392.241015][ C1] ? asm_exc_invalid_op+0x1a/0x20
[ 392.241058][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.241154][ C1] ? __warn_printk+0x17a/0x310
[ 392.241240][ C1] ? __warn_printk+0x187/0x310
[ 392.241249][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.241258][ C1] ? refcount_warn_saturate+0x2e5/0x330
[ 392.241265][ C1] ? __pfx_refcount_warn_saturate+0x10/0x10
[ 392.241317][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.241347][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.241380][ C1] ? __run_timers+0x668/0x900
[ 392.241387][ C1] ? run_timer_base+0xc5/0x120
[ 392.241414][ C1] ? run_timer_softirq+0x1a/0x40
[ 392.241436][ C1] ? handle_softirqs+0x1bf/0x850
[ 392.241477][ C1] ? do_raw_spin_unlock+0x174/0x230
[ 392.241498][ C1] ? _raw_spin_unlock+0x28/0x50
[ 392.241538][ C1] ? sctp_generate_heartbeat_event+0x171/0x490
[ 392.241555][ C1] ? sctp_assoc_add_peer+0x2d9/0x1520
[ 392.241597][ C1] sctp_transport_put+0x172/0x1d0
[ 392.241639][ C1] call_timer_fn+0x1a6/0x620
[ 392.241668][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.241678][ C1] ? __pfx_call_timer_fn+0x10/0x10
[ 392.241693][ C1] ? __pfx_lock_release+0x10/0x10
[ 392.241725][ C1] ? mark_held_locks+0x9f/0xe0
[ 392.241741][ C1] ? _raw_spin_unlock_irq+0x23/0x50
[ 392.241759][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.241858][ C1] __run_timers+0x668/0x900
[ 392.241889][ C1] ? __pfx___run_timers+0x10/0x10
[ 392.241905][ C1] ? rcu_is_watching+0x12/0xc0
[ 392.241955][ C1] ? do_raw_spin_lock+0x12c/0x2b0
[ 392.241971][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.242013][ C1] ? lock_acquire+0x32/0xc0
[ 392.242029][ C1] ? run_timer_base+0xbd/0x120
[ 392.242083][ C1] run_timer_base+0xc5/0x120
[ 392.242104][ C1] run_timer_softirq+0x1a/0x40
[ 392.242110][ C1] handle_softirqs+0x1bf/0x850
[ 392.242129][ C1] __irq_exit_rcu+0x109/0x170
[ 392.242151][ C1] irq_exit_rcu+0x9/0x30
[ 392.242157][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 392.242186][ C1] </IRQ>
[ 392.242198][ C1] <TASK>
[ 392.242212][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 392.242277][ C1] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50
[ 392.242310][ C1] Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
[ 392.242330][ C1] RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
[ 392.242385][ C1] RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
[ 392.242389][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[ 392.242425][ C1] RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
[ 392.242449][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
[ 392.242489][ C1] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 392.242547][ C1] shmem_add_to_page_cache+0x5ef/0xaf0
[ 392.242618][ C1] ? __pfx_shmem_add_to_page_cache+0x10/0x10
[ 392.242650][ C1] shmem_alloc_and_add_folio+0x56b/0xb90
[ 392.242712][ C1] ? __lock_acquire+0x157d/0x3c80
[ 392.242775][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[ 392.242837][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 392.242897][ C1] ? shmem_allowable_huge_orders+0x1c2/0x6c0
[ 392.242938][ C1] shmem_get_folio_gfp+0x593/0x14e0
[ 392.243062][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10
[ 392.243090][ C1] shmem_write_begin+0x14e/0x310
[ 392.243146][ C1] ? __pfx_fault_in_readable+0x10/0x10
[ 392.243202][ C1] ? __pfx_shmem_write_begin+0x10/0x10
[ 392.243236][ C1] generic_perform_write+0x2bd/0x900
[ 392.243313][ C1] ? __pfx_generic_perform_write+0x10/0x10
[ 392.243352][ C1] ? inode_needs_update_time.part.0+0x191/0x270
[ 392.243382][ C1] shmem_file_write_iter+0x111/0x140
[ 392.243411][ C1] vfs_write+0xc02/0x10d0
[ 392.243460][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10
[ 392.243501][ C1] ? __pfx_vfs_write+0x10/0x10
[ 392.243527][ C1] ? __fget_files+0x40/0x3a0
[ 392.243563][ C1] ksys_write+0x122/0x240
[ 392.243591][ C1] ? __pfx_ksys_write+0x10/0x10
[ 392.243686][ C1] do_syscall_64+0xcb/0x250
[ 392.243771][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 392.243791][ C1] RIP: 0033:0x7f848cb9ea3f
[ 392.243800][ C1] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
[ 392.243816][ C1] RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 392.243842][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
[ 392.243855][ C1] RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
[ 392.243899][ C1] RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
[ 392.243931][ C1] R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
[ 392.243957][ C1] R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
[ 392.244000][ C1] </TASK>
[ 392.244010][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 392.244047][ C1] CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
[ 392.244081][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 392.244099][ C1] Call Trace:
[ 392.244108][ C1] <IRQ>
[ 392.244111][ C1] dump_stack_lvl+0x3d/0x1b0
[ 392.244121][ C1] panic+0x6fd/0x7b0
[ 392.244130][ C1] ? __pfx_panic+0x10/0x10
[ 392.244184][ C1] ? show_trace_log_lvl+0x284/0x390
[ 392.244254][ C1] ? check_panic_on_warn+0x1f/0xc0
[ 392.244284][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244292][ C1] check_panic_on_warn+0xb1/0xc0
[ 392.244314][ C1] __warn+0xf6/0x3d0
[ 392.244333][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244361][ C1] report_bug+0x2e1/0x500
[ 392.244375][ C1] ? refcount_warn_saturate+0x2e6/0x330
[ 392.244404][ C1] ? refcount_warn_saturate+0x2e7/0x330
[ 392.244421][ C1] handle_bug+0xe5/0x180
[ 392.244455][ C1] exc_invalid_op+0x35/0x80
[ 392.244472][ C1] asm_exc_invalid_op+0x1a/0x20
[ 392.244484][ C1] RIP: 0010:refcount_warn_saturate+0x2e6/0x330
[ 392.244491][ C1] Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
[ 392.244510][ C1] RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
[ 392.244565][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
[ 392.244636][ C1] RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
[ 392.244653][ C1] RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
[ 392.244697][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
[ 392.244716][ C1] R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
[ 392.244747][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.244799][ C1] ? __warn_printk+0x17a/0x310
[ 392.244836][ C1] ? __warn_printk+0x187/0x310
[ 392.244875][ C1] ? refcount_warn_saturate+0x2e5/0x330
[ 392.244903][ C1] ? __pfx_refcount_warn_saturate+0x10/0x10
[ 392.244957][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.244963][ C1] ? call_timer_fn+0x1a6/0x620
[ 392.244971][ C1] ? __run_timers+0x668/0x900
[ 392.245006][ C1] ? run_timer_base+0xc5/0x120
[ 392.245033][ C1] ? run_timer_softirq+0x1a/0x40
[ 392.245056][ C1] ? handle_softirqs+0x1bf/0x850
[ 392.245067][ C1] ? do_raw_spin_unlock+0x174/0x230
[ 392.245114][ C1] ? _raw_spin_unlock+0x28/0x50
[ 392.245123][ C1] ? sctp_generate_heartbeat_event+0x171/0x490
[ 392.245203][ C1] ? sctp_assoc_add_peer+0x2d9/0x1520
[ 392.245246][ C1] sctp_transport_put+0x172/0x1d0
[ 392.245263][ C1] call_timer_fn+0x1a6/0x620
[ 392.245273][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.245295][ C1] ? __pfx_call_timer_fn+0x10/0x10
[ 392.245307][ C1] ? __pfx_lock_release+0x10/0x10
[ 392.245316][ C1] ? mark_held_locks+0x9f/0xe0
[ 392.245337][ C1] ? _raw_spin_unlock_irq+0x23/0x50
[ 392.245380][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10
[ 392.245424][ C1] __run_timers+0x668/0x900
[ 392.245433][ C1] ? __pfx___run_timers+0x10/0x10
[ 392.245437][ C1] ? rcu_is_watching+0x12/0xc0
[ 392.245443][ C1] ? do_raw_spin_lock+0x12c/0x2b0
[ 392.245449][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 392.245454][ C1] ? lock_acquire+0x32/0xc0
[ 392.245458][ C1] ? run_timer_base+0xbd/0x120
[ 392.245466][ C1] run_timer_base+0xc5/0x120
[ 392.245471][ C1] run_timer_softirq+0x1a/0x40
[ 392.245475][ C1] handle_softirqs+0x1bf/0x850
[ 392.245484][ C1] __irq_exit_rcu+0x109/0x170
[ 392.245489][ C1] irq_exit_rcu+0x9/0x30
[ 392.245493][ C1] sysvec_apic_timer_interrupt+0xa8/0xc0
[ 392.245499][ C1] </IRQ>
[ 392.245501][ C1] <TASK>
[ 392.245505][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 392.245508][ C1] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50
[ 392.245513][ C1] Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
[ 392.245517][ C1] RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
[ 392.245522][ C1] RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
[ 392.245525][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[ 392.245528][ C1] RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
[ 392.245532][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
[ 392.245535][ C1] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 392.245545][ C1] shmem_add_to_page_cache+0x5ef/0xaf0
[ 392.245552][ C1] ? __pfx_shmem_add_to_page_cache+0x10/0x10
[ 392.245563][ C1] shmem_alloc_and_add_folio+0x56b/0xb90
[ 392.245571][ C1] ? __lock_acquire+0x157d/0x3c80
[ 392.245575][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[ 392.245580][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 392.245586][ C1] ? shmem_allowable_huge_orders+0x1c2/0x6c0
[ 392.245594][ C1] shmem_get_folio_gfp+0x593/0x14e0
[ 392.245602][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10
[ 392.245611][ C1] shmem_write_begin+0x14e/0x310
[ 392.245617][ C1] ? __pfx_fault_in_readable+0x10/0x10
[ 392.245622][ C1] ? __pfx_shmem_write_begin+0x10/0x10
[ 392.245631][ C1] generic_perform_write+0x2bd/0x900
[ 392.245640][ C1] ? __pfx_generic_perform_write+0x10/0x10
[ 392.245646][ C1] ? inode_needs_update_time.part.0+0x191/0x270
[ 392.245654][ C1] shmem_file_write_iter+0x111/0x140
[ 392.245661][ C1] vfs_write+0xc02/0x10d0
[ 392.245666][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10
[ 392.245673][ C1] ? __pfx_vfs_write+0x10/0x10
[ 392.245679][ C1] ? __fget_files+0x40/0x3a0
[ 392.245691][ C1] ksys_write+0x122/0x240
[ 392.245696][ C1] ? __pfx_ksys_write+0x10/0x10
[ 392.245705][ C1] do_syscall_64+0xcb/0x250
[ 392.245712][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 392.245717][ C1] RIP: 0033:0x7f848cb9ea3f
[ 392.245721][ C1] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
[ 392.245725][ C1] RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 392.245730][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
[ 392.245733][ C1] RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
[ 392.245736][ C1] RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
[ 392.245739][ C1] R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
[ 392.245742][ C1] R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
[ 392.245752][ C1] </TASK>
[ 392.246649][ C1] Kernel Offset: disabled
==================================================================
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 32801 at lib/refcount.c:32 refcount_warn_saturate+0x2e6/0x330 lib/refcount.c:32
Modules linked in:
CPU: 1 UID: 0 PID: 32801 Comm: syz.4.1477 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x2e6/0x330 lib/refcount.c:32
Code: ff 89 de e8 ac a6 00 fd 84 db 0f 85 97 fe ff ff e8 cf a3 00 fd c6 05 d1 32 8f 0b 01 90 48 c7 c7 60 4c b1 8b e8 5b 80 c1 fc 90 <0f> 0b 90 90 e9 74 fe ff ff e8 ac a3 00 fd c6 05 ad 32 8f 0b 01 90
RSP: 0018:ffffc900001e8c38 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81599efa
RDX: ffff888107c22500 RSI: ffffffff81599f07 RDI: 0000000000000001
RBP: 1ffff9200003d187 R08: 0000000000000001 R09: ffffed1026bc5181
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
R13: ffffffff81856376 R14: 1ffff9200003d1a8 R15: 000000000003d98c
FS: 00007f848d8d6640(0000) GS:ffff888135e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f848220f000 CR3: 0000000050830000 CR4: 0000000000752ef0
DR0: 0000000000000006 DR1: 000000000000000d DR2: 0000000000000003
DR3: 0000000000000001 DR6: 00000000fffe07f0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<IRQ>
__refcount_sub_and_test include/linux/refcount.h:296 [inline]
__refcount_dec_and_test include/linux/refcount.h:333 [inline]
refcount_dec_and_test include/linux/refcount.h:354 [inline]
sctp_transport_put+0x172/0x1d0 net/sctp/transport.c:483
call_timer_fn+0x1a6/0x620 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1844 [inline]
__run_timers+0x668/0x900 kernel/time/timer.c:2418
__run_timer_base kernel/time/timer.c:2430 [inline]
__run_timer_base kernel/time/timer.c:2422 [inline]
run_timer_base+0xc5/0x120 kernel/time/timer.c:2439
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449
handle_softirqs+0x1bf/0x850 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:655
irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa8/0xc0 arch/x86/kernel/apic/apic.c:1049
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 5a 3c 59 f6 48 89 ef e8 b2 b1 59 f6 e8 4d f8 83 f6 fb bf 01 00 00 00 <e8> 42 dc 4a f6 65 8b 05 f3 6a e7 74 85 c0 74 06 5d c3 cc cc cc cc
RSP: 0018:ffffc90006ff7800 EFLAGS: 00000202
RAX: 000000000000048f RBX: 0000000000000cc0 RCX: 1ffffffff2d93fdf
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff888106c79dc8 R08: 0000000000000001 R09: fffffbfff2d8a1b1
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90006ff7870
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
spin_unlock_irq include/linux/spinlock.h:401 [inline]
shmem_add_to_page_cache+0x5ef/0xaf0 mm/shmem.c:830
shmem_alloc_and_add_folio+0x56b/0xb90 mm/shmem.c:1859
shmem_get_folio_gfp+0x593/0x14e0 mm/shmem.c:2355
shmem_get_folio mm/shmem.c:2461 [inline]
shmem_write_begin+0x14e/0x310 mm/shmem.c:3117
generic_perform_write+0x2bd/0x900 mm/filemap.c:4055
shmem_file_write_iter+0x111/0x140 mm/shmem.c:3293
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xc02/0x10d0 fs/read_write.c:679
ksys_write+0x122/0x240 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f848cb9ea3f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 79 0d 03 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 bc 0d 03 00 48
RSP: 002b:00007f848d8d5d40 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f848cb9ea3f
RDX: 0000000000010000 RSI: 00007f8482200000 RDI: 0000000000000003
RBP: 000000000000023b R08: 0000000000000000 R09: 0000000000000237
R10: 00000000000003b2 R11: 0000000000000293 R12: 0000000000000003
R13: 00007f848d8d5e0c R14: 00007f848d8d5e10 R15: 00007f8482200000
</TASK>
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 55 push %rbp
6: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
b: 48 89 fd mov %rdi,%rbp
e: 48 83 c7 18 add $0x18,%rdi
12: e8 5a 3c 59 f6 call 0xf6593c71
17: 48 89 ef mov %rbp,%rdi
1a: e8 b2 b1 59 f6 call 0xf659b1d1
1f: e8 4d f8 83 f6 call 0xf683f871
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 42 dc 4a f6 call 0xf64adc71 <-- trapping instruction
2f: 65 8b 05 f3 6a e7 74 mov %gs:0x74e76af3(%rip),%eax # 0x74e76b29
36: 85 c0 test %eax,%eax
38: 74 06 je 0x40
3a: 5d pop %rbp
3b: c3 ret
3c: cc int3
3d: cc int3
3e: cc int3
3f: cc int3
