From: syzbot <syzbot+f5baf1a1df3261c2ad8d@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, horms@kernel.org,
kuba@kernel.org, linux-kernel@vger.kernel.org,
linux-sctp@vger.kernel.org, lucien.xin@gmail.com,
marcelo.leitner@gmail.com, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [sctp?] WARNING: refcount bug in sctp_generate_timeout_event (4)
Date: Tue, 01 Sep 2026 06:58:29 -0700 [thread overview]
Message-ID: <6a96da05.08473e0e.15b4ac.0001.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: bf1079577a11 Merge tag 'sched_ext-for-7.3-rc1-fixes' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17d06d9e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
dashboard link: https://syzkaller.appspot.com/bug?extid=f5baf1a1df3261c2ad8d
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c52dc60311d3/disk-bf107957.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/37591d96a65b/vmlinux-bf107957.xz
kernel image: https://storage.googleapis.com/syzbot-assets/729e80af6e39/bzImage-bf107957.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f5baf1a1df3261c2ad8d@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#1: syz.0.2220/13955
Modules linked in:
CPU: 1 UID: 0 PID: 13955 Comm: syz.0.2220 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 6b d2 e9 fc 48 8d 3d f4 46 a7 0b 67 48 0f b9 3a eb 4a e8 58 d2 e9 fc 48 8d 3d f1 46 a7 0b <67> 48 0f b9 3a eb 37 e8 45 d2 e9 fc 48 8d 3d ee 46 a7 0b 67 48 0f
RSP: 0018:ffffc90000a18c28 EFLAGS: 00010246
RAX: ffffffff84dde548 RBX: 0000000000000002 RCX: ffff88807715be80
RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffffffff90852c40
RBP: 0000000000000000 R08: ffff88807715be80 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000100 R12: dffffc0000000000
R13: 0000000000000001 R14: ffff888020fde004 R15: ffff888020fde640
FS: 00007f4a87be06c0(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff55dd92eb8 CR3: 000000005800b000 CR4: 0000000000350ef0
Call Trace:
<IRQ>
sctp_generate_timeout_event+0x1c8/0x390 net/sctp/sm_sideeffect.c:284
call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x226/0x860 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
invoke_softirq kernel/softirq.c:519 [inline]
__irq_exit_rcu+0xcb/0x220 kernel/softirq.c:767
irq_exit_rcu+0x9/0x30 kernel/softirq.c:784
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5913
Code: ff ff ff e8 a0 a9 40 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 f2 44 f1 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 ba 25 6d ff cc 48 8d 3d 77 31 da
RSP: 0018:ffffc9000dabfac8 EFLAGS: 00000282
RAX: b29753db72d85c00 RBX: 0000000000000001 RCX: 8000000000000001
RDX: 00000000b866b3b2 RSI: ffffffff8e6fc28f RDI: ffffffff8c6d9380
RBP: ffff88807715be80 R08: 8c00000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888066f6e418 R12: ffff888066f6e418
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
__io_cq_lock io_uring/io_uring.c:484 [inline]
__io_submit_flush_completions+0x85/0x10d0 io_uring/io_uring.c:1133
io_submit_flush_completions io_uring/io_uring.h:253 [inline]
io_submit_state_end io_uring/io_uring.c:1939 [inline]
io_submit_sqes+0x1cec/0x2310 io_uring/io_uring.c:2063
__do_sys_io_uring_enter io_uring/io_uring.c:2637 [inline]
__se_sys_io_uring_enter+0x35b/0x1bb0 io_uring/io_uring.c:2586
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4a86d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4a87bdff38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007f4a86d9e159
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000009
RBP: 0000000000000a12 R08: 0000000000000000 R09: 0000000000000008
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000940
R13: 0000200000000948 R14: 0000000000000e26 R15: 0000000000000002
</TASK>
----------------
Code disassembly (best guess):
0: eb 66 jmp 0x68
2: 85 db test %ebx,%ebx
4: 74 3e je 0x44
6: 83 fb 01 cmp $0x1,%ebx
9: 75 4c jne 0x57
b: e8 6b d2 e9 fc call 0xfce9d27b
10: 48 8d 3d f4 46 a7 0b lea 0xba746f4(%rip),%rdi # 0xba7470b
17: 67 48 0f b9 3a ud1 (%edx),%rdi
1c: eb 4a jmp 0x68
1e: e8 58 d2 e9 fc call 0xfce9d27b
23: 48 8d 3d f1 46 a7 0b lea 0xba746f1(%rip),%rdi # 0xba7471b
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb 37 jmp 0x68
31: e8 45 d2 e9 fc call 0xfce9d27b
36: 48 8d 3d ee 46 a7 0b lea 0xba746ee(%rip),%rdi # 0xba7472b
3d: 67 addr32
3e: 48 rex.W
3f: 0f .byte 0xf
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-09-01 13:58 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a96da05.08473e0e.15b4ac.0001.GAE@google.com \
--to=syzbot+f5baf1a1df3261c2ad8d@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.