TITLE: WARNING: refcount bug in sctp_wfree
TYPE: REFCOUNT_WARNING
PANICKED: Y

[   44.461565] refcount_t: underflow; use-after-free.
[   44.466577] ------------[ cut here ]------------
[   44.471332] WARNING: CPU: 1 PID: 2992 at lib/refcount.c:186 refcount_sub_and_test+0x167/0x1b0
[   44.479978] Kernel panic - not syncing: panic_on_warn set ...
[   44.479978] 
[   44.487309] CPU: 1 PID: 2992 Comm: syzkaller263121 Not tainted 4.14.0-rc5+ #91
[   44.494631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   44.503948] Call Trace:
[   44.506504]  dump_stack+0x194/0x257
[   44.510098]  ? arch_local_irq_restore+0x53/0x53
[   44.514735]  panic+0x1e4/0x417
[   44.517892]  ? __warn+0x1d9/0x1d9
[   44.521307]  ? show_regs_print_info+0x65/0x65
[   44.525774]  ? refcount_sub_and_test+0x167/0x1b0
[   44.530498]  __warn+0x1c4/0x1d9
[   44.533743]  ? refcount_sub_and_test+0x167/0x1b0
[   44.538466]  report_bug+0x211/0x2d0
[   44.542078]  fixup_bug+0x40/0x90
[   44.545410]  do_trap+0x260/0x390
[   44.548743]  do_error_trap+0x120/0x390
[   44.552593]  ? vprintk_emit+0x49b/0x590
[   44.556537]  ? do_trap+0x390/0x390
[   44.560045]  ? refcount_sub_and_test+0x167/0x1b0
[   44.564766]  ? vprintk_emit+0x3ea/0x590
[   44.568710]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   44.573519]  do_invalid_op+0x1b/0x20
[   44.577201]  invalid_op+0x18/0x20
[   44.580618] RIP: 0010:refcount_sub_and_test+0x167/0x1b0
[   44.585944] RSP: 0018:ffff8801d1f4e9c8 EFLAGS: 00010282
[   44.591271] RAX: 0000000000000026 RBX: 0000000000000001 RCX: 0000000000000000
[   44.598504] RDX: 0000000000000026 RSI: 1ffff1003a3e9cf9 RDI: ffffed003a3e9d2d
[   44.605737] RBP: ffff8801d1f4ea58 R08: 0000000000000000 R09: 1ffff1003a3e9ccb
[   44.612969] R10: ffff8801d1f4e7f8 R11: ffffffff85b2cb78 R12: 1ffff1003a3e9d3a
[   44.620203] R13: 00000000ffffff01 R14: 0000000000000100 R15: ffff8801d1d16a3c
[   44.627449]  ? refcount_sub_and_test+0x167/0x1b0
[   44.632170]  ? refcount_inc+0x50/0x50
[   44.635936]  ? __sctp_outq_teardown+0xa5b/0x1230
[   44.640656]  ? sctp_association_free+0x2d0/0x930
[   44.645375]  ? sctp_do_sm+0x271b/0x6a30
[   44.649313]  ? sctp_primitive_SHUTDOWN+0xa0/0xd0
[   44.654031]  ? sctp_close+0x3c6/0x980
[   44.657795]  ? inet_release+0xed/0x1c0
[   44.661648]  ? sock_release+0x8d/0x1e0
[   44.665498]  ? sock_close+0x16/0x20
[   44.669090]  sctp_wfree+0x183/0x620
[   44.672685]  ? entry_SYSCALL_64_fastpath+0xbc/0xbe
[   44.677580]  ? __sctp_write_space+0x910/0x910
[   44.682043]  skb_release_head_state+0x124/0x200
[   44.686676]  skb_release_all+0x15/0x60
[   44.690528]  consume_skb+0x153/0x490
[   44.694202]  ? sctp_chunk_put+0x99/0x420
[   44.698226]  ? alloc_skb_with_frags+0x750/0x750
[   44.702858]  ? sctp_chunk_hold+0x20/0x20
[   44.706884]  ? sctp_sched_dequeue_common+0x2aa/0x5d0
[   44.711952]  ? refcount_sub_and_test+0x115/0x1b0
[   44.716672]  ? refcount_inc+0x50/0x50
[   44.720440]  ? trace_hardirqs_off+0xd/0x10
[   44.724641]  ? quarantine_put+0xeb/0x190
[   44.728672]  sctp_chunk_put+0x29c/0x420
[   44.732615]  ? sctp_chunk_hold+0x20/0x20
[   44.736643]  ? sctp_transport_dst_confirm+0x50/0x50
[   44.741627]  ? sctp_sched_fcfs_dequeue+0x198/0x290
[   44.746522]  ? sctp_sched_dequeue_common+0x5d0/0x5d0
[   44.751594]  sctp_chunk_free+0x53/0x60
[   44.755448]  __sctp_outq_teardown+0xa5b/0x1230
[   44.759997]  ? sctp_inq_set_th_handler+0x1b0/0x1b0
[   44.764894]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   44.770054]  ? check_preempt_wakeup+0x1320/0x1320
[   44.774873]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   44.780030]  ? default_wake_function+0x30/0x50
[   44.784576]  ? autoremove_wake_function+0x78/0x350
[   44.789471]  ? finish_wait+0x490/0x490
[   44.793325]  ? lock_acquire+0x1d5/0x580
[   44.797266]  ? lock_acquire+0x1d5/0x580
[   44.801206]  ? lock_acquire+0x1d5/0x580
[   44.805147]  ? __wake_up_common_lock+0x1c2/0x310
[   44.809879]  ? lock_acquire+0x1d5/0x580
[   44.813821]  ? sock_def_wakeup+0x1f9/0x350
[   44.818023]  ? lock_downgrade+0x990/0x990
[   44.822138]  ? lock_release+0xa40/0xa40
[   44.826078]  ? trace_raw_output_tick_stop+0x130/0x130
[   44.831234]  sctp_outq_free+0x15/0x20
[   44.834999]  sctp_association_free+0x2d0/0x930
[   44.839548]  ? sctp_asconf_queue_teardown+0x700/0x700
[   44.844704]  ? sock_def_wakeup+0x222/0x350
[   44.848907]  ? sk_dst_check+0x560/0x560
[   44.852852]  ? lock_release+0xa40/0xa40
[   44.856794]  ? bpf_prog_kallsyms_find+0xbd/0x440
[   44.861519]  sctp_do_sm+0x271b/0x6a30
[   44.865286]  ? lock_acquire+0x1d5/0x580
[   44.869227]  ? is_bpf_text_address+0x7b/0x120
[   44.873691]  ? sctp_do_8_2_transport_strike.isra.16+0x8a0/0x8a0
[   44.879718]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   44.884875]  ? do_raw_spin_trylock+0x190/0x190
[   44.889429]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   44.894592]  ? lock_acquire+0x1d5/0x580
[   44.898532]  ? lock_acquire+0x1d5/0x580
[   44.902469]  ? skb_dequeue+0x12a/0x180
[   44.906323]  ? lock_downgrade+0x990/0x990
[   44.910438]  ? do_raw_spin_trylock+0x190/0x190
[   44.914986]  ? lock_release+0xa40/0xa40
[   44.918928]  ? trace_hardirqs_on+0xd/0x10
[   44.923045]  sctp_primitive_SHUTDOWN+0xa0/0xd0
[   44.927595]  sctp_close+0x3c6/0x980
[   44.931192]  ? sctp_apply_peer_addr_params+0xf30/0xf30
[   44.936438]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   44.941593]  ? lock_downgrade+0x990/0x990
[   44.945705]  ? lock_downgrade+0x990/0x990
[   44.949821]  ? locks_remove_file+0x3fa/0x5a0
[   44.954195]  ? fcntl_setlk+0x10c0/0x10c0
[   44.958223]  ? bsearch+0x83/0xa0
[   44.961555]  ? __fsnotify_parent+0xb4/0x3a0
[   44.965841]  ? ip_mc_drop_socket+0x1ce/0x230
[   44.970218]  inet_release+0xed/0x1c0
[   44.973901]  sock_release+0x8d/0x1e0
[   44.977581]  ? sock_release+0x1e0/0x1e0
[   44.981521]  sock_close+0x16/0x20
[   44.984942]  __fput+0x327/0x7e0
[   44.988190]  ? fput+0x140/0x140
[   44.991441]  ____fput+0x15/0x20
[   44.994686]  task_work_run+0x199/0x270
[   44.998539]  ? task_work_cancel+0x210/0x210
[   45.002829]  ? __do_page_fault+0x3d6/0xd60
[   45.007032]  get_signal+0x1343/0x16d0
[   45.010798]  ? mm_fault_error+0x2c0/0x2c0
[   45.014910]  ? ptrace_notify+0x130/0x130
[   45.018935]  ? do_page_fault+0xee/0x720
[   45.022874]  ? __do_page_fault+0xd60/0xd60
[   45.027072]  ? do_page_fault+0xee/0x720
[   45.031011]  ? __do_page_fault+0xd60/0xd60
[   45.035210]  ? lock_acquire+0x1d5/0x580
[   45.039147]  ? lock_acquire+0x1d5/0x580
[   45.043093]  do_signal+0x94/0x1ee0
[   45.046597]  ? lock_acquire+0x1d5/0x580
[   45.050533]  ? lock_acquire+0x1d5/0x580
[   45.054470]  ? put_unused_fd+0x62/0x70
[   45.058322]  ? lock_downgrade+0x990/0x990
[   45.062437]  ? setup_sigcontext+0x7d0/0x7d0
[   45.066722]  ? do_raw_spin_trylock+0x190/0x190
[   45.071271]  ? task_work_add+0x10e/0x1b0
[   45.075296]  ? __put_unused_fd+0x183/0x250
[   45.079498]  ? alloc_fdtable+0x280/0x280
[   45.083524]  ? cpumask_weight.constprop.3+0x45/0x45
[   45.088509]  ? _copy_to_user+0xa2/0xc0
[   45.092398]  ? _raw_spin_unlock+0x22/0x30
[   45.096511]  ? fput+0xd2/0x140
[   45.099669]  ? SYSC_accept4+0x4ec/0x850
[   45.103622]  ? kernel_accept+0x2f0/0x2f0
[   45.107668]  exit_to_usermode_loop+0x214/0x310
[   45.112219]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   45.117728]  syscall_return_slowpath+0x42f/0x510
[   45.122448]  ? finish_task_switch+0x1aa/0x740
[   45.126907]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   45.131889]  ? prepare_exit_to_usermode+0x1a0/0x2d0
[   45.136869]  ? perf_trace_sys_enter+0xc20/0xc20
[   45.141502]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   45.146226]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   45.150944] RIP: 0033:0x446539
[   45.154099] RSP: 002b:00007f402614bdc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000120
[   45.161772] RAX: fffffffffffffff2 RBX: 0000000000000000 RCX: 0000000000446539
[   45.169007] RDX: 0000000020137ffc RSI: 0000000020b53ff0 RDI: 0000000000000003
[   45.176244] RBP: 0000000000000000 R08: 00007f402614c700 R09: 00007f402614c700
[   45.183479] R10: 0000000000080000 R11: 0000000000000202 R12: 0000000000000000
[   45.190717] R13: 00000000007efe7f R14: 00007f402614c9c0 R15: 0000000000000000
[   45.198315] Dumping ftrace buffer:
[   45.201822]    (ftrace buffer empty)
[   45.205500] Kernel Offset: disabled
[   45.209092] Rebooting in 86400 seconds..
