TITLE: WARNING: refcount bug in __vma_enter_locked
TYPE: REFCOUNT_WARNING
FRAME: __vma_enter_locked
EXECUTOR: proc=3, id=20


[   99.057804][ T6051] ------------[ cut here ]------------
[   99.063495][ T6051] refcount_t: saturated; leaking memory.
[   99.069428][ T6051] WARNING: lib/refcount.c:19 at 0x0, CPU#1: syz.3.20/6051
[   99.078460][ T6051] Modules linked in:
[   99.082515][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) 
[   99.084063][ T5884] Bluetooth: hci3: command tx timeout
[   99.091778][ T6051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[   99.108470][ T6051] RIP: 0010:refcount_warn_saturate+0xc5/0x110
[   99.115982][ T6051] Code: 91 0e 33 0b 67 48 0f b9 3a eb 37 e8 95 1c 2b fd 48 8d 3d 8e 0e 33 0b 67 48 0f b9 3a eb 24 e8 82 1c 2b fd 48 8d 3d 8b 0e 33 0b <67> 48 0f b9 3a eb 11 e8 6f 1c 2b fd 48 8d 3d 88 0e 33 0b 67 48 0f
[   99.135953][ T6051] RSP: 0018:ffffc90003017568 EFLAGS: 00010293
[   99.142036][ T6051] RAX: ffffffff8496c3fe RBX: 0000000000000000 RCX: ffff888033329e80
[   99.150505][ T6051] RDX: 0000000000000000 RSI: ffffffff8ea87240 RDI: ffffffff8fc9d290
[   99.159979][ T6051] RBP: ffffc90003017690 R08: ffff888033329e80 R09: 0000000000000005
[   99.168296][ T6051] R10: 0000000000000004 R11: 0000000000000000 R12: ffff888074927bc0
[   99.176450][ T6051] R13: ffff888074927b40 R14: ffff888074927bc0 R15: 0000000000000000
[   99.184247][ T3067] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   99.184486][ T6051] FS:  00007f3c56b436c0(0000) GS:ffff888125b41000(0000) knlGS:0000000000000000
[   99.200803][ T6051] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   99.208522][ T6051] CR2: 00007fc5622e2a90 CR3: 0000000074a98000 CR4: 00000000003526f0
[   99.217473][ T6051] Call Trace:
[   99.220803][ T6051]  <TASK>
[   99.223753][ T6051]  __vma_enter_locked+0x62e/0x6a0
[   99.229335][ T6051]  ? __vma_start_write+0x23/0x140
[   99.235141][ T6051]  ? __pfx___vma_enter_locked+0x10/0x10
[   99.240967][ T6051]  __vma_start_write+0x23/0x140
[   99.246265][ T6051]  vma_modify+0xf62/0x1a70
[   99.250960][ T6051]  vma_modify_flags_uffd+0x204/0x250
[   99.256449][ T6051]  ? __pfx_vma_modify_flags_uffd+0x10/0x10
[   99.262313][ T6051]  ? mas_find+0xb0e/0xd30
[   99.266871][ T6051]  userfaultfd_release_all+0x34c/0x5d0
[   99.272385][ T6051]  ? __pfx_userfaultfd_release_all+0x10/0x10
[   99.279680][ T6051]  userfaultfd_release+0xe7/0x1b0
[   99.284853][ T6051]  ? __pfx_userfaultfd_release+0x10/0x10
[   99.290503][ T6051]  ? preempt_schedule_common+0x83/0xd0
[   99.296110][ T6051]  ? preempt_schedule+0xae/0xc0
[   99.301081][ T6051]  ? __pfx_preempt_schedule+0x10/0x10
[   99.306683][ T6051]  ? evm_file_release+0x107/0x1e0
[   99.312839][ T6051]  ? __pfx_userfaultfd_release+0x10/0x10
[   99.320116][ T6051]  __fput+0x44c/0xa70
[   99.324441][ T6051]  task_work_run+0x1d4/0x260
[   99.329243][ T6051]  ? __pfx_task_work_run+0x10/0x10
[   99.334445][ T6051]  get_signal+0x11ec/0x1340
[   99.338989][ T6051]  arch_do_signal_or_restart+0x9a/0x7a0
[   99.344642][ T6051]  ? __pfx_task_work_add+0x10/0x10
[   99.349787][ T6051]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[   99.356052][ T6051]  ? __fput_deferred+0x215/0x390
[   99.361030][ T6051]  ? exit_to_user_mode_loop+0x55/0x4f0
[   99.366760][ T6051]  exit_to_user_mode_loop+0x87/0x4f0
[   99.372084][ T6051]  ? rcu_is_watching+0x15/0xb0
[   99.377392][ T6051]  do_syscall_64+0x2e3/0xf80
[   99.382025][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.388226][ T6051]  ? clear_bhb_loop+0x60/0xb0
[   99.392940][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.399055][ T6051] RIP: 0033:0x7f3c55d8f749
[   99.403592][ T6051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   99.424712][ T6051] RSP: 002b:00007f3c56b43038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   99.433370][ T6051] RAX: fffffffffffffffc RBX: 00007f3c55fe5fa0 RCX: 00007f3c55d8f749
[   99.443455][ T6051] RDX: 0000200000000100 RSI: 00000000c028aa05 RDI: 0000000000000003
[   99.451556][ T6051] RBP: 00007f3c55e13f91 R08: 0000000000000000 R09: 0000000000000000
[   99.460458][ T6051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   99.468534][ T6051] R13: 00007f3c55fe6038 R14: 00007f3c55fe5fa0 R15: 00007ffe60821b78
[   99.477252][ T6051]  </TASK>
