WARNING in refcount_sub_and_test (2)

Hello,

syzbot hit the following crash on bpf-next commit
22527437e0a0c96ee3153e9d0382942b0fd4f9dd (Thu Mar 29 02:36:15 2018 +0000)
Merge branch 'nfp-bpf-updates'
syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=c7b0dde061c523bc4b0f

C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5996614741131264
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5947747274326016
Raw console output: https://syzkaller.appspot.com/x/log.txt?id=6215237837520896
Kernel config: https://syzkaller.appspot.com/x/.config?id=-1280663959502969741
compiler: gcc (GCC) 7.1.1 20170620

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: <redacted>
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.

R13: 0030656c69662f2e R14: 0000000000000005 R15: 2f30656c69662f2e
------------[ cut here ]------------
------------[ cut here ]------------
refcount_t: increment on 0; use-after-free.
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 4450 at lib/refcount.c:187 refcount_sub_and_test+0x167/0x1b0 lib/refcount.c:187
WARNING: CPU: 1 PID: 4460 at lib/refcount.c:153 refcount_inc+0x47/0x50 lib/refcount.c:153
Kernel panic - not syncing: panic_on_warn set ...

Modules linked in:
CPU: 0 PID: 4450 Comm: syzkaller428798 Not tainted 4.16.0-rc6+ #40
CPU: 1 PID: 4460 Comm: syzkaller428798 Not tainted 4.16.0-rc6+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
RIP: 0010:refcount_inc+0x47/0x50 lib/refcount.c:153
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
RSP: 0018:ffff8801b534f860 EFLAGS: 00010286
RAX: dffffc0000000008 RBX: ffff8801b1b8c184 RCX: ffffffff815ba4be
 panic+0x1e4/0x41c kernel/panic.c:183
RDX: 0000000000000000 RSI: 1ffff10036a69ebc RDI: 1ffff10036a69e91

123 more lines

On Fri, Mar 30, 2018 at 12:01 AM, syzbot
[off-list ref] wrote:

Hello,

syzbot hit the following crash on bpf-next commit
22527437e0a0c96ee3153e9d0382942b0fd4f9dd (Thu Mar 29 02:36:15 2018 +0000)
Merge branch 'nfp-bpf-updates'
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=c7b0dde061c523bc4b0f

C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5996614741131264
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=5947747274326016
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=6215237837520896
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-1280663959502969741
compiler: gcc (GCC) 7.1.1 20170620

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: <redacted>
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

Messed kernel output.

#syz dup: WARNING: refcount bug in sk_alloc

R13: 0030656c69662f2e R14: 0000000000000005 R15: 2f30656c69662f2e
------------[ cut here ]------------
------------[ cut here ]------------
refcount_t: increment on 0; use-after-free.
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 4450 at lib/refcount.c:187
refcount_sub_and_test+0x167/0x1b0 lib/refcount.c:187
WARNING: CPU: 1 PID: 4460 at lib/refcount.c:153 refcount_inc+0x47/0x50
lib/refcount.c:153
Kernel panic - not syncing: panic_on_warn set ...

Modules linked in:
CPU: 0 PID: 4450 Comm: syzkaller428798 Not tainted 4.16.0-rc6+ #40
CPU: 1 PID: 4460 Comm: syzkaller428798 Not tainted 4.16.0-rc6+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
RIP: 0010:refcount_inc+0x47/0x50 lib/refcount.c:153
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
RSP: 0018:ffff8801b534f860 EFLAGS: 00010286
RAX: dffffc0000000008 RBX: ffff8801b1b8c184 RCX: ffffffff815ba4be
 panic+0x1e4/0x41c kernel/panic.c:183
RDX: 0000000000000000 RSI: 1ffff10036a69ebc RDI: 1ffff10036a69e91
RBP: ffff8801b534f868 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b534faf8
R13: ffff8801b04db513 R14: ffff8801b1b8c180 R15: ffff8801b04db501
FS:  00000000008e6880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 __warn+0x1dc/0x200 kernel/panic.c:547
CR2: 00000000006ea510 CR3: 00000001b106f005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 report_bug+0x1f4/0x2b0 lib/bug.c:186
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
Call Trace:
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296

121 more quoted lines