WARNING: refcount bug in put_device

[Hui Guo]

Hi Kernel Maintainers,
we found a crash "WARNING: refcount bug in put_device" in upstream, we
also have successfully reproduced it manually:

HEAD Commit: 9852d85ec9d492ebef56dc5f229416c925758edc(tag 'v6.12-rc1')
kernel config: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/6.12.config

console output:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/83e10c2b482009dbb3b32ece907dcc361978f9b9/log0
repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/83e10c2b482009dbb3b32ece907dcc361978f9b9/repro.report
syz reproducer:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/83e10c2b482009dbb3b32ece907dcc361978f9b9/repro.prog
c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/main/9852d85ec9d492ebef56dc5f229416c925758edc/83e10c2b482009dbb3b32ece907dcc361978f9b9/repro.cprog


Please let me know if there is anything I can help with.
Best,
Hui Guo

This is the crash log I got by reproducing the bug based on the above
environment，
I have piped this log through decode_stacktrace.sh to better
understand the cause of the bug.
=============================================================================================
2024/10/15 06:23:01 executed programs: 0
[ 52.946160][ T8459] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 52.948146][ T8459] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 52.949830][ T8459] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 52.951676][ T8459] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 52.953434][ T8459] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 52.955077][ T8459] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 52.978855][ T9837] chnl_net:caif_netlink_parms(): no params data found
[ 53.007227][ T9837] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.008839][ T9837] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.010425][ T9837] bridge_slave_0: entered allmulticast mode
[ 53.011911][ T9837] bridge_slave_0: entered promiscuous mode
[ 53.013568][ T9837] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.015128][ T9837] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.016866][ T9837] bridge_slave_1: entered allmulticast mode
[ 53.018565][ T9837] bridge_slave_1: entered promiscuous mode
[ 53.027144][ T9837] bond0: (slave bond_slave_0): Enslaving as an
active interface with an up link
[ 53.029674][ T9837] bond0: (slave bond_slave_1): Enslaving as an
active interface with an up link
[ 53.038127][ T9837] team0: Port device team_slave_0 added
[ 53.039716][ T9837] team0: Port device team_slave_1 added
[ 53.047451][ T9837] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 53.049010][ T9837] batman_adv: batadv0: The MTU of interface
batadv_slave_0 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this interface will be fr.
[ 53.054641][ T9837] batman_adv: batadv0: Not using interface
batadv_slave_0 (retrying later): interface not active
[ 53.057422][ T9837] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 53.058894][ T9837] batman_adv: batadv0: The MTU of interface
batadv_slave_1 is too small (1500) to handle the transport of
batman-adv packets. Packets going over this interface will be fr.
[ 53.063627][ T9837] batman_adv: batadv0: Not using interface
batadv_slave_1 (retrying later): interface not active
[ 53.070533][ T9837] hsr_slave_0: entered promiscuous mode
[ 53.071302][ T9837] hsr_slave_1: entered promiscuous mode
[ 53.071985][ T9837] debugfs: Directory 'hsr0' with parent 'hsr'
already present!
[ 53.072789][ T9837] Cannot create hsr debugfs directory
[ 53.083987][ T9837] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 53.085055][ T9837] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 53.086039][ T9837] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 53.087330][ T9837] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 53.094030][ T9837] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.094780][ T9837] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.095554][ T9837] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.096307][ T9837] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.101333][ T9837] 8021q: adding VLAN 0 to HW filter on device bond0
[ 53.103084][ T2963] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.104186][ T2963] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.106320][ T9837] 8021q: adding VLAN 0 to HW filter on device team0
[ 53.108343][ T92] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.109940][ T92] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.112379][ T2963] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.113257][ T2963] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.137079][ T9837] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 53.141567][ T9837] veth0_vlan: entered promiscuous mode
[ 53.142678][ T9837] veth1_vlan: entered promiscuous mode
[ 53.145297][ T9837] veth0_macvtap: entered promiscuous mode
[ 53.146206][ T9837] veth1_macvtap: entered promiscuous mode
[ 53.147799][ T9837] batman_adv: The newly added mac address
(aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 53.148906][ T9837] batman_adv: It is strongly recommended to keep
mac addresses unique to avoid problems!
[ 53.150098][ T9837] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 53.151677][ T9837] batman_adv: The newly added mac address
(aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 53.152781][ T9837] batman_adv: It is strongly recommended to keep
mac addresses unique to avoid problems!
[ 53.153971][ T9837] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 53.155171][ T9837] netdevsim netdevsim0 netdevsim0: set [1, 0] type
2 family 0 port 6081 - 0
[ 53.156136][ T9837] netdevsim netdevsim0 netdevsim1: set [1, 0] type
2 family 0 port 6081 - 0
[ 53.157153][ T9837] netdevsim netdevsim0 netdevsim2: set [1, 0] type
2 family 0 port 6081 - 0
[ 53.158103][ T9837] netdevsim netdevsim0 netdevsim3: set [1, 0] type
2 family 0 port 6081 - 0
[ 53.232002][ T3671] wlan0: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 53.233031][ T3671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.238434][ T119] wlan1: Created IBSS using preconfigured BSSID
50:50:50:50:50:50
[ 53.239437][ T119] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 53.476459][ T80] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 53.626458][ T80] usb 1-1: Using ep0 maxpacket: 8
[ 53.628120][ T80] usb 1-1: config 8 has an invalid interface number:
207 but max is 3
[ 53.629284][ T80] usb 1-1: config 8 has an invalid interface number:
146 but max is 3
[ 53.630397][ T80] usb 1-1: config 8 has an invalid descriptor of
length 0, skipping remainder of the config
[ 53.631751][ T80] usb 1-1: config 8 has 2 interfaces, different from
the descriptor's value: 4
[ 53.632959][ T80] usb 1-1: config 8 has no interface number 0
[ 53.633781][ T80] usb 1-1: config 8 has no interface number 1
[ 53.634613][ T80] usb 1-1: config 8 interface 207 altsetting 6 has an
invalid descriptor for endpoint zero, skipping
[ 53.636082][ T80] usb 1-1: config 8 interface 207 altsetting 6 has a
duplicate endpoint with address 0x8, skipping
[ 53.637583][ T80] usb 1-1: config 8 interface 207 altsetting 6
endpoint 0x5 has invalid maxpacket 959, setting to 64
[ 53.639029][ T80] usb 1-1: config 8 interface 207 altsetting 6 has a
duplicate endpoint with address 0xB, skipping
[ 53.640479][ T80] usb 1-1: config 8 interface 207 altsetting 6
endpoint 0x2 has invalid maxpacket 512, setting to 64
[ 53.641947][ T80] usb 1-1: config 8 interface 146 altsetting 9 has 0
endpoint descriptors, different from the interface descriptor's value:
8
[ 53.643707][ T80] usb 1-1: config 8 interface 207 has no altsetting 0
[ 53.644636][ T80] usb 1-1: config 8 interface 146 has no altsetting 0
[ 53.646775][ T80] usb 1-1: New USB device found, idVendor=0424,
idProduct=cf30, bcdDevice=86.3f
[ 53.648010][ T80] usb 1-1: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[ 53.649089][ T80] usb 1-1: Product: syz
[ 53.649662][ T80] usb 1-1: Manufacturer: syz
[ 53.650295][ T80] usb 1-1: SerialNumber: syz
[ 53.651764][T10865] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[ 53.856332][ T80] usb 1-1: USB disconnect, device number 2
[ 53.857522][ T80] ------------[ cut here ]------------
[ 53.858121][ T80] refcount_t: underflow; use-after-free.
[ 53.858848][ T80] WARNING: CPU: 6 PID: 80 at lib/refcount.c:28
refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.859860][ T80] Modules linked in:
[ 53.860298][ T80] CPU: 6 UID: 0 PID: 80 Comm: kworker/6:1 Not tainted
6.12.0-rc1 #5
[ 53.861170][ T80] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.15.0-1 04/01/2014
[ 53.862181][ T80] Workqueue: usb_hub_wq hub_event
[ 53.862756][ T80] RIP: 0010:refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.863448][ T80] Code: ff 89 de e8 83 16 c8 fe 84 db 0f 85 1c ff ff
ff e8 66 14 c8 fe c6 05 81 f8 85 04 01 90 48 c7 c7 98 fc 50 86 e8 e2
ae af fe 90 <0f> 0b 90 90 e9 f9 fe ff ff e8 43 11
All code
========
0: ff 89 de e8 83 16 decl 0x1683e8de(%rcx)
6: c8 fe 84 db enter $0x84fe,$0xdb
a: 0f 85 1c ff ff ff jne 0xffffffffffffff2c
10: e8 66 14 c8 fe call 0xfffffffffec8147b
15: c6 05 81 f8 85 04 01 movb $0x1,0x485f881(%rip) # 0x485f89d
1c: 90 nop
1d: 48 c7 c7 98 fc 50 86 mov $0xffffffff8650fc98,%rdi
24: e8 e2 ae af fe call 0xfffffffffeafaf0b
29: 90 nop
2a:* 0f 0b ud2 <-- trapping instruction
2c: 90 nop
2d: 90 nop
2e: e9 f9 fe ff ff jmp 0xffffffffffffff2c
33: e8 .byte 0xe8
34: 43 rex.XB
35: 11 .byte 0x11

Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 90 nop
3: 90 nop
4: e9 f9 fe ff ff jmp 0xffffffffffffff02
9: e8 .byte 0xe8
a: 43 rex.XB
b: 11 .byte 0x11
[ 53.865584][ T80] RSP: 0018:ffff88810036fa60 EFLAGS: 00010282
[ 53.866248][ T80] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
ffffffff811c855c
[ 53.867170][ T80] RDX: ffff888101400000 RSI: ffffffff811c8565 RDI:
0000000000000001
[ 53.868051][ T80] RBP: ffff88810036fa70 R08: 0000000000000000 R09:
205b5d3132313835
[ 53.868929][ T80] R10: 0000000000000000 R11: 205d303854202020 R12:
ffff88812b896838
[ 53.869831][ T80] R13: ffff88812b896838 R14: ffff88812b895c50 R15:
0000000000000000
[ 53.870713][ T80] FS: 0000000000000000(0000)
GS:ffff88813bb80000(0000) knlGS:0000000000000000
[ 53.871697][ T80] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 53.872422][ T80] CR2: 00007fd472328988 CR3: 000000010a042000 CR4:
00000000000006f0
[ 53.873304][ T80] Call Trace:
[ 53.873669][ T80] <TASK>
[ 53.873995][ T80] ? show_regs
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/dumpstack.c:479)
[ 53.874481][ T80] ? __warn
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:748)
[ 53.874941][ T80] ? refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.875567][ T80] ? report_bug
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/bug.c:201
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/bug.c:219)
[ 53.876074][ T80] ? refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.876738][ T80] ? refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.877369][ T80] ? handle_bug
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/traps.c:285)
[ 53.877864][ T80] ? exc_invalid_op
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/traps.c:309
(discriminator 1))
[ 53.878399][ T80] ? asm_exc_invalid_op
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./arch/x86/include/asm/idtentry.h:621)
[ 53.878964][ T80] ? __warn_printk
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./include/linux/context_tracking.h:161
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:799)
[ 53.879493][ T80] ? __warn_printk
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/panic.c:800)
[ 53.880017][ T80] ? refcount_warn_saturate
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/refcount.c:28
(discriminator 3))
[ 53.880635][ T80] kobject_put
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/lib/kobject.c:739)
[ 53.881131][ T80] put_device
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/core.c:3784)
[ 53.881600][ T80] hdm_disconnect
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/most/most_usb.c:1130)
[ 53.882102][ T80] usb_unbind_interface
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/driver.c:464)
[ 53.882685][ T80] ? __pfx_usb_unbind_interface
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/driver.c:432)
[ 53.883329][ T80] device_remove
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/dd.c:570)
[ 53.883831][ T80] device_release_driver_internal
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/dd.c:1275
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/dd.c:1296)
[ 53.884518][ T80] device_release_driver
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/dd.c:1320)
[ 53.885092][ T80] bus_remove_device
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/./include/linux/kobject.h:193
(discriminator 3)
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/base.h:73
(discriminator 3)
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/bus.c:583
(discriminator 3))
[ 53.885648][ T80] device_del
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/core.c:3865)
[ 53.886134][ T80] ? device_unregister
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/base/core.c:3907)
[ 53.886729][ T80] usb_disable_device
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/message.c:1408
(discriminator 2))
[ 53.887302][ T80] usb_disconnect
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/input/misc/yealink.c:591
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/input/misc/yealink.c:614)
[ 53.887830][ T80] ? usb_control_msg
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/message.c:163)
[ 53.888388][ T80] ? hub_port_warm_reset_required
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/hub.c:2905)
[ 53.889045][ T80] hub_event
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/hub.c:5367
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/hub.c:5661
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/hub.c:5821
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/drivers/usb/core/hub.c:5903)
[ 53.889547][ T80] ? kick_pool
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/workqueue.c:1281)
[ 53.890032][ T80] process_one_work
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/workqueue.c:3234)
[ 53.890582][ T80] worker_thread
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/workqueue.c:3304
/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/workqueue.c:3391)
[ 53.891105][ T80] ? __pfx_worker_thread
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/workqueue.c:3337)
[ 53.891687][ T80] kthread
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kthread.c:389)
[ 53.892142][ T80] ? __pfx_kthread
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kthread.c:342)
[ 53.892666][ T80] ret_from_fork
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/kernel/process.c:153)
[ 53.893168][ T80] ? __pfx_kthread
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/kernel/kthread.c:342)
[ 53.893687][ T80] ret_from_fork_asm
(/data/ghui/docker_data/linux_kernel/upstream/linux_v6.11/arch/x86/entry/entry_64.S:257)
[ 53.894225][ T80] </TASK>