[ 17.635974][ T311] ==================================================================
[ 17.636245][ T311] BUG: KASAN: slab-use-after-free in emit_its_trampoline+0xa5/0x300
[ 17.636528][ T311] Read of size 1 at addr ffff888001932720 by task modprobe/311
[ 17.636772][ T311]
[ 17.636857][ T311] CPU: 3 UID: 0 PID: 311 Comm: modprobe Not tainted 6.16.0-rc2-virtme #1 PREEMPT(full)
[ 17.636862][ T311] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 17.636864][ T311] Call Trace:
[ 17.636866][ T311]
[ 17.636868][ T311] dump_stack_lvl+0x82/0xd0
[ 17.636875][ T311] print_address_description.constprop.0+0x2c/0x400
[ 17.636882][ T311] ? emit_its_trampoline+0xa5/0x300
[ 17.636886][ T311] print_report+0xb4/0x270
[ 17.636890][ T311] ? emit_its_trampoline+0xa5/0x300
[ 17.636892][ T311] ? kasan_addr_to_slab+0x25/0x80
[ 17.636896][ T311] ? emit_its_trampoline+0xa5/0x300
[ 17.636899][ T311] kasan_report+0xca/0x100
[ 17.636903][ T311] ? emit_its_trampoline+0xa5/0x300
[ 17.636908][ T311] ? emit_its_trampoline+0xa5/0x300
[ 17.636911][ T311] __kasan_check_byte+0x3a/0x50
[ 17.636914][ T311] krealloc_noprof+0x3d/0x320
[ 17.636918][ T311] ? execmem_alloc+0xc0/0x240
[ 17.636925][ T311] emit_its_trampoline+0xa5/0x300
[ 17.636928][ T311] ? __x86_indirect_paranoid_thunk_rax+0x2/0x2
[ 17.636934][ T311] ? __do_softirq+0x10/0x10
[ 17.636939][ T311] apply_retpolines+0xcf/0x550
[ 17.636943][ T311] ? __pfx_apply_retpolines+0x10/0x10
[ 17.636948][ T311] ? __pfx___mutex_lock+0x10/0x10
[ 17.636957][ T311] module_finalize+0x3d5/0x9d0
[ 17.636965][ T311] ? add_kallsyms+0x8d7/0xf40
[ 17.636970][ T311] ? __pfx_module_finalize+0x10/0x10
[ 17.636974][ T311] ? __pfx_cmp_ex_sort+0x10/0x10
[ 17.636977][ T311] ? __pfx_swap_ex+0x10/0x10
[ 17.636982][ T311] load_module+0x139a/0x2660
[ 17.636988][ T311] ? __pfx_load_module+0x10/0x10
[ 17.636991][ T311] ? kernel_read_file+0x3f5/0x550
[ 17.636998][ T311] ? kernel_read_file+0x3d0/0x550
[ 17.637002][ T311] ? __pfx_kernel_read_file+0x10/0x10
[ 17.637007][ T311] ? init_module_from_file+0xe9/0x150
[ 17.637010][ T311] init_module_from_file+0xe9/0x150
[ 17.637013][ T311] ? __pfx_init_module_from_file+0x10/0x10
[ 17.637021][ T311] ? idempotent_init_module+0x31a/0x620
[ 17.637023][ T311] ? __lock_release+0x5d/0x170
[ 17.637029][ T311] ? do_raw_spin_unlock+0x58/0x220
[ 17.637033][ T311] idempotent_init_module+0x335/0x620
[ 17.637037][ T311] ? __pfx_idempotent_init_module+0x10/0x10
[ 17.637044][ T311] ? cap_capable+0x94/0x230
[ 17.637051][ T311] __x64_sys_finit_module+0xca/0x150
[ 17.637054][ T311] ? do_syscall_64+0x85/0x380
[ 17.637057][ T311] do_syscall_64+0xc1/0x380
[ 17.637060][ T311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 17.637064][ T311] RIP: 0033:0x7f1069183e5d
[ 17.637067][ T311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48
[ 17.637070][ T311] RSP: 002b:00007ffc7b4775c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 17.637074][ T311] RAX: ffffffffffffffda RBX: 000055e3fd8aac80 RCX: 00007f1069183e5d
[ 17.637076][ T311] RDX: 0000000000000000 RSI: 000055e3e181fa2a RDI: 0000000000000000
[ 17.637078][ T311] RBP: 0000000000040000 R08: 0000000000000000 R09: 00007ffc7b477700
[ 17.637080][ T311] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e3e181fa2a
[ 17.637081][ T311] R13: 000055e3fd8aad40 R14: 000055e3fd8aadc0 R15: 000055e3fd8aacec
[ 17.637087][ T311]
[ 17.637089][ T311]
[ 17.647267][ T311] Allocated by task 296:
[ 17.647400][ T311] kasan_save_stack+0x24/0x50
[ 17.647578][ T311] kasan_save_track+0x14/0x30
[ 17.647750][ T311] __kasan_kmalloc+0x7f/0x90
[ 17.647922][ T311] __kmalloc_noprof+0x1d4/0x470
[ 17.648095][ T311] virtqueue_add_split+0x6a3/0x1920
[ 17.648266][ T311] virtqueue_add_sgs+0x143/0x270
[ 17.648438][ T311] virtio_fs_enqueue_req+0x58c/0xfe0
[ 17.648620][ T311] virtio_fs_send_req+0x13a/0x710
[ 17.648791][ T311] __fuse_simple_request+0x22a/0xb50
[ 17.648960][ T311] fuse_readlink_folio+0x20b/0x400
[ 17.649127][ T311] fuse_get_link+0x12d/0x350
[ 17.649295][ T311] pick_link+0x7a2/0x1160
[ 17.649423][ T311] step_into+0x85a/0xfc0
[ 17.649552][ T311] link_path_walk+0x3c2/0xa10
[ 17.649720][ T311] path_openat+0x14d/0x380
[ 17.649893][ T311] do_filp_open+0x1d7/0x420
[ 17.650059][ T311] do_sys_openat2+0xd4/0x160
[ 17.650228][ T311] __x64_sys_openat+0x122/0x1e0
[ 17.650394][ T311] do_syscall_64+0xc1/0x380
[ 17.650560][ T311] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 17.650766][ T311]
[ 17.650853][ T311] Freed by task 62:
[ 17.650977][ T311] kasan_save_stack+0x24/0x50
[ 17.651176][ T311] kasan_save_track+0x14/0x30
[ 17.651347][ T311] kasan_save_free_info+0x3b/0x60
[ 17.651517][ T311] __kasan_slab_free+0x38/0x50
[ 17.651692][ T311] kfree+0x144/0x320
[ 17.651820][ T311] detach_buf_split+0x48d/0x6f0
[ 17.651996][ T311] virtqueue_get_buf_ctx_split+0x294/0x7f0
[ 17.652208][ T311] virtio_fs_requests_done_work+0x231/0x890
[ 17.652426][ T311] process_one_work+0xe43/0x1660
[ 17.652597][ T311] worker_thread+0x591/0xcf0
[ 17.652763][ T311] kthread+0x37b/0x600
[ 17.652893][ T311] ret_from_fork+0x243/0x320
[ 17.653060][ T311] ret_from_fork_asm+0x1a/0x30
[ 17.653230][ T311]
[ 17.653313][ T311] The buggy address belongs to the object at ffff888001932720
[ 17.653313][ T311] which belongs to the cache kmalloc-96 of size 96
[ 17.653711][ T311] The buggy address is located 0 bytes inside of
[ 17.653711][ T311] freed 96-byte region [ffff888001932720, ffff888001932780)
[ 17.654114][ T311]
[ 17.654200][ T311] The buggy address belongs to the physical page:
[ 17.654403][ T311] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888001932720 pfn:0x1932
[ 17.654739][ T311] flags: 0x80000000000200(workingset|node=0|zone=1)
[ 17.654951][ T311] page_type: f5(slab)
[ 17.655084][ T311] raw: 0080000000000200 ffff888001042340 ffffea000007d990 ffffea0000042fd0
[ 17.655399][ T311] raw: ffff888001932720 000000000010000e 00000000f5000000 0000000000000000
[ 17.655695][ T311] page dumped because: kasan: bad access detected
[ 17.655901][ T311]
[ 17.655983][ T311] Memory state around the buggy address:
[ 17.656150][ T311] ffff888001932600: fc fc fc fc 00 00 00 00 00 00 00 00 00 fc fc fc
[ 17.656398][ T311] ffff888001932680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 17.656638][ T311] >ffff888001932700: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
[ 17.656880][ T311] ^
[ 17.657040][ T311] ffff888001932780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 17.657280][ T311] ffff888001932800: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 fc
[ 17.657525][ T311] ==================================================================
[ 17.658380][ T311] Disabling lock debugging due to kernel taint
[ 247.182093][ T44] INFO: task modprobe:311 blocked for more than 122 seconds.
[ 247.182547][ T44] Tainted: G B 6.16.0-rc2-virtme #1
[ 247.182785][ T44] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 247.183037][ T44] task:modprobe state:D stack:25792 pid:311 tgid:311 ppid:46 task_flags:0x400100 flags:0x00004002
[ 247.183389][ T44] Call Trace:
[ 247.183509][ T44]
[ 247.183595][ T44] __schedule+0x862/0x1b00
[ 247.183766][ T44] ? __pfx___schedule+0x10/0x10
[ 247.183910][ T44] ? trace_irq_enable.constprop.0+0xd4/0x130
[ 247.184101][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.184271][ T44] ? schedule+0x1ee/0x270
[ 247.184391][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.184541][ T44] schedule+0xe2/0x270
[ 247.184659][ T44] schedule_preempt_disabled+0x18/0x30
[ 247.184835][ T44] __mutex_lock+0x77f/0xcd0
[ 247.184986][ T44] ? text_poke_set+0x86/0x120
[ 247.185134][ T44] ? __pfx___mutex_lock+0x10/0x10
[ 247.185276][ T44] ? execmem_free+0x10d/0x1d0
[ 247.185422][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.185561][ T44] ? trace_lock_release+0x2a/0xd0
[ 247.185708][ T44] ? text_poke_set+0x86/0x120
[ 247.185849][ T44] text_poke_set+0x86/0x120
[ 247.186004][ T44] ? __pfx_text_poke_set+0x10/0x10
[ 247.186147][ T44] execmem_free+0x11a/0x1d0
[ 247.186291][ T44] ? __pfx_execmem_free+0x10/0x10
[ 247.186457][ T44] ? emit_its_trampoline+0xa5/0x300
[ 247.186609][ T44] ? __kasan_check_byte+0x3a/0x50
[ 247.186762][ T44] ? krealloc_noprof+0x3d/0x320
[ 247.186928][ T44] ? execmem_alloc+0xc0/0x240
[ 247.187112][ T44] emit_its_trampoline+0x258/0x300
[ 247.187284][ T44] ? __x86_indirect_paranoid_thunk_rax+0x2/0x2
[ 247.187476][ T44] ? __do_softirq+0x10/0x10
[ 247.187638][ T44] apply_retpolines+0xcf/0x550
[ 247.187792][ T44] ? __pfx_apply_retpolines+0x10/0x10
[ 247.187942][ T44] ? __pfx___mutex_lock+0x10/0x10
[ 247.188110][ T44] module_finalize+0x3d5/0x9d0
[ 247.188256][ T44] ? add_kallsyms+0x8d7/0xf40
[ 247.188424][ T44] ? __pfx_module_finalize+0x10/0x10
[ 247.188575][ T44] ? __pfx_cmp_ex_sort+0x10/0x10
[ 247.188725][ T44] ? __pfx_swap_ex+0x10/0x10
[ 247.188876][ T44] load_module+0x139a/0x2660
[ 247.189035][ T44] ? __pfx_load_module+0x10/0x10
[ 247.189185][ T44] ? kernel_read_file+0x3f5/0x550
[ 247.189335][ T44] ? kernel_read_file+0x3d0/0x550
[ 247.189493][ T44] ? __pfx_kernel_read_file+0x10/0x10
[ 247.189666][ T44] ? init_module_from_file+0xe9/0x150
[ 247.189809][ T44] init_module_from_file+0xe9/0x150
[ 247.189958][ T44] ? __pfx_init_module_from_file+0x10/0x10
[ 247.190138][ T44] ? idempotent_init_module+0x31a/0x620
[ 247.190286][ T44] ? __lock_release+0x5d/0x170
[ 247.190459][ T44] ? do_raw_spin_unlock+0x58/0x220
[ 247.190616][ T44] idempotent_init_module+0x335/0x620
[ 247.190766][ T44] ? __pfx_idempotent_init_module+0x10/0x10
[ 247.190988][ T44] ? cap_capable+0x94/0x230
[ 247.191147][ T44] __x64_sys_finit_module+0xca/0x150
[ 247.191301][ T44] ? do_syscall_64+0x85/0x380
[ 247.191455][ T44] do_syscall_64+0xc1/0x380
[ 247.191611][ T44] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 247.191810][ T44] RIP: 0033:0x7f1069183e5d
[ 247.191975][ T44] RSP: 002b:00007ffc7b4775c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 247.192200][ T44] RAX: ffffffffffffffda RBX: 000055e3fd8aac80 RCX: 00007f1069183e5d
[ 247.192421][ T44] RDX: 0000000000000000 RSI: 000055e3e181fa2a RDI: 0000000000000000
[ 247.192651][ T44] RBP: 0000000000040000 R08: 0000000000000000 R09: 00007ffc7b477700
[ 247.192865][ T44] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e3e181fa2a
[ 247.193085][ T44] R13: 000055e3fd8aad40 R14: 000055e3fd8aadc0 R15: 000055e3fd8aacec
[ 247.193297][ T44]
[ 247.193420][ T44] INFO: task modprobe:311 is blocked on a mutex likely owned by task modprobe:311.
[ 247.193655][ T44] task:modprobe state:D stack:25792 pid:311 tgid:311 ppid:46 task_flags:0x400100 flags:0x00004002
[ 247.193971][ T44] Call Trace:
[ 247.194084][ T44]
[ 247.194164][ T44] __schedule+0x862/0x1b00
[ 247.194312][ T44] ? __pfx___schedule+0x10/0x10
[ 247.194457][ T44] ? trace_irq_enable.constprop.0+0xd4/0x130
[ 247.194635][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.194779][ T44] ? schedule+0x1ee/0x270
[ 247.194893][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.195050][ T44] schedule+0xe2/0x270
[ 247.195184][ T44] schedule_preempt_disabled+0x18/0x30
[ 247.195336][ T44] __mutex_lock+0x77f/0xcd0
[ 247.195488][ T44] ? text_poke_set+0x86/0x120
[ 247.195639][ T44] ? __pfx___mutex_lock+0x10/0x10
[ 247.195793][ T44] ? execmem_free+0x10d/0x1d0
[ 247.195942][ T44] ? rcu_is_watching+0x12/0xc0
[ 247.196102][ T44] ? trace_lock_release+0x2a/0xd0
[ 247.196256][ T44] ? text_poke_set+0x86/0x120
[ 247.196407][ T44] text_poke_set+0x86/0x120
[ 247.196551][ T44] ? __pfx_text_poke_set+0x10/0x10
[ 247.196715][ T44] execmem_free+0x11a/0x1d0
[ 247.196855][ T44] ? __pfx_execmem_free+0x10/0x10
[ 247.197004][ T44] ? emit_its_trampoline+0xa5/0x300
[ 247.197152][ T44] ? __kasan_check_byte+0x3a/0x50
[ 247.197297][ T44] ? krealloc_noprof+0x3d/0x320
[ 247.197438][ T44] ? execmem_alloc+0xc0/0x240
[ 247.197579][ T44] emit_its_trampoline+0x258/0x300
[ 247.197721][ T44] ? __x86_indirect_paranoid_thunk_rax+0x2/0x2
[ 247.197895][ T44] ? __do_softirq+0x10/0x10
[ 247.198045][ T44] apply_retpolines+0xcf/0x550
[ 247.198189][ T44] ? __pfx_apply_retpolines+0x10/0x10
[ 247.198337][ T44] ? __pfx___mutex_lock+0x10/0x10
[ 247.198484][ T44] module_finalize+0x3d5/0x9d0
[ 247.198630][ T44] ? add_kallsyms+0x8d7/0xf40
[ 247.198773][ T44] ? __pfx_module_finalize+0x10/0x10
[ 247.198916][ T44] ? __pfx_cmp_ex_sort+0x10/0x10
[ 247.199067][ T44] ? __pfx_swap_ex+0x10/0x10
[ 247.199234][ T44] load_module+0x139a/0x2660
[ 247.199389][ T44] ? __pfx_load_module+0x10/0x10
[ 247.199557][ T44] ? kernel_read_file+0x3f5/0x550
[ 247.199708][ T44] ? kernel_read_file+0x3d0/0x550
[ 247.199870][ T44] ? __pfx_kernel_read_file+0x10/0x10
[ 247.200029][ T44] ? init_module_from_file+0xe9/0x150
[ 247.200178][ T44] init_module_from_file+0xe9/0x150
[ 247.200338][ T44] ? __pfx_init_module_from_file+0x10/0x10
[ 247.200515][ T44] ? idempotent_init_module+0x31a/0x620
[ 247.200663][ T44] ? __lock_release+0x5d/0x170
[ 247.200805][ T44] ? do_raw_spin_unlock+0x58/0x220
[ 247.200954][ T44] idempotent_init_module+0x335/0x620
[ 247.201097][ T44] ? __pfx_idempotent_init_module+0x10/0x10
[ 247.201274][ T44] ? cap_capable+0x94/0x230
[ 247.201417][ T44] __x64_sys_finit_module+0xca/0x150
[ 247.201563][ T44] ? do_syscall_64+0x85/0x380
[ 247.201703][ T44] do_syscall_64+0xc1/0x380
[ 247.201844][ T44] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 247.202026][ T44] RIP: 0033:0x7f1069183e5d
[ 247.202175][ T44] RSP: 002b:00007ffc7b4775c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 247.202407][ T44] RAX: ffffffffffffffda RBX: 000055e3fd8aac80 RCX: 00007f1069183e5d
[ 247.202634][ T44] RDX: 0000000000000000 RSI: 000055e3e181fa2a RDI: 0000000000000000
[ 247.202853][ T44] RBP: 0000000000040000 R08: 0000000000000000 R09: 00007ffc7b477700
[ 247.203083][ T44] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e3e181fa2a
[ 247.203311][ T44] R13: 000055e3fd8aad40 R14: 000055e3fd8aadc0 R15: 000055e3fd8aacec
[ 247.203534][ T44]
[ 247.203658][ T44] INFO: lockdep is turned off.
HARD STOP (301.760815)
WAIT TIMEOUT stderr
Ctrl-C stderr
Ctrl-C stderr