vkms_vblank_simulate: vblank timer overrun
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 45 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 45 Comm: kworker/u32:2 Not tainted 6.14.0-rc3-syzkaller-00012-g2408a807bfc3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 e8 56 f5 fc 84 db 0f 85 66 ff ff ff e8 3b 5c f5 fc c6 05 b7 5b 86 0b 01 90 48 c7 c7 80 01 d3 8b e8 d7 8d b5 fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 18 5c f5 fc 0f b6 1d 92 5b 86 0b 31
RSP: 0018:ffffc90000708d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817a1229
RDX: ffff88801cf1c880 RSI: ffffffff817a1236 RDI: 0000000000000001
RBP: ffff8880241b7108 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000006 R12: ffff8880241b7108
R13: ffff888032307000 R14: 0000000000000014 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3414fd CR3: 000000000df80000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:275 [inline]
 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
 refcount_dec_and_test include/linux/refcount.h:325 [inline]
 p9_req_put+0x1ec/0x250 net/9p/client.c:404
 req_done+0x1e7/0x2f0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
 vring_interrupt+0x31b/0x400 drivers/virtio/virtio_ring.c:2690
 __handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x263/0xd10 kernel/irq/chip.c:831
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:247 [inline]
 call_irq_handler arch/x86/kernel/irq.c:259 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:285
 common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:csd_lock_wait kernel/smp.c:340 [inline]
RIP: 0010:smp_call_function_many_cond+0x4ea/0x12c0 kernel/smp.c:885
Code: 7c 0e 0c 00 f3 90 41 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 e8 0b 00 00 8b 43 08 31 ff 83 e0 01 41 89 c5 89 c6 e8 56 09 0c 00 <45> 85 ed 75 d0 e8 4c 0e 0c 00 e8 47 0e 0c 00 44 8b 6c 24 04 bf 07
RSP: 0018:ffffc900007d7928 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff88806a7468c0 RCX: ffffffff81add08a
RDX: ffff88801cf1c880 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000006 R12: ffffed100d4e8d19
R13: 0000000000000001 R14: ffff88806a93fe80 R15: ffff88806a7468c8
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1052
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2118 [inline]
 text_poke_bp_batch+0x22b/0x760 arch/x86/kernel/alternative.c:2328
 text_poke_flush arch/x86/kernel/alternative.c:2519 [inline]
 text_poke_flush arch/x86/kernel/alternative.c:2516 [inline]
 text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2526
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 jump_label_update+0x1d7/0x400 kernel/jump_label.c:920
 static_key_disable_cpuslocked+0x158/0x1c0 kernel/jump_label.c:240
 static_key_disable+0x1a/0x20 kernel/jump_label.c:248
 toggle_allocation_gate mm/kfence/core.c:855 [inline]
 toggle_allocation_gate+0x147/0x260 mm/kfence/core.c:842
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	7c 0e                	jl     0x10
   2:	0c 00                	or     $0x0,%al
   4:	f3 90                	pause
   6:	41 0f b6 04 24       	movzbl (%r12),%eax
   b:	40 38 c5             	cmp    %al,%bpl
   e:	7c 08                	jl     0x18
  10:	84 c0                	test   %al,%al
  12:	0f 85 e8 0b 00 00    	jne    0xc00
  18:	8b 43 08             	mov    0x8(%rbx),%eax
  1b:	31 ff                	xor    %edi,%edi
  1d:	83 e0 01             	and    $0x1,%eax
  20:	41 89 c5             	mov    %eax,%r13d
  23:	89 c6                	mov    %eax,%esi
  25:	e8 56 09 0c 00       	call   0xc0980
* 2a:	45 85 ed             	test   %r13d,%r13d <-- trapping instruction
  2d:	75 d0                	jne    0xffffffff
  2f:	e8 4c 0e 0c 00       	call   0xc0e80
  34:	e8 47 0e 0c 00       	call   0xc0e80
  39:	44 8b 6c 24 04       	mov    0x4(%rsp),%r13d
  3e:	bf                   	.byte 0xbf
  3f:	07                   	(bad)