==================================================================
BUG: KASAN: slab-use-after-free in __bpf_trace_run kernel/trace/bpf_trace.c:2304 [inline]
BUG: KASAN: slab-use-after-free in bpf_trace_run2+0xfa/0x540 kernel/trace/bpf_trace.c:2359
Read of size 8 at addr ffff888026d4ca18 by task udevd/4692

CPU: 1 UID: 0 PID: 4692 Comm: udevd Not tainted 6.12.0-rc3-next-20241016-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 __bpf_trace_run kernel/trace/bpf_trace.c:2304 [inline]
 bpf_trace_run2+0xfa/0x540 kernel/trace/bpf_trace.c:2359
 __bpf_trace_sys_enter+0x38/0x60 include/trace/events/syscalls.h:18
 trace_sys_enter+0xd9/0x150 include/trace/events/syscalls.h:18
 syscall_trace_enter+0xf8/0x150 kernel/entry/common.c:61
 syscall_enter_from_user_mode_work include/linux/entry-common.h:168 [inline]
 syscall_enter_from_user_mode include/linux/entry-common.h:198 [inline]
 do_syscall_64+0xcc/0x230 arch/x86/entry/common.c:79
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff6a8116b6a
Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007fff3ce92d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000555f8a397040 RCX: 00007ff6a8116b6a
RDX: 0000000000000080 RSI: 00007fff3ce92f18 RDI: 0000000000000008
RBP: 0000555f8adbbc50 R08: 000000005e6c5cfe R09: 7fffffffffffffff
R10: 00007ff6a86040b8 R11: 0000000000000246 R12: 000000000000d30c
R13: 0000555f8adbebd0 R14: 0000000000000001 R15: 0000000000000000
 </TASK>

Allocated by task 11591:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4304
 kmalloc_noprof include/linux/slab.h:901 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 bpf_raw_tp_link_attach+0x2a0/0x6e0 kernel/bpf/syscall.c:3829
 bpf_raw_tracepoint_open+0x177/0x1f0 kernel/bpf/syscall.c:3876
 __sys_bpf+0x3c0/0x810 kernel/bpf/syscall.c:5691
 __do_sys_bpf kernel/bpf/syscall.c:5756 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5754 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5754
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 0:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2329 [inline]
 slab_free mm/slub.c:4588 [inline]
 kfree+0x1a0/0x460 mm/slub.c:4736
 rcu_do_batch kernel/rcu/tree.c:2567 [inline]
 rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823
 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0xa3/0xc0 arch/x86/kernel/smp.c:266
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709

Last potentially related work creation:
 kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 __call_rcu_common kernel/rcu/tree.c:3086 [inline]
 call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190
 bpf_link_put_direct kernel/bpf/syscall.c:3045 [inline]
 bpf_link_release+0x78/0x90 kernel/bpf/syscall.c:3052
 __fput+0x23c/0xa50 fs/file_table.c:434
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888026d4ca00
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 freed 128-byte region [ffff888026d4ca00, ffff888026d4ca80)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888026d4cd00 pfn:0x26d4c
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801ac41a00 ffffea0001b6c350 ffffea0000b5fd90
raw: ffff888026d4cd00 000000000010000e 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 35, tgid 35 (kworker/u8:2), ts 8991544409, free_ts 0
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537
 prep_new_page mm/page_alloc.c:1545 [inline]
 get_page_from_freelist+0x3123/0x3270 mm/page_alloc.c:3493
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4769
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_slab_page+0x59/0x120 mm/slub.c:2401
 allocate_slab+0x5a/0x2f0 mm/slub.c:2565
 new_slab mm/slub.c:2618 [inline]
 ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3805
 __slab_alloc+0x58/0xa0 mm/slub.c:3895
 __slab_alloc_node mm/slub.c:3970 [inline]
 slab_alloc_node mm/slub.c:4131 [inline]
 __kmalloc_cache_node_noprof+0x294/0x3a0 mm/slub.c:4312
 kmalloc_node_noprof include/linux/slab.h:924 [inline]
 blk_alloc_flush_queue+0x84/0x230 block/blk-flush.c:483
 blk_mq_alloc_hctx block/blk-mq.c:3817 [inline]
 blk_mq_alloc_and_init_hctx+0x868/0xdc0 block/blk-mq.c:4276
 blk_mq_realloc_hw_ctxs+0x198/0x4a0 block/blk-mq.c:4309
 blk_mq_init_allocated_queue+0x3d1/0x14f0 block/blk-mq.c:4351
 blk_mq_alloc_queue+0x1d9/0x2f0 block/blk-mq.c:4185
 scsi_alloc_sdev+0x772/0xb90 drivers/scsi/scsi_scan.c:337
 scsi_probe_and_add_lun+0x1db/0x4be0 drivers/scsi/scsi_scan.c:1210
 __scsi_scan_target+0x205/0x1080 drivers/scsi/scsi_scan.c:1757
page_owner free stack trace missing

Memory state around the buggy address:
 ffff888026d4c900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026d4c980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888026d4ca00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff888026d4ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888026d4cb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
==================================================================