==================================================================
BUG: KFENCE: use-after-free read in fcloop_rport_lsrqst_work+0x179/0x2e0 drivers/nvme/target/fcloop.c:342

Use-after-free read at 0xffff88816daac038 (in kfence-#85):
 fcloop_rport_lsrqst_work+0x179/0x2e0 drivers/nvme/target/fcloop.c:342
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

kfence-#85: 0xffff88816daac000-0xffff88816daac0ff, size=256, cache=kmalloc-256

allocated by task 1160 on cpu 1 at 78.926918s (0.000589s ago):
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 nvmet_fc_xmt_disconnect_assoc drivers/nvme/target/fc.c:489 [inline]
 nvmet_fc_target_assoc_free+0xbd5/0x2220 drivers/nvme/target/fc.c:1177
 kref_put include/linux/kref.h:65 [inline]
 nvmet_fc_tgt_a_put drivers/nvme/target/fc.c:1195 [inline]
 nvmet_fc_delete_assoc_work.cold+0x118/0x144 drivers/nvme/target/fc.c:1068
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

freed by task 6016 on cpu 3 at 78.927230s (0.000456s ago):
 nvmet_fc_free_pending_reqs drivers/nvme/target/fc.c:1619 [inline]
 nvmet_fc_unregister_targetport+0x351/0x760 drivers/nvme/target/fc.c:1651
 __targetport_unreg drivers/nvme/target/fcloop.c:1600 [inline]
 fcloop_delete_target_port+0x185/0x1f0 drivers/nvme/target/fcloop.c:1630
 dev_attr_store+0x58/0x80 drivers/base/core.c:2509
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687
 ksys_write+0x12a/0x250 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 63 Comm: kworker/u33:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvmet-wq fcloop_tport_lsrqst_work
RIP: 0010:fcloop_rport_lsrqst_work+0x179/0x2e0 drivers/nvme/target/fcloop.c:342
Code: c1 e8 03 80 3c 18 00 0f 85 f0 00 00 00 49 8b 47 c8 48 8d 78 38 48 89 f9 48 c1 e9 03 80 3c 19 00 0f 85 c3 00 00 00 49 8d 7f f8 <4c> 8b 40 38 48 89 f9 48 c1 e9 03 0f b6 0c 19 84 c9 74 09 80 f9 03
RSP: 0018:ffffc90000b0fbc8 EFLAGS: 00010246
RAX: ffff88816daac000 RBX: dffffc0000000000 RCX: 1ffff1102db55807
RDX: 0000000000000004 RSI: 0000000000000004 RDI: ffff888036b493d8
RBP: ffff888036b493a8 R08: 0000000000000000 R09: ffffed10054cd22c
R10: ffff88802a669163 R11: 0000000000000000 R12: ffff88802a669160
R13: 0000000000000001 R14: ffff888036b493e8 R15: ffff888036b493e0
FS:  0000000000000000(0000) GS:ffff8880d5b4e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88816daac038 CR3: 000000000eb96000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	c1 e8 03             	shr    $0x3,%eax
   3:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1)
   7:	0f 85 f0 00 00 00    	jne    0xfd
   d:	49 8b 47 c8          	mov    -0x38(%r15),%rax
  11:	48 8d 78 38          	lea    0x38(%rax),%rdi
  15:	48 89 f9             	mov    %rdi,%rcx
  18:	48 c1 e9 03          	shr    $0x3,%rcx
  1c:	80 3c 19 00          	cmpb   $0x0,(%rcx,%rbx,1)
  20:	0f 85 c3 00 00 00    	jne    0xe9
  26:	49 8d 7f f8          	lea    -0x8(%r15),%rdi
* 2a:	4c 8b 40 38          	mov    0x38(%rax),%r8 <-- trapping instruction
  2e:	48 89 f9             	mov    %rdi,%rcx
  31:	48 c1 e9 03          	shr    $0x3,%rcx
  35:	0f b6 0c 19          	movzbl (%rcx,%rbx,1),%ecx
  39:	84 c9                	test   %cl,%cl
  3b:	74 09                	je     0x46
  3d:	80 f9 03             	cmp    $0x3,%cl