=== DF-4329 i915 request-RCU lifetime replica — guest run ===

--- mode 1 (log-only) ---
i915rcu: [1] request r=0xfffff8004f309140 published (refcount=1, engine=0xffff00000000)
i915rcu: [2] retire: refcount 1->0, i915_fence_release: kmem_cache_free(i915->requests, rq) -> kfree(0xfffff8004f309140)
i915rcu: [3] unrelated kmalloc(392) -> 0xfffff8004f309140 == REUSED (no grace period, SLAB_TYPESAFE_BY_RCU unenforced) r
i915rcu: [4] reused object poisoned: engine@0xfffff8004f309160 = 0x0000515151515151 (attacker-influenced), global_seqno=0x42
i915rcu: [5] dma_fence_get_rcu() shim replica: refcount 0 -> 1 (upstream kref_get_unless_zero would REFUSE and return NULL)
i915rcu: [6] reader: rcu_read_lock()=crit_enter(); p = rcu_dereference(active.request)...
i915rcu: [6] reader sees p=0xfffff8004f309140 (stale, freed & reused)
i915rcu: [6] p->global_seqno=0x42
i915rcu: [6] chasing p->engine = 0x0000515151515151 (intel_engine_has_completed(rq->engine, seqno))
i915rcu: [7] mode 1: would read *(u32 *)(engine+0x18) at 0x0000515151515169 (SKIPPED - no fault in log mode)
i915rcu: [1] request r=0xfffff8004f309140 published (refcount=1, engine=0xffff00000000)
i915rcu: [2] retire: refcount 1->0, i915_fence_release: kmem_cache_free(i915->requests, rq) -> kfree(0xfffff8004f309140)
i915rcu: [3] unrelated kmalloc(392) -> 0xfffff8004f309140 == REUSED (no grace period, SLAB_TYPESAFE_BY_RCU unenforced) r
i915rcu: [4] reused object poisoned: engine@0xfffff8004f309160 = 0x0000515151515151 (attacker-influenced), global_seqno=0x42

--- mode 2 (chase -> panic) ---
i915rcu: [7] mode 2: READING *(u32 *)(engine+0x18) -> EXPECT PANIC ON 0x0000515151515169
Fatal user address access from kernel mode from sysctl at ffffffff82624380


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x515151515169
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82624380
stack pointer	        = 0x10:0xfffff8011891f5b8
frame pointer	        = 0x10:0xfffff8011891f768
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1615
current thread          = pri 6 (CRIT)
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      run_replica+0x350:      movl    0x18(%r12),%esi