[   18.635017] ==================================================================
[   18.636079] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350
[   18.636837] Read of size 1 at addr ffff8881017113a0 by task kunit_try_catch/212
[   18.637359] 
[   18.639097] CPU: 0 UID: 0 PID: 212 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT(voluntary) 
[   18.639229] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.639270] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.639316] Call Trace:
[   18.639343]  <TASK>
[   18.639380]  dump_stack_lvl+0x73/0xb0
[   18.639423]  print_report+0xd1/0x650
[   18.639512]  ? __virt_addr_valid+0x1db/0x2d0
[   18.639719]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.639757]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.639790]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.639829]  kasan_report+0x141/0x180
[   18.639863]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.639902]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.639938]  __kasan_check_byte+0x3d/0x50
[   18.639969]  kfree_sensitive+0x22/0x90
[   18.640002]  kmalloc_double_kzfree+0x19c/0x350
[   18.640037]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   18.640073]  ? __schedule+0x10cc/0x2b30
[   18.640106]  ? __pfx_read_tsc+0x10/0x10
[   18.640134]  ? ktime_get_ts64+0x86/0x230
[   18.640171]  kunit_try_run_case+0x1a5/0x480
[   18.640205]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.640234]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.640267]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.640301]  ? __kthread_parkme+0x82/0x180
[   18.640332]  ? preempt_count_sub+0x50/0x80
[   18.640367]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.640400]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.640442]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.640589]  kthread+0x337/0x6f0
[   18.640653]  ? trace_preempt_on+0x20/0xc0
[   18.640721]  ? __pfx_kthread+0x10/0x10
[   18.640753]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.640785]  ? calculate_sigpending+0x7b/0xa0
[   18.640814]  ? __pfx_kthread+0x10/0x10
[   18.640844]  ret_from_fork+0x41/0x80
[   18.640873]  ? __pfx_kthread+0x10/0x10
[   18.640904]  ret_from_fork_asm+0x1a/0x30
[   18.640947]  </TASK>
[   18.640962] 
[   18.662873] Allocated by task 212:
[   18.663349]  kasan_save_stack+0x45/0x70
[   18.663867]  kasan_save_track+0x18/0x40
[   18.664259]  kasan_save_alloc_info+0x3b/0x50
[   18.664938]  __kasan_kmalloc+0xb7/0xc0
[   18.665345]  __kmalloc_cache_noprof+0x189/0x420
[   18.665939]  kmalloc_double_kzfree+0xa9/0x350
[   18.666303]  kunit_try_run_case+0x1a5/0x480
[   18.666997]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.667472]  kthread+0x337/0x6f0
[   18.667780]  ret_from_fork+0x41/0x80
[   18.668176]  ret_from_fork_asm+0x1a/0x30
[   18.668776] 
[   18.669129] Freed by task 212:
[   18.669451]  kasan_save_stack+0x45/0x70
[   18.669918]  kasan_save_track+0x18/0x40
[   18.671020]  kasan_save_free_info+0x3f/0x60
[   18.671282]  __kasan_slab_free+0x56/0x70
[   18.671572]  kfree+0x222/0x3f0
[   18.672206]  kfree_sensitive+0x67/0x90
[   18.673015]  kmalloc_double_kzfree+0x12b/0x350
[   18.674089]  kunit_try_run_case+0x1a5/0x480
[   18.674609]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.675262]  kthread+0x337/0x6f0
[   18.675691]  ret_from_fork+0x41/0x80
[   18.676047]  ret_from_fork_asm+0x1a/0x30
[   18.676791] 
[   18.677009] The buggy address belongs to the object at ffff8881017113a0
[   18.677009]  which belongs to the cache kmalloc-16 of size 16
[   18.678114] The buggy address is located 0 bytes inside of
[   18.678114]  freed 16-byte region [ffff8881017113a0, ffff8881017113b0)
[   18.679244] 
[   18.679467] The buggy address belongs to the physical page:
[   18.680151] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101711
[   18.681227] flags: 0x200000000000000(node=0|zone=2)
[   18.681798] page_type: f5(slab)
[   18.682218] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   18.682974] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   18.683587] page dumped because: kasan: bad access detected
[   18.684175] 
[   18.684588] Memory state around the buggy address:
[   18.685049]  ffff888101711280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.685719]  ffff888101711300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.686386] >ffff888101711380: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   18.687126]                                ^
[   18.687619]  ffff888101711400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.688316]  ffff888101711480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.689094] ==================================================================

[   20.044817] ==================================================================
[   20.046145] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   20.046881] Read of size 1 at addr ffff00000a7446a0 by task kunit_try_catch/250
[   20.047570] 
[   20.047743] CPU: 3 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc3 #1 PREEMPT 
[   20.047806] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.047823] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.047845] Call trace:
[   20.047859]  show_stack+0x20/0x38 (C)
[   20.047897]  dump_stack_lvl+0x8c/0xd0
[   20.047936]  print_report+0x118/0x608
[   20.047972]  kasan_report+0xdc/0x128
[   20.048007]  __kasan_check_byte+0x54/0x70
[   20.048042]  kfree_sensitive+0x30/0xb0
[   20.048078]  kmalloc_double_kzfree+0x168/0x308
[   20.048122]  kunit_try_run_case+0x170/0x3f0
[   20.048166]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.048214]  kthread+0x328/0x630
[   20.048256]  ret_from_fork+0x10/0x20
[   20.048296] 
[   20.054210] Allocated by task 250:
[   20.054547]  kasan_save_stack+0x3c/0x68
[   20.054931]  kasan_save_track+0x20/0x40
[   20.055314]  kasan_save_alloc_info+0x40/0x58
[   20.055739]  __kasan_kmalloc+0xd4/0xd8
[   20.056110]  __kmalloc_cache_noprof+0x15c/0x3c0
[   20.056564]  kmalloc_double_kzfree+0xb8/0x308
[   20.056998]  kunit_try_run_case+0x170/0x3f0
[   20.057416]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.057953]  kthread+0x328/0x630
[   20.058286]  ret_from_fork+0x10/0x20
[   20.058647] 
[   20.058805] Freed by task 250:
[   20.059106]  kasan_save_stack+0x3c/0x68
[   20.059487]  kasan_save_track+0x20/0x40
[   20.059868]  kasan_save_free_info+0x4c/0x78
[   20.060284]  __kasan_slab_free+0x6c/0x98
[   20.060674]  kfree+0x214/0x3c8
[   20.060991]  kfree_sensitive+0x80/0xb0
[   20.061365]  kmalloc_double_kzfree+0x11c/0x308
[   20.061807]  kunit_try_run_case+0x170/0x3f0
[   20.062225]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.062762]  kthread+0x328/0x630
[   20.063094]  ret_from_fork+0x10/0x20
[   20.063455] 
[   20.063614] The buggy address belongs to the object at ffff00000a7446a0
[   20.063614]  which belongs to the cache kmalloc-16 of size 16
[   20.064744] The buggy address is located 0 bytes inside of
[   20.064744]  freed 16-byte region [ffff00000a7446a0, ffff00000a7446b0)
[   20.065847] 
[   20.066007] The buggy address belongs to the physical page:
[   20.066530] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa744
[   20.067266] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.067888] page_type: f5(slab)
[   20.068211] raw: 03fffe0000000000 ffff000000402640 dead000000000122 0000000000000000
[   20.068939] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   20.069655] page dumped because: kasan: bad access detected
[   20.070178] 
[   20.070337] Memory state around the buggy address:
[   20.070794]  ffff00000a744580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   20.071470]  ffff00000a744600: fa fb fc fc fa fb fc fc 00 05 fc fc fa fb fc fc
[   20.072146] >ffff00000a744680: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   20.072816]                                ^
[   20.073226]  ffff00000a744700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.073901]  ffff00000a744780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.074572] ==================================================================