Hay
Date
June 8, 2025, 11:09 p.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
rk3399-rock-pi-4b

[   29.988428] ==================================================================
[   30.002087] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   30.009462] Read of size 1 at addr ffff000800c2f0a0 by task kunit_try_catch/239
[   30.016752] 
[   30.018238] CPU: 5 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   30.018300] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.018319] Hardware name: WinLink E850-96 board (DT)
[   30.018341] Call trace:
[   30.018357]  show_stack+0x20/0x38 (C)
[   30.018393]  dump_stack_lvl+0x8c/0xd0
[   30.018433]  print_report+0x118/0x608
[   30.018468]  kasan_report+0xdc/0x128
[   30.018505]  __kasan_check_byte+0x54/0x70
[   30.018537]  kfree_sensitive+0x30/0xb0
[   30.018573]  kmalloc_double_kzfree+0x168/0x308
[   30.018605]  kunit_try_run_case+0x170/0x3f0
[   30.018642]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.018681]  kthread+0x328/0x630
[   30.018709]  ret_from_fork+0x10/0x20
[   30.018743] 
[   30.084287] Allocated by task 239:
[   30.087675]  kasan_save_stack+0x3c/0x68
[   30.091492]  kasan_save_track+0x20/0x40
[   30.095310]  kasan_save_alloc_info+0x40/0x58
[   30.099564]  __kasan_kmalloc+0xd4/0xd8
[   30.103296]  __kmalloc_cache_noprof+0x16c/0x3c0
[   30.107810]  kmalloc_double_kzfree+0xb8/0x308
[   30.112150]  kunit_try_run_case+0x170/0x3f0
[   30.116317]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.121787]  kthread+0x328/0x630
[   30.124997]  ret_from_fork+0x10/0x20
[   30.128556] 
[   30.130032] Freed by task 239:
[   30.133070]  kasan_save_stack+0x3c/0x68
[   30.136889]  kasan_save_track+0x20/0x40
[   30.140710]  kasan_save_free_info+0x4c/0x78
[   30.144875]  __kasan_slab_free+0x6c/0x98
[   30.148781]  kfree+0x214/0x3c8
[   30.151820]  kfree_sensitive+0x80/0xb0
[   30.155552]  kmalloc_double_kzfree+0x11c/0x308
[   30.159979]  kunit_try_run_case+0x170/0x3f0
[   30.164146]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.169614]  kthread+0x328/0x630
[   30.172828]  ret_from_fork+0x10/0x20
[   30.176385] 
[   30.177863] The buggy address belongs to the object at ffff000800c2f0a0
[   30.177863]  which belongs to the cache kmalloc-16 of size 16
[   30.190190] The buggy address is located 0 bytes inside of
[   30.190190]  freed 16-byte region [ffff000800c2f0a0, ffff000800c2f0b0)
[   30.202166] 
[   30.203644] The buggy address belongs to the physical page:
[   30.209201] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880c2f
[   30.217185] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.223696] page_type: f5(slab)
[   30.226833] raw: 0bfffe0000000000 ffff000800002640 dead000000000122 0000000000000000
[   30.234551] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   30.242269] page dumped because: kasan: bad access detected
[   30.247825] 
[   30.249300] Memory state around the buggy address:
[   30.254082]  ffff000800c2ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.261285]  ffff000800c2f000: 00 04 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   30.268488] >ffff000800c2f080: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   30.275689]                                ^
[   30.279947]  ffff000800c2f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.287151]  ffff000800c2f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.294355] ==================================================================

[   25.657559] ==================================================================
[   25.657907] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   25.658246] Read of size 1 at addr fff00000c62bd320 by task kunit_try_catch/192
[   25.658564] 
[   25.658767] CPU: 0 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.659082] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.659175] Hardware name: linux,dummy-virt (DT)
[   25.659260] Call trace:
[   25.659326]  show_stack+0x20/0x38 (C)
[   25.659957]  dump_stack_lvl+0x8c/0xd0
[   25.660257]  print_report+0x118/0x608
[   25.660389]  kasan_report+0xdc/0x128
[   25.660529]  __kasan_check_byte+0x54/0x70
[   25.660744]  kfree_sensitive+0x30/0xb0
[   25.660974]  kmalloc_double_kzfree+0x168/0x308
[   25.661156]  kunit_try_run_case+0x170/0x3f0
[   25.661299]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.661610]  kthread+0x328/0x630
[   25.661727]  ret_from_fork+0x10/0x20
[   25.661852] 
[   25.661901] Allocated by task 192:
[   25.662001]  kasan_save_stack+0x3c/0x68
[   25.662366]  kasan_save_track+0x20/0x40
[   25.662590]  kasan_save_alloc_info+0x40/0x58
[   25.662828]  __kasan_kmalloc+0xd4/0xd8
[   25.663017]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.663381]  kmalloc_double_kzfree+0xb8/0x308
[   25.663836]  kunit_try_run_case+0x170/0x3f0
[   25.664124]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.664438]  kthread+0x328/0x630
[   25.664566]  ret_from_fork+0x10/0x20
[   25.664837] 
[   25.664902] Freed by task 192:
[   25.664996]  kasan_save_stack+0x3c/0x68
[   25.665565]  kasan_save_track+0x20/0x40
[   25.666108]  kasan_save_free_info+0x4c/0x78
[   25.666240]  __kasan_slab_free+0x6c/0x98
[   25.666742]  kfree+0x214/0x3c8
[   25.666850]  kfree_sensitive+0x80/0xb0
[   25.667213]  kmalloc_double_kzfree+0x11c/0x308
[   25.667516]  kunit_try_run_case+0x170/0x3f0
[   25.667903]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.668504]  kthread+0x328/0x630
[   25.668633]  ret_from_fork+0x10/0x20
[   25.668743] 
[   25.668828] The buggy address belongs to the object at fff00000c62bd320
[   25.668828]  which belongs to the cache kmalloc-16 of size 16
[   25.668983] The buggy address is located 0 bytes inside of
[   25.668983]  freed 16-byte region [fff00000c62bd320, fff00000c62bd330)
[   25.669242] 
[   25.669549] The buggy address belongs to the physical page:
[   25.669756] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062bd
[   25.670318] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.670702] page_type: f5(slab)
[   25.670903] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   25.671388] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   25.671839] page dumped because: kasan: bad access detected
[   25.671922] 
[   25.672186] Memory state around the buggy address:
[   25.672282]  fff00000c62bd200: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc
[   25.672719]  fff00000c62bd280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.673076] >fff00000c62bd300: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   25.673466]                                ^
[   25.673555]  fff00000c62bd380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.673660]  fff00000c62bd400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.674144] ==================================================================

[   25.920351] ==================================================================
[   25.920502] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   25.920634] Read of size 1 at addr fff00000c56fe400 by task kunit_try_catch/192
[   25.922263] 
[   25.922494] CPU: 0 UID: 0 PID: 192 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.923089] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.923654] Hardware name: linux,dummy-virt (DT)
[   25.923742] Call trace:
[   25.923809]  show_stack+0x20/0x38 (C)
[   25.923954]  dump_stack_lvl+0x8c/0xd0
[   25.925782]  print_report+0x118/0x608
[   25.925941]  kasan_report+0xdc/0x128
[   25.926811]  __kasan_check_byte+0x54/0x70
[   25.927239]  kfree_sensitive+0x30/0xb0
[   25.928220]  kmalloc_double_kzfree+0x168/0x308
[   25.928497]  kunit_try_run_case+0x170/0x3f0
[   25.928849]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.929044]  kthread+0x328/0x630
[   25.929178]  ret_from_fork+0x10/0x20
[   25.929576] 
[   25.929921] Allocated by task 192:
[   25.930074]  kasan_save_stack+0x3c/0x68
[   25.930252]  kasan_save_track+0x20/0x40
[   25.930351]  kasan_save_alloc_info+0x40/0x58
[   25.930455]  __kasan_kmalloc+0xd4/0xd8
[   25.930763]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.931108]  kmalloc_double_kzfree+0xb8/0x308
[   25.931300]  kunit_try_run_case+0x170/0x3f0
[   25.931408]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.931530]  kthread+0x328/0x630
[   25.931695]  ret_from_fork+0x10/0x20
[   25.931826] 
[   25.931927] Freed by task 192:
[   25.932006]  kasan_save_stack+0x3c/0x68
[   25.932114]  kasan_save_track+0x20/0x40
[   25.932563]  kasan_save_free_info+0x4c/0x78
[   25.932886]  __kasan_slab_free+0x6c/0x98
[   25.933001]  kfree+0x214/0x3c8
[   25.933174]  kfree_sensitive+0x80/0xb0
[   25.933281]  kmalloc_double_kzfree+0x11c/0x308
[   25.933384]  kunit_try_run_case+0x170/0x3f0
[   25.933487]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.933597]  kthread+0x328/0x630
[   25.933676]  ret_from_fork+0x10/0x20
[   25.933768] 
[   25.934057] The buggy address belongs to the object at fff00000c56fe400
[   25.934057]  which belongs to the cache kmalloc-16 of size 16
[   25.934676] The buggy address is located 0 bytes inside of
[   25.934676]  freed 16-byte region [fff00000c56fe400, fff00000c56fe410)
[   25.934971] 
[   25.935092] The buggy address belongs to the physical page:
[   25.935291] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1056fe
[   25.935472] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.935809] page_type: f5(slab)
[   25.936498] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   25.936820] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   25.937361] page dumped because: kasan: bad access detected
[   25.937455] 
[   25.937515] Memory state around the buggy address:
[   25.937604]  fff00000c56fe300: fa fb fc fc 00 04 fc fc fa fb fc fc fa fb fc fc
[   25.938476]  fff00000c56fe380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.938599] >fff00000c56fe400: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.938699]                    ^
[   25.938776]  fff00000c56fe480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.939804]  fff00000c56fe500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.940088] ==================================================================

[   19.457448] ==================================================================
[   19.458412] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350
[   19.460043] Read of size 1 at addr ffff8881023e23e0 by task kunit_try_catch/210
[   19.461025] 
[   19.461326] CPU: 0 UID: 0 PID: 210 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   19.461567] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.461606] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.461682] Call Trace:
[   19.461719]  <TASK>
[   19.461767]  dump_stack_lvl+0x73/0xb0
[   19.461871]  print_report+0xd1/0x650
[   19.461950]  ? __virt_addr_valid+0x1db/0x2d0
[   19.462078]  ? kmalloc_double_kzfree+0x19c/0x350
[   19.462169]  ? kasan_complete_mode_report_info+0x64/0x200
[   19.462285]  ? kmalloc_double_kzfree+0x19c/0x350
[   19.462344]  kasan_report+0x141/0x180
[   19.462378]  ? kmalloc_double_kzfree+0x19c/0x350
[   19.462414]  ? kmalloc_double_kzfree+0x19c/0x350
[   19.462447]  __kasan_check_byte+0x3d/0x50
[   19.462477]  kfree_sensitive+0x22/0x90
[   19.462542]  kmalloc_double_kzfree+0x19c/0x350
[   19.462578]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   19.462612]  ? __schedule+0x10cc/0x2b60
[   19.462644]  ? __pfx_read_tsc+0x10/0x10
[   19.462675]  ? ktime_get_ts64+0x86/0x230
[   19.462708]  kunit_try_run_case+0x1a5/0x480
[   19.462746]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.462778]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   19.462813]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   19.462846]  ? __kthread_parkme+0x82/0x180
[   19.462876]  ? preempt_count_sub+0x50/0x80
[   19.462908]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.462942]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.462975]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   19.463008]  kthread+0x337/0x6f0
[   19.463034]  ? trace_preempt_on+0x20/0xc0
[   19.463067]  ? __pfx_kthread+0x10/0x10
[   19.463095]  ? _raw_spin_unlock_irq+0x47/0x80
[   19.463124]  ? calculate_sigpending+0x7b/0xa0
[   19.463158]  ? __pfx_kthread+0x10/0x10
[   19.463187]  ret_from_fork+0x116/0x1d0
[   19.463212]  ? __pfx_kthread+0x10/0x10
[   19.463291]  ret_from_fork_asm+0x1a/0x30
[   19.463337]  </TASK>
[   19.463353] 
[   19.483168] Allocated by task 210:
[   19.483826]  kasan_save_stack+0x45/0x70
[   19.484579]  kasan_save_track+0x18/0x40
[   19.484996]  kasan_save_alloc_info+0x3b/0x50
[   19.485631]  __kasan_kmalloc+0xb7/0xc0
[   19.486069]  __kmalloc_cache_noprof+0x189/0x420
[   19.486763]  kmalloc_double_kzfree+0xa9/0x350
[   19.487184]  kunit_try_run_case+0x1a5/0x480
[   19.487806]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.488466]  kthread+0x337/0x6f0
[   19.488944]  ret_from_fork+0x116/0x1d0
[   19.489313]  ret_from_fork_asm+0x1a/0x30
[   19.489766] 
[   19.490008] Freed by task 210:
[   19.490361]  kasan_save_stack+0x45/0x70
[   19.490781]  kasan_save_track+0x18/0x40
[   19.491097]  kasan_save_free_info+0x3f/0x60
[   19.491679]  __kasan_slab_free+0x56/0x70
[   19.492458]  kfree+0x222/0x3f0
[   19.493053]  kfree_sensitive+0x67/0x90
[   19.493725]  kmalloc_double_kzfree+0x12b/0x350
[   19.494359]  kunit_try_run_case+0x1a5/0x480
[   19.494835]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.495735]  kthread+0x337/0x6f0
[   19.496056]  ret_from_fork+0x116/0x1d0
[   19.496571]  ret_from_fork_asm+0x1a/0x30
[   19.497219] 
[   19.497694] The buggy address belongs to the object at ffff8881023e23e0
[   19.497694]  which belongs to the cache kmalloc-16 of size 16
[   19.499213] The buggy address is located 0 bytes inside of
[   19.499213]  freed 16-byte region [ffff8881023e23e0, ffff8881023e23f0)
[   19.500100] 
[   19.500347] The buggy address belongs to the physical page:
[   19.500796] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1023e2
[   19.502109] flags: 0x200000000000000(node=0|zone=2)
[   19.502544] page_type: f5(slab)
[   19.503325] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   19.503895] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   19.504767] page dumped because: kasan: bad access detected
[   19.505424] 
[   19.505932] Memory state around the buggy address:
[   19.506434]  ffff8881023e2280: fa fb fc fc 00 02 fc fc 00 05 fc fc 00 02 fc fc
[   19.507683]  ffff8881023e2300: 00 02 fc fc 00 02 fc fc 00 02 fc fc fa fb fc fc
[   19.509588] >ffff8881023e2380: fa fb fc fc fa fb fc fc 00 05 fc fc fa fb fc fc
[   19.510939]                                                        ^
[   19.511410]  ffff8881023e2400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.512932]  ffff8881023e2480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.513945] ==================================================================

[   18.479070] ==================================================================
[   18.480101] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350
[   18.480939] Read of size 1 at addr ffff88810262e160 by task kunit_try_catch/210
[   18.482342] 
[   18.482582] CPU: 0 UID: 0 PID: 210 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   18.482702] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.482740] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.483050] Call Trace:
[   18.483077]  <TASK>
[   18.483106]  dump_stack_lvl+0x73/0xb0
[   18.483186]  print_report+0xd1/0x650
[   18.483221]  ? __virt_addr_valid+0x1db/0x2d0
[   18.483254]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.483288]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.483319]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.483352]  kasan_report+0x141/0x180
[   18.483382]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.483419]  ? kmalloc_double_kzfree+0x19c/0x350
[   18.483452]  __kasan_check_byte+0x3d/0x50
[   18.483482]  kfree_sensitive+0x22/0x90
[   18.483513]  kmalloc_double_kzfree+0x19c/0x350
[   18.483546]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   18.483580]  ? __schedule+0x10cc/0x2b60
[   18.483612]  ? __pfx_read_tsc+0x10/0x10
[   18.483642]  ? ktime_get_ts64+0x86/0x230
[   18.483675]  kunit_try_run_case+0x1a5/0x480
[   18.483711]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.483745]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.483777]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.483810]  ? __kthread_parkme+0x82/0x180
[   18.483837]  ? preempt_count_sub+0x50/0x80
[   18.483868]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.483932]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.483966]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.484000]  kthread+0x337/0x6f0
[   18.484029]  ? trace_preempt_on+0x20/0xc0
[   18.484062]  ? __pfx_kthread+0x10/0x10
[   18.484091]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.484161]  ? calculate_sigpending+0x7b/0xa0
[   18.484202]  ? __pfx_kthread+0x10/0x10
[   18.484233]  ret_from_fork+0x116/0x1d0
[   18.484258]  ? __pfx_kthread+0x10/0x10
[   18.484287]  ret_from_fork_asm+0x1a/0x30
[   18.484329]  </TASK>
[   18.484346] 
[   18.497268] Allocated by task 210:
[   18.497558]  kasan_save_stack+0x45/0x70
[   18.497905]  kasan_save_track+0x18/0x40
[   18.498317]  kasan_save_alloc_info+0x3b/0x50
[   18.498785]  __kasan_kmalloc+0xb7/0xc0
[   18.499262]  __kmalloc_cache_noprof+0x189/0x420
[   18.499731]  kmalloc_double_kzfree+0xa9/0x350
[   18.500267]  kunit_try_run_case+0x1a5/0x480
[   18.500715]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.501300]  kthread+0x337/0x6f0
[   18.501700]  ret_from_fork+0x116/0x1d0
[   18.502142]  ret_from_fork_asm+0x1a/0x30
[   18.502533] 
[   18.502742] Freed by task 210:
[   18.503156]  kasan_save_stack+0x45/0x70
[   18.503549]  kasan_save_track+0x18/0x40
[   18.503861]  kasan_save_free_info+0x3f/0x60
[   18.504368]  __kasan_slab_free+0x56/0x70
[   18.504764]  kfree+0x222/0x3f0
[   18.505186]  kfree_sensitive+0x67/0x90
[   18.505596]  kmalloc_double_kzfree+0x12b/0x350
[   18.506045]  kunit_try_run_case+0x1a5/0x480
[   18.506487]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.506871]  kthread+0x337/0x6f0
[   18.507315]  ret_from_fork+0x116/0x1d0
[   18.507719]  ret_from_fork_asm+0x1a/0x30
[   18.508194] 
[   18.508430] The buggy address belongs to the object at ffff88810262e160
[   18.508430]  which belongs to the cache kmalloc-16 of size 16
[   18.509344] The buggy address is located 0 bytes inside of
[   18.509344]  freed 16-byte region [ffff88810262e160, ffff88810262e170)
[   18.510227] 
[   18.510428] The buggy address belongs to the physical page:
[   18.510795] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10262e
[   18.511546] flags: 0x200000000000000(node=0|zone=2)
[   18.512039] page_type: f5(slab)
[   18.512450] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   18.513162] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   18.513833] page dumped because: kasan: bad access detected
[   18.514359] 
[   18.514587] Memory state around the buggy address:
[   18.514946]  ffff88810262e000: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc
[   18.515648]  ffff88810262e080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.516205] >ffff88810262e100: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.516643]                                                        ^
[   18.517167]  ffff88810262e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.517784]  ffff88810262e200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.518458] ==================================================================

[   20.802398] ==================================================================
[   20.803751] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   20.804455] Read of size 1 at addr ffff000001e6e700 by task kunit_try_catch/245
[   20.805134] 
[   20.805299] CPU: 1 UID: 0 PID: 245 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   20.805348] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.805363] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.805380] Call trace:
[   20.805391]  show_stack+0x20/0x38 (C)
[   20.805428]  dump_stack_lvl+0x8c/0xd0
[   20.805463]  print_report+0x118/0x608
[   20.805497]  kasan_report+0xdc/0x128
[   20.805530]  __kasan_check_byte+0x54/0x70
[   20.805562]  kfree_sensitive+0x30/0xb0
[   20.805594]  kmalloc_double_kzfree+0x168/0x308
[   20.805626]  kunit_try_run_case+0x170/0x3f0
[   20.805659]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.805698]  kthread+0x328/0x630
[   20.805725]  ret_from_fork+0x10/0x20
[   20.805757] 
[   20.811626] Allocated by task 245:
[   20.811950]  kasan_save_stack+0x3c/0x68
[   20.812328]  kasan_save_track+0x20/0x40
[   20.812704]  kasan_save_alloc_info+0x40/0x58
[   20.813121]  __kasan_kmalloc+0xd4/0xd8
[   20.813488]  __kmalloc_cache_noprof+0x16c/0x3c0
[   20.813925]  kmalloc_double_kzfree+0xb8/0x308
[   20.814345]  kunit_try_run_case+0x170/0x3f0
[   20.814751]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.815274]  kthread+0x328/0x630
[   20.815589]  ret_from_fork+0x10/0x20
[   20.815940] 
[   20.816093] Freed by task 245:
[   20.816386]  kasan_save_stack+0x3c/0x68
[   20.816763]  kasan_save_track+0x20/0x40
[   20.817138]  kasan_save_free_info+0x4c/0x78
[   20.817545]  __kasan_slab_free+0x6c/0x98
[   20.817927]  kfree+0x214/0x3c8
[   20.818230]  kfree_sensitive+0x80/0xb0
[   20.818596]  kmalloc_double_kzfree+0x11c/0x308
[   20.819023]  kunit_try_run_case+0x170/0x3f0
[   20.819429]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.819952]  kthread+0x328/0x630
[   20.820267]  ret_from_fork+0x10/0x20
[   20.820619] 
[   20.820771] The buggy address belongs to the object at ffff000001e6e700
[   20.820771]  which belongs to the cache kmalloc-16 of size 16
[   20.821888] The buggy address is located 0 bytes inside of
[   20.821888]  freed 16-byte region [ffff000001e6e700, ffff000001e6e710)
[   20.822977] 
[   20.823130] The buggy address belongs to the physical page:
[   20.823645] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e6e
[   20.824369] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.824982] page_type: f5(slab)
[   20.825297] raw: 03fffe0000000000 ffff000000402640 dead000000000122 0000000000000000
[   20.826012] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   20.826719] page dumped because: kasan: bad access detected
[   20.827234] 
[   20.827386] Memory state around the buggy address:
[   20.827835]  ffff000001e6e600: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   20.828500]  ffff000001e6e680: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   20.829165] >ffff000001e6e700: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.829826]                    ^
[   20.830137]  ffff000001e6e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.830802]  ffff000001e6e800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.831463] ==================================================================