Hay
Date
June 8, 2025, 11:09 p.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
rk3399-rock-pi-4b

[   29.080260] ==================================================================
[   29.090381] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   29.096889] Read of size 1 at addr ffff000800c2f088 by task kunit_try_catch/231
[   29.104179] 
[   29.105666] CPU: 5 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   29.105728] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.105746] Hardware name: WinLink E850-96 board (DT)
[   29.105769] Call trace:
[   29.105782]  show_stack+0x20/0x38 (C)
[   29.105817]  dump_stack_lvl+0x8c/0xd0
[   29.105854]  print_report+0x118/0x608
[   29.105892]  kasan_report+0xdc/0x128
[   29.105924]  __asan_report_load1_noabort+0x20/0x30
[   29.105966]  kmalloc_uaf+0x300/0x338
[   29.105992]  kunit_try_run_case+0x170/0x3f0
[   29.106028]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.106067]  kthread+0x328/0x630
[   29.106098]  ret_from_fork+0x10/0x20
[   29.106135] 
[   29.167895] Allocated by task 231:
[   29.171282]  kasan_save_stack+0x3c/0x68
[   29.175099]  kasan_save_track+0x20/0x40
[   29.178918]  kasan_save_alloc_info+0x40/0x58
[   29.183171]  __kasan_kmalloc+0xd4/0xd8
[   29.186904]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.191417]  kmalloc_uaf+0xb8/0x338
[   29.194890]  kunit_try_run_case+0x170/0x3f0
[   29.199056]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.204525]  kthread+0x328/0x630
[   29.207737]  ret_from_fork+0x10/0x20
[   29.211296] 
[   29.212771] Freed by task 231:
[   29.215809]  kasan_save_stack+0x3c/0x68
[   29.219629]  kasan_save_track+0x20/0x40
[   29.223450]  kasan_save_free_info+0x4c/0x78
[   29.227615]  __kasan_slab_free+0x6c/0x98
[   29.231521]  kfree+0x214/0x3c8
[   29.234559]  kmalloc_uaf+0x11c/0x338
[   29.238118]  kunit_try_run_case+0x170/0x3f0
[   29.242286]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.247753]  kthread+0x328/0x630
[   29.250965]  ret_from_fork+0x10/0x20
[   29.254524] 
[   29.256001] The buggy address belongs to the object at ffff000800c2f080
[   29.256001]  which belongs to the cache kmalloc-16 of size 16
[   29.268328] The buggy address is located 8 bytes inside of
[   29.268328]  freed 16-byte region [ffff000800c2f080, ffff000800c2f090)
[   29.280305] 
[   29.281783] The buggy address belongs to the physical page:
[   29.287340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880c2f
[   29.295325] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.301835] page_type: f5(slab)
[   29.304971] raw: 0bfffe0000000000 ffff000800002640 dead000000000122 0000000000000000
[   29.312690] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   29.320410] page dumped because: kasan: bad access detected
[   29.325964] 
[   29.327440] Memory state around the buggy address:
[   29.332222]  ffff000800c2ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.339424]  ffff000800c2f000: 00 04 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   29.346627] >ffff000800c2f080: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.353828]                       ^
[   29.357305]  ffff000800c2f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.364509]  ffff000800c2f180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.371713] ==================================================================

[   25.542277] ==================================================================
[   25.542410] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   25.542543] Read of size 1 at addr fff00000c62bd308 by task kunit_try_catch/184
[   25.542719] 
[   25.542790] CPU: 0 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.543020] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.543088] Hardware name: linux,dummy-virt (DT)
[   25.543187] Call trace:
[   25.543250]  show_stack+0x20/0x38 (C)
[   25.543436]  dump_stack_lvl+0x8c/0xd0
[   25.543580]  print_report+0x118/0x608
[   25.543713]  kasan_report+0xdc/0x128
[   25.543838]  __asan_report_load1_noabort+0x20/0x30
[   25.544100]  kmalloc_uaf+0x300/0x338
[   25.544315]  kunit_try_run_case+0x170/0x3f0
[   25.544540]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.544770]  kthread+0x328/0x630
[   25.545043]  ret_from_fork+0x10/0x20
[   25.545401] 
[   25.545455] Allocated by task 184:
[   25.545655]  kasan_save_stack+0x3c/0x68
[   25.545914]  kasan_save_track+0x20/0x40
[   25.546204]  kasan_save_alloc_info+0x40/0x58
[   25.546312]  __kasan_kmalloc+0xd4/0xd8
[   25.546420]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.546710]  kmalloc_uaf+0xb8/0x338
[   25.546997]  kunit_try_run_case+0x170/0x3f0
[   25.547104]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.547226]  kthread+0x328/0x630
[   25.547369]  ret_from_fork+0x10/0x20
[   25.547517] 
[   25.547573] Freed by task 184:
[   25.547652]  kasan_save_stack+0x3c/0x68
[   25.547761]  kasan_save_track+0x20/0x40
[   25.547871]  kasan_save_free_info+0x4c/0x78
[   25.548119]  __kasan_slab_free+0x6c/0x98
[   25.548385]  kfree+0x214/0x3c8
[   25.548532]  kmalloc_uaf+0x11c/0x338
[   25.548652]  kunit_try_run_case+0x170/0x3f0
[   25.548757]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.548889]  kthread+0x328/0x630
[   25.549045]  ret_from_fork+0x10/0x20
[   25.549145] 
[   25.549204] The buggy address belongs to the object at fff00000c62bd300
[   25.549204]  which belongs to the cache kmalloc-16 of size 16
[   25.549438] The buggy address is located 8 bytes inside of
[   25.549438]  freed 16-byte region [fff00000c62bd300, fff00000c62bd310)
[   25.549588] 
[   25.549683] The buggy address belongs to the physical page:
[   25.549764] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1062bd
[   25.549988] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.550239] page_type: f5(slab)
[   25.550332] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   25.550455] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   25.550554] page dumped because: kasan: bad access detected
[   25.550633] 
[   25.550676] Memory state around the buggy address:
[   25.550798]  fff00000c62bd200: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc
[   25.551005]  fff00000c62bd280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.551139] >fff00000c62bd300: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.551324]                       ^
[   25.551406]  fff00000c62bd380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.551584]  fff00000c62bd400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.551760] ==================================================================

[   25.777992] ==================================================================
[   25.778228] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   25.778453] Read of size 1 at addr fff00000c56fe3e8 by task kunit_try_catch/184
[   25.778787] 
[   25.778905] CPU: 0 UID: 0 PID: 184 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.779128] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.779248] Hardware name: linux,dummy-virt (DT)
[   25.779341] Call trace:
[   25.779394]  show_stack+0x20/0x38 (C)
[   25.779542]  dump_stack_lvl+0x8c/0xd0
[   25.779923]  print_report+0x118/0x608
[   25.780129]  kasan_report+0xdc/0x128
[   25.780243]  __asan_report_load1_noabort+0x20/0x30
[   25.780373]  kmalloc_uaf+0x300/0x338
[   25.780478]  kunit_try_run_case+0x170/0x3f0
[   25.780596]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.780724]  kthread+0x328/0x630
[   25.780826]  ret_from_fork+0x10/0x20
[   25.780964] 
[   25.781007] Allocated by task 184:
[   25.781103]  kasan_save_stack+0x3c/0x68
[   25.781230]  kasan_save_track+0x20/0x40
[   25.781337]  kasan_save_alloc_info+0x40/0x58
[   25.781457]  __kasan_kmalloc+0xd4/0xd8
[   25.781778]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.782085]  kmalloc_uaf+0xb8/0x338
[   25.782192]  kunit_try_run_case+0x170/0x3f0
[   25.782298]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.782441]  kthread+0x328/0x630
[   25.782546]  ret_from_fork+0x10/0x20
[   25.782690] 
[   25.782739] Freed by task 184:
[   25.782814]  kasan_save_stack+0x3c/0x68
[   25.783332]  kasan_save_track+0x20/0x40
[   25.783584]  kasan_save_free_info+0x4c/0x78
[   25.783733]  __kasan_slab_free+0x6c/0x98
[   25.783863]  kfree+0x214/0x3c8
[   25.784092]  kmalloc_uaf+0x11c/0x338
[   25.784181]  kunit_try_run_case+0x170/0x3f0
[   25.784286]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.784590]  kthread+0x328/0x630
[   25.784727]  ret_from_fork+0x10/0x20
[   25.784875] 
[   25.784935] The buggy address belongs to the object at fff00000c56fe3e0
[   25.784935]  which belongs to the cache kmalloc-16 of size 16
[   25.785123] The buggy address is located 8 bytes inside of
[   25.785123]  freed 16-byte region [fff00000c56fe3e0, fff00000c56fe3f0)
[   25.785697] 
[   25.785773] The buggy address belongs to the physical page:
[   25.785871] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1056fe
[   25.786005] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.786138] page_type: f5(slab)
[   25.786239] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   25.786393] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   25.786571] page dumped because: kasan: bad access detected
[   25.786751] 
[   25.787082] Memory state around the buggy address:
[   25.787216]  fff00000c56fe280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.787331]  fff00000c56fe300: fa fb fc fc 00 04 fc fc fa fb fc fc fa fb fc fc
[   25.787457] >fff00000c56fe380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   25.787786]                                                           ^
[   25.787912]  fff00000c56fe400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.788024]  fff00000c56fe480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.788124] ==================================================================

[   19.262224] ==================================================================
[   19.263376] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380
[   19.264141] Read of size 1 at addr ffff888101a90bc8 by task kunit_try_catch/202
[   19.264681] 
[   19.264892] CPU: 1 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   19.265005] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.265038] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.265090] Call Trace:
[   19.265125]  <TASK>
[   19.265170]  dump_stack_lvl+0x73/0xb0
[   19.265252]  print_report+0xd1/0x650
[   19.265317]  ? __virt_addr_valid+0x1db/0x2d0
[   19.265385]  ? kmalloc_uaf+0x320/0x380
[   19.265446]  ? kasan_complete_mode_report_info+0x64/0x200
[   19.265535]  ? kmalloc_uaf+0x320/0x380
[   19.265599]  kasan_report+0x141/0x180
[   19.265679]  ? kmalloc_uaf+0x320/0x380
[   19.265753]  __asan_report_load1_noabort+0x18/0x20
[   19.265825]  kmalloc_uaf+0x320/0x380
[   19.265887]  ? __pfx_kmalloc_uaf+0x10/0x10
[   19.265950]  ? __schedule+0x10cc/0x2b60
[   19.266021]  ? __pfx_read_tsc+0x10/0x10
[   19.266088]  ? ktime_get_ts64+0x86/0x230
[   19.266157]  kunit_try_run_case+0x1a5/0x480
[   19.266231]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.266301]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   19.266362]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   19.266426]  ? __kthread_parkme+0x82/0x180
[   19.266486]  ? preempt_count_sub+0x50/0x80
[   19.266581]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.266647]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.266715]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   19.266786]  kthread+0x337/0x6f0
[   19.266852]  ? trace_preempt_on+0x20/0xc0
[   19.266928]  ? __pfx_kthread+0x10/0x10
[   19.267325]  ? _raw_spin_unlock_irq+0x47/0x80
[   19.267412]  ? calculate_sigpending+0x7b/0xa0
[   19.267494]  ? __pfx_kthread+0x10/0x10
[   19.267703]  ret_from_fork+0x116/0x1d0
[   19.267772]  ? __pfx_kthread+0x10/0x10
[   19.267842]  ret_from_fork_asm+0x1a/0x30
[   19.268028]  </TASK>
[   19.268069] 
[   19.289579] Allocated by task 202:
[   19.290021]  kasan_save_stack+0x45/0x70
[   19.291024]  kasan_save_track+0x18/0x40
[   19.291823]  kasan_save_alloc_info+0x3b/0x50
[   19.292520]  __kasan_kmalloc+0xb7/0xc0
[   19.292999]  __kmalloc_cache_noprof+0x189/0x420
[   19.293806]  kmalloc_uaf+0xaa/0x380
[   19.294150]  kunit_try_run_case+0x1a5/0x480
[   19.294989]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.295472]  kthread+0x337/0x6f0
[   19.295996]  ret_from_fork+0x116/0x1d0
[   19.296422]  ret_from_fork_asm+0x1a/0x30
[   19.297004] 
[   19.297272] Freed by task 202:
[   19.297897]  kasan_save_stack+0x45/0x70
[   19.298326]  kasan_save_track+0x18/0x40
[   19.298750]  kasan_save_free_info+0x3f/0x60
[   19.299123]  __kasan_slab_free+0x56/0x70
[   19.299588]  kfree+0x222/0x3f0
[   19.299956]  kmalloc_uaf+0x12c/0x380
[   19.300684]  kunit_try_run_case+0x1a5/0x480
[   19.301083]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.301722]  kthread+0x337/0x6f0
[   19.302097]  ret_from_fork+0x116/0x1d0
[   19.302671]  ret_from_fork_asm+0x1a/0x30
[   19.303102] 
[   19.303377] The buggy address belongs to the object at ffff888101a90bc0
[   19.303377]  which belongs to the cache kmalloc-16 of size 16
[   19.304731] The buggy address is located 8 bytes inside of
[   19.304731]  freed 16-byte region [ffff888101a90bc0, ffff888101a90bd0)
[   19.305693] 
[   19.305896] The buggy address belongs to the physical page:
[   19.306426] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101a90
[   19.307030] flags: 0x200000000000000(node=0|zone=2)
[   19.307441] page_type: f5(slab)
[   19.308018] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   19.308888] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   19.309475] page dumped because: kasan: bad access detected
[   19.310164] 
[   19.310452] Memory state around the buggy address:
[   19.311206]  ffff888101a90a80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   19.312004]  ffff888101a90b00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   19.312802] >ffff888101a90b80: fa fb fc fc fa fb fc fc fa fb fc fc fc fc fc fc
[   19.313363]                                               ^
[   19.313987]  ffff888101a90c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.314810]  ffff888101a90c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.315397] ==================================================================

[   18.297156] ==================================================================
[   18.298185] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380
[   18.298787] Read of size 1 at addr ffff888101e49ea8 by task kunit_try_catch/202
[   18.299534] 
[   18.300223] CPU: 1 UID: 0 PID: 202 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   18.300717] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.300735] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.300765] Call Trace:
[   18.300780]  <TASK>
[   18.300798]  dump_stack_lvl+0x73/0xb0
[   18.300842]  print_report+0xd1/0x650
[   18.300874]  ? __virt_addr_valid+0x1db/0x2d0
[   18.300934]  ? kmalloc_uaf+0x320/0x380
[   18.300964]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.300994]  ? kmalloc_uaf+0x320/0x380
[   18.301023]  kasan_report+0x141/0x180
[   18.301054]  ? kmalloc_uaf+0x320/0x380
[   18.301088]  __asan_report_load1_noabort+0x18/0x20
[   18.301151]  kmalloc_uaf+0x320/0x380
[   18.301184]  ? __pfx_kmalloc_uaf+0x10/0x10
[   18.301215]  ? __schedule+0x10cc/0x2b60
[   18.301247]  ? __pfx_read_tsc+0x10/0x10
[   18.301275]  ? ktime_get_ts64+0x86/0x230
[   18.301307]  kunit_try_run_case+0x1a5/0x480
[   18.301342]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.301375]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.301406]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.301439]  ? __kthread_parkme+0x82/0x180
[   18.301466]  ? preempt_count_sub+0x50/0x80
[   18.301496]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.301604]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.301657]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.301693]  kthread+0x337/0x6f0
[   18.301720]  ? trace_preempt_on+0x20/0xc0
[   18.301753]  ? __pfx_kthread+0x10/0x10
[   18.301781]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.301811]  ? calculate_sigpending+0x7b/0xa0
[   18.301845]  ? __pfx_kthread+0x10/0x10
[   18.301873]  ret_from_fork+0x116/0x1d0
[   18.301930]  ? __pfx_kthread+0x10/0x10
[   18.301960]  ret_from_fork_asm+0x1a/0x30
[   18.302002]  </TASK>
[   18.302017] 
[   18.322640] Allocated by task 202:
[   18.323033]  kasan_save_stack+0x45/0x70
[   18.324115]  kasan_save_track+0x18/0x40
[   18.324459]  kasan_save_alloc_info+0x3b/0x50
[   18.325021]  __kasan_kmalloc+0xb7/0xc0
[   18.325698]  __kmalloc_cache_noprof+0x189/0x420
[   18.326040]  kmalloc_uaf+0xaa/0x380
[   18.326960]  kunit_try_run_case+0x1a5/0x480
[   18.327500]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.328293]  kthread+0x337/0x6f0
[   18.328895]  ret_from_fork+0x116/0x1d0
[   18.329249]  ret_from_fork_asm+0x1a/0x30
[   18.329801] 
[   18.330039] Freed by task 202:
[   18.330327]  kasan_save_stack+0x45/0x70
[   18.330805]  kasan_save_track+0x18/0x40
[   18.331204]  kasan_save_free_info+0x3f/0x60
[   18.332319]  __kasan_slab_free+0x56/0x70
[   18.332805]  kfree+0x222/0x3f0
[   18.333440]  kmalloc_uaf+0x12c/0x380
[   18.333786]  kunit_try_run_case+0x1a5/0x480
[   18.334292]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.334831]  kthread+0x337/0x6f0
[   18.335301]  ret_from_fork+0x116/0x1d0
[   18.335992]  ret_from_fork_asm+0x1a/0x30
[   18.336420] 
[   18.336660] The buggy address belongs to the object at ffff888101e49ea0
[   18.336660]  which belongs to the cache kmalloc-16 of size 16
[   18.337614] The buggy address is located 8 bytes inside of
[   18.337614]  freed 16-byte region [ffff888101e49ea0, ffff888101e49eb0)
[   18.338899] 
[   18.339142] The buggy address belongs to the physical page:
[   18.339703] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e49
[   18.340299] flags: 0x200000000000000(node=0|zone=2)
[   18.340926] page_type: f5(slab)
[   18.341290] raw: 0200000000000000 ffff888100041640 dead000000000122 0000000000000000
[   18.341786] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   18.342486] page dumped because: kasan: bad access detected
[   18.343010] 
[   18.343198] Memory state around the buggy address:
[   18.344049]  ffff888101e49d80: 00 02 fc fc 00 02 fc fc 00 02 fc fc fa fb fc fc
[   18.344982]  ffff888101e49e00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   18.345494] >ffff888101e49e80: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   18.346243]                                   ^
[   18.346657]  ffff888101e49f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.347299]  ffff888101e49f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.347829] ==================================================================

[   20.704225] ==================================================================
[   20.705366] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   20.705994] Read of size 1 at addr ffff000001e6e6e8 by task kunit_try_catch/237
[   20.706672] 
[   20.706836] CPU: 1 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   20.706887] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.706901] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.706918] Call trace:
[   20.706930]  show_stack+0x20/0x38 (C)
[   20.706963]  dump_stack_lvl+0x8c/0xd0
[   20.706999]  print_report+0x118/0x608
[   20.707033]  kasan_report+0xdc/0x128
[   20.707064]  __asan_report_load1_noabort+0x20/0x30
[   20.707101]  kmalloc_uaf+0x300/0x338
[   20.707129]  kunit_try_run_case+0x170/0x3f0
[   20.707163]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.707200]  kthread+0x328/0x630
[   20.707227]  ret_from_fork+0x10/0x20
[   20.707259] 
[   20.712785] Allocated by task 237:
[   20.713111]  kasan_save_stack+0x3c/0x68
[   20.713489]  kasan_save_track+0x20/0x40
[   20.713863]  kasan_save_alloc_info+0x40/0x58
[   20.714278]  __kasan_kmalloc+0xd4/0xd8
[   20.714647]  __kmalloc_cache_noprof+0x16c/0x3c0
[   20.715083]  kmalloc_uaf+0xb8/0x338
[   20.715424]  kunit_try_run_case+0x170/0x3f0
[   20.715829]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.716353]  kthread+0x328/0x630
[   20.716670]  ret_from_fork+0x10/0x20
[   20.717020] 
[   20.717172] Freed by task 237:
[   20.717466]  kasan_save_stack+0x3c/0x68
[   20.717842]  kasan_save_track+0x20/0x40
[   20.718217]  kasan_save_free_info+0x4c/0x78
[   20.718625]  __kasan_slab_free+0x6c/0x98
[   20.719009]  kfree+0x214/0x3c8
[   20.719312]  kmalloc_uaf+0x11c/0x338
[   20.719660]  kunit_try_run_case+0x170/0x3f0
[   20.720066]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.720589]  kthread+0x328/0x630
[   20.720905]  ret_from_fork+0x10/0x20
[   20.721254] 
[   20.721407] The buggy address belongs to the object at ffff000001e6e6e0
[   20.721407]  which belongs to the cache kmalloc-16 of size 16
[   20.722524] The buggy address is located 8 bytes inside of
[   20.722524]  freed 16-byte region [ffff000001e6e6e0, ffff000001e6e6f0)
[   20.723613] 
[   20.723767] The buggy address belongs to the physical page:
[   20.724282] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e6e
[   20.725007] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.725618] page_type: f5(slab)
[   20.725931] raw: 03fffe0000000000 ffff000000402640 dead000000000122 0000000000000000
[   20.726647] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   20.727354] page dumped because: kasan: bad access detected
[   20.727869] 
[   20.728020] Memory state around the buggy address:
[   20.728469]  ffff000001e6e580: 00 05 fc fc 00 05 fc fc 00 05 fc fc fa fb fc fc
[   20.729135]  ffff000001e6e600: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   20.729800] >ffff000001e6e680: 00 05 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   20.730462]                                                           ^
[   20.731070]  ffff000001e6e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.731735]  ffff000001e6e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.732396] ==================================================================