Hay
Date
June 8, 2025, 11:09 p.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
rk3399-rock-pi-4b

[   29.684963] ==================================================================
[   29.694280] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   29.700874] Read of size 1 at addr ffff000800c2e9a8 by task kunit_try_catch/235
[   29.708163] 
[   29.709649] CPU: 5 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   29.709706] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.709724] Hardware name: WinLink E850-96 board (DT)
[   29.709747] Call trace:
[   29.709760]  show_stack+0x20/0x38 (C)
[   29.709797]  dump_stack_lvl+0x8c/0xd0
[   29.709835]  print_report+0x118/0x608
[   29.709870]  kasan_report+0xdc/0x128
[   29.709906]  __asan_report_load1_noabort+0x20/0x30
[   29.709946]  kmalloc_uaf2+0x3f4/0x468
[   29.709976]  kunit_try_run_case+0x170/0x3f0
[   29.710014]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.710052]  kthread+0x328/0x630
[   29.710085]  ret_from_fork+0x10/0x20
[   29.710122] 
[   29.771966] Allocated by task 235:
[   29.775354]  kasan_save_stack+0x3c/0x68
[   29.779169]  kasan_save_track+0x20/0x40
[   29.782989]  kasan_save_alloc_info+0x40/0x58
[   29.787242]  __kasan_kmalloc+0xd4/0xd8
[   29.790974]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.795488]  kmalloc_uaf2+0xc4/0x468
[   29.799047]  kunit_try_run_case+0x170/0x3f0
[   29.803214]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.808684]  kthread+0x328/0x630
[   29.811894]  ret_from_fork+0x10/0x20
[   29.815452] 
[   29.816928] Freed by task 235:
[   29.819967]  kasan_save_stack+0x3c/0x68
[   29.823786]  kasan_save_track+0x20/0x40
[   29.827607]  kasan_save_free_info+0x4c/0x78
[   29.831773]  __kasan_slab_free+0x6c/0x98
[   29.835679]  kfree+0x214/0x3c8
[   29.838717]  kmalloc_uaf2+0x134/0x468
[   29.842363]  kunit_try_run_case+0x170/0x3f0
[   29.846529]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.851998]  kthread+0x328/0x630
[   29.855210]  ret_from_fork+0x10/0x20
[   29.858769] 
[   29.860247] The buggy address belongs to the object at ffff000800c2e980
[   29.860247]  which belongs to the cache kmalloc-64 of size 64
[   29.872574] The buggy address is located 40 bytes inside of
[   29.872574]  freed 64-byte region [ffff000800c2e980, ffff000800c2e9c0)
[   29.884636] 
[   29.886114] The buggy address belongs to the physical page:
[   29.891674] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880c2e
[   29.899655] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.906166] page_type: f5(slab)
[   29.909301] raw: 0bfffe0000000000 ffff0008000028c0 dead000000000122 0000000000000000
[   29.917021] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   29.924741] page dumped because: kasan: bad access detected
[   29.930295] 
[   29.931770] Memory state around the buggy address:
[   29.936552]  ffff000800c2e880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.943754]  ffff000800c2e900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.950958] >ffff000800c2e980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.958159]                                   ^
[   29.962678]  ffff000800c2ea00: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   29.969882]  ffff000800c2ea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.977086] ==================================================================

[   25.603374] ==================================================================
[   25.604097] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   25.604491] Read of size 1 at addr fff00000c6418728 by task kunit_try_catch/188
[   25.604631] 
[   25.604957] CPU: 0 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.605796] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.605893] Hardware name: linux,dummy-virt (DT)
[   25.605993] Call trace:
[   25.606101]  show_stack+0x20/0x38 (C)
[   25.606362]  dump_stack_lvl+0x8c/0xd0
[   25.606998]  print_report+0x118/0x608
[   25.607166]  kasan_report+0xdc/0x128
[   25.607317]  __asan_report_load1_noabort+0x20/0x30
[   25.607889]  kmalloc_uaf2+0x3f4/0x468
[   25.608029]  kunit_try_run_case+0x170/0x3f0
[   25.608346]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.608665]  kthread+0x328/0x630
[   25.608818]  ret_from_fork+0x10/0x20
[   25.609081] 
[   25.609128] Allocated by task 188:
[   25.609285]  kasan_save_stack+0x3c/0x68
[   25.609424]  kasan_save_track+0x20/0x40
[   25.609659]  kasan_save_alloc_info+0x40/0x58
[   25.609763]  __kasan_kmalloc+0xd4/0xd8
[   25.609855]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.609974]  kmalloc_uaf2+0xc4/0x468
[   25.610061]  kunit_try_run_case+0x170/0x3f0
[   25.610154]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.610361]  kthread+0x328/0x630
[   25.610529]  ret_from_fork+0x10/0x20
[   25.610673] 
[   25.610801] Freed by task 188:
[   25.610916]  kasan_save_stack+0x3c/0x68
[   25.611057]  kasan_save_track+0x20/0x40
[   25.611173]  kasan_save_free_info+0x4c/0x78
[   25.611293]  __kasan_slab_free+0x6c/0x98
[   25.611403]  kfree+0x214/0x3c8
[   25.611507]  kmalloc_uaf2+0x134/0x468
[   25.611610]  kunit_try_run_case+0x170/0x3f0
[   25.611725]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.611876]  kthread+0x328/0x630
[   25.612024]  ret_from_fork+0x10/0x20
[   25.612127] 
[   25.612185] The buggy address belongs to the object at fff00000c6418700
[   25.612185]  which belongs to the cache kmalloc-64 of size 64
[   25.612334] The buggy address is located 40 bytes inside of
[   25.612334]  freed 64-byte region [fff00000c6418700, fff00000c6418740)
[   25.612503] 
[   25.612557] The buggy address belongs to the physical page:
[   25.612677] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106418
[   25.612873] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.613142] page_type: f5(slab)
[   25.613299] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   25.613478] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   25.613664] page dumped because: kasan: bad access detected
[   25.613747] 
[   25.613795] Memory state around the buggy address:
[   25.613881]  fff00000c6418600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.614027]  fff00000c6418680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.614149] >fff00000c6418700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.614254]                                   ^
[   25.614335]  fff00000c6418780: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   25.614440]  fff00000c6418800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.614554] ==================================================================

[   25.862949] ==================================================================
[   25.863075] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   25.863196] Read of size 1 at addr fff00000c7713328 by task kunit_try_catch/188
[   25.863605] 
[   25.863707] CPU: 0 UID: 0 PID: 188 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.864067] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.864382] Hardware name: linux,dummy-virt (DT)
[   25.864483] Call trace:
[   25.864626]  show_stack+0x20/0x38 (C)
[   25.864926]  dump_stack_lvl+0x8c/0xd0
[   25.865611]  print_report+0x118/0x608
[   25.865764]  kasan_report+0xdc/0x128
[   25.865922]  __asan_report_load1_noabort+0x20/0x30
[   25.866065]  kmalloc_uaf2+0x3f4/0x468
[   25.866288]  kunit_try_run_case+0x170/0x3f0
[   25.866452]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.867100]  kthread+0x328/0x630
[   25.867563]  ret_from_fork+0x10/0x20
[   25.867695] 
[   25.867740] Allocated by task 188:
[   25.867821]  kasan_save_stack+0x3c/0x68
[   25.867937]  kasan_save_track+0x20/0x40
[   25.868883]  kasan_save_alloc_info+0x40/0x58
[   25.869088]  __kasan_kmalloc+0xd4/0xd8
[   25.869205]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.869314]  kmalloc_uaf2+0xc4/0x468
[   25.869599]  kunit_try_run_case+0x170/0x3f0
[   25.870192]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.870370]  kthread+0x328/0x630
[   25.870587]  ret_from_fork+0x10/0x20
[   25.870681] 
[   25.870724] Freed by task 188:
[   25.870790]  kasan_save_stack+0x3c/0x68
[   25.870904]  kasan_save_track+0x20/0x40
[   25.871017]  kasan_save_free_info+0x4c/0x78
[   25.871289]  __kasan_slab_free+0x6c/0x98
[   25.871564]  kfree+0x214/0x3c8
[   25.871697]  kmalloc_uaf2+0x134/0x468
[   25.872245]  kunit_try_run_case+0x170/0x3f0
[   25.872712]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.872965]  kthread+0x328/0x630
[   25.873094]  ret_from_fork+0x10/0x20
[   25.873286] 
[   25.873334] The buggy address belongs to the object at fff00000c7713300
[   25.873334]  which belongs to the cache kmalloc-64 of size 64
[   25.873475] The buggy address is located 40 bytes inside of
[   25.873475]  freed 64-byte region [fff00000c7713300, fff00000c7713340)
[   25.873684] 
[   25.873997] The buggy address belongs to the physical page:
[   25.874166] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107713
[   25.874444] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.874723] page_type: f5(slab)
[   25.874831] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   25.875052] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   25.875310] page dumped because: kasan: bad access detected
[   25.875391] 
[   25.875433] Memory state around the buggy address:
[   25.875510]  fff00000c7713200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.875614]  fff00000c7713280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.875718] >fff00000c7713300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.875876]                                   ^
[   25.876077]  fff00000c7713380: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   25.876281]  fff00000c7713400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.876374] ==================================================================

[   19.386289] ==================================================================
[   19.387639] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520
[   19.388353] Read of size 1 at addr ffff8881039cc128 by task kunit_try_catch/206
[   19.388937] 
[   19.389525] CPU: 0 UID: 0 PID: 206 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   19.390215] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.390255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.390312] Call Trace:
[   19.390343]  <TASK>
[   19.390368]  dump_stack_lvl+0x73/0xb0
[   19.390422]  print_report+0xd1/0x650
[   19.390456]  ? __virt_addr_valid+0x1db/0x2d0
[   19.390488]  ? kmalloc_uaf2+0x4a8/0x520
[   19.390554]  ? kasan_complete_mode_report_info+0x64/0x200
[   19.390648]  ? kmalloc_uaf2+0x4a8/0x520
[   19.390714]  kasan_report+0x141/0x180
[   19.390748]  ? kmalloc_uaf2+0x4a8/0x520
[   19.390782]  __asan_report_load1_noabort+0x18/0x20
[   19.390816]  kmalloc_uaf2+0x4a8/0x520
[   19.390844]  ? __pfx_kmalloc_uaf2+0x10/0x10
[   19.390870]  ? finish_task_switch.isra.0+0x153/0x700
[   19.390902]  ? __switch_to+0x47/0xf50
[   19.390939]  ? __schedule+0x10cc/0x2b60
[   19.390970]  ? __pfx_read_tsc+0x10/0x10
[   19.390999]  ? ktime_get_ts64+0x86/0x230
[   19.391030]  kunit_try_run_case+0x1a5/0x480
[   19.391067]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.391099]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   19.391132]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   19.391165]  ? __kthread_parkme+0x82/0x180
[   19.391192]  ? preempt_count_sub+0x50/0x80
[   19.391224]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.391286]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.391321]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   19.391355]  kthread+0x337/0x6f0
[   19.391383]  ? trace_preempt_on+0x20/0xc0
[   19.391416]  ? __pfx_kthread+0x10/0x10
[   19.391445]  ? _raw_spin_unlock_irq+0x47/0x80
[   19.391475]  ? calculate_sigpending+0x7b/0xa0
[   19.391536]  ? __pfx_kthread+0x10/0x10
[   19.391639]  ret_from_fork+0x116/0x1d0
[   19.391690]  ? __pfx_kthread+0x10/0x10
[   19.391720]  ret_from_fork_asm+0x1a/0x30
[   19.391763]  </TASK>
[   19.391778] 
[   19.413984] Allocated by task 206:
[   19.414491]  kasan_save_stack+0x45/0x70
[   19.415197]  kasan_save_track+0x18/0x40
[   19.415859]  kasan_save_alloc_info+0x3b/0x50
[   19.416401]  __kasan_kmalloc+0xb7/0xc0
[   19.416831]  __kmalloc_cache_noprof+0x189/0x420
[   19.418024]  kmalloc_uaf2+0xc6/0x520
[   19.418766]  kunit_try_run_case+0x1a5/0x480
[   19.419214]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.419882]  kthread+0x337/0x6f0
[   19.420445]  ret_from_fork+0x116/0x1d0
[   19.420815]  ret_from_fork_asm+0x1a/0x30
[   19.422171] 
[   19.422554] Freed by task 206:
[   19.423065]  kasan_save_stack+0x45/0x70
[   19.423759]  kasan_save_track+0x18/0x40
[   19.424198]  kasan_save_free_info+0x3f/0x60
[   19.424695]  __kasan_slab_free+0x56/0x70
[   19.425115]  kfree+0x222/0x3f0
[   19.425480]  kmalloc_uaf2+0x14c/0x520
[   19.426542]  kunit_try_run_case+0x1a5/0x480
[   19.427115]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.427966]  kthread+0x337/0x6f0
[   19.428386]  ret_from_fork+0x116/0x1d0
[   19.429242]  ret_from_fork_asm+0x1a/0x30
[   19.430357] 
[   19.430547] The buggy address belongs to the object at ffff8881039cc100
[   19.430547]  which belongs to the cache kmalloc-64 of size 64
[   19.432284] The buggy address is located 40 bytes inside of
[   19.432284]  freed 64-byte region [ffff8881039cc100, ffff8881039cc140)
[   19.433314] 
[   19.434194] The buggy address belongs to the physical page:
[   19.434794] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039cc
[   19.435515] flags: 0x200000000000000(node=0|zone=2)
[   19.436286] page_type: f5(slab)
[   19.436902] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   19.437942] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   19.438594] page dumped because: kasan: bad access detected
[   19.438914] 
[   19.439251] Memory state around the buggy address:
[   19.440598]  ffff8881039cc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   19.441160]  ffff8881039cc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   19.441730] >ffff8881039cc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   19.442238]                                   ^
[   19.443832]  ffff8881039cc180: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   19.444838]  ffff8881039cc200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.445093] ==================================================================

[   18.408294] ==================================================================
[   18.409481] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520
[   18.410453] Read of size 1 at addr ffff8881033027a8 by task kunit_try_catch/206
[   18.411163] 
[   18.411899] CPU: 0 UID: 0 PID: 206 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   18.412102] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.412143] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.412189] Call Trace:
[   18.412207]  <TASK>
[   18.412224]  dump_stack_lvl+0x73/0xb0
[   18.412267]  print_report+0xd1/0x650
[   18.412299]  ? __virt_addr_valid+0x1db/0x2d0
[   18.412333]  ? kmalloc_uaf2+0x4a8/0x520
[   18.412362]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.412393]  ? kmalloc_uaf2+0x4a8/0x520
[   18.412421]  kasan_report+0x141/0x180
[   18.412451]  ? kmalloc_uaf2+0x4a8/0x520
[   18.412486]  __asan_report_load1_noabort+0x18/0x20
[   18.412744]  kmalloc_uaf2+0x4a8/0x520
[   18.412831]  ? __pfx_kmalloc_uaf2+0x10/0x10
[   18.412907]  ? finish_task_switch.isra.0+0x153/0x700
[   18.412946]  ? __switch_to+0x47/0xf50
[   18.412984]  ? __schedule+0x10cc/0x2b60
[   18.413016]  ? __pfx_read_tsc+0x10/0x10
[   18.413045]  ? ktime_get_ts64+0x86/0x230
[   18.413076]  kunit_try_run_case+0x1a5/0x480
[   18.413154]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.413194]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.413229]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.413262]  ? __kthread_parkme+0x82/0x180
[   18.413289]  ? preempt_count_sub+0x50/0x80
[   18.413319]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.413354]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.413386]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.413420]  kthread+0x337/0x6f0
[   18.413446]  ? trace_preempt_on+0x20/0xc0
[   18.413479]  ? __pfx_kthread+0x10/0x10
[   18.413509]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.413581]  ? calculate_sigpending+0x7b/0xa0
[   18.413654]  ? __pfx_kthread+0x10/0x10
[   18.413687]  ret_from_fork+0x116/0x1d0
[   18.413713]  ? __pfx_kthread+0x10/0x10
[   18.413742]  ret_from_fork_asm+0x1a/0x30
[   18.413783]  </TASK>
[   18.413798] 
[   18.440779] Allocated by task 206:
[   18.441109]  kasan_save_stack+0x45/0x70
[   18.441566]  kasan_save_track+0x18/0x40
[   18.442107]  kasan_save_alloc_info+0x3b/0x50
[   18.442527]  __kasan_kmalloc+0xb7/0xc0
[   18.443281]  __kmalloc_cache_noprof+0x189/0x420
[   18.444326]  kmalloc_uaf2+0xc6/0x520
[   18.445171]  kunit_try_run_case+0x1a5/0x480
[   18.445530]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.445966]  kthread+0x337/0x6f0
[   18.446428]  ret_from_fork+0x116/0x1d0
[   18.447542]  ret_from_fork_asm+0x1a/0x30
[   18.448566] 
[   18.449117] Freed by task 206:
[   18.449400]  kasan_save_stack+0x45/0x70
[   18.449841]  kasan_save_track+0x18/0x40
[   18.450277]  kasan_save_free_info+0x3f/0x60
[   18.450665]  __kasan_slab_free+0x56/0x70
[   18.451287]  kfree+0x222/0x3f0
[   18.452006]  kmalloc_uaf2+0x14c/0x520
[   18.452419]  kunit_try_run_case+0x1a5/0x480
[   18.452998]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.453504]  kthread+0x337/0x6f0
[   18.454021]  ret_from_fork+0x116/0x1d0
[   18.454441]  ret_from_fork_asm+0x1a/0x30
[   18.455190] 
[   18.455423] The buggy address belongs to the object at ffff888103302780
[   18.455423]  which belongs to the cache kmalloc-64 of size 64
[   18.456750] The buggy address is located 40 bytes inside of
[   18.456750]  freed 64-byte region [ffff888103302780, ffff8881033027c0)
[   18.457794] 
[   18.458050] The buggy address belongs to the physical page:
[   18.458869] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103302
[   18.459773] flags: 0x200000000000000(node=0|zone=2)
[   18.460258] page_type: f5(slab)
[   18.460716] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   18.461403] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   18.462152] page dumped because: kasan: bad access detected
[   18.462969] 
[   18.463255] Memory state around the buggy address:
[   18.463731]  ffff888103302680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.464307]  ffff888103302700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.464861] >ffff888103302780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.465430]                                   ^
[   18.465857]  ffff888103302800: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   18.466956]  ffff888103302880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.467716] ==================================================================

[   20.767626] ==================================================================
[   20.768669] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   20.769326] Read of size 1 at addr ffff00000e2e8e28 by task kunit_try_catch/241
[   20.770008] 
[   20.770172] CPU: 3 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   20.770222] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.770237] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.770255] Call trace:
[   20.770266]  show_stack+0x20/0x38 (C)
[   20.770300]  dump_stack_lvl+0x8c/0xd0
[   20.770335]  print_report+0x118/0x608
[   20.770369]  kasan_report+0xdc/0x128
[   20.770401]  __asan_report_load1_noabort+0x20/0x30
[   20.770439]  kmalloc_uaf2+0x3f4/0x468
[   20.770467]  kunit_try_run_case+0x170/0x3f0
[   20.770501]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.770539]  kthread+0x328/0x630
[   20.770566]  ret_from_fork+0x10/0x20
[   20.770598] 
[   20.776133] Allocated by task 241:
[   20.776458]  kasan_save_stack+0x3c/0x68
[   20.776839]  kasan_save_track+0x20/0x40
[   20.777215]  kasan_save_alloc_info+0x40/0x58
[   20.777632]  __kasan_kmalloc+0xd4/0xd8
[   20.777999]  __kmalloc_cache_noprof+0x16c/0x3c0
[   20.778437]  kmalloc_uaf2+0xc4/0x468
[   20.778785]  kunit_try_run_case+0x170/0x3f0
[   20.779192]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.779715]  kthread+0x328/0x630
[   20.780031]  ret_from_fork+0x10/0x20
[   20.780382] 
[   20.780537] Freed by task 241:
[   20.780830]  kasan_save_stack+0x3c/0x68
[   20.781206]  kasan_save_track+0x20/0x40
[   20.781581]  kasan_save_free_info+0x4c/0x78
[   20.781988]  __kasan_slab_free+0x6c/0x98
[   20.782371]  kfree+0x214/0x3c8
[   20.782674]  kmalloc_uaf2+0x134/0x468
[   20.783030]  kunit_try_run_case+0x170/0x3f0
[   20.783434]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.783957]  kthread+0x328/0x630
[   20.784273]  ret_from_fork+0x10/0x20
[   20.784622] 
[   20.784776] The buggy address belongs to the object at ffff00000e2e8e00
[   20.784776]  which belongs to the cache kmalloc-64 of size 64
[   20.785893] The buggy address is located 40 bytes inside of
[   20.785893]  freed 64-byte region [ffff00000e2e8e00, ffff00000e2e8e40)
[   20.786990] 
[   20.787144] The buggy address belongs to the physical page:
[   20.787658] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe2e8
[   20.788385] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.788999] page_type: f5(slab)
[   20.789312] raw: 03fffe0000000000 ffff0000004028c0 dead000000000122 0000000000000000
[   20.790029] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   20.790736] page dumped because: kasan: bad access detected
[   20.791251] 
[   20.791403] Memory state around the buggy address:
[   20.791852]  ffff00000e2e8d00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[   20.792518]  ffff00000e2e8d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.793184] >ffff00000e2e8e00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.793845]                                   ^
[   20.794269]  ffff00000e2e8e80: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   20.794935]  ffff00000e2e8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.795596] ==================================================================