Hay
Date
June 8, 2025, 11:09 p.m.

Environment
e850-96
qemu-arm64
qemu-x86_64
rk3399-rock-pi-4b

[   29.380671] ==================================================================
[   29.389426] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   29.396538] Write of size 33 at addr ffff000800d62280 by task kunit_try_catch/233
[   29.404001] 
[   29.405489] CPU: 7 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   29.405548] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.405567] Hardware name: WinLink E850-96 board (DT)
[   29.405588] Call trace:
[   29.405602]  show_stack+0x20/0x38 (C)
[   29.405639]  dump_stack_lvl+0x8c/0xd0
[   29.405677]  print_report+0x118/0x608
[   29.405715]  kasan_report+0xdc/0x128
[   29.405751]  kasan_check_range+0x100/0x1a8
[   29.405791]  __asan_memset+0x34/0x78
[   29.405820]  kmalloc_uaf_memset+0x170/0x310
[   29.405853]  kunit_try_run_case+0x170/0x3f0
[   29.405890]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.405929]  kthread+0x328/0x630
[   29.405958]  ret_from_fork+0x10/0x20
[   29.405994] 
[   29.471189] Allocated by task 233:
[   29.474576]  kasan_save_stack+0x3c/0x68
[   29.478392]  kasan_save_track+0x20/0x40
[   29.482212]  kasan_save_alloc_info+0x40/0x58
[   29.486465]  __kasan_kmalloc+0xd4/0xd8
[   29.490199]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.494712]  kmalloc_uaf_memset+0xb8/0x310
[   29.498791]  kunit_try_run_case+0x170/0x3f0
[   29.502959]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.508426]  kthread+0x328/0x630
[   29.511638]  ret_from_fork+0x10/0x20
[   29.515197] 
[   29.516673] Freed by task 233:
[   29.519714]  kasan_save_stack+0x3c/0x68
[   29.523530]  kasan_save_track+0x20/0x40
[   29.527350]  kasan_save_free_info+0x4c/0x78
[   29.531516]  __kasan_slab_free+0x6c/0x98
[   29.535423]  kfree+0x214/0x3c8
[   29.538461]  kmalloc_uaf_memset+0x11c/0x310
[   29.542629]  kunit_try_run_case+0x170/0x3f0
[   29.546794]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.552263]  kthread+0x328/0x630
[   29.555474]  ret_from_fork+0x10/0x20
[   29.559033] 
[   29.560509] The buggy address belongs to the object at ffff000800d62280
[   29.560509]  which belongs to the cache kmalloc-64 of size 64
[   29.572839] The buggy address is located 0 bytes inside of
[   29.572839]  freed 64-byte region [ffff000800d62280, ffff000800d622c0)
[   29.584815] 
[   29.586294] The buggy address belongs to the physical page:
[   29.591849] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x880d62
[   29.599835] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.606343] page_type: f5(slab)
[   29.609480] raw: 0bfffe0000000000 ffff0008000028c0 dead000000000122 0000000000000000
[   29.617200] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   29.624919] page dumped because: kasan: bad access detected
[   29.630473] 
[   29.631949] Memory state around the buggy address:
[   29.636730]  ffff000800d62180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.643932]  ffff000800d62200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.651136] >ffff000800d62280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   29.658337]                    ^
[   29.661553]  ffff000800d62300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.668758]  ffff000800d62380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.675960] ==================================================================

[   25.568899] ==================================================================
[   25.569231] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   25.569436] Write of size 33 at addr fff00000c6418580 by task kunit_try_catch/186
[   25.569838] 
[   25.570205] CPU: 0 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.570859] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.571469] Hardware name: linux,dummy-virt (DT)
[   25.572403] Call trace:
[   25.572703]  show_stack+0x20/0x38 (C)
[   25.573012]  dump_stack_lvl+0x8c/0xd0
[   25.573624]  print_report+0x118/0x608
[   25.574533]  kasan_report+0xdc/0x128
[   25.574692]  kasan_check_range+0x100/0x1a8
[   25.574812]  __asan_memset+0x34/0x78
[   25.574954]  kmalloc_uaf_memset+0x170/0x310
[   25.576287]  kunit_try_run_case+0x170/0x3f0
[   25.577141]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.578078]  kthread+0x328/0x630
[   25.578258]  ret_from_fork+0x10/0x20
[   25.578382] 
[   25.578429] Allocated by task 186:
[   25.578498]  kasan_save_stack+0x3c/0x68
[   25.579978]  kasan_save_track+0x20/0x40
[   25.580094]  kasan_save_alloc_info+0x40/0x58
[   25.580443]  __kasan_kmalloc+0xd4/0xd8
[   25.580570]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.580842]  kmalloc_uaf_memset+0xb8/0x310
[   25.581072]  kunit_try_run_case+0x170/0x3f0
[   25.581174]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.581296]  kthread+0x328/0x630
[   25.581494]  ret_from_fork+0x10/0x20
[   25.581584] 
[   25.581632] Freed by task 186:
[   25.581702]  kasan_save_stack+0x3c/0x68
[   25.581797]  kasan_save_track+0x20/0x40
[   25.581911]  kasan_save_free_info+0x4c/0x78
[   25.582096]  __kasan_slab_free+0x6c/0x98
[   25.582361]  kfree+0x214/0x3c8
[   25.582455]  kmalloc_uaf_memset+0x11c/0x310
[   25.582952]  kunit_try_run_case+0x170/0x3f0
[   25.583254]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.583700]  kthread+0x328/0x630
[   25.583804]  ret_from_fork+0x10/0x20
[   25.583892] 
[   25.583967] The buggy address belongs to the object at fff00000c6418580
[   25.583967]  which belongs to the cache kmalloc-64 of size 64
[   25.584304] The buggy address is located 0 bytes inside of
[   25.584304]  freed 64-byte region [fff00000c6418580, fff00000c64185c0)
[   25.584560] 
[   25.584651] The buggy address belongs to the physical page:
[   25.584855] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106418
[   25.585254] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.585453] page_type: f5(slab)
[   25.585547] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   25.585672] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   25.585769] page dumped because: kasan: bad access detected
[   25.585890] 
[   25.585980] Memory state around the buggy address:
[   25.586070]  fff00000c6418480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.586464]  fff00000c6418500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.586594] >fff00000c6418580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.586911]                    ^
[   25.587185]  fff00000c6418600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.587474]  fff00000c6418680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.587578] ==================================================================

[   25.815615] ==================================================================
[   25.815793] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   25.815948] Write of size 33 at addr fff00000c7713180 by task kunit_try_catch/186
[   25.816070] 
[   25.817330] CPU: 0 UID: 0 PID: 186 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   25.817574] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.817643] Hardware name: linux,dummy-virt (DT)
[   25.817720] Call trace:
[   25.817777]  show_stack+0x20/0x38 (C)
[   25.818611]  dump_stack_lvl+0x8c/0xd0
[   25.818737]  print_report+0x118/0x608
[   25.818883]  kasan_report+0xdc/0x128
[   25.819299]  kasan_check_range+0x100/0x1a8
[   25.819434]  __asan_memset+0x34/0x78
[   25.819560]  kmalloc_uaf_memset+0x170/0x310
[   25.819688]  kunit_try_run_case+0x170/0x3f0
[   25.819830]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.819981]  kthread+0x328/0x630
[   25.820090]  ret_from_fork+0x10/0x20
[   25.820214] 
[   25.820255] Allocated by task 186:
[   25.820324]  kasan_save_stack+0x3c/0x68
[   25.820419]  kasan_save_track+0x20/0x40
[   25.820515]  kasan_save_alloc_info+0x40/0x58
[   25.820616]  __kasan_kmalloc+0xd4/0xd8
[   25.820718]  __kmalloc_cache_noprof+0x16c/0x3c0
[   25.820822]  kmalloc_uaf_memset+0xb8/0x310
[   25.825021]  kunit_try_run_case+0x170/0x3f0
[   25.825162]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.825279]  kthread+0x328/0x630
[   25.825372]  ret_from_fork+0x10/0x20
[   25.827103] 
[   25.827158] Freed by task 186:
[   25.827224]  kasan_save_stack+0x3c/0x68
[   25.827335]  kasan_save_track+0x20/0x40
[   25.827437]  kasan_save_free_info+0x4c/0x78
[   25.827604]  __kasan_slab_free+0x6c/0x98
[   25.829250]  kfree+0x214/0x3c8
[   25.829374]  kmalloc_uaf_memset+0x11c/0x310
[   25.829769]  kunit_try_run_case+0x170/0x3f0
[   25.830960]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.831081]  kthread+0x328/0x630
[   25.831158]  ret_from_fork+0x10/0x20
[   25.831242] 
[   25.831287] The buggy address belongs to the object at fff00000c7713180
[   25.831287]  which belongs to the cache kmalloc-64 of size 64
[   25.831426] The buggy address is located 0 bytes inside of
[   25.831426]  freed 64-byte region [fff00000c7713180, fff00000c77131c0)
[   25.831569] 
[   25.831618] The buggy address belongs to the physical page:
[   25.831689] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107713
[   25.831829] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.831973] page_type: f5(slab)
[   25.832075] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   25.832200] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   25.832300] page dumped because: kasan: bad access detected
[   25.832375] 
[   25.832468] Memory state around the buggy address:
[   25.832570]  fff00000c7713080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.832826]  fff00000c7713100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.832980] >fff00000c7713180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   25.833141]                    ^
[   25.833222]  fff00000c7713200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.833331]  fff00000c7713280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.833534] ==================================================================

[   19.323068] ==================================================================
[   19.323777] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360
[   19.324669] Write of size 33 at addr ffff8881039cc000 by task kunit_try_catch/204
[   19.325293] 
[   19.326718] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   19.326929] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.326969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.327029] Call Trace:
[   19.327072]  <TASK>
[   19.327119]  dump_stack_lvl+0x73/0xb0
[   19.327219]  print_report+0xd1/0x650
[   19.327298]  ? __virt_addr_valid+0x1db/0x2d0
[   19.327369]  ? kmalloc_uaf_memset+0x1a3/0x360
[   19.327401]  ? kasan_complete_mode_report_info+0x64/0x200
[   19.327431]  ? kmalloc_uaf_memset+0x1a3/0x360
[   19.327461]  kasan_report+0x141/0x180
[   19.327491]  ? kmalloc_uaf_memset+0x1a3/0x360
[   19.327629]  kasan_check_range+0x10c/0x1c0
[   19.327711]  __asan_memset+0x27/0x50
[   19.327742]  kmalloc_uaf_memset+0x1a3/0x360
[   19.327773]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   19.327804]  ? __schedule+0x10cc/0x2b60
[   19.327838]  ? __pfx_read_tsc+0x10/0x10
[   19.327868]  ? ktime_get_ts64+0x86/0x230
[   19.327901]  kunit_try_run_case+0x1a5/0x480
[   19.327939]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.327972]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   19.328006]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   19.328038]  ? __kthread_parkme+0x82/0x180
[   19.328066]  ? preempt_count_sub+0x50/0x80
[   19.328097]  ? __pfx_kunit_try_run_case+0x10/0x10
[   19.328132]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.328164]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   19.328197]  kthread+0x337/0x6f0
[   19.328224]  ? trace_preempt_on+0x20/0xc0
[   19.328286]  ? __pfx_kthread+0x10/0x10
[   19.328317]  ? _raw_spin_unlock_irq+0x47/0x80
[   19.328348]  ? calculate_sigpending+0x7b/0xa0
[   19.328384]  ? __pfx_kthread+0x10/0x10
[   19.328412]  ret_from_fork+0x116/0x1d0
[   19.328438]  ? __pfx_kthread+0x10/0x10
[   19.328466]  ret_from_fork_asm+0x1a/0x30
[   19.328531]  </TASK>
[   19.328590] 
[   19.348048] Allocated by task 204:
[   19.349187]  kasan_save_stack+0x45/0x70
[   19.350320]  kasan_save_track+0x18/0x40
[   19.350787]  kasan_save_alloc_info+0x3b/0x50
[   19.351308]  __kasan_kmalloc+0xb7/0xc0
[   19.351859]  __kmalloc_cache_noprof+0x189/0x420
[   19.352731]  kmalloc_uaf_memset+0xa9/0x360
[   19.353992]  kunit_try_run_case+0x1a5/0x480
[   19.354340]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.354989]  kthread+0x337/0x6f0
[   19.355426]  ret_from_fork+0x116/0x1d0
[   19.355853]  ret_from_fork_asm+0x1a/0x30
[   19.356272] 
[   19.356967] Freed by task 204:
[   19.357329]  kasan_save_stack+0x45/0x70
[   19.358011]  kasan_save_track+0x18/0x40
[   19.358328]  kasan_save_free_info+0x3f/0x60
[   19.358892]  __kasan_slab_free+0x56/0x70
[   19.359315]  kfree+0x222/0x3f0
[   19.359759]  kmalloc_uaf_memset+0x12b/0x360
[   19.360157]  kunit_try_run_case+0x1a5/0x480
[   19.361165]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.362034]  kthread+0x337/0x6f0
[   19.362343]  ret_from_fork+0x116/0x1d0
[   19.362927]  ret_from_fork_asm+0x1a/0x30
[   19.363344] 
[   19.363618] The buggy address belongs to the object at ffff8881039cc000
[   19.363618]  which belongs to the cache kmalloc-64 of size 64
[   19.365121] The buggy address is located 0 bytes inside of
[   19.365121]  freed 64-byte region [ffff8881039cc000, ffff8881039cc040)
[   19.366560] 
[   19.366785] The buggy address belongs to the physical page:
[   19.367777] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039cc
[   19.368953] flags: 0x200000000000000(node=0|zone=2)
[   19.369291] page_type: f5(slab)
[   19.369612] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   19.371014] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   19.372333] page dumped because: kasan: bad access detected
[   19.372679] 
[   19.373444] Memory state around the buggy address:
[   19.374134]  ffff8881039cbf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.375073]  ffff8881039cbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.376064] >ffff8881039cc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   19.376893]                    ^
[   19.377158]  ffff8881039cc080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.378407]  ffff8881039cc100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.379123] ==================================================================

[   18.352185] ==================================================================
[   18.352984] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360
[   18.353499] Write of size 33 at addr ffff888103302680 by task kunit_try_catch/204
[   18.354827] 
[   18.355400] CPU: 0 UID: 0 PID: 204 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT(voluntary) 
[   18.355633] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.355670] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.355727] Call Trace:
[   18.355761]  <TASK>
[   18.355803]  dump_stack_lvl+0x73/0xb0
[   18.355911]  print_report+0xd1/0x650
[   18.355989]  ? __virt_addr_valid+0x1db/0x2d0
[   18.356055]  ? kmalloc_uaf_memset+0x1a3/0x360
[   18.356297]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.356424]  ? kmalloc_uaf_memset+0x1a3/0x360
[   18.356502]  kasan_report+0x141/0x180
[   18.356639]  ? kmalloc_uaf_memset+0x1a3/0x360
[   18.356686]  kasan_check_range+0x10c/0x1c0
[   18.356723]  __asan_memset+0x27/0x50
[   18.356750]  kmalloc_uaf_memset+0x1a3/0x360
[   18.356780]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   18.356812]  ? __schedule+0x10cc/0x2b60
[   18.356846]  ? __pfx_read_tsc+0x10/0x10
[   18.356897]  ? ktime_get_ts64+0x86/0x230
[   18.356944]  kunit_try_run_case+0x1a5/0x480
[   18.356982]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.357015]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.357050]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.357083]  ? __kthread_parkme+0x82/0x180
[   18.357126]  ? preempt_count_sub+0x50/0x80
[   18.357171]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.357208]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.357242]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.357276]  kthread+0x337/0x6f0
[   18.357302]  ? trace_preempt_on+0x20/0xc0
[   18.357363]  ? __pfx_kthread+0x10/0x10
[   18.357395]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.357432]  ? calculate_sigpending+0x7b/0xa0
[   18.357480]  ? __pfx_kthread+0x10/0x10
[   18.357518]  ret_from_fork+0x116/0x1d0
[   18.357620]  ? __pfx_kthread+0x10/0x10
[   18.357683]  ret_from_fork_asm+0x1a/0x30
[   18.357743]  </TASK>
[   18.357761] 
[   18.375475] Allocated by task 204:
[   18.376054]  kasan_save_stack+0x45/0x70
[   18.376487]  kasan_save_track+0x18/0x40
[   18.377415]  kasan_save_alloc_info+0x3b/0x50
[   18.378017]  __kasan_kmalloc+0xb7/0xc0
[   18.378490]  __kmalloc_cache_noprof+0x189/0x420
[   18.379024]  kmalloc_uaf_memset+0xa9/0x360
[   18.379545]  kunit_try_run_case+0x1a5/0x480
[   18.380253]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.381197]  kthread+0x337/0x6f0
[   18.381715]  ret_from_fork+0x116/0x1d0
[   18.382134]  ret_from_fork_asm+0x1a/0x30
[   18.382500] 
[   18.382938] Freed by task 204:
[   18.383361]  kasan_save_stack+0x45/0x70
[   18.383961]  kasan_save_track+0x18/0x40
[   18.384439]  kasan_save_free_info+0x3f/0x60
[   18.385291]  __kasan_slab_free+0x56/0x70
[   18.385793]  kfree+0x222/0x3f0
[   18.386306]  kmalloc_uaf_memset+0x12b/0x360
[   18.386915]  kunit_try_run_case+0x1a5/0x480
[   18.387388]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.388041]  kthread+0x337/0x6f0
[   18.388911]  ret_from_fork+0x116/0x1d0
[   18.389349]  ret_from_fork_asm+0x1a/0x30
[   18.389784] 
[   18.390016] The buggy address belongs to the object at ffff888103302680
[   18.390016]  which belongs to the cache kmalloc-64 of size 64
[   18.390953] The buggy address is located 0 bytes inside of
[   18.390953]  freed 64-byte region [ffff888103302680, ffff8881033026c0)
[   18.391742] 
[   18.392123] The buggy address belongs to the physical page:
[   18.392870] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103302
[   18.393793] flags: 0x200000000000000(node=0|zone=2)
[   18.394346] page_type: f5(slab)
[   18.394892] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   18.395731] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   18.396453] page dumped because: kasan: bad access detected
[   18.397408] 
[   18.397799] Memory state around the buggy address:
[   18.398266]  ffff888103302580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.399102]  ffff888103302600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.399909] >ffff888103302680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.400997]                    ^
[   18.401408]  ffff888103302700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.402164]  ffff888103302780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.402924] ==================================================================

[   20.736176] ==================================================================
[   20.737182] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   20.737868] Write of size 33 at addr ffff00000101c980 by task kunit_try_catch/239
[   20.738560] 
[   20.738724] CPU: 2 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc1 #1 PREEMPT 
[   20.738775] Tainted: [B]=BAD_PAGE, [N]=TEST
[   20.738790] Hardware name: Radxa ROCK Pi 4B (DT)
[   20.738806] Call trace:
[   20.738818]  show_stack+0x20/0x38 (C)
[   20.738852]  dump_stack_lvl+0x8c/0xd0
[   20.738887]  print_report+0x118/0x608
[   20.738921]  kasan_report+0xdc/0x128
[   20.738953]  kasan_check_range+0x100/0x1a8
[   20.738987]  __asan_memset+0x34/0x78
[   20.739013]  kmalloc_uaf_memset+0x170/0x310
[   20.739042]  kunit_try_run_case+0x170/0x3f0
[   20.739076]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.739115]  kthread+0x328/0x630
[   20.739141]  ret_from_fork+0x10/0x20
[   20.739172] 
[   20.745007] Allocated by task 239:
[   20.745332]  kasan_save_stack+0x3c/0x68
[   20.745710]  kasan_save_track+0x20/0x40
[   20.746085]  kasan_save_alloc_info+0x40/0x58
[   20.746500]  __kasan_kmalloc+0xd4/0xd8
[   20.746867]  __kmalloc_cache_noprof+0x16c/0x3c0
[   20.747304]  kmalloc_uaf_memset+0xb8/0x310
[   20.747699]  kunit_try_run_case+0x170/0x3f0
[   20.748104]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.748627]  kthread+0x328/0x630
[   20.748942]  ret_from_fork+0x10/0x20
[   20.749292] 
[   20.749445] Freed by task 239:
[   20.749738]  kasan_save_stack+0x3c/0x68
[   20.750113]  kasan_save_track+0x20/0x40
[   20.750488]  kasan_save_free_info+0x4c/0x78
[   20.750895]  __kasan_slab_free+0x6c/0x98
[   20.751277]  kfree+0x214/0x3c8
[   20.751580]  kmalloc_uaf_memset+0x11c/0x310
[   20.751982]  kunit_try_run_case+0x170/0x3f0
[   20.752387]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   20.752910]  kthread+0x328/0x630
[   20.753226]  ret_from_fork+0x10/0x20
[   20.753576] 
[   20.753728] The buggy address belongs to the object at ffff00000101c980
[   20.753728]  which belongs to the cache kmalloc-64 of size 64
[   20.754844] The buggy address is located 0 bytes inside of
[   20.754844]  freed 64-byte region [ffff00000101c980, ffff00000101c9c0)
[   20.755933] 
[   20.756087] The buggy address belongs to the physical page:
[   20.756600] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101c
[   20.757324] flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff)
[   20.757935] page_type: f5(slab)
[   20.758250] raw: 03fffe0000000000 ffff0000004028c0 dead000000000122 0000000000000000
[   20.758965] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   20.759671] page dumped because: kasan: bad access detected
[   20.760186] 
[   20.760338] Memory state around the buggy address:
[   20.760786]  ffff00000101c880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.761452]  ffff00000101c900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.762117] >ffff00000101c980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   20.762778]                    ^
[   20.763088]  ffff00000101ca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.763754]  ffff00000101ca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.764415] ==================================================================