Hay
Date
July 6, 2025, 11:09 p.m.

Environment
qemu-arm64
qemu-x86_64
x86

[   16.669330] ==================================================================
[   16.669394] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0
[   16.669445] Write of size 1 at addr fff00000c6595f00 by task kunit_try_catch/145
[   16.669493] 
[   16.669524] CPU: 0 UID: 0 PID: 145 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   16.669603] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.669634] Hardware name: linux,dummy-virt (DT)
[   16.669663] Call trace:
[   16.669684]  show_stack+0x20/0x38 (C)
[   16.669728]  dump_stack_lvl+0x8c/0xd0
[   16.669772]  print_report+0x118/0x608
[   16.669814]  kasan_report+0xdc/0x128
[   16.669856]  __asan_report_store1_noabort+0x20/0x30
[   16.669904]  kmalloc_big_oob_right+0x2a4/0x2f0
[   16.669947]  kunit_try_run_case+0x170/0x3f0
[   16.670218]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.670285]  kthread+0x328/0x630
[   16.670328]  ret_from_fork+0x10/0x20
[   16.670372] 
[   16.670390] Allocated by task 145:
[   16.670416]  kasan_save_stack+0x3c/0x68
[   16.670455]  kasan_save_track+0x20/0x40
[   16.670491]  kasan_save_alloc_info+0x40/0x58
[   16.670528]  __kasan_kmalloc+0xd4/0xd8
[   16.670563]  __kmalloc_cache_noprof+0x16c/0x3c0
[   16.670680]  kmalloc_big_oob_right+0xb8/0x2f0
[   16.672834]  kunit_try_run_case+0x170/0x3f0
[   16.673997]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.674054]  kthread+0x328/0x630
[   16.674099]  ret_from_fork+0x10/0x20
[   16.674136] 
[   16.674157] The buggy address belongs to the object at fff00000c6594000
[   16.674157]  which belongs to the cache kmalloc-8k of size 8192
[   16.674213] The buggy address is located 0 bytes to the right of
[   16.674213]  allocated 7936-byte region [fff00000c6594000, fff00000c6595f00)
[   16.674274] 
[   16.674292] The buggy address belongs to the physical page:
[   16.674332] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106590
[   16.674394] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   16.674501] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   16.674556] page_type: f5(slab)
[   16.674593] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   16.674640] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.674687] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   16.674733] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.674780] head: 0bfffe0000000003 ffffc1ffc3196401 00000000ffffffff 00000000ffffffff
[   16.676536] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   16.676658] page dumped because: kasan: bad access detected
[   16.676693] 
[   16.676711] Memory state around the buggy address:
[   16.676743]  fff00000c6595e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.676785]  fff00000c6595e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.677683] >fff00000c6595f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.678081]                    ^
[   16.678124]  fff00000c6595f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.678595]  fff00000c6596000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.679057] ==================================================================

[   16.605401] ==================================================================
[   16.605821] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x2a4/0x2f0
[   16.605890] Write of size 1 at addr fff00000c64c5f00 by task kunit_try_catch/145
[   16.605950] 
[   16.605983] CPU: 1 UID: 0 PID: 145 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   16.606436] Tainted: [B]=BAD_PAGE, [N]=TEST
[   16.606462] Hardware name: linux,dummy-virt (DT)
[   16.606512] Call trace:
[   16.606535]  show_stack+0x20/0x38 (C)
[   16.606585]  dump_stack_lvl+0x8c/0xd0
[   16.606745]  print_report+0x118/0x608
[   16.606791]  kasan_report+0xdc/0x128
[   16.606835]  __asan_report_store1_noabort+0x20/0x30
[   16.606883]  kmalloc_big_oob_right+0x2a4/0x2f0
[   16.606940]  kunit_try_run_case+0x170/0x3f0
[   16.607004]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.607220]  kthread+0x328/0x630
[   16.607284]  ret_from_fork+0x10/0x20
[   16.607331] 
[   16.607396] Allocated by task 145:
[   16.607493]  kasan_save_stack+0x3c/0x68
[   16.607534]  kasan_save_track+0x20/0x40
[   16.607570]  kasan_save_alloc_info+0x40/0x58
[   16.607610]  __kasan_kmalloc+0xd4/0xd8
[   16.607645]  __kmalloc_cache_noprof+0x16c/0x3c0
[   16.607683]  kmalloc_big_oob_right+0xb8/0x2f0
[   16.607719]  kunit_try_run_case+0x170/0x3f0
[   16.607756]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   16.607798]  kthread+0x328/0x630
[   16.607829]  ret_from_fork+0x10/0x20
[   16.607923] 
[   16.607965] The buggy address belongs to the object at fff00000c64c4000
[   16.607965]  which belongs to the cache kmalloc-8k of size 8192
[   16.608020] The buggy address is located 0 bytes to the right of
[   16.608020]  allocated 7936-byte region [fff00000c64c4000, fff00000c64c5f00)
[   16.608102] 
[   16.608163] The buggy address belongs to the physical page:
[   16.608247] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064c0
[   16.608348] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   16.608438] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   16.608558] page_type: f5(slab)
[   16.608702] raw: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   16.608750] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.608798] head: 0bfffe0000000040 fff00000c0002280 dead000000000122 0000000000000000
[   16.608844] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.608891] head: 0bfffe0000000003 ffffc1ffc3193001 00000000ffffffff 00000000ffffffff
[   16.609341] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   16.609779] page dumped because: kasan: bad access detected
[   16.609868] 
[   16.609981] Memory state around the buggy address:
[   16.610140]  fff00000c64c5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.610273]  fff00000c64c5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.610353] >fff00000c64c5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.610389]                    ^
[   16.610415]  fff00000c64c5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.610478]  fff00000c64c6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.610514] ==================================================================

[   12.660399] ==================================================================
[   12.660862] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370
[   12.661122] Write of size 1 at addr ffff888103999f00 by task kunit_try_catch/162
[   12.662125] 
[   12.662315] CPU: 1 UID: 0 PID: 162 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   12.662391] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.662412] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.662442] Call Trace:
[   12.662463]  <TASK>
[   12.662489]  dump_stack_lvl+0x73/0xb0
[   12.662543]  print_report+0xd1/0x650
[   12.662580]  ? __virt_addr_valid+0x1db/0x2d0
[   12.662637]  ? kmalloc_big_oob_right+0x316/0x370
[   12.662678]  ? kasan_complete_mode_report_info+0x2a/0x200
[   12.662724]  ? kmalloc_big_oob_right+0x316/0x370
[   12.662764]  kasan_report+0x141/0x180
[   12.662807]  ? kmalloc_big_oob_right+0x316/0x370
[   12.662859]  __asan_report_store1_noabort+0x1b/0x30
[   12.662891]  kmalloc_big_oob_right+0x316/0x370
[   12.662912]  ? __pfx_kmalloc_big_oob_right+0x10/0x10
[   12.662933]  ? __schedule+0x10cc/0x2b60
[   12.662953]  ? __pfx_read_tsc+0x10/0x10
[   12.662971]  ? ktime_get_ts64+0x86/0x230
[   12.662994]  kunit_try_run_case+0x1a5/0x480
[   12.663015]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.663033]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.663054]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.663073]  ? __kthread_parkme+0x82/0x180
[   12.663091]  ? preempt_count_sub+0x50/0x80
[   12.663129]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.663149]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.663168]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.663188]  kthread+0x337/0x6f0
[   12.663205]  ? trace_preempt_on+0x20/0xc0
[   12.663227]  ? __pfx_kthread+0x10/0x10
[   12.663247]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.663276]  ? calculate_sigpending+0x7b/0xa0
[   12.663306]  ? __pfx_kthread+0x10/0x10
[   12.663334]  ret_from_fork+0x116/0x1d0
[   12.663359]  ? __pfx_kthread+0x10/0x10
[   12.663384]  ret_from_fork_asm+0x1a/0x30
[   12.663412]  </TASK>
[   12.663424] 
[   12.675945] Allocated by task 162:
[   12.676549]  kasan_save_stack+0x45/0x70
[   12.676738]  kasan_save_track+0x18/0x40
[   12.676875]  kasan_save_alloc_info+0x3b/0x50
[   12.677103]  __kasan_kmalloc+0xb7/0xc0
[   12.677462]  __kmalloc_cache_noprof+0x189/0x420
[   12.678220]  kmalloc_big_oob_right+0xa9/0x370
[   12.678837]  kunit_try_run_case+0x1a5/0x480
[   12.679099]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.679450]  kthread+0x337/0x6f0
[   12.679628]  ret_from_fork+0x116/0x1d0
[   12.679866]  ret_from_fork_asm+0x1a/0x30
[   12.680309] 
[   12.680477] The buggy address belongs to the object at ffff888103998000
[   12.680477]  which belongs to the cache kmalloc-8k of size 8192
[   12.681354] The buggy address is located 0 bytes to the right of
[   12.681354]  allocated 7936-byte region [ffff888103998000, ffff888103999f00)
[   12.682116] 
[   12.682217] The buggy address belongs to the physical page:
[   12.682352] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103998
[   12.682492] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   12.682685] flags: 0x200000000000040(head|node=0|zone=2)
[   12.683852] page_type: f5(slab)
[   12.684215] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   12.684781] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   12.685112] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   12.685416] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   12.686374] head: 0200000000000003 ffffea00040e6601 00000000ffffffff 00000000ffffffff
[   12.686877] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   12.687516] page dumped because: kasan: bad access detected
[   12.687721] 
[   12.688149] Memory state around the buggy address:
[   12.688544]  ffff888103999e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.688910]  ffff888103999e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.689472] >ffff888103999f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.689901]                    ^
[   12.690297]  ffff888103999f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.690708]  ffff88810399a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.691156] ==================================================================

[   12.922327] ==================================================================
[   12.922810] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370
[   12.923084] Write of size 1 at addr ffff8881027edf00 by task kunit_try_catch/161
[   12.923652] 
[   12.923881] CPU: 0 UID: 0 PID: 161 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   12.923930] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.923942] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.923992] Call Trace:
[   12.924006]  <TASK>
[   12.924026]  dump_stack_lvl+0x73/0xb0
[   12.924072]  print_report+0xd1/0x650
[   12.924095]  ? __virt_addr_valid+0x1db/0x2d0
[   12.924119]  ? kmalloc_big_oob_right+0x316/0x370
[   12.924179]  ? kasan_complete_mode_report_info+0x2a/0x200
[   12.924206]  ? kmalloc_big_oob_right+0x316/0x370
[   12.924241]  kasan_report+0x141/0x180
[   12.924294]  ? kmalloc_big_oob_right+0x316/0x370
[   12.924345]  __asan_report_store1_noabort+0x1b/0x30
[   12.924369]  kmalloc_big_oob_right+0x316/0x370
[   12.924392]  ? __pfx_kmalloc_big_oob_right+0x10/0x10
[   12.924415]  ? __schedule+0x10cc/0x2b60
[   12.924438]  ? __pfx_read_tsc+0x10/0x10
[   12.924459]  ? ktime_get_ts64+0x86/0x230
[   12.924485]  kunit_try_run_case+0x1a5/0x480
[   12.924510]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.924532]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.924556]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.924578]  ? __kthread_parkme+0x82/0x180
[   12.924599]  ? preempt_count_sub+0x50/0x80
[   12.924623]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.924647]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.924669]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.924691]  kthread+0x337/0x6f0
[   12.924717]  ? trace_preempt_on+0x20/0xc0
[   12.924740]  ? __pfx_kthread+0x10/0x10
[   12.924761]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.924782]  ? calculate_sigpending+0x7b/0xa0
[   12.924806]  ? __pfx_kthread+0x10/0x10
[   12.924828]  ret_from_fork+0x116/0x1d0
[   12.924846]  ? __pfx_kthread+0x10/0x10
[   12.924867]  ret_from_fork_asm+0x1a/0x30
[   12.924899]  </TASK>
[   12.924911] 
[   12.937430] Allocated by task 161:
[   12.937636]  kasan_save_stack+0x45/0x70
[   12.937881]  kasan_save_track+0x18/0x40
[   12.938033]  kasan_save_alloc_info+0x3b/0x50
[   12.938203]  __kasan_kmalloc+0xb7/0xc0
[   12.938391]  __kmalloc_cache_noprof+0x189/0x420
[   12.938683]  kmalloc_big_oob_right+0xa9/0x370
[   12.939197]  kunit_try_run_case+0x1a5/0x480
[   12.939415]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.939666]  kthread+0x337/0x6f0
[   12.939819]  ret_from_fork+0x116/0x1d0
[   12.940104]  ret_from_fork_asm+0x1a/0x30
[   12.940377] 
[   12.940550] The buggy address belongs to the object at ffff8881027ec000
[   12.940550]  which belongs to the cache kmalloc-8k of size 8192
[   12.941141] The buggy address is located 0 bytes to the right of
[   12.941141]  allocated 7936-byte region [ffff8881027ec000, ffff8881027edf00)
[   12.941610] 
[   12.941689] The buggy address belongs to the physical page:
[   12.941993] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027e8
[   12.942375] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   12.942740] flags: 0x200000000000040(head|node=0|zone=2)
[   12.943084] page_type: f5(slab)
[   12.943213] raw: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   12.943733] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   12.944317] head: 0200000000000040 ffff888100042280 dead000000000122 0000000000000000
[   12.944621] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   12.945116] head: 0200000000000003 ffffea000409fa01 00000000ffffffff 00000000ffffffff
[   12.945544] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   12.945985] page dumped because: kasan: bad access detected
[   12.946181] 
[   12.946255] Memory state around the buggy address:
[   12.946576]  ffff8881027ede00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.947129]  ffff8881027ede80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   12.947386] >ffff8881027edf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.947684]                    ^
[   12.947834]  ffff8881027edf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.948402]  ffff8881027ee000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.948755] ==================================================================

[   15.986019] ==================================================================
[   15.998477] BUG: KASAN: slab-out-of-bounds in kmalloc_big_oob_right+0x316/0x370
[   16.005790] Write of size 1 at addr ffff888106f25f00 by task kunit_try_catch/185
[   16.013192] 
[   16.014693] CPU: 3 UID: 0 PID: 185 Comm: kunit_try_catch Tainted: G S  B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   16.014702] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST
[   16.014705] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021
[   16.014708] Call Trace:
[   16.014710]  <TASK>
[   16.014712]  dump_stack_lvl+0x73/0xb0
[   16.014717]  print_report+0xd1/0x650
[   16.014721]  ? __virt_addr_valid+0x1db/0x2d0
[   16.014725]  ? kmalloc_big_oob_right+0x316/0x370
[   16.014729]  ? kasan_complete_mode_report_info+0x2a/0x200
[   16.014734]  ? kmalloc_big_oob_right+0x316/0x370
[   16.014738]  kasan_report+0x141/0x180
[   16.014742]  ? kmalloc_big_oob_right+0x316/0x370
[   16.014747]  __asan_report_store1_noabort+0x1b/0x30
[   16.014751]  kmalloc_big_oob_right+0x316/0x370
[   16.014755]  ? __pfx_kmalloc_big_oob_right+0x10/0x10
[   16.014760]  ? __schedule+0x10cc/0x2b60
[   16.014764]  ? ktime_get_ts64+0x83/0x230
[   16.014768]  kunit_try_run_case+0x1a2/0x480
[   16.014772]  ? __pfx_kunit_try_run_case+0x10/0x10
[   16.014776]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   16.014781]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   16.014785]  ? __kthread_parkme+0x82/0x180
[   16.014788]  ? preempt_count_sub+0x50/0x80
[   16.014792]  ? __pfx_kunit_try_run_case+0x10/0x10
[   16.014797]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   16.014801]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   16.014805]  kthread+0x334/0x6f0
[   16.014808]  ? trace_preempt_on+0x20/0xc0
[   16.014812]  ? __pfx_kthread+0x10/0x10
[   16.014816]  ? _raw_spin_unlock_irq+0x47/0x80
[   16.014820]  ? calculate_sigpending+0x7b/0xa0
[   16.014824]  ? __pfx_kthread+0x10/0x10
[   16.014828]  ret_from_fork+0x113/0x1d0
[   16.014831]  ? __pfx_kthread+0x10/0x10
[   16.014835]  ret_from_fork_asm+0x1a/0x30
[   16.014841]  </TASK>
[   16.014842] 
[   16.181487] Allocated by task 185:
[   16.184894]  kasan_save_stack+0x45/0x70
[   16.188735]  kasan_save_track+0x18/0x40
[   16.192573]  kasan_save_alloc_info+0x3b/0x50
[   16.196846]  __kasan_kmalloc+0xb7/0xc0
[   16.200597]  __kmalloc_cache_noprof+0x189/0x420
[   16.205132]  kmalloc_big_oob_right+0xa9/0x370
[   16.209490]  kunit_try_run_case+0x1a2/0x480
[   16.213677]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   16.219083]  kthread+0x334/0x6f0
[   16.222318]  ret_from_fork+0x113/0x1d0
[   16.226104]  ret_from_fork_asm+0x1a/0x30
[   16.230032] 
[   16.231531] The buggy address belongs to the object at ffff888106f24000
[   16.231531]  which belongs to the cache kmalloc-8k of size 8192
[   16.244045] The buggy address is located 0 bytes to the right of
[   16.244045]  allocated 7936-byte region [ffff888106f24000, ffff888106f25f00)
[   16.257087] 
[   16.258588] The buggy address belongs to the physical page:
[   16.264158] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106f20
[   16.272159] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   16.279819] flags: 0x200000000000040(head|node=0|zone=2)
[   16.285132] page_type: f5(slab)
[   16.288280] raw: 0200000000000040 ffff888100043180 dead000000000122 0000000000000000
[   16.296029] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.303775] head: 0200000000000040 ffff888100043180 dead000000000122 0000000000000000
[   16.311602] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[   16.319427] head: 0200000000000003 ffffea00041bc801 00000000ffffffff 00000000ffffffff
[   16.327253] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   16.335080] page dumped because: kasan: bad access detected
[   16.340651] 
[   16.342151] Memory state around the buggy address:
[   16.346944]  ffff888106f25e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.354163]  ffff888106f25e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   16.361391] >ffff888106f25f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.368609]                    ^
[   16.371843]  ffff888106f25f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.379061]  ffff888106f26000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   16.386282] ==================================================================