Hay
Date
July 6, 2025, 11:09 p.m.

Environment
qemu-arm64
qemu-x86_64
x86

[   17.393354] ==================================================================
[   17.393467] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8
[   17.393521] Read of size 8 at addr fff00000c77d50c0 by task kunit_try_catch/201
[   17.393607] 
[   17.393668] CPU: 0 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   17.393750] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.393777] Hardware name: linux,dummy-virt (DT)
[   17.393806] Call trace:
[   17.393859]  show_stack+0x20/0x38 (C)
[   17.393925]  dump_stack_lvl+0x8c/0xd0
[   17.393998]  print_report+0x118/0x608
[   17.394063]  kasan_report+0xdc/0x128
[   17.394144]  __asan_report_load8_noabort+0x20/0x30
[   17.394222]  workqueue_uaf+0x480/0x4a8
[   17.394267]  kunit_try_run_case+0x170/0x3f0
[   17.394313]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.394562]  kthread+0x328/0x630
[   17.394660]  ret_from_fork+0x10/0x20
[   17.394853] 
[   17.394929] Allocated by task 201:
[   17.395085]  kasan_save_stack+0x3c/0x68
[   17.395179]  kasan_save_track+0x20/0x40
[   17.395319]  kasan_save_alloc_info+0x40/0x58
[   17.395454]  __kasan_kmalloc+0xd4/0xd8
[   17.395527]  __kmalloc_cache_noprof+0x16c/0x3c0
[   17.395578]  workqueue_uaf+0x13c/0x4a8
[   17.395620]  kunit_try_run_case+0x170/0x3f0
[   17.395658]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.395699]  kthread+0x328/0x630
[   17.395732]  ret_from_fork+0x10/0x20
[   17.395767] 
[   17.395784] Freed by task 76:
[   17.395811]  kasan_save_stack+0x3c/0x68
[   17.395847]  kasan_save_track+0x20/0x40
[   17.395903]  kasan_save_free_info+0x4c/0x78
[   17.395943]  __kasan_slab_free+0x6c/0x98
[   17.395991]  kfree+0x214/0x3c8
[   17.396024]  workqueue_uaf_work+0x18/0x30
[   17.396124]  process_one_work+0x530/0xf98
[   17.396196]  worker_thread+0x618/0xf38
[   17.396355]  kthread+0x328/0x630
[   17.396489]  ret_from_fork+0x10/0x20
[   17.396638] 
[   17.396716] Last potentially related work creation:
[   17.396824]  kasan_save_stack+0x3c/0x68
[   17.396874]  kasan_record_aux_stack+0xb4/0xc8
[   17.396914]  __queue_work+0x65c/0x1008
[   17.397126]  queue_work_on+0xbc/0xf8
[   17.397255]  workqueue_uaf+0x210/0x4a8
[   17.397386]  kunit_try_run_case+0x170/0x3f0
[   17.397424]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.397590]  kthread+0x328/0x630
[   17.397629]  ret_from_fork+0x10/0x20
[   17.397666] 
[   17.397686] The buggy address belongs to the object at fff00000c77d50c0
[   17.397686]  which belongs to the cache kmalloc-32 of size 32
[   17.397856] The buggy address is located 0 bytes inside of
[   17.397856]  freed 32-byte region [fff00000c77d50c0, fff00000c77d50e0)
[   17.397973] 
[   17.398078] The buggy address belongs to the physical page:
[   17.398137] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077d5
[   17.398223] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.398325] page_type: f5(slab)
[   17.398398] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000
[   17.398462] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   17.398800] page dumped because: kasan: bad access detected
[   17.398920] 
[   17.398989] Memory state around the buggy address:
[   17.399050]  fff00000c77d4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.399104]  fff00000c77d5000: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   17.399145] >fff00000c77d5080: 00 00 00 07 fc fc fc fc fa fb fb fb fc fc fc fc
[   17.399182]                                            ^
[   17.399222]  fff00000c77d5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.399273]  fff00000c77d5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.399319] ==================================================================

[   17.173699] ==================================================================
[   17.173877] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8
[   17.173950] Read of size 8 at addr fff00000c7770f00 by task kunit_try_catch/201
[   17.174547] 
[   17.174593] CPU: 1 UID: 0 PID: 201 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT 
[   17.174680] Tainted: [B]=BAD_PAGE, [N]=TEST
[   17.174705] Hardware name: linux,dummy-virt (DT)
[   17.174737] Call trace:
[   17.174758]  show_stack+0x20/0x38 (C)
[   17.174809]  dump_stack_lvl+0x8c/0xd0
[   17.174857]  print_report+0x118/0x608
[   17.174902]  kasan_report+0xdc/0x128
[   17.175778]  __asan_report_load8_noabort+0x20/0x30
[   17.175961]  workqueue_uaf+0x480/0x4a8
[   17.176075]  kunit_try_run_case+0x170/0x3f0
[   17.176223]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.176629]  kthread+0x328/0x630
[   17.176737]  ret_from_fork+0x10/0x20
[   17.176866] 
[   17.176887] Allocated by task 201:
[   17.176954]  kasan_save_stack+0x3c/0x68
[   17.177300]  kasan_save_track+0x20/0x40
[   17.177454]  kasan_save_alloc_info+0x40/0x58
[   17.177500]  __kasan_kmalloc+0xd4/0xd8
[   17.177849]  __kmalloc_cache_noprof+0x16c/0x3c0
[   17.178096]  workqueue_uaf+0x13c/0x4a8
[   17.178298]  kunit_try_run_case+0x170/0x3f0
[   17.178345]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.178390]  kthread+0x328/0x630
[   17.178445]  ret_from_fork+0x10/0x20
[   17.178483] 
[   17.178505] Freed by task 57:
[   17.178978]  kasan_save_stack+0x3c/0x68
[   17.179040]  kasan_save_track+0x20/0x40
[   17.179225]  kasan_save_free_info+0x4c/0x78
[   17.179494]  __kasan_slab_free+0x6c/0x98
[   17.179564]  kfree+0x214/0x3c8
[   17.179765]  workqueue_uaf_work+0x18/0x30
[   17.179843]  process_one_work+0x530/0xf98
[   17.180155]  worker_thread+0x618/0xf38
[   17.180470]  kthread+0x328/0x630
[   17.180601]  ret_from_fork+0x10/0x20
[   17.180642] 
[   17.180823] Last potentially related work creation:
[   17.180908]  kasan_save_stack+0x3c/0x68
[   17.180963]  kasan_record_aux_stack+0xb4/0xc8
[   17.181125]  __queue_work+0x65c/0x1008
[   17.181243]  queue_work_on+0xbc/0xf8
[   17.181581]  workqueue_uaf+0x210/0x4a8
[   17.181759]  kunit_try_run_case+0x170/0x3f0
[   17.181836]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   17.182226]  kthread+0x328/0x630
[   17.182433]  ret_from_fork+0x10/0x20
[   17.182473] 
[   17.182500] The buggy address belongs to the object at fff00000c7770f00
[   17.182500]  which belongs to the cache kmalloc-32 of size 32
[   17.182559] The buggy address is located 0 bytes inside of
[   17.182559]  freed 32-byte region [fff00000c7770f00, fff00000c7770f20)
[   17.182620] 
[   17.182642] The buggy address belongs to the physical page:
[   17.182674] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107770
[   17.182728] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   17.182776] page_type: f5(slab)
[   17.182814] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000
[   17.183273] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   17.183320] page dumped because: kasan: bad access detected
[   17.183362] 
[   17.183420] Memory state around the buggy address:
[   17.183456]  fff00000c7770e00: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   17.183499]  fff00000c7770e80: 00 00 00 fc fc fc fc fc 00 00 00 07 fc fc fc fc
[   17.183551] >fff00000c7770f00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   17.183596]                    ^
[   17.183625]  fff00000c7770f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   17.183677]  fff00000c7771000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   17.183716] ==================================================================

[   14.041274] ==================================================================
[   14.041953] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560
[   14.042720] Read of size 8 at addr ffff888102aaa840 by task kunit_try_catch/218
[   14.042975] 
[   14.043162] CPU: 0 UID: 0 PID: 218 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   14.043239] Tainted: [B]=BAD_PAGE, [N]=TEST
[   14.043260] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   14.043297] Call Trace:
[   14.043320]  <TASK>
[   14.043347]  dump_stack_lvl+0x73/0xb0
[   14.043457]  print_report+0xd1/0x650
[   14.043498]  ? __virt_addr_valid+0x1db/0x2d0
[   14.043539]  ? workqueue_uaf+0x4d6/0x560
[   14.043571]  ? kasan_complete_mode_report_info+0x64/0x200
[   14.043605]  ? workqueue_uaf+0x4d6/0x560
[   14.043651]  kasan_report+0x141/0x180
[   14.043682]  ? workqueue_uaf+0x4d6/0x560
[   14.043721]  __asan_report_load8_noabort+0x18/0x20
[   14.043759]  workqueue_uaf+0x4d6/0x560
[   14.043795]  ? __pfx_workqueue_uaf+0x10/0x10
[   14.043828]  ? __schedule+0x10cc/0x2b60
[   14.043877]  ? __pfx_read_tsc+0x10/0x10
[   14.043927]  ? ktime_get_ts64+0x86/0x230
[   14.043976]  kunit_try_run_case+0x1a5/0x480
[   14.044017]  ? __pfx_kunit_try_run_case+0x10/0x10
[   14.044068]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   14.044139]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   14.044181]  ? __kthread_parkme+0x82/0x180
[   14.044213]  ? preempt_count_sub+0x50/0x80
[   14.044255]  ? __pfx_kunit_try_run_case+0x10/0x10
[   14.044294]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.044341]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   14.044396]  kthread+0x337/0x6f0
[   14.044432]  ? trace_preempt_on+0x20/0xc0
[   14.044476]  ? __pfx_kthread+0x10/0x10
[   14.044536]  ? _raw_spin_unlock_irq+0x47/0x80
[   14.044574]  ? calculate_sigpending+0x7b/0xa0
[   14.044631]  ? __pfx_kthread+0x10/0x10
[   14.044664]  ret_from_fork+0x116/0x1d0
[   14.044692]  ? __pfx_kthread+0x10/0x10
[   14.044721]  ret_from_fork_asm+0x1a/0x30
[   14.044775]  </TASK>
[   14.044798] 
[   14.054864] Allocated by task 218:
[   14.055047]  kasan_save_stack+0x45/0x70
[   14.055397]  kasan_save_track+0x18/0x40
[   14.055826]  kasan_save_alloc_info+0x3b/0x50
[   14.056171]  __kasan_kmalloc+0xb7/0xc0
[   14.056471]  __kmalloc_cache_noprof+0x189/0x420
[   14.056920]  workqueue_uaf+0x152/0x560
[   14.057216]  kunit_try_run_case+0x1a5/0x480
[   14.057447]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.058246]  kthread+0x337/0x6f0
[   14.058713]  ret_from_fork+0x116/0x1d0
[   14.059023]  ret_from_fork_asm+0x1a/0x30
[   14.059262] 
[   14.059373] Freed by task 9:
[   14.059638]  kasan_save_stack+0x45/0x70
[   14.059989]  kasan_save_track+0x18/0x40
[   14.060316]  kasan_save_free_info+0x3f/0x60
[   14.060766]  __kasan_slab_free+0x56/0x70
[   14.061078]  kfree+0x222/0x3f0
[   14.061332]  workqueue_uaf_work+0x12/0x20
[   14.061715]  process_one_work+0x5ee/0xf60
[   14.062077]  worker_thread+0x758/0x1220
[   14.062360]  kthread+0x337/0x6f0
[   14.063135]  ret_from_fork+0x116/0x1d0
[   14.063373]  ret_from_fork_asm+0x1a/0x30
[   14.063853] 
[   14.063959] Last potentially related work creation:
[   14.064299]  kasan_save_stack+0x45/0x70
[   14.064667]  kasan_record_aux_stack+0xb2/0xc0
[   14.065020]  __queue_work+0x626/0xeb0
[   14.065280]  queue_work_on+0xb6/0xc0
[   14.065710]  workqueue_uaf+0x26d/0x560
[   14.066026]  kunit_try_run_case+0x1a5/0x480
[   14.066266]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.066795]  kthread+0x337/0x6f0
[   14.067090]  ret_from_fork+0x116/0x1d0
[   14.067298]  ret_from_fork_asm+0x1a/0x30
[   14.067816] 
[   14.068015] The buggy address belongs to the object at ffff888102aaa840
[   14.068015]  which belongs to the cache kmalloc-32 of size 32
[   14.068993] The buggy address is located 0 bytes inside of
[   14.068993]  freed 32-byte region [ffff888102aaa840, ffff888102aaa860)
[   14.069860] 
[   14.070003] The buggy address belongs to the physical page:
[   14.070188] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102aaa
[   14.070933] flags: 0x200000000000000(node=0|zone=2)
[   14.071233] page_type: f5(slab)
[   14.071596] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   14.071934] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   14.072447] page dumped because: kasan: bad access detected
[   14.073236] 
[   14.073420] Memory state around the buggy address:
[   14.073773]  ffff888102aaa700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   14.074292]  ffff888102aaa780: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   14.074661] >ffff888102aaa800: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   14.075155]                                            ^
[   14.075375]  ffff888102aaa880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   14.075994]  ffff888102aaa900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   14.076419] ==================================================================

[   14.184538] ==================================================================
[   14.185767] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560
[   14.186245] Read of size 8 at addr ffff8881031bbf40 by task kunit_try_catch/217
[   14.187304] 
[   14.187707] CPU: 1 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   14.187757] Tainted: [B]=BAD_PAGE, [N]=TEST
[   14.187769] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   14.187790] Call Trace:
[   14.187804]  <TASK>
[   14.187820]  dump_stack_lvl+0x73/0xb0
[   14.187850]  print_report+0xd1/0x650
[   14.187872]  ? __virt_addr_valid+0x1db/0x2d0
[   14.187894]  ? workqueue_uaf+0x4d6/0x560
[   14.188013]  ? kasan_complete_mode_report_info+0x64/0x200
[   14.188041]  ? workqueue_uaf+0x4d6/0x560
[   14.188094]  kasan_report+0x141/0x180
[   14.188116]  ? workqueue_uaf+0x4d6/0x560
[   14.188143]  __asan_report_load8_noabort+0x18/0x20
[   14.188167]  workqueue_uaf+0x4d6/0x560
[   14.188189]  ? __pfx_workqueue_uaf+0x10/0x10
[   14.188211]  ? __schedule+0x10cc/0x2b60
[   14.188233]  ? __pfx_read_tsc+0x10/0x10
[   14.188255]  ? ktime_get_ts64+0x86/0x230
[   14.188280]  kunit_try_run_case+0x1a5/0x480
[   14.188304]  ? __pfx_kunit_try_run_case+0x10/0x10
[   14.188326]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   14.188350]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   14.188373]  ? __kthread_parkme+0x82/0x180
[   14.188393]  ? preempt_count_sub+0x50/0x80
[   14.188417]  ? __pfx_kunit_try_run_case+0x10/0x10
[   14.188440]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.188462]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   14.188485]  kthread+0x337/0x6f0
[   14.188504]  ? trace_preempt_on+0x20/0xc0
[   14.188529]  ? __pfx_kthread+0x10/0x10
[   14.188550]  ? _raw_spin_unlock_irq+0x47/0x80
[   14.188570]  ? calculate_sigpending+0x7b/0xa0
[   14.188594]  ? __pfx_kthread+0x10/0x10
[   14.188616]  ret_from_fork+0x116/0x1d0
[   14.188634]  ? __pfx_kthread+0x10/0x10
[   14.188654]  ret_from_fork_asm+0x1a/0x30
[   14.188685]  </TASK>
[   14.188697] 
[   14.204503] Allocated by task 217:
[   14.205143]  kasan_save_stack+0x45/0x70
[   14.205659]  kasan_save_track+0x18/0x40
[   14.206235]  kasan_save_alloc_info+0x3b/0x50
[   14.206787]  __kasan_kmalloc+0xb7/0xc0
[   14.207152]  __kmalloc_cache_noprof+0x189/0x420
[   14.207347]  workqueue_uaf+0x152/0x560
[   14.207486]  kunit_try_run_case+0x1a5/0x480
[   14.207633]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.207819]  kthread+0x337/0x6f0
[   14.207941]  ret_from_fork+0x116/0x1d0
[   14.208083]  ret_from_fork_asm+0x1a/0x30
[   14.208286] 
[   14.208382] Freed by task 24:
[   14.208539]  kasan_save_stack+0x45/0x70
[   14.208733]  kasan_save_track+0x18/0x40
[   14.210019]  kasan_save_free_info+0x3f/0x60
[   14.210776]  __kasan_slab_free+0x56/0x70
[   14.211418]  kfree+0x222/0x3f0
[   14.211555]  workqueue_uaf_work+0x12/0x20
[   14.212383]  process_one_work+0x5ee/0xf60
[   14.212883]  worker_thread+0x758/0x1220
[   14.213037]  kthread+0x337/0x6f0
[   14.213829]  ret_from_fork+0x116/0x1d0
[   14.214317]  ret_from_fork_asm+0x1a/0x30
[   14.214886] 
[   14.215161] Last potentially related work creation:
[   14.215401]  kasan_save_stack+0x45/0x70
[   14.215549]  kasan_record_aux_stack+0xb2/0xc0
[   14.216132]  __queue_work+0x626/0xeb0
[   14.216611]  queue_work_on+0xb6/0xc0
[   14.217224]  workqueue_uaf+0x26d/0x560
[   14.217923]  kunit_try_run_case+0x1a5/0x480
[   14.218475]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   14.219289]  kthread+0x337/0x6f0
[   14.219428]  ret_from_fork+0x116/0x1d0
[   14.219567]  ret_from_fork_asm+0x1a/0x30
[   14.220099] 
[   14.220573] The buggy address belongs to the object at ffff8881031bbf40
[   14.220573]  which belongs to the cache kmalloc-32 of size 32
[   14.222203] The buggy address is located 0 bytes inside of
[   14.222203]  freed 32-byte region [ffff8881031bbf40, ffff8881031bbf60)
[   14.222598] 
[   14.222677] The buggy address belongs to the physical page:
[   14.223808] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1031bb
[   14.224894] flags: 0x200000000000000(node=0|zone=2)
[   14.225127] page_type: f5(slab)
[   14.225259] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   14.225496] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   14.226496] page dumped because: kasan: bad access detected
[   14.227271] 
[   14.227603] Memory state around the buggy address:
[   14.228344]  ffff8881031bbe00: 00 00 05 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   14.229090]  ffff8881031bbe80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   14.229931] >ffff8881031bbf00: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   14.230764]                                            ^
[   14.231403]  ffff8881031bbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   14.232204]  ffff8881031bc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   14.232975] ==================================================================

[   32.283182] ==================================================================
[   32.293406] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560
[   32.300117] Read of size 8 at addr ffff88810134bfc0 by task kunit_try_catch/241
[   32.307431] 
[   32.308932] CPU: 2 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G S  B            N  6.16.0-rc5 #1 PREEMPT(voluntary) 
[   32.308941] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST
[   32.308944] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.7 12/07/2021
[   32.308947] Call Trace:
[   32.308949]  <TASK>
[   32.308951]  dump_stack_lvl+0x73/0xb0
[   32.308957]  print_report+0xd1/0x650
[   32.308961]  ? __virt_addr_valid+0x1db/0x2d0
[   32.308966]  ? workqueue_uaf+0x4d6/0x560
[   32.308970]  ? kasan_complete_mode_report_info+0x64/0x200
[   32.308975]  ? workqueue_uaf+0x4d6/0x560
[   32.308979]  kasan_report+0x141/0x180
[   32.308983]  ? workqueue_uaf+0x4d6/0x560
[   32.308988]  __asan_report_load8_noabort+0x18/0x20
[   32.308993]  workqueue_uaf+0x4d6/0x560
[   32.308997]  ? __pfx_workqueue_uaf+0x10/0x10
[   32.309001]  ? __schedule+0x10cc/0x2b60
[   32.309005]  ? ktime_get_ts64+0x83/0x230
[   32.309010]  kunit_try_run_case+0x1a2/0x480
[   32.309015]  ? __pfx_kunit_try_run_case+0x10/0x10
[   32.309019]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   32.309024]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   32.309028]  ? __kthread_parkme+0x82/0x180
[   32.309032]  ? preempt_count_sub+0x50/0x80
[   32.309037]  ? __pfx_kunit_try_run_case+0x10/0x10
[   32.309041]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   32.309045]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   32.309049]  kthread+0x334/0x6f0
[   32.309053]  ? trace_preempt_on+0x20/0xc0
[   32.309058]  ? __pfx_kthread+0x10/0x10
[   32.309061]  ? _raw_spin_unlock_irq+0x47/0x80
[   32.309065]  ? calculate_sigpending+0x7b/0xa0
[   32.309070]  ? __pfx_kthread+0x10/0x10
[   32.309074]  ret_from_fork+0x113/0x1d0
[   32.309078]  ? __pfx_kthread+0x10/0x10
[   32.309081]  ret_from_fork_asm+0x1a/0x30
[   32.309087]  </TASK>
[   32.309089] 
[   32.472216] Allocated by task 241:
[   32.475623]  kasan_save_stack+0x45/0x70
[   32.479463]  kasan_save_track+0x18/0x40
[   32.483301]  kasan_save_alloc_info+0x3b/0x50
[   32.487574]  __kasan_kmalloc+0xb7/0xc0
[   32.491328]  __kmalloc_cache_noprof+0x189/0x420
[   32.495886]  workqueue_uaf+0x152/0x560
[   32.499639]  kunit_try_run_case+0x1a2/0x480
[   32.503823]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   32.509223]  kthread+0x334/0x6f0
[   32.512458]  ret_from_fork+0x113/0x1d0
[   32.516210]  ret_from_fork_asm+0x1a/0x30
[   32.520134] 
[   32.521636] Freed by task 49:
[   32.524606]  kasan_save_stack+0x45/0x70
[   32.528445]  kasan_save_track+0x18/0x40
[   32.532286]  kasan_save_free_info+0x3f/0x60
[   32.536470]  __kasan_slab_free+0x56/0x70
[   32.540404]  kfree+0x222/0x3f0
[   32.543466]  workqueue_uaf_work+0x12/0x20
[   32.547478]  process_one_work+0x5eb/0xf60
[   32.551492]  worker_thread+0x758/0x1220
[   32.555348]  kthread+0x334/0x6f0
[   32.558590]  ret_from_fork+0x113/0x1d0
[   32.562361]  ret_from_fork_asm+0x1a/0x30
[   32.566312] 
[   32.567812] Last potentially related work creation:
[   32.572689]  kasan_save_stack+0x45/0x70
[   32.576529]  kasan_record_aux_stack+0xb2/0xc0
[   32.580895]  __queue_work+0x626/0xeb0
[   32.584564]  queue_work_on+0xb6/0xc0
[   32.588141]  workqueue_uaf+0x26d/0x560
[   32.591895]  kunit_try_run_case+0x1a2/0x480
[   32.596081]  kunit_generic_run_threadfn_adapter+0x82/0xf0
[   32.601479]  kthread+0x334/0x6f0
[   32.604712]  ret_from_fork+0x113/0x1d0
[   32.608465]  ret_from_fork_asm+0x1a/0x30
[   32.612407] 
[   32.613901] The buggy address belongs to the object at ffff88810134bfc0
[   32.613901]  which belongs to the cache kmalloc-32 of size 32
[   32.626242] The buggy address is located 0 bytes inside of
[   32.626242]  freed 32-byte region [ffff88810134bfc0, ffff88810134bfe0)
[   32.638236] 
[   32.639736] The buggy address belongs to the physical page:
[   32.645307] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10134b
[   32.653315] flags: 0x200000000000000(node=0|zone=2)
[   32.658230] page_type: f5(slab)
[   32.661378] raw: 0200000000000000 ffff888100042780 dead000000000122 0000000000000000
[   32.669143] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   32.676887] page dumped because: kasan: bad access detected
[   32.682461] 
[   32.683961] Memory state around the buggy address:
[   32.688754]  ffff88810134be80: 00 00 07 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   32.695973]  ffff88810134bf00: 00 00 03 fc fc fc fc fc 00 00 07 fc fc fc fc fc
[   32.703191] >ffff88810134bf80: 00 00 00 07 fc fc fc fc fa fb fb fb fc fc fc fc
[   32.710410]                                            ^
[   32.715723]  ffff88810134c000: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[   32.722944]  ffff88810134c080: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[   32.730163] ==================================================================