[   24.379766] ==================================================================
[   24.380611] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bd/0x380
[   24.381361] Read of size 1 at addr ffff888102997000 by task kunit_try_catch/223
[   24.382174] 
[   24.382420] CPU: 1 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G    B            N 6.13.0-rc1-next-20241204 #1
[   24.383568] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.384258] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.385827] Call Trace:
[   24.386064]  <TASK>
[   24.386354]  dump_stack_lvl+0x73/0xb0
[   24.387086]  print_report+0xd1/0x640
[   24.387720]  ? __virt_addr_valid+0x1db/0x2d0
[   24.388164]  ? kasan_complete_mode_report_info+0x64/0x200
[   24.388663]  kasan_report+0x102/0x140
[   24.389273]  ? kmem_cache_double_destroy+0x1bd/0x380
[   24.389923]  ? kmem_cache_double_destroy+0x1bd/0x380
[   24.390634]  ? kmem_cache_double_destroy+0x1bd/0x380
[   24.391286]  __kasan_check_byte+0x3d/0x50
[   24.391649]  kmem_cache_destroy+0x25/0x1d0
[   24.391924]  kmem_cache_double_destroy+0x1bd/0x380
[   24.392265]  ? __pfx_kmem_cache_double_destroy+0x10/0x10
[   24.392743]  ? finish_task_switch.isra.0+0x153/0x700
[   24.393519]  ? __switch_to+0x5d9/0xf60
[   24.393817]  ? __pfx_empty_cache_ctor+0x10/0x10
[   24.394558]  ? __pfx_read_tsc+0x10/0x10
[   24.394849]  ? ktime_get_ts64+0x86/0x230
[   24.395164]  kunit_try_run_case+0x1b3/0x490
[   24.395669]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.396141]  ? _raw_spin_lock_irqsave+0xa2/0x110
[   24.396591]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.397083]  ? __kthread_parkme+0x82/0x160
[   24.397581]  ? preempt_count_sub+0x50/0x80
[   24.397938]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.398510]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.398982]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.399593]  kthread+0x257/0x310
[   24.399966]  ? __pfx_kthread+0x10/0x10
[   24.400264]  ret_from_fork+0x41/0x80
[   24.400747]  ? __pfx_kthread+0x10/0x10
[   24.401243]  ret_from_fork_asm+0x1a/0x30
[   24.401675]  </TASK>
[   24.401867] 
[   24.402132] Allocated by task 223:
[   24.402597]  kasan_save_stack+0x3d/0x60
[   24.403086]  kasan_save_track+0x18/0x40
[   24.403406]  kasan_save_alloc_info+0x3b/0x50
[   24.403801]  __kasan_slab_alloc+0x91/0xa0
[   24.404218]  kmem_cache_alloc_noprof+0x11e/0x3e0
[   24.404580]  __kmem_cache_create_args+0x177/0x250
[   24.405157]  kmem_cache_double_destroy+0xd3/0x380
[   24.405662]  kunit_try_run_case+0x1b3/0x490
[   24.405975]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.407187]  kthread+0x257/0x310
[   24.407620]  ret_from_fork+0x41/0x80
[   24.408080]  ret_from_fork_asm+0x1a/0x30
[   24.408885] 
[   24.409068] Freed by task 223:
[   24.409401]  kasan_save_stack+0x3d/0x60
[   24.409999]  kasan_save_track+0x18/0x40
[   24.410284]  kasan_save_free_info+0x3f/0x60
[   24.410799]  __kasan_slab_free+0x56/0x70
[   24.411259]  kmem_cache_free+0x120/0x420
[   24.411623]  slab_kmem_cache_release+0x2e/0x40
[   24.412238]  kmem_cache_release+0x16/0x20
[   24.412743]  kobject_put+0x181/0x450
[   24.413038]  sysfs_slab_release+0x16/0x20
[   24.413544]  kmem_cache_destroy+0xf0/0x1d0
[   24.414046]  kmem_cache_double_destroy+0x14c/0x380
[   24.414445]  kunit_try_run_case+0x1b3/0x490
[   24.414861]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.415599]  kthread+0x257/0x310
[   24.415958]  ret_from_fork+0x41/0x80
[   24.416508]  ret_from_fork_asm+0x1a/0x30
[   24.416946] 
[   24.417271] The buggy address belongs to the object at ffff888102997000
[   24.417271]  which belongs to the cache kmem_cache of size 208
[   24.418270] The buggy address is located 0 bytes inside of
[   24.418270]  freed 208-byte region [ffff888102997000, ffff8881029970d0)
[   24.419522] 
[   24.419683] The buggy address belongs to the physical page:
[   24.420361] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102997
[   24.421089] flags: 0x200000000000000(node=0|zone=2)
[   24.421697] page_type: f5(slab)
[   24.422202] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000
[   24.422924] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[   24.423632] page dumped because: kasan: bad access detected
[   24.424255] 
[   24.424425] Memory state around the buggy address:
[   24.424983]  ffff888102996f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   24.425703]  ffff888102996f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.426354] >ffff888102997000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   24.427083]                    ^
[   24.427442]  ffff888102997080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[   24.428117]  ffff888102997100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.429201] ==================================================================