[   23.275227] ==================================================================
[   23.276255] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x1bc/0x380
[   23.278351] Read of size 1 at addr ffff8881009f8c80 by task kunit_try_catch/236
[   23.279246] 
[   23.279471] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G    B            N  6.14.0-rc7-next-20250319 #1 PREEMPT(voluntary) 
[   23.279545] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.279563] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.279605] Call Trace:
[   23.279641]  <TASK>
[   23.279664]  dump_stack_lvl+0x73/0xb0
[   23.280191]  print_report+0xd1/0x660
[   23.280236]  ? __virt_addr_valid+0x1db/0x2d0
[   23.280305]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.280343]  kasan_report+0x104/0x140
[   23.280372]  ? kmem_cache_double_destroy+0x1bc/0x380
[   23.280411]  ? kmem_cache_double_destroy+0x1bc/0x380
[   23.280452]  ? kmem_cache_double_destroy+0x1bc/0x380
[   23.280487]  __kasan_check_byte+0x3d/0x50
[   23.280521]  kmem_cache_destroy+0x25/0x200
[   23.280554]  kmem_cache_double_destroy+0x1bc/0x380
[   23.280589]  ? __pfx_kmem_cache_double_destroy+0x10/0x10
[   23.280624]  ? finish_task_switch.isra.0+0x153/0x730
[   23.280657]  ? __switch_to+0x5d9/0xf70
[   23.280865]  ? __pfx_empty_cache_ctor+0x10/0x10
[   23.280931]  ? __pfx_read_tsc+0x10/0x10
[   23.280967]  ? ktime_get_ts64+0x86/0x240
[   23.281007]  kunit_try_run_case+0x1b2/0x490
[   23.281046]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.281078]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.281130]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.281163]  ? __kthread_parkme+0x82/0x160
[   23.281196]  ? preempt_count_sub+0x50/0x80
[   23.281232]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.281266]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.281300]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.281334]  kthread+0x323/0x710
[   23.281363]  ? trace_preempt_on+0x20/0xc0
[   23.281398]  ? __pfx_kthread+0x10/0x10
[   23.281430]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.281458]  ? calculate_sigpending+0x7b/0xa0
[   23.281490]  ? __pfx_kthread+0x10/0x10
[   23.281522]  ret_from_fork+0x41/0x80
[   23.281552]  ? __pfx_kthread+0x10/0x10
[   23.281583]  ret_from_fork_asm+0x1a/0x30
[   23.281631]  </TASK>
[   23.281646] 
[   23.302382] Allocated by task 236:
[   23.302690]  kasan_save_stack+0x3d/0x60
[   23.303627]  kasan_save_track+0x18/0x40
[   23.304318]  kasan_save_alloc_info+0x3b/0x50
[   23.304904]  __kasan_slab_alloc+0x91/0xa0
[   23.305501]  kmem_cache_alloc_noprof+0x11d/0x3f0
[   23.305977]  __kmem_cache_create_args+0x169/0x240
[   23.306896]  kmem_cache_double_destroy+0xd2/0x380
[   23.307741]  kunit_try_run_case+0x1b2/0x490
[   23.308187]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.309160]  kthread+0x323/0x710
[   23.309610]  ret_from_fork+0x41/0x80
[   23.310214]  ret_from_fork_asm+0x1a/0x30
[   23.310588] 
[   23.311605] Freed by task 236:
[   23.311960]  kasan_save_stack+0x3d/0x60
[   23.312340]  kasan_save_track+0x18/0x40
[   23.312891]  kasan_save_free_info+0x3f/0x60
[   23.314023]  __kasan_slab_free+0x56/0x70
[   23.314416]  kmem_cache_free+0x249/0x420
[   23.314862]  slab_kmem_cache_release+0x2e/0x40
[   23.315221]  kmem_cache_release+0x16/0x20
[   23.315667]  kobject_put+0x181/0x470
[   23.317106]  sysfs_slab_release+0x16/0x20
[   23.317669]  kmem_cache_destroy+0xf0/0x200
[   23.318321]  kmem_cache_double_destroy+0x14b/0x380
[   23.318666]  kunit_try_run_case+0x1b2/0x490
[   23.319091]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.319634]  kthread+0x323/0x710
[   23.320808]  ret_from_fork+0x41/0x80
[   23.321306]  ret_from_fork_asm+0x1a/0x30
[   23.321579] 
[   23.322038] The buggy address belongs to the object at ffff8881009f8c80
[   23.322038]  which belongs to the cache kmem_cache of size 208
[   23.323272] The buggy address is located 0 bytes inside of
[   23.323272]  freed 208-byte region [ffff8881009f8c80, ffff8881009f8d50)
[   23.324354] 
[   23.324653] The buggy address belongs to the physical page:
[   23.325586] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009f8
[   23.326734] flags: 0x200000000000000(node=0|zone=2)
[   23.326955] page_type: f5(slab)
[   23.327092] raw: 0200000000000000 ffff888100041000 dead000000000122 0000000000000000
[   23.327787] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[   23.328667] page dumped because: kasan: bad access detected
[   23.329942] 
[   23.330282] Memory state around the buggy address:
[   23.331025]  ffff8881009f8b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   23.331669]  ffff8881009f8c00: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.332606] >ffff8881009f8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   23.333264]                    ^
[   23.333620]  ffff8881009f8d00: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[   23.334253]  ffff8881009f8d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.335100] ==================================================================