[   26.186501] ==================================================================
[   26.193607] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520
[   26.200198] Read of size 1 at addr ffff0008034c8a00 by task kunit_try_catch/209
[   26.207489] 
[   26.208971] CPU: 7 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   26.209020] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.209035] Hardware name: WinLink E850-96 board (DT)
[   26.209054] Call trace:
[   26.209068]  show_stack+0x20/0x38 (C)
[   26.209099]  dump_stack_lvl+0x8c/0xd0
[   26.209130]  print_report+0x118/0x608
[   26.209163]  kasan_report+0xdc/0x128
[   26.209192]  __asan_report_load1_noabort+0x20/0x30
[   26.209225]  krealloc_uaf+0x4c8/0x520
[   26.209251]  kunit_try_run_case+0x170/0x3f0
[   26.209280]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.209312]  kthread+0x328/0x630
[   26.209344]  ret_from_fork+0x10/0x20
[   26.209374] 
[   26.272505] Allocated by task 209:
[   26.275892]  kasan_save_stack+0x3c/0x68
[   26.279710]  kasan_save_track+0x20/0x40
[   26.283529]  kasan_save_alloc_info+0x40/0x58
[   26.287783]  __kasan_kmalloc+0xd4/0xd8
[   26.291515]  __kmalloc_cache_noprof+0x15c/0x3c0
[   26.296029]  krealloc_uaf+0xc8/0x520
[   26.299588]  kunit_try_run_case+0x170/0x3f0
[   26.303754]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.309223]  kthread+0x328/0x630
[   26.312435]  ret_from_fork+0x10/0x20
[   26.315994] 
[   26.317470] Freed by task 209:
[   26.320509]  kasan_save_stack+0x3c/0x68
[   26.324327]  kasan_save_track+0x20/0x40
[   26.328147]  kasan_save_free_info+0x4c/0x78
[   26.332313]  __kasan_slab_free+0x6c/0x98
[   26.336220]  kfree+0x214/0x3c8
[   26.339258]  krealloc_uaf+0x12c/0x520
[   26.342903]  kunit_try_run_case+0x170/0x3f0
[   26.347070]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.352539]  kthread+0x328/0x630
[   26.355750]  ret_from_fork+0x10/0x20
[   26.359310] 
[   26.360787] The buggy address belongs to the object at ffff0008034c8a00
[   26.360787]  which belongs to the cache kmalloc-256 of size 256
[   26.373287] The buggy address is located 0 bytes inside of
[   26.373287]  freed 256-byte region [ffff0008034c8a00, ffff0008034c8b00)
[   26.385351] 
[   26.386828] The buggy address belongs to the physical page:
[   26.392385] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8834c8
[   26.400368] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   26.408008] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   26.414951] page_type: f5(slab)
[   26.418084] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000
[   26.425808] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   26.433534] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000
[   26.441346] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   26.449159] head: 0bfffe0000000002 fffffdffe00d3201 00000000ffffffff 00000000ffffffff
[   26.456971] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   26.464778] page dumped because: kasan: bad access detected
[   26.470332] 
[   26.471807] Memory state around the buggy address:
[   26.476586]  ffff0008034c8900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.483790]  ffff0008034c8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.490995] >ffff0008034c8a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.498196]                    ^
[   26.501412]  ffff0008034c8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.508616]  ffff0008034c8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.515818] ==================================================================
[   25.844008] ==================================================================
[   25.853942] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520
[   25.860534] Read of size 1 at addr ffff0008034c8a00 by task kunit_try_catch/209
[   25.867825] 
[   25.869310] CPU: 7 UID: 0 PID: 209 Comm: kunit_try_catch Tainted: G    B            N  6.15.0-rc6-next-20250515 #1 PREEMPT 
[   25.869366] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.869384] Hardware name: WinLink E850-96 board (DT)
[   25.869405] Call trace:
[   25.869419]  show_stack+0x20/0x38 (C)
[   25.869454]  dump_stack_lvl+0x8c/0xd0
[   25.869486]  print_report+0x118/0x608
[   25.869518]  kasan_report+0xdc/0x128
[   25.869547]  __kasan_check_byte+0x54/0x70
[   25.869578]  krealloc_noprof+0x44/0x360
[   25.869612]  krealloc_uaf+0x180/0x520
[   25.869639]  kunit_try_run_case+0x170/0x3f0
[   25.869671]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.869703]  kthread+0x328/0x630
[   25.869737]  ret_from_fork+0x10/0x20
[   25.869771] 
[   25.935878] Allocated by task 209:
[   25.939267]  kasan_save_stack+0x3c/0x68
[   25.943083]  kasan_save_track+0x20/0x40
[   25.946904]  kasan_save_alloc_info+0x40/0x58
[   25.951156]  __kasan_kmalloc+0xd4/0xd8
[   25.954888]  __kmalloc_cache_noprof+0x15c/0x3c0
[   25.959402]  krealloc_uaf+0xc8/0x520
[   25.962961]  kunit_try_run_case+0x170/0x3f0
[   25.967128]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.972597]  kthread+0x328/0x630
[   25.975808]  ret_from_fork+0x10/0x20
[   25.979367] 
[   25.980844] Freed by task 209:
[   25.983884]  kasan_save_stack+0x3c/0x68
[   25.987701]  kasan_save_track+0x20/0x40
[   25.991520]  kasan_save_free_info+0x4c/0x78
[   25.995686]  __kasan_slab_free+0x6c/0x98
[   25.999593]  kfree+0x214/0x3c8
[   26.002631]  krealloc_uaf+0x12c/0x520
[   26.006276]  kunit_try_run_case+0x170/0x3f0
[   26.010443]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.015912]  kthread+0x328/0x630
[   26.019124]  ret_from_fork+0x10/0x20
[   26.022682] 
[   26.024161] The buggy address belongs to the object at ffff0008034c8a00
[   26.024161]  which belongs to the cache kmalloc-256 of size 256
[   26.036662] The buggy address is located 0 bytes inside of
[   26.036662]  freed 256-byte region [ffff0008034c8a00, ffff0008034c8b00)
[   26.048725] 
[   26.050203] The buggy address belongs to the physical page:
[   26.055759] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8834c8
[   26.063744] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   26.071382] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   26.078326] page_type: f5(slab)
[   26.081463] raw: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000
[   26.089181] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   26.096908] head: 0bfffe0000000040 ffff000800002b40 dead000000000122 0000000000000000
[   26.104719] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   26.112532] head: 0bfffe0000000002 fffffdffe00d3201 00000000ffffffff 00000000ffffffff
[   26.120344] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   26.128149] page dumped because: kasan: bad access detected
[   26.133705] 
[   26.135180] Memory state around the buggy address:
[   26.139962]  ffff0008034c8900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.147164]  ffff0008034c8980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.154371] >ffff0008034c8a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.161570]                    ^
[   26.164784]  ffff0008034c8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.171990]  ffff0008034c8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.179192] ==================================================================