[   25.593282] ==================================================================
[   25.593510] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70
[   25.593652] Read of size 4 at addr fff00000c77ed180 by task swapper/0/0
[   25.593780] 
[   25.596502] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT 
[   25.597861] Tainted: [B]=BAD_PAGE, [N]=TEST
[   25.597932] Hardware name: linux,dummy-virt (DT)
[   25.598010] Call trace:
[   25.598066]  show_stack+0x20/0x38 (C)
[   25.599562]  dump_stack_lvl+0x8c/0xd0
[   25.599726]  print_report+0x118/0x608
[   25.599939]  kasan_report+0xdc/0x128
[   25.600404]  __asan_report_load4_noabort+0x20/0x30
[   25.600613]  rcu_uaf_reclaim+0x64/0x70
[   25.600778]  rcu_core+0x9f4/0x1e20
[   25.601117]  rcu_core_si+0x18/0x30
[   25.601238]  handle_softirqs+0x374/0xb28
[   25.601596]  __do_softirq+0x1c/0x28
[   25.601725]  ____do_softirq+0x18/0x30
[   25.601858]  call_on_irq_stack+0x24/0x30
[   25.602395]  do_softirq_own_stack+0x24/0x38
[   25.602925]  __irq_exit_rcu+0x1fc/0x318
[   25.603148]  irq_exit_rcu+0x1c/0x80
[   25.603422]  el1_interrupt+0x38/0x58
[   25.603618]  el1h_64_irq_handler+0x18/0x28
[   25.603757]  el1h_64_irq+0x6c/0x70
[   25.603957]  arch_local_irq_enable+0x4/0x8 (P)
[   25.604109]  do_idle+0x384/0x4e8
[   25.604274]  cpu_startup_entry+0x64/0x80
[   25.604409]  rest_init+0x160/0x188
[   25.604915]  start_kernel+0x314/0x3d8
[   25.605131]  __primary_switched+0x8c/0xa0
[   25.605371] 
[   25.605482] Allocated by task 199:
[   25.605559]  kasan_save_stack+0x3c/0x68
[   25.605671]  kasan_save_track+0x20/0x40
[   25.605790]  kasan_save_alloc_info+0x40/0x58
[   25.605897]  __kasan_kmalloc+0xd4/0xd8
[   25.606091]  __kmalloc_cache_noprof+0x15c/0x3c0
[   25.606301]  rcu_uaf+0xb0/0x2d8
[   25.606414]  kunit_try_run_case+0x170/0x3f0
[   25.606527]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.606652]  kthread+0x328/0x630
[   25.606914]  ret_from_fork+0x10/0x20
[   25.607102] 
[   25.607147] Freed by task 0:
[   25.607630]  kasan_save_stack+0x3c/0x68
[   25.607840]  kasan_save_track+0x20/0x40
[   25.608062]  kasan_save_free_info+0x4c/0x78
[   25.608237]  __kasan_slab_free+0x6c/0x98
[   25.608350]  kfree+0x214/0x3c8
[   25.608449]  rcu_uaf_reclaim+0x28/0x70
[   25.608559]  rcu_core+0x9f4/0x1e20
[   25.608663]  rcu_core_si+0x18/0x30
[   25.608778]  handle_softirqs+0x374/0xb28
[   25.609407]  __do_softirq+0x1c/0x28
[   25.609520] 
[   25.609617] Last potentially related work creation:
[   25.609785]  kasan_save_stack+0x3c/0x68
[   25.610012]  kasan_record_aux_stack+0xb4/0xc8
[   25.610146]  __call_rcu_common.constprop.0+0x70/0x8b0
[   25.610436]  call_rcu+0x18/0x30
[   25.610546]  rcu_uaf+0x14c/0x2d8
[   25.610783]  kunit_try_run_case+0x170/0x3f0
[   25.611342]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   25.611425]  kthread+0x328/0x630
[   25.611470]  ret_from_fork+0x10/0x20
[   25.611562] 
[   25.611734] The buggy address belongs to the object at fff00000c77ed180
[   25.611734]  which belongs to the cache kmalloc-32 of size 32
[   25.611914] The buggy address is located 0 bytes inside of
[   25.611914]  freed 32-byte region [fff00000c77ed180, fff00000c77ed1a0)
[   25.612314] 
[   25.612371] The buggy address belongs to the physical page:
[   25.612447] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ed
[   25.612574] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   25.612770] page_type: f5(slab)
[   25.612890] raw: 0bfffe0000000000 fff00000c0001780 dead000000000122 0000000000000000
[   25.613025] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   25.613134] page dumped because: kasan: bad access detected
[   25.613215] 
[   25.613393] Memory state around the buggy address:
[   25.613591]  fff00000c77ed080: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc
[   25.613864]  fff00000c77ed100: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   25.614124] >fff00000c77ed180: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[   25.614218]                    ^
[   25.614339]  fff00000c77ed200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.614479]  fff00000c77ed280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   25.614727] ==================================================================

[   19.207417] ==================================================================
[   19.208480] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x50/0x60
[   19.209425] Read of size 4 at addr ffff888102b69640 by task swapper/0/0
[   19.209946] 
[   19.210968] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G    B            N  6.15.0-next-20250530 #1 PREEMPT(voluntary) 
[   19.211091] Tainted: [B]=BAD_PAGE, [N]=TEST
[   19.211130] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   19.211188] Call Trace:
[   19.211259]  <IRQ>
[   19.211300]  dump_stack_lvl+0x73/0xb0
[   19.211369]  print_report+0xd1/0x650
[   19.211430]  ? __virt_addr_valid+0x1db/0x2d0
[   19.211466]  ? rcu_uaf_reclaim+0x50/0x60
[   19.211495]  ? kasan_complete_mode_report_info+0x64/0x200
[   19.211529]  ? rcu_uaf_reclaim+0x50/0x60
[   19.211558]  kasan_report+0x141/0x180
[   19.211589]  ? rcu_uaf_reclaim+0x50/0x60
[   19.211623]  __asan_report_load4_noabort+0x18/0x20
[   19.211651]  rcu_uaf_reclaim+0x50/0x60
[   19.211680]  rcu_core+0x66f/0x1c40
[   19.211728]  ? __pfx_rcu_core+0x10/0x10
[   19.211985]  ? ktime_get+0x6b/0x150
[   19.212052]  rcu_core_si+0x12/0x20
[   19.212083]  handle_softirqs+0x209/0x730
[   19.212114]  ? hrtimer_interrupt+0x2fe/0x780
[   19.212145]  ? __pfx_handle_softirqs+0x10/0x10
[   19.212269]  __irq_exit_rcu+0xc9/0x110
[   19.212310]  irq_exit_rcu+0x12/0x20
[   19.212340]  sysvec_apic_timer_interrupt+0x81/0x90
[   19.212380]  </IRQ>
[   19.212420]  <TASK>
[   19.212436]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   19.212560] RIP: 0010:pv_native_safe_halt+0xf/0x20
[   19.212853] Code: 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 23 98 1d 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[   19.212968] RSP: 0000:ffffffff8a807dd8 EFLAGS: 00010216
[   19.213112] RAX: ffff8881cf45b000 RBX: ffffffff8a81cac0 RCX: ffffffff896b2245
[   19.213311] RDX: ffffed102b60618b RSI: 0000000000000004 RDI: 000000000002846c
[   19.213386] RBP: ffffffff8a807de0 R08: 0000000000000001 R09: ffffed102b60618a
[   19.213447] R10: ffff88815b030c53 R11: 0000000000023400 R12: 0000000000000000
[   19.213506] R13: fffffbfff1503958 R14: ffffffff8b3c3190 R15: 0000000000000000
[   19.213587]  ? ct_kernel_exit.constprop.0+0xa5/0xd0
[   19.213663]  ? default_idle+0xd/0x20
[   19.213697]  arch_cpu_idle+0xd/0x20
[   19.213747]  default_idle_call+0x48/0x80
[   19.213790]  do_idle+0x379/0x4f0
[   19.213821]  ? __pfx_do_idle+0x10/0x10
[   19.213846]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   19.213881]  ? trace_preempt_on+0x20/0xc0
[   19.213914]  ? schedule+0x86/0x2e0
[   19.213943]  ? preempt_count_sub+0x50/0x80
[   19.213975]  cpu_startup_entry+0x5c/0x70
[   19.214027]  rest_init+0x11a/0x140
[   19.214058]  ? acpi_subsystem_init+0x5d/0x150
[   19.214094]  start_kernel+0x330/0x410
[   19.214124]  x86_64_start_reservations+0x1c/0x30
[   19.214154]  x86_64_start_kernel+0x10d/0x120
[   19.214233]  common_startup_64+0x13e/0x148
[   19.214345]  </TASK>
[   19.214385] 
[   19.247082] Allocated by task 215:
[   19.247980]  kasan_save_stack+0x45/0x70
[   19.248567]  kasan_save_track+0x18/0x40
[   19.249282]  kasan_save_alloc_info+0x3b/0x50
[   19.249885]  __kasan_kmalloc+0xb7/0xc0
[   19.250542]  __kmalloc_cache_noprof+0x189/0x420
[   19.251108]  rcu_uaf+0xb0/0x330
[   19.251830]  kunit_try_run_case+0x1a5/0x480
[   19.252347]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.253073]  kthread+0x337/0x6f0
[   19.253572]  ret_from_fork+0x116/0x1d0
[   19.254049]  ret_from_fork_asm+0x1a/0x30
[   19.254679] 
[   19.254977] Freed by task 0:
[   19.255595]  kasan_save_stack+0x45/0x70
[   19.256411]  kasan_save_track+0x18/0x40
[   19.256820]  kasan_save_free_info+0x3f/0x60
[   19.257116]  __kasan_slab_free+0x56/0x70
[   19.257860]  kfree+0x222/0x3f0
[   19.258382]  rcu_uaf_reclaim+0x1f/0x60
[   19.258842]  rcu_core+0x66f/0x1c40
[   19.259599]  rcu_core_si+0x12/0x20
[   19.260118]  handle_softirqs+0x209/0x730
[   19.260822]  __irq_exit_rcu+0xc9/0x110
[   19.261391]  irq_exit_rcu+0x12/0x20
[   19.261617]  sysvec_apic_timer_interrupt+0x81/0x90
[   19.262585]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   19.263783] 
[   19.264401] Last potentially related work creation:
[   19.265260]  kasan_save_stack+0x45/0x70
[   19.265683]  kasan_record_aux_stack+0xb2/0xc0
[   19.266139]  __call_rcu_common.constprop.0+0x72/0x9d0
[   19.266628]  call_rcu+0x12/0x20
[   19.267395]  rcu_uaf+0x168/0x330
[   19.267742]  kunit_try_run_case+0x1a5/0x480
[   19.268230]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   19.268820]  kthread+0x337/0x6f0
[   19.269631]  ret_from_fork+0x116/0x1d0
[   19.270103]  ret_from_fork_asm+0x1a/0x30
[   19.270739] 
[   19.270978] The buggy address belongs to the object at ffff888102b69640
[   19.270978]  which belongs to the cache kmalloc-32 of size 32
[   19.272623] The buggy address is located 0 bytes inside of
[   19.272623]  freed 32-byte region [ffff888102b69640, ffff888102b69660)
[   19.273650] 
[   19.273884] The buggy address belongs to the physical page:
[   19.274891] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b69
[   19.275891] flags: 0x200000000000000(node=0|zone=2)
[   19.276431] page_type: f5(slab)
[   19.277036] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   19.277786] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   19.278397] page dumped because: kasan: bad access detected
[   19.278912] 
[   19.279111] Memory state around the buggy address:
[   19.279638]  ffff888102b69500: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   19.280891]  ffff888102b69580: 00 00 00 fc fc fc fc fc 00 00 05 fc fc fc fc fc
[   19.281549] >ffff888102b69600: 00 00 07 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   19.282390]                                            ^
[   19.283167]  ffff888102b69680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.284082]  ffff888102b69700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.284703] ==================================================================

[   59.263244] ==================================================================
[   59.273681] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x5c/0x60
[   59.280456] Read of size 4 at addr cc797a80 by task ksoftirqd/0/14
[   59.286682] 
[   59.288208] CPU: 0 UID: 0 PID: 14 Comm: ksoftirqd/0 Tainted: G    B   W        N  6.15.0-next-20250530 #1 NONE 
[   59.288238] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   59.288269] Hardware name: Generic DRA74X (Flattened Device Tree)
[   59.288269] Call trace: 
[   59.288299]  unwind_backtrace from show_stack+0x18/0x1c
[   59.288330]  show_stack from dump_stack_lvl+0x70/0x90
[   59.288360]  dump_stack_lvl from print_report+0x158/0x528
[   59.288391]  print_report from kasan_report+0xdc/0x118
[   59.288421]  kasan_report from rcu_uaf_reclaim+0x5c/0x60
[   59.288482]  rcu_uaf_reclaim from rcu_core+0x84c/0x1aa4
[   59.288513]  rcu_core from handle_softirqs+0x3d8/0xc7c
[   59.288543]  handle_softirqs from run_ksoftirqd+0x7c/0x9c
[   59.288574]  run_ksoftirqd from smpboot_thread_fn+0x46c/0xa68
[   59.288604]  smpboot_thread_fn from kthread+0x464/0x810
[   59.288635]  kthread from ret_from_fork+0x14/0x20
[   59.288665] Exception stack(0xf007bfb0 to 0xf007bff8)
[   59.288696] bfa0:                                     00000000 00000000 00000000 00000000
[   59.288696] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   59.288726] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   59.288757] 
[   59.400054] Allocated by task 250:
[   59.403503]  kasan_save_track+0x30/0x5c
[   59.407379]  __kasan_kmalloc+0x8c/0x94
[   59.411163]  rcu_uaf+0xd0/0x354
[   59.414337]  kunit_try_run_case+0x22c/0x5a8
[   59.418579]  kunit_generic_run_threadfn_adapter+0xc4/0x128
[   59.424133]  kthread+0x464/0x810
[   59.427398]  ret_from_fork+0x14/0x20
[   59.430999] 
[   59.432525] Freed by task 14:
[   59.435516]  kasan_save_track+0x30/0x5c
[   59.439392]  kasan_save_free_info+0x3c/0x48
[   59.443603]  __kasan_slab_free+0x40/0x50
[   59.447570]  kfree+0xe8/0x384
[   59.450592]  rcu_uaf_reclaim+0x1c/0x60
[   59.454376]  rcu_core+0x84c/0x1aa4
[   59.457824]  handle_softirqs+0x3d8/0xc7c
[   59.461791]  run_ksoftirqd+0x7c/0x9c
[   59.465393]  smpboot_thread_fn+0x46c/0xa68
[   59.469543]  kthread+0x464/0x810
[   59.472808]  ret_from_fork+0x14/0x20
[   59.476409] 
[   59.477935] Last potentially related work creation:
[   59.482849]  kasan_save_stack+0x30/0x4c
[   59.486724]  kasan_record_aux_stack+0x80/0x88
[   59.491119]  __call_rcu_common.constprop.0+0x98/0xb80
[   59.496215]  rcu_uaf+0x1a4/0x354
[   59.499481]  kunit_try_run_case+0x22c/0x5a8
[   59.503723]  kunit_generic_run_threadfn_adapter+0xc4/0x128
[   59.509277]  kthread+0x464/0x810
[   59.512542]  ret_from_fork+0x14/0x20
[   59.516143] 
[   59.517669] The buggy address belongs to the object at cc797a80
[   59.517669]  which belongs to the cache kmalloc-64 of size 64
[   59.529388] The buggy address is located 0 bytes inside of
[   59.529388]  freed 64-byte region [cc797a80, cc797ac0)
[   59.540100] 
[   59.541595] The buggy address belongs to the physical page:
[   59.547210] page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x8c797
[   59.554504] flags: 0x0(zone=0)
[   59.557586] page_type: f5(slab)
[   59.560760] raw: 00000000 c7001300 00000122 00000000 00000000 80200020 f5000000 00000000
[   59.568908] raw: 00000000
[   59.571563] page dumped because: kasan: bad access detected
[   59.577178] 
[   59.578704] Memory state around the buggy address:
[   59.583526]  cc797980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.590118]  cc797a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.596679] >cc797a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.603271]            ^
[   59.605834]  cc797b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.612426]  cc797b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.618988] ==================================================================