[   18.954130] ==================================================================
[   18.955287] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x4d6/0x560
[   18.956049] Read of size 8 at addr ffff888102a1a180 by task kunit_try_catch/227
[   18.957077] 
[   18.957463] CPU: 1 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc2-next-20250617 #1 PREEMPT(voluntary) 
[   18.957621] Tainted: [B]=BAD_PAGE, [N]=TEST
[   18.957660] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.957748] Call Trace:
[   18.957787]  <TASK>
[   18.957852]  dump_stack_lvl+0x73/0xb0
[   18.957940]  print_report+0xd1/0x650
[   18.958012]  ? __virt_addr_valid+0x1db/0x2d0
[   18.958082]  ? workqueue_uaf+0x4d6/0x560
[   18.958147]  ? kasan_complete_mode_report_info+0x64/0x200
[   18.958214]  ? workqueue_uaf+0x4d6/0x560
[   18.958303]  kasan_report+0x141/0x180
[   18.958378]  ? workqueue_uaf+0x4d6/0x560
[   18.958445]  __asan_report_load8_noabort+0x18/0x20
[   18.958483]  workqueue_uaf+0x4d6/0x560
[   18.958515]  ? __pfx_workqueue_uaf+0x10/0x10
[   18.958546]  ? __schedule+0x10cc/0x2b60
[   18.958579]  ? __pfx_read_tsc+0x10/0x10
[   18.958609]  ? ktime_get_ts64+0x86/0x230
[   18.958644]  kunit_try_run_case+0x1a5/0x480
[   18.958679]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.958712]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   18.958741]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   18.958778]  ? __kthread_parkme+0x82/0x180
[   18.958806]  ? preempt_count_sub+0x50/0x80
[   18.958863]  ? __pfx_kunit_try_run_case+0x10/0x10
[   18.958901]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.958934]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   18.958966]  kthread+0x337/0x6f0
[   18.958993]  ? trace_preempt_on+0x20/0xc0
[   18.959028]  ? __pfx_kthread+0x10/0x10
[   18.959058]  ? _raw_spin_unlock_irq+0x47/0x80
[   18.959092]  ? calculate_sigpending+0x7b/0xa0
[   18.959127]  ? __pfx_kthread+0x10/0x10
[   18.959156]  ret_from_fork+0x116/0x1d0
[   18.959181]  ? __pfx_kthread+0x10/0x10
[   18.959209]  ret_from_fork_asm+0x1a/0x30
[   18.959291]  </TASK>
[   18.959507] 
[   18.978812] Allocated by task 227:
[   18.979283]  kasan_save_stack+0x45/0x70
[   18.979721]  kasan_save_track+0x18/0x40
[   18.980029]  kasan_save_alloc_info+0x3b/0x50
[   18.980526]  __kasan_kmalloc+0xb7/0xc0
[   18.981167]  __kmalloc_cache_noprof+0x189/0x420
[   18.981529]  workqueue_uaf+0x152/0x560
[   18.982106]  kunit_try_run_case+0x1a5/0x480
[   18.982663]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.983031]  kthread+0x337/0x6f0
[   18.983582]  ret_from_fork+0x116/0x1d0
[   18.984025]  ret_from_fork_asm+0x1a/0x30
[   18.984592] 
[   18.984807] Freed by task 40:
[   18.985073]  kasan_save_stack+0x45/0x70
[   18.985609]  kasan_save_track+0x18/0x40
[   18.986010]  kasan_save_free_info+0x3f/0x60
[   18.986699]  __kasan_slab_free+0x56/0x70
[   18.987148]  kfree+0x222/0x3f0
[   18.987644]  workqueue_uaf_work+0x12/0x20
[   18.988011]  process_one_work+0x5ee/0xf60
[   18.988413]  worker_thread+0x758/0x1220
[   18.988714]  kthread+0x337/0x6f0
[   18.989392]  ret_from_fork+0x116/0x1d0
[   18.989848]  ret_from_fork_asm+0x1a/0x30
[   18.990348] 
[   18.990564] Last potentially related work creation:
[   18.991050]  kasan_save_stack+0x45/0x70
[   18.991715]  kasan_record_aux_stack+0xb2/0xc0
[   18.992198]  __queue_work+0x61a/0xe70
[   18.992687]  queue_work_on+0xb6/0xc0
[   18.992981]  workqueue_uaf+0x26d/0x560
[   18.993541]  kunit_try_run_case+0x1a5/0x480
[   18.993963]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   18.994589]  kthread+0x337/0x6f0
[   18.995006]  ret_from_fork+0x116/0x1d0
[   18.995561]  ret_from_fork_asm+0x1a/0x30
[   18.995910] 
[   18.996157] The buggy address belongs to the object at ffff888102a1a180
[   18.996157]  which belongs to the cache kmalloc-32 of size 32
[   18.997014] The buggy address is located 0 bytes inside of
[   18.997014]  freed 32-byte region [ffff888102a1a180, ffff888102a1a1a0)
[   18.998183] 
[   18.998522] The buggy address belongs to the physical page:
[   18.999046] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a1a
[   18.999743] flags: 0x200000000000000(node=0|zone=2)
[   19.000397] page_type: f5(slab)
[   19.000792] raw: 0200000000000000 ffff888100041780 dead000000000122 0000000000000000
[   19.001586] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   19.002154] page dumped because: kasan: bad access detected
[   19.003045] 
[   19.003347] Memory state around the buggy address:
[   19.003802]  ffff888102a1a080: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   19.004540]  ffff888102a1a100: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   19.005161] >ffff888102a1a180: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
[   19.005798]                    ^
[   19.006191]  ffff888102a1a200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.006898]  ffff888102a1a280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   19.007954] ==================================================================