[  181.088800] ==================================================================
[  181.089460] BUG: KASAN: slab-use-after-free in drm_encoder_cleanup+0x265/0x270
[  181.089762] Read of size 8 at addr ffff888105b27470 by task kunit_try_catch/1610
[  181.091036] 
[  181.091459] CPU: 1 UID: 0 PID: 1610 Comm: kunit_try_catch Tainted: G    B D W        N  6.16.0-rc2-next-20250619 #1 PREEMPT(voluntary) 
[  181.091716] Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN, [N]=TEST
[  181.091736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  181.091757] Call Trace:
[  181.091777]  <TASK>
[  181.091806]  dump_stack_lvl+0x73/0xb0
[  181.091862]  print_report+0xd1/0x650
[  181.091905]  ? __virt_addr_valid+0x1db/0x2d0
[  181.091934]  ? drm_encoder_cleanup+0x265/0x270
[  181.091959]  ? kasan_complete_mode_report_info+0x64/0x200
[  181.091985]  ? drm_encoder_cleanup+0x265/0x270
[  181.092009]  kasan_report+0x141/0x180
[  181.092032]  ? drm_encoder_cleanup+0x265/0x270
[  181.092060]  __asan_report_load8_noabort+0x18/0x20
[  181.092136]  drm_encoder_cleanup+0x265/0x270
[  181.092163]  drmm_encoder_alloc_release+0x36/0x60
[  181.092187]  drm_managed_release+0x15c/0x470
[  181.092211]  ? simple_release_fs+0x86/0xb0
[  181.092239]  drm_dev_put.part.0+0xa1/0x100
[  181.092263]  ? __pfx_devm_drm_dev_init_release+0x10/0x10
[  181.092288]  devm_drm_dev_init_release+0x17/0x30
[  181.092311]  devm_action_release+0x50/0x80
[  181.092340]  devres_release_all+0x186/0x240
[  181.092366]  ? __pfx_devres_release_all+0x10/0x10
[  181.092388]  ? kernfs_remove_by_name_ns+0x166/0x1d0
[  181.092416]  ? sysfs_remove_file_ns+0x56/0xa0
[  181.092441]  device_unbind_cleanup+0x1b/0x1b0
[  181.092465]  device_release_driver_internal+0x3e4/0x540
[  181.092488]  ? klist_devices_put+0x35/0x50
[  181.092511]  device_release_driver+0x16/0x20
[  181.092534]  bus_remove_device+0x1e9/0x3d0
[  181.092557]  device_del+0x397/0x980
[  181.092583]  ? __pfx_device_del+0x10/0x10
[  181.092606]  ? __kasan_check_write+0x18/0x20
[  181.092629]  ? _raw_spin_lock_irqsave+0xa1/0x100
[  181.092653]  ? __pfx_device_unregister_wrapper+0x10/0x10
[  181.092680]  device_unregister+0x1b/0xa0
[  181.092702]  device_unregister_wrapper+0x12/0x20
[  181.092724]  __kunit_action_free+0x57/0x70
[  181.092749]  kunit_remove_resource+0x133/0x200
[  181.092771]  ? preempt_count_sub+0x50/0x80
[  181.092797]  kunit_cleanup+0x7a/0x120
[  181.092823]  kunit_try_run_case_cleanup+0xbd/0xf0
[  181.092847]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
[  181.092877]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  181.092911]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[  181.092933]  kthread+0x337/0x6f0
[  181.092957]  ? trace_preempt_on+0x20/0xc0
[  181.092984]  ? __pfx_kthread+0x10/0x10
[  181.093006]  ? _raw_spin_unlock_irq+0x47/0x80
[  181.093028]  ? calculate_sigpending+0x7b/0xa0
[  181.093053]  ? __pfx_kthread+0x10/0x10
[  181.093088]  ret_from_fork+0x116/0x1d0
[  181.093113]  ? __pfx_kthread+0x10/0x10
[  181.093134]  ret_from_fork_asm+0x1a/0x30
[  181.093168]  </TASK>
[  181.093184] 
[  181.111650] Allocated by task 1609:
[  181.112114]  kasan_save_stack+0x45/0x70
[  181.112528]  kasan_save_track+0x18/0x40
[  181.112919]  kasan_save_alloc_info+0x3b/0x50
[  181.113327]  __kasan_kmalloc+0xb7/0xc0
[  181.113503]  __kmalloc_noprof+0x1c9/0x500
[  181.113726]  __devm_drm_bridge_alloc+0x33/0x170
[  181.114013]  drm_test_bridge_init+0x188/0x5c0
[  181.114393]  drm_test_drm_bridge_get_current_state_atomic+0xea/0x870
[  181.114808]  kunit_try_run_case+0x1a5/0x480
[  181.115126]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  181.115546]  kthread+0x337/0x6f0
[  181.115746]  ret_from_fork+0x116/0x1d0
[  181.116127]  ret_from_fork_asm+0x1a/0x30
[  181.116369] 
[  181.116531] Freed by task 1610:
[  181.116685]  kasan_save_stack+0x45/0x70
[  181.116930]  kasan_save_track+0x18/0x40
[  181.117307]  kasan_save_free_info+0x3f/0x60
[  181.117658]  __kasan_slab_free+0x56/0x70
[  181.118021]  kfree+0x222/0x3f0
[  181.118327]  drm_bridge_put.part.0+0xc7/0x100
[  181.118599]  drm_bridge_put_void+0x17/0x30
[  181.118836]  devm_action_release+0x50/0x80
[  181.119240]  devres_release_all+0x186/0x240
[  181.119518]  device_unbind_cleanup+0x1b/0x1b0
[  181.119762]  device_release_driver_internal+0x3e4/0x540
[  181.119990]  device_release_driver+0x16/0x20
[  181.120193]  bus_remove_device+0x1e9/0x3d0
[  181.120587]  device_del+0x397/0x980
[  181.120933]  device_unregister+0x1b/0xa0
[  181.121271]  device_unregister_wrapper+0x12/0x20
[  181.121658]  __kunit_action_free+0x57/0x70
[  181.122016]  kunit_remove_resource+0x133/0x200
[  181.122394]  kunit_cleanup+0x7a/0x120
[  181.122610]  kunit_try_run_case_cleanup+0xbd/0xf0
[  181.122970]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  181.123332]  kthread+0x337/0x6f0
[  181.123629]  ret_from_fork+0x116/0x1d0
[  181.123917]  ret_from_fork_asm+0x1a/0x30
[  181.124160] 
[  181.124338] The buggy address belongs to the object at ffff888105b27400
[  181.124338]  which belongs to the cache kmalloc-512 of size 512
[  181.124814] The buggy address is located 112 bytes inside of
[  181.124814]  freed 512-byte region [ffff888105b27400, ffff888105b27600)
[  181.125506] 
[  181.125694] The buggy address belongs to the physical page:
[  181.126180] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105b24
[  181.126683] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  181.127182] anon flags: 0x200000000000040(head|node=0|zone=2)
[  181.127602] page_type: f5(slab)
[  181.127780] raw: 0200000000000040 ffff888100041c80 0000000000000000 0000000000000001
[  181.128366] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[  181.128812] head: 0200000000000040 ffff888100041c80 0000000000000000 0000000000000001
[  181.129281] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[  181.129686] head: 0200000000000002 ffffea000416c901 00000000ffffffff 00000000ffffffff
[  181.129995] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  181.130280] page dumped because: kasan: bad access detected
[  181.130722] 
[  181.130928] Memory state around the buggy address:
[  181.131336]  ffff888105b27300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.131893]  ffff888105b27380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  181.132285] >ffff888105b27400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  181.132675]                                                              ^
[  181.133079]  ffff888105b27480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  181.133580]  ffff888105b27500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  181.133967] ==================================================================