[  159.816418] ==================================================================
[  159.816751] BUG: KASAN: slab-use-after-free in drm_encoder_cleanup+0x265/0x270
[  159.817282] Read of size 8 at addr ffff888107ecf870 by task kunit_try_catch/1678
[  159.817563] 
[  159.817689] CPU: 0 UID: 0 PID: 1678 Comm: kunit_try_catch Tainted: G    B D W        N  6.16.0-rc3-next-20250623 #1 PREEMPT(voluntary) 
[  159.817743] Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN, [N]=TEST
[  159.817756] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  159.817776] Call Trace:
[  159.817800]  <TASK>
[  159.817833]  dump_stack_lvl+0x73/0xb0
[  159.817886]  print_report+0xd1/0x650
[  159.817925]  ? __virt_addr_valid+0x1db/0x2d0
[  159.817977]  ? drm_encoder_cleanup+0x265/0x270
[  159.818014]  ? kasan_complete_mode_report_info+0x64/0x200
[  159.818053]  ? drm_encoder_cleanup+0x265/0x270
[  159.818091]  kasan_report+0x141/0x180
[  159.818129]  ? drm_encoder_cleanup+0x265/0x270
[  159.818175]  __asan_report_load8_noabort+0x18/0x20
[  159.818215]  drm_encoder_cleanup+0x265/0x270
[  159.818256]  drmm_encoder_alloc_release+0x36/0x60
[  159.818297]  drm_managed_release+0x15c/0x470
[  159.818354]  ? simple_release_fs+0x86/0xb0
[  159.818409]  drm_dev_put.part.0+0xa1/0x100
[  159.818439]  ? __pfx_devm_drm_dev_init_release+0x10/0x10
[  159.818462]  devm_drm_dev_init_release+0x17/0x30
[  159.818483]  devm_action_release+0x50/0x80
[  159.818508]  devres_release_all+0x186/0x240
[  159.818529]  ? __pfx_devres_release_all+0x10/0x10
[  159.818548]  ? kernfs_remove_by_name_ns+0x166/0x1d0
[  159.818584]  ? sysfs_remove_file_ns+0x56/0xa0
[  159.818620]  device_unbind_cleanup+0x1b/0x1b0
[  159.818651]  device_release_driver_internal+0x3e4/0x540
[  159.818682]  ? klist_devices_put+0x35/0x50
[  159.818726]  device_release_driver+0x16/0x20
[  159.818763]  bus_remove_device+0x1e9/0x3d0
[  159.818803]  device_del+0x397/0x980
[  159.818849]  ? __pfx_device_del+0x10/0x10
[  159.818889]  ? __kasan_check_write+0x18/0x20
[  159.818932]  ? _raw_spin_lock_irqsave+0xa1/0x100
[  159.818976]  ? __pfx_device_unregister_wrapper+0x10/0x10
[  159.819025]  device_unregister+0x1b/0xa0
[  159.819062]  device_unregister_wrapper+0x12/0x20
[  159.819105]  __kunit_action_free+0x57/0x70
[  159.819128]  kunit_remove_resource+0x133/0x200
[  159.819147]  ? preempt_count_sub+0x50/0x80
[  159.819169]  kunit_cleanup+0x7a/0x120
[  159.819191]  kunit_try_run_case_cleanup+0xbd/0xf0
[  159.819211]  ? __pfx_kunit_try_run_case_cleanup+0x10/0x10
[  159.819230]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  159.819249]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[  159.819267]  kthread+0x337/0x6f0
[  159.819287]  ? trace_preempt_on+0x20/0xc0
[  159.819309]  ? __pfx_kthread+0x10/0x10
[  159.819343]  ? _raw_spin_unlock_irq+0x47/0x80
[  159.819364]  ? calculate_sigpending+0x7b/0xa0
[  159.819386]  ? __pfx_kthread+0x10/0x10
[  159.819404]  ret_from_fork+0x116/0x1d0
[  159.819423]  ? __pfx_kthread+0x10/0x10
[  159.819441]  ret_from_fork_asm+0x1a/0x30
[  159.819471]  </TASK>
[  159.819484] 
[  159.834193] Allocated by task 1677:
[  159.834402]  kasan_save_stack+0x45/0x70
[  159.834626]  kasan_save_track+0x18/0x40
[  159.835167]  kasan_save_alloc_info+0x3b/0x50
[  159.835544]  __kasan_kmalloc+0xb7/0xc0
[  159.835741]  __kmalloc_noprof+0x1c9/0x500
[  159.836039]  __devm_drm_bridge_alloc+0x33/0x170
[  159.836578]  drm_test_bridge_init+0x188/0x5c0
[  159.836827]  drm_test_drm_bridge_get_current_state_atomic+0xea/0x870
[  159.837154]  kunit_try_run_case+0x1a5/0x480
[  159.837318]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  159.837658]  kthread+0x337/0x6f0
[  159.837860]  ret_from_fork+0x116/0x1d0
[  159.838179]  ret_from_fork_asm+0x1a/0x30
[  159.838491] 
[  159.838581] Freed by task 1678:
[  159.838834]  kasan_save_stack+0x45/0x70
[  159.839427]  kasan_save_track+0x18/0x40
[  159.839880]  kasan_save_free_info+0x3f/0x60
[  159.840042]  __kasan_slab_free+0x56/0x70
[  159.840528]  kfree+0x222/0x3f0
[  159.840808]  drm_bridge_put.part.0+0xc7/0x100
[  159.841070]  drm_bridge_put_void+0x17/0x30
[  159.841226]  devm_action_release+0x50/0x80
[  159.841387]  devres_release_all+0x186/0x240
[  159.841681]  device_unbind_cleanup+0x1b/0x1b0
[  159.841987]  device_release_driver_internal+0x3e4/0x540
[  159.842215]  device_release_driver+0x16/0x20
[  159.842381]  bus_remove_device+0x1e9/0x3d0
[  159.842565]  device_del+0x397/0x980
[  159.842833]  device_unregister+0x1b/0xa0
[  159.843061]  device_unregister_wrapper+0x12/0x20
[  159.843312]  __kunit_action_free+0x57/0x70
[  159.843487]  kunit_remove_resource+0x133/0x200
[  159.843725]  kunit_cleanup+0x7a/0x120
[  159.843871]  kunit_try_run_case_cleanup+0xbd/0xf0
[  159.844192]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[  159.844558]  kthread+0x337/0x6f0
[  159.844697]  ret_from_fork+0x116/0x1d0
[  159.844869]  ret_from_fork_asm+0x1a/0x30
[  159.845145] 
[  159.845267] The buggy address belongs to the object at ffff888107ecf800
[  159.845267]  which belongs to the cache kmalloc-512 of size 512
[  159.846014] The buggy address is located 112 bytes inside of
[  159.846014]  freed 512-byte region [ffff888107ecf800, ffff888107ecfa00)
[  159.846406] 
[  159.846512] The buggy address belongs to the physical page:
[  159.846814] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107ecc
[  159.847342] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  159.847657] flags: 0x200000000000040(head|node=0|zone=2)
[  159.847884] page_type: f5(slab)
[  159.848080] raw: 0200000000000040 ffff888100041c80 dead000000000122 0000000000000000
[  159.848536] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[  159.849028] head: 0200000000000040 ffff888100041c80 dead000000000122 0000000000000000
[  159.849416] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[  159.849719] head: 0200000000000002 ffffea00041fb301 00000000ffffffff 00000000ffffffff
[  159.850122] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  159.850431] page dumped because: kasan: bad access detected
[  159.850810] 
[  159.850948] Memory state around the buggy address:
[  159.851147]  ffff888107ecf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  159.851373]  ffff888107ecf780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  159.851715] >ffff888107ecf800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  159.852217]                                                              ^
[  159.852647]  ffff888107ecf880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  159.852949]  ffff888107ecf900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  159.853212] ==================================================================