Hay
Date
June 25, 2025, 8:08 a.m.

Environment
qemu-arm64
qemu-x86_64

[   26.945044] ==================================================================
[   26.945139] BUG: KASAN: slab-use-after-free in ksize_uaf+0x598/0x5f8
[   26.945206] Read of size 1 at addr fff00000c7895300 by task kunit_try_catch/208
[   26.945316] 
[   26.945358] CPU: 1 UID: 0 PID: 208 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT 
[   26.945453] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.945480] Hardware name: linux,dummy-virt (DT)
[   26.945512] Call trace:
[   26.945535]  show_stack+0x20/0x38 (C)
[   26.945593]  dump_stack_lvl+0x8c/0xd0
[   26.945643]  print_report+0x118/0x608
[   26.945690]  kasan_report+0xdc/0x128
[   26.945743]  __asan_report_load1_noabort+0x20/0x30
[   26.945791]  ksize_uaf+0x598/0x5f8
[   26.945831]  kunit_try_run_case+0x170/0x3f0
[   26.945878]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.945930]  kthread+0x328/0x630
[   26.945972]  ret_from_fork+0x10/0x20
[   26.946018] 
[   26.946037] Allocated by task 208:
[   26.946064]  kasan_save_stack+0x3c/0x68
[   26.946108]  kasan_save_track+0x20/0x40
[   26.946146]  kasan_save_alloc_info+0x40/0x58
[   26.946183]  __kasan_kmalloc+0xd4/0xd8
[   26.946220]  __kmalloc_cache_noprof+0x16c/0x3c0
[   26.946260]  ksize_uaf+0xb8/0x5f8
[   26.946294]  kunit_try_run_case+0x170/0x3f0
[   26.946332]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.946376]  kthread+0x328/0x630
[   26.946708]  ret_from_fork+0x10/0x20
[   26.946763] 
[   26.947037] Freed by task 208:
[   26.947072]  kasan_save_stack+0x3c/0x68
[   26.947137]  kasan_save_track+0x20/0x40
[   26.947297]  kasan_save_free_info+0x4c/0x78
[   26.947443]  __kasan_slab_free+0x6c/0x98
[   26.947496]  kfree+0x214/0x3c8
[   26.947531]  ksize_uaf+0x11c/0x5f8
[   26.947567]  kunit_try_run_case+0x170/0x3f0
[   26.947742]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.947820]  kthread+0x328/0x630
[   26.947855]  ret_from_fork+0x10/0x20
[   26.948035] 
[   26.948057] The buggy address belongs to the object at fff00000c7895300
[   26.948057]  which belongs to the cache kmalloc-128 of size 128
[   26.948117] The buggy address is located 0 bytes inside of
[   26.948117]  freed 128-byte region [fff00000c7895300, fff00000c7895380)
[   26.948543] 
[   26.948639] The buggy address belongs to the physical page:
[   26.948708] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107895
[   26.948827] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   26.948994] page_type: f5(slab)
[   26.949304] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   26.949486] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   26.949663] page dumped because: kasan: bad access detected
[   26.949772] 
[   26.949936] Memory state around the buggy address:
[   26.949987]  fff00000c7895200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.950418]  fff00000c7895280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.950530] >fff00000c7895300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.950649]                    ^
[   26.950795]  fff00000c7895380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.951014]  fff00000c7895400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.951307] ==================================================================
[   26.952751] ==================================================================
[   26.953063] BUG: KASAN: slab-use-after-free in ksize_uaf+0x544/0x5f8
[   26.953230] Read of size 1 at addr fff00000c7895378 by task kunit_try_catch/208
[   26.953415] 
[   26.953633] CPU: 1 UID: 0 PID: 208 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT 
[   26.953846] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.954024] Hardware name: linux,dummy-virt (DT)
[   26.954609] Call trace:
[   26.954723]  show_stack+0x20/0x38 (C)
[   26.954985]  dump_stack_lvl+0x8c/0xd0
[   26.955066]  print_report+0x118/0x608
[   26.955433]  kasan_report+0xdc/0x128
[   26.956017]  __asan_report_load1_noabort+0x20/0x30
[   26.956098]  ksize_uaf+0x544/0x5f8
[   26.956233]  kunit_try_run_case+0x170/0x3f0
[   26.956383]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.956519]  kthread+0x328/0x630
[   26.956571]  ret_from_fork+0x10/0x20
[   26.956625] 
[   26.956856] Allocated by task 208:
[   26.957187]  kasan_save_stack+0x3c/0x68
[   26.957411]  kasan_save_track+0x20/0x40
[   26.957619]  kasan_save_alloc_info+0x40/0x58
[   26.957764]  __kasan_kmalloc+0xd4/0xd8
[   26.957886]  __kmalloc_cache_noprof+0x16c/0x3c0
[   26.958002]  ksize_uaf+0xb8/0x5f8
[   26.958095]  kunit_try_run_case+0x170/0x3f0
[   26.958200]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.958412]  kthread+0x328/0x630
[   26.958519]  ret_from_fork+0x10/0x20
[   26.958666] 
[   26.958714] Freed by task 208:
[   26.958778]  kasan_save_stack+0x3c/0x68
[   26.958846]  kasan_save_track+0x20/0x40
[   26.958883]  kasan_save_free_info+0x4c/0x78
[   26.958920]  __kasan_slab_free+0x6c/0x98
[   26.958963]  kfree+0x214/0x3c8
[   26.959016]  ksize_uaf+0x11c/0x5f8
[   26.959060]  kunit_try_run_case+0x170/0x3f0
[   26.959104]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.959149]  kthread+0x328/0x630
[   26.959182]  ret_from_fork+0x10/0x20
[   26.959217] 
[   26.959237] The buggy address belongs to the object at fff00000c7895300
[   26.959237]  which belongs to the cache kmalloc-128 of size 128
[   26.959294] The buggy address is located 120 bytes inside of
[   26.959294]  freed 128-byte region [fff00000c7895300, fff00000c7895380)
[   26.959361] 
[   26.959382] The buggy address belongs to the physical page:
[   26.959853] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107895
[   26.959915] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   26.959962] page_type: f5(slab)
[   26.959998] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   26.960721] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   26.960929] page dumped because: kasan: bad access detected
[   26.960981] 
[   26.961124] Memory state around the buggy address:
[   26.961288]  fff00000c7895200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.961557]  fff00000c7895280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.961608] >fff00000c7895300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.961771]                                                                 ^
[   26.961863]  fff00000c7895380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.962044]  fff00000c7895400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.962138] ==================================================================
[   26.931716] ==================================================================
[   26.931961] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x5f8
[   26.932197] Read of size 1 at addr fff00000c7895300 by task kunit_try_catch/208
[   26.932670] 
[   26.932774] CPU: 1 UID: 0 PID: 208 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT 
[   26.933128] Tainted: [B]=BAD_PAGE, [N]=TEST
[   26.933367] Hardware name: linux,dummy-virt (DT)
[   26.933449] Call trace:
[   26.933621]  show_stack+0x20/0x38 (C)
[   26.933869]  dump_stack_lvl+0x8c/0xd0
[   26.933955]  print_report+0x118/0x608
[   26.934012]  kasan_report+0xdc/0x128
[   26.934071]  __kasan_check_byte+0x54/0x70
[   26.934120]  ksize+0x30/0x88
[   26.934164]  ksize_uaf+0x168/0x5f8
[   26.934218]  kunit_try_run_case+0x170/0x3f0
[   26.934268]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.934321]  kthread+0x328/0x630
[   26.934373]  ret_from_fork+0x10/0x20
[   26.934448] 
[   26.934469] Allocated by task 208:
[   26.934513]  kasan_save_stack+0x3c/0x68
[   26.935152]  kasan_save_track+0x20/0x40
[   26.935229]  kasan_save_alloc_info+0x40/0x58
[   26.935443]  __kasan_kmalloc+0xd4/0xd8
[   26.935599]  __kmalloc_cache_noprof+0x16c/0x3c0
[   26.935829]  ksize_uaf+0xb8/0x5f8
[   26.936157]  kunit_try_run_case+0x170/0x3f0
[   26.936381]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.936770]  kthread+0x328/0x630
[   26.936871]  ret_from_fork+0x10/0x20
[   26.936976] 
[   26.937066] Freed by task 208:
[   26.937097]  kasan_save_stack+0x3c/0x68
[   26.937391]  kasan_save_track+0x20/0x40
[   26.937688]  kasan_save_free_info+0x4c/0x78
[   26.937843]  __kasan_slab_free+0x6c/0x98
[   26.938006]  kfree+0x214/0x3c8
[   26.938103]  ksize_uaf+0x11c/0x5f8
[   26.938311]  kunit_try_run_case+0x170/0x3f0
[   26.938553]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   26.938790]  kthread+0x328/0x630
[   26.938959]  ret_from_fork+0x10/0x20
[   26.939058] 
[   26.939079] The buggy address belongs to the object at fff00000c7895300
[   26.939079]  which belongs to the cache kmalloc-128 of size 128
[   26.939326] The buggy address is located 0 bytes inside of
[   26.939326]  freed 128-byte region [fff00000c7895300, fff00000c7895380)
[   26.939642] 
[   26.939730] The buggy address belongs to the physical page:
[   26.939899] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107895
[   26.939955] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   26.940013] page_type: f5(slab)
[   26.940053] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   26.940418] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   26.940495] page dumped because: kasan: bad access detected
[   26.940673] 
[   26.940919] Memory state around the buggy address:
[   26.941107]  fff00000c7895200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.941292]  fff00000c7895280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.941366] >fff00000c7895300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   26.941623]                    ^
[   26.941823]  fff00000c7895380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.941983]  fff00000c7895400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   26.942089] ==================================================================

[   22.358165] ==================================================================
[   22.359072] BUG: KASAN: slab-use-after-free in ksize_uaf+0x19d/0x6c0
[   22.359366] Read of size 1 at addr ffff8881039c3700 by task kunit_try_catch/225
[   22.359739] 
[   22.359828] CPU: 1 UID: 0 PID: 225 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) 
[   22.359880] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.359892] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.359913] Call Trace:
[   22.359926]  <TASK>
[   22.359954]  dump_stack_lvl+0x73/0xb0
[   22.359992]  print_report+0xd1/0x650
[   22.360013]  ? __virt_addr_valid+0x1db/0x2d0
[   22.360036]  ? ksize_uaf+0x19d/0x6c0
[   22.360054]  ? kasan_complete_mode_report_info+0x64/0x200
[   22.360078]  ? ksize_uaf+0x19d/0x6c0
[   22.360097]  kasan_report+0x141/0x180
[   22.360129]  ? ksize_uaf+0x19d/0x6c0
[   22.360159]  ? ksize_uaf+0x19d/0x6c0
[   22.360178]  __kasan_check_byte+0x3d/0x50
[   22.360209]  ksize+0x20/0x60
[   22.360232]  ksize_uaf+0x19d/0x6c0
[   22.360259]  ? __pfx_ksize_uaf+0x10/0x10
[   22.360278]  ? __schedule+0x10cc/0x2b60
[   22.360302]  ? __pfx_read_tsc+0x10/0x10
[   22.360339]  ? ktime_get_ts64+0x86/0x230
[   22.360364]  kunit_try_run_case+0x1a5/0x480
[   22.360395]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.360416]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.360561]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.360592]  ? __kthread_parkme+0x82/0x180
[   22.360612]  ? preempt_count_sub+0x50/0x80
[   22.360640]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.360662]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.360684]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.360705]  kthread+0x337/0x6f0
[   22.360723]  ? trace_preempt_on+0x20/0xc0
[   22.360745]  ? __pfx_kthread+0x10/0x10
[   22.360763]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.360784]  ? calculate_sigpending+0x7b/0xa0
[   22.360806]  ? __pfx_kthread+0x10/0x10
[   22.360826]  ret_from_fork+0x116/0x1d0
[   22.360843]  ? __pfx_kthread+0x10/0x10
[   22.360862]  ret_from_fork_asm+0x1a/0x30
[   22.360890]  </TASK>
[   22.360901] 
[   22.369242] Allocated by task 225:
[   22.369400]  kasan_save_stack+0x45/0x70
[   22.369592]  kasan_save_track+0x18/0x40
[   22.369829]  kasan_save_alloc_info+0x3b/0x50
[   22.370219]  __kasan_kmalloc+0xb7/0xc0
[   22.370369]  __kmalloc_cache_noprof+0x189/0x420
[   22.370515]  ksize_uaf+0xaa/0x6c0
[   22.370627]  kunit_try_run_case+0x1a5/0x480
[   22.370819]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.371081]  kthread+0x337/0x6f0
[   22.371246]  ret_from_fork+0x116/0x1d0
[   22.371444]  ret_from_fork_asm+0x1a/0x30
[   22.371604] 
[   22.371704] Freed by task 225:
[   22.371884]  kasan_save_stack+0x45/0x70
[   22.372073]  kasan_save_track+0x18/0x40
[   22.372335]  kasan_save_free_info+0x3f/0x60
[   22.372514]  __kasan_slab_free+0x56/0x70
[   22.372704]  kfree+0x222/0x3f0
[   22.372883]  ksize_uaf+0x12c/0x6c0
[   22.373228]  kunit_try_run_case+0x1a5/0x480
[   22.373433]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.373664]  kthread+0x337/0x6f0
[   22.373856]  ret_from_fork+0x116/0x1d0
[   22.374026]  ret_from_fork_asm+0x1a/0x30
[   22.374258] 
[   22.374325] The buggy address belongs to the object at ffff8881039c3700
[   22.374325]  which belongs to the cache kmalloc-128 of size 128
[   22.374666] The buggy address is located 0 bytes inside of
[   22.374666]  freed 128-byte region [ffff8881039c3700, ffff8881039c3780)
[   22.375316] 
[   22.375419] The buggy address belongs to the physical page:
[   22.375706] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c3
[   22.376182] flags: 0x200000000000000(node=0|zone=2)
[   22.376354] page_type: f5(slab)
[   22.376467] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.376716] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.377360] page dumped because: kasan: bad access detected
[   22.377610] 
[   22.377677] Memory state around the buggy address:
[   22.377876]  ffff8881039c3600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.378198]  ffff8881039c3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.378522] >ffff8881039c3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.378809]                    ^
[   22.379015]  ffff8881039c3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.379392]  ffff8881039c3800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.379595] ==================================================================
[   22.380174] ==================================================================
[   22.380750] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5fe/0x6c0
[   22.381293] Read of size 1 at addr ffff8881039c3700 by task kunit_try_catch/225
[   22.381541] 
[   22.381655] CPU: 1 UID: 0 PID: 225 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) 
[   22.381697] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.381709] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.381740] Call Trace:
[   22.381753]  <TASK>
[   22.381768]  dump_stack_lvl+0x73/0xb0
[   22.381791]  print_report+0xd1/0x650
[   22.381810]  ? __virt_addr_valid+0x1db/0x2d0
[   22.381882]  ? ksize_uaf+0x5fe/0x6c0
[   22.381914]  ? kasan_complete_mode_report_info+0x64/0x200
[   22.381947]  ? ksize_uaf+0x5fe/0x6c0
[   22.381968]  kasan_report+0x141/0x180
[   22.381988]  ? ksize_uaf+0x5fe/0x6c0
[   22.382011]  __asan_report_load1_noabort+0x18/0x20
[   22.382042]  ksize_uaf+0x5fe/0x6c0
[   22.382060]  ? __pfx_ksize_uaf+0x10/0x10
[   22.382079]  ? __schedule+0x10cc/0x2b60
[   22.382112]  ? __pfx_read_tsc+0x10/0x10
[   22.382133]  ? ktime_get_ts64+0x86/0x230
[   22.382155]  kunit_try_run_case+0x1a5/0x480
[   22.382179]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.382201]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.382230]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.382253]  ? __kthread_parkme+0x82/0x180
[   22.382271]  ? preempt_count_sub+0x50/0x80
[   22.382303]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.382325]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.382347]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.382377]  kthread+0x337/0x6f0
[   22.382395]  ? trace_preempt_on+0x20/0xc0
[   22.382415]  ? __pfx_kthread+0x10/0x10
[   22.382436]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.382467]  ? calculate_sigpending+0x7b/0xa0
[   22.382489]  ? __pfx_kthread+0x10/0x10
[   22.382508]  ret_from_fork+0x116/0x1d0
[   22.382534]  ? __pfx_kthread+0x10/0x10
[   22.382553]  ret_from_fork_asm+0x1a/0x30
[   22.382581]  </TASK>
[   22.382590] 
[   22.390496] Allocated by task 225:
[   22.390650]  kasan_save_stack+0x45/0x70
[   22.390845]  kasan_save_track+0x18/0x40
[   22.391025]  kasan_save_alloc_info+0x3b/0x50
[   22.391289]  __kasan_kmalloc+0xb7/0xc0
[   22.391451]  __kmalloc_cache_noprof+0x189/0x420
[   22.391675]  ksize_uaf+0xaa/0x6c0
[   22.391793]  kunit_try_run_case+0x1a5/0x480
[   22.392102]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.392359]  kthread+0x337/0x6f0
[   22.392546]  ret_from_fork+0x116/0x1d0
[   22.392725]  ret_from_fork_asm+0x1a/0x30
[   22.392977] 
[   22.393097] Freed by task 225:
[   22.393361]  kasan_save_stack+0x45/0x70
[   22.393566]  kasan_save_track+0x18/0x40
[   22.393763]  kasan_save_free_info+0x3f/0x60
[   22.393999]  __kasan_slab_free+0x56/0x70
[   22.394270]  kfree+0x222/0x3f0
[   22.394390]  ksize_uaf+0x12c/0x6c0
[   22.394502]  kunit_try_run_case+0x1a5/0x480
[   22.394634]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.394793]  kthread+0x337/0x6f0
[   22.395155]  ret_from_fork+0x116/0x1d0
[   22.395372]  ret_from_fork_asm+0x1a/0x30
[   22.395605] 
[   22.395692] The buggy address belongs to the object at ffff8881039c3700
[   22.395692]  which belongs to the cache kmalloc-128 of size 128
[   22.396267] The buggy address is located 0 bytes inside of
[   22.396267]  freed 128-byte region [ffff8881039c3700, ffff8881039c3780)
[   22.396594] 
[   22.396655] The buggy address belongs to the physical page:
[   22.396813] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c3
[   22.397191] flags: 0x200000000000000(node=0|zone=2)
[   22.397506] page_type: f5(slab)
[   22.397845] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.398389] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.398712] page dumped because: kasan: bad access detected
[   22.399064] 
[   22.399138] Memory state around the buggy address:
[   22.399383]  ffff8881039c3600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.399656]  ffff8881039c3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.399912] >ffff8881039c3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.400431]                    ^
[   22.400667]  ffff8881039c3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.401007]  ffff8881039c3800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.401232] ==================================================================
[   22.402223] ==================================================================
[   22.402588] BUG: KASAN: slab-use-after-free in ksize_uaf+0x5e4/0x6c0
[   22.402987] Read of size 1 at addr ffff8881039c3778 by task kunit_try_catch/225
[   22.403386] 
[   22.403469] CPU: 1 UID: 0 PID: 225 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) 
[   22.403512] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.403524] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   22.403544] Call Trace:
[   22.403558]  <TASK>
[   22.403571]  dump_stack_lvl+0x73/0xb0
[   22.403594]  print_report+0xd1/0x650
[   22.403613]  ? __virt_addr_valid+0x1db/0x2d0
[   22.403633]  ? ksize_uaf+0x5e4/0x6c0
[   22.403651]  ? kasan_complete_mode_report_info+0x64/0x200
[   22.403675]  ? ksize_uaf+0x5e4/0x6c0
[   22.403693]  kasan_report+0x141/0x180
[   22.403713]  ? ksize_uaf+0x5e4/0x6c0
[   22.403735]  __asan_report_load1_noabort+0x18/0x20
[   22.403757]  ksize_uaf+0x5e4/0x6c0
[   22.403775]  ? __pfx_ksize_uaf+0x10/0x10
[   22.403794]  ? __schedule+0x10cc/0x2b60
[   22.403817]  ? __pfx_read_tsc+0x10/0x10
[   22.403837]  ? ktime_get_ts64+0x86/0x230
[   22.403860]  kunit_try_run_case+0x1a5/0x480
[   22.403883]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.403987]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   22.404007]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   22.404030]  ? __kthread_parkme+0x82/0x180
[   22.404060]  ? preempt_count_sub+0x50/0x80
[   22.404081]  ? __pfx_kunit_try_run_case+0x10/0x10
[   22.404103]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.404125]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   22.404147]  kthread+0x337/0x6f0
[   22.404165]  ? trace_preempt_on+0x20/0xc0
[   22.404186]  ? __pfx_kthread+0x10/0x10
[   22.404204]  ? _raw_spin_unlock_irq+0x47/0x80
[   22.404226]  ? calculate_sigpending+0x7b/0xa0
[   22.404247]  ? __pfx_kthread+0x10/0x10
[   22.404267]  ret_from_fork+0x116/0x1d0
[   22.404284]  ? __pfx_kthread+0x10/0x10
[   22.404302]  ret_from_fork_asm+0x1a/0x30
[   22.404335]  </TASK>
[   22.404345] 
[   22.412917] Allocated by task 225:
[   22.413054]  kasan_save_stack+0x45/0x70
[   22.413182]  kasan_save_track+0x18/0x40
[   22.413303]  kasan_save_alloc_info+0x3b/0x50
[   22.413497]  __kasan_kmalloc+0xb7/0xc0
[   22.413683]  __kmalloc_cache_noprof+0x189/0x420
[   22.413889]  ksize_uaf+0xaa/0x6c0
[   22.414057]  kunit_try_run_case+0x1a5/0x480
[   22.414300]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.414620]  kthread+0x337/0x6f0
[   22.414769]  ret_from_fork+0x116/0x1d0
[   22.415016]  ret_from_fork_asm+0x1a/0x30
[   22.415191] 
[   22.415293] Freed by task 225:
[   22.415441]  kasan_save_stack+0x45/0x70
[   22.415682]  kasan_save_track+0x18/0x40
[   22.415885]  kasan_save_free_info+0x3f/0x60
[   22.416178]  __kasan_slab_free+0x56/0x70
[   22.416392]  kfree+0x222/0x3f0
[   22.416547]  ksize_uaf+0x12c/0x6c0
[   22.416723]  kunit_try_run_case+0x1a5/0x480
[   22.416926]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   22.417188]  kthread+0x337/0x6f0
[   22.417375]  ret_from_fork+0x116/0x1d0
[   22.417716]  ret_from_fork_asm+0x1a/0x30
[   22.418062] 
[   22.418247] The buggy address belongs to the object at ffff8881039c3700
[   22.418247]  which belongs to the cache kmalloc-128 of size 128
[   22.418746] The buggy address is located 120 bytes inside of
[   22.418746]  freed 128-byte region [ffff8881039c3700, ffff8881039c3780)
[   22.419304] 
[   22.419491] The buggy address belongs to the physical page:
[   22.419837] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c3
[   22.420109] flags: 0x200000000000000(node=0|zone=2)
[   22.420258] page_type: f5(slab)
[   22.420375] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   22.420828] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.421209] page dumped because: kasan: bad access detected
[   22.421597] 
[   22.421764] Memory state around the buggy address:
[   22.422133]  ffff8881039c3600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.422440]  ffff8881039c3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.422647] >ffff8881039c3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.422857]                                                                 ^
[   22.423388]  ffff8881039c3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.423773]  ffff8881039c3800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.424346] ==================================================================