[   32.669449] ==================================================================
[   32.669516] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   32.669568] Read of size 1 at addr fff00000c57889a8 by task kunit_try_catch/215
[   32.669617] 
[   32.669646] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   32.669761] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.669790] Hardware name: linux,dummy-virt (DT)
[   32.669822] Call trace:
[   32.669845]  show_stack+0x20/0x38 (C)
[   32.669893]  dump_stack_lvl+0x8c/0xd0
[   32.669941]  print_report+0x118/0x608
[   32.669989]  kasan_report+0xdc/0x128
[   32.670036]  __asan_report_load1_noabort+0x20/0x30
[   32.670085]  kmalloc_uaf+0x300/0x338
[   32.670134]  kunit_try_run_case+0x170/0x3f0
[   32.670197]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.670251]  kthread+0x328/0x630
[   32.670524]  ret_from_fork+0x10/0x20
[   32.670742] 
[   32.670787] Allocated by task 215:
[   32.670817]  kasan_save_stack+0x3c/0x68
[   32.670875]  kasan_save_track+0x20/0x40
[   32.670915]  kasan_save_alloc_info+0x40/0x58
[   32.670962]  __kasan_kmalloc+0xd4/0xd8
[   32.671010]  __kmalloc_cache_noprof+0x16c/0x3c0
[   32.671073]  kmalloc_uaf+0xb8/0x338
[   32.671300]  kunit_try_run_case+0x170/0x3f0
[   32.671344]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.671389]  kthread+0x328/0x630
[   32.671461]  ret_from_fork+0x10/0x20
[   32.671524] 
[   32.671574] Freed by task 215:
[   32.671654]  kasan_save_stack+0x3c/0x68
[   32.671712]  kasan_save_track+0x20/0x40
[   32.671780]  kasan_save_free_info+0x4c/0x78
[   32.671874]  __kasan_slab_free+0x6c/0x98
[   32.671941]  kfree+0x214/0x3c8
[   32.671986]  kmalloc_uaf+0x11c/0x338
[   32.672021]  kunit_try_run_case+0x170/0x3f0
[   32.672060]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.672104]  kthread+0x328/0x630
[   32.672138]  ret_from_fork+0x10/0x20
[   32.672185] 
[   32.672474] The buggy address belongs to the object at fff00000c57889a0
[   32.672474]  which belongs to the cache kmalloc-16 of size 16
[   32.672571] The buggy address is located 8 bytes inside of
[   32.672571]  freed 16-byte region [fff00000c57889a0, fff00000c57889b0)
[   32.672849] 
[   32.672917] The buggy address belongs to the physical page:
[   32.672970] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105788
[   32.673037] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.673122] page_type: f5(slab)
[   32.673180] raw: 0bfffe0000000000 fff00000c0001640 dead000000000100 dead000000000122
[   32.673250] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   32.673329] page dumped because: kasan: bad access detected
[   32.673397] 
[   32.673477] Memory state around the buggy address:
[   32.673544]  fff00000c5788880: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   32.673613]  fff00000c5788900: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   32.673694] >fff00000c5788980: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   32.673750]                                   ^
[   32.673805]  fff00000c5788a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.673878]  fff00000c5788a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.673946] ==================================================================

[   23.287529] ==================================================================
[   23.288282] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380
[   23.288920] Read of size 1 at addr ffff8881048b63a8 by task kunit_try_catch/232
[   23.289618] 
[   23.289876] CPU: 1 UID: 0 PID: 232 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.289926] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.289939] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.289959] Call Trace:
[   23.289972]  <TASK>
[   23.289987]  dump_stack_lvl+0x73/0xb0
[   23.290014]  print_report+0xd1/0x650
[   23.290036]  ? __virt_addr_valid+0x1db/0x2d0
[   23.290073]  ? kmalloc_uaf+0x320/0x380
[   23.290092]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.290117]  ? kmalloc_uaf+0x320/0x380
[   23.290136]  kasan_report+0x141/0x180
[   23.290157]  ? kmalloc_uaf+0x320/0x380
[   23.290180]  __asan_report_load1_noabort+0x18/0x20
[   23.290203]  kmalloc_uaf+0x320/0x380
[   23.290223]  ? __pfx_kmalloc_uaf+0x10/0x10
[   23.290242]  ? __schedule+0x10cc/0x2b60
[   23.290262]  ? __pfx_read_tsc+0x10/0x10
[   23.290283]  ? ktime_get_ts64+0x86/0x230
[   23.290316]  kunit_try_run_case+0x1a5/0x480
[   23.290341]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.290364]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.290384]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.290405]  ? __kthread_parkme+0x82/0x180
[   23.290424]  ? preempt_count_sub+0x50/0x80
[   23.290449]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.290472]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.290501]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.290525]  kthread+0x337/0x6f0
[   23.290544]  ? trace_preempt_on+0x20/0xc0
[   23.290566]  ? __pfx_kthread+0x10/0x10
[   23.290586]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.290609]  ? calculate_sigpending+0x7b/0xa0
[   23.290631]  ? __pfx_kthread+0x10/0x10
[   23.290652]  ret_from_fork+0x116/0x1d0
[   23.290670]  ? __pfx_kthread+0x10/0x10
[   23.290690]  ret_from_fork_asm+0x1a/0x30
[   23.290719]  </TASK>
[   23.290730] 
[   23.302448] Allocated by task 232:
[   23.302585]  kasan_save_stack+0x45/0x70
[   23.302719]  kasan_save_track+0x18/0x40
[   23.302846]  kasan_save_alloc_info+0x3b/0x50
[   23.302986]  __kasan_kmalloc+0xb7/0xc0
[   23.303109]  __kmalloc_cache_noprof+0x189/0x420
[   23.303257]  kmalloc_uaf+0xaa/0x380
[   23.303386]  kunit_try_run_case+0x1a5/0x480
[   23.303528]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.303697]  kthread+0x337/0x6f0
[   23.303809]  ret_from_fork+0x116/0x1d0
[   23.303933]  ret_from_fork_asm+0x1a/0x30
[   23.304063] 
[   23.304126] Freed by task 232:
[   23.304228]  kasan_save_stack+0x45/0x70
[   23.304479]  kasan_save_track+0x18/0x40
[   23.304803]  kasan_save_free_info+0x3f/0x60
[   23.305281]  __kasan_slab_free+0x56/0x70
[   23.305721]  kfree+0x222/0x3f0
[   23.306092]  kmalloc_uaf+0x12c/0x380
[   23.306408]  kunit_try_run_case+0x1a5/0x480
[   23.306763]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.307365]  kthread+0x337/0x6f0
[   23.307780]  ret_from_fork+0x116/0x1d0
[   23.308179]  ret_from_fork_asm+0x1a/0x30
[   23.308659] 
[   23.308851] The buggy address belongs to the object at ffff8881048b63a0
[   23.308851]  which belongs to the cache kmalloc-16 of size 16
[   23.310240] The buggy address is located 8 bytes inside of
[   23.310240]  freed 16-byte region [ffff8881048b63a0, ffff8881048b63b0)
[   23.311450] 
[   23.311639] The buggy address belongs to the physical page:
[   23.312257] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1048b6
[   23.313067] flags: 0x200000000000000(node=0|zone=2)
[   23.313599] page_type: f5(slab)
[   23.313934] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122
[   23.314696] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   23.315481] page dumped because: kasan: bad access detected
[   23.316089] 
[   23.316239] Memory state around the buggy address:
[   23.316741]  ffff8881048b6280: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   23.317479]  ffff8881048b6300: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   23.318105] >ffff8881048b6380: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   23.318821]                                   ^
[   23.319347]  ffff8881048b6400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.320063]  ffff8881048b6480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.320803] ==================================================================

[   23.581547] ==================================================================
[   23.582050] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380
[   23.582570] Read of size 1 at addr ffff8881049ad588 by task kunit_try_catch/233
[   23.583195] 
[   23.583363] CPU: 1 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.583422] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.583436] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.583461] Call Trace:
[   23.583476]  <TASK>
[   23.583500]  dump_stack_lvl+0x73/0xb0
[   23.583535]  print_report+0xd1/0x650
[   23.583559]  ? __virt_addr_valid+0x1db/0x2d0
[   23.583585]  ? kmalloc_uaf+0x320/0x380
[   23.583605]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.583630]  ? kmalloc_uaf+0x320/0x380
[   23.583650]  kasan_report+0x141/0x180
[   23.583672]  ? kmalloc_uaf+0x320/0x380
[   23.583696]  __asan_report_load1_noabort+0x18/0x20
[   23.583721]  kmalloc_uaf+0x320/0x380
[   23.583741]  ? __pfx_kmalloc_uaf+0x10/0x10
[   23.583761]  ? __schedule+0x10cc/0x2b60
[   23.583784]  ? __pfx_read_tsc+0x10/0x10
[   23.583807]  ? ktime_get_ts64+0x86/0x230
[   23.583834]  kunit_try_run_case+0x1a5/0x480
[   23.583862]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.583885]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.583907]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.583929]  ? __kthread_parkme+0x82/0x180
[   23.584296]  ? preempt_count_sub+0x50/0x80
[   23.584324]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.584365]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.584392]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.584469]  kthread+0x337/0x6f0
[   23.584490]  ? trace_preempt_on+0x20/0xc0
[   23.584516]  ? __pfx_kthread+0x10/0x10
[   23.584548]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.584573]  ? calculate_sigpending+0x7b/0xa0
[   23.584598]  ? __pfx_kthread+0x10/0x10
[   23.584620]  ret_from_fork+0x116/0x1d0
[   23.584640]  ? __pfx_kthread+0x10/0x10
[   23.584661]  ret_from_fork_asm+0x1a/0x30
[   23.584695]  </TASK>
[   23.584709] 
[   23.592792] Allocated by task 233:
[   23.593006]  kasan_save_stack+0x45/0x70
[   23.593335]  kasan_save_track+0x18/0x40
[   23.593595]  kasan_save_alloc_info+0x3b/0x50
[   23.593815]  __kasan_kmalloc+0xb7/0xc0
[   23.594083]  __kmalloc_cache_noprof+0x189/0x420
[   23.594376]  kmalloc_uaf+0xaa/0x380
[   23.594703]  kunit_try_run_case+0x1a5/0x480
[   23.595909]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.596485]  kthread+0x337/0x6f0
[   23.596704]  ret_from_fork+0x116/0x1d0
[   23.596872]  ret_from_fork_asm+0x1a/0x30
[   23.597311] 
[   23.597551] Freed by task 233:
[   23.597882]  kasan_save_stack+0x45/0x70
[   23.598092]  kasan_save_track+0x18/0x40
[   23.598528]  kasan_save_free_info+0x3f/0x60
[   23.598845]  __kasan_slab_free+0x56/0x70
[   23.599254]  kfree+0x222/0x3f0
[   23.599646]  kmalloc_uaf+0x12c/0x380
[   23.599973]  kunit_try_run_case+0x1a5/0x480
[   23.600596]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.600848]  kthread+0x337/0x6f0
[   23.601337]  ret_from_fork+0x116/0x1d0
[   23.601573]  ret_from_fork_asm+0x1a/0x30
[   23.602025] 
[   23.602168] The buggy address belongs to the object at ffff8881049ad580
[   23.602168]  which belongs to the cache kmalloc-16 of size 16
[   23.603156] The buggy address is located 8 bytes inside of
[   23.603156]  freed 16-byte region [ffff8881049ad580, ffff8881049ad590)
[   23.604115] 
[   23.604329] The buggy address belongs to the physical page:
[   23.604715] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1049ad
[   23.605395] flags: 0x200000000000000(node=0|zone=2)
[   23.605844] page_type: f5(slab)
[   23.605978] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122
[   23.606490] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   23.607058] page dumped because: kasan: bad access detected
[   23.607403] 
[   23.607698] Memory state around the buggy address:
[   23.607890]  ffff8881049ad480: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   23.608581]  ffff8881049ad500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   23.609051] >ffff8881049ad580: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.609372]                       ^
[   23.609739]  ffff8881049ad600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.610135]  ffff8881049ad680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.610614] ==================================================================