[   32.691461] ==================================================================
[   32.691556] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   32.691628] Read of size 1 at addr fff00000c990ba28 by task kunit_try_catch/219
[   32.691681] 
[   32.691727] CPU: 1 UID: 0 PID: 219 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   32.691815] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.691843] Hardware name: linux,dummy-virt (DT)
[   32.691874] Call trace:
[   32.691897]  show_stack+0x20/0x38 (C)
[   32.691948]  dump_stack_lvl+0x8c/0xd0
[   32.692128]  print_report+0x118/0x608
[   32.692218]  kasan_report+0xdc/0x128
[   32.692287]  __asan_report_load1_noabort+0x20/0x30
[   32.692349]  kmalloc_uaf2+0x3f4/0x468
[   32.692422]  kunit_try_run_case+0x170/0x3f0
[   32.692502]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.692629]  kthread+0x328/0x630
[   32.692707]  ret_from_fork+0x10/0x20
[   32.692782] 
[   32.692876] Allocated by task 219:
[   32.692935]  kasan_save_stack+0x3c/0x68
[   32.693009]  kasan_save_track+0x20/0x40
[   32.693092]  kasan_save_alloc_info+0x40/0x58
[   32.693129]  __kasan_kmalloc+0xd4/0xd8
[   32.693196]  __kmalloc_cache_noprof+0x16c/0x3c0
[   32.693383]  kmalloc_uaf2+0xc4/0x468
[   32.693538]  kunit_try_run_case+0x170/0x3f0
[   32.693687]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.693776]  kthread+0x328/0x630
[   32.693851]  ret_from_fork+0x10/0x20
[   32.693947] 
[   32.693996] Freed by task 219:
[   32.694060]  kasan_save_stack+0x3c/0x68
[   32.694139]  kasan_save_track+0x20/0x40
[   32.694226]  kasan_save_free_info+0x4c/0x78
[   32.694308]  __kasan_slab_free+0x6c/0x98
[   32.694346]  kfree+0x214/0x3c8
[   32.694715]  kmalloc_uaf2+0x134/0x468
[   32.694838]  kunit_try_run_case+0x170/0x3f0
[   32.694934]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.695018]  kthread+0x328/0x630
[   32.695087]  ret_from_fork+0x10/0x20
[   32.695142] 
[   32.695234] The buggy address belongs to the object at fff00000c990ba00
[   32.695234]  which belongs to the cache kmalloc-64 of size 64
[   32.695339] The buggy address is located 40 bytes inside of
[   32.695339]  freed 64-byte region [fff00000c990ba00, fff00000c990ba40)
[   32.695485] 
[   32.695534] The buggy address belongs to the physical page:
[   32.695569] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10990b
[   32.695621] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.695670] page_type: f5(slab)
[   32.695709] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   32.695985] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   32.696070] page dumped because: kasan: bad access detected
[   32.696321] 
[   32.696358] Memory state around the buggy address:
[   32.696398]  fff00000c990b900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.696445]  fff00000c990b980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.696489] >fff00000c990ba00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.696528]                                   ^
[   32.696561]  fff00000c990ba80: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   32.696603]  fff00000c990bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.696642] ==================================================================

[   23.356556] ==================================================================
[   23.357341] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520
[   23.357725] Read of size 1 at addr ffff88810609b0a8 by task kunit_try_catch/236
[   23.358241] 
[   23.358370] CPU: 1 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.358420] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.358433] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.358453] Call Trace:
[   23.358466]  <TASK>
[   23.358483]  dump_stack_lvl+0x73/0xb0
[   23.358511]  print_report+0xd1/0x650
[   23.358552]  ? __virt_addr_valid+0x1db/0x2d0
[   23.358575]  ? kmalloc_uaf2+0x4a8/0x520
[   23.358594]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.358618]  ? kmalloc_uaf2+0x4a8/0x520
[   23.358647]  kasan_report+0x141/0x180
[   23.358668]  ? kmalloc_uaf2+0x4a8/0x520
[   23.358692]  __asan_report_load1_noabort+0x18/0x20
[   23.358715]  kmalloc_uaf2+0x4a8/0x520
[   23.358735]  ? __pfx_kmalloc_uaf2+0x10/0x10
[   23.358754]  ? finish_task_switch.isra.0+0x153/0x700
[   23.358775]  ? __switch_to+0x47/0xf50
[   23.358856]  ? __schedule+0x10cc/0x2b60
[   23.358879]  ? __pfx_read_tsc+0x10/0x10
[   23.358901]  ? ktime_get_ts64+0x86/0x230
[   23.358924]  kunit_try_run_case+0x1a5/0x480
[   23.358950]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.358973]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.358993]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.359036]  ? __kthread_parkme+0x82/0x180
[   23.359057]  ? preempt_count_sub+0x50/0x80
[   23.359079]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.359103]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.359126]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.359150]  kthread+0x337/0x6f0
[   23.359168]  ? trace_preempt_on+0x20/0xc0
[   23.359191]  ? __pfx_kthread+0x10/0x10
[   23.359211]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.359235]  ? calculate_sigpending+0x7b/0xa0
[   23.359257]  ? __pfx_kthread+0x10/0x10
[   23.359278]  ret_from_fork+0x116/0x1d0
[   23.359297]  ? __pfx_kthread+0x10/0x10
[   23.359328]  ret_from_fork_asm+0x1a/0x30
[   23.359358]  </TASK>
[   23.359371] 
[   23.367102] Allocated by task 236:
[   23.367247]  kasan_save_stack+0x45/0x70
[   23.367391]  kasan_save_track+0x18/0x40
[   23.367518]  kasan_save_alloc_info+0x3b/0x50
[   23.367734]  __kasan_kmalloc+0xb7/0xc0
[   23.367909]  __kmalloc_cache_noprof+0x189/0x420
[   23.368176]  kmalloc_uaf2+0xc6/0x520
[   23.368359]  kunit_try_run_case+0x1a5/0x480
[   23.368624]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.368875]  kthread+0x337/0x6f0
[   23.368991]  ret_from_fork+0x116/0x1d0
[   23.369146]  ret_from_fork_asm+0x1a/0x30
[   23.369350] 
[   23.369459] Freed by task 236:
[   23.369632]  kasan_save_stack+0x45/0x70
[   23.369923]  kasan_save_track+0x18/0x40
[   23.370116]  kasan_save_free_info+0x3f/0x60
[   23.370360]  __kasan_slab_free+0x56/0x70
[   23.370572]  kfree+0x222/0x3f0
[   23.370726]  kmalloc_uaf2+0x14c/0x520
[   23.370898]  kunit_try_run_case+0x1a5/0x480
[   23.371094]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.371340]  kthread+0x337/0x6f0
[   23.371593]  ret_from_fork+0x116/0x1d0
[   23.371873]  ret_from_fork_asm+0x1a/0x30
[   23.372009] 
[   23.372072] The buggy address belongs to the object at ffff88810609b080
[   23.372072]  which belongs to the cache kmalloc-64 of size 64
[   23.372530] The buggy address is located 40 bytes inside of
[   23.372530]  freed 64-byte region [ffff88810609b080, ffff88810609b0c0)
[   23.373491] 
[   23.373611] The buggy address belongs to the physical page:
[   23.373909] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10609b
[   23.374215] flags: 0x200000000000000(node=0|zone=2)
[   23.374420] page_type: f5(slab)
[   23.374643] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   23.375053] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   23.375304] page dumped because: kasan: bad access detected
[   23.375616] 
[   23.375755] Memory state around the buggy address:
[   23.375937]  ffff88810609af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.376291]  ffff88810609b000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.376628] >ffff88810609b080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.377021]                                   ^
[   23.377298]  ffff88810609b100: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   23.377619]  ffff88810609b180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.378053] ==================================================================

[   23.646636] ==================================================================
[   23.647111] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x4a8/0x520
[   23.647534] Read of size 1 at addr ffff888106053fa8 by task kunit_try_catch/237
[   23.647816] 
[   23.647952] CPU: 1 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.648006] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.648019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.648042] Call Trace:
[   23.648057]  <TASK>
[   23.648087]  dump_stack_lvl+0x73/0xb0
[   23.648119]  print_report+0xd1/0x650
[   23.648142]  ? __virt_addr_valid+0x1db/0x2d0
[   23.648166]  ? kmalloc_uaf2+0x4a8/0x520
[   23.648255]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.648280]  ? kmalloc_uaf2+0x4a8/0x520
[   23.648300]  kasan_report+0x141/0x180
[   23.648322]  ? kmalloc_uaf2+0x4a8/0x520
[   23.648346]  __asan_report_load1_noabort+0x18/0x20
[   23.648369]  kmalloc_uaf2+0x4a8/0x520
[   23.648388]  ? __pfx_kmalloc_uaf2+0x10/0x10
[   23.648408]  ? finish_task_switch.isra.0+0x153/0x700
[   23.648430]  ? __switch_to+0x47/0xf50
[   23.648457]  ? __schedule+0x10cc/0x2b60
[   23.648479]  ? __pfx_read_tsc+0x10/0x10
[   23.648500]  ? ktime_get_ts64+0x86/0x230
[   23.648525]  kunit_try_run_case+0x1a5/0x480
[   23.648553]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.648576]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.648597]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.648618]  ? __kthread_parkme+0x82/0x180
[   23.648639]  ? preempt_count_sub+0x50/0x80
[   23.648661]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.648685]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.648708]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.648732]  kthread+0x337/0x6f0
[   23.648751]  ? trace_preempt_on+0x20/0xc0
[   23.648774]  ? __pfx_kthread+0x10/0x10
[   23.648794]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.648817]  ? calculate_sigpending+0x7b/0xa0
[   23.648841]  ? __pfx_kthread+0x10/0x10
[   23.648861]  ret_from_fork+0x116/0x1d0
[   23.648880]  ? __pfx_kthread+0x10/0x10
[   23.648900]  ret_from_fork_asm+0x1a/0x30
[   23.648950]  </TASK>
[   23.648963] 
[   23.656123] Allocated by task 237:
[   23.656337]  kasan_save_stack+0x45/0x70
[   23.656541]  kasan_save_track+0x18/0x40
[   23.656718]  kasan_save_alloc_info+0x3b/0x50
[   23.656859]  __kasan_kmalloc+0xb7/0xc0
[   23.657008]  __kmalloc_cache_noprof+0x189/0x420
[   23.657287]  kmalloc_uaf2+0xc6/0x520
[   23.657474]  kunit_try_run_case+0x1a5/0x480
[   23.657677]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.657911]  kthread+0x337/0x6f0
[   23.658050]  ret_from_fork+0x116/0x1d0
[   23.658206]  ret_from_fork_asm+0x1a/0x30
[   23.658396] 
[   23.658484] Freed by task 237:
[   23.658637]  kasan_save_stack+0x45/0x70
[   23.658823]  kasan_save_track+0x18/0x40
[   23.659008]  kasan_save_free_info+0x3f/0x60
[   23.659195]  __kasan_slab_free+0x56/0x70
[   23.659372]  kfree+0x222/0x3f0
[   23.659483]  kmalloc_uaf2+0x14c/0x520
[   23.659606]  kunit_try_run_case+0x1a5/0x480
[   23.659746]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.659912]  kthread+0x337/0x6f0
[   23.660055]  ret_from_fork+0x116/0x1d0
[   23.660417]  ret_from_fork_asm+0x1a/0x30
[   23.660606] 
[   23.660694] The buggy address belongs to the object at ffff888106053f80
[   23.660694]  which belongs to the cache kmalloc-64 of size 64
[   23.661307] The buggy address is located 40 bytes inside of
[   23.661307]  freed 64-byte region [ffff888106053f80, ffff888106053fc0)
[   23.661801] 
[   23.661879] The buggy address belongs to the physical page:
[   23.662080] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106053
[   23.662495] flags: 0x200000000000000(node=0|zone=2)
[   23.662729] page_type: f5(slab)
[   23.662899] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   23.663312] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[   23.663608] page dumped because: kasan: bad access detected
[   23.663812] 
[   23.663906] Memory state around the buggy address:
[   23.664133]  ffff888106053e80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[   23.664479]  ffff888106053f00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.664757] >ffff888106053f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.665053]                                   ^
[   23.665303]  ffff888106054000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   23.665515]  ffff888106054080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.665809] ==================================================================