[   32.681255] ==================================================================
[   32.681318] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   32.681375] Write of size 33 at addr fff00000c990b880 by task kunit_try_catch/217
[   32.681430] 
[   32.681462] CPU: 1 UID: 0 PID: 217 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT 
[   32.681557] Tainted: [B]=BAD_PAGE, [N]=TEST
[   32.681586] Hardware name: linux,dummy-virt (DT)
[   32.681643] Call trace:
[   32.681668]  show_stack+0x20/0x38 (C)
[   32.681721]  dump_stack_lvl+0x8c/0xd0
[   32.681773]  print_report+0x118/0x608
[   32.681822]  kasan_report+0xdc/0x128
[   32.681869]  kasan_check_range+0x100/0x1a8
[   32.681916]  __asan_memset+0x34/0x78
[   32.681959]  kmalloc_uaf_memset+0x170/0x310
[   32.682007]  kunit_try_run_case+0x170/0x3f0
[   32.682057]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.682111]  kthread+0x328/0x630
[   32.682167]  ret_from_fork+0x10/0x20
[   32.682217] 
[   32.682235] Allocated by task 217:
[   32.682272]  kasan_save_stack+0x3c/0x68
[   32.682318]  kasan_save_track+0x20/0x40
[   32.682367]  kasan_save_alloc_info+0x40/0x58
[   32.682405]  __kasan_kmalloc+0xd4/0xd8
[   32.682446]  __kmalloc_cache_noprof+0x16c/0x3c0
[   32.682489]  kmalloc_uaf_memset+0xb8/0x310
[   32.682526]  kunit_try_run_case+0x170/0x3f0
[   32.682564]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.682608]  kthread+0x328/0x630
[   32.682646]  ret_from_fork+0x10/0x20
[   32.682690] 
[   32.682710] Freed by task 217:
[   32.682738]  kasan_save_stack+0x3c/0x68
[   32.682779]  kasan_save_track+0x20/0x40
[   32.682817]  kasan_save_free_info+0x4c/0x78
[   32.682857]  __kasan_slab_free+0x6c/0x98
[   32.682895]  kfree+0x214/0x3c8
[   32.682927]  kmalloc_uaf_memset+0x11c/0x310
[   32.682965]  kunit_try_run_case+0x170/0x3f0
[   32.683011]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   32.683064]  kthread+0x328/0x630
[   32.683096]  ret_from_fork+0x10/0x20
[   32.683133] 
[   32.683151] The buggy address belongs to the object at fff00000c990b880
[   32.683151]  which belongs to the cache kmalloc-64 of size 64
[   32.683531] The buggy address is located 0 bytes inside of
[   32.683531]  freed 64-byte region [fff00000c990b880, fff00000c990b8c0)
[   32.683657] 
[   32.683677] The buggy address belongs to the physical page:
[   32.686169] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10990b
[   32.686239] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   32.686292] page_type: f5(slab)
[   32.686331] raw: 0bfffe0000000000 fff00000c00018c0 dead000000000122 0000000000000000
[   32.686384] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   32.686424] page dumped because: kasan: bad access detected
[   32.686456] 
[   32.686476] Memory state around the buggy address:
[   32.686506]  fff00000c990b780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.686550]  fff00000c990b800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.686593] >fff00000c990b880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   32.686632]                    ^
[   32.686659]  fff00000c990b900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.686703]  fff00000c990b980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   32.686744] ==================================================================

[   23.324119] ==================================================================
[   23.324575] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360
[   23.324876] Write of size 33 at addr ffff888105895900 by task kunit_try_catch/234
[   23.325189] 
[   23.325287] CPU: 0 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.325344] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.325356] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.325377] Call Trace:
[   23.325392]  <TASK>
[   23.325410]  dump_stack_lvl+0x73/0xb0
[   23.325437]  print_report+0xd1/0x650
[   23.325458]  ? __virt_addr_valid+0x1db/0x2d0
[   23.325481]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.325500]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.325524]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.325545]  kasan_report+0x141/0x180
[   23.325565]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.325589]  kasan_check_range+0x10c/0x1c0
[   23.325611]  __asan_memset+0x27/0x50
[   23.325634]  kmalloc_uaf_memset+0x1a3/0x360
[   23.325654]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   23.325675]  ? __schedule+0x10cc/0x2b60
[   23.325695]  ? __pfx_read_tsc+0x10/0x10
[   23.325716]  ? ktime_get_ts64+0x86/0x230
[   23.325746]  kunit_try_run_case+0x1a5/0x480
[   23.325771]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.325793]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.325813]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.325834]  ? __kthread_parkme+0x82/0x180
[   23.325853]  ? preempt_count_sub+0x50/0x80
[   23.325876]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.325899]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.325922]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.325945]  kthread+0x337/0x6f0
[   23.325963]  ? trace_preempt_on+0x20/0xc0
[   23.325985]  ? __pfx_kthread+0x10/0x10
[   23.326005]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.326027]  ? calculate_sigpending+0x7b/0xa0
[   23.326050]  ? __pfx_kthread+0x10/0x10
[   23.326070]  ret_from_fork+0x116/0x1d0
[   23.326088]  ? __pfx_kthread+0x10/0x10
[   23.326108]  ret_from_fork_asm+0x1a/0x30
[   23.326137]  </TASK>
[   23.326148] 
[   23.337548] Allocated by task 234:
[   23.338032]  kasan_save_stack+0x45/0x70
[   23.338248]  kasan_save_track+0x18/0x40
[   23.338598]  kasan_save_alloc_info+0x3b/0x50
[   23.339025]  __kasan_kmalloc+0xb7/0xc0
[   23.339212]  __kmalloc_cache_noprof+0x189/0x420
[   23.339391]  kmalloc_uaf_memset+0xa9/0x360
[   23.339855]  kunit_try_run_case+0x1a5/0x480
[   23.340188]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.340470]  kthread+0x337/0x6f0
[   23.340875]  ret_from_fork+0x116/0x1d0
[   23.341157]  ret_from_fork_asm+0x1a/0x30
[   23.341433] 
[   23.341530] Freed by task 234:
[   23.341792]  kasan_save_stack+0x45/0x70
[   23.342180]  kasan_save_track+0x18/0x40
[   23.342392]  kasan_save_free_info+0x3f/0x60
[   23.342781]  __kasan_slab_free+0x56/0x70
[   23.343111]  kfree+0x222/0x3f0
[   23.343235]  kmalloc_uaf_memset+0x12b/0x360
[   23.343642]  kunit_try_run_case+0x1a5/0x480
[   23.344065]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.344316]  kthread+0x337/0x6f0
[   23.344483]  ret_from_fork+0x116/0x1d0
[   23.344920]  ret_from_fork_asm+0x1a/0x30
[   23.345120] 
[   23.345191] The buggy address belongs to the object at ffff888105895900
[   23.345191]  which belongs to the cache kmalloc-64 of size 64
[   23.345943] The buggy address is located 0 bytes inside of
[   23.345943]  freed 64-byte region [ffff888105895900, ffff888105895940)
[   23.346665] 
[   23.346895] The buggy address belongs to the physical page:
[   23.347158] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105895
[   23.347513] flags: 0x200000000000000(node=0|zone=2)
[   23.348083] page_type: f5(slab)
[   23.348230] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   23.348947] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   23.349388] page dumped because: kasan: bad access detected
[   23.349764] 
[   23.349967] Memory state around the buggy address:
[   23.350139]  ffff888105895800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.350941]  ffff888105895880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.351252] >ffff888105895900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.351567]                    ^
[   23.351993]  ffff888105895980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.352353]  ffff888105895a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.352906] ==================================================================

[   23.613972] ==================================================================
[   23.614649] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x1a3/0x360
[   23.614908] Write of size 33 at addr ffff888105a09b80 by task kunit_try_catch/235
[   23.615150] 
[   23.615334] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250702 #1 PREEMPT(voluntary) 
[   23.615393] Tainted: [B]=BAD_PAGE, [N]=TEST
[   23.615408] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   23.615433] Call Trace:
[   23.615448]  <TASK>
[   23.615472]  dump_stack_lvl+0x73/0xb0
[   23.615609]  print_report+0xd1/0x650
[   23.615643]  ? __virt_addr_valid+0x1db/0x2d0
[   23.615670]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.615691]  ? kasan_complete_mode_report_info+0x64/0x200
[   23.615717]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.615740]  kasan_report+0x141/0x180
[   23.615761]  ? kmalloc_uaf_memset+0x1a3/0x360
[   23.615786]  kasan_check_range+0x10c/0x1c0
[   23.615809]  __asan_memset+0x27/0x50
[   23.615834]  kmalloc_uaf_memset+0x1a3/0x360
[   23.615855]  ? __pfx_kmalloc_uaf_memset+0x10/0x10
[   23.615878]  ? __schedule+0x10cc/0x2b60
[   23.615900]  ? __pfx_read_tsc+0x10/0x10
[   23.615923]  ? ktime_get_ts64+0x86/0x230
[   23.615993]  kunit_try_run_case+0x1a5/0x480
[   23.616021]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.616044]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   23.616078]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   23.616100]  ? __kthread_parkme+0x82/0x180
[   23.616122]  ? preempt_count_sub+0x50/0x80
[   23.616178]  ? __pfx_kunit_try_run_case+0x10/0x10
[   23.616202]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.616227]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   23.616301]  kthread+0x337/0x6f0
[   23.616361]  ? trace_preempt_on+0x20/0xc0
[   23.616387]  ? __pfx_kthread+0x10/0x10
[   23.616408]  ? _raw_spin_unlock_irq+0x47/0x80
[   23.616432]  ? calculate_sigpending+0x7b/0xa0
[   23.616457]  ? __pfx_kthread+0x10/0x10
[   23.616479]  ret_from_fork+0x116/0x1d0
[   23.616498]  ? __pfx_kthread+0x10/0x10
[   23.616519]  ret_from_fork_asm+0x1a/0x30
[   23.616551]  </TASK>
[   23.616565] 
[   23.627899] Allocated by task 235:
[   23.628051]  kasan_save_stack+0x45/0x70
[   23.628340]  kasan_save_track+0x18/0x40
[   23.628859]  kasan_save_alloc_info+0x3b/0x50
[   23.629400]  __kasan_kmalloc+0xb7/0xc0
[   23.629774]  __kmalloc_cache_noprof+0x189/0x420
[   23.630257]  kmalloc_uaf_memset+0xa9/0x360
[   23.630678]  kunit_try_run_case+0x1a5/0x480
[   23.631118]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.631494]  kthread+0x337/0x6f0
[   23.631618]  ret_from_fork+0x116/0x1d0
[   23.631742]  ret_from_fork_asm+0x1a/0x30
[   23.631872] 
[   23.631946] Freed by task 235:
[   23.632293]  kasan_save_stack+0x45/0x70
[   23.632722]  kasan_save_track+0x18/0x40
[   23.633185]  kasan_save_free_info+0x3f/0x60
[   23.633901]  __kasan_slab_free+0x56/0x70
[   23.634437]  kfree+0x222/0x3f0
[   23.634758]  kmalloc_uaf_memset+0x12b/0x360
[   23.635169]  kunit_try_run_case+0x1a5/0x480
[   23.635465]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   23.635641]  kthread+0x337/0x6f0
[   23.635755]  ret_from_fork+0x116/0x1d0
[   23.635880]  ret_from_fork_asm+0x1a/0x30
[   23.636075] 
[   23.636143] The buggy address belongs to the object at ffff888105a09b80
[   23.636143]  which belongs to the cache kmalloc-64 of size 64
[   23.636900] The buggy address is located 0 bytes inside of
[   23.636900]  freed 64-byte region [ffff888105a09b80, ffff888105a09bc0)
[   23.637301] 
[   23.637393] The buggy address belongs to the physical page:
[   23.637701] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105a09
[   23.638053] flags: 0x200000000000000(node=0|zone=2)
[   23.638550] page_type: f5(slab)
[   23.638739] raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
[   23.638989] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   23.639284] page dumped because: kasan: bad access detected
[   23.639610] 
[   23.639702] Memory state around the buggy address:
[   23.639880]  ffff888105a09a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.640324]  ffff888105a09b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.640626] >ffff888105a09b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   23.640891]                    ^
[   23.641024]  ffff888105a09c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.641421]  ffff888105a09c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   23.641689] ==================================================================