[   50.527886] ==================================================================
[   50.539970] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   50.547202] Free of addr ffff000096d10000 by task kunit_try_catch/346
[   50.553732] 
[   50.555273] CPU: 5 UID: 0 PID: 346 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   50.555304] Tainted: [B]=BAD_PAGE, [N]=TEST
[   50.555313] Hardware name: Thundercomm Dragonboard 845c (DT)
[   50.555325] Call trace:
[   50.555332]  show_stack+0x20/0x38 (C)
[   50.555350]  dump_stack_lvl+0x8c/0xd0
[   50.555370]  print_report+0x118/0x608
[   50.555391]  kasan_report_invalid_free+0xc0/0xe8
[   50.555412]  __kasan_mempool_poison_object+0x14c/0x150
[   50.555433]  mempool_free+0x28c/0x328
[   50.555450]  mempool_double_free_helper+0x150/0x2e8
[   50.555470]  mempool_kmalloc_large_double_free+0xc0/0x118
[   50.555489]  kunit_try_run_case+0x170/0x3f0
[   50.555508]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   50.555529]  kthread+0x328/0x630
[   50.555544]  ret_from_fork+0x10/0x20
[   50.555562] 
[   50.632486] The buggy address belongs to the physical page:
[   50.638132] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116d10
[   50.646237] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   50.653991] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   50.661043] page_type: f8(unknown)
[   50.664504] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   50.672348] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   50.680194] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   50.688120] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   50.696049] head: 0bfffe0000000002 fffffdffc25b4401 00000000ffffffff 00000000ffffffff
[   50.703981] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   50.711908] page dumped because: kasan: bad access detected
[   50.717551] 
[   50.719084] Memory state around the buggy address:
[   50.723936]  ffff000096d0ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.731246]  ffff000096d0ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.738557] >ffff000096d10000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.745864]                    ^
[   50.749146]  ffff000096d10080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.756455]  ffff000096d10100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.763772] ==================================================================
[   50.775160] ==================================================================
[   50.787784] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   50.795020] Free of addr ffff00008553c000 by task kunit_try_catch/348
[   50.801544] 
[   50.803078] CPU: 3 UID: 0 PID: 348 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   50.803110] Tainted: [B]=BAD_PAGE, [N]=TEST
[   50.803120] Hardware name: Thundercomm Dragonboard 845c (DT)
[   50.803134] Call trace:
[   50.803142]  show_stack+0x20/0x38 (C)
[   50.803161]  dump_stack_lvl+0x8c/0xd0
[   50.803184]  print_report+0x118/0x608
[   50.803205]  kasan_report_invalid_free+0xc0/0xe8
[   50.803226]  __kasan_mempool_poison_pages+0xe0/0xe8
[   50.803252]  mempool_free+0x24c/0x328
[   50.803271]  mempool_double_free_helper+0x150/0x2e8
[   50.803291]  mempool_page_alloc_double_free+0xbc/0x118
[   50.803314]  kunit_try_run_case+0x170/0x3f0
[   50.803335]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   50.803358]  kthread+0x328/0x630
[   50.803375]  ret_from_fork+0x10/0x20
[   50.803393] 
[   50.879848] The buggy address belongs to the physical page:
[   50.885504] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10553c
[   50.893611] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   50.900236] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   50.908086] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   50.915931] page dumped because: kasan: bad access detected
[   50.921583] 
[   50.923111] Memory state around the buggy address:
[   50.927974]  ffff00008553bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.935294]  ffff00008553bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.942614] >ffff00008553c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.949929]                    ^
[   50.953219]  ffff00008553c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.960536]  ffff00008553c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.967851] ==================================================================
[   50.139739] ==================================================================
[   50.151398] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   50.158641] Free of addr ffff000082240900 by task kunit_try_catch/344
[   50.165169] 
[   50.166709] CPU: 3 UID: 0 PID: 344 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   50.166742] Tainted: [B]=BAD_PAGE, [N]=TEST
[   50.166753] Hardware name: Thundercomm Dragonboard 845c (DT)
[   50.166769] Call trace:
[   50.166777]  show_stack+0x20/0x38 (C)
[   50.166797]  dump_stack_lvl+0x8c/0xd0
[   50.166821]  print_report+0x118/0x608
[   50.166843]  kasan_report_invalid_free+0xc0/0xe8
[   50.166866]  check_slab_allocation+0xd4/0x108
[   50.166891]  __kasan_mempool_poison_object+0x78/0x150
[   50.166913]  mempool_free+0x28c/0x328
[   50.166934]  mempool_double_free_helper+0x150/0x2e8
[   50.166954]  mempool_kmalloc_double_free+0xc0/0x118
[   50.166974]  kunit_try_run_case+0x170/0x3f0
[   50.166995]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   50.167019]  kthread+0x328/0x630
[   50.167037]  ret_from_fork+0x10/0x20
[   50.167058] 
[   50.247832] Allocated by task 344:
[   50.251300]  kasan_save_stack+0x3c/0x68
[   50.255213]  kasan_save_track+0x20/0x40
[   50.259125]  kasan_save_alloc_info+0x40/0x58
[   50.263464]  __kasan_mempool_unpoison_object+0x11c/0x180
[   50.268865]  remove_element+0x130/0x1f8
[   50.272775]  mempool_alloc_preallocated+0x58/0xc0
[   50.277560]  mempool_double_free_helper+0x94/0x2e8
[   50.282432]  mempool_kmalloc_double_free+0xc0/0x118
[   50.287393]  kunit_try_run_case+0x170/0x3f0
[   50.291646]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   50.297219]  kthread+0x328/0x630
[   50.300513]  ret_from_fork+0x10/0x20
[   50.304154] 
[   50.305685] Freed by task 344:
[   50.308801]  kasan_save_stack+0x3c/0x68
[   50.312713]  kasan_save_track+0x20/0x40
[   50.316625]  kasan_save_free_info+0x4c/0x78
[   50.320877]  __kasan_mempool_poison_object+0xc0/0x150
[   50.326012]  mempool_free+0x28c/0x328
[   50.329738]  mempool_double_free_helper+0x100/0x2e8
[   50.334695]  mempool_kmalloc_double_free+0xc0/0x118
[   50.339652]  kunit_try_run_case+0x170/0x3f0
[   50.343905]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   50.349481]  kthread+0x328/0x630
[   50.352773]  ret_from_fork+0x10/0x20
[   50.356413] 
[   50.357948] The buggy address belongs to the object at ffff000082240900
[   50.357948]  which belongs to the cache kmalloc-128 of size 128
[   50.370609] The buggy address is located 0 bytes inside of
[   50.370609]  128-byte region [ffff000082240900, ffff000082240980)
[   50.382310] 
[   50.383849] The buggy address belongs to the physical page:
[   50.389501] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   50.397611] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   50.405371] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   50.412436] page_type: f5(slab)
[   50.415647] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   50.423497] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   50.431347] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   50.439281] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   50.447218] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   50.455155] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   50.463085] page dumped because: kasan: bad access detected
[   50.468733] 
[   50.470264] Memory state around the buggy address:
[   50.475131]  ffff000082240800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.482448]  ffff000082240880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   50.489767] >ffff000082240900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   50.497082]                    ^
[   50.500372]  ffff000082240980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   50.507691]  ffff000082240a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   50.515008] ==================================================================

[   49.944094] ==================================================================
[   49.955260] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   49.962062] Read of size 1 at addr ffff000095740000 by task kunit_try_catch/342
[   49.969469] 
[   49.971002] CPU: 6 UID: 0 PID: 342 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   49.971036] Tainted: [B]=BAD_PAGE, [N]=TEST
[   49.971045] Hardware name: Thundercomm Dragonboard 845c (DT)
[   49.971059] Call trace:
[   49.971066]  show_stack+0x20/0x38 (C)
[   49.971087]  dump_stack_lvl+0x8c/0xd0
[   49.971110]  print_report+0x118/0x608
[   49.971130]  kasan_report+0xdc/0x128
[   49.971148]  __asan_report_load1_noabort+0x20/0x30
[   49.971165]  mempool_uaf_helper+0x314/0x340
[   49.971182]  mempool_page_alloc_uaf+0xc0/0x118
[   49.971200]  kunit_try_run_case+0x170/0x3f0
[   49.971220]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.971240]  kthread+0x328/0x630
[   49.971255]  ret_from_fork+0x10/0x20
[   49.971273] 
[   50.041449] The buggy address belongs to the physical page:
[   50.047102] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115740
[   50.055211] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   50.061837] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   50.069675] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   50.077509] page dumped because: kasan: bad access detected
[   50.083150] 
[   50.084681] Memory state around the buggy address:
[   50.089546]  ffff00009573ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.096860]  ffff00009573ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.104172] >ffff000095740000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.111483]                    ^
[   50.114769]  ffff000095740080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.122081]  ffff000095740100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   50.129395] ==================================================================
[   49.353461] ==================================================================
[   49.364866] BUG: KASAN: use-after-free in mempool_uaf_helper+0x314/0x340
[   49.371664] Read of size 1 at addr ffff000095590000 by task kunit_try_catch/338
[   49.379066] 
[   49.380605] CPU: 4 UID: 0 PID: 338 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   49.380639] Tainted: [B]=BAD_PAGE, [N]=TEST
[   49.380648] Hardware name: Thundercomm Dragonboard 845c (DT)
[   49.380663] Call trace:
[   49.380671]  show_stack+0x20/0x38 (C)
[   49.380692]  dump_stack_lvl+0x8c/0xd0
[   49.380715]  print_report+0x118/0x608
[   49.380737]  kasan_report+0xdc/0x128
[   49.380755]  __asan_report_load1_noabort+0x20/0x30
[   49.380773]  mempool_uaf_helper+0x314/0x340
[   49.380789]  mempool_kmalloc_large_uaf+0xc4/0x120
[   49.380808]  kunit_try_run_case+0x170/0x3f0
[   49.380827]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.380849]  kthread+0x328/0x630
[   49.380867]  ret_from_fork+0x10/0x20
[   49.380888] 
[   49.451333] The buggy address belongs to the physical page:
[   49.456979] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115590
[   49.465084] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   49.472839] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   49.479891] page_type: f8(unknown)
[   49.483353] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   49.491197] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   49.499040] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   49.506967] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   49.514895] head: 0bfffe0000000002 fffffdffc2556401 00000000ffffffff 00000000ffffffff
[   49.522821] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   49.530744] page dumped because: kasan: bad access detected
[   49.536384] 
[   49.537909] Memory state around the buggy address:
[   49.542763]  ffff00009558ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   49.550080]  ffff00009558ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   49.557398] >ffff000095590000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   49.564712]                    ^
[   49.567992]  ffff000095590080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   49.575310]  ffff000095590100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   49.582617] ==================================================================

[   49.594072] ==================================================================
[   49.606005] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340
[   49.613251] Read of size 1 at addr ffff000097e1a240 by task kunit_try_catch/340
[   49.620660] 
[   49.622201] CPU: 3 UID: 0 PID: 340 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   49.622238] Tainted: [B]=BAD_PAGE, [N]=TEST
[   49.622247] Hardware name: Thundercomm Dragonboard 845c (DT)
[   49.622263] Call trace:
[   49.622273]  show_stack+0x20/0x38 (C)
[   49.622295]  dump_stack_lvl+0x8c/0xd0
[   49.622318]  print_report+0x118/0x608
[   49.622341]  kasan_report+0xdc/0x128
[   49.622361]  __asan_report_load1_noabort+0x20/0x30
[   49.622381]  mempool_uaf_helper+0x314/0x340
[   49.622399]  mempool_slab_uaf+0xc0/0x118
[   49.622420]  kunit_try_run_case+0x170/0x3f0
[   49.622443]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.622468]  kthread+0x328/0x630
[   49.622486]  ret_from_fork+0x10/0x20
[   49.622509] 
[   49.692208] Allocated by task 340:
[   49.695673]  kasan_save_stack+0x3c/0x68
[   49.699583]  kasan_save_track+0x20/0x40
[   49.703492]  kasan_save_alloc_info+0x40/0x58
[   49.707838]  __kasan_mempool_unpoison_object+0xbc/0x180
[   49.713150]  remove_element+0x16c/0x1f8
[   49.717059]  mempool_alloc_preallocated+0x58/0xc0
[   49.721842]  mempool_uaf_helper+0xa4/0x340
[   49.726008]  mempool_slab_uaf+0xc0/0x118
[   49.730004]  kunit_try_run_case+0x170/0x3f0
[   49.734256]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.739833]  kthread+0x328/0x630
[   49.743127]  ret_from_fork+0x10/0x20
[   49.746766] 
[   49.748301] Freed by task 340:
[   49.751408]  kasan_save_stack+0x3c/0x68
[   49.755318]  kasan_save_track+0x20/0x40
[   49.759228]  kasan_save_free_info+0x4c/0x78
[   49.763478]  __kasan_mempool_poison_object+0xc0/0x150
[   49.768615]  mempool_free+0x28c/0x328
[   49.772349]  mempool_uaf_helper+0x104/0x340
[   49.776602]  mempool_slab_uaf+0xc0/0x118
[   49.780595]  kunit_try_run_case+0x170/0x3f0
[   49.784849]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.790422]  kthread+0x328/0x630
[   49.793713]  ret_from_fork+0x10/0x20
[   49.797360] 
[   49.798891] The buggy address belongs to the object at ffff000097e1a240
[   49.798891]  which belongs to the cache test_cache of size 123
[   49.811463] The buggy address is located 0 bytes inside of
[   49.811463]  freed 123-byte region [ffff000097e1a240, ffff000097e1a2bb)
[   49.823689] 
[   49.825218] The buggy address belongs to the physical page:
[   49.830869] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117e1a
[   49.838979] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   49.845601] page_type: f5(slab)
[   49.848811] raw: 0bfffe0000000000 ffff000082242280 dead000000000122 0000000000000000
[   49.856665] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000
[   49.864514] page dumped because: kasan: bad access detected
[   49.870163] 
[   49.871701] Memory state around the buggy address:
[   49.876559]  ffff000097e1a100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   49.883883]  ffff000097e1a180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.891208] >ffff000097e1a200: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[   49.898528]                                            ^
[   49.903915]  ffff000097e1a280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   49.911239]  ffff000097e1a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   49.918561] ==================================================================
[   48.978434] ==================================================================
[   48.990143] BUG: KASAN: slab-use-after-free in mempool_uaf_helper+0x314/0x340
[   48.997399] Read of size 1 at addr ffff000082240500 by task kunit_try_catch/336
[   49.004810] 
[   49.006354] CPU: 3 UID: 0 PID: 336 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   49.006392] Tainted: [B]=BAD_PAGE, [N]=TEST
[   49.006401] Hardware name: Thundercomm Dragonboard 845c (DT)
[   49.006418] Call trace:
[   49.006427]  show_stack+0x20/0x38 (C)
[   49.006451]  dump_stack_lvl+0x8c/0xd0
[   49.006476]  print_report+0x118/0x608
[   49.006499]  kasan_report+0xdc/0x128
[   49.006517]  __asan_report_load1_noabort+0x20/0x30
[   49.006538]  mempool_uaf_helper+0x314/0x340
[   49.006555]  mempool_kmalloc_uaf+0xc4/0x120
[   49.006573]  kunit_try_run_case+0x170/0x3f0
[   49.006597]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.006621]  kthread+0x328/0x630
[   49.006640]  ret_from_fork+0x10/0x20
[   49.006662] 
[   49.076614] Allocated by task 336:
[   49.080075]  kasan_save_stack+0x3c/0x68
[   49.083988]  kasan_save_track+0x20/0x40
[   49.087897]  kasan_save_alloc_info+0x40/0x58
[   49.092233]  __kasan_mempool_unpoison_object+0x11c/0x180
[   49.097635]  remove_element+0x130/0x1f8
[   49.101545]  mempool_alloc_preallocated+0x58/0xc0
[   49.106327]  mempool_uaf_helper+0xa4/0x340
[   49.110493]  mempool_kmalloc_uaf+0xc4/0x120
[   49.114747]  kunit_try_run_case+0x170/0x3f0
[   49.118998]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.124576]  kthread+0x328/0x630
[   49.127867]  ret_from_fork+0x10/0x20
[   49.131507] 
[   49.133043] Freed by task 336:
[   49.136154]  kasan_save_stack+0x3c/0x68
[   49.140065]  kasan_save_track+0x20/0x40
[   49.143973]  kasan_save_free_info+0x4c/0x78
[   49.148223]  __kasan_mempool_poison_object+0xc0/0x150
[   49.153354]  mempool_free+0x28c/0x328
[   49.157087]  mempool_uaf_helper+0x104/0x340
[   49.161339]  mempool_kmalloc_uaf+0xc4/0x120
[   49.165592]  kunit_try_run_case+0x170/0x3f0
[   49.169846]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   49.175419]  kthread+0x328/0x630
[   49.178712]  ret_from_fork+0x10/0x20
[   49.182349] 
[   49.183885] The buggy address belongs to the object at ffff000082240500
[   49.183885]  which belongs to the cache kmalloc-128 of size 128
[   49.196549] The buggy address is located 0 bytes inside of
[   49.196549]  freed 128-byte region [ffff000082240500, ffff000082240580)
[   49.208781] 
[   49.210316] The buggy address belongs to the physical page:
[   49.215971] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   49.224083] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   49.231839] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   49.238904] page_type: f5(slab)
[   49.242114] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   49.249958] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   49.257803] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   49.265743] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   49.273684] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   49.281623] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   49.289559] page dumped because: kasan: bad access detected
[   49.295207] 
[   49.296742] Memory state around the buggy address:
[   49.301607]  ffff000082240400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.308928]  ffff000082240480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   49.316251] >ffff000082240500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.323566]                    ^
[   49.326855]  ffff000082240580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   49.334175]  ffff000082240600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   49.341497] ==================================================================

[   48.430801] ==================================================================
[   48.442730] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0
[   48.450410] Read of size 1 at addr ffff00008553a001 by task kunit_try_catch/332
[   48.457824] 
[   48.459361] CPU: 3 UID: 0 PID: 332 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   48.459395] Tainted: [B]=BAD_PAGE, [N]=TEST
[   48.459403] Hardware name: Thundercomm Dragonboard 845c (DT)
[   48.459417] Call trace:
[   48.459425]  show_stack+0x20/0x38 (C)
[   48.459446]  dump_stack_lvl+0x8c/0xd0
[   48.459469]  print_report+0x118/0x608
[   48.459489]  kasan_report+0xdc/0x128
[   48.459507]  __asan_report_load1_noabort+0x20/0x30
[   48.459525]  mempool_oob_right_helper+0x2ac/0x2f0
[   48.459543]  mempool_kmalloc_large_oob_right+0xc4/0x120
[   48.459563]  kunit_try_run_case+0x170/0x3f0
[   48.459585]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   48.459607]  kthread+0x328/0x630
[   48.459623]  ret_from_fork+0x10/0x20
[   48.459640] 
[   48.531140] The buggy address belongs to the physical page:
[   48.536789] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff00008553e600 pfn:0x105538
[   48.546214] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   48.553974] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   48.561034] page_type: f8(unknown)
[   48.564504] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   48.572352] raw: ffff00008553e600 0000000000000000 00000000f8000000 0000000000000000
[   48.580203] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   48.588136] head: ffff00008553e600 0000000000000000 00000000f8000000 0000000000000000
[   48.596072] head: 0bfffe0000000002 fffffdffc2154e01 00000000ffffffff 00000000ffffffff
[   48.604006] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   48.611934] page dumped because: kasan: bad access detected
[   48.617585] 
[   48.619115] Memory state around the buggy address:
[   48.623975]  ffff000085539f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   48.631295]  ffff000085539f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   48.638611] >ffff00008553a000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   48.645925]                    ^
[   48.649213]  ffff00008553a080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   48.656528]  ffff00008553a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   48.663842] ==================================================================
[   48.102457] ==================================================================
[   48.113501] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0
[   48.121191] Read of size 1 at addr ffff00009068f473 by task kunit_try_catch/330
[   48.128593] 
[   48.130128] CPU: 5 UID: 0 PID: 330 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   48.130166] Tainted: [B]=BAD_PAGE, [N]=TEST
[   48.130175] Hardware name: Thundercomm Dragonboard 845c (DT)
[   48.130191] Call trace:
[   48.130199]  show_stack+0x20/0x38 (C)
[   48.130220]  dump_stack_lvl+0x8c/0xd0
[   48.130243]  print_report+0x118/0x608
[   48.130264]  kasan_report+0xdc/0x128
[   48.130282]  __asan_report_load1_noabort+0x20/0x30
[   48.130302]  mempool_oob_right_helper+0x2ac/0x2f0
[   48.130319]  mempool_kmalloc_oob_right+0xc4/0x120
[   48.130337]  kunit_try_run_case+0x170/0x3f0
[   48.130358]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   48.130380]  kthread+0x328/0x630
[   48.130396]  ret_from_fork+0x10/0x20
[   48.130417] 
[   48.201338] Allocated by task 330:
[   48.204796]  kasan_save_stack+0x3c/0x68
[   48.208696]  kasan_save_track+0x20/0x40
[   48.212595]  kasan_save_alloc_info+0x40/0x58
[   48.216932]  __kasan_mempool_unpoison_object+0x11c/0x180
[   48.222329]  remove_element+0x130/0x1f8
[   48.226227]  mempool_alloc_preallocated+0x58/0xc0
[   48.230998]  mempool_oob_right_helper+0x98/0x2f0
[   48.235684]  mempool_kmalloc_oob_right+0xc4/0x120
[   48.240459]  kunit_try_run_case+0x170/0x3f0
[   48.244712]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   48.250280]  kthread+0x328/0x630
[   48.253564]  ret_from_fork+0x10/0x20
[   48.257199] 
[   48.258723] The buggy address belongs to the object at ffff00009068f400
[   48.258723]  which belongs to the cache kmalloc-128 of size 128
[   48.271383] The buggy address is located 0 bytes to the right of
[   48.271383]  allocated 115-byte region [ffff00009068f400, ffff00009068f473)
[   48.284480] 
[   48.286008] The buggy address belongs to the physical page:
[   48.291655] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11068e
[   48.299761] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   48.307519] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   48.314578] page_type: f5(slab)
[   48.317781] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   48.325626] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   48.333471] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   48.341402] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   48.349333] head: 0bfffe0000000001 fffffdffc241a381 00000000ffffffff 00000000ffffffff
[   48.357262] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   48.365183] page dumped because: kasan: bad access detected
[   48.370827] 
[   48.372358] Memory state around the buggy address:
[   48.377215]  ffff00009068f300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.384522]  ffff00009068f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.391834] >ffff00009068f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[   48.399141]                                                              ^
[   48.406103]  ffff00009068f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.413412]  ffff00009068f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[   48.420719] ==================================================================
[   48.676501] ==================================================================
[   48.688943] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0
[   48.696618] Read of size 1 at addr ffff000097e1d2bb by task kunit_try_catch/334
[   48.704030] 
[   48.705566] CPU: 3 UID: 0 PID: 334 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   48.705599] Tainted: [B]=BAD_PAGE, [N]=TEST
[   48.705607] Hardware name: Thundercomm Dragonboard 845c (DT)
[   48.705621] Call trace:
[   48.705628]  show_stack+0x20/0x38 (C)
[   48.705647]  dump_stack_lvl+0x8c/0xd0
[   48.705671]  print_report+0x118/0x608
[   48.705690]  kasan_report+0xdc/0x128
[   48.705708]  __asan_report_load1_noabort+0x20/0x30
[   48.705726]  mempool_oob_right_helper+0x2ac/0x2f0
[   48.705745]  mempool_slab_oob_right+0xc0/0x118
[   48.705766]  kunit_try_run_case+0x170/0x3f0
[   48.705786]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   48.705807]  kthread+0x328/0x630
[   48.705822]  ret_from_fork+0x10/0x20
[   48.705842] 
[   48.776582] Allocated by task 334:
[   48.780043]  kasan_save_stack+0x3c/0x68
[   48.783951]  kasan_save_track+0x20/0x40
[   48.787860]  kasan_save_alloc_info+0x40/0x58
[   48.792196]  __kasan_mempool_unpoison_object+0xbc/0x180
[   48.797509]  remove_element+0x16c/0x1f8
[   48.801419]  mempool_alloc_preallocated+0x58/0xc0
[   48.806201]  mempool_oob_right_helper+0x98/0x2f0
[   48.810896]  mempool_slab_oob_right+0xc0/0x118
[   48.815418]  kunit_try_run_case+0x170/0x3f0
[   48.819669]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   48.825238]  kthread+0x328/0x630
[   48.828529]  ret_from_fork+0x10/0x20
[   48.832177] 
[   48.833708] The buggy address belongs to the object at ffff000097e1d240
[   48.833708]  which belongs to the cache test_cache of size 123
[   48.846286] The buggy address is located 0 bytes to the right of
[   48.846286]  allocated 123-byte region [ffff000097e1d240, ffff000097e1d2bb)
[   48.859391] 
[   48.860929] The buggy address belongs to the physical page:
[   48.866578] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117e1d
[   48.874691] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   48.881314] page_type: f5(slab)
[   48.884521] raw: 0bfffe0000000000 ffff000082242140 dead000000000122 0000000000000000
[   48.892374] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000
[   48.900216] page dumped because: kasan: bad access detected
[   48.905864] 
[   48.907394] Memory state around the buggy address:
[   48.912260]  ffff000097e1d180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   48.919576]  ffff000097e1d200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[   48.926891] >ffff000097e1d280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc
[   48.934209]                                         ^
[   48.939331]  ffff000097e1d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.946655]  ffff000097e1d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   48.953972] ==================================================================

[   47.150133] ==================================================================
[   47.161494] BUG: KASAN: slab-use-after-free in kmem_cache_double_destroy+0x174/0x300
[   47.169365] Read of size 1 at addr ffff000080e02000 by task kunit_try_catch/324
[   47.176783] 
[   47.178327] CPU: 2 UID: 0 PID: 324 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   47.178364] Tainted: [B]=BAD_PAGE, [N]=TEST
[   47.178374] Hardware name: Thundercomm Dragonboard 845c (DT)
[   47.178392] Call trace:
[   47.178401]  show_stack+0x20/0x38 (C)
[   47.178424]  dump_stack_lvl+0x8c/0xd0
[   47.178448]  print_report+0x118/0x608
[   47.178473]  kasan_report+0xdc/0x128
[   47.178491]  __kasan_check_byte+0x54/0x70
[   47.178513]  kmem_cache_destroy+0x34/0x218
[   47.178535]  kmem_cache_double_destroy+0x174/0x300
[   47.178555]  kunit_try_run_case+0x170/0x3f0
[   47.178579]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   47.178603]  kthread+0x328/0x630
[   47.178622]  ret_from_fork+0x10/0x20
[   47.178644] 
[   47.248318] Allocated by task 324:
[   47.251789]  kasan_save_stack+0x3c/0x68
[   47.255695]  kasan_save_track+0x20/0x40
[   47.259601]  kasan_save_alloc_info+0x40/0x58
[   47.263945]  __kasan_slab_alloc+0xa8/0xb0
[   47.268025]  kmem_cache_alloc_noprof+0x10c/0x398
[   47.272724]  __kmem_cache_create_args+0x178/0x280
[   47.277504]  kmem_cache_double_destroy+0xc0/0x300
[   47.282283]  kunit_try_run_case+0x170/0x3f0
[   47.286546]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   47.292116]  kthread+0x328/0x630
[   47.295404]  ret_from_fork+0x10/0x20
[   47.299048] 
[   47.300579] Freed by task 324:
[   47.303689]  kasan_save_stack+0x3c/0x68
[   47.307596]  kasan_save_track+0x20/0x40
[   47.311500]  kasan_save_free_info+0x4c/0x78
[   47.315760]  __kasan_slab_free+0x6c/0x98
[   47.319753]  kmem_cache_free+0x260/0x468
[   47.323745]  slab_kmem_cache_release+0x38/0x50
[   47.328266]  kmem_cache_release+0x1c/0x30
[   47.332344]  kobject_put+0x17c/0x420
[   47.335992]  sysfs_slab_release+0x1c/0x30
[   47.340071]  kmem_cache_destroy+0x118/0x218
[   47.344331]  kmem_cache_double_destroy+0x128/0x300
[   47.349196]  kunit_try_run_case+0x170/0x3f0
[   47.353456]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   47.359025]  kthread+0x328/0x630
[   47.362312]  ret_from_fork+0x10/0x20
[   47.365959] 
[   47.367491] The buggy address belongs to the object at ffff000080e02000
[   47.367491]  which belongs to the cache kmem_cache of size 208
[   47.380073] The buggy address is located 0 bytes inside of
[   47.380073]  freed 208-byte region [ffff000080e02000, ffff000080e020d0)
[   47.392296] 
[   47.393830] The buggy address belongs to the physical page:
[   47.399479] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100e02
[   47.407589] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   47.415351] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   47.422417] page_type: f5(slab)
[   47.425625] raw: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000
[   47.433473] raw: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000
[   47.441322] head: 0bfffe0000000040 ffff000080002000 dead000000000122 0000000000000000
[   47.449257] head: 0000000000000000 0000000080190019 00000000f5000000 0000000000000000
[   47.457190] head: 0bfffe0000000001 fffffdffc2038081 00000000ffffffff 00000000ffffffff
[   47.465124] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   47.473054] page dumped because: kasan: bad access detected
[   47.478700] 
[   47.480231] Memory state around the buggy address:
[   47.485095]  ffff000080e01f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.492409]  ffff000080e01f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.499724] >ffff000080e02000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   47.507037]                    ^
[   47.510322]  ffff000080e02080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[   47.517638]  ffff000080e02100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.524951] ==================================================================

[   46.712321] ==================================================================
[   46.724106] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x388/0x468
[   46.731347] Read of size 1 at addr ffff0000952aa000 by task kunit_try_catch/322
[   46.738751] 
[   46.740292] CPU: 6 UID: 0 PID: 322 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   46.740329] Tainted: [B]=BAD_PAGE, [N]=TEST
[   46.740340] Hardware name: Thundercomm Dragonboard 845c (DT)
[   46.740355] Call trace:
[   46.740364]  show_stack+0x20/0x38 (C)
[   46.740386]  dump_stack_lvl+0x8c/0xd0
[   46.740408]  print_report+0x118/0x608
[   46.740429]  kasan_report+0xdc/0x128
[   46.740447]  __asan_report_load1_noabort+0x20/0x30
[   46.740464]  kmem_cache_rcu_uaf+0x388/0x468
[   46.740480]  kunit_try_run_case+0x170/0x3f0
[   46.740502]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.740525]  kthread+0x328/0x630
[   46.740541]  ret_from_fork+0x10/0x20
[   46.740560] 
[   46.806243] Allocated by task 322:
[   46.809699]  kasan_save_stack+0x3c/0x68
[   46.813610]  kasan_save_track+0x20/0x40
[   46.817515]  kasan_save_alloc_info+0x40/0x58
[   46.821850]  __kasan_slab_alloc+0xa8/0xb0
[   46.825928]  kmem_cache_alloc_noprof+0x10c/0x398
[   46.830618]  kmem_cache_rcu_uaf+0x12c/0x468
[   46.834870]  kunit_try_run_case+0x170/0x3f0
[   46.839120]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.844685]  kthread+0x328/0x630
[   46.847967]  ret_from_fork+0x10/0x20
[   46.851599] 
[   46.853122] Freed by task 0:
[   46.856056]  kasan_save_stack+0x3c/0x68
[   46.859961]  kasan_save_track+0x20/0x40
[   46.863864]  kasan_save_free_info+0x4c/0x78
[   46.868111]  __kasan_slab_free+0x6c/0x98
[   46.872101]  slab_free_after_rcu_debug+0xd4/0x2f8
[   46.876876]  rcu_core+0x9f4/0x1e20
[   46.880337]  rcu_core_si+0x18/0x30
[   46.883796]  handle_softirqs+0x374/0xb28
[   46.887789]  __do_softirq+0x1c/0x28
[   46.891335] 
[   46.892858] Last potentially related work creation:
[   46.897797]  kasan_save_stack+0x3c/0x68
[   46.901704]  kasan_record_aux_stack+0xb4/0xc8
[   46.906126]  kmem_cache_free+0x120/0x468
[   46.910120]  kmem_cache_rcu_uaf+0x16c/0x468
[   46.914372]  kunit_try_run_case+0x170/0x3f0
[   46.918622]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.924185]  kthread+0x328/0x630
[   46.927469]  ret_from_fork+0x10/0x20
[   46.931103] 
[   46.932634] The buggy address belongs to the object at ffff0000952aa000
[   46.932634]  which belongs to the cache test_cache of size 200
[   46.945207] The buggy address is located 0 bytes inside of
[   46.945207]  freed 200-byte region [ffff0000952aa000, ffff0000952aa0c8)
[   46.957422] 
[   46.958947] The buggy address belongs to the physical page:
[   46.964590] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1152aa
[   46.972695] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   46.980449] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   46.987505] page_type: f5(slab)
[   46.990711] raw: 0bfffe0000000040 ffff000087bc8f00 dead000000000122 0000000000000000
[   46.998556] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   47.006398] head: 0bfffe0000000040 ffff000087bc8f00 dead000000000122 0000000000000000
[   47.014324] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   47.022251] head: 0bfffe0000000001 fffffdffc254aa81 00000000ffffffff 00000000ffffffff
[   47.030176] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   47.038098] page dumped because: kasan: bad access detected
[   47.043746] 
[   47.045269] Memory state around the buggy address:
[   47.050133]  ffff0000952a9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.057446]  ffff0000952a9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.064759] >ffff0000952aa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   47.072074]                    ^
[   47.075354]  ffff0000952aa080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   47.082672]  ffff0000952aa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.089984] ==================================================================

[   63.838352] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x760/0x4858

[   61.128073] ==================================================================
[   61.135387] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f94/0x4858
[   61.142883] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   61.150375] 
[   61.151902] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   61.151931] Tainted: [B]=BAD_PAGE, [N]=TEST
[   61.151938] Hardware name: Thundercomm Dragonboard 845c (DT)
[   61.151949] Call trace:
[   61.151955]  show_stack+0x20/0x38 (C)
[   61.151972]  dump_stack_lvl+0x8c/0xd0
[   61.151991]  print_report+0x118/0x608
[   61.152010]  kasan_report+0xdc/0x128
[   61.152029]  __asan_report_store4_noabort+0x20/0x30
[   61.152046]  kasan_atomics_helper+0x3f94/0x4858
[   61.152065]  kasan_atomics+0x198/0x2e0
[   61.152082]  kunit_try_run_case+0x170/0x3f0
[   61.152099]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.152120]  kthread+0x328/0x630
[   61.152133]  ret_from_fork+0x10/0x20
[   61.152150] 
[   61.222060] Allocated by task 374:
[   61.225518]  kasan_save_stack+0x3c/0x68
[   61.229418]  kasan_save_track+0x20/0x40
[   61.233316]  kasan_save_alloc_info+0x40/0x58
[   61.237655]  __kasan_kmalloc+0xd4/0xd8
[   61.241467]  __kmalloc_cache_noprof+0x16c/0x3c0
[   61.246072]  kasan_atomics+0xb8/0x2e0
[   61.249795]  kunit_try_run_case+0x170/0x3f0
[   61.254051]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.259623]  kthread+0x328/0x630
[   61.262909]  ret_from_fork+0x10/0x20
[   61.266547] 
[   61.268071] The buggy address belongs to the object at ffff000081814300
[   61.268071]  which belongs to the cache kmalloc-64 of size 64
[   61.280553] The buggy address is located 0 bytes to the right of
[   61.280553]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   61.293560] 
[   61.295085] The buggy address belongs to the physical page:
[   61.300735] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   61.308836] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   61.315794] page_type: f5(slab)
[   61.318995] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   61.326836] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   61.334671] page dumped because: kasan: bad access detected
[   61.340321] 
[   61.341846] Memory state around the buggy address:
[   61.346703]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.354019]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.361332] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   61.368643]                                      ^
[   61.373503]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.380820]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.388134] ==================================================================
[   61.395515] ==================================================================
[   61.402829] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3ac/0x4858
[   61.410236] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   61.417727] 
[   61.419255] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   61.419285] Tainted: [B]=BAD_PAGE, [N]=TEST
[   61.419293] Hardware name: Thundercomm Dragonboard 845c (DT)
[   61.419305] Call trace:
[   61.419311]  show_stack+0x20/0x38 (C)
[   61.419330]  dump_stack_lvl+0x8c/0xd0
[   61.419350]  print_report+0x118/0x608
[   61.419369]  kasan_report+0xdc/0x128
[   61.419388]  kasan_check_range+0x100/0x1a8
[   61.419409]  __kasan_check_write+0x20/0x30
[   61.419425]  kasan_atomics_helper+0x3ac/0x4858
[   61.419444]  kasan_atomics+0x198/0x2e0
[   61.419462]  kunit_try_run_case+0x170/0x3f0
[   61.419480]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.419502]  kthread+0x328/0x630
[   61.419516]  ret_from_fork+0x10/0x20
[   61.419534] 
[   61.492710] Allocated by task 374:
[   61.496169]  kasan_save_stack+0x3c/0x68
[   61.500069]  kasan_save_track+0x20/0x40
[   61.503967]  kasan_save_alloc_info+0x40/0x58
[   61.508309]  __kasan_kmalloc+0xd4/0xd8
[   61.512120]  __kmalloc_cache_noprof+0x16c/0x3c0
[   61.516725]  kasan_atomics+0xb8/0x2e0
[   61.520449]  kunit_try_run_case+0x170/0x3f0
[   61.524706]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.530265]  kthread+0x328/0x630
[   61.533554]  ret_from_fork+0x10/0x20
[   61.537191] 
[   61.538716] The buggy address belongs to the object at ffff000081814300
[   61.538716]  which belongs to the cache kmalloc-64 of size 64
[   61.551198] The buggy address is located 0 bytes to the right of
[   61.551198]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   61.564205] 
[   61.565730] The buggy address belongs to the physical page:
[   61.571378] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   61.579478] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   61.586437] page_type: f5(slab)
[   61.589638] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   61.597480] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   61.605315] page dumped because: kasan: bad access detected
[   61.610965] 
[   61.612489] Memory state around the buggy address:
[   61.617347]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.624661]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.631979] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   61.639291]                                      ^
[   61.644149]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.651465]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.658778] ==================================================================
[   63.560409] ==================================================================
[   63.567724] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x6ec/0x4858
[   63.575132] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   63.582623] 
[   63.584149] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   63.584179] Tainted: [B]=BAD_PAGE, [N]=TEST
[   63.584188] Hardware name: Thundercomm Dragonboard 845c (DT)
[   63.584199] Call trace:
[   63.584205]  show_stack+0x20/0x38 (C)
[   63.584223]  dump_stack_lvl+0x8c/0xd0
[   63.584243]  print_report+0x118/0x608
[   63.584262]  kasan_report+0xdc/0x128
[   63.584280]  kasan_check_range+0x100/0x1a8
[   63.584300]  __kasan_check_write+0x20/0x30
[   63.584315]  kasan_atomics_helper+0x6ec/0x4858
[   63.584335]  kasan_atomics+0x198/0x2e0
[   63.584353]  kunit_try_run_case+0x170/0x3f0
[   63.584370]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.584392]  kthread+0x328/0x630
[   63.584406]  ret_from_fork+0x10/0x20
[   63.584422] 
[   63.657598] Allocated by task 374:
[   63.661055]  kasan_save_stack+0x3c/0x68
[   63.664956]  kasan_save_track+0x20/0x40
[   63.668855]  kasan_save_alloc_info+0x40/0x58
[   63.673196]  __kasan_kmalloc+0xd4/0xd8
[   63.677007]  __kmalloc_cache_noprof+0x16c/0x3c0
[   63.681610]  kasan_atomics+0xb8/0x2e0
[   63.685334]  kunit_try_run_case+0x170/0x3f0
[   63.689588]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.695160]  kthread+0x328/0x630
[   63.698447]  ret_from_fork+0x10/0x20
[   63.702083] 
[   63.703608] The buggy address belongs to the object at ffff000081814300
[   63.703608]  which belongs to the cache kmalloc-64 of size 64
[   63.716091] The buggy address is located 0 bytes to the right of
[   63.716091]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   63.729097] 
[   63.730623] The buggy address belongs to the physical page:
[   63.736271] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   63.744371] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   63.751330] page_type: f5(slab)
[   63.754531] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   63.762371] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   63.770207] page dumped because: kasan: bad access detected
[   63.775855] 
[   63.777381] Memory state around the buggy address:
[   63.782238]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.789555]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.796870] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   63.804182]                                      ^
[   63.809042]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.816357]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.823670] ==================================================================
[   60.857444] ==================================================================
[   60.864758] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x32c/0x4858
[   60.872166] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   60.879657] 
[   60.881184] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   60.881213] Tainted: [B]=BAD_PAGE, [N]=TEST
[   60.881220] Hardware name: Thundercomm Dragonboard 845c (DT)
[   60.881231] Call trace:
[   60.881238]  show_stack+0x20/0x38 (C)
[   60.881255]  dump_stack_lvl+0x8c/0xd0
[   60.881274]  print_report+0x118/0x608
[   60.881292]  kasan_report+0xdc/0x128
[   60.881310]  kasan_check_range+0x100/0x1a8
[   60.881330]  __kasan_check_write+0x20/0x30
[   60.881346]  kasan_atomics_helper+0x32c/0x4858
[   60.881363]  kasan_atomics+0x198/0x2e0
[   60.881382]  kunit_try_run_case+0x170/0x3f0
[   60.881399]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.881420]  kthread+0x328/0x630
[   60.881435]  ret_from_fork+0x10/0x20
[   60.881452] 
[   60.954631] Allocated by task 374:
[   60.958090]  kasan_save_stack+0x3c/0x68
[   60.961990]  kasan_save_track+0x20/0x40
[   60.965891]  kasan_save_alloc_info+0x40/0x58
[   60.970231]  __kasan_kmalloc+0xd4/0xd8
[   60.974041]  __kmalloc_cache_noprof+0x16c/0x3c0
[   60.978646]  kasan_atomics+0xb8/0x2e0
[   60.982371]  kunit_try_run_case+0x170/0x3f0
[   60.986626]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.992197]  kthread+0x328/0x630
[   60.995484]  ret_from_fork+0x10/0x20
[   60.999120] 
[   61.000644] The buggy address belongs to the object at ffff000081814300
[   61.000644]  which belongs to the cache kmalloc-64 of size 64
[   61.013128] The buggy address is located 0 bytes to the right of
[   61.013128]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   61.026135] 
[   61.027660] The buggy address belongs to the physical page:
[   61.033308] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   61.041405] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   61.048363] page_type: f5(slab)
[   61.051566] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   61.059406] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   61.067242] page dumped because: kasan: bad access detected
[   61.072892] 
[   61.074415] Memory state around the buggy address:
[   61.079272]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.086589]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.093904] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   61.101217]                                      ^
[   61.106076]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.113392]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.120705] ==================================================================
[   59.234906] ==================================================================
[   59.249978] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x40a8/0x4858
[   59.257484] Read of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   59.264892] 
[   59.266429] CPU: 3 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   59.266459] Tainted: [B]=BAD_PAGE, [N]=TEST
[   59.266469] Hardware name: Thundercomm Dragonboard 845c (DT)
[   59.266484] Call trace:
[   59.266491]  show_stack+0x20/0x38 (C)
[   59.266511]  dump_stack_lvl+0x8c/0xd0
[   59.266534]  print_report+0x118/0x608
[   59.266556]  kasan_report+0xdc/0x128
[   59.266575]  __asan_report_load4_noabort+0x20/0x30
[   59.266594]  kasan_atomics_helper+0x40a8/0x4858
[   59.266614]  kasan_atomics+0x198/0x2e0
[   59.266632]  kunit_try_run_case+0x170/0x3f0
[   59.266652]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.266674]  kthread+0x328/0x630
[   59.266690]  ret_from_fork+0x10/0x20
[   59.266709] 
[   59.336543] Allocated by task 374:
[   59.340005]  kasan_save_stack+0x3c/0x68
[   59.343919]  kasan_save_track+0x20/0x40
[   59.347830]  kasan_save_alloc_info+0x40/0x58
[   59.352172]  __kasan_kmalloc+0xd4/0xd8
[   59.355995]  __kmalloc_cache_noprof+0x16c/0x3c0
[   59.360600]  kasan_atomics+0xb8/0x2e0
[   59.364327]  kunit_try_run_case+0x170/0x3f0
[   59.368583]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.374160]  kthread+0x328/0x630
[   59.377453]  ret_from_fork+0x10/0x20
[   59.381092] 
[   59.382626] The buggy address belongs to the object at ffff000081814300
[   59.382626]  which belongs to the cache kmalloc-64 of size 64
[   59.395109] The buggy address is located 0 bytes to the right of
[   59.395109]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   59.408122] 
[   59.409654] The buggy address belongs to the physical page:
[   59.415303] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   59.423410] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   59.430383] page_type: f5(slab)
[   59.433591] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   59.441439] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   59.449282] page dumped because: kasan: bad access detected
[   59.454933] 
[   59.456471] Memory state around the buggy address:
[   59.461335]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.468652]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.475970] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   59.483286]                                      ^
[   59.488150]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.495471]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.502787] ==================================================================
[   60.049140] ==================================================================
[   60.056462] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x24c/0x4858
[   60.063875] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   60.071371] 
[   60.072899] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   60.072930] Tainted: [B]=BAD_PAGE, [N]=TEST
[   60.072940] Hardware name: Thundercomm Dragonboard 845c (DT)
[   60.072950] Call trace:
[   60.072956]  show_stack+0x20/0x38 (C)
[   60.072975]  dump_stack_lvl+0x8c/0xd0
[   60.072994]  print_report+0x118/0x608
[   60.073014]  kasan_report+0xdc/0x128
[   60.073034]  kasan_check_range+0x100/0x1a8
[   60.073057]  __kasan_check_write+0x20/0x30
[   60.073072]  kasan_atomics_helper+0x24c/0x4858
[   60.073090]  kasan_atomics+0x198/0x2e0
[   60.073107]  kunit_try_run_case+0x170/0x3f0
[   60.073126]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.073148]  kthread+0x328/0x630
[   60.073161]  ret_from_fork+0x10/0x20
[   60.073178] 
[   60.146339] Allocated by task 374:
[   60.149792]  kasan_save_stack+0x3c/0x68
[   60.153699]  kasan_save_track+0x20/0x40
[   60.157606]  kasan_save_alloc_info+0x40/0x58
[   60.161943]  __kasan_kmalloc+0xd4/0xd8
[   60.165761]  __kmalloc_cache_noprof+0x16c/0x3c0
[   60.170362]  kasan_atomics+0xb8/0x2e0
[   60.174083]  kunit_try_run_case+0x170/0x3f0
[   60.178336]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.183900]  kthread+0x328/0x630
[   60.187184]  ret_from_fork+0x10/0x20
[   60.190818] 
[   60.192348] The buggy address belongs to the object at ffff000081814300
[   60.192348]  which belongs to the cache kmalloc-64 of size 64
[   60.204831] The buggy address is located 0 bytes to the right of
[   60.204831]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   60.217837] 
[   60.219369] The buggy address belongs to the physical page:
[   60.225014] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   60.233116] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   60.240078] page_type: f5(slab)
[   60.243277] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   60.251120] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   60.258957] page dumped because: kasan: bad access detected
[   60.264599] 
[   60.266122] Memory state around the buggy address:
[   60.270974]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.278283]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.285599] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   60.292904]                                      ^
[   60.297758]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.305065]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.312370] ==================================================================
[   59.778720] ==================================================================
[   59.786041] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x1ec/0x4858
[   59.793459] Read of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   59.800859] 
[   59.802389] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   59.802421] Tainted: [B]=BAD_PAGE, [N]=TEST
[   59.802430] Hardware name: Thundercomm Dragonboard 845c (DT)
[   59.802442] Call trace:
[   59.802449]  show_stack+0x20/0x38 (C)
[   59.802469]  dump_stack_lvl+0x8c/0xd0
[   59.802490]  print_report+0x118/0x608
[   59.802509]  kasan_report+0xdc/0x128
[   59.802529]  kasan_check_range+0x100/0x1a8
[   59.802550]  __kasan_check_read+0x20/0x30
[   59.802567]  kasan_atomics_helper+0x1ec/0x4858
[   59.802585]  kasan_atomics+0x198/0x2e0
[   59.802602]  kunit_try_run_case+0x170/0x3f0
[   59.802621]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.802642]  kthread+0x328/0x630
[   59.802656]  ret_from_fork+0x10/0x20
[   59.802672] 
[   59.875760] Allocated by task 374:
[   59.879219]  kasan_save_stack+0x3c/0x68
[   59.883118]  kasan_save_track+0x20/0x40
[   59.887013]  kasan_save_alloc_info+0x40/0x58
[   59.891347]  __kasan_kmalloc+0xd4/0xd8
[   59.895156]  __kmalloc_cache_noprof+0x16c/0x3c0
[   59.899754]  kasan_atomics+0xb8/0x2e0
[   59.903476]  kunit_try_run_case+0x170/0x3f0
[   59.907729]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.913297]  kthread+0x328/0x630
[   59.916580]  ret_from_fork+0x10/0x20
[   59.920213] 
[   59.921737] The buggy address belongs to the object at ffff000081814300
[   59.921737]  which belongs to the cache kmalloc-64 of size 64
[   59.934220] The buggy address is located 0 bytes to the right of
[   59.934220]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   59.947229] 
[   59.948753] The buggy address belongs to the physical page:
[   59.954399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   59.962502] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   59.969466] page_type: f5(slab)
[   59.972663] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   59.980508] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   59.988346] page dumped because: kasan: bad access detected
[   59.993991] 
[   59.995521] Memory state around the buggy address:
[   60.000375]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.007686]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.014997] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   60.022303]                                      ^
[   60.027157]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.034466]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.041771] ==================================================================
[   60.590189] ==================================================================
[   60.597507] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x40fc/0x4858
[   60.605001] Read of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   60.612407] 
[   60.613934] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   60.613963] Tainted: [B]=BAD_PAGE, [N]=TEST
[   60.613973] Hardware name: Thundercomm Dragonboard 845c (DT)
[   60.613983] Call trace:
[   60.613990]  show_stack+0x20/0x38 (C)
[   60.614006]  dump_stack_lvl+0x8c/0xd0
[   60.614025]  print_report+0x118/0x608
[   60.614044]  kasan_report+0xdc/0x128
[   60.614062]  __asan_report_load4_noabort+0x20/0x30
[   60.614079]  kasan_atomics_helper+0x40fc/0x4858
[   60.614098]  kasan_atomics+0x198/0x2e0
[   60.614116]  kunit_try_run_case+0x170/0x3f0
[   60.614134]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.614156]  kthread+0x328/0x630
[   60.614170]  ret_from_fork+0x10/0x20
[   60.614188] 
[   60.684000] Allocated by task 374:
[   60.687458]  kasan_save_stack+0x3c/0x68
[   60.691357]  kasan_save_track+0x20/0x40
[   60.695256]  kasan_save_alloc_info+0x40/0x58
[   60.699596]  __kasan_kmalloc+0xd4/0xd8
[   60.703408]  __kmalloc_cache_noprof+0x16c/0x3c0
[   60.708010]  kasan_atomics+0xb8/0x2e0
[   60.711733]  kunit_try_run_case+0x170/0x3f0
[   60.715988]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.721558]  kthread+0x328/0x630
[   60.724845]  ret_from_fork+0x10/0x20
[   60.728481] 
[   60.730006] The buggy address belongs to the object at ffff000081814300
[   60.730006]  which belongs to the cache kmalloc-64 of size 64
[   60.742488] The buggy address is located 0 bytes to the right of
[   60.742488]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   60.755492] 
[   60.757018] The buggy address belongs to the physical page:
[   60.762666] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   60.770765] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   60.777723] page_type: f5(slab)
[   60.780925] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   60.788766] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   60.796601] page dumped because: kasan: bad access detected
[   60.802249] 
[   60.803774] Memory state around the buggy address:
[   60.808631]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.815945]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.823259] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   60.830575]                                      ^
[   60.835433]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.842747]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.850060] ==================================================================
[   63.019186] ==================================================================
[   63.026500] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x61c/0x4858
[   63.033906] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   63.041397] 
[   63.042924] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   63.042953] Tainted: [B]=BAD_PAGE, [N]=TEST
[   63.042962] Hardware name: Thundercomm Dragonboard 845c (DT)
[   63.042972] Call trace:
[   63.042978]  show_stack+0x20/0x38 (C)
[   63.042996]  dump_stack_lvl+0x8c/0xd0
[   63.043014]  print_report+0x118/0x608
[   63.043033]  kasan_report+0xdc/0x128
[   63.043055]  kasan_check_range+0x100/0x1a8
[   63.043075]  __kasan_check_write+0x20/0x30
[   63.043092]  kasan_atomics_helper+0x61c/0x4858
[   63.043111]  kasan_atomics+0x198/0x2e0
[   63.043128]  kunit_try_run_case+0x170/0x3f0
[   63.043147]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.043168]  kthread+0x328/0x630
[   63.043181]  ret_from_fork+0x10/0x20
[   63.043197] 
[   63.116363] Allocated by task 374:
[   63.119820]  kasan_save_stack+0x3c/0x68
[   63.123723]  kasan_save_track+0x20/0x40
[   63.127621]  kasan_save_alloc_info+0x40/0x58
[   63.131962]  __kasan_kmalloc+0xd4/0xd8
[   63.135773]  __kmalloc_cache_noprof+0x16c/0x3c0
[   63.140376]  kasan_atomics+0xb8/0x2e0
[   63.144098]  kunit_try_run_case+0x170/0x3f0
[   63.148354]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.153915]  kthread+0x328/0x630
[   63.157203]  ret_from_fork+0x10/0x20
[   63.160840] 
[   63.162365] The buggy address belongs to the object at ffff000081814300
[   63.162365]  which belongs to the cache kmalloc-64 of size 64
[   63.174848] The buggy address is located 0 bytes to the right of
[   63.174848]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   63.187858] 
[   63.189382] The buggy address belongs to the physical page:
[   63.195031] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   63.203130] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   63.210089] page_type: f5(slab)
[   63.213288] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   63.221129] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   63.228963] page dumped because: kasan: bad access detected
[   63.234612] 
[   63.236136] Memory state around the buggy address:
[   63.240994]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.248309]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.255624] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   63.262939]                                      ^
[   63.267797]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.275113]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.282426] ==================================================================
[   61.666143] ==================================================================
[   61.673456] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x414/0x4858
[   61.680863] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   61.688353] 
[   61.689878] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   61.689908] Tainted: [B]=BAD_PAGE, [N]=TEST
[   61.689916] Hardware name: Thundercomm Dragonboard 845c (DT)
[   61.689926] Call trace:
[   61.689931]  show_stack+0x20/0x38 (C)
[   61.689948]  dump_stack_lvl+0x8c/0xd0
[   61.689971]  print_report+0x118/0x608
[   61.689991]  kasan_report+0xdc/0x128
[   61.690009]  kasan_check_range+0x100/0x1a8
[   61.690029]  __kasan_check_write+0x20/0x30
[   61.690044]  kasan_atomics_helper+0x414/0x4858
[   61.690063]  kasan_atomics+0x198/0x2e0
[   61.690082]  kunit_try_run_case+0x170/0x3f0
[   61.690100]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.690121]  kthread+0x328/0x630
[   61.690136]  ret_from_fork+0x10/0x20
[   61.690153] 
[   61.763307] Allocated by task 374:
[   61.766764]  kasan_save_stack+0x3c/0x68
[   61.770663]  kasan_save_track+0x20/0x40
[   61.774563]  kasan_save_alloc_info+0x40/0x58
[   61.778901]  __kasan_kmalloc+0xd4/0xd8
[   61.782713]  __kmalloc_cache_noprof+0x16c/0x3c0
[   61.787317]  kasan_atomics+0xb8/0x2e0
[   61.791039]  kunit_try_run_case+0x170/0x3f0
[   61.795297]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.800868]  kthread+0x328/0x630
[   61.804156]  ret_from_fork+0x10/0x20
[   61.807793] 
[   61.809318] The buggy address belongs to the object at ffff000081814300
[   61.809318]  which belongs to the cache kmalloc-64 of size 64
[   61.821800] The buggy address is located 0 bytes to the right of
[   61.821800]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   61.834807] 
[   61.836331] The buggy address belongs to the physical page:
[   61.841979] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   61.850079] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   61.857038] page_type: f5(slab)
[   61.860239] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   61.868080] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   61.875917] page dumped because: kasan: bad access detected
[   61.881567] 
[   61.883090] Memory state around the buggy address:
[   61.887949]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.895266]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.902582] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   61.909897]                                      ^
[   61.914754]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.922070]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   61.929385] ==================================================================
[   62.207363] ==================================================================
[   62.214679] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x4e4/0x4858
[   62.222086] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   62.229578] 
[   62.231104] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   62.231133] Tainted: [B]=BAD_PAGE, [N]=TEST
[   62.231141] Hardware name: Thundercomm Dragonboard 845c (DT)
[   62.231151] Call trace:
[   62.231157]  show_stack+0x20/0x38 (C)
[   62.231174]  dump_stack_lvl+0x8c/0xd0
[   62.231193]  print_report+0x118/0x608
[   62.231211]  kasan_report+0xdc/0x128
[   62.231230]  kasan_check_range+0x100/0x1a8
[   62.231249]  __kasan_check_write+0x20/0x30
[   62.231264]  kasan_atomics_helper+0x4e4/0x4858
[   62.231282]  kasan_atomics+0x198/0x2e0
[   62.231299]  kunit_try_run_case+0x170/0x3f0
[   62.231317]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.231337]  kthread+0x328/0x630
[   62.231350]  ret_from_fork+0x10/0x20
[   62.231367] 
[   62.304525] Allocated by task 374:
[   62.307982]  kasan_save_stack+0x3c/0x68
[   62.311881]  kasan_save_track+0x20/0x40
[   62.315782]  kasan_save_alloc_info+0x40/0x58
[   62.320122]  __kasan_kmalloc+0xd4/0xd8
[   62.323933]  __kmalloc_cache_noprof+0x16c/0x3c0
[   62.328537]  kasan_atomics+0xb8/0x2e0
[   62.332261]  kunit_try_run_case+0x170/0x3f0
[   62.336515]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.342075]  kthread+0x328/0x630
[   62.345363]  ret_from_fork+0x10/0x20
[   62.349000] 
[   62.350524] The buggy address belongs to the object at ffff000081814300
[   62.350524]  which belongs to the cache kmalloc-64 of size 64
[   62.363006] The buggy address is located 0 bytes to the right of
[   62.363006]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   62.376010] 
[   62.377534] The buggy address belongs to the physical page:
[   62.383184] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   62.391282] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   62.398240] page_type: f5(slab)
[   62.401441] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   62.409281] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   62.417117] page dumped because: kasan: bad access detected
[   62.422767] 
[   62.424291] Memory state around the buggy address:
[   62.429150]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.436466]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.443782] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   62.451095]                                      ^
[   62.455952]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.463265]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.470578] ==================================================================
[   60.319739] ==================================================================
[   60.327049] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x2b0/0x4858
[   60.334449] Read of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   60.341857] 
[   60.343383] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   60.343413] Tainted: [B]=BAD_PAGE, [N]=TEST
[   60.343422] Hardware name: Thundercomm Dragonboard 845c (DT)
[   60.343434] Call trace:
[   60.343440]  show_stack+0x20/0x38 (C)
[   60.343457]  dump_stack_lvl+0x8c/0xd0
[   60.343477]  print_report+0x118/0x608
[   60.343495]  kasan_report+0xdc/0x128
[   60.343515]  kasan_check_range+0x100/0x1a8
[   60.343534]  __kasan_check_read+0x20/0x30
[   60.343550]  kasan_atomics_helper+0x2b0/0x4858
[   60.343569]  kasan_atomics+0x198/0x2e0
[   60.343587]  kunit_try_run_case+0x170/0x3f0
[   60.343606]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.343628]  kthread+0x328/0x630
[   60.343642]  ret_from_fork+0x10/0x20
[   60.343659] 
[   60.416744] Allocated by task 374:
[   60.420202]  kasan_save_stack+0x3c/0x68
[   60.424103]  kasan_save_track+0x20/0x40
[   60.428003]  kasan_save_alloc_info+0x40/0x58
[   60.432344]  __kasan_kmalloc+0xd4/0xd8
[   60.436158]  __kmalloc_cache_noprof+0x16c/0x3c0
[   60.440762]  kasan_atomics+0xb8/0x2e0
[   60.444487]  kunit_try_run_case+0x170/0x3f0
[   60.448744]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   60.454304]  kthread+0x328/0x630
[   60.457592]  ret_from_fork+0x10/0x20
[   60.461228] 
[   60.462753] The buggy address belongs to the object at ffff000081814300
[   60.462753]  which belongs to the cache kmalloc-64 of size 64
[   60.475235] The buggy address is located 0 bytes to the right of
[   60.475235]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   60.488239] 
[   60.489763] The buggy address belongs to the physical page:
[   60.495413] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   60.503513] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   60.510472] page_type: f5(slab)
[   60.513674] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   60.521513] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   60.529349] page dumped because: kasan: bad access detected
[   60.534999] 
[   60.536523] Memory state around the buggy address:
[   60.541380]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.548695]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.556011] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   60.563324]                                      ^
[   60.568182]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.575496]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   60.582809] ==================================================================
[   62.477958] ==================================================================
[   62.485272] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x54c/0x4858
[   62.492679] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   62.500172] 
[   62.501698] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   62.501727] Tainted: [B]=BAD_PAGE, [N]=TEST
[   62.501735] Hardware name: Thundercomm Dragonboard 845c (DT)
[   62.501745] Call trace:
[   62.501752]  show_stack+0x20/0x38 (C)
[   62.501769]  dump_stack_lvl+0x8c/0xd0
[   62.501788]  print_report+0x118/0x608
[   62.501806]  kasan_report+0xdc/0x128
[   62.501824]  kasan_check_range+0x100/0x1a8
[   62.501844]  __kasan_check_write+0x20/0x30
[   62.501861]  kasan_atomics_helper+0x54c/0x4858
[   62.501880]  kasan_atomics+0x198/0x2e0
[   62.501897]  kunit_try_run_case+0x170/0x3f0
[   62.501916]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.501938]  kthread+0x328/0x630
[   62.501952]  ret_from_fork+0x10/0x20
[   62.501969] 
[   62.575144] Allocated by task 374:
[   62.578601]  kasan_save_stack+0x3c/0x68
[   62.582502]  kasan_save_track+0x20/0x40
[   62.586399]  kasan_save_alloc_info+0x40/0x58
[   62.590738]  __kasan_kmalloc+0xd4/0xd8
[   62.594549]  __kmalloc_cache_noprof+0x16c/0x3c0
[   62.599153]  kasan_atomics+0xb8/0x2e0
[   62.602877]  kunit_try_run_case+0x170/0x3f0
[   62.607133]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.612695]  kthread+0x328/0x630
[   62.615983]  ret_from_fork+0x10/0x20
[   62.619620] 
[   62.621144] The buggy address belongs to the object at ffff000081814300
[   62.621144]  which belongs to the cache kmalloc-64 of size 64
[   62.633626] The buggy address is located 0 bytes to the right of
[   62.633626]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   62.646634] 
[   62.648159] The buggy address belongs to the physical page:
[   62.653806] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   62.661905] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   62.668864] page_type: f5(slab)
[   62.672066] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   62.679905] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   62.687741] page dumped because: kasan: bad access detected
[   62.693390] 
[   62.694914] Memory state around the buggy address:
[   62.699772]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.707088]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.714405] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   62.721719]                                      ^
[   62.726578]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.733891]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.741205] ==================================================================
[   62.748571] ==================================================================
[   62.755885] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x5b4/0x4858
[   62.763293] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   62.770784] 
[   62.772309] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   62.772338] Tainted: [B]=BAD_PAGE, [N]=TEST
[   62.772346] Hardware name: Thundercomm Dragonboard 845c (DT)
[   62.772356] Call trace:
[   62.772362]  show_stack+0x20/0x38 (C)
[   62.772380]  dump_stack_lvl+0x8c/0xd0
[   62.772398]  print_report+0x118/0x608
[   62.772418]  kasan_report+0xdc/0x128
[   62.772436]  kasan_check_range+0x100/0x1a8
[   62.772456]  __kasan_check_write+0x20/0x30
[   62.772472]  kasan_atomics_helper+0x5b4/0x4858
[   62.772490]  kasan_atomics+0x198/0x2e0
[   62.772507]  kunit_try_run_case+0x170/0x3f0
[   62.772526]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.772548]  kthread+0x328/0x630
[   62.772561]  ret_from_fork+0x10/0x20
[   62.772578] 
[   62.845742] Allocated by task 374:
[   62.849200]  kasan_save_stack+0x3c/0x68
[   62.853100]  kasan_save_track+0x20/0x40
[   62.857000]  kasan_save_alloc_info+0x40/0x58
[   62.861341]  __kasan_kmalloc+0xd4/0xd8
[   62.865152]  __kmalloc_cache_noprof+0x16c/0x3c0
[   62.869754]  kasan_atomics+0xb8/0x2e0
[   62.873476]  kunit_try_run_case+0x170/0x3f0
[   62.877731]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.883302]  kthread+0x328/0x630
[   62.886588]  ret_from_fork+0x10/0x20
[   62.890223] 
[   62.891747] The buggy address belongs to the object at ffff000081814300
[   62.891747]  which belongs to the cache kmalloc-64 of size 64
[   62.904230] The buggy address is located 0 bytes to the right of
[   62.904230]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   62.917235] 
[   62.918761] The buggy address belongs to the physical page:
[   62.924411] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   62.932510] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   62.939468] page_type: f5(slab)
[   62.942668] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   62.950508] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   62.958343] page dumped because: kasan: bad access detected
[   62.963993] 
[   62.965518] Memory state around the buggy address:
[   62.970375]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.977693]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.985008] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   62.992321]                                      ^
[   62.997179]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.004493]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.011808] ==================================================================
[   63.289792] ==================================================================
[   63.297106] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x684/0x4858
[   63.304513] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   63.312006] 
[   63.313532] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   63.313561] Tainted: [B]=BAD_PAGE, [N]=TEST
[   63.313570] Hardware name: Thundercomm Dragonboard 845c (DT)
[   63.313581] Call trace:
[   63.313587]  show_stack+0x20/0x38 (C)
[   63.313603]  dump_stack_lvl+0x8c/0xd0
[   63.313621]  print_report+0x118/0x608
[   63.313639]  kasan_report+0xdc/0x128
[   63.313658]  kasan_check_range+0x100/0x1a8
[   63.313678]  __kasan_check_write+0x20/0x30
[   63.313695]  kasan_atomics_helper+0x684/0x4858
[   63.313713]  kasan_atomics+0x198/0x2e0
[   63.313731]  kunit_try_run_case+0x170/0x3f0
[   63.313749]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.313770]  kthread+0x328/0x630
[   63.313784]  ret_from_fork+0x10/0x20
[   63.313802] 
[   63.386957] Allocated by task 374:
[   63.390417]  kasan_save_stack+0x3c/0x68
[   63.394315]  kasan_save_track+0x20/0x40
[   63.398216]  kasan_save_alloc_info+0x40/0x58
[   63.402558]  __kasan_kmalloc+0xd4/0xd8
[   63.406369]  __kmalloc_cache_noprof+0x16c/0x3c0
[   63.410974]  kasan_atomics+0xb8/0x2e0
[   63.414699]  kunit_try_run_case+0x170/0x3f0
[   63.418955]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   63.424517]  kthread+0x328/0x630
[   63.427804]  ret_from_fork+0x10/0x20
[   63.431440] 
[   63.432964] The buggy address belongs to the object at ffff000081814300
[   63.432964]  which belongs to the cache kmalloc-64 of size 64
[   63.445448] The buggy address is located 0 bytes to the right of
[   63.445448]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   63.458456] 
[   63.459981] The buggy address belongs to the physical page:
[   63.465629] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   63.473729] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   63.480687] page_type: f5(slab)
[   63.483888] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   63.491729] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   63.499566] page dumped because: kasan: bad access detected
[   63.505216] 
[   63.506740] Memory state around the buggy address:
[   63.511597]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.518913]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.526231] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   63.533543]                                      ^
[   63.538401]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.545717]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   63.553032] ==================================================================
[   61.936763] ==================================================================
[   61.944079] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x47c/0x4858
[   61.951488] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   61.958979] 
[   61.960506] CPU: 4 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   61.960536] Tainted: [B]=BAD_PAGE, [N]=TEST
[   61.960543] Hardware name: Thundercomm Dragonboard 845c (DT)
[   61.960555] Call trace:
[   61.960561]  show_stack+0x20/0x38 (C)
[   61.960578]  dump_stack_lvl+0x8c/0xd0
[   61.960598]  print_report+0x118/0x608
[   61.960617]  kasan_report+0xdc/0x128
[   61.960636]  kasan_check_range+0x100/0x1a8
[   61.960656]  __kasan_check_write+0x20/0x30
[   61.960671]  kasan_atomics_helper+0x47c/0x4858
[   61.960692]  kasan_atomics+0x198/0x2e0
[   61.960709]  kunit_try_run_case+0x170/0x3f0
[   61.960727]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   61.960749]  kthread+0x328/0x630
[   61.960764]  ret_from_fork+0x10/0x20
[   61.960781] 
[   62.033945] Allocated by task 374:
[   62.037404]  kasan_save_stack+0x3c/0x68
[   62.041305]  kasan_save_track+0x20/0x40
[   62.045202]  kasan_save_alloc_info+0x40/0x58
[   62.049541]  __kasan_kmalloc+0xd4/0xd8
[   62.053353]  __kmalloc_cache_noprof+0x16c/0x3c0
[   62.057955]  kasan_atomics+0xb8/0x2e0
[   62.061678]  kunit_try_run_case+0x170/0x3f0
[   62.065932]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   62.071493]  kthread+0x328/0x630
[   62.074780]  ret_from_fork+0x10/0x20
[   62.078416] 
[   62.079940] The buggy address belongs to the object at ffff000081814300
[   62.079940]  which belongs to the cache kmalloc-64 of size 64
[   62.092423] The buggy address is located 0 bytes to the right of
[   62.092423]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   62.105430] 
[   62.106954] The buggy address belongs to the physical page:
[   62.112602] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   62.120700] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   62.127660] page_type: f5(slab)
[   62.130861] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   62.138701] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   62.146536] page dumped because: kasan: bad access detected
[   62.152186] 
[   62.153709] Memory state around the buggy address:
[   62.158568]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.165884]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.173199] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   62.180513]                                      ^
[   62.185371]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.192686]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   62.200000] ==================================================================
[   59.510179] ==================================================================
[   59.517505] BUG: KASAN: slab-out-of-bounds in kasan_atomics_helper+0x3f7c/0x4858
[   59.525010] Write of size 4 at addr ffff000081814330 by task kunit_try_catch/374
[   59.532510] 
[   59.534047] CPU: 3 UID: 0 PID: 374 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   59.534079] Tainted: [B]=BAD_PAGE, [N]=TEST
[   59.534089] Hardware name: Thundercomm Dragonboard 845c (DT)
[   59.534101] Call trace:
[   59.534109]  show_stack+0x20/0x38 (C)
[   59.534128]  dump_stack_lvl+0x8c/0xd0
[   59.534149]  print_report+0x118/0x608
[   59.534169]  kasan_report+0xdc/0x128
[   59.534190]  __asan_report_store4_noabort+0x20/0x30
[   59.534209]  kasan_atomics_helper+0x3f7c/0x4858
[   59.534229]  kasan_atomics+0x198/0x2e0
[   59.534249]  kunit_try_run_case+0x170/0x3f0
[   59.534269]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.534292]  kthread+0x328/0x630
[   59.534308]  ret_from_fork+0x10/0x20
[   59.534326] 
[   59.604257] Allocated by task 374:
[   59.607720]  kasan_save_stack+0x3c/0x68
[   59.611623]  kasan_save_track+0x20/0x40
[   59.615525]  kasan_save_alloc_info+0x40/0x58
[   59.619863]  __kasan_kmalloc+0xd4/0xd8
[   59.623675]  __kmalloc_cache_noprof+0x16c/0x3c0
[   59.628277]  kasan_atomics+0xb8/0x2e0
[   59.632014]  kunit_try_run_case+0x170/0x3f0
[   59.636271]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.641846]  kthread+0x328/0x630
[   59.645140]  ret_from_fork+0x10/0x20
[   59.648780] 
[   59.650312] The buggy address belongs to the object at ffff000081814300
[   59.650312]  which belongs to the cache kmalloc-64 of size 64
[   59.662799] The buggy address is located 0 bytes to the right of
[   59.662799]  allocated 48-byte region [ffff000081814300, ffff000081814330)
[   59.675811] 
[   59.677342] The buggy address belongs to the physical page:
[   59.682993] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   59.691098] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   59.698074] page_type: f5(slab)
[   59.701281] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   59.709131] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   59.716974] page dumped because: kasan: bad access detected
[   59.722628] 
[   59.724165] Memory state around the buggy address:
[   59.729030]  ffff000081814200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.736355]  ffff000081814280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.743673] >ffff000081814300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[   59.750990]                                      ^
[   59.755853]  ffff000081814380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.763172]  ffff000081814400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   59.770488] ==================================================================

[   57.861538] ==================================================================
[   57.868853] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x25c/0xbc0
[   57.877922] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   57.885413] 
[   57.886939] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   57.886969] Tainted: [B]=BAD_PAGE, [N]=TEST
[   57.886979] Hardware name: Thundercomm Dragonboard 845c (DT)
[   57.886990] Call trace:
[   57.886996]  show_stack+0x20/0x38 (C)
[   57.887013]  dump_stack_lvl+0x8c/0xd0
[   57.887032]  print_report+0x118/0x608
[   57.887051]  kasan_report+0xdc/0x128
[   57.887070]  kasan_check_range+0x100/0x1a8
[   57.887090]  __kasan_check_write+0x20/0x30
[   57.887106]  kasan_bitops_test_and_modify.constprop.0+0x25c/0xbc0
[   57.887129]  kasan_bitops_generic+0x11c/0x1c8
[   57.887146]  kunit_try_run_case+0x170/0x3f0
[   57.887164]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.887187]  kthread+0x328/0x630
[   57.887200]  ret_from_fork+0x10/0x20
[   57.887217] 
[   57.962658] Allocated by task 370:
[   57.966115]  kasan_save_stack+0x3c/0x68
[   57.970014]  kasan_save_track+0x20/0x40
[   57.973912]  kasan_save_alloc_info+0x40/0x58
[   57.978251]  __kasan_kmalloc+0xd4/0xd8
[   57.982061]  __kmalloc_cache_noprof+0x16c/0x3c0
[   57.986664]  kasan_bitops_generic+0xa0/0x1c8
[   57.991008]  kunit_try_run_case+0x170/0x3f0
[   57.995266]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.000828]  kthread+0x328/0x630
[   58.004115]  ret_from_fork+0x10/0x20
[   58.007752] 
[   58.009276] The buggy address belongs to the object at ffff000098190200
[   58.009276]  which belongs to the cache kmalloc-16 of size 16
[   58.021758] The buggy address is located 8 bytes inside of
[   58.021758]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   58.034159] 
[   58.035684] The buggy address belongs to the physical page:
[   58.041333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   58.049431] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   58.056041] page_type: f5(slab)
[   58.059242] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   58.067084] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   58.074920] page dumped because: kasan: bad access detected
[   58.080569] 
[   58.082093] Memory state around the buggy address:
[   58.086950]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.094266]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.101581] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.108894]                       ^
[   58.112438]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.119753]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.127066] ==================================================================
[   57.319272] ==================================================================
[   57.326589] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x1d8/0xbc0
[   57.335658] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   57.343149] 
[   57.344675] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   57.344703] Tainted: [B]=BAD_PAGE, [N]=TEST
[   57.344712] Hardware name: Thundercomm Dragonboard 845c (DT)
[   57.344724] Call trace:
[   57.344729]  show_stack+0x20/0x38 (C)
[   57.344747]  dump_stack_lvl+0x8c/0xd0
[   57.344767]  print_report+0x118/0x608
[   57.344787]  kasan_report+0xdc/0x128
[   57.344805]  kasan_check_range+0x100/0x1a8
[   57.344824]  __kasan_check_write+0x20/0x30
[   57.344840]  kasan_bitops_test_and_modify.constprop.0+0x1d8/0xbc0
[   57.344860]  kasan_bitops_generic+0x11c/0x1c8
[   57.344879]  kunit_try_run_case+0x170/0x3f0
[   57.344896]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.344917]  kthread+0x328/0x630
[   57.344931]  ret_from_fork+0x10/0x20
[   57.344947] 
[   57.420392] Allocated by task 370:
[   57.423852]  kasan_save_stack+0x3c/0x68
[   57.427751]  kasan_save_track+0x20/0x40
[   57.431651]  kasan_save_alloc_info+0x40/0x58
[   57.435991]  __kasan_kmalloc+0xd4/0xd8
[   57.439801]  __kmalloc_cache_noprof+0x16c/0x3c0
[   57.444405]  kasan_bitops_generic+0xa0/0x1c8
[   57.448748]  kunit_try_run_case+0x170/0x3f0
[   57.453003]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.458575]  kthread+0x328/0x630
[   57.461862]  ret_from_fork+0x10/0x20
[   57.465499] 
[   57.467024] The buggy address belongs to the object at ffff000098190200
[   57.467024]  which belongs to the cache kmalloc-16 of size 16
[   57.479507] The buggy address is located 8 bytes inside of
[   57.479507]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   57.491906] 
[   57.493430] The buggy address belongs to the physical page:
[   57.499080] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   57.507180] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   57.513791] page_type: f5(slab)
[   57.516991] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   57.524831] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   57.532665] page dumped because: kasan: bad access detected
[   57.538315] 
[   57.539838] Memory state around the buggy address:
[   57.544696]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.552013]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.559328] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.566640]                       ^
[   57.570185]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.577499]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.584811] ==================================================================
[   57.592191] ==================================================================
[   57.599505] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa48/0xbc0
[   57.608576] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   57.615982] 
[   57.617508] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   57.617538] Tainted: [B]=BAD_PAGE, [N]=TEST
[   57.617546] Hardware name: Thundercomm Dragonboard 845c (DT)
[   57.617557] Call trace:
[   57.617562]  show_stack+0x20/0x38 (C)
[   57.617580]  dump_stack_lvl+0x8c/0xd0
[   57.617598]  print_report+0x118/0x608
[   57.617616]  kasan_report+0xdc/0x128
[   57.617635]  __asan_report_load8_noabort+0x20/0x30
[   57.617650]  kasan_bitops_test_and_modify.constprop.0+0xa48/0xbc0
[   57.617672]  kasan_bitops_generic+0x11c/0x1c8
[   57.617689]  kunit_try_run_case+0x170/0x3f0
[   57.617707]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.617727]  kthread+0x328/0x630
[   57.617740]  ret_from_fork+0x10/0x20
[   57.617757] 
[   57.689768] Allocated by task 370:
[   57.693225]  kasan_save_stack+0x3c/0x68
[   57.697126]  kasan_save_track+0x20/0x40
[   57.701027]  kasan_save_alloc_info+0x40/0x58
[   57.705368]  __kasan_kmalloc+0xd4/0xd8
[   57.709179]  __kmalloc_cache_noprof+0x16c/0x3c0
[   57.713783]  kasan_bitops_generic+0xa0/0x1c8
[   57.718126]  kunit_try_run_case+0x170/0x3f0
[   57.722383]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.727943]  kthread+0x328/0x630
[   57.731230]  ret_from_fork+0x10/0x20
[   57.734865] 
[   57.736390] The buggy address belongs to the object at ffff000098190200
[   57.736390]  which belongs to the cache kmalloc-16 of size 16
[   57.748873] The buggy address is located 8 bytes inside of
[   57.748873]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   57.761271] 
[   57.762795] The buggy address belongs to the physical page:
[   57.768443] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   57.776542] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   57.783153] page_type: f5(slab)
[   57.786355] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   57.794195] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   57.802033] page dumped because: kasan: bad access detected
[   57.807681] 
[   57.809204] Memory state around the buggy address:
[   57.814061]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.821375]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.828688] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.835999]                       ^
[   57.839543]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.846858]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.854170] ==================================================================
[   56.777168] ==================================================================
[   56.784483] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xfc/0xbc0
[   56.793464] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   56.800956] 
[   56.802481] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   56.802513] Tainted: [B]=BAD_PAGE, [N]=TEST
[   56.802521] Hardware name: Thundercomm Dragonboard 845c (DT)
[   56.802533] Call trace:
[   56.802540]  show_stack+0x20/0x38 (C)
[   56.802558]  dump_stack_lvl+0x8c/0xd0
[   56.802577]  print_report+0x118/0x608
[   56.802596]  kasan_report+0xdc/0x128
[   56.802614]  kasan_check_range+0x100/0x1a8
[   56.802635]  __kasan_check_write+0x20/0x30
[   56.802651]  kasan_bitops_test_and_modify.constprop.0+0xfc/0xbc0
[   56.802675]  kasan_bitops_generic+0x11c/0x1c8
[   56.802694]  kunit_try_run_case+0x170/0x3f0
[   56.802713]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.802733]  kthread+0x328/0x630
[   56.802748]  ret_from_fork+0x10/0x20
[   56.802766] 
[   56.878134] Allocated by task 370:
[   56.881592]  kasan_save_stack+0x3c/0x68
[   56.885493]  kasan_save_track+0x20/0x40
[   56.889392]  kasan_save_alloc_info+0x40/0x58
[   56.893733]  __kasan_kmalloc+0xd4/0xd8
[   56.897545]  __kmalloc_cache_noprof+0x16c/0x3c0
[   56.902146]  kasan_bitops_generic+0xa0/0x1c8
[   56.906488]  kunit_try_run_case+0x170/0x3f0
[   56.910745]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.916306]  kthread+0x328/0x630
[   56.919593]  ret_from_fork+0x10/0x20
[   56.923231] 
[   56.924755] The buggy address belongs to the object at ffff000098190200
[   56.924755]  which belongs to the cache kmalloc-16 of size 16
[   56.937236] The buggy address is located 8 bytes inside of
[   56.937236]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   56.949636] 
[   56.951161] The buggy address belongs to the physical page:
[   56.956809] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   56.964910] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   56.971520] page_type: f5(slab)
[   56.974720] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   56.982560] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   56.990394] page dumped because: kasan: bad access detected
[   56.996043] 
[   56.997567] Memory state around the buggy address:
[   57.002427]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.009743]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.017056] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.024370]                       ^
[   57.027914]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.035230]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.042543] ==================================================================
[   58.134445] ==================================================================
[   58.141761] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xacc/0xbc0
[   58.150830] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   58.158236] 
[   58.159762] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   58.159792] Tainted: [B]=BAD_PAGE, [N]=TEST
[   58.159801] Hardware name: Thundercomm Dragonboard 845c (DT)
[   58.159812] Call trace:
[   58.159817]  show_stack+0x20/0x38 (C)
[   58.159834]  dump_stack_lvl+0x8c/0xd0
[   58.159853]  print_report+0x118/0x608
[   58.159872]  kasan_report+0xdc/0x128
[   58.159890]  __asan_report_load8_noabort+0x20/0x30
[   58.159907]  kasan_bitops_test_and_modify.constprop.0+0xacc/0xbc0
[   58.159929]  kasan_bitops_generic+0x11c/0x1c8
[   58.159948]  kunit_try_run_case+0x170/0x3f0
[   58.159965]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.159986]  kthread+0x328/0x630
[   58.160000]  ret_from_fork+0x10/0x20
[   58.160017] 
[   58.232025] Allocated by task 370:
[   58.235484]  kasan_save_stack+0x3c/0x68
[   58.239385]  kasan_save_track+0x20/0x40
[   58.243284]  kasan_save_alloc_info+0x40/0x58
[   58.247624]  __kasan_kmalloc+0xd4/0xd8
[   58.251435]  __kmalloc_cache_noprof+0x16c/0x3c0
[   58.256039]  kasan_bitops_generic+0xa0/0x1c8
[   58.260383]  kunit_try_run_case+0x170/0x3f0
[   58.264640]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.270213]  kthread+0x328/0x630
[   58.273502]  ret_from_fork+0x10/0x20
[   58.277139] 
[   58.278662] The buggy address belongs to the object at ffff000098190200
[   58.278662]  which belongs to the cache kmalloc-16 of size 16
[   58.291144] The buggy address is located 8 bytes inside of
[   58.291144]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   58.303544] 
[   58.305069] The buggy address belongs to the physical page:
[   58.310718] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   58.318817] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   58.325427] page_type: f5(slab)
[   58.328627] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   58.336464] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   58.344300] page dumped because: kasan: bad access detected
[   58.349950] 
[   58.351474] Memory state around the buggy address:
[   58.356333]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.363649]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.370963] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.378275]                       ^
[   58.381819]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.389134]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.396447] ==================================================================
[   57.049920] ==================================================================
[   57.057237] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa00/0xbc0
[   57.066305] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   57.073712] 
[   57.075239] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   57.075269] Tainted: [B]=BAD_PAGE, [N]=TEST
[   57.075278] Hardware name: Thundercomm Dragonboard 845c (DT)
[   57.075288] Call trace:
[   57.075294]  show_stack+0x20/0x38 (C)
[   57.075314]  dump_stack_lvl+0x8c/0xd0
[   57.075333]  print_report+0x118/0x608
[   57.075352]  kasan_report+0xdc/0x128
[   57.075370]  __asan_report_load8_noabort+0x20/0x30
[   57.075386]  kasan_bitops_test_and_modify.constprop.0+0xa00/0xbc0
[   57.075408]  kasan_bitops_generic+0x11c/0x1c8
[   57.075427]  kunit_try_run_case+0x170/0x3f0
[   57.075446]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.075468]  kthread+0x328/0x630
[   57.075481]  ret_from_fork+0x10/0x20
[   57.075498] 
[   57.147496] Allocated by task 370:
[   57.150954]  kasan_save_stack+0x3c/0x68
[   57.154856]  kasan_save_track+0x20/0x40
[   57.158756]  kasan_save_alloc_info+0x40/0x58
[   57.163097]  __kasan_kmalloc+0xd4/0xd8
[   57.166907]  __kmalloc_cache_noprof+0x16c/0x3c0
[   57.171510]  kasan_bitops_generic+0xa0/0x1c8
[   57.175855]  kunit_try_run_case+0x170/0x3f0
[   57.180110]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   57.185674]  kthread+0x328/0x630
[   57.188961]  ret_from_fork+0x10/0x20
[   57.192598] 
[   57.194122] The buggy address belongs to the object at ffff000098190200
[   57.194122]  which belongs to the cache kmalloc-16 of size 16
[   57.206606] The buggy address is located 8 bytes inside of
[   57.206606]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   57.219004] 
[   57.220528] The buggy address belongs to the physical page:
[   57.226178] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   57.234276] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   57.240886] page_type: f5(slab)
[   57.244087] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   57.251925] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   57.259762] page dumped because: kasan: bad access detected
[   57.265410] 
[   57.266933] Memory state around the buggy address:
[   57.271791]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.279105]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   57.286421] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.293733]                       ^
[   57.297278]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.304592]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   57.311906] ==================================================================
[   58.403814] ==================================================================
[   58.411129] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0x334/0xbc0
[   58.420195] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   58.427686] 
[   58.429212] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   58.429239] Tainted: [B]=BAD_PAGE, [N]=TEST
[   58.429248] Hardware name: Thundercomm Dragonboard 845c (DT)
[   58.429258] Call trace:
[   58.429264]  show_stack+0x20/0x38 (C)
[   58.429282]  dump_stack_lvl+0x8c/0xd0
[   58.429301]  print_report+0x118/0x608
[   58.429320]  kasan_report+0xdc/0x128
[   58.429337]  kasan_check_range+0x100/0x1a8
[   58.429357]  __kasan_check_write+0x20/0x30
[   58.429373]  kasan_bitops_test_and_modify.constprop.0+0x334/0xbc0
[   58.429395]  kasan_bitops_generic+0x11c/0x1c8
[   58.429413]  kunit_try_run_case+0x170/0x3f0
[   58.429431]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.429452]  kthread+0x328/0x630
[   58.429466]  ret_from_fork+0x10/0x20
[   58.429485] 
[   58.504918] Allocated by task 370:
[   58.508375]  kasan_save_stack+0x3c/0x68
[   58.512274]  kasan_save_track+0x20/0x40
[   58.516174]  kasan_save_alloc_info+0x40/0x58
[   58.520514]  __kasan_kmalloc+0xd4/0xd8
[   58.524325]  __kmalloc_cache_noprof+0x16c/0x3c0
[   58.528928]  kasan_bitops_generic+0xa0/0x1c8
[   58.533272]  kunit_try_run_case+0x170/0x3f0
[   58.537528]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.543100]  kthread+0x328/0x630
[   58.546388]  ret_from_fork+0x10/0x20
[   58.550024] 
[   58.551548] The buggy address belongs to the object at ffff000098190200
[   58.551548]  which belongs to the cache kmalloc-16 of size 16
[   58.564032] The buggy address is located 8 bytes inside of
[   58.564032]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   58.576431] 
[   58.577955] The buggy address belongs to the physical page:
[   58.583603] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   58.591702] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   58.598313] page_type: f5(slab)
[   58.601514] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   58.609354] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   58.617188] page dumped because: kasan: bad access detected
[   58.622837] 
[   58.624361] Memory state around the buggy address:
[   58.629218]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.636533]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.643847] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.651160]                       ^
[   58.654706]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.662021]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.669334] ==================================================================
[   58.676712] ==================================================================
[   58.684026] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa3c/0xbc0
[   58.693094] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   58.700499] 
[   58.702026] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   58.702056] Tainted: [B]=BAD_PAGE, [N]=TEST
[   58.702064] Hardware name: Thundercomm Dragonboard 845c (DT)
[   58.702075] Call trace:
[   58.702081]  show_stack+0x20/0x38 (C)
[   58.702098]  dump_stack_lvl+0x8c/0xd0
[   58.702118]  print_report+0x118/0x608
[   58.702137]  kasan_report+0xdc/0x128
[   58.702155]  __asan_report_load8_noabort+0x20/0x30
[   58.702171]  kasan_bitops_test_and_modify.constprop.0+0xa3c/0xbc0
[   58.702193]  kasan_bitops_generic+0x11c/0x1c8
[   58.702211]  kunit_try_run_case+0x170/0x3f0
[   58.702229]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.702250]  kthread+0x328/0x630
[   58.702263]  ret_from_fork+0x10/0x20
[   58.702280] 
[   58.774303] Allocated by task 370:
[   58.777760]  kasan_save_stack+0x3c/0x68
[   58.781659]  kasan_save_track+0x20/0x40
[   58.785559]  kasan_save_alloc_info+0x40/0x58
[   58.789898]  __kasan_kmalloc+0xd4/0xd8
[   58.793711]  __kmalloc_cache_noprof+0x16c/0x3c0
[   58.798316]  kasan_bitops_generic+0xa0/0x1c8
[   58.802659]  kunit_try_run_case+0x170/0x3f0
[   58.806916]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.812476]  kthread+0x328/0x630
[   58.815764]  ret_from_fork+0x10/0x20
[   58.819402] 
[   58.820927] The buggy address belongs to the object at ffff000098190200
[   58.820927]  which belongs to the cache kmalloc-16 of size 16
[   58.833408] The buggy address is located 8 bytes inside of
[   58.833408]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   58.845806] 
[   58.847332] The buggy address belongs to the physical page:
[   58.852979] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   58.861078] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   58.867688] page_type: f5(slab)
[   58.870891] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   58.878729] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   58.886563] page dumped because: kasan: bad access detected
[   58.892212] 
[   58.893737] Memory state around the buggy address:
[   58.898594]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.905909]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   58.913226] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.920539]                       ^
[   58.924084]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.931400]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.938711] ==================================================================
[   58.946076] ==================================================================
[   58.953391] BUG: KASAN: slab-out-of-bounds in kasan_bitops_test_and_modify.constprop.0+0xa84/0xbc0
[   58.962460] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   58.969862] 
[   58.971390] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   58.971419] Tainted: [B]=BAD_PAGE, [N]=TEST
[   58.971427] Hardware name: Thundercomm Dragonboard 845c (DT)
[   58.971437] Call trace:
[   58.971444]  show_stack+0x20/0x38 (C)
[   58.971462]  dump_stack_lvl+0x8c/0xd0
[   58.971480]  print_report+0x118/0x608
[   58.971499]  kasan_report+0xdc/0x128
[   58.971516]  __asan_report_load8_noabort+0x20/0x30
[   58.971533]  kasan_bitops_test_and_modify.constprop.0+0xa84/0xbc0
[   58.971555]  kasan_bitops_generic+0x11c/0x1c8
[   58.971572]  kunit_try_run_case+0x170/0x3f0
[   58.971589]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   58.971610]  kthread+0x328/0x630
[   58.971623]  ret_from_fork+0x10/0x20
[   58.971640] 
[   59.043645] Allocated by task 370:
[   59.047103]  kasan_save_stack+0x3c/0x68
[   59.051003]  kasan_save_track+0x20/0x40
[   59.054901]  kasan_save_alloc_info+0x40/0x58
[   59.059241]  __kasan_kmalloc+0xd4/0xd8
[   59.063053]  __kmalloc_cache_noprof+0x16c/0x3c0
[   59.067656]  kasan_bitops_generic+0xa0/0x1c8
[   59.071998]  kunit_try_run_case+0x170/0x3f0
[   59.076252]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   59.081822]  kthread+0x328/0x630
[   59.085108]  ret_from_fork+0x10/0x20
[   59.088744] 
[   59.090268] The buggy address belongs to the object at ffff000098190200
[   59.090268]  which belongs to the cache kmalloc-16 of size 16
[   59.102752] The buggy address is located 8 bytes inside of
[   59.102752]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   59.115149] 
[   59.116674] The buggy address belongs to the physical page:
[   59.122323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   59.130422] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   59.137031] page_type: f5(slab)
[   59.140233] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   59.148073] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   59.155909] page dumped because: kasan: bad access detected
[   59.161558] 
[   59.163082] Memory state around the buggy address:
[   59.167940]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   59.175256]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   59.182572] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.189884]                       ^
[   59.193429]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.200743]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   59.208057] ==================================================================

[   54.887139] ==================================================================
[   54.894452] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa80/0xbc0
[   54.902736] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   54.910144] 
[   54.911677] CPU: 6 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   54.911707] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.911717] Hardware name: Thundercomm Dragonboard 845c (DT)
[   54.911727] Call trace:
[   54.911733]  show_stack+0x20/0x38 (C)
[   54.911751]  dump_stack_lvl+0x8c/0xd0
[   54.911770]  print_report+0x118/0x608
[   54.911790]  kasan_report+0xdc/0x128
[   54.911809]  __asan_report_load8_noabort+0x20/0x30
[   54.911828]  kasan_bitops_modify.constprop.0+0xa80/0xbc0
[   54.911848]  kasan_bitops_generic+0x110/0x1c8
[   54.911866]  kunit_try_run_case+0x170/0x3f0
[   54.911885]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.911907]  kthread+0x328/0x630
[   54.911920]  ret_from_fork+0x10/0x20
[   54.911937] 
[   54.983160] Allocated by task 370:
[   54.986616]  kasan_save_stack+0x3c/0x68
[   54.990516]  kasan_save_track+0x20/0x40
[   54.994421]  kasan_save_alloc_info+0x40/0x58
[   54.998762]  __kasan_kmalloc+0xd4/0xd8
[   55.002581]  __kmalloc_cache_noprof+0x16c/0x3c0
[   55.007181]  kasan_bitops_generic+0xa0/0x1c8
[   55.011519]  kunit_try_run_case+0x170/0x3f0
[   55.015771]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.021340]  kthread+0x328/0x630
[   55.024624]  ret_from_fork+0x10/0x20
[   55.028260] 
[   55.029783] The buggy address belongs to the object at ffff000098190200
[   55.029783]  which belongs to the cache kmalloc-16 of size 16
[   55.042267] The buggy address is located 8 bytes inside of
[   55.042267]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   55.054657] 
[   55.056188] The buggy address belongs to the physical page:
[   55.061836] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   55.069936] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   55.076552] page_type: f5(slab)
[   55.079749] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   55.087594] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   55.095433] page dumped because: kasan: bad access detected
[   55.101080] 
[   55.102603] Memory state around the buggy address:
[   55.107454]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.114765]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.122074] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.129382]                       ^
[   55.132922]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.140232]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.147541] ==================================================================
[   55.154969] ==================================================================
[   55.162283] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x2b4/0xbc0
[   55.170565] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   55.178049] 
[   55.179585] CPU: 6 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   55.179615] Tainted: [B]=BAD_PAGE, [N]=TEST
[   55.179625] Hardware name: Thundercomm Dragonboard 845c (DT)
[   55.179636] Call trace:
[   55.179643]  show_stack+0x20/0x38 (C)
[   55.179660]  dump_stack_lvl+0x8c/0xd0
[   55.179679]  print_report+0x118/0x608
[   55.179698]  kasan_report+0xdc/0x128
[   55.179716]  kasan_check_range+0x100/0x1a8
[   55.179736]  __kasan_check_write+0x20/0x30
[   55.179752]  kasan_bitops_modify.constprop.0+0x2b4/0xbc0
[   55.179773]  kasan_bitops_generic+0x110/0x1c8
[   55.179790]  kunit_try_run_case+0x170/0x3f0
[   55.179809]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.179829]  kthread+0x328/0x630
[   55.179842]  ret_from_fork+0x10/0x20
[   55.179860] 
[   55.254493] Allocated by task 370:
[   55.257946]  kasan_save_stack+0x3c/0x68
[   55.261845]  kasan_save_track+0x20/0x40
[   55.265751]  kasan_save_alloc_info+0x40/0x58
[   55.270089]  __kasan_kmalloc+0xd4/0xd8
[   55.273907]  __kmalloc_cache_noprof+0x16c/0x3c0
[   55.278509]  kasan_bitops_generic+0xa0/0x1c8
[   55.282847]  kunit_try_run_case+0x170/0x3f0
[   55.287100]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.292668]  kthread+0x328/0x630
[   55.295951]  ret_from_fork+0x10/0x20
[   55.299587] 
[   55.301110] The buggy address belongs to the object at ffff000098190200
[   55.301110]  which belongs to the cache kmalloc-16 of size 16
[   55.313593] The buggy address is located 8 bytes inside of
[   55.313593]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   55.325983] 
[   55.327514] The buggy address belongs to the physical page:
[   55.333159] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   55.341261] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   55.347876] page_type: f5(slab)
[   55.351077] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   55.358921] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   55.366760] page dumped because: kasan: bad access detected
[   55.372403] 
[   55.373925] Memory state around the buggy address:
[   55.378780]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.386089]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.393397] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.400702]                       ^
[   55.404244]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.411554]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.418863] ==================================================================
[   56.238014] ==================================================================
[   56.245335] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x3b0/0xbc0
[   56.253618] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   56.261106] 
[   56.262634] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   56.262663] Tainted: [B]=BAD_PAGE, [N]=TEST
[   56.262672] Hardware name: Thundercomm Dragonboard 845c (DT)
[   56.262685] Call trace:
[   56.262691]  show_stack+0x20/0x38 (C)
[   56.262709]  dump_stack_lvl+0x8c/0xd0
[   56.262728]  print_report+0x118/0x608
[   56.262746]  kasan_report+0xdc/0x128
[   56.262765]  kasan_check_range+0x100/0x1a8
[   56.262785]  __kasan_check_write+0x20/0x30
[   56.262801]  kasan_bitops_modify.constprop.0+0x3b0/0xbc0
[   56.262823]  kasan_bitops_generic+0x110/0x1c8
[   56.262840]  kunit_try_run_case+0x170/0x3f0
[   56.262858]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.262878]  kthread+0x328/0x630
[   56.262892]  ret_from_fork+0x10/0x20
[   56.262911] 
[   56.337562] Allocated by task 370:
[   56.341019]  kasan_save_stack+0x3c/0x68
[   56.344919]  kasan_save_track+0x20/0x40
[   56.348818]  kasan_save_alloc_info+0x40/0x58
[   56.353158]  __kasan_kmalloc+0xd4/0xd8
[   56.356969]  __kmalloc_cache_noprof+0x16c/0x3c0
[   56.361572]  kasan_bitops_generic+0xa0/0x1c8
[   56.365915]  kunit_try_run_case+0x170/0x3f0
[   56.370172]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.375743]  kthread+0x328/0x630
[   56.379030]  ret_from_fork+0x10/0x20
[   56.382667] 
[   56.384190] The buggy address belongs to the object at ffff000098190200
[   56.384190]  which belongs to the cache kmalloc-16 of size 16
[   56.396673] The buggy address is located 8 bytes inside of
[   56.396673]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   56.409072] 
[   56.410598] The buggy address belongs to the physical page:
[   56.416246] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   56.424343] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   56.430954] page_type: f5(slab)
[   56.434155] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   56.441993] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   56.449830] page dumped because: kasan: bad access detected
[   56.455478] 
[   56.457002] Memory state around the buggy address:
[   56.461858]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.469173]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.476489] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.483803]                       ^
[   56.487346]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.494662]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.501976] ==================================================================
[   55.698846] ==================================================================
[   55.706168] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xaec/0xbc0
[   55.714455] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   55.721865] 
[   55.723402] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   55.723433] Tainted: [B]=BAD_PAGE, [N]=TEST
[   55.723442] Hardware name: Thundercomm Dragonboard 845c (DT)
[   55.723454] Call trace:
[   55.723460]  show_stack+0x20/0x38 (C)
[   55.723480]  dump_stack_lvl+0x8c/0xd0
[   55.723500]  print_report+0x118/0x608
[   55.723520]  kasan_report+0xdc/0x128
[   55.723538]  __asan_report_load8_noabort+0x20/0x30
[   55.723555]  kasan_bitops_modify.constprop.0+0xaec/0xbc0
[   55.723577]  kasan_bitops_generic+0x110/0x1c8
[   55.723595]  kunit_try_run_case+0x170/0x3f0
[   55.723614]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.723636]  kthread+0x328/0x630
[   55.723650]  ret_from_fork+0x10/0x20
[   55.723668] 
[   55.794876] Allocated by task 370:
[   55.798330]  kasan_save_stack+0x3c/0x68
[   55.802237]  kasan_save_track+0x20/0x40
[   55.806142]  kasan_save_alloc_info+0x40/0x58
[   55.810480]  __kasan_kmalloc+0xd4/0xd8
[   55.814298]  __kmalloc_cache_noprof+0x16c/0x3c0
[   55.818899]  kasan_bitops_generic+0xa0/0x1c8
[   55.823235]  kunit_try_run_case+0x170/0x3f0
[   55.827484]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.833052]  kthread+0x328/0x630
[   55.836335]  ret_from_fork+0x10/0x20
[   55.839968] 
[   55.841493] The buggy address belongs to the object at ffff000098190200
[   55.841493]  which belongs to the cache kmalloc-16 of size 16
[   55.853975] The buggy address is located 8 bytes inside of
[   55.853975]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   55.866376] 
[   55.867906] The buggy address belongs to the physical page:
[   55.873552] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   55.881653] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   55.888269] page_type: f5(slab)
[   55.891464] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   55.899310] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   55.907147] page dumped because: kasan: bad access detected
[   55.912790] 
[   55.914315] Memory state around the buggy address:
[   55.919175]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.926485]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.933806] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.941121]                       ^
[   55.944665]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.951983]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.959290] ==================================================================
[   55.426466] ==================================================================
[   55.433799] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x320/0xbc0
[   55.442093] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   55.449593] 
[   55.451127] CPU: 2 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   55.451158] Tainted: [B]=BAD_PAGE, [N]=TEST
[   55.451166] Hardware name: Thundercomm Dragonboard 845c (DT)
[   55.451179] Call trace:
[   55.451185]  show_stack+0x20/0x38 (C)
[   55.451203]  dump_stack_lvl+0x8c/0xd0
[   55.451224]  print_report+0x118/0x608
[   55.451244]  kasan_report+0xdc/0x128
[   55.451264]  kasan_check_range+0x100/0x1a8
[   55.451286]  __kasan_check_write+0x20/0x30
[   55.451304]  kasan_bitops_modify.constprop.0+0x320/0xbc0
[   55.451326]  kasan_bitops_generic+0x110/0x1c8
[   55.451345]  kunit_try_run_case+0x170/0x3f0
[   55.451365]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.451388]  kthread+0x328/0x630
[   55.451404]  ret_from_fork+0x10/0x20
[   55.451422] 
[   55.526115] Allocated by task 370:
[   55.529583]  kasan_save_stack+0x3c/0x68
[   55.533492]  kasan_save_track+0x20/0x40
[   55.537397]  kasan_save_alloc_info+0x40/0x58
[   55.541743]  __kasan_kmalloc+0xd4/0xd8
[   55.545561]  __kmalloc_cache_noprof+0x16c/0x3c0
[   55.550168]  kasan_bitops_generic+0xa0/0x1c8
[   55.554517]  kunit_try_run_case+0x170/0x3f0
[   55.558778]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.564349]  kthread+0x328/0x630
[   55.567639]  ret_from_fork+0x10/0x20
[   55.571283] 
[   55.572814] The buggy address belongs to the object at ffff000098190200
[   55.572814]  which belongs to the cache kmalloc-16 of size 16
[   55.585305] The buggy address is located 8 bytes inside of
[   55.585305]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   55.597712] 
[   55.599243] The buggy address belongs to the physical page:
[   55.604889] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   55.612997] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   55.619613] page_type: f5(slab)
[   55.622814] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   55.630663] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   55.638507] page dumped because: kasan: bad access detected
[   55.644155] 
[   55.645686] Memory state around the buggy address:
[   55.650545]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.657862]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   55.665179] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.672492]                       ^
[   55.676046]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.683363]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.690676] ==================================================================
[   54.071719] ==================================================================
[   54.082931] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x100/0xbc0
[   54.091226] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   54.098720] 
[   54.100261] CPU: 3 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   54.100294] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.100305] Hardware name: Thundercomm Dragonboard 845c (DT)
[   54.100318] Call trace:
[   54.100326]  show_stack+0x20/0x38 (C)
[   54.100345]  dump_stack_lvl+0x8c/0xd0
[   54.100366]  print_report+0x118/0x608
[   54.100388]  kasan_report+0xdc/0x128
[   54.100408]  kasan_check_range+0x100/0x1a8
[   54.100430]  __kasan_check_write+0x20/0x30
[   54.100447]  kasan_bitops_modify.constprop.0+0x100/0xbc0
[   54.100468]  kasan_bitops_generic+0x110/0x1c8
[   54.100488]  kunit_try_run_case+0x170/0x3f0
[   54.100507]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.100529]  kthread+0x328/0x630
[   54.100545]  ret_from_fork+0x10/0x20
[   54.100566] 
[   54.175268] Allocated by task 370:
[   54.178732]  kasan_save_stack+0x3c/0x68
[   54.182645]  kasan_save_track+0x20/0x40
[   54.186558]  kasan_save_alloc_info+0x40/0x58
[   54.190898]  __kasan_kmalloc+0xd4/0xd8
[   54.194713]  __kmalloc_cache_noprof+0x16c/0x3c0
[   54.199325]  kasan_bitops_generic+0xa0/0x1c8
[   54.203667]  kunit_try_run_case+0x170/0x3f0
[   54.207923]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.213502]  kthread+0x328/0x630
[   54.216797]  ret_from_fork+0x10/0x20
[   54.220437] 
[   54.221971] The buggy address belongs to the object at ffff000098190200
[   54.221971]  which belongs to the cache kmalloc-16 of size 16
[   54.234457] The buggy address is located 8 bytes inside of
[   54.234457]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   54.246860] 
[   54.248397] The buggy address belongs to the physical page:
[   54.254048] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   54.262155] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   54.268772] page_type: f5(slab)
[   54.271980] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   54.279828] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   54.287674] page dumped because: kasan: bad access detected
[   54.293326] 
[   54.294857] Memory state around the buggy address:
[   54.299719]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.307037]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.314355] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.321672]                       ^
[   54.325222]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.332540]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.339855] ==================================================================
[   54.347272] ==================================================================
[   54.354590] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa44/0xbc0
[   54.362875] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   54.370280] 
[   54.371822] CPU: 3 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   54.371854] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.371863] Hardware name: Thundercomm Dragonboard 845c (DT)
[   54.371875] Call trace:
[   54.371884]  show_stack+0x20/0x38 (C)
[   54.371904]  dump_stack_lvl+0x8c/0xd0
[   54.371924]  print_report+0x118/0x608
[   54.371944]  kasan_report+0xdc/0x128
[   54.371965]  __asan_report_load8_noabort+0x20/0x30
[   54.371984]  kasan_bitops_modify.constprop.0+0xa44/0xbc0
[   54.372006]  kasan_bitops_generic+0x110/0x1c8
[   54.372027]  kunit_try_run_case+0x170/0x3f0
[   54.372047]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.372072]  kthread+0x328/0x630
[   54.372087]  ret_from_fork+0x10/0x20
[   54.372106] 
[   54.443352] Allocated by task 370:
[   54.446819]  kasan_save_stack+0x3c/0x68
[   54.450731]  kasan_save_track+0x20/0x40
[   54.454644]  kasan_save_alloc_info+0x40/0x58
[   54.458984]  __kasan_kmalloc+0xd4/0xd8
[   54.462798]  __kmalloc_cache_noprof+0x16c/0x3c0
[   54.467411]  kasan_bitops_generic+0xa0/0x1c8
[   54.471751]  kunit_try_run_case+0x170/0x3f0
[   54.476007]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.481586]  kthread+0x328/0x630
[   54.484879]  ret_from_fork+0x10/0x20
[   54.488519] 
[   54.490051] The buggy address belongs to the object at ffff000098190200
[   54.490051]  which belongs to the cache kmalloc-16 of size 16
[   54.502539] The buggy address is located 8 bytes inside of
[   54.502539]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   54.514941] 
[   54.516479] The buggy address belongs to the physical page:
[   54.522130] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   54.530239] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   54.536853] page_type: f5(slab)
[   54.540059] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   54.547909] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   54.555753] page dumped because: kasan: bad access detected
[   54.561404] 
[   54.562934] Memory state around the buggy address:
[   54.567795]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.575115]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.582434] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.589749]                       ^
[   54.593299]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.600616]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.607931] ==================================================================
[   55.966700] ==================================================================
[   55.974024] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x344/0xbc0
[   55.982306] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   55.989801] 
[   55.991334] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   55.991363] Tainted: [B]=BAD_PAGE, [N]=TEST
[   55.991371] Hardware name: Thundercomm Dragonboard 845c (DT)
[   55.991382] Call trace:
[   55.991389]  show_stack+0x20/0x38 (C)
[   55.991407]  dump_stack_lvl+0x8c/0xd0
[   55.991426]  print_report+0x118/0x608
[   55.991445]  kasan_report+0xdc/0x128
[   55.991462]  kasan_check_range+0x100/0x1a8
[   55.991482]  __kasan_check_write+0x20/0x30
[   55.991497]  kasan_bitops_modify.constprop.0+0x344/0xbc0
[   55.991516]  kasan_bitops_generic+0x110/0x1c8
[   55.991535]  kunit_try_run_case+0x170/0x3f0
[   55.991554]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   55.991576]  kthread+0x328/0x630
[   55.991590]  ret_from_fork+0x10/0x20
[   55.991606] 
[   56.066247] Allocated by task 370:
[   56.069700]  kasan_save_stack+0x3c/0x68
[   56.073597]  kasan_save_track+0x20/0x40
[   56.077503]  kasan_save_alloc_info+0x40/0x58
[   56.081840]  __kasan_kmalloc+0xd4/0xd8
[   56.085657]  __kmalloc_cache_noprof+0x16c/0x3c0
[   56.090260]  kasan_bitops_generic+0xa0/0x1c8
[   56.094598]  kunit_try_run_case+0x170/0x3f0
[   56.098851]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.104413]  kthread+0x328/0x630
[   56.107694]  ret_from_fork+0x10/0x20
[   56.111325] 
[   56.112859] The buggy address belongs to the object at ffff000098190200
[   56.112859]  which belongs to the cache kmalloc-16 of size 16
[   56.125340] The buggy address is located 8 bytes inside of
[   56.125340]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   56.137737] 
[   56.139270] The buggy address belongs to the physical page:
[   56.144913] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   56.153014] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   56.159626] page_type: f5(slab)
[   56.162829] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   56.170669] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   56.178506] page dumped because: kasan: bad access detected
[   56.184149] 
[   56.185672] Memory state around the buggy address:
[   56.190524]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.197842]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.205160] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.212467]                       ^
[   56.216017]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.223335]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.230642] ==================================================================
[   56.509370] ==================================================================
[   56.516685] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0xa20/0xbc0
[   56.524962] Read of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   56.532369] 
[   56.533896] CPU: 5 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   56.533926] Tainted: [B]=BAD_PAGE, [N]=TEST
[   56.533934] Hardware name: Thundercomm Dragonboard 845c (DT)
[   56.533947] Call trace:
[   56.533954]  show_stack+0x20/0x38 (C)
[   56.533971]  dump_stack_lvl+0x8c/0xd0
[   56.533990]  print_report+0x118/0x608
[   56.534009]  kasan_report+0xdc/0x128
[   56.534028]  __asan_report_load8_noabort+0x20/0x30
[   56.534045]  kasan_bitops_modify.constprop.0+0xa20/0xbc0
[   56.534065]  kasan_bitops_generic+0x110/0x1c8
[   56.534082]  kunit_try_run_case+0x170/0x3f0
[   56.534101]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.534121]  kthread+0x328/0x630
[   56.534135]  ret_from_fork+0x10/0x20
[   56.534151] 
[   56.605378] Allocated by task 370:
[   56.608836]  kasan_save_stack+0x3c/0x68
[   56.612735]  kasan_save_track+0x20/0x40
[   56.616634]  kasan_save_alloc_info+0x40/0x58
[   56.620976]  __kasan_kmalloc+0xd4/0xd8
[   56.624788]  __kmalloc_cache_noprof+0x16c/0x3c0
[   56.629391]  kasan_bitops_generic+0xa0/0x1c8
[   56.633736]  kunit_try_run_case+0x170/0x3f0
[   56.637992]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   56.643562]  kthread+0x328/0x630
[   56.646849]  ret_from_fork+0x10/0x20
[   56.650487] 
[   56.652019] The buggy address belongs to the object at ffff000098190200
[   56.652019]  which belongs to the cache kmalloc-16 of size 16
[   56.664500] The buggy address is located 8 bytes inside of
[   56.664500]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   56.676899] 
[   56.678424] The buggy address belongs to the physical page:
[   56.684071] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   56.692169] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   56.698779] page_type: f5(slab)
[   56.701979] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   56.709819] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   56.717656] page dumped because: kasan: bad access detected
[   56.723303] 
[   56.724827] Memory state around the buggy address:
[   56.729685]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.737000]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   56.744316] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.751629]                       ^
[   56.755174]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.762488]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   56.769799] ==================================================================
[   54.615771] ==================================================================
[   54.623096] BUG: KASAN: slab-out-of-bounds in kasan_bitops_modify.constprop.0+0x1dc/0xbc0
[   54.631379] Write of size 8 at addr ffff000098190208 by task kunit_try_catch/370
[   54.638871] 
[   54.640407] CPU: 6 UID: 0 PID: 370 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   54.640440] Tainted: [B]=BAD_PAGE, [N]=TEST
[   54.640449] Hardware name: Thundercomm Dragonboard 845c (DT)
[   54.640461] Call trace:
[   54.640468]  show_stack+0x20/0x38 (C)
[   54.640487]  dump_stack_lvl+0x8c/0xd0
[   54.640508]  print_report+0x118/0x608
[   54.640528]  kasan_report+0xdc/0x128
[   54.640547]  kasan_check_range+0x100/0x1a8
[   54.640569]  __kasan_check_write+0x20/0x30
[   54.640584]  kasan_bitops_modify.constprop.0+0x1dc/0xbc0
[   54.640605]  kasan_bitops_generic+0x110/0x1c8
[   54.640622]  kunit_try_run_case+0x170/0x3f0
[   54.640640]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.640661]  kthread+0x328/0x630
[   54.640674]  ret_from_fork+0x10/0x20
[   54.640692] 
[   54.715367] Allocated by task 370:
[   54.718829]  kasan_save_stack+0x3c/0x68
[   54.722737]  kasan_save_track+0x20/0x40
[   54.726634]  kasan_save_alloc_info+0x40/0x58
[   54.730970]  __kasan_kmalloc+0xd4/0xd8
[   54.734780]  __kmalloc_cache_noprof+0x16c/0x3c0
[   54.739378]  kasan_bitops_generic+0xa0/0x1c8
[   54.743717]  kunit_try_run_case+0x170/0x3f0
[   54.747973]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   54.753541]  kthread+0x328/0x630
[   54.756827]  ret_from_fork+0x10/0x20
[   54.760461] 
[   54.761986] The buggy address belongs to the object at ffff000098190200
[   54.761986]  which belongs to the cache kmalloc-16 of size 16
[   54.774463] The buggy address is located 8 bytes inside of
[   54.774463]  allocated 9-byte region [ffff000098190200, ffff000098190209)
[   54.786862] 
[   54.788397] The buggy address belongs to the physical page:
[   54.794042] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   54.802145] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   54.808758] page_type: f5(slab)
[   54.811960] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   54.819807] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   54.827650] page dumped because: kasan: bad access detected
[   54.833295] 
[   54.834818] Memory state around the buggy address:
[   54.839683]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.846995]  ffff000098190180: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   54.854305] >ffff000098190200: 00 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.861611]                       ^
[   54.865152]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.872464]  ffff000098190300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   54.879770] ==================================================================

[   53.762163] ==================================================================
[   53.769481] BUG: KASAN: slab-use-after-free in strnlen+0x80/0x88
[   53.775575] Read of size 1 at addr ffff000085584210 by task kunit_try_catch/368
[   53.782976] 
[   53.784509] CPU: 6 UID: 0 PID: 368 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   53.784539] Tainted: [B]=BAD_PAGE, [N]=TEST
[   53.784549] Hardware name: Thundercomm Dragonboard 845c (DT)
[   53.784559] Call trace:
[   53.784565]  show_stack+0x20/0x38 (C)
[   53.784583]  dump_stack_lvl+0x8c/0xd0
[   53.784601]  print_report+0x118/0x608
[   53.784620]  kasan_report+0xdc/0x128
[   53.784641]  __asan_report_load1_noabort+0x20/0x30
[   53.784658]  strnlen+0x80/0x88
[   53.784674]  kasan_strings+0x478/0xb00
[   53.784689]  kunit_try_run_case+0x170/0x3f0
[   53.784708]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.784729]  kthread+0x328/0x630
[   53.784742]  ret_from_fork+0x10/0x20
[   53.784760] 
[   53.853083] Allocated by task 368:
[   53.856536]  kasan_save_stack+0x3c/0x68
[   53.860434]  kasan_save_track+0x20/0x40
[   53.864329]  kasan_save_alloc_info+0x40/0x58
[   53.868665]  __kasan_kmalloc+0xd4/0xd8
[   53.872476]  __kmalloc_cache_noprof+0x16c/0x3c0
[   53.877078]  kasan_strings+0xc8/0xb00
[   53.880807]  kunit_try_run_case+0x170/0x3f0
[   53.885060]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.890630]  kthread+0x328/0x630
[   53.893914]  ret_from_fork+0x10/0x20
[   53.897549] 
[   53.899082] Freed by task 368:
[   53.902190]  kasan_save_stack+0x3c/0x68
[   53.906095]  kasan_save_track+0x20/0x40
[   53.910002]  kasan_save_free_info+0x4c/0x78
[   53.914254]  __kasan_slab_free+0x6c/0x98
[   53.918250]  kfree+0x214/0x3c8
[   53.921371]  kasan_strings+0x24c/0xb00
[   53.925182]  kunit_try_run_case+0x170/0x3f0
[   53.929436]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.935006]  kthread+0x328/0x630
[   53.938292]  ret_from_fork+0x10/0x20
[   53.941925] 
[   53.943460] The buggy address belongs to the object at ffff000085584200
[   53.943460]  which belongs to the cache kmalloc-32 of size 32
[   53.955944] The buggy address is located 16 bytes inside of
[   53.955944]  freed 32-byte region [ffff000085584200, ffff000085584220)
[   53.968161] 
[   53.969686] The buggy address belongs to the physical page:
[   53.975327] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105584
[   53.983433] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   53.990052] page_type: f5(slab)
[   53.993250] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000
[   54.001095] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   54.008936] page dumped because: kasan: bad access detected
[   54.014581] 
[   54.016113] Memory state around the buggy address:
[   54.020968]  ffff000085584100: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   54.028277]  ffff000085584180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   54.035596] >ffff000085584200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   54.042908]                          ^
[   54.046711]  ffff000085584280: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   54.054029]  ffff000085584300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   54.061336] ==================================================================

[   53.455848] ==================================================================
[   53.463159] BUG: KASAN: slab-use-after-free in strlen+0xa8/0xb0
[   53.469159] Read of size 1 at addr ffff000085584210 by task kunit_try_catch/368
[   53.476567] 
[   53.478093] CPU: 6 UID: 0 PID: 368 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   53.478123] Tainted: [B]=BAD_PAGE, [N]=TEST
[   53.478133] Hardware name: Thundercomm Dragonboard 845c (DT)
[   53.478144] Call trace:
[   53.478152]  show_stack+0x20/0x38 (C)
[   53.478170]  dump_stack_lvl+0x8c/0xd0
[   53.478189]  print_report+0x118/0x608
[   53.478211]  kasan_report+0xdc/0x128
[   53.478230]  __asan_report_load1_noabort+0x20/0x30
[   53.478247]  strlen+0xa8/0xb0
[   53.478262]  kasan_strings+0x418/0xb00
[   53.478278]  kunit_try_run_case+0x170/0x3f0
[   53.478296]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.478318]  kthread+0x328/0x630
[   53.478332]  ret_from_fork+0x10/0x20
[   53.478350] 
[   53.546572] Allocated by task 368:
[   53.550025]  kasan_save_stack+0x3c/0x68
[   53.553932]  kasan_save_track+0x20/0x40
[   53.557838]  kasan_save_alloc_info+0x40/0x58
[   53.562177]  __kasan_kmalloc+0xd4/0xd8
[   53.565994]  __kmalloc_cache_noprof+0x16c/0x3c0
[   53.570594]  kasan_strings+0xc8/0xb00
[   53.574325]  kunit_try_run_case+0x170/0x3f0
[   53.578579]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.584140]  kthread+0x328/0x630
[   53.587426]  ret_from_fork+0x10/0x20
[   53.591063] 
[   53.592596] Freed by task 368:
[   53.595701]  kasan_save_stack+0x3c/0x68
[   53.599605]  kasan_save_track+0x20/0x40
[   53.603513]  kasan_save_free_info+0x4c/0x78
[   53.607760]  __kasan_slab_free+0x6c/0x98
[   53.611755]  kfree+0x214/0x3c8
[   53.614871]  kasan_strings+0x24c/0xb00
[   53.618687]  kunit_try_run_case+0x170/0x3f0
[   53.622938]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.628501]  kthread+0x328/0x630
[   53.631785]  ret_from_fork+0x10/0x20
[   53.635419] 
[   53.636942] The buggy address belongs to the object at ffff000085584200
[   53.636942]  which belongs to the cache kmalloc-32 of size 32
[   53.649424] The buggy address is located 16 bytes inside of
[   53.649424]  freed 32-byte region [ffff000085584200, ffff000085584220)
[   53.661649] 
[   53.663182] The buggy address belongs to the physical page:
[   53.668824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105584
[   53.676926] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   53.683539] page_type: f5(slab)
[   53.686743] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000
[   53.694583] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   53.702423] page dumped because: kasan: bad access detected
[   53.708065] 
[   53.709588] Memory state around the buggy address:
[   53.714444]  ffff000085584100: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   53.721762]  ffff000085584180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.729072] >ffff000085584200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.736379]                          ^
[   53.740190]  ffff000085584280: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   53.747498]  ffff000085584300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.754808] ==================================================================

[   53.151711] ==================================================================
[   53.159042] BUG: KASAN: slab-use-after-free in kasan_strings+0x95c/0xb00
[   53.165837] Read of size 1 at addr ffff000085584210 by task kunit_try_catch/368
[   53.173239] 
[   53.174768] CPU: 6 UID: 0 PID: 368 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   53.174799] Tainted: [B]=BAD_PAGE, [N]=TEST
[   53.174809] Hardware name: Thundercomm Dragonboard 845c (DT)
[   53.174821] Call trace:
[   53.174829]  show_stack+0x20/0x38 (C)
[   53.174849]  dump_stack_lvl+0x8c/0xd0
[   53.174871]  print_report+0x118/0x608
[   53.174891]  kasan_report+0xdc/0x128
[   53.174909]  __asan_report_load1_noabort+0x20/0x30
[   53.174926]  kasan_strings+0x95c/0xb00
[   53.174943]  kunit_try_run_case+0x170/0x3f0
[   53.174960]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.174981]  kthread+0x328/0x630
[   53.174994]  ret_from_fork+0x10/0x20
[   53.175010] 
[   53.240235] Allocated by task 368:
[   53.243692]  kasan_save_stack+0x3c/0x68
[   53.247600]  kasan_save_track+0x20/0x40
[   53.251506]  kasan_save_alloc_info+0x40/0x58
[   53.255843]  __kasan_kmalloc+0xd4/0xd8
[   53.259658]  __kmalloc_cache_noprof+0x16c/0x3c0
[   53.264263]  kasan_strings+0xc8/0xb00
[   53.267981]  kunit_try_run_case+0x170/0x3f0
[   53.272234]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.277802]  kthread+0x328/0x630
[   53.281085]  ret_from_fork+0x10/0x20
[   53.284729] 
[   53.286253] Freed by task 368:
[   53.289360]  kasan_save_stack+0x3c/0x68
[   53.293268]  kasan_save_track+0x20/0x40
[   53.297172]  kasan_save_free_info+0x4c/0x78
[   53.301422]  __kasan_slab_free+0x6c/0x98
[   53.305417]  kfree+0x214/0x3c8
[   53.308526]  kasan_strings+0x24c/0xb00
[   53.312342]  kunit_try_run_case+0x170/0x3f0
[   53.316592]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.322159]  kthread+0x328/0x630
[   53.325442]  ret_from_fork+0x10/0x20
[   53.329076] 
[   53.330602] The buggy address belongs to the object at ffff000085584200
[   53.330602]  which belongs to the cache kmalloc-32 of size 32
[   53.343085] The buggy address is located 16 bytes inside of
[   53.343085]  freed 32-byte region [ffff000085584200, ffff000085584220)
[   53.355306] 
[   53.356830] The buggy address belongs to the physical page:
[   53.362474] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105584
[   53.370577] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   53.377191] page_type: f5(slab)
[   53.380388] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000
[   53.388233] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   53.396073] page dumped because: kasan: bad access detected
[   53.401719] 
[   53.403253] Memory state around the buggy address:
[   53.408105]  ffff000085584100: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   53.415414]  ffff000085584180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.422723] >ffff000085584200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.430040]                          ^
[   53.433853]  ffff000085584280: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   53.441168]  ffff000085584300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.448475] ==================================================================

[   52.827617] ==================================================================
[   52.851775] BUG: KASAN: slab-use-after-free in strcmp+0xc0/0xc8
[   52.857783] Read of size 1 at addr ffff000085584210 by task kunit_try_catch/368
[   52.865188] 
[   52.866726] CPU: 3 UID: 0 PID: 368 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   52.866758] Tainted: [B]=BAD_PAGE, [N]=TEST
[   52.866767] Hardware name: Thundercomm Dragonboard 845c (DT)
[   52.866779] Call trace:
[   52.866789]  show_stack+0x20/0x38 (C)
[   52.866808]  dump_stack_lvl+0x8c/0xd0
[   52.866830]  print_report+0x118/0x608
[   52.866851]  kasan_report+0xdc/0x128
[   52.866870]  __asan_report_load1_noabort+0x20/0x30
[   52.866889]  strcmp+0xc0/0xc8
[   52.866905]  kasan_strings+0x340/0xb00
[   52.866922]  kunit_try_run_case+0x170/0x3f0
[   52.866942]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.866965]  kthread+0x328/0x630
[   52.866980]  ret_from_fork+0x10/0x20
[   52.866998] 
[   52.935262] Allocated by task 368:
[   52.938730]  kasan_save_stack+0x3c/0x68
[   52.942643]  kasan_save_track+0x20/0x40
[   52.946554]  kasan_save_alloc_info+0x40/0x58
[   52.950894]  __kasan_kmalloc+0xd4/0xd8
[   52.954706]  __kmalloc_cache_noprof+0x16c/0x3c0
[   52.959322]  kasan_strings+0xc8/0xb00
[   52.963048]  kunit_try_run_case+0x170/0x3f0
[   52.967304]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.972878]  kthread+0x328/0x630
[   52.976171]  ret_from_fork+0x10/0x20
[   52.979812] 
[   52.981344] Freed by task 368:
[   52.984460]  kasan_save_stack+0x3c/0x68
[   52.988372]  kasan_save_track+0x20/0x40
[   52.992284]  kasan_save_free_info+0x4c/0x78
[   52.996539]  __kasan_slab_free+0x6c/0x98
[   53.000537]  kfree+0x214/0x3c8
[   53.003660]  kasan_strings+0x24c/0xb00
[   53.007473]  kunit_try_run_case+0x170/0x3f0
[   53.011727]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   53.017302]  kthread+0x328/0x630
[   53.020596]  ret_from_fork+0x10/0x20
[   53.024236] 
[   53.025767] The buggy address belongs to the object at ffff000085584200
[   53.025767]  which belongs to the cache kmalloc-32 of size 32
[   53.038255] The buggy address is located 16 bytes inside of
[   53.038255]  freed 32-byte region [ffff000085584200, ffff000085584220)
[   53.050484] 
[   53.052021] The buggy address belongs to the physical page:
[   53.057672] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105584
[   53.065787] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   53.072414] page_type: f5(slab)
[   53.075623] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000
[   53.083474] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   53.091320] page dumped because: kasan: bad access detected
[   53.096970] 
[   53.098502] Memory state around the buggy address:
[   53.103366]  ffff000085584100: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[   53.110685]  ffff000085584180: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   53.118003] >ffff000085584200: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.125319]                          ^
[   53.129137]  ffff000085584280: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[   53.136455]  ffff000085584300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   53.143772] ==================================================================

[   52.517957] ==================================================================
[   52.529102] BUG: KASAN: slab-out-of-bounds in memcmp+0x198/0x1d8
[   52.535207] Read of size 1 at addr ffff000085584198 by task kunit_try_catch/366
[   52.542624] 
[   52.544164] CPU: 3 UID: 0 PID: 366 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   52.544197] Tainted: [B]=BAD_PAGE, [N]=TEST
[   52.544207] Hardware name: Thundercomm Dragonboard 845c (DT)
[   52.544219] Call trace:
[   52.544227]  show_stack+0x20/0x38 (C)
[   52.544248]  dump_stack_lvl+0x8c/0xd0
[   52.544272]  print_report+0x118/0x608
[   52.544294]  kasan_report+0xdc/0x128
[   52.544314]  __asan_report_load1_noabort+0x20/0x30
[   52.544333]  memcmp+0x198/0x1d8
[   52.544351]  kasan_memcmp+0x16c/0x300
[   52.544369]  kunit_try_run_case+0x170/0x3f0
[   52.544388]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.544411]  kthread+0x328/0x630
[   52.544427]  ret_from_fork+0x10/0x20
[   52.544446] 
[   52.612808] Allocated by task 366:
[   52.616271]  kasan_save_stack+0x3c/0x68
[   52.620183]  kasan_save_track+0x20/0x40
[   52.624095]  kasan_save_alloc_info+0x40/0x58
[   52.628435]  __kasan_kmalloc+0xd4/0xd8
[   52.632258]  __kmalloc_cache_noprof+0x16c/0x3c0
[   52.636874]  kasan_memcmp+0xbc/0x300
[   52.640511]  kunit_try_run_case+0x170/0x3f0
[   52.644767]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.650342]  kthread+0x328/0x630
[   52.653633]  ret_from_fork+0x10/0x20
[   52.657272] 
[   52.658803] The buggy address belongs to the object at ffff000085584180
[   52.658803]  which belongs to the cache kmalloc-32 of size 32
[   52.671294] The buggy address is located 0 bytes to the right of
[   52.671294]  allocated 24-byte region [ffff000085584180, ffff000085584198)
[   52.684315] 
[   52.685847] The buggy address belongs to the physical page:
[   52.691495] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105584
[   52.699606] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   52.706224] page_type: f5(slab)
[   52.709430] raw: 0bfffe0000000000 ffff000080002780 dead000000000122 0000000000000000
[   52.717276] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   52.725118] page dumped because: kasan: bad access detected
[   52.730769] 
[   52.732304] Memory state around the buggy address:
[   52.737169]  ffff000085584080: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   52.744494]  ffff000085584100: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   52.751810] >ffff000085584180: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
[   52.759125]                             ^
[   52.763203]  ffff000085584200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   52.770519]  ffff000085584280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   52.777842] ==================================================================

[   52.272512] ==================================================================
[   52.284077] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_right+0x2dc/0x340
[   52.291757] Read of size 1 at addr ffff8000843d7b4a by task kunit_try_catch/362
[   52.299162] 
[   52.300698] CPU: 2 UID: 0 PID: 362 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   52.300730] Tainted: [B]=BAD_PAGE, [N]=TEST
[   52.300738] Hardware name: Thundercomm Dragonboard 845c (DT)
[   52.300751] Call trace:
[   52.300760]  show_stack+0x20/0x38 (C)
[   52.300778]  dump_stack_lvl+0x8c/0xd0
[   52.300803]  print_report+0x310/0x608
[   52.300824]  kasan_report+0xdc/0x128
[   52.300845]  __asan_report_load1_noabort+0x20/0x30
[   52.300865]  kasan_alloca_oob_right+0x2dc/0x340
[   52.300883]  kunit_try_run_case+0x170/0x3f0
[   52.300904]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.300925]  kthread+0x328/0x630
[   52.300941]  ret_from_fork+0x10/0x20
[   52.300961] 
[   52.367018] The buggy address belongs to stack of task kunit_try_catch/362
[   52.373999] 
[   52.375534] The buggy address belongs to the virtual mapping at
[   52.375534]  [ffff8000843d0000, ffff8000843d9000) created by:
[   52.375534]  kernel_clone+0x150/0x7a8
[   52.391014] 
[   52.392550] The buggy address belongs to the physical page:
[   52.398196] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105592
[   52.406303] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   52.412922] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   52.420772] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   52.428617] page dumped because: kasan: bad access detected
[   52.434264] 
[   52.435794] Memory state around the buggy address:
[   52.440654]  ffff8000843d7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   52.447971]  ffff8000843d7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   52.455288] >ffff8000843d7b00: 00 00 00 00 ca ca ca ca 00 02 cb cb cb cb cb cb
[   52.462602]                                               ^
[   52.468252]  ffff8000843d7b80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 01 f2 04 f2
[   52.475569]  ffff8000843d7c00: 00 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00
[   52.482883] ==================================================================

[   52.050807] ==================================================================
[   52.061844] BUG: KASAN: alloca-out-of-bounds in kasan_alloca_oob_left+0x2b8/0x310
[   52.069432] Read of size 1 at addr ffff8000843b7b5f by task kunit_try_catch/360
[   52.076842] 
[   52.078380] CPU: 5 UID: 0 PID: 360 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   52.078412] Tainted: [B]=BAD_PAGE, [N]=TEST
[   52.078421] Hardware name: Thundercomm Dragonboard 845c (DT)
[   52.078433] Call trace:
[   52.078440]  show_stack+0x20/0x38 (C)
[   52.078460]  dump_stack_lvl+0x8c/0xd0
[   52.078481]  print_report+0x310/0x608
[   52.078503]  kasan_report+0xdc/0x128
[   52.078522]  __asan_report_load1_noabort+0x20/0x30
[   52.078539]  kasan_alloca_oob_left+0x2b8/0x310
[   52.078557]  kunit_try_run_case+0x170/0x3f0
[   52.078575]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   52.078597]  kthread+0x328/0x630
[   52.078611]  ret_from_fork+0x10/0x20
[   52.078629] 
[   52.144556] The buggy address belongs to stack of task kunit_try_catch/360
[   52.151530] 
[   52.153059] The buggy address belongs to the virtual mapping at
[   52.153059]  [ffff8000843b0000, ffff8000843b9000) created by:
[   52.153059]  kernel_clone+0x150/0x7a8
[   52.168523] 
[   52.170051] The buggy address belongs to the physical page:
[   52.175692] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10463d
[   52.183796] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   52.190421] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   52.198267] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   52.206107] page dumped because: kasan: bad access detected
[   52.211749] 
[   52.213273] Memory state around the buggy address:
[   52.218130]  ffff8000843b7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   52.225438]  ffff8000843b7a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   52.232746] >ffff8000843b7b00: 00 00 00 00 00 00 00 00 ca ca ca ca 00 02 cb cb
[   52.240051]                                                     ^
[   52.246221]  ffff8000843b7b80: cb cb cb cb 00 00 00 00 f1 f1 f1 f1 01 f2 04 f2
[   52.253530]  ffff8000843b7c00: 00 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00
[   52.260836] ==================================================================

[   51.798857] ==================================================================
[   51.814097] BUG: KASAN: stack-out-of-bounds in kasan_stack_oob+0x238/0x270
[   51.821070] Read of size 1 at addr ffff800084397c2a by task kunit_try_catch/358
[   51.828483] 
[   51.830019] CPU: 3 UID: 0 PID: 358 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   51.830052] Tainted: [B]=BAD_PAGE, [N]=TEST
[   51.830061] Hardware name: Thundercomm Dragonboard 845c (DT)
[   51.830073] Call trace:
[   51.830082]  show_stack+0x20/0x38 (C)
[   51.830101]  dump_stack_lvl+0x8c/0xd0
[   51.830123]  print_report+0x310/0x608
[   51.830147]  kasan_report+0xdc/0x128
[   51.830167]  __asan_report_load1_noabort+0x20/0x30
[   51.830186]  kasan_stack_oob+0x238/0x270
[   51.830204]  kunit_try_run_case+0x170/0x3f0
[   51.830225]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   51.830247]  kthread+0x328/0x630
[   51.830264]  ret_from_fork+0x10/0x20
[   51.830284] 
[   51.895735] The buggy address belongs to stack of task kunit_try_catch/358
[   51.902704]  and is located at offset 138 in frame:
[   51.907651]  kasan_stack_oob+0x0/0x270
[   51.911477] 
[   51.913013] This frame has 4 objects:
[   51.916742]  [48, 49) '__assertion'
[   51.916756]  [64, 72) 'array'
[   51.920302]  [96, 112) '__assertion'
[   51.923326]  [128, 138) 'stack_array'
[   51.926961] 
[   51.932211] The buggy address belongs to the virtual mapping at
[   51.932211]  [ffff800084390000, ffff800084399000) created by:
[   51.932211]  kernel_clone+0x150/0x7a8
[   51.947690] 
[   51.949220] The buggy address belongs to the physical page:
[   51.954871] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x104649
[   51.964295] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   51.970919] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   51.978765] raw: ffffffffffffffff 0000000000000000 00000001ffffffff 0000000000000000
[   51.986604] page dumped because: kasan: bad access detected
[   51.992257] 
[   51.993788] Memory state around the buggy address:
[   51.998649]  ffff800084397b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   52.005974]  ffff800084397b80: 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 00 f2 f2 f2
[   52.013300] >ffff800084397c00: 00 00 f2 f2 00 02 f3 f3 00 00 00 00 00 00 00 00
[   52.020622]                                   ^
[   52.025230]  ffff800084397c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2
[   52.032552]  ffff800084397d00: 00 00 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00
[   52.039866] ==================================================================

[   51.566397] ==================================================================
[   51.579107] BUG: KASAN: global-out-of-bounds in kasan_global_oob_right+0x230/0x270
[   51.586785] Read of size 1 at addr ffffb46a770e964d by task kunit_try_catch/354
[   51.594197] 
[   51.595740] CPU: 3 UID: 0 PID: 354 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   51.595771] Tainted: [B]=BAD_PAGE, [N]=TEST
[   51.595780] Hardware name: Thundercomm Dragonboard 845c (DT)
[   51.595792] Call trace:
[   51.595800]  show_stack+0x20/0x38 (C)
[   51.595819]  dump_stack_lvl+0x8c/0xd0
[   51.595840]  print_report+0x310/0x608
[   51.595860]  kasan_report+0xdc/0x128
[   51.595879]  __asan_report_load1_noabort+0x20/0x30
[   51.595898]  kasan_global_oob_right+0x230/0x270
[   51.595915]  kunit_try_run_case+0x170/0x3f0
[   51.595935]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   51.595958]  kthread+0x328/0x630
[   51.595974]  ret_from_fork+0x10/0x20
[   51.595993] 
[   51.662045] The buggy address belongs to the variable:
[   51.667263]  global_array+0xd/0x40
[   51.670738] 
[   51.672290] The buggy address belongs to the virtual mapping at
[   51.672290]  [ffffb46a75270000, ffffb46a771a1000) created by:
[   51.672290]  paging_init+0x66c/0x7d0
[   51.687690] 
[   51.689225] The buggy address belongs to the physical page:
[   51.694875] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa7ae9
[   51.702892] flags: 0x3fffe0000002000(reserved|node=0|zone=0|lastcpupid=0x1ffff)
[   51.710314] raw: 03fffe0000002000 fffffdffc09eba48 fffffdffc09eba48 0000000000000000
[   51.718161] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   51.726003] page dumped because: kasan: bad access detected
[   51.731651] 
[   51.733179] Memory state around the buggy address:
[   51.738042]  ffffb46a770e9500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.745368]  ffffb46a770e9580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.752693] >ffffb46a770e9600: 02 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9
[   51.760017]                                               ^
[   51.765672]  ffffb46a770e9680: 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
[   51.772996]  ffffb46a770e9700: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
[   51.780319] ==================================================================

[   50.980145] ==================================================================
[   50.992503] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   51.000623] Free of addr ffff000082240d01 by task kunit_try_catch/350
[   51.007152] 
[   51.008697] CPU: 3 UID: 0 PID: 350 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   51.008730] Tainted: [B]=BAD_PAGE, [N]=TEST
[   51.008739] Hardware name: Thundercomm Dragonboard 845c (DT)
[   51.008751] Call trace:
[   51.008759]  show_stack+0x20/0x38 (C)
[   51.008778]  dump_stack_lvl+0x8c/0xd0
[   51.008800]  print_report+0x118/0x608
[   51.008823]  kasan_report_invalid_free+0xc0/0xe8
[   51.008845]  check_slab_allocation+0xfc/0x108
[   51.008865]  __kasan_mempool_poison_object+0x78/0x150
[   51.008890]  mempool_free+0x28c/0x328
[   51.008908]  mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   51.008930]  mempool_kmalloc_invalid_free+0xc0/0x118
[   51.008951]  kunit_try_run_case+0x170/0x3f0
[   51.008971]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   51.008995]  kthread+0x328/0x630
[   51.009011]  ret_from_fork+0x10/0x20
[   51.009030] 
[   51.090707] Allocated by task 350:
[   51.094168]  kasan_save_stack+0x3c/0x68
[   51.098080]  kasan_save_track+0x20/0x40
[   51.101992]  kasan_save_alloc_info+0x40/0x58
[   51.106330]  __kasan_mempool_unpoison_object+0x11c/0x180
[   51.111727]  remove_element+0x130/0x1f8
[   51.115637]  mempool_alloc_preallocated+0x58/0xc0
[   51.120417]  mempool_kmalloc_invalid_free_helper+0x94/0x2a8
[   51.126076]  mempool_kmalloc_invalid_free+0xc0/0x118
[   51.131117]  kunit_try_run_case+0x170/0x3f0
[   51.135371]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   51.140943]  kthread+0x328/0x630
[   51.144234]  ret_from_fork+0x10/0x20
[   51.147873] 
[   51.149406] The buggy address belongs to the object at ffff000082240d00
[   51.149406]  which belongs to the cache kmalloc-128 of size 128
[   51.162072] The buggy address is located 1 bytes inside of
[   51.162072]  128-byte region [ffff000082240d00, ffff000082240d80)
[   51.173778] 
[   51.175309] The buggy address belongs to the physical page:
[   51.180956] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   51.189072] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   51.196832] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   51.203889] page_type: f5(slab)
[   51.207099] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   51.214947] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   51.222794] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   51.230727] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   51.238662] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   51.246594] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   51.254523] page dumped because: kasan: bad access detected
[   51.260181] 
[   51.261713] Memory state around the buggy address:
[   51.266576]  ffff000082240c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   51.273901]  ffff000082240c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   51.281226] >ffff000082240d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.288550]                    ^
[   51.291842]  ffff000082240d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   51.299162]  ffff000082240e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.306476] ==================================================================
[   51.317178] ==================================================================
[   51.329369] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   51.337487] Free of addr ffff00008553c001 by task kunit_try_catch/352
[   51.344023] 
[   51.345558] CPU: 3 UID: 0 PID: 352 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   51.345590] Tainted: [B]=BAD_PAGE, [N]=TEST
[   51.345600] Hardware name: Thundercomm Dragonboard 845c (DT)
[   51.345613] Call trace:
[   51.345620]  show_stack+0x20/0x38 (C)
[   51.345640]  dump_stack_lvl+0x8c/0xd0
[   51.345662]  print_report+0x118/0x608
[   51.345686]  kasan_report_invalid_free+0xc0/0xe8
[   51.345707]  __kasan_mempool_poison_object+0xfc/0x150
[   51.345732]  mempool_free+0x28c/0x328
[   51.345751]  mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   51.345773]  mempool_kmalloc_large_invalid_free+0xc0/0x118
[   51.345794]  kunit_try_run_case+0x170/0x3f0
[   51.345813]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   51.345836]  kthread+0x328/0x630
[   51.345853]  ret_from_fork+0x10/0x20
[   51.345871] 
[   51.423654] The buggy address belongs to the physical page:
[   51.429300] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10553c
[   51.437414] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   51.445171] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   51.452226] page_type: f8(unknown)
[   51.455695] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   51.463539] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   51.471381] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   51.479311] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   51.487252] head: 0bfffe0000000002 fffffdffc2154f01 00000000ffffffff 00000000ffffffff
[   51.495194] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   51.503128] page dumped because: kasan: bad access detected
[   51.508782] 
[   51.510313] Memory state around the buggy address:
[   51.515172]  ffff00008553bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   51.522497]  ffff00008553bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   51.529821] >ffff00008553c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.537140]                    ^
[   51.540430]  ffff00008553c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.547755]  ffff00008553c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   51.555067] ==================================================================

[   46.300749] ==================================================================
[   46.312428] BUG: KASAN: invalid-free in kmem_cache_invalid_free+0x184/0x3c8
[   46.319490] Free of addr ffff000095dfa001 by task kunit_try_catch/320
[   46.326016] 
[   46.327552] CPU: 4 UID: 0 PID: 320 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   46.327590] Tainted: [B]=BAD_PAGE, [N]=TEST
[   46.327601] Hardware name: Thundercomm Dragonboard 845c (DT)
[   46.327616] Call trace:
[   46.327625]  show_stack+0x20/0x38 (C)
[   46.327646]  dump_stack_lvl+0x8c/0xd0
[   46.327668]  print_report+0x118/0x608
[   46.327688]  kasan_report_invalid_free+0xc0/0xe8
[   46.327708]  check_slab_allocation+0xfc/0x108
[   46.327728]  __kasan_slab_pre_free+0x2c/0x48
[   46.327746]  kmem_cache_free+0xf0/0x468
[   46.327766]  kmem_cache_invalid_free+0x184/0x3c8
[   46.327783]  kunit_try_run_case+0x170/0x3f0
[   46.327805]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.327827]  kthread+0x328/0x630
[   46.327842]  ret_from_fork+0x10/0x20
[   46.327862] 
[   46.402805] Allocated by task 320:
[   46.406267]  kasan_save_stack+0x3c/0x68
[   46.410170]  kasan_save_track+0x20/0x40
[   46.414069]  kasan_save_alloc_info+0x40/0x58
[   46.418410]  __kasan_slab_alloc+0xa8/0xb0
[   46.422482]  kmem_cache_alloc_noprof+0x10c/0x398
[   46.427173]  kmem_cache_invalid_free+0x12c/0x3c8
[   46.431861]  kunit_try_run_case+0x170/0x3f0
[   46.436115]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.441677]  kthread+0x328/0x630
[   46.444964]  ret_from_fork+0x10/0x20
[   46.448600] 
[   46.450126] The buggy address belongs to the object at ffff000095dfa000
[   46.450126]  which belongs to the cache test_cache of size 200
[   46.462697] The buggy address is located 1 bytes inside of
[   46.462697]  200-byte region [ffff000095dfa000, ffff000095dfa0c8)
[   46.474391] 
[   46.475917] The buggy address belongs to the physical page:
[   46.481568] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115dfa
[   46.489669] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   46.497420] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   46.504483] page_type: f5(slab)
[   46.507690] raw: 0bfffe0000000040 ffff000080f20b40 dead000000000122 0000000000000000
[   46.515530] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   46.523369] head: 0bfffe0000000040 ffff000080f20b40 dead000000000122 0000000000000000
[   46.531293] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   46.539219] head: 0bfffe0000000001 fffffdffc2577e81 00000000ffffffff 00000000ffffffff
[   46.547144] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   46.555067] page dumped because: kasan: bad access detected
[   46.560718] 
[   46.562243] Memory state around the buggy address:
[   46.567102]  ffff000095df9f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.574419]  ffff000095df9f80: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   46.581735] >ffff000095dfa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   46.589048]                    ^
[   46.592334]  ffff000095dfa080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   46.599649]  ffff000095dfa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   46.606962] ==================================================================

[   45.927019] ==================================================================
[   45.937987] BUG: KASAN: double-free in kmem_cache_double_free+0x190/0x3c8
[   45.944882] Free of addr ffff0000952aa000 by task kunit_try_catch/318
[   45.951410] 
[   45.952945] CPU: 6 UID: 0 PID: 318 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   45.952982] Tainted: [B]=BAD_PAGE, [N]=TEST
[   45.952991] Hardware name: Thundercomm Dragonboard 845c (DT)
[   45.953008] Call trace:
[   45.953016]  show_stack+0x20/0x38 (C)
[   45.953038]  dump_stack_lvl+0x8c/0xd0
[   45.953060]  print_report+0x118/0x608
[   45.953079]  kasan_report_invalid_free+0xc0/0xe8
[   45.953099]  check_slab_allocation+0xd4/0x108
[   45.953119]  __kasan_slab_pre_free+0x2c/0x48
[   45.953138]  kmem_cache_free+0xf0/0x468
[   45.953160]  kmem_cache_double_free+0x190/0x3c8
[   45.953177]  kunit_try_run_case+0x170/0x3f0
[   45.953198]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.953220]  kthread+0x328/0x630
[   45.953235]  ret_from_fork+0x10/0x20
[   45.953256] 
[   46.028107] Allocated by task 318:
[   46.031563]  kasan_save_stack+0x3c/0x68
[   46.035470]  kasan_save_track+0x20/0x40
[   46.039377]  kasan_save_alloc_info+0x40/0x58
[   46.043714]  __kasan_slab_alloc+0xa8/0xb0
[   46.047794]  kmem_cache_alloc_noprof+0x10c/0x398
[   46.052481]  kmem_cache_double_free+0x12c/0x3c8
[   46.057081]  kunit_try_run_case+0x170/0x3f0
[   46.061330]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.066896]  kthread+0x328/0x630
[   46.070181]  ret_from_fork+0x10/0x20
[   46.073814] 
[   46.075345] Freed by task 318:
[   46.078454]  kasan_save_stack+0x3c/0x68
[   46.082349]  kasan_save_track+0x20/0x40
[   46.086254]  kasan_save_free_info+0x4c/0x78
[   46.090504]  __kasan_slab_free+0x6c/0x98
[   46.094495]  kmem_cache_free+0x260/0x468
[   46.098488]  kmem_cache_double_free+0x140/0x3c8
[   46.103085]  kunit_try_run_case+0x170/0x3f0
[   46.107334]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   46.112901]  kthread+0x328/0x630
[   46.116182]  ret_from_fork+0x10/0x20
[   46.119815] 
[   46.121339] The buggy address belongs to the object at ffff0000952aa000
[   46.121339]  which belongs to the cache test_cache of size 200
[   46.133909] The buggy address is located 0 bytes inside of
[   46.133909]  200-byte region [ffff0000952aa000, ffff0000952aa0c8)
[   46.145601] 
[   46.147136] The buggy address belongs to the physical page:
[   46.152781] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1152aa
[   46.160886] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   46.168638] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   46.175695] page_type: f5(slab)
[   46.178902] raw: 0bfffe0000000040 ffff000087bc8dc0 dead000000000122 0000000000000000
[   46.186743] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   46.194586] head: 0bfffe0000000040 ffff000087bc8dc0 dead000000000122 0000000000000000
[   46.202514] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   46.210444] head: 0bfffe0000000001 fffffdffc254aa81 00000000ffffffff 00000000ffffffff
[   46.218373] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   46.226295] page dumped because: kasan: bad access detected
[   46.231937] 
[   46.233459] Memory state around the buggy address:
[   46.238316]  ffff0000952a9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   46.245635]  ffff0000952a9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   46.252952] >ffff0000952aa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.260258]                    ^
[   46.263539]  ffff0000952aa080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   46.270848]  ffff0000952aa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   46.278154] ==================================================================

[   45.568117] ==================================================================
[   45.579078] BUG: KASAN: slab-out-of-bounds in kmem_cache_oob+0x344/0x430
[   45.585872] Read of size 1 at addr ffff000095dfa0c8 by task kunit_try_catch/316
[   45.593278] 
[   45.594807] CPU: 5 UID: 0 PID: 316 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   45.594838] Tainted: [B]=BAD_PAGE, [N]=TEST
[   45.594846] Hardware name: Thundercomm Dragonboard 845c (DT)
[   45.594857] Call trace:
[   45.594864]  show_stack+0x20/0x38 (C)
[   45.594882]  dump_stack_lvl+0x8c/0xd0
[   45.594903]  print_report+0x118/0x608
[   45.594924]  kasan_report+0xdc/0x128
[   45.594941]  __asan_report_load1_noabort+0x20/0x30
[   45.594957]  kmem_cache_oob+0x344/0x430
[   45.594972]  kunit_try_run_case+0x170/0x3f0
[   45.594989]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.595010]  kthread+0x328/0x630
[   45.595025]  ret_from_fork+0x10/0x20
[   45.595041] 
[   45.660372] Allocated by task 316:
[   45.663826]  kasan_save_stack+0x3c/0x68
[   45.667734]  kasan_save_track+0x20/0x40
[   45.671638]  kasan_save_alloc_info+0x40/0x58
[   45.675975]  __kasan_slab_alloc+0xa8/0xb0
[   45.680052]  kmem_cache_alloc_noprof+0x10c/0x398
[   45.684739]  kmem_cache_oob+0x12c/0x430
[   45.688641]  kunit_try_run_case+0x170/0x3f0
[   45.692892]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.698458]  kthread+0x328/0x630
[   45.701740]  ret_from_fork+0x10/0x20
[   45.705381] 
[   45.706904] The buggy address belongs to the object at ffff000095dfa000
[   45.706904]  which belongs to the cache test_cache of size 200
[   45.719467] The buggy address is located 0 bytes to the right of
[   45.719467]  allocated 200-byte region [ffff000095dfa000, ffff000095dfa0c8)
[   45.732563] 
[   45.734087] The buggy address belongs to the physical page:
[   45.739735] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115dfa
[   45.747836] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   45.755587] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   45.762638] page_type: f5(slab)
[   45.765835] raw: 0bfffe0000000040 ffff0000812c6a00 dead000000000122 0000000000000000
[   45.773676] raw: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   45.781515] head: 0bfffe0000000040 ffff0000812c6a00 dead000000000122 0000000000000000
[   45.789442] head: 0000000000000000 00000000801f001f 00000000f5000000 0000000000000000
[   45.797366] head: 0bfffe0000000001 fffffdffc2577e81 00000000ffffffff 00000000ffffffff
[   45.805288] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   45.813207] page dumped because: kasan: bad access detected
[   45.818848] 
[   45.820376] Memory state around the buggy address:
[   45.825237]  ffff000095df9f80: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc
[   45.832548]  ffff000095dfa000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   45.839861] >ffff000095dfa080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   45.847165]                                               ^
[   45.852804]  ffff000095dfa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   45.860114]  ffff000095dfa180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   45.867426] ==================================================================

[   45.203416] ==================================================================
[   45.213757] BUG: KASAN: slab-use-after-free in workqueue_uaf+0x480/0x4a8
[   45.220557] Read of size 8 at addr ffff0000810baf00 by task kunit_try_catch/309
[   45.227962] 
[   45.229492] CPU: 6 UID: 0 PID: 309 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   45.229523] Tainted: [B]=BAD_PAGE, [N]=TEST
[   45.229530] Hardware name: Thundercomm Dragonboard 845c (DT)
[   45.229541] Call trace:
[   45.229547]  show_stack+0x20/0x38 (C)
[   45.229565]  dump_stack_lvl+0x8c/0xd0
[   45.229584]  print_report+0x118/0x608
[   45.229605]  kasan_report+0xdc/0x128
[   45.229622]  __asan_report_load8_noabort+0x20/0x30
[   45.229641]  workqueue_uaf+0x480/0x4a8
[   45.229657]  kunit_try_run_case+0x170/0x3f0
[   45.229675]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.229696]  kthread+0x328/0x630
[   45.229710]  ret_from_fork+0x10/0x20
[   45.229726] 
[   45.294953] Allocated by task 309:
[   45.298409]  kasan_save_stack+0x3c/0x68
[   45.302316]  kasan_save_track+0x20/0x40
[   45.306218]  kasan_save_alloc_info+0x40/0x58
[   45.310552]  __kasan_kmalloc+0xd4/0xd8
[   45.314367]  __kmalloc_cache_noprof+0x16c/0x3c0
[   45.318967]  workqueue_uaf+0x13c/0x4a8
[   45.322780]  kunit_try_run_case+0x170/0x3f0
[   45.327030]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.332589]  kthread+0x328/0x630
[   45.335871]  ret_from_fork+0x10/0x20
[   45.339503] 
[   45.341026] Freed by task 136:
[   45.344130]  kasan_save_stack+0x3c/0x68
[   45.348035]  kasan_save_track+0x20/0x40
[   45.351938]  kasan_save_free_info+0x4c/0x78
[   45.356186]  __kasan_slab_free+0x6c/0x98
[   45.360177]  kfree+0x214/0x3c8
[   45.363290]  workqueue_uaf_work+0x18/0x30
[   45.367363]  process_one_work+0x530/0xf98
[   45.371442]  worker_thread+0x618/0xf38
[   45.375248]  kthread+0x328/0x630
[   45.378531]  ret_from_fork+0x10/0x20
[   45.382163] 
[   45.383692] Last potentially related work creation:
[   45.388641]  kasan_save_stack+0x3c/0x68
[   45.392545]  kasan_record_aux_stack+0xb4/0xc8
[   45.396969]  __queue_work+0x65c/0xfe0
[   45.400696]  queue_work_on+0xbc/0xf8
[   45.404326]  workqueue_uaf+0x210/0x4a8
[   45.408141]  kunit_try_run_case+0x170/0x3f0
[   45.412390]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.417957]  kthread+0x328/0x630
[   45.421238]  ret_from_fork+0x10/0x20
[   45.424879] 
[   45.426402] The buggy address belongs to the object at ffff0000810baf00
[   45.426402]  which belongs to the cache kmalloc-32 of size 32
[   45.438884] The buggy address is located 0 bytes inside of
[   45.438884]  freed 32-byte region [ffff0000810baf00, ffff0000810baf20)
[   45.451016] 
[   45.452547] The buggy address belongs to the physical page:
[   45.458190] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1010ba
[   45.466291] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   45.472902] page_type: f5(slab)
[   45.476099] raw: 0bfffe0000000000 ffff000080002780 dead000000000100 dead000000000122
[   45.483940] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   45.491775] page dumped because: kasan: bad access detected
[   45.497419] 
[   45.498943] Memory state around the buggy address:
[   45.503800]  ffff0000810bae00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.511110]  ffff0000810bae80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.518427] >ffff0000810baf00: fa fb fb fb fc fc fc fc 00 00 00 07 fc fc fc fc
[   45.525739]                    ^
[   45.529019]  ffff0000810baf80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.536336]  ffff0000810bb000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   45.543649] ==================================================================

[   44.799808] ==================================================================
[   44.810321] BUG: KASAN: slab-use-after-free in rcu_uaf_reclaim+0x64/0x70
[   44.817111] Read of size 4 at addr ffff000084091980 by task swapper/5/0
[   44.823809] 
[   44.825339] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   44.825369] Tainted: [B]=BAD_PAGE, [N]=TEST
[   44.825378] Hardware name: Thundercomm Dragonboard 845c (DT)
[   44.825388] Call trace:
[   44.825395]  show_stack+0x20/0x38 (C)
[   44.825413]  dump_stack_lvl+0x8c/0xd0
[   44.825433]  print_report+0x118/0x608
[   44.825453]  kasan_report+0xdc/0x128
[   44.825472]  __asan_report_load4_noabort+0x20/0x30
[   44.825488]  rcu_uaf_reclaim+0x64/0x70
[   44.825504]  rcu_core+0x9f4/0x1e20
[   44.825523]  rcu_core_si+0x18/0x30
[   44.825538]  handle_softirqs+0x374/0xb28
[   44.825558]  __do_softirq+0x1c/0x28
[   44.825571]  ____do_softirq+0x18/0x30
[   44.825589]  call_on_irq_stack+0x24/0x30
[   44.825605]  do_softirq_own_stack+0x24/0x38
[   44.825623]  __irq_exit_rcu+0x1fc/0x318
[   44.825639]  irq_exit_rcu+0x1c/0x80
[   44.825655]  el1_interrupt+0x38/0x58
[   44.825670]  el1h_64_irq_handler+0x18/0x28
[   44.825685]  el1h_64_irq+0x6c/0x70
[   44.825700]  arch_local_irq_enable+0x4/0x8 (P)
[   44.825722]  cpuidle_enter+0x60/0xb8
[   44.825738]  do_idle+0x36c/0x4e8
[   44.825757]  cpu_startup_entry+0x68/0x80
[   44.825774]  secondary_start_kernel+0x288/0x340
[   44.825792]  __secondary_switched+0xc0/0xc8
[   44.825815] 
[   44.942766] Allocated by task 307:
[   44.946219]  kasan_save_stack+0x3c/0x68
[   44.950126]  kasan_save_track+0x20/0x40
[   44.954032]  kasan_save_alloc_info+0x40/0x58
[   44.958367]  __kasan_kmalloc+0xd4/0xd8
[   44.962181]  __kmalloc_cache_noprof+0x16c/0x3c0
[   44.966780]  rcu_uaf+0xb0/0x2d8
[   44.969973]  kunit_try_run_case+0x170/0x3f0
[   44.974224]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.979784]  kthread+0x328/0x630
[   44.983070]  ret_from_fork+0x10/0x20
[   44.986703] 
[   44.988233] Freed by task 0:
[   44.991165]  kasan_save_stack+0x3c/0x68
[   44.995068]  kasan_save_track+0x20/0x40
[   44.998973]  kasan_save_free_info+0x4c/0x78
[   45.003216]  __kasan_slab_free+0x6c/0x98
[   45.007207]  kfree+0x214/0x3c8
[   45.010317]  rcu_uaf_reclaim+0x28/0x70
[   45.014130]  rcu_core+0x9f4/0x1e20
[   45.017597]  rcu_core_si+0x18/0x30
[   45.021054]  handle_softirqs+0x374/0xb28
[   45.025043]  __do_softirq+0x1c/0x28
[   45.028595] 
[   45.030118] Last potentially related work creation:
[   45.035063]  kasan_save_stack+0x3c/0x68
[   45.038968]  kasan_record_aux_stack+0xb4/0xc8
[   45.043394]  __call_rcu_common.constprop.0+0x74/0x8c8
[   45.048523]  call_rcu+0x18/0x30
[   45.051718]  rcu_uaf+0x14c/0x2d8
[   45.055004]  kunit_try_run_case+0x170/0x3f0
[   45.059250]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   45.064811]  kthread+0x328/0x630
[   45.068092]  ret_from_fork+0x10/0x20
[   45.071733] 
[   45.073257] The buggy address belongs to the object at ffff000084091980
[   45.073257]  which belongs to the cache kmalloc-32 of size 32
[   45.085734] The buggy address is located 0 bytes inside of
[   45.085734]  freed 32-byte region [ffff000084091980, ffff0000840919a0)
[   45.097866] 
[   45.099395] The buggy address belongs to the physical page:
[   45.105036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104091
[   45.113139] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   45.119748] page_type: f5(slab)
[   45.122949] raw: 0bfffe0000000000 ffff000080002780 fffffdffc21098c0 dead000000000002
[   45.130789] raw: 0000000000000000 0000000080400040 00000000f5000000 0000000000000000
[   45.138623] page dumped because: kasan: bad access detected
[   45.144270] 
[   45.145793] Memory state around the buggy address:
[   45.150648]  ffff000084091880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.157956]  ffff000084091900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.165264] >ffff000084091980: fa fb fb fb fc fc fc fc 00 00 07 fc fc fc fc fc
[   45.172569]                    ^
[   45.175850]  ffff000084091a00: 00 00 05 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[   45.183160]  ffff000084091a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[   45.190467] ==================================================================

[   44.083669] ==================================================================
[   44.090987] BUG: KASAN: slab-use-after-free in ksize_uaf+0x598/0x5f8
[   44.097437] Read of size 1 at addr ffff000082240200 by task kunit_try_catch/305
[   44.104845] 
[   44.106379] CPU: 3 UID: 0 PID: 305 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   44.106410] Tainted: [B]=BAD_PAGE, [N]=TEST
[   44.106419] Hardware name: Thundercomm Dragonboard 845c (DT)
[   44.106431] Call trace:
[   44.106438]  show_stack+0x20/0x38 (C)
[   44.106458]  dump_stack_lvl+0x8c/0xd0
[   44.106480]  print_report+0x118/0x608
[   44.106499]  kasan_report+0xdc/0x128
[   44.106518]  __asan_report_load1_noabort+0x20/0x30
[   44.106536]  ksize_uaf+0x598/0x5f8
[   44.106552]  kunit_try_run_case+0x170/0x3f0
[   44.106573]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.106596]  kthread+0x328/0x630
[   44.106612]  ret_from_fork+0x10/0x20
[   44.106630] 
[   44.171536] Allocated by task 305:
[   44.174997]  kasan_save_stack+0x3c/0x68
[   44.178900]  kasan_save_track+0x20/0x40
[   44.182809]  kasan_save_alloc_info+0x40/0x58
[   44.187146]  __kasan_kmalloc+0xd4/0xd8
[   44.190968]  __kmalloc_cache_noprof+0x16c/0x3c0
[   44.195578]  ksize_uaf+0xb8/0x5f8
[   44.198959]  kunit_try_run_case+0x170/0x3f0
[   44.203215]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.208787]  kthread+0x328/0x630
[   44.212076]  ret_from_fork+0x10/0x20
[   44.215716] 
[   44.217246] Freed by task 305:
[   44.220358]  kasan_save_stack+0x3c/0x68
[   44.224269]  kasan_save_track+0x20/0x40
[   44.228180]  kasan_save_free_info+0x4c/0x78
[   44.232432]  __kasan_slab_free+0x6c/0x98
[   44.236428]  kfree+0x214/0x3c8
[   44.239540]  ksize_uaf+0x11c/0x5f8
[   44.243007]  kunit_try_run_case+0x170/0x3f0
[   44.247260]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.252830]  kthread+0x328/0x630
[   44.256124]  ret_from_fork+0x10/0x20
[   44.259764] 
[   44.261291] The buggy address belongs to the object at ffff000082240200
[   44.261291]  which belongs to the cache kmalloc-128 of size 128
[   44.273958] The buggy address is located 0 bytes inside of
[   44.273958]  freed 128-byte region [ffff000082240200, ffff000082240280)
[   44.286181] 
[   44.287718] The buggy address belongs to the physical page:
[   44.293367] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   44.301483] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   44.309244] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   44.316301] page_type: f5(slab)
[   44.319509] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   44.327355] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   44.335203] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   44.343137] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   44.351072] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   44.359006] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   44.366934] page dumped because: kasan: bad access detected
[   44.372582] 
[   44.374111] Memory state around the buggy address:
[   44.378973]  ffff000082240100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.386289]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.393604] >ffff000082240200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.400916]                    ^
[   44.404203]  ffff000082240280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.411521]  ffff000082240300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.418834] ==================================================================
[   44.427005] ==================================================================
[   44.434324] BUG: KASAN: slab-use-after-free in ksize_uaf+0x544/0x5f8
[   44.440772] Read of size 1 at addr ffff000082240278 by task kunit_try_catch/305
[   44.448182] 
[   44.449712] CPU: 4 UID: 0 PID: 305 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   44.449743] Tainted: [B]=BAD_PAGE, [N]=TEST
[   44.449751] Hardware name: Thundercomm Dragonboard 845c (DT)
[   44.449763] Call trace:
[   44.449770]  show_stack+0x20/0x38 (C)
[   44.449788]  dump_stack_lvl+0x8c/0xd0
[   44.449807]  print_report+0x118/0x608
[   44.449825]  kasan_report+0xdc/0x128
[   44.449844]  __asan_report_load1_noabort+0x20/0x30
[   44.449861]  ksize_uaf+0x544/0x5f8
[   44.449877]  kunit_try_run_case+0x170/0x3f0
[   44.449896]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.449916]  kthread+0x328/0x630
[   44.449929]  ret_from_fork+0x10/0x20
[   44.449947] 
[   44.514800] Allocated by task 305:
[   44.518255]  kasan_save_stack+0x3c/0x68
[   44.522162]  kasan_save_track+0x20/0x40
[   44.526068]  kasan_save_alloc_info+0x40/0x58
[   44.530407]  __kasan_kmalloc+0xd4/0xd8
[   44.534226]  __kmalloc_cache_noprof+0x16c/0x3c0
[   44.538825]  ksize_uaf+0xb8/0x5f8
[   44.542197]  kunit_try_run_case+0x170/0x3f0
[   44.546447]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.552012]  kthread+0x328/0x630
[   44.555296]  ret_from_fork+0x10/0x20
[   44.558931] 
[   44.560462] Freed by task 305:
[   44.563568]  kasan_save_stack+0x3c/0x68
[   44.567474]  kasan_save_track+0x20/0x40
[   44.571378]  kasan_save_free_info+0x4c/0x78
[   44.575626]  __kasan_slab_free+0x6c/0x98
[   44.579619]  kfree+0x214/0x3c8
[   44.582733]  ksize_uaf+0x11c/0x5f8
[   44.586190]  kunit_try_run_case+0x170/0x3f0
[   44.590443]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   44.596005]  kthread+0x328/0x630
[   44.599288]  ret_from_fork+0x10/0x20
[   44.602923] 
[   44.604453] The buggy address belongs to the object at ffff000082240200
[   44.604453]  which belongs to the cache kmalloc-128 of size 128
[   44.617110] The buggy address is located 120 bytes inside of
[   44.617110]  freed 128-byte region [ffff000082240200, ffff000082240280)
[   44.629499] 
[   44.631034] The buggy address belongs to the physical page:
[   44.636677] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   44.644782] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   44.652538] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   44.659587] page_type: f5(slab)
[   44.662789] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   44.670634] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   44.678477] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   44.686405] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   44.694334] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   44.702262] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   44.710185] page dumped because: kasan: bad access detected
[   44.715822] 
[   44.717346] Memory state around the buggy address:
[   44.722197]  ffff000082240100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.729513]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.736830] >ffff000082240200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.744146]                                                                 ^
[   44.751362]  ffff000082240280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.758674]  ffff000082240300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.765989] ==================================================================
[   43.734638] ==================================================================
[   43.746285] BUG: KASAN: slab-use-after-free in ksize_uaf+0x168/0x5f8
[   43.752731] Read of size 1 at addr ffff000082240200 by task kunit_try_catch/305
[   43.760147] 
[   43.761682] CPU: 3 UID: 0 PID: 305 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   43.761714] Tainted: [B]=BAD_PAGE, [N]=TEST
[   43.761723] Hardware name: Thundercomm Dragonboard 845c (DT)
[   43.761736] Call trace:
[   43.761743]  show_stack+0x20/0x38 (C)
[   43.761762]  dump_stack_lvl+0x8c/0xd0
[   43.761784]  print_report+0x118/0x608
[   43.761804]  kasan_report+0xdc/0x128
[   43.761823]  __kasan_check_byte+0x54/0x70
[   43.761842]  ksize+0x30/0x88
[   43.761863]  ksize_uaf+0x168/0x5f8
[   43.761879]  kunit_try_run_case+0x170/0x3f0
[   43.761897]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.761920]  kthread+0x328/0x630
[   43.761934]  ret_from_fork+0x10/0x20
[   43.761953] 
[   43.829008] Allocated by task 305:
[   43.832474]  kasan_save_stack+0x3c/0x68
[   43.836380]  kasan_save_track+0x20/0x40
[   43.840285]  kasan_save_alloc_info+0x40/0x58
[   43.844631]  __kasan_kmalloc+0xd4/0xd8
[   43.848448]  __kmalloc_cache_noprof+0x16c/0x3c0
[   43.853055]  ksize_uaf+0xb8/0x5f8
[   43.856430]  kunit_try_run_case+0x170/0x3f0
[   43.860690]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.866260]  kthread+0x328/0x630
[   43.869547]  ret_from_fork+0x10/0x20
[   43.873192] 
[   43.874722] Freed by task 305:
[   43.877830]  kasan_save_stack+0x3c/0x68
[   43.881736]  kasan_save_track+0x20/0x40
[   43.885641]  kasan_save_free_info+0x4c/0x78
[   43.889899]  __kasan_slab_free+0x6c/0x98
[   43.893890]  kfree+0x214/0x3c8
[   43.897005]  ksize_uaf+0x11c/0x5f8
[   43.900476]  kunit_try_run_case+0x170/0x3f0
[   43.904737]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.910305]  kthread+0x328/0x630
[   43.913591]  ret_from_fork+0x10/0x20
[   43.917235] 
[   43.918765] The buggy address belongs to the object at ffff000082240200
[   43.918765]  which belongs to the cache kmalloc-128 of size 128
[   43.931429] The buggy address is located 0 bytes inside of
[   43.931429]  freed 128-byte region [ffff000082240200, ffff000082240280)
[   43.943650] 
[   43.945181] The buggy address belongs to the physical page:
[   43.950826] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   43.958933] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   43.966692] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   43.973750] page_type: f5(slab)
[   43.976951] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.984799] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.992649] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   44.000584] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   44.008517] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   44.016450] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   44.024379] page dumped because: kasan: bad access detected
[   44.030026] 
[   44.031557] Memory state around the buggy address:
[   44.036416]  ffff000082240100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.043732]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.051049] >ffff000082240200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   44.058364]                    ^
[   44.061650]  ffff000082240280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.068968]  ffff000082240300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   44.076281] ==================================================================

[   42.805526] ==================================================================
[   42.817089] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x628/0x740
[   42.824589] Read of size 1 at addr ffff000082240173 by task kunit_try_catch/303
[   42.831998] 
[   42.833534] CPU: 3 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   42.833566] Tainted: [B]=BAD_PAGE, [N]=TEST
[   42.833574] Hardware name: Thundercomm Dragonboard 845c (DT)
[   42.833587] Call trace:
[   42.833594]  show_stack+0x20/0x38 (C)
[   42.833613]  dump_stack_lvl+0x8c/0xd0
[   42.833635]  print_report+0x118/0x608
[   42.833655]  kasan_report+0xdc/0x128
[   42.833675]  __asan_report_load1_noabort+0x20/0x30
[   42.833694]  ksize_unpoisons_memory+0x628/0x740
[   42.833713]  kunit_try_run_case+0x170/0x3f0
[   42.833733]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.833754]  kthread+0x328/0x630
[   42.833769]  ret_from_fork+0x10/0x20
[   42.833788] 
[   42.899872] Allocated by task 303:
[   42.903336]  kasan_save_stack+0x3c/0x68
[   42.907246]  kasan_save_track+0x20/0x40
[   42.911156]  kasan_save_alloc_info+0x40/0x58
[   42.915493]  __kasan_kmalloc+0xd4/0xd8
[   42.919315]  __kmalloc_cache_noprof+0x16c/0x3c0
[   42.923920]  ksize_unpoisons_memory+0xc0/0x740
[   42.928443]  kunit_try_run_case+0x170/0x3f0
[   42.932697]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.938272]  kthread+0x328/0x630
[   42.941564]  ret_from_fork+0x10/0x20
[   42.945211] 
[   42.946741] The buggy address belongs to the object at ffff000082240100
[   42.946741]  which belongs to the cache kmalloc-128 of size 128
[   42.959400] The buggy address is located 0 bytes to the right of
[   42.959400]  allocated 115-byte region [ffff000082240100, ffff000082240173)
[   42.972503] 
[   42.974035] The buggy address belongs to the physical page:
[   42.979681] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   42.987794] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   42.995552] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   43.002609] page_type: f5(slab)
[   43.005814] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.013659] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.021502] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.029434] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.037365] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   43.045296] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   43.053222] page dumped because: kasan: bad access detected
[   43.058871] 
[   43.060407] Memory state around the buggy address:
[   43.065269]  ffff000082240000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.072595]  ffff000082240080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.079918] >ffff000082240100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[   43.087233]                                                              ^
[   43.094200]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.101524]  ffff000082240200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.108844] ==================================================================
[   43.116234] ==================================================================
[   43.123557] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x618/0x740
[   43.131058] Read of size 1 at addr ffff000082240178 by task kunit_try_catch/303
[   43.138470] 
[   43.140009] CPU: 3 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   43.140038] Tainted: [B]=BAD_PAGE, [N]=TEST
[   43.140046] Hardware name: Thundercomm Dragonboard 845c (DT)
[   43.140057] Call trace:
[   43.140065]  show_stack+0x20/0x38 (C)
[   43.140083]  dump_stack_lvl+0x8c/0xd0
[   43.140106]  print_report+0x118/0x608
[   43.140124]  kasan_report+0xdc/0x128
[   43.140143]  __asan_report_load1_noabort+0x20/0x30
[   43.140162]  ksize_unpoisons_memory+0x618/0x740
[   43.140182]  kunit_try_run_case+0x170/0x3f0
[   43.140200]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.140223]  kthread+0x328/0x630
[   43.140237]  ret_from_fork+0x10/0x20
[   43.140254] 
[   43.206302] Allocated by task 303:
[   43.209762]  kasan_save_stack+0x3c/0x68
[   43.213672]  kasan_save_track+0x20/0x40
[   43.217582]  kasan_save_alloc_info+0x40/0x58
[   43.221920]  __kasan_kmalloc+0xd4/0xd8
[   43.225742]  __kmalloc_cache_noprof+0x16c/0x3c0
[   43.230352]  ksize_unpoisons_memory+0xc0/0x740
[   43.234873]  kunit_try_run_case+0x170/0x3f0
[   43.239124]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.244702]  kthread+0x328/0x630
[   43.247993]  ret_from_fork+0x10/0x20
[   43.251634] 
[   43.253171] The buggy address belongs to the object at ffff000082240100
[   43.253171]  which belongs to the cache kmalloc-128 of size 128
[   43.265835] The buggy address is located 5 bytes to the right of
[   43.265835]  allocated 115-byte region [ffff000082240100, ffff000082240173)
[   43.278941] 
[   43.280477] The buggy address belongs to the physical page:
[   43.286124] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   43.294238] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   43.301995] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   43.309049] page_type: f5(slab)
[   43.312252] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.320096] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.327940] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.335872] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.343802] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   43.351731] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   43.359656] page dumped because: kasan: bad access detected
[   43.365303] 
[   43.366833] Memory state around the buggy address:
[   43.371692]  ffff000082240000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.379007]  ffff000082240080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.386332] >ffff000082240100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[   43.393652]                                                                 ^
[   43.400888]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.408212]  ffff000082240200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.415527] ==================================================================
[   43.423704] ==================================================================
[   43.431032] BUG: KASAN: slab-out-of-bounds in ksize_unpoisons_memory+0x690/0x740
[   43.438530] Read of size 1 at addr ffff00008224017f by task kunit_try_catch/303
[   43.445936] 
[   43.447472] CPU: 5 UID: 0 PID: 303 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   43.447503] Tainted: [B]=BAD_PAGE, [N]=TEST
[   43.447512] Hardware name: Thundercomm Dragonboard 845c (DT)
[   43.447523] Call trace:
[   43.447530]  show_stack+0x20/0x38 (C)
[   43.447547]  dump_stack_lvl+0x8c/0xd0
[   43.447566]  print_report+0x118/0x608
[   43.447584]  kasan_report+0xdc/0x128
[   43.447603]  __asan_report_load1_noabort+0x20/0x30
[   43.447619]  ksize_unpoisons_memory+0x690/0x740
[   43.447637]  kunit_try_run_case+0x170/0x3f0
[   43.447654]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.447676]  kthread+0x328/0x630
[   43.447690]  ret_from_fork+0x10/0x20
[   43.447706] 
[   43.513723] Allocated by task 303:
[   43.517175]  kasan_save_stack+0x3c/0x68
[   43.521083]  kasan_save_track+0x20/0x40
[   43.524987]  kasan_save_alloc_info+0x40/0x58
[   43.529323]  __kasan_kmalloc+0xd4/0xd8
[   43.533137]  __kmalloc_cache_noprof+0x16c/0x3c0
[   43.537738]  ksize_unpoisons_memory+0xc0/0x740
[   43.542249]  kunit_try_run_case+0x170/0x3f0
[   43.546499]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   43.552069]  kthread+0x328/0x630
[   43.555351]  ret_from_fork+0x10/0x20
[   43.558985] 
[   43.560515] The buggy address belongs to the object at ffff000082240100
[   43.560515]  which belongs to the cache kmalloc-128 of size 128
[   43.573168] The buggy address is located 12 bytes to the right of
[   43.573168]  allocated 115-byte region [ffff000082240100, ffff000082240173)
[   43.586355] 
[   43.587883] The buggy address belongs to the physical page:
[   43.593527] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   43.601629] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   43.609381] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   43.616437] page_type: f5(slab)
[   43.619631] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.627471] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.635313] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   43.643238] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   43.651163] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   43.659090] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   43.667013] page dumped because: kasan: bad access detected
[   43.672663] 
[   43.674185] Memory state around the buggy address:
[   43.679045]  ffff000082240000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   43.686360]  ffff000082240080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.693673] >ffff000082240100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc
[   43.700984]                                                                 ^
[   43.708210]  ffff000082240180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.715526]  ffff000082240200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   43.722833] ==================================================================

[   42.482103] ==================================================================
[   42.489417] BUG: KASAN: double-free in kfree_sensitive+0x3c/0xb0
[   42.495514] Free of addr ffff0000955dd4a0 by task kunit_try_catch/301
[   42.502040] 
[   42.503573] CPU: 7 UID: 0 PID: 301 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   42.503602] Tainted: [B]=BAD_PAGE, [N]=TEST
[   42.503609] Hardware name: Thundercomm Dragonboard 845c (DT)
[   42.503621] Call trace:
[   42.503628]  show_stack+0x20/0x38 (C)
[   42.503646]  dump_stack_lvl+0x8c/0xd0
[   42.503664]  print_report+0x118/0x608
[   42.503682]  kasan_report_invalid_free+0xc0/0xe8
[   42.503703]  check_slab_allocation+0xd4/0x108
[   42.503722]  __kasan_slab_pre_free+0x2c/0x48
[   42.503741]  kfree+0xe8/0x3c8
[   42.503757]  kfree_sensitive+0x3c/0xb0
[   42.503773]  kmalloc_double_kzfree+0x168/0x308
[   42.503791]  kunit_try_run_case+0x170/0x3f0
[   42.503809]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.503830]  kthread+0x328/0x630
[   42.503843]  ret_from_fork+0x10/0x20
[   42.503860] 
[   42.581525] Allocated by task 301:
[   42.584977]  kasan_save_stack+0x3c/0x68
[   42.588883]  kasan_save_track+0x20/0x40
[   42.592789]  kasan_save_alloc_info+0x40/0x58
[   42.597124]  __kasan_kmalloc+0xd4/0xd8
[   42.600940]  __kmalloc_cache_noprof+0x16c/0x3c0
[   42.605538]  kmalloc_double_kzfree+0xb8/0x308
[   42.609960]  kunit_try_run_case+0x170/0x3f0
[   42.614209]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.619773]  kthread+0x328/0x630
[   42.623058]  ret_from_fork+0x10/0x20
[   42.626690] 
[   42.628220] Freed by task 301:
[   42.631325]  kasan_save_stack+0x3c/0x68
[   42.635220]  kasan_save_track+0x20/0x40
[   42.639124]  kasan_save_free_info+0x4c/0x78
[   42.643369]  __kasan_slab_free+0x6c/0x98
[   42.647361]  kfree+0x214/0x3c8
[   42.650473]  kfree_sensitive+0x80/0xb0
[   42.654288]  kmalloc_double_kzfree+0x11c/0x308
[   42.658799]  kunit_try_run_case+0x170/0x3f0
[   42.663049]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.668612]  kthread+0x328/0x630
[   42.671894]  ret_from_fork+0x10/0x20
[   42.675536] 
[   42.677060] The buggy address belongs to the object at ffff0000955dd4a0
[   42.677060]  which belongs to the cache kmalloc-16 of size 16
[   42.689538] The buggy address is located 0 bytes inside of
[   42.689538]  16-byte region [ffff0000955dd4a0, ffff0000955dd4b0)
[   42.701139] 
[   42.702665] The buggy address belongs to the physical page:
[   42.708312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1155dd
[   42.716411] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   42.723028] page_type: f5(slab)
[   42.726226] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   42.734067] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   42.741904] page dumped because: kasan: bad access detected
[   42.747543] 
[   42.749066] Memory state around the buggy address:
[   42.753917]  ffff0000955dd380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   42.761237]  ffff0000955dd400: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   42.768556] >ffff0000955dd480: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   42.775869]                                ^
[   42.780202]  ffff0000955dd500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.787520]  ffff0000955dd580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.794827] ==================================================================

[   42.160570] ==================================================================
[   42.175202] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   42.182705] Read of size 1 at addr ffff0000955dd4a0 by task kunit_try_catch/301
[   42.190110] 
[   42.191644] CPU: 7 UID: 0 PID: 301 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   42.191676] Tainted: [B]=BAD_PAGE, [N]=TEST
[   42.191684] Hardware name: Thundercomm Dragonboard 845c (DT)
[   42.191697] Call trace:
[   42.191704]  show_stack+0x20/0x38 (C)
[   42.191721]  dump_stack_lvl+0x8c/0xd0
[   42.191742]  print_report+0x118/0x608
[   42.191761]  kasan_report+0xdc/0x128
[   42.191778]  __kasan_check_byte+0x54/0x70
[   42.191796]  kfree_sensitive+0x30/0xb0
[   42.191817]  kmalloc_double_kzfree+0x168/0x308
[   42.191836]  kunit_try_run_case+0x170/0x3f0
[   42.191853]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.191874]  kthread+0x328/0x630
[   42.191887]  ret_from_fork+0x10/0x20
[   42.191905] 
[   42.260854] Allocated by task 301:
[   42.264307]  kasan_save_stack+0x3c/0x68
[   42.268213]  kasan_save_track+0x20/0x40
[   42.272116]  kasan_save_alloc_info+0x40/0x58
[   42.276452]  __kasan_kmalloc+0xd4/0xd8
[   42.280268]  __kmalloc_cache_noprof+0x16c/0x3c0
[   42.284866]  kmalloc_double_kzfree+0xb8/0x308
[   42.289290]  kunit_try_run_case+0x170/0x3f0
[   42.293539]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.299105]  kthread+0x328/0x630
[   42.302388]  ret_from_fork+0x10/0x20
[   42.306031] 
[   42.307560] Freed by task 301:
[   42.310672]  kasan_save_stack+0x3c/0x68
[   42.314576]  kasan_save_track+0x20/0x40
[   42.318479]  kasan_save_free_info+0x4c/0x78
[   42.322725]  __kasan_slab_free+0x6c/0x98
[   42.326718]  kfree+0x214/0x3c8
[   42.329827]  kfree_sensitive+0x80/0xb0
[   42.333644]  kmalloc_double_kzfree+0x11c/0x308
[   42.338156]  kunit_try_run_case+0x170/0x3f0
[   42.342405]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.347976]  kthread+0x328/0x630
[   42.351259]  ret_from_fork+0x10/0x20
[   42.354892] 
[   42.356423] The buggy address belongs to the object at ffff0000955dd4a0
[   42.356423]  which belongs to the cache kmalloc-16 of size 16
[   42.368902] The buggy address is located 0 bytes inside of
[   42.368902]  freed 16-byte region [ffff0000955dd4a0, ffff0000955dd4b0)
[   42.381039] 
[   42.382563] The buggy address belongs to the physical page:
[   42.388202] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1155dd
[   42.396302] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   42.402918] page_type: f5(slab)
[   42.406114] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   42.413953] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   42.421792] page dumped because: kasan: bad access detected
[   42.427432] 
[   42.428954] Memory state around the buggy address:
[   42.433807]  ffff0000955dd380: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   42.441121]  ffff0000955dd400: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   42.448435] >ffff0000955dd480: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   42.455749]                                ^
[   42.460082]  ffff0000955dd500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.467398]  ffff0000955dd580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.474706] ==================================================================

[   41.840510] ==================================================================
[   41.851811] BUG: KASAN: slab-use-after-free in kmalloc_uaf2+0x3f4/0x468
[   41.858520] Read of size 1 at addr ffff000097bcda28 by task kunit_try_catch/297
[   41.865930] 
[   41.867464] CPU: 2 UID: 0 PID: 297 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   41.867493] Tainted: [B]=BAD_PAGE, [N]=TEST
[   41.867502] Hardware name: Thundercomm Dragonboard 845c (DT)
[   41.867513] Call trace:
[   41.867520]  show_stack+0x20/0x38 (C)
[   41.867537]  dump_stack_lvl+0x8c/0xd0
[   41.867558]  print_report+0x118/0x608
[   41.867576]  kasan_report+0xdc/0x128
[   41.867595]  __asan_report_load1_noabort+0x20/0x30
[   41.867613]  kmalloc_uaf2+0x3f4/0x468
[   41.867629]  kunit_try_run_case+0x170/0x3f0
[   41.867648]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.867670]  kthread+0x328/0x630
[   41.867685]  ret_from_fork+0x10/0x20
[   41.867702] 
[   41.932886] Allocated by task 297:
[   41.936346]  kasan_save_stack+0x3c/0x68
[   41.940256]  kasan_save_track+0x20/0x40
[   41.944166]  kasan_save_alloc_info+0x40/0x58
[   41.948506]  __kasan_kmalloc+0xd4/0xd8
[   41.952329]  __kmalloc_cache_noprof+0x16c/0x3c0
[   41.956940]  kmalloc_uaf2+0xc4/0x468
[   41.960578]  kunit_try_run_case+0x170/0x3f0
[   41.964832]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.970408]  kthread+0x328/0x630
[   41.973699]  ret_from_fork+0x10/0x20
[   41.977336] 
[   41.978868] Freed by task 297:
[   41.981980]  kasan_save_stack+0x3c/0x68
[   41.985890]  kasan_save_track+0x20/0x40
[   41.989800]  kasan_save_free_info+0x4c/0x78
[   41.994052]  __kasan_slab_free+0x6c/0x98
[   41.998049]  kfree+0x214/0x3c8
[   42.001168]  kmalloc_uaf2+0x134/0x468
[   42.004902]  kunit_try_run_case+0x170/0x3f0
[   42.009156]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   42.014731]  kthread+0x328/0x630
[   42.018022]  ret_from_fork+0x10/0x20
[   42.021660] 
[   42.023188] The buggy address belongs to the object at ffff000097bcda00
[   42.023188]  which belongs to the cache kmalloc-64 of size 64
[   42.035679] The buggy address is located 40 bytes inside of
[   42.035679]  freed 64-byte region [ffff000097bcda00, ffff000097bcda40)
[   42.047901] 
[   42.049431] The buggy address belongs to the physical page:
[   42.055080] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117bcd
[   42.063195] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   42.069810] page_type: f5(slab)
[   42.073015] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000
[   42.080860] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   42.088702] page dumped because: kasan: bad access detected
[   42.094354] 
[   42.095889] Memory state around the buggy address:
[   42.100753]  ffff000097bcd900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   42.108068]  ffff000097bcd980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   42.115385] >ffff000097bcda00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   42.122698]                                   ^
[   42.127301]  ffff000097bcda80: 00 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc
[   42.134618]  ffff000097bcdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   42.141940] ==================================================================

[   41.523261] ==================================================================
[   41.533949] BUG: KASAN: slab-use-after-free in kmalloc_uaf_memset+0x170/0x310
[   41.541182] Write of size 33 at addr ffff000081814780 by task kunit_try_catch/295
[   41.548770] 
[   41.550305] CPU: 3 UID: 0 PID: 295 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   41.550337] Tainted: [B]=BAD_PAGE, [N]=TEST
[   41.550346] Hardware name: Thundercomm Dragonboard 845c (DT)
[   41.550360] Call trace:
[   41.550367]  show_stack+0x20/0x38 (C)
[   41.550385]  dump_stack_lvl+0x8c/0xd0
[   41.550409]  print_report+0x118/0x608
[   41.550427]  kasan_report+0xdc/0x128
[   41.550447]  kasan_check_range+0x100/0x1a8
[   41.550467]  __asan_memset+0x34/0x78
[   41.550485]  kmalloc_uaf_memset+0x170/0x310
[   41.550503]  kunit_try_run_case+0x170/0x3f0
[   41.550522]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.550544]  kthread+0x328/0x630
[   41.550558]  ret_from_fork+0x10/0x20
[   41.550576] 
[   41.619207] Allocated by task 295:
[   41.622673]  kasan_save_stack+0x3c/0x68
[   41.626581]  kasan_save_track+0x20/0x40
[   41.630486]  kasan_save_alloc_info+0x40/0x58
[   41.634831]  __kasan_kmalloc+0xd4/0xd8
[   41.638650]  __kmalloc_cache_noprof+0x16c/0x3c0
[   41.643256]  kmalloc_uaf_memset+0xb8/0x310
[   41.647419]  kunit_try_run_case+0x170/0x3f0
[   41.651680]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.657249]  kthread+0x328/0x630
[   41.660536]  ret_from_fork+0x10/0x20
[   41.664181] 
[   41.665711] Freed by task 295:
[   41.668820]  kasan_save_stack+0x3c/0x68
[   41.672726]  kasan_save_track+0x20/0x40
[   41.676632]  kasan_save_free_info+0x4c/0x78
[   41.680890]  __kasan_slab_free+0x6c/0x98
[   41.684883]  kfree+0x214/0x3c8
[   41.687997]  kmalloc_uaf_memset+0x11c/0x310
[   41.692256]  kunit_try_run_case+0x170/0x3f0
[   41.696518]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.702087]  kthread+0x328/0x630
[   41.705374]  ret_from_fork+0x10/0x20
[   41.709018] 
[   41.710549] The buggy address belongs to the object at ffff000081814780
[   41.710549]  which belongs to the cache kmalloc-64 of size 64
[   41.723037] The buggy address is located 0 bytes inside of
[   41.723037]  freed 64-byte region [ffff000081814780, ffff0000818147c0)
[   41.735173] 
[   41.736705] The buggy address belongs to the physical page:
[   41.742352] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101814
[   41.750457] ksm flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   41.757428] page_type: f5(slab)
[   41.760628] raw: 0bfffe0000000000 ffff0000800028c0 fffffdffc20ea340 0000000000000007
[   41.768476] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   41.776318] page dumped because: kasan: bad access detected
[   41.781966] 
[   41.783496] Memory state around the buggy address:
[   41.788354]  ffff000081814680: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.795669]  ffff000081814700: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.802984] >ffff000081814780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.810298]                    ^
[   41.813583]  ffff000081814800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.820899]  ffff000081814880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.828212] ==================================================================

[   41.210189] ==================================================================
[   41.222363] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   41.228983] Read of size 1 at addr ffff000097bbea08 by task kunit_try_catch/293
[   41.236397] 
[   41.237931] CPU: 2 UID: 0 PID: 293 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   41.237962] Tainted: [B]=BAD_PAGE, [N]=TEST
[   41.237971] Hardware name: Thundercomm Dragonboard 845c (DT)
[   41.237985] Call trace:
[   41.237991]  show_stack+0x20/0x38 (C)
[   41.238009]  dump_stack_lvl+0x8c/0xd0
[   41.238031]  print_report+0x118/0x608
[   41.238050]  kasan_report+0xdc/0x128
[   41.238069]  __asan_report_load1_noabort+0x20/0x30
[   41.238087]  kmalloc_uaf+0x300/0x338
[   41.238105]  kunit_try_run_case+0x170/0x3f0
[   41.238124]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.238146]  kthread+0x328/0x630
[   41.238161]  ret_from_fork+0x10/0x20
[   41.238179] 
[   41.303268] Allocated by task 293:
[   41.306731]  kasan_save_stack+0x3c/0x68
[   41.310643]  kasan_save_track+0x20/0x40
[   41.314544]  kasan_save_alloc_info+0x40/0x58
[   41.318882]  __kasan_kmalloc+0xd4/0xd8
[   41.322696]  __kmalloc_cache_noprof+0x16c/0x3c0
[   41.327309]  kmalloc_uaf+0xb8/0x338
[   41.330863]  kunit_try_run_case+0x170/0x3f0
[   41.335116]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.340689]  kthread+0x328/0x630
[   41.343983]  ret_from_fork+0x10/0x20
[   41.347625] 
[   41.349153] Freed by task 293:
[   41.352268]  kasan_save_stack+0x3c/0x68
[   41.356179]  kasan_save_track+0x20/0x40
[   41.360089]  kasan_save_free_info+0x4c/0x78
[   41.364343]  __kasan_slab_free+0x6c/0x98
[   41.368341]  kfree+0x214/0x3c8
[   41.371453]  kmalloc_uaf+0x11c/0x338
[   41.375091]  kunit_try_run_case+0x170/0x3f0
[   41.379346]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.384918]  kthread+0x328/0x630
[   41.388209]  ret_from_fork+0x10/0x20
[   41.391849] 
[   41.393379] The buggy address belongs to the object at ffff000097bbea00
[   41.393379]  which belongs to the cache kmalloc-16 of size 16
[   41.405865] The buggy address is located 8 bytes inside of
[   41.405865]  freed 16-byte region [ffff000097bbea00, ffff000097bbea10)
[   41.418007] 
[   41.419537] The buggy address belongs to the physical page:
[   41.425186] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117bbe
[   41.433292] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   41.439909] page_type: f5(slab)
[   41.443119] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   41.450969] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   41.458814] page dumped because: kasan: bad access detected
[   41.464462] 
[   41.465993] Memory state around the buggy address:
[   41.470857]  ffff000097bbe900: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   41.478173]  ffff000097bbe980: fa fb fc fc fa fb fc fc fa fb fc fc 00 05 fc fc
[   41.485491] >ffff000097bbea00: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.492806]                       ^
[   41.496355]  ffff000097bbea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.503673]  ffff000097bbeb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.510989] ==================================================================

[   40.932742] ==================================================================
[   40.944997] BUG: KASAN: slab-out-of-bounds in kmalloc_memmove_invalid_size+0x154/0x2e0
[   40.953019] Read of size 64 at addr ffff000098090384 by task kunit_try_catch/291
[   40.960517] 
[   40.962046] CPU: 4 UID: 0 PID: 291 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   40.962077] Tainted: [B]=BAD_PAGE, [N]=TEST
[   40.962085] Hardware name: Thundercomm Dragonboard 845c (DT)
[   40.962097] Call trace:
[   40.962104]  show_stack+0x20/0x38 (C)
[   40.962123]  dump_stack_lvl+0x8c/0xd0
[   40.962144]  print_report+0x118/0x608
[   40.962162]  kasan_report+0xdc/0x128
[   40.962181]  kasan_check_range+0x100/0x1a8
[   40.962201]  __asan_memmove+0x3c/0x98
[   40.962215]  kmalloc_memmove_invalid_size+0x154/0x2e0
[   40.962234]  kunit_try_run_case+0x170/0x3f0
[   40.962253]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.962274]  kthread+0x328/0x630
[   40.962288]  ret_from_fork+0x10/0x20
[   40.962305] 
[   41.031831] Allocated by task 291:
[   41.035286]  kasan_save_stack+0x3c/0x68
[   41.039185]  kasan_save_track+0x20/0x40
[   41.043080]  kasan_save_alloc_info+0x40/0x58
[   41.047416]  __kasan_kmalloc+0xd4/0xd8
[   41.051234]  __kmalloc_cache_noprof+0x16c/0x3c0
[   41.055837]  kmalloc_memmove_invalid_size+0xb0/0x2e0
[   41.060872]  kunit_try_run_case+0x170/0x3f0
[   41.065124]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   41.070690]  kthread+0x328/0x630
[   41.073975]  ret_from_fork+0x10/0x20
[   41.077609] 
[   41.079141] The buggy address belongs to the object at ffff000098090380
[   41.079141]  which belongs to the cache kmalloc-64 of size 64
[   41.091620] The buggy address is located 4 bytes inside of
[   41.091620]  allocated 64-byte region [ffff000098090380, ffff0000980903c0)
[   41.104106] 
[   41.105631] The buggy address belongs to the physical page:
[   41.111273] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118090
[   41.119377] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   41.125997] page_type: f5(slab)
[   41.129194] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000
[   41.137036] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   41.144875] page dumped because: kasan: bad access detected
[   41.150523] 
[   41.152053] Memory state around the buggy address:
[   41.156908]  ffff000098090280: 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc fc
[   41.164225]  ffff000098090300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   41.171532] >ffff000098090380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   41.178842]                                            ^
[   41.184226]  ffff000098090400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.191543]  ffff000098090480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.198854] ==================================================================

[   40.657013] ==================================================================
[   40.668578] BUG: KASAN: out-of-bounds in kmalloc_memmove_negative_size+0x154/0x2e0
[   40.676258] Read of size 18446744073709551614 at addr ffff000097bcd984 by task kunit_try_catch/289
[   40.685339] 
[   40.686875] CPU: 2 UID: 0 PID: 289 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   40.686905] Tainted: [B]=BAD_PAGE, [N]=TEST
[   40.686915] Hardware name: Thundercomm Dragonboard 845c (DT)
[   40.686927] Call trace:
[   40.686935]  show_stack+0x20/0x38 (C)
[   40.686953]  dump_stack_lvl+0x8c/0xd0
[   40.686975]  print_report+0x118/0x608
[   40.686995]  kasan_report+0xdc/0x128
[   40.687014]  kasan_check_range+0x100/0x1a8
[   40.687035]  __asan_memmove+0x3c/0x98
[   40.687052]  kmalloc_memmove_negative_size+0x154/0x2e0
[   40.687072]  kunit_try_run_case+0x170/0x3f0
[   40.687090]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.687114]  kthread+0x328/0x630
[   40.687130]  ret_from_fork+0x10/0x20
[   40.687149] 
[   40.756827] Allocated by task 289:
[   40.760294]  kasan_save_stack+0x3c/0x68
[   40.764201]  kasan_save_track+0x20/0x40
[   40.768106]  kasan_save_alloc_info+0x40/0x58
[   40.772452]  __kasan_kmalloc+0xd4/0xd8
[   40.776269]  __kmalloc_cache_noprof+0x16c/0x3c0
[   40.780877]  kmalloc_memmove_negative_size+0xb0/0x2e0
[   40.786013]  kunit_try_run_case+0x170/0x3f0
[   40.790274]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.795845]  kthread+0x328/0x630
[   40.799132]  ret_from_fork+0x10/0x20
[   40.802776] 
[   40.804307] The buggy address belongs to the object at ffff000097bcd980
[   40.804307]  which belongs to the cache kmalloc-64 of size 64
[   40.816798] The buggy address is located 4 bytes inside of
[   40.816798]  64-byte region [ffff000097bcd980, ffff000097bcd9c0)
[   40.828415] 
[   40.829948] The buggy address belongs to the physical page:
[   40.835594] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117bcd
[   40.843699] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   40.850324] page_type: f5(slab)
[   40.853526] raw: 0bfffe0000000000 ffff0000800028c0 dead000000000122 0000000000000000
[   40.861372] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   40.869216] page dumped because: kasan: bad access detected
[   40.874862] 
[   40.876392] Memory state around the buggy address:
[   40.881250]  ffff000097bcd880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   40.888564]  ffff000097bcd900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   40.895881] >ffff000097bcd980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   40.903195]                    ^
[   40.906479]  ffff000097bcda00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.913794]  ffff000097bcda80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.921106] ==================================================================

[   40.339324] ==================================================================
[   40.350793] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8
[   40.358205] Write of size 16 at addr ffff000095356269 by task kunit_try_catch/287
[   40.365788] 
[   40.367324] CPU: 4 UID: 0 PID: 287 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   40.367355] Tainted: [B]=BAD_PAGE, [N]=TEST
[   40.367364] Hardware name: Thundercomm Dragonboard 845c (DT)
[   40.367377] Call trace:
[   40.367384]  show_stack+0x20/0x38 (C)
[   40.367402]  dump_stack_lvl+0x8c/0xd0
[   40.367421]  print_report+0x118/0x608
[   40.367440]  kasan_report+0xdc/0x128
[   40.367457]  kasan_check_range+0x100/0x1a8
[   40.367476]  __asan_memset+0x34/0x78
[   40.367491]  kmalloc_oob_memset_16+0x150/0x2f8
[   40.367509]  kunit_try_run_case+0x170/0x3f0
[   40.367526]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.367547]  kthread+0x328/0x630
[   40.367560]  ret_from_fork+0x10/0x20
[   40.367577] 
[   40.436420] Allocated by task 287:
[   40.439875]  kasan_save_stack+0x3c/0x68
[   40.443784]  kasan_save_track+0x20/0x40
[   40.447691]  kasan_save_alloc_info+0x40/0x58
[   40.452028]  __kasan_kmalloc+0xd4/0xd8
[   40.455848]  __kmalloc_cache_noprof+0x16c/0x3c0
[   40.460447]  kmalloc_oob_memset_16+0xb0/0x2f8
[   40.464871]  kunit_try_run_case+0x170/0x3f0
[   40.469122]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.474689]  kthread+0x328/0x630
[   40.477971]  ret_from_fork+0x10/0x20
[   40.481605] 
[   40.483137] The buggy address belongs to the object at ffff000095356200
[   40.483137]  which belongs to the cache kmalloc-128 of size 128
[   40.495794] The buggy address is located 105 bytes inside of
[   40.495794]  allocated 120-byte region [ffff000095356200, ffff000095356278)
[   40.508541] 
[   40.510067] The buggy address belongs to the physical page:
[   40.515712] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115356
[   40.523815] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   40.531570] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   40.538624] page_type: f5(slab)
[   40.541821] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   40.549664] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   40.557507] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   40.565435] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   40.573362] head: 0bfffe0000000001 fffffdffc254d581 00000000ffffffff 00000000ffffffff
[   40.581290] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   40.589215] page dumped because: kasan: bad access detected
[   40.594862] 
[   40.596391] Memory state around the buggy address:
[   40.601245]  ffff000095356100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   40.608563]  ffff000095356180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.615870] >ffff000095356200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   40.623179]                                                                 ^
[   40.630400]  ffff000095356280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.637717]  ffff000095356300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.645022] ==================================================================

[   40.021323] ==================================================================
[   40.032797] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_8+0x150/0x2f8
[   40.040122] Write of size 8 at addr ffff000082240071 by task kunit_try_catch/285
[   40.047621] 
[   40.049153] CPU: 3 UID: 0 PID: 285 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   40.049184] Tainted: [B]=BAD_PAGE, [N]=TEST
[   40.049192] Hardware name: Thundercomm Dragonboard 845c (DT)
[   40.049203] Call trace:
[   40.049211]  show_stack+0x20/0x38 (C)
[   40.049229]  dump_stack_lvl+0x8c/0xd0
[   40.049249]  print_report+0x118/0x608
[   40.049268]  kasan_report+0xdc/0x128
[   40.049287]  kasan_check_range+0x100/0x1a8
[   40.049308]  __asan_memset+0x34/0x78
[   40.049323]  kmalloc_oob_memset_8+0x150/0x2f8
[   40.049341]  kunit_try_run_case+0x170/0x3f0
[   40.049361]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.049383]  kthread+0x328/0x630
[   40.049397]  ret_from_fork+0x10/0x20
[   40.049415] 
[   40.118214] Allocated by task 285:
[   40.121673]  kasan_save_stack+0x3c/0x68
[   40.125581]  kasan_save_track+0x20/0x40
[   40.129489]  kasan_save_alloc_info+0x40/0x58
[   40.133827]  __kasan_kmalloc+0xd4/0xd8
[   40.137648]  __kmalloc_cache_noprof+0x16c/0x3c0
[   40.142258]  kmalloc_oob_memset_8+0xb0/0x2f8
[   40.146598]  kunit_try_run_case+0x170/0x3f0
[   40.150849]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   40.156425]  kthread+0x328/0x630
[   40.159717]  ret_from_fork+0x10/0x20
[   40.163356] 
[   40.164892] The buggy address belongs to the object at ffff000082240000
[   40.164892]  which belongs to the cache kmalloc-128 of size 128
[   40.177554] The buggy address is located 113 bytes inside of
[   40.177554]  allocated 120-byte region [ffff000082240000, ffff000082240078)
[   40.190303] 
[   40.191839] The buggy address belongs to the physical page:
[   40.197485] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102240
[   40.205595] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   40.213348] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   40.220400] page_type: f5(slab)
[   40.223607] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   40.231449] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   40.239292] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   40.247232] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   40.255171] head: 0bfffe0000000001 fffffdffc2089001 00000000ffffffff 00000000ffffffff
[   40.263111] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   40.271036] page dumped because: kasan: bad access detected
[   40.276689] 
[   40.278219] Memory state around the buggy address:
[   40.283080]  ffff00008223ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.290404]  ffff00008223ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.297725] >ffff000082240000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   40.305044]                                                                 ^
[   40.312277]  ffff000082240080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.319593]  ffff000082240100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.326915] ==================================================================

[   39.705265] ==================================================================
[   39.716745] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_4+0x150/0x300
[   39.724068] Write of size 4 at addr ffff000095356175 by task kunit_try_catch/283
[   39.731563] 
[   39.733101] CPU: 4 UID: 0 PID: 283 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   39.733131] Tainted: [B]=BAD_PAGE, [N]=TEST
[   39.733141] Hardware name: Thundercomm Dragonboard 845c (DT)
[   39.733152] Call trace:
[   39.733160]  show_stack+0x20/0x38 (C)
[   39.733178]  dump_stack_lvl+0x8c/0xd0
[   39.733199]  print_report+0x118/0x608
[   39.733218]  kasan_report+0xdc/0x128
[   39.733237]  kasan_check_range+0x100/0x1a8
[   39.733257]  __asan_memset+0x34/0x78
[   39.733272]  kmalloc_oob_memset_4+0x150/0x300
[   39.733289]  kunit_try_run_case+0x170/0x3f0
[   39.733307]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.733329]  kthread+0x328/0x630
[   39.733342]  ret_from_fork+0x10/0x20
[   39.733358] 
[   39.802129] Allocated by task 283:
[   39.805582]  kasan_save_stack+0x3c/0x68
[   39.809488]  kasan_save_track+0x20/0x40
[   39.813394]  kasan_save_alloc_info+0x40/0x58
[   39.817729]  __kasan_kmalloc+0xd4/0xd8
[   39.821546]  __kmalloc_cache_noprof+0x16c/0x3c0
[   39.826147]  kmalloc_oob_memset_4+0xb0/0x300
[   39.830486]  kunit_try_run_case+0x170/0x3f0
[   39.834737]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.840297]  kthread+0x328/0x630
[   39.843579]  ret_from_fork+0x10/0x20
[   39.847211] 
[   39.848743] The buggy address belongs to the object at ffff000095356100
[   39.848743]  which belongs to the cache kmalloc-128 of size 128
[   39.861399] The buggy address is located 117 bytes inside of
[   39.861399]  allocated 120-byte region [ffff000095356100, ffff000095356178)
[   39.874140] 
[   39.875671] The buggy address belongs to the physical page:
[   39.881319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115356
[   39.889417] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   39.897171] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   39.904217] page_type: f5(slab)
[   39.907414] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   39.915255] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.923098] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   39.931024] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.938949] head: 0bfffe0000000001 fffffdffc254d581 00000000ffffffff 00000000ffffffff
[   39.946874] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   39.954799] page dumped because: kasan: bad access detected
[   39.960440] 
[   39.961963] Memory state around the buggy address:
[   39.966817]  ffff000095356000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.974133]  ffff000095356080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.981447] >ffff000095356100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   39.988763]                                                                 ^
[   39.995986]  ffff000095356180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.003303]  ffff000095356200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   40.010610] ==================================================================

[   39.387999] ==================================================================
[   39.399563] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_2+0x150/0x2f8
[   39.406883] Write of size 2 at addr ffff000080df5877 by task kunit_try_catch/281
[   39.414384] 
[   39.415920] CPU: 2 UID: 0 PID: 281 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   39.415952] Tainted: [B]=BAD_PAGE, [N]=TEST
[   39.415961] Hardware name: Thundercomm Dragonboard 845c (DT)
[   39.415974] Call trace:
[   39.415980]  show_stack+0x20/0x38 (C)
[   39.415998]  dump_stack_lvl+0x8c/0xd0
[   39.416020]  print_report+0x118/0x608
[   39.416040]  kasan_report+0xdc/0x128
[   39.416058]  kasan_check_range+0x100/0x1a8
[   39.416079]  __asan_memset+0x34/0x78
[   39.416095]  kmalloc_oob_memset_2+0x150/0x2f8
[   39.416113]  kunit_try_run_case+0x170/0x3f0
[   39.416131]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.416152]  kthread+0x328/0x630
[   39.416169]  ret_from_fork+0x10/0x20
[   39.416187] 
[   39.484991] Allocated by task 281:
[   39.488458]  kasan_save_stack+0x3c/0x68
[   39.492363]  kasan_save_track+0x20/0x40
[   39.496269]  kasan_save_alloc_info+0x40/0x58
[   39.500613]  __kasan_kmalloc+0xd4/0xd8
[   39.504432]  __kmalloc_cache_noprof+0x16c/0x3c0
[   39.509040]  kmalloc_oob_memset_2+0xb0/0x2f8
[   39.513387]  kunit_try_run_case+0x170/0x3f0
[   39.517646]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.523215]  kthread+0x328/0x630
[   39.526502]  ret_from_fork+0x10/0x20
[   39.530147] 
[   39.531677] The buggy address belongs to the object at ffff000080df5800
[   39.531677]  which belongs to the cache kmalloc-128 of size 128
[   39.544339] The buggy address is located 119 bytes inside of
[   39.544339]  allocated 120-byte region [ffff000080df5800, ffff000080df5878)
[   39.557090] 
[   39.558621] The buggy address belongs to the physical page:
[   39.564270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100df4
[   39.572375] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   39.580135] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   39.587193] page_type: f5(slab)
[   39.590393] raw: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   39.598240] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.606088] head: 0bfffe0000000040 ffff000080002a00 dead000000000122 0000000000000000
[   39.614021] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.621956] head: 0bfffe0000000001 fffffdffc2037d01 00000000ffffffff 00000000ffffffff
[   39.629889] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   39.637817] page dumped because: kasan: bad access detected
[   39.643463] 
[   39.644993] Memory state around the buggy address:
[   39.649853]  ffff000080df5700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.657168]  ffff000080df5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.664484] >ffff000080df5800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   39.671797]                                                                 ^
[   39.679022]  ffff000080df5880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.686337]  ffff000080df5900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.693651] ==================================================================

[   39.070531] ==================================================================
[   39.081492] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_in_memset+0x144/0x2d0
[   39.088904] Write of size 128 at addr ffff0000814acf00 by task kunit_try_catch/279
[   39.096577] 
[   39.098114] CPU: 3 UID: 0 PID: 279 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   39.098143] Tainted: [B]=BAD_PAGE, [N]=TEST
[   39.098152] Hardware name: Thundercomm Dragonboard 845c (DT)
[   39.098164] Call trace:
[   39.098173]  show_stack+0x20/0x38 (C)
[   39.098190]  dump_stack_lvl+0x8c/0xd0
[   39.098212]  print_report+0x118/0x608
[   39.098233]  kasan_report+0xdc/0x128
[   39.098252]  kasan_check_range+0x100/0x1a8
[   39.098273]  __asan_memset+0x34/0x78
[   39.098289]  kmalloc_oob_in_memset+0x144/0x2d0
[   39.098306]  kunit_try_run_case+0x170/0x3f0
[   39.098324]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.098346]  kthread+0x328/0x630
[   39.098361]  ret_from_fork+0x10/0x20
[   39.098380] 
[   39.167262] Allocated by task 279:
[   39.170724]  kasan_save_stack+0x3c/0x68
[   39.174633]  kasan_save_track+0x20/0x40
[   39.178543]  kasan_save_alloc_info+0x40/0x58
[   39.182881]  __kasan_kmalloc+0xd4/0xd8
[   39.186702]  __kmalloc_cache_noprof+0x16c/0x3c0
[   39.191313]  kmalloc_oob_in_memset+0xb0/0x2d0
[   39.195748]  kunit_try_run_case+0x170/0x3f0
[   39.200000]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   39.205574]  kthread+0x328/0x630
[   39.208865]  ret_from_fork+0x10/0x20
[   39.212502] 
[   39.214033] The buggy address belongs to the object at ffff0000814acf00
[   39.214033]  which belongs to the cache kmalloc-128 of size 128
[   39.226699] The buggy address is located 0 bytes inside of
[   39.226699]  allocated 120-byte region [ffff0000814acf00, ffff0000814acf78)
[   39.239277] 
[   39.240816] The buggy address belongs to the physical page:
[   39.246469] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1014ac
[   39.254583] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   39.262340] anon flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   39.269838] page_type: f5(slab)
[   39.273043] raw: 0bfffe0000000040 ffff000080002a00 0000000000000000 0000000000000001
[   39.280886] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.288732] head: 0bfffe0000000040 ffff000080002a00 0000000000000000 0000000000000001
[   39.296665] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   39.304596] head: 0bfffe0000000001 fffffdffc2052b01 00000000ffffffff 00000000ffffffff
[   39.312527] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[   39.320453] page dumped because: kasan: bad access detected
[   39.326103] 
[   39.327640] Memory state around the buggy address:
[   39.332500]  ffff0000814ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[   39.339814]  ffff0000814ace80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.347131] >ffff0000814acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
[   39.354444]                                                                 ^
[   39.361668]  ffff0000814acf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.368994]  ffff0000814ad000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   39.376314] ==================================================================

[   38.755294] ==================================================================
[   38.766237] BUG: KASAN: slab-use-after-free in kmalloc_uaf_16+0x3bc/0x438
[   38.773123] Read of size 16 at addr ffff0000981901e0 by task kunit_try_catch/277
[   38.780625] 
[   38.782160] CPU: 3 UID: 0 PID: 277 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   38.782189] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.782198] Hardware name: Thundercomm Dragonboard 845c (DT)
[   38.782210] Call trace:
[   38.782218]  show_stack+0x20/0x38 (C)
[   38.782237]  dump_stack_lvl+0x8c/0xd0
[   38.782259]  print_report+0x118/0x608
[   38.782280]  kasan_report+0xdc/0x128
[   38.782298]  __asan_report_load16_noabort+0x20/0x30
[   38.782318]  kmalloc_uaf_16+0x3bc/0x438
[   38.782335]  kunit_try_run_case+0x170/0x3f0
[   38.782353]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.782375]  kthread+0x328/0x630
[   38.782391]  ret_from_fork+0x10/0x20
[   38.782409] 
[   38.847849] Allocated by task 277:
[   38.851315]  kasan_save_stack+0x3c/0x68
[   38.855223]  kasan_save_track+0x20/0x40
[   38.859127]  kasan_save_alloc_info+0x40/0x58
[   38.863474]  __kasan_kmalloc+0xd4/0xd8
[   38.867290]  __kmalloc_cache_noprof+0x16c/0x3c0
[   38.871897]  kmalloc_uaf_16+0x140/0x438
[   38.875802]  kunit_try_run_case+0x170/0x3f0
[   38.880063]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.885634]  kthread+0x328/0x630
[   38.888919]  ret_from_fork+0x10/0x20
[   38.892564] 
[   38.894094] Freed by task 277:
[   38.897203]  kasan_save_stack+0x3c/0x68
[   38.901109]  kasan_save_track+0x20/0x40
[   38.905016]  kasan_save_free_info+0x4c/0x78
[   38.909275]  __kasan_slab_free+0x6c/0x98
[   38.913266]  kfree+0x214/0x3c8
[   38.916381]  kmalloc_uaf_16+0x190/0x438
[   38.920285]  kunit_try_run_case+0x170/0x3f0
[   38.924546]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.930116]  kthread+0x328/0x630
[   38.933403]  ret_from_fork+0x10/0x20
[   38.937048] 
[   38.938579] The buggy address belongs to the object at ffff0000981901e0
[   38.938579]  which belongs to the cache kmalloc-16 of size 16
[   38.951066] The buggy address is located 0 bytes inside of
[   38.951066]  freed 16-byte region [ffff0000981901e0, ffff0000981901f0)
[   38.963202] 
[   38.964733] The buggy address belongs to the physical page:
[   38.970381] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   38.978485] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   38.985109] page_type: f5(slab)
[   38.988310] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   38.996157] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   39.004000] page dumped because: kasan: bad access detected
[   39.009647] 
[   39.011177] Memory state around the buggy address:
[   39.016035]  ffff000098190080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   39.023350]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   39.030666] >ffff000098190180: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc
[   39.037980]                                                        ^
[   39.044420]  ffff000098190200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.051736]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.059050] ==================================================================

[   38.486881] ==================================================================
[   38.497656] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_16+0x3a0/0x3f8
[   38.504453] Write of size 16 at addr ffff000098190180 by task kunit_try_catch/275
[   38.512040] 
[   38.513574] CPU: 3 UID: 0 PID: 275 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   38.513606] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.513614] Hardware name: Thundercomm Dragonboard 845c (DT)
[   38.513627] Call trace:
[   38.513633]  show_stack+0x20/0x38 (C)
[   38.513651]  dump_stack_lvl+0x8c/0xd0
[   38.513672]  print_report+0x118/0x608
[   38.513691]  kasan_report+0xdc/0x128
[   38.513711]  __asan_report_store16_noabort+0x20/0x30
[   38.513730]  kmalloc_oob_16+0x3a0/0x3f8
[   38.513747]  kunit_try_run_case+0x170/0x3f0
[   38.513766]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.513788]  kthread+0x328/0x630
[   38.513803]  ret_from_fork+0x10/0x20
[   38.513820] 
[   38.579351] Allocated by task 275:
[   38.582813]  kasan_save_stack+0x3c/0x68
[   38.586723]  kasan_save_track+0x20/0x40
[   38.590633]  kasan_save_alloc_info+0x40/0x58
[   38.594970]  __kasan_kmalloc+0xd4/0xd8
[   38.598792]  __kmalloc_cache_noprof+0x16c/0x3c0
[   38.603401]  kmalloc_oob_16+0xb4/0x3f8
[   38.607222]  kunit_try_run_case+0x170/0x3f0
[   38.611476]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.617046]  kthread+0x328/0x630
[   38.620338]  ret_from_fork+0x10/0x20
[   38.623977] 
[   38.625507] The buggy address belongs to the object at ffff000098190180
[   38.625507]  which belongs to the cache kmalloc-16 of size 16
[   38.638000] The buggy address is located 0 bytes inside of
[   38.638000]  allocated 13-byte region [ffff000098190180, ffff00009819018d)
[   38.650494] 
[   38.652030] The buggy address belongs to the physical page:
[   38.657679] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118190
[   38.665793] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   38.672415] page_type: f5(slab)
[   38.675623] raw: 0bfffe0000000000 ffff000080002640 dead000000000122 0000000000000000
[   38.683469] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   38.691310] page dumped because: kasan: bad access detected
[   38.696956] 
[   38.698486] Memory state around the buggy address:
[   38.703346]  ffff000098190080: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   38.710663]  ffff000098190100: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   38.717988] >ffff000098190180: 00 05 fc fc 00 00 fc fc fc fc fc fc fc fc fc fc
[   38.725310]                       ^
[   38.728856]  ffff000098190200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.736181]  ffff000098190280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.743496] ==================================================================

[   37.788324] ==================================================================
[   37.800061] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x180/0x520
[   37.806768] Read of size 1 at addr ffff000086189800 by task kunit_try_catch/273
[   37.814179] 
[   37.815721] CPU: 3 UID: 0 PID: 273 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   37.815750] Tainted: [B]=BAD_PAGE, [N]=TEST
[   37.815758] Hardware name: Thundercomm Dragonboard 845c (DT)
[   37.815768] Call trace:
[   37.815775]  show_stack+0x20/0x38 (C)
[   37.815793]  dump_stack_lvl+0x8c/0xd0
[   37.815812]  print_report+0x118/0x608
[   37.815830]  kasan_report+0xdc/0x128
[   37.815850]  __kasan_check_byte+0x54/0x70
[   37.815868]  krealloc_noprof+0x44/0x360
[   37.815886]  krealloc_uaf+0x180/0x520
[   37.815904]  kunit_try_run_case+0x170/0x3f0
[   37.815923]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.815944]  kthread+0x328/0x630
[   37.815959]  ret_from_fork+0x10/0x20
[   37.815976] 
[   37.884249] Allocated by task 273:
[   37.887711]  kasan_save_stack+0x3c/0x68
[   37.891614]  kasan_save_track+0x20/0x40
[   37.895516]  kasan_save_alloc_info+0x40/0x58
[   37.899854]  __kasan_kmalloc+0xd4/0xd8
[   37.903666]  __kmalloc_cache_noprof+0x16c/0x3c0
[   37.908278]  krealloc_uaf+0xc8/0x520
[   37.911917]  kunit_try_run_case+0x170/0x3f0
[   37.916173]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.921750]  kthread+0x328/0x630
[   37.925042]  ret_from_fork+0x10/0x20
[   37.928680] 
[   37.930210] Freed by task 273:
[   37.933325]  kasan_save_stack+0x3c/0x68
[   37.937237]  kasan_save_track+0x20/0x40
[   37.941148]  kasan_save_free_info+0x4c/0x78
[   37.945402]  __kasan_slab_free+0x6c/0x98
[   37.949401]  kfree+0x214/0x3c8
[   37.952521]  krealloc_uaf+0x12c/0x520
[   37.956246]  kunit_try_run_case+0x170/0x3f0
[   37.960501]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.966076]  kthread+0x328/0x630
[   37.969369]  ret_from_fork+0x10/0x20
[   37.973007] 
[   37.974537] The buggy address belongs to the object at ffff000086189800
[   37.974537]  which belongs to the cache kmalloc-256 of size 256
[   37.987202] The buggy address is located 0 bytes inside of
[   37.987202]  freed 256-byte region [ffff000086189800, ffff000086189900)
[   37.999430] 
[   38.000958] The buggy address belongs to the physical page:
[   38.006610] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106188
[   38.014714] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   38.022473] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   38.029531] page_type: f5(slab)
[   38.032737] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   38.040585] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   38.048434] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   38.056368] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   38.064300] head: 0bfffe0000000002 fffffdffc2186201 00000000ffffffff 00000000ffffffff
[   38.072233] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   38.080164] page dumped because: kasan: bad access detected
[   38.085815] 
[   38.087343] Memory state around the buggy address:
[   38.092204]  ffff000086189700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.099523]  ffff000086189780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.106840] >ffff000086189800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.114154]                    ^
[   38.117443]  ffff000086189880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.124759]  ffff000086189900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.132073] ==================================================================
[   38.139451] ==================================================================
[   38.146771] BUG: KASAN: slab-use-after-free in krealloc_uaf+0x4c8/0x520
[   38.153485] Read of size 1 at addr ffff000086189800 by task kunit_try_catch/273
[   38.160898] 
[   38.162432] CPU: 3 UID: 0 PID: 273 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   38.162462] Tainted: [B]=BAD_PAGE, [N]=TEST
[   38.162472] Hardware name: Thundercomm Dragonboard 845c (DT)
[   38.162483] Call trace:
[   38.162489]  show_stack+0x20/0x38 (C)
[   38.162509]  dump_stack_lvl+0x8c/0xd0
[   38.162530]  print_report+0x118/0x608
[   38.162549]  kasan_report+0xdc/0x128
[   38.162568]  __asan_report_load1_noabort+0x20/0x30
[   38.162586]  krealloc_uaf+0x4c8/0x520
[   38.162604]  kunit_try_run_case+0x170/0x3f0
[   38.162622]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.162644]  kthread+0x328/0x630
[   38.162659]  ret_from_fork+0x10/0x20
[   38.162677] 
[   38.227864] Allocated by task 273:
[   38.231328]  kasan_save_stack+0x3c/0x68
[   38.235239]  kasan_save_track+0x20/0x40
[   38.239152]  kasan_save_alloc_info+0x40/0x58
[   38.243491]  __kasan_kmalloc+0xd4/0xd8
[   38.247305]  __kmalloc_cache_noprof+0x16c/0x3c0
[   38.251916]  krealloc_uaf+0xc8/0x520
[   38.255558]  kunit_try_run_case+0x170/0x3f0
[   38.259810]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.265386]  kthread+0x328/0x630
[   38.268678]  ret_from_fork+0x10/0x20
[   38.272318] 
[   38.273848] Freed by task 273:
[   38.276962]  kasan_save_stack+0x3c/0x68
[   38.280874]  kasan_save_track+0x20/0x40
[   38.284785]  kasan_save_free_info+0x4c/0x78
[   38.289037]  __kasan_slab_free+0x6c/0x98
[   38.293034]  kfree+0x214/0x3c8
[   38.296155]  krealloc_uaf+0x12c/0x520
[   38.299882]  kunit_try_run_case+0x170/0x3f0
[   38.304137]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   38.309711]  kthread+0x328/0x630
[   38.313006]  ret_from_fork+0x10/0x20
[   38.316645] 
[   38.318176] The buggy address belongs to the object at ffff000086189800
[   38.318176]  which belongs to the cache kmalloc-256 of size 256
[   38.330835] The buggy address is located 0 bytes inside of
[   38.330835]  freed 256-byte region [ffff000086189800, ffff000086189900)
[   38.343058] 
[   38.344587] The buggy address belongs to the physical page:
[   38.350237] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106188
[   38.358342] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   38.366102] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   38.373160] page_type: f5(slab)
[   38.376365] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   38.384213] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   38.392060] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   38.399994] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   38.407927] head: 0bfffe0000000002 fffffdffc2186201 00000000ffffffff 00000000ffffffff
[   38.415859] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   38.423789] page dumped because: kasan: bad access detected
[   38.429439] 
[   38.430968] Memory state around the buggy address:
[   38.435828]  ffff000086189700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.443145]  ffff000086189780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.450464] >ffff000086189800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.457777]                    ^
[   38.461066]  ffff000086189880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   38.468383]  ffff000086189900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   38.475698] ==================================================================

[   35.477527] ==================================================================
[   35.484839] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50
[   35.492502] Write of size 1 at addr ffff00009697ecea by task kunit_try_catch/267
[   35.499989] 
[   35.501516] CPU: 4 UID: 0 PID: 267 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   35.501544] Tainted: [B]=BAD_PAGE, [N]=TEST
[   35.501552] Hardware name: Thundercomm Dragonboard 845c (DT)
[   35.501562] Call trace:
[   35.501567]  show_stack+0x20/0x38 (C)
[   35.501584]  dump_stack_lvl+0x8c/0xd0
[   35.501602]  print_report+0x118/0x608
[   35.501619]  kasan_report+0xdc/0x128
[   35.501637]  __asan_report_store1_noabort+0x20/0x30
[   35.501654]  krealloc_less_oob_helper+0xae4/0xc50
[   35.501672]  krealloc_less_oob+0x20/0x38
[   35.501688]  kunit_try_run_case+0x170/0x3f0
[   35.501705]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.501726]  kthread+0x328/0x630
[   35.501739]  ret_from_fork+0x10/0x20
[   35.501754] 
[   35.571979] Allocated by task 267:
[   35.575433]  kasan_save_stack+0x3c/0x68
[   35.579339]  kasan_save_track+0x20/0x40
[   35.583245]  kasan_save_alloc_info+0x40/0x58
[   35.587582]  __kasan_krealloc+0x118/0x178
[   35.591654]  krealloc_noprof+0x128/0x360
[   35.595646]  krealloc_less_oob_helper+0x168/0xc50
[   35.600422]  krealloc_less_oob+0x20/0x38
[   35.604413]  kunit_try_run_case+0x170/0x3f0
[   35.608664]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.614231]  kthread+0x328/0x630
[   35.617514]  ret_from_fork+0x10/0x20
[   35.621147] 
[   35.622670] The buggy address belongs to the object at ffff00009697ec00
[   35.622670]  which belongs to the cache kmalloc-256 of size 256
[   35.635325] The buggy address is located 33 bytes to the right of
[   35.635325]  allocated 201-byte region [ffff00009697ec00, ffff00009697ecc9)
[   35.648508] 
[   35.650031] The buggy address belongs to the physical page:
[   35.655672] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11697c
[   35.663774] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   35.671530] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   35.678583] page_type: f5(slab)
[   35.681781] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.689626] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.697471] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.705401] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.713331] head: 0bfffe0000000002 fffffdffc25a5f01 00000000ffffffff 00000000ffffffff
[   35.721262] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   35.729186] page dumped because: kasan: bad access detected
[   35.734830] 
[   35.736362] Memory state around the buggy address:
[   35.741216]  ffff00009697eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.748524]  ffff00009697ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   35.755832] >ffff00009697ec80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc
[   35.763141]                                                           ^
[   35.769840]  ffff00009697ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.777149]  ffff00009697ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.784453] ==================================================================
[   34.531896] ==================================================================
[   34.543105] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50
[   34.550778] Write of size 1 at addr ffff00009697ecc9 by task kunit_try_catch/267
[   34.558272] 
[   34.559813] CPU: 2 UID: 0 PID: 267 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   34.559843] Tainted: [B]=BAD_PAGE, [N]=TEST
[   34.559851] Hardware name: Thundercomm Dragonboard 845c (DT)
[   34.559860] Call trace:
[   34.559867]  show_stack+0x20/0x38 (C)
[   34.559884]  dump_stack_lvl+0x8c/0xd0
[   34.559904]  print_report+0x118/0x608
[   34.559924]  kasan_report+0xdc/0x128
[   34.559942]  __asan_report_store1_noabort+0x20/0x30
[   34.559959]  krealloc_less_oob_helper+0xa48/0xc50
[   34.559977]  krealloc_less_oob+0x20/0x38
[   34.559994]  kunit_try_run_case+0x170/0x3f0
[   34.560012]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.560033]  kthread+0x328/0x630
[   34.560048]  ret_from_fork+0x10/0x20
[   34.560065] 
[   34.630340] Allocated by task 267:
[   34.633799]  kasan_save_stack+0x3c/0x68
[   34.637708]  kasan_save_track+0x20/0x40
[   34.641614]  kasan_save_alloc_info+0x40/0x58
[   34.645949]  __kasan_krealloc+0x118/0x178
[   34.650031]  krealloc_noprof+0x128/0x360
[   34.654026]  krealloc_less_oob_helper+0x168/0xc50
[   34.658808]  krealloc_less_oob+0x20/0x38
[   34.662803]  kunit_try_run_case+0x170/0x3f0
[   34.667053]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.672620]  kthread+0x328/0x630
[   34.675912]  ret_from_fork+0x10/0x20
[   34.679551] 
[   34.681087] The buggy address belongs to the object at ffff00009697ec00
[   34.681087]  which belongs to the cache kmalloc-256 of size 256
[   34.693747] The buggy address is located 0 bytes to the right of
[   34.693747]  allocated 201-byte region [ffff00009697ec00, ffff00009697ecc9)
[   34.706852] 
[   34.708385] The buggy address belongs to the physical page:
[   34.714036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11697c
[   34.722147] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   34.729900] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   34.736952] page_type: f5(slab)
[   34.740155] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.747998] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.755841] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.763771] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.771700] head: 0bfffe0000000002 fffffdffc25a5f01 00000000ffffffff 00000000ffffffff
[   34.779628] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   34.787554] page dumped because: kasan: bad access detected
[   34.793197] 
[   34.794727] Memory state around the buggy address:
[   34.799586]  ffff00009697eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.806900]  ffff00009697ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.814221] >ffff00009697ec80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc
[   34.821541]                                               ^
[   34.827190]  ffff00009697ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.834514]  ffff00009697ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.841833] ==================================================================
[   37.308828] ==================================================================
[   37.316142] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xae4/0xc50
[   37.323807] Write of size 1 at addr ffff0000861960ea by task kunit_try_catch/271
[   37.331291] 
[   37.332818] CPU: 4 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   37.332848] Tainted: [B]=BAD_PAGE, [N]=TEST
[   37.332855] Hardware name: Thundercomm Dragonboard 845c (DT)
[   37.332865] Call trace:
[   37.332871]  show_stack+0x20/0x38 (C)
[   37.332887]  dump_stack_lvl+0x8c/0xd0
[   37.332905]  print_report+0x118/0x608
[   37.332922]  kasan_report+0xdc/0x128
[   37.332939]  __asan_report_store1_noabort+0x20/0x30
[   37.332956]  krealloc_less_oob_helper+0xae4/0xc50
[   37.332974]  krealloc_large_less_oob+0x20/0x38
[   37.332991]  kunit_try_run_case+0x170/0x3f0
[   37.333009]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.333028]  kthread+0x328/0x630
[   37.333041]  ret_from_fork+0x10/0x20
[   37.333057] 
[   37.403834] The buggy address belongs to the physical page:
[   37.409480] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106194
[   37.417586] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   37.425332] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   37.432384] page_type: f8(unknown)
[   37.435844] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.443689] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.451525] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.459453] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.467383] head: 0bfffe0000000002 fffffdffc2186501 00000000ffffffff 00000000ffffffff
[   37.475312] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   37.483241] page dumped because: kasan: bad access detected
[   37.488888] 
[   37.490410] Memory state around the buggy address:
[   37.495261]  ffff000086195f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.502573]  ffff000086196000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.509882] >ffff000086196080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe
[   37.517189]                                                           ^
[   37.523888]  ffff000086196100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.531198]  ffff000086196180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.538507] ==================================================================
[   34.849245] ==================================================================
[   34.856566] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50
[   34.864238] Write of size 1 at addr ffff00009697ecd0 by task kunit_try_catch/267
[   34.871740] 
[   34.873268] CPU: 2 UID: 0 PID: 267 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   34.873297] Tainted: [B]=BAD_PAGE, [N]=TEST
[   34.873305] Hardware name: Thundercomm Dragonboard 845c (DT)
[   34.873316] Call trace:
[   34.873324]  show_stack+0x20/0x38 (C)
[   34.873343]  dump_stack_lvl+0x8c/0xd0
[   34.873365]  print_report+0x118/0x608
[   34.873386]  kasan_report+0xdc/0x128
[   34.873405]  __asan_report_store1_noabort+0x20/0x30
[   34.873423]  krealloc_less_oob_helper+0xb9c/0xc50
[   34.873441]  krealloc_less_oob+0x20/0x38
[   34.873459]  kunit_try_run_case+0x170/0x3f0
[   34.873477]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.873499]  kthread+0x328/0x630
[   34.873514]  ret_from_fork+0x10/0x20
[   34.873532] 
[   34.943836] Allocated by task 267:
[   34.947300]  kasan_save_stack+0x3c/0x68
[   34.951210]  kasan_save_track+0x20/0x40
[   34.955119]  kasan_save_alloc_info+0x40/0x58
[   34.959457]  __kasan_krealloc+0x118/0x178
[   34.963538]  krealloc_noprof+0x128/0x360
[   34.967534]  krealloc_less_oob_helper+0x168/0xc50
[   34.972313]  krealloc_less_oob+0x20/0x38
[   34.976307]  kunit_try_run_case+0x170/0x3f0
[   34.980562]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.986135]  kthread+0x328/0x630
[   34.989425]  ret_from_fork+0x10/0x20
[   34.993064] 
[   34.994594] The buggy address belongs to the object at ffff00009697ec00
[   34.994594]  which belongs to the cache kmalloc-256 of size 256
[   35.007258] The buggy address is located 7 bytes to the right of
[   35.007258]  allocated 201-byte region [ffff00009697ec00, ffff00009697ecc9)
[   35.020359] 
[   35.021891] The buggy address belongs to the physical page:
[   35.027538] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11697c
[   35.035650] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   35.043405] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   35.050459] page_type: f5(slab)
[   35.053664] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.061509] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.069354] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.077284] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.085213] head: 0bfffe0000000002 fffffdffc25a5f01 00000000ffffffff 00000000ffffffff
[   35.093144] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   35.101069] page dumped because: kasan: bad access detected
[   35.106719] 
[   35.108252] Memory state around the buggy address:
[   35.113113]  ffff00009697eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.120438]  ffff00009697ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   35.127753] >ffff00009697ec80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc
[   35.135065]                                                  ^
[   35.140981]  ffff00009697ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.148304]  ffff00009697ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.155619] ==================================================================
[   36.835388] ==================================================================
[   36.842709] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xb9c/0xc50
[   36.850383] Write of size 1 at addr ffff0000861960d0 by task kunit_try_catch/271
[   36.857880] 
[   36.859411] CPU: 3 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   36.859439] Tainted: [B]=BAD_PAGE, [N]=TEST
[   36.859447] Hardware name: Thundercomm Dragonboard 845c (DT)
[   36.859457] Call trace:
[   36.859464]  show_stack+0x20/0x38 (C)
[   36.859482]  dump_stack_lvl+0x8c/0xd0
[   36.859503]  print_report+0x118/0x608
[   36.859521]  kasan_report+0xdc/0x128
[   36.859539]  __asan_report_store1_noabort+0x20/0x30
[   36.859557]  krealloc_less_oob_helper+0xb9c/0xc50
[   36.859576]  krealloc_large_less_oob+0x20/0x38
[   36.859595]  kunit_try_run_case+0x170/0x3f0
[   36.859613]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.859634]  kthread+0x328/0x630
[   36.859649]  ret_from_fork+0x10/0x20
[   36.859666] 
[   36.930484] The buggy address belongs to the physical page:
[   36.936138] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106194
[   36.944249] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   36.952004] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   36.959062] page_type: f8(unknown)
[   36.962528] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.970373] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.978218] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.986148] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.994079] head: 0bfffe0000000002 fffffdffc2186501 00000000ffffffff 00000000ffffffff
[   37.002008] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   37.009935] page dumped because: kasan: bad access detected
[   37.015581] 
[   37.017107] Memory state around the buggy address:
[   37.021969]  ffff000086195f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.029293]  ffff000086196000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.036616] >ffff000086196080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe
[   37.043937]                                                  ^
[   37.049847]  ffff000086196100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.057171]  ffff000086196180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.064493] ==================================================================
[   35.792013] ==================================================================
[   35.799339] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50
[   35.807017] Write of size 1 at addr ffff00009697eceb by task kunit_try_catch/267
[   35.814508] 
[   35.816048] CPU: 3 UID: 0 PID: 267 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   35.816076] Tainted: [B]=BAD_PAGE, [N]=TEST
[   35.816085] Hardware name: Thundercomm Dragonboard 845c (DT)
[   35.816096] Call trace:
[   35.816103]  show_stack+0x20/0x38 (C)
[   35.816122]  dump_stack_lvl+0x8c/0xd0
[   35.816143]  print_report+0x118/0x608
[   35.816162]  kasan_report+0xdc/0x128
[   35.816181]  __asan_report_store1_noabort+0x20/0x30
[   35.816199]  krealloc_less_oob_helper+0xa58/0xc50
[   35.816217]  krealloc_less_oob+0x20/0x38
[   35.816235]  kunit_try_run_case+0x170/0x3f0
[   35.816255]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.816275]  kthread+0x328/0x630
[   35.816290]  ret_from_fork+0x10/0x20
[   35.816307] 
[   35.886597] Allocated by task 267:
[   35.890058]  kasan_save_stack+0x3c/0x68
[   35.893968]  kasan_save_track+0x20/0x40
[   35.897879]  kasan_save_alloc_info+0x40/0x58
[   35.902219]  __kasan_krealloc+0x118/0x178
[   35.906302]  krealloc_noprof+0x128/0x360
[   35.910300]  krealloc_less_oob_helper+0x168/0xc50
[   35.915083]  krealloc_less_oob+0x20/0x38
[   35.919080]  kunit_try_run_case+0x170/0x3f0
[   35.923335]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.928907]  kthread+0x328/0x630
[   35.932199]  ret_from_fork+0x10/0x20
[   35.935839] 
[   35.937370] The buggy address belongs to the object at ffff00009697ec00
[   35.937370]  which belongs to the cache kmalloc-256 of size 256
[   35.950026] The buggy address is located 34 bytes to the right of
[   35.950026]  allocated 201-byte region [ffff00009697ec00, ffff00009697ecc9)
[   35.963211] 
[   35.964739] The buggy address belongs to the physical page:
[   35.970389] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11697c
[   35.978492] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   35.986252] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   35.993309] page_type: f5(slab)
[   35.996513] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   36.004360] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   36.012206] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   36.020139] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   36.028072] head: 0bfffe0000000002 fffffdffc25a5f01 00000000ffffffff 00000000ffffffff
[   36.036005] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   36.043934] page dumped because: kasan: bad access detected
[   36.049585] 
[   36.051113] Memory state around the buggy address:
[   36.055974]  ffff00009697eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.063293]  ffff00009697ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.070611] >ffff00009697ec80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc
[   36.077923]                                                           ^
[   36.084630]  ffff00009697ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.091945]  ffff00009697ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.099262] ==================================================================
[   36.594768] ==================================================================
[   36.606509] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa48/0xc50
[   36.614186] Write of size 1 at addr ffff0000861960c9 by task kunit_try_catch/271
[   36.621687] 
[   36.623221] CPU: 3 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   36.623249] Tainted: [B]=BAD_PAGE, [N]=TEST
[   36.623257] Hardware name: Thundercomm Dragonboard 845c (DT)
[   36.623270] Call trace:
[   36.623277]  show_stack+0x20/0x38 (C)
[   36.623295]  dump_stack_lvl+0x8c/0xd0
[   36.623315]  print_report+0x118/0x608
[   36.623334]  kasan_report+0xdc/0x128
[   36.623353]  __asan_report_store1_noabort+0x20/0x30
[   36.623372]  krealloc_less_oob_helper+0xa48/0xc50
[   36.623392]  krealloc_large_less_oob+0x20/0x38
[   36.623410]  kunit_try_run_case+0x170/0x3f0
[   36.623429]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.623450]  kthread+0x328/0x630
[   36.623465]  ret_from_fork+0x10/0x20
[   36.623483] 
[   36.694294] The buggy address belongs to the physical page:
[   36.699939] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106194
[   36.708044] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   36.715802] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   36.722860] page_type: f8(unknown)
[   36.726330] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.734178] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.742026] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.749959] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.757891] head: 0bfffe0000000002 fffffdffc2186501 00000000ffffffff 00000000ffffffff
[   36.765824] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   36.773751] page dumped because: kasan: bad access detected
[   36.779396] 
[   36.780926] Memory state around the buggy address:
[   36.785785]  ffff000086195f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.793100]  ffff000086196000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.800415] >ffff000086196080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe
[   36.807727]                                               ^
[   36.813375]  ffff000086196100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.820689]  ffff000086196180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.828002] ==================================================================
[   37.072217] ==================================================================
[   37.079537] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50
[   37.087212] Write of size 1 at addr ffff0000861960da by task kunit_try_catch/271
[   37.094700] 
[   37.096238] CPU: 4 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   37.096268] Tainted: [B]=BAD_PAGE, [N]=TEST
[   37.096276] Hardware name: Thundercomm Dragonboard 845c (DT)
[   37.096286] Call trace:
[   37.096292]  show_stack+0x20/0x38 (C)
[   37.096310]  dump_stack_lvl+0x8c/0xd0
[   37.096329]  print_report+0x118/0x608
[   37.096347]  kasan_report+0xdc/0x128
[   37.096365]  __asan_report_store1_noabort+0x20/0x30
[   37.096381]  krealloc_less_oob_helper+0xa80/0xc50
[   37.096399]  krealloc_large_less_oob+0x20/0x38
[   37.096415]  kunit_try_run_case+0x170/0x3f0
[   37.096432]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.096454]  kthread+0x328/0x630
[   37.096467]  ret_from_fork+0x10/0x20
[   37.096483] 
[   37.167264] The buggy address belongs to the physical page:
[   37.172910] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106194
[   37.181016] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   37.188762] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   37.195813] page_type: f8(unknown)
[   37.199274] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.207108] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.214945] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.222874] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.230804] head: 0bfffe0000000002 fffffdffc2186501 00000000ffffffff 00000000ffffffff
[   37.238734] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   37.246651] page dumped because: kasan: bad access detected
[   37.252292] 
[   37.253816] Memory state around the buggy address:
[   37.258671]  ffff000086195f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.265980]  ffff000086196000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.273289] >ffff000086196080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe
[   37.280598]                                                     ^
[   37.286767]  ffff000086196100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.294078]  ffff000086196180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.301387] ==================================================================
[   37.546341] ==================================================================
[   37.553662] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa58/0xc50
[   37.561332] Write of size 1 at addr ffff0000861960eb by task kunit_try_catch/271
[   37.568823] 
[   37.570351] CPU: 5 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   37.570381] Tainted: [B]=BAD_PAGE, [N]=TEST
[   37.570389] Hardware name: Thundercomm Dragonboard 845c (DT)
[   37.570400] Call trace:
[   37.570406]  show_stack+0x20/0x38 (C)
[   37.570423]  dump_stack_lvl+0x8c/0xd0
[   37.570442]  print_report+0x118/0x608
[   37.570460]  kasan_report+0xdc/0x128
[   37.570478]  __asan_report_store1_noabort+0x20/0x30
[   37.570495]  krealloc_less_oob_helper+0xa58/0xc50
[   37.570512]  krealloc_large_less_oob+0x20/0x38
[   37.570530]  kunit_try_run_case+0x170/0x3f0
[   37.570546]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   37.570566]  kthread+0x328/0x630
[   37.570580]  ret_from_fork+0x10/0x20
[   37.570597] 
[   37.641384] The buggy address belongs to the physical page:
[   37.647027] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106194
[   37.655125] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   37.662879] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   37.669933] page_type: f8(unknown)
[   37.673391] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.681230] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.689070] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   37.696993] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   37.704917] head: 0bfffe0000000002 fffffdffc2186501 00000000ffffffff 00000000ffffffff
[   37.712842] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   37.720765] page dumped because: kasan: bad access detected
[   37.726406] 
[   37.727934] Memory state around the buggy address:
[   37.732784]  ffff000086195f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.740097]  ffff000086196000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   37.747411] >ffff000086196080: 00 00 00 00 00 00 00 00 00 01 fe fe fe fe fe fe
[   37.754719]                                                           ^
[   37.761412]  ffff000086196100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.768727]  ffff000086196180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   37.776035] ==================================================================
[   35.163637] ==================================================================
[   35.170964] BUG: KASAN: slab-out-of-bounds in krealloc_less_oob_helper+0xa80/0xc50
[   35.178639] Write of size 1 at addr ffff00009697ecda by task kunit_try_catch/267
[   35.186136] 
[   35.187673] CPU: 4 UID: 0 PID: 267 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   35.187702] Tainted: [B]=BAD_PAGE, [N]=TEST
[   35.187711] Hardware name: Thundercomm Dragonboard 845c (DT)
[   35.187721] Call trace:
[   35.187727]  show_stack+0x20/0x38 (C)
[   35.187745]  dump_stack_lvl+0x8c/0xd0
[   35.187766]  print_report+0x118/0x608
[   35.187784]  kasan_report+0xdc/0x128
[   35.187802]  __asan_report_store1_noabort+0x20/0x30
[   35.187820]  krealloc_less_oob_helper+0xa80/0xc50
[   35.187837]  krealloc_less_oob+0x20/0x38
[   35.187854]  kunit_try_run_case+0x170/0x3f0
[   35.187872]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.187892]  kthread+0x328/0x630
[   35.187906]  ret_from_fork+0x10/0x20
[   35.187923] 
[   35.258166] Allocated by task 267:
[   35.261622]  kasan_save_stack+0x3c/0x68
[   35.265519]  kasan_save_track+0x20/0x40
[   35.269424]  kasan_save_alloc_info+0x40/0x58
[   35.273760]  __kasan_krealloc+0x118/0x178
[   35.277842]  krealloc_noprof+0x128/0x360
[   35.281824]  krealloc_less_oob_helper+0x168/0xc50
[   35.286598]  krealloc_less_oob+0x20/0x38
[   35.290581]  kunit_try_run_case+0x170/0x3f0
[   35.294832]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   35.300397]  kthread+0x328/0x630
[   35.303680]  ret_from_fork+0x10/0x20
[   35.307313] 
[   35.308836] The buggy address belongs to the object at ffff00009697ec00
[   35.308836]  which belongs to the cache kmalloc-256 of size 256
[   35.321486] The buggy address is located 17 bytes to the right of
[   35.321486]  allocated 201-byte region [ffff00009697ec00, ffff00009697ecc9)
[   35.334669] 
[   35.336202] The buggy address belongs to the physical page:
[   35.341847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11697c
[   35.349951] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   35.357705] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   35.364755] page_type: f5(slab)
[   35.367954] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.375799] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.383642] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   35.391572] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   35.399501] head: 0bfffe0000000002 fffffdffc25a5f01 00000000ffffffff 00000000ffffffff
[   35.407430] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   35.415356] page dumped because: kasan: bad access detected
[   35.421004] 
[   35.422526] Memory state around the buggy address:
[   35.427378]  ffff00009697eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.434691]  ffff00009697ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   35.442000] >ffff00009697ec80: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc
[   35.449307]                                                     ^
[   35.455473]  ffff00009697ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.462783]  ffff00009697ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   35.470092] ==================================================================

[   36.352885] ==================================================================
[   36.360200] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c0/0x678
[   36.367878] Write of size 1 at addr ffff0000861920f0 by task kunit_try_catch/269
[   36.375370] 
[   36.376901] CPU: 3 UID: 0 PID: 269 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   36.376929] Tainted: [B]=BAD_PAGE, [N]=TEST
[   36.376938] Hardware name: Thundercomm Dragonboard 845c (DT)
[   36.376948] Call trace:
[   36.376955]  show_stack+0x20/0x38 (C)
[   36.376973]  dump_stack_lvl+0x8c/0xd0
[   36.376992]  print_report+0x118/0x608
[   36.377012]  kasan_report+0xdc/0x128
[   36.377030]  __asan_report_store1_noabort+0x20/0x30
[   36.377048]  krealloc_more_oob_helper+0x5c0/0x678
[   36.377066]  krealloc_large_more_oob+0x20/0x38
[   36.377086]  kunit_try_run_case+0x170/0x3f0
[   36.377105]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.377126]  kthread+0x328/0x630
[   36.377140]  ret_from_fork+0x10/0x20
[   36.377158] 
[   36.447972] The buggy address belongs to the physical page:
[   36.453623] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106190
[   36.461729] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   36.469487] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   36.476545] page_type: f8(unknown)
[   36.480010] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.487857] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.495705] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.503639] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.511573] head: 0bfffe0000000002 fffffdffc2186401 00000000ffffffff 00000000ffffffff
[   36.519504] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   36.527432] page dumped because: kasan: bad access detected
[   36.533080] 
[   36.534610] Memory state around the buggy address:
[   36.539471]  ffff000086191f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.546787]  ffff000086192000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.554102] >ffff000086192080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe
[   36.561416]                                                              ^
[   36.568383]  ffff000086192100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.575700]  ffff000086192180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.583016] ==================================================================
[   33.896092] ==================================================================
[   33.907040] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x60c/0x678
[   33.914710] Write of size 1 at addr ffff0000861896eb by task kunit_try_catch/265
[   33.922205] 
[   33.923745] CPU: 3 UID: 0 PID: 265 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   33.923773] Tainted: [B]=BAD_PAGE, [N]=TEST
[   33.923780] Hardware name: Thundercomm Dragonboard 845c (DT)
[   33.923791] Call trace:
[   33.923797]  show_stack+0x20/0x38 (C)
[   33.923815]  dump_stack_lvl+0x8c/0xd0
[   33.923835]  print_report+0x118/0x608
[   33.923855]  kasan_report+0xdc/0x128
[   33.923873]  __asan_report_store1_noabort+0x20/0x30
[   33.923890]  krealloc_more_oob_helper+0x60c/0x678
[   33.923909]  krealloc_more_oob+0x20/0x38
[   33.923928]  kunit_try_run_case+0x170/0x3f0
[   33.923946]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.923967]  kthread+0x328/0x630
[   33.923981]  ret_from_fork+0x10/0x20
[   33.923998] 
[   33.994280] Allocated by task 265:
[   33.997736]  kasan_save_stack+0x3c/0x68
[   34.001646]  kasan_save_track+0x20/0x40
[   34.005555]  kasan_save_alloc_info+0x40/0x58
[   34.009892]  __kasan_krealloc+0x118/0x178
[   34.013973]  krealloc_noprof+0x128/0x360
[   34.017969]  krealloc_more_oob_helper+0x168/0x678
[   34.022753]  krealloc_more_oob+0x20/0x38
[   34.026747]  kunit_try_run_case+0x170/0x3f0
[   34.030998]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.036564]  kthread+0x328/0x630
[   34.039856]  ret_from_fork+0x10/0x20
[   34.043495] 
[   34.045032] The buggy address belongs to the object at ffff000086189600
[   34.045032]  which belongs to the cache kmalloc-256 of size 256
[   34.057695] The buggy address is located 0 bytes to the right of
[   34.057695]  allocated 235-byte region [ffff000086189600, ffff0000861896eb)
[   34.070799] 
[   34.072334] The buggy address belongs to the physical page:
[   34.077983] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106188
[   34.086093] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   34.093848] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   34.100910] page_type: f5(slab)
[   34.104113] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.111955] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.119799] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.127727] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.135655] head: 0bfffe0000000002 fffffdffc2186201 00000000ffffffff 00000000ffffffff
[   34.143583] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   34.151507] page dumped because: kasan: bad access detected
[   34.157150] 
[   34.158679] Memory state around the buggy address:
[   34.163538]  ffff000086189580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.170860]  ffff000086189600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.178180] >ffff000086189680: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc
[   34.185498]                                                           ^
[   34.192201]  ffff000086189700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.199517]  ffff000086189780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.206836] ==================================================================
[   36.111747] ==================================================================
[   36.122953] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x60c/0x678
[   36.130631] Write of size 1 at addr ffff0000861920eb by task kunit_try_catch/269
[   36.138133] 
[   36.139675] CPU: 3 UID: 0 PID: 269 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   36.139703] Tainted: [B]=BAD_PAGE, [N]=TEST
[   36.139712] Hardware name: Thundercomm Dragonboard 845c (DT)
[   36.139723] Call trace:
[   36.139729]  show_stack+0x20/0x38 (C)
[   36.139746]  dump_stack_lvl+0x8c/0xd0
[   36.139767]  print_report+0x118/0x608
[   36.139787]  kasan_report+0xdc/0x128
[   36.139806]  __asan_report_store1_noabort+0x20/0x30
[   36.139823]  krealloc_more_oob_helper+0x60c/0x678
[   36.139843]  krealloc_large_more_oob+0x20/0x38
[   36.139861]  kunit_try_run_case+0x170/0x3f0
[   36.139880]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.139901]  kthread+0x328/0x630
[   36.139917]  ret_from_fork+0x10/0x20
[   36.139934] 
[   36.210731] The buggy address belongs to the physical page:
[   36.216378] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106190
[   36.224484] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   36.232241] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   36.239300] page_type: f8(unknown)
[   36.242767] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.250614] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.258462] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.266395] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.274328] head: 0bfffe0000000002 fffffdffc2186401 00000000ffffffff 00000000ffffffff
[   36.282261] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   36.290189] page dumped because: kasan: bad access detected
[   36.295834] 
[   36.297364] Memory state around the buggy address:
[   36.302227]  ffff000086191f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.309540]  ffff000086192000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.316855] >ffff000086192080: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fe fe
[   36.324167]                                                           ^
[   36.330870]  ffff000086192100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.338185]  ffff000086192180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   36.345497] ==================================================================
[   34.214270] ==================================================================
[   34.221593] BUG: KASAN: slab-out-of-bounds in krealloc_more_oob_helper+0x5c0/0x678
[   34.229264] Write of size 1 at addr ffff0000861896f0 by task kunit_try_catch/265
[   34.236761] 
[   34.238295] CPU: 3 UID: 0 PID: 265 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   34.238324] Tainted: [B]=BAD_PAGE, [N]=TEST
[   34.238333] Hardware name: Thundercomm Dragonboard 845c (DT)
[   34.238343] Call trace:
[   34.238350]  show_stack+0x20/0x38 (C)
[   34.238369]  dump_stack_lvl+0x8c/0xd0
[   34.238389]  print_report+0x118/0x608
[   34.238408]  kasan_report+0xdc/0x128
[   34.238427]  __asan_report_store1_noabort+0x20/0x30
[   34.238444]  krealloc_more_oob_helper+0x5c0/0x678
[   34.238464]  krealloc_more_oob+0x20/0x38
[   34.238482]  kunit_try_run_case+0x170/0x3f0
[   34.238501]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.238522]  kthread+0x328/0x630
[   34.238537]  ret_from_fork+0x10/0x20
[   34.238555] 
[   34.308868] Allocated by task 265:
[   34.312326]  kasan_save_stack+0x3c/0x68
[   34.316236]  kasan_save_track+0x20/0x40
[   34.320144]  kasan_save_alloc_info+0x40/0x58
[   34.324481]  __kasan_krealloc+0x118/0x178
[   34.328561]  krealloc_noprof+0x128/0x360
[   34.332556]  krealloc_more_oob_helper+0x168/0x678
[   34.337339]  krealloc_more_oob+0x20/0x38
[   34.341333]  kunit_try_run_case+0x170/0x3f0
[   34.345585]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   34.351155]  kthread+0x328/0x630
[   34.354445]  ret_from_fork+0x10/0x20
[   34.358092] 
[   34.359618] The buggy address belongs to the object at ffff000086189600
[   34.359618]  which belongs to the cache kmalloc-256 of size 256
[   34.372272] The buggy address is located 5 bytes to the right of
[   34.372272]  allocated 235-byte region [ffff000086189600, ffff0000861896eb)
[   34.385376] 
[   34.386905] The buggy address belongs to the physical page:
[   34.392556] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106188
[   34.400667] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   34.408420] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   34.415475] page_type: f5(slab)
[   34.418681] raw: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.426531] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.434373] head: 0bfffe0000000040 ffff000080002b40 dead000000000122 0000000000000000
[   34.442311] head: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
[   34.450250] head: 0bfffe0000000002 fffffdffc2186201 00000000ffffffff 00000000ffffffff
[   34.458189] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   34.466123] page dumped because: kasan: bad access detected
[   34.471777] 
[   34.473304] Memory state around the buggy address:
[   34.478164]  ffff000086189580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.485487]  ffff000086189600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   34.492807] >ffff000086189680: 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc fc
[   34.500126]                                                              ^
[   34.507094]  ffff000086189700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.514416]  ffff000086189780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   34.521734] ==================================================================

[   33.698497] ==================================================================
[   33.713747] BUG: KASAN: use-after-free in page_alloc_uaf+0x328/0x350
[   33.720192] Read of size 1 at addr ffff0000934a0000 by task kunit_try_catch/263
[   33.727595] 
[   33.729130] CPU: 3 UID: 0 PID: 263 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   33.729159] Tainted: [B]=BAD_PAGE, [N]=TEST
[   33.729168] Hardware name: Thundercomm Dragonboard 845c (DT)
[   33.729179] Call trace:
[   33.729186]  show_stack+0x20/0x38 (C)
[   33.729204]  dump_stack_lvl+0x8c/0xd0
[   33.729224]  print_report+0x118/0x608
[   33.729245]  kasan_report+0xdc/0x128
[   33.729264]  __asan_report_load1_noabort+0x20/0x30
[   33.729282]  page_alloc_uaf+0x328/0x350
[   33.729299]  kunit_try_run_case+0x170/0x3f0
[   33.729317]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.729340]  kthread+0x328/0x630
[   33.729355]  ret_from_fork+0x10/0x20
[   33.729372] 
[   33.794725] The buggy address belongs to the physical page:
[   33.800370] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134a0
[   33.808474] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   33.815089] page_type: f0(buddy)
[   33.818378] raw: 0bfffe0000000000 ffff0000fd587e48 ffff0000fd587e48 0000000000000000
[   33.826224] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000
[   33.834066] page dumped because: kasan: bad access detected
[   33.839711] 
[   33.841242] Memory state around the buggy address:
[   33.846100]  ffff00009349ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.853415]  ffff00009349ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.860729] >ffff0000934a0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.868041]                    ^
[   33.871325]  ffff0000934a0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.878639]  ffff0000934a0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.885952] ==================================================================

[   33.450870] ==================================================================
[   33.461993] BUG: KASAN: invalid-free in kfree+0x270/0x3c8
[   33.467477] Free of addr ffff000096d0c001 by task kunit_try_catch/259
[   33.474005] 
[   33.475540] CPU: 5 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   33.475571] Tainted: [B]=BAD_PAGE, [N]=TEST
[   33.475579] Hardware name: Thundercomm Dragonboard 845c (DT)
[   33.475590] Call trace:
[   33.475596]  show_stack+0x20/0x38 (C)
[   33.475613]  dump_stack_lvl+0x8c/0xd0
[   33.475634]  print_report+0x118/0x608
[   33.475652]  kasan_report_invalid_free+0xc0/0xe8
[   33.475671]  __kasan_kfree_large+0x5c/0xa8
[   33.475691]  free_large_kmalloc+0x68/0x150
[   33.475707]  kfree+0x270/0x3c8
[   33.475723]  kmalloc_large_invalid_free+0x108/0x270
[   33.475739]  kunit_try_run_case+0x170/0x3f0
[   33.475756]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.475776]  kthread+0x328/0x630
[   33.475788]  ret_from_fork+0x10/0x20
[   33.475805] 
[   33.549757] The buggy address belongs to the physical page:
[   33.555396] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116d0c
[   33.563494] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   33.571246] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   33.578294] page_type: f8(unknown)
[   33.581754] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   33.589595] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   33.597434] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   33.605359] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   33.613284] head: 0bfffe0000000002 fffffdffc25b4301 00000000ffffffff 00000000ffffffff
[   33.621211] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   33.629129] page dumped because: kasan: bad access detected
[   33.634772] 
[   33.636301] Memory state around the buggy address:
[   33.641154]  ffff000096d0bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   33.648468]  ffff000096d0bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   33.655784] >ffff000096d0c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.663091]                    ^
[   33.666373]  ffff000096d0c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.673687]  ffff000096d0c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.681000] ==================================================================

[   33.258012] ==================================================================
[   33.269662] BUG: KASAN: use-after-free in kmalloc_large_uaf+0x2cc/0x2f8
[   33.276371] Read of size 1 at addr ffff000086190000 by task kunit_try_catch/257
[   33.283784] 
[   33.285315] CPU: 3 UID: 0 PID: 257 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   33.285343] Tainted: [B]=BAD_PAGE, [N]=TEST
[   33.285351] Hardware name: Thundercomm Dragonboard 845c (DT)
[   33.285362] Call trace:
[   33.285369]  show_stack+0x20/0x38 (C)
[   33.285387]  dump_stack_lvl+0x8c/0xd0
[   33.285407]  print_report+0x118/0x608
[   33.285427]  kasan_report+0xdc/0x128
[   33.285445]  __asan_report_load1_noabort+0x20/0x30
[   33.285463]  kmalloc_large_uaf+0x2cc/0x2f8
[   33.285480]  kunit_try_run_case+0x170/0x3f0
[   33.285499]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.285521]  kthread+0x328/0x630
[   33.285536]  ret_from_fork+0x10/0x20
[   33.285554] 
[   33.351176] The buggy address belongs to the physical page:
[   33.356829] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106190
[   33.364942] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   33.371563] raw: 0bfffe0000000000 fffffdffc2186508 ffff0000dae04c00 0000000000000000
[   33.379407] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   33.387247] page dumped because: kasan: bad access detected
[   33.392901] 
[   33.394432] Memory state around the buggy address:
[   33.399295]  ffff00008618ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.406616]  ffff00008618ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.413939] >ffff000086190000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.421259]                    ^
[   33.424547]  ffff000086190080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.431862]  ffff000086190100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   33.439176] ==================================================================

[   33.022254] ==================================================================
[   33.033729] BUG: KASAN: slab-out-of-bounds in kmalloc_large_oob_right+0x278/0x2b8
[   33.041313] Write of size 1 at addr ffff00009558a00a by task kunit_try_catch/255
[   33.048805] 
[   33.050335] CPU: 4 UID: 0 PID: 255 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4-next-20250703 #1 PREEMPT 
[   33.050365] Tainted: [B]=BAD_PAGE, [N]=TEST
[   33.050374] Hardware name: Thundercomm Dragonboard 845c (DT)
[   33.050385] Call trace:
[   33.050391]  show_stack+0x20/0x38 (C)
[   33.050409]  dump_stack_lvl+0x8c/0xd0
[   33.050429]  print_report+0x118/0x608
[   33.050449]  kasan_report+0xdc/0x128
[   33.050466]  __asan_report_store1_noabort+0x20/0x30
[   33.050483]  kmalloc_large_oob_right+0x278/0x2b8
[   33.050500]  kunit_try_run_case+0x170/0x3f0
[   33.050517]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   33.050537]  kthread+0x328/0x630
[   33.050549]  ret_from_fork+0x10/0x20
[   33.050567] 
[   33.116774] The buggy address belongs to the physical page:
[   33.122417] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115588
[   33.130525] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   33.138273] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   33.145327] page_type: f8(unknown)
[   33.148795] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   33.156633] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   33.164469] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   33.172394] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   33.180315] head: 0bfffe0000000002 fffffdffc2556201 00000000ffffffff 00000000ffffffff
[   33.188239] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   33.196156] page dumped because: kasan: bad access detected
[   33.201796] 
[   33.203327] Memory state around the buggy address:
[   33.208185]  ffff000095589f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.215498]  ffff000095589f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   33.222806] >ffff00009558a000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   33.230116]                       ^
[   33.233665]  ffff00009558a080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   33.240976]  ffff00009558a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   33.248286] ==================================================================