[   24.163157] ==================================================================
[   24.163622] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3e3/0x510
[   24.164291] Read of size 1 at addr ffff8881059c5000 by task kunit_try_catch/261
[   24.165049] 
[   24.165367] CPU: 0 UID: 0 PID: 261 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) 
[   24.165459] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.165472] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.165498] Call Trace:
[   24.165521]  <TASK>
[   24.165543]  dump_stack_lvl+0x73/0xb0
[   24.165581]  print_report+0xd1/0x610
[   24.165606]  ? __virt_addr_valid+0x1db/0x2d0
[   24.165634]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   24.165660]  ? kasan_complete_mode_report_info+0x64/0x200
[   24.165689]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   24.165715]  kasan_report+0x141/0x180
[   24.165737]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   24.165965]  __asan_report_load1_noabort+0x18/0x20
[   24.165997]  kmem_cache_rcu_uaf+0x3e3/0x510
[   24.166024]  ? __pfx_kmem_cache_rcu_uaf+0x10/0x10
[   24.166049]  ? finish_task_switch.isra.0+0x153/0x700
[   24.166074]  ? __switch_to+0x47/0xf50
[   24.166108]  ? __pfx_read_tsc+0x10/0x10
[   24.166134]  ? ktime_get_ts64+0x86/0x230
[   24.166163]  kunit_try_run_case+0x1a5/0x480
[   24.166189]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.166210]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   24.166234]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.166278]  ? __kthread_parkme+0x82/0x180
[   24.166300]  ? preempt_count_sub+0x50/0x80
[   24.166324]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.166346]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.166374]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.166400]  kthread+0x337/0x6f0
[   24.166422]  ? trace_preempt_on+0x20/0xc0
[   24.166448]  ? __pfx_kthread+0x10/0x10
[   24.166471]  ? _raw_spin_unlock_irq+0x47/0x80
[   24.166498]  ? calculate_sigpending+0x7b/0xa0
[   24.166526]  ? __pfx_kthread+0x10/0x10
[   24.166550]  ret_from_fork+0x116/0x1d0
[   24.166569]  ? __pfx_kthread+0x10/0x10
[   24.166591]  ret_from_fork_asm+0x1a/0x30
[   24.166627]  </TASK>
[   24.166640] 
[   24.176540] Allocated by task 261:
[   24.176744]  kasan_save_stack+0x45/0x70
[   24.177315]  kasan_save_track+0x18/0x40
[   24.177495]  kasan_save_alloc_info+0x3b/0x50
[   24.177654]  __kasan_slab_alloc+0x91/0xa0
[   24.178389]  kmem_cache_alloc_noprof+0x123/0x3f0
[   24.178594]  kmem_cache_rcu_uaf+0x155/0x510
[   24.178945]  kunit_try_run_case+0x1a5/0x480
[   24.179349]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.179560]  kthread+0x337/0x6f0
[   24.179964]  ret_from_fork+0x116/0x1d0
[   24.180284]  ret_from_fork_asm+0x1a/0x30
[   24.180627] 
[   24.180727] Freed by task 0:
[   24.180918]  kasan_save_stack+0x45/0x70
[   24.181395]  kasan_save_track+0x18/0x40
[   24.181588]  kasan_save_free_info+0x3f/0x60
[   24.181953]  __kasan_slab_free+0x56/0x70
[   24.182231]  slab_free_after_rcu_debug+0xe4/0x310
[   24.182469]  rcu_core+0x66f/0x1c40
[   24.182634]  rcu_core_si+0x12/0x20
[   24.183043]  handle_softirqs+0x209/0x730
[   24.183234]  __irq_exit_rcu+0xc9/0x110
[   24.183392]  irq_exit_rcu+0x12/0x20
[   24.183567]  sysvec_apic_timer_interrupt+0x81/0x90
[   24.183731]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   24.184047] 
[   24.184149] Last potentially related work creation:
[   24.184356]  kasan_save_stack+0x45/0x70
[   24.184542]  kasan_record_aux_stack+0xb2/0xc0
[   24.184743]  kmem_cache_free+0x131/0x420
[   24.184981]  kmem_cache_rcu_uaf+0x194/0x510
[   24.185121]  kunit_try_run_case+0x1a5/0x480
[   24.185288]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.185568]  kthread+0x337/0x6f0
[   24.185732]  ret_from_fork+0x116/0x1d0
[   24.185944]  ret_from_fork_asm+0x1a/0x30
[   24.186226] 
[   24.186324] The buggy address belongs to the object at ffff8881059c5000
[   24.186324]  which belongs to the cache test_cache of size 200
[   24.186805] The buggy address is located 0 bytes inside of
[   24.186805]  freed 200-byte region [ffff8881059c5000, ffff8881059c50c8)
[   24.187535] 
[   24.187690] The buggy address belongs to the physical page:
[   24.188205] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059c5
[   24.188626] flags: 0x200000000000000(node=0|zone=2)
[   24.188790] page_type: f5(slab)
[   24.188908] raw: 0200000000000000 ffff888101ea6280 dead000000000122 0000000000000000
[   24.189356] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   24.189701] page dumped because: kasan: bad access detected
[   24.189996] 
[   24.190097] Memory state around the buggy address:
[   24.190349]  ffff8881059c4f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.190558]  ffff8881059c4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.191105] >ffff8881059c5000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   24.191437]                    ^
[   24.191573]  ffff8881059c5080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   24.192192]  ffff8881059c5100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.192529] ==================================================================