[   30.499132] ==================================================================
[   30.499335] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x300/0x338
[   30.499925] Read of size 1 at addr fff00000c918c668 by task kunit_try_catch/215
[   30.499991] 
[   30.500149] CPU: 1 UID: 0 PID: 215 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250711 #1 PREEMPT 
[   30.500239] Tainted: [B]=BAD_PAGE, [N]=TEST
[   30.500266] Hardware name: linux,dummy-virt (DT)
[   30.500304] Call trace:
[   30.500563]  show_stack+0x20/0x38 (C)
[   30.500712]  dump_stack_lvl+0x8c/0xd0
[   30.500800]  print_report+0x118/0x5d0
[   30.501103]  kasan_report+0xdc/0x128
[   30.501203]  __asan_report_load1_noabort+0x20/0x30
[   30.501468]  kmalloc_uaf+0x300/0x338
[   30.501673]  kunit_try_run_case+0x170/0x3f0
[   30.501727]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.501779]  kthread+0x328/0x630
[   30.501959]  ret_from_fork+0x10/0x20
[   30.502025] 
[   30.502043] Allocated by task 215:
[   30.502143]  kasan_save_stack+0x3c/0x68
[   30.502189]  kasan_save_track+0x20/0x40
[   30.502228]  kasan_save_alloc_info+0x40/0x58
[   30.502270]  __kasan_kmalloc+0xd4/0xd8
[   30.502388]  __kmalloc_cache_noprof+0x16c/0x3c0
[   30.502464]  kmalloc_uaf+0xb8/0x338
[   30.502622]  kunit_try_run_case+0x170/0x3f0
[   30.502707]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.502748]  kthread+0x328/0x630
[   30.502780]  ret_from_fork+0x10/0x20
[   30.502856] 
[   30.502936] Freed by task 215:
[   30.503053]  kasan_save_stack+0x3c/0x68
[   30.503119]  kasan_save_track+0x20/0x40
[   30.503217]  kasan_save_free_info+0x4c/0x78
[   30.503265]  __kasan_slab_free+0x6c/0x98
[   30.503303]  kfree+0x214/0x3c8
[   30.503660]  kmalloc_uaf+0x11c/0x338
[   30.504041]  kunit_try_run_case+0x170/0x3f0
[   30.504091]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   30.504285]  kthread+0x328/0x630
[   30.504339]  ret_from_fork+0x10/0x20
[   30.504471] 
[   30.504491] The buggy address belongs to the object at fff00000c918c660
[   30.504491]  which belongs to the cache kmalloc-16 of size 16
[   30.504550] The buggy address is located 8 bytes inside of
[   30.504550]  freed 16-byte region [fff00000c918c660, fff00000c918c670)
[   30.504905] 
[   30.504936] The buggy address belongs to the physical page:
[   30.505028] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10918c
[   30.505105] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   30.505184] page_type: f5(slab)
[   30.505276] raw: 0bfffe0000000000 fff00000c0001640 dead000000000100 dead000000000122
[   30.505339] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   30.505569] page dumped because: kasan: bad access detected
[   30.505674] 
[   30.505697] Memory state around the buggy address:
[   30.505730]  fff00000c918c500: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc
[   30.505772]  fff00000c918c580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   30.505814] >fff00000c918c600: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   30.506036]                                                           ^
[   30.506142]  fff00000c918c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.506224]  fff00000c918c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   30.506263] ==================================================================

[   24.012064] ==================================================================
[   24.012825] BUG: KASAN: slab-use-after-free in kmalloc_uaf+0x320/0x380
[   24.013784] Read of size 1 at addr ffff88810226ac88 by task kunit_try_catch/234
[   24.014717] 
[   24.014840] CPU: 1 UID: 0 PID: 234 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc5-next-20250711 #1 PREEMPT(voluntary) 
[   24.014895] Tainted: [B]=BAD_PAGE, [N]=TEST
[   24.014908] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.014930] Call Trace:
[   24.014945]  <TASK>
[   24.014964]  dump_stack_lvl+0x73/0xb0
[   24.014998]  print_report+0xd1/0x610
[   24.015021]  ? __virt_addr_valid+0x1db/0x2d0
[   24.015045]  ? kmalloc_uaf+0x320/0x380
[   24.015068]  ? kasan_complete_mode_report_info+0x64/0x200
[   24.015095]  ? kmalloc_uaf+0x320/0x380
[   24.015115]  kasan_report+0x141/0x180
[   24.015137]  ? kmalloc_uaf+0x320/0x380
[   24.015160]  __asan_report_load1_noabort+0x18/0x20
[   24.015183]  kmalloc_uaf+0x320/0x380
[   24.015203]  ? __pfx_kmalloc_uaf+0x10/0x10
[   24.015223]  ? __schedule+0x10cc/0x2b60
[   24.015247]  ? __pfx_read_tsc+0x10/0x10
[   24.015269]  ? ktime_get_ts64+0x86/0x230
[   24.015315]  kunit_try_run_case+0x1a5/0x480
[   24.015350]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.015370]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   24.015393]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.015416]  ? __kthread_parkme+0x82/0x180
[   24.015438]  ? preempt_count_sub+0x50/0x80
[   24.015461]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.015524]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.015577]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.015615]  kthread+0x337/0x6f0
[   24.015637]  ? trace_preempt_on+0x20/0xc0
[   24.015660]  ? __pfx_kthread+0x10/0x10
[   24.015681]  ? _raw_spin_unlock_irq+0x47/0x80
[   24.015703]  ? calculate_sigpending+0x7b/0xa0
[   24.015728]  ? __pfx_kthread+0x10/0x10
[   24.015759]  ret_from_fork+0x116/0x1d0
[   24.015778]  ? __pfx_kthread+0x10/0x10
[   24.015799]  ret_from_fork_asm+0x1a/0x30
[   24.015831]  </TASK>
[   24.015843] 
[   24.030317] Allocated by task 234:
[   24.030583]  kasan_save_stack+0x45/0x70
[   24.031160]  kasan_save_track+0x18/0x40
[   24.031523]  kasan_save_alloc_info+0x3b/0x50
[   24.031877]  __kasan_kmalloc+0xb7/0xc0
[   24.032009]  __kmalloc_cache_noprof+0x189/0x420
[   24.032160]  kmalloc_uaf+0xaa/0x380
[   24.032489]  kunit_try_run_case+0x1a5/0x480
[   24.032821]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.032993]  kthread+0x337/0x6f0
[   24.033109]  ret_from_fork+0x116/0x1d0
[   24.033236]  ret_from_fork_asm+0x1a/0x30
[   24.033700] 
[   24.033937] Freed by task 234:
[   24.034311]  kasan_save_stack+0x45/0x70
[   24.034723]  kasan_save_track+0x18/0x40
[   24.035142]  kasan_save_free_info+0x3f/0x60
[   24.035638]  __kasan_slab_free+0x56/0x70
[   24.036142]  kfree+0x222/0x3f0
[   24.036540]  kmalloc_uaf+0x12c/0x380
[   24.036967]  kunit_try_run_case+0x1a5/0x480
[   24.037145]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.037532]  kthread+0x337/0x6f0
[   24.037952]  ret_from_fork+0x116/0x1d0
[   24.038358]  ret_from_fork_asm+0x1a/0x30
[   24.038828] 
[   24.039062] The buggy address belongs to the object at ffff88810226ac80
[   24.039062]  which belongs to the cache kmalloc-16 of size 16
[   24.039726] The buggy address is located 8 bytes inside of
[   24.039726]  freed 16-byte region [ffff88810226ac80, ffff88810226ac90)
[   24.040080] 
[   24.040147] The buggy address belongs to the physical page:
[   24.040494] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10226a
[   24.041351] flags: 0x200000000000000(node=0|zone=2)
[   24.041884] page_type: f5(slab)
[   24.042226] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122
[   24.043060] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   24.043839] page dumped because: kasan: bad access detected
[   24.044526] 
[   24.044745] Memory state around the buggy address:
[   24.045237]  ffff88810226ab80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc
[   24.045947]  ffff88810226ac00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   24.046228] >ffff88810226ac80: fa fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.046942]                       ^
[   24.047474]  ffff88810226ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.048183]  ffff88810226ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.048701] ==================================================================