[   29.790826] ==================================================================
[   29.791097] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x168/0x308
[   29.791218] Read of size 1 at addr fff00000c64c1b20 by task kunit_try_catch/223
[   29.791411] 
[   29.791594] CPU: 0 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc6-next-20250714 #1 PREEMPT 
[   29.791864] Tainted: [B]=BAD_PAGE, [N]=TEST
[   29.791964] Hardware name: linux,dummy-virt (DT)
[   29.792057] Call trace:
[   29.792090]  show_stack+0x20/0x38 (C)
[   29.792230]  dump_stack_lvl+0x8c/0xd0
[   29.792278]  print_report+0x118/0x5d0
[   29.792948]  kasan_report+0xdc/0x128
[   29.793012]  __kasan_check_byte+0x54/0x70
[   29.793093]  kfree_sensitive+0x30/0xb0
[   29.793144]  kmalloc_double_kzfree+0x168/0x308
[   29.793193]  kunit_try_run_case+0x170/0x3f0
[   29.793241]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.793475]  kthread+0x328/0x630
[   29.793520]  ret_from_fork+0x10/0x20
[   29.793576] 
[   29.793601] Allocated by task 223:
[   29.793692]  kasan_save_stack+0x3c/0x68
[   29.793903]  kasan_save_track+0x20/0x40
[   29.794125]  kasan_save_alloc_info+0x40/0x58
[   29.794173]  __kasan_kmalloc+0xd4/0xd8
[   29.794212]  __kmalloc_cache_noprof+0x16c/0x3c0
[   29.794338]  kmalloc_double_kzfree+0xb8/0x308
[   29.794380]  kunit_try_run_case+0x170/0x3f0
[   29.794626]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.794749]  kthread+0x328/0x630
[   29.794824]  ret_from_fork+0x10/0x20
[   29.794905] 
[   29.795017] Freed by task 223:
[   29.795109]  kasan_save_stack+0x3c/0x68
[   29.795151]  kasan_save_track+0x20/0x40
[   29.795189]  kasan_save_free_info+0x4c/0x78
[   29.795226]  __kasan_slab_free+0x6c/0x98
[   29.795278]  kfree+0x214/0x3c8
[   29.795314]  kfree_sensitive+0x80/0xb0
[   29.795498]  kmalloc_double_kzfree+0x11c/0x308
[   29.795539]  kunit_try_run_case+0x170/0x3f0
[   29.795628]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   29.795674]  kthread+0x328/0x630
[   29.795727]  ret_from_fork+0x10/0x20
[   29.795907] 
[   29.795969] The buggy address belongs to the object at fff00000c64c1b20
[   29.795969]  which belongs to the cache kmalloc-16 of size 16
[   29.796028] The buggy address is located 0 bytes inside of
[   29.796028]  freed 16-byte region [fff00000c64c1b20, fff00000c64c1b30)
[   29.796380] 
[   29.796408] The buggy address belongs to the physical page:
[   29.796441] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xfff00000c64c1a40 pfn:0x1064c1
[   29.796968] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   29.797035] page_type: f5(slab)
[   29.797089] raw: 0bfffe0000000000 fff00000c0001640 dead000000000122 0000000000000000
[   29.797140] raw: fff00000c64c1a40 000000008080007f 00000000f5000000 0000000000000000
[   29.797181] page dumped because: kasan: bad access detected
[   29.797213] 
[   29.797230] Memory state around the buggy address:
[   29.797444]  fff00000c64c1a00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   29.797512]  fff00000c64c1a80: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   29.797760] >fff00000c64c1b00: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   29.797800]                                ^
[   29.797833]  fff00000c64c1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.798165]  fff00000c64c1c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   29.798209] ==================================================================

[   24.625557] ==================================================================
[   24.626507] BUG: KASAN: slab-use-after-free in kmalloc_double_kzfree+0x19c/0x350
[   24.626923] Read of size 1 at addr ffff8881058422a0 by task kunit_try_catch/241
[   24.627500] 
[   24.627628] CPU: 1 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G    B   W        N  6.16.0-rc6-next-20250714 #1 PREEMPT(voluntary) 
[   24.627703] Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
[   24.627716] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   24.627740] Call Trace:
[   24.627752]  <TASK>
[   24.627771]  dump_stack_lvl+0x73/0xb0
[   24.627805]  print_report+0xd1/0x610
[   24.627828]  ? __virt_addr_valid+0x1db/0x2d0
[   24.627852]  ? kmalloc_double_kzfree+0x19c/0x350
[   24.627874]  ? kasan_complete_mode_report_info+0x64/0x200
[   24.627899]  ? kmalloc_double_kzfree+0x19c/0x350
[   24.627921]  kasan_report+0x141/0x180
[   24.627942]  ? kmalloc_double_kzfree+0x19c/0x350
[   24.628046]  ? kmalloc_double_kzfree+0x19c/0x350
[   24.628071]  __kasan_check_byte+0x3d/0x50
[   24.628092]  kfree_sensitive+0x22/0x90
[   24.628115]  kmalloc_double_kzfree+0x19c/0x350
[   24.628137]  ? __pfx_kmalloc_double_kzfree+0x10/0x10
[   24.628159]  ? __schedule+0x10cc/0x2b60
[   24.628183]  ? __pfx_read_tsc+0x10/0x10
[   24.628205]  ? ktime_get_ts64+0x86/0x230
[   24.628231]  kunit_try_run_case+0x1a5/0x480
[   24.628256]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.628277]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   24.628301]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   24.628325]  ? __kthread_parkme+0x82/0x180
[   24.628348]  ? preempt_count_sub+0x50/0x80
[   24.628372]  ? __pfx_kunit_try_run_case+0x10/0x10
[   24.628393]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.628417]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   24.628442]  kthread+0x337/0x6f0
[   24.628461]  ? trace_preempt_on+0x20/0xc0
[   24.628485]  ? __pfx_kthread+0x10/0x10
[   24.628506]  ? _raw_spin_unlock_irq+0x47/0x80
[   24.628527]  ? calculate_sigpending+0x7b/0xa0
[   24.628551]  ? __pfx_kthread+0x10/0x10
[   24.628572]  ret_from_fork+0x116/0x1d0
[   24.628591]  ? __pfx_kthread+0x10/0x10
[   24.628611]  ret_from_fork_asm+0x1a/0x30
[   24.628642]  </TASK>
[   24.628653] 
[   24.636335] Allocated by task 241:
[   24.636481]  kasan_save_stack+0x45/0x70
[   24.636754]  kasan_save_track+0x18/0x40
[   24.636977]  kasan_save_alloc_info+0x3b/0x50
[   24.637308]  __kasan_kmalloc+0xb7/0xc0
[   24.637722]  __kmalloc_cache_noprof+0x189/0x420
[   24.638270]  kmalloc_double_kzfree+0xa9/0x350
[   24.638455]  kunit_try_run_case+0x1a5/0x480
[   24.638669]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.639003]  kthread+0x337/0x6f0
[   24.639121]  ret_from_fork+0x116/0x1d0
[   24.639247]  ret_from_fork_asm+0x1a/0x30
[   24.639392] 
[   24.639578] Freed by task 241:
[   24.639821]  kasan_save_stack+0x45/0x70
[   24.640087]  kasan_save_track+0x18/0x40
[   24.640249]  kasan_save_free_info+0x3f/0x60
[   24.640388]  __kasan_slab_free+0x56/0x70
[   24.640516]  kfree+0x222/0x3f0
[   24.640709]  kfree_sensitive+0x67/0x90
[   24.640928]  kmalloc_double_kzfree+0x12b/0x350
[   24.641212]  kunit_try_run_case+0x1a5/0x480
[   24.641436]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   24.641694]  kthread+0x337/0x6f0
[   24.641888]  ret_from_fork+0x116/0x1d0
[   24.642264]  ret_from_fork_asm+0x1a/0x30
[   24.642429] 
[   24.642518] The buggy address belongs to the object at ffff8881058422a0
[   24.642518]  which belongs to the cache kmalloc-16 of size 16
[   24.643300] The buggy address is located 0 bytes inside of
[   24.643300]  freed 16-byte region [ffff8881058422a0, ffff8881058422b0)
[   24.643997] 
[   24.644098] The buggy address belongs to the physical page:
[   24.644326] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105842
[   24.644665] flags: 0x200000000000000(node=0|zone=2)
[   24.644931] page_type: f5(slab)
[   24.645148] raw: 0200000000000000 ffff888100041640 dead000000000100 dead000000000122
[   24.645402] raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000
[   24.645620] page dumped because: kasan: bad access detected
[   24.645836] 
[   24.645943] Memory state around the buggy address:
[   24.646202]  ffff888105842180: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc
[   24.646516]  ffff888105842200: fa fb fc fc 00 06 fc fc 00 06 fc fc 00 06 fc fc
[   24.647274] >ffff888105842280: fa fb fc fc fa fb fc fc fc fc fc fc fc fc fc fc
[   24.647595]                                ^
[   24.647819]  ffff888105842300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.648028]  ffff888105842380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   24.648234] ==================================================================