[   12.676652] ==================================================================
[   12.677322] BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3e3/0x510
[   12.677893] Read of size 1 at addr ffff8881039eb000 by task kunit_try_catch/233
[   12.678218] 
[   12.678409] CPU: 0 UID: 0 PID: 233 Comm: kunit_try_catch Tainted: G    B            N  6.15.4-rc2 #1 PREEMPT(voluntary) 
[   12.678477] Tainted: [B]=BAD_PAGE, [N]=TEST
[   12.678910] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   12.678960] Call Trace:
[   12.679136]  <TASK>
[   12.679188]  dump_stack_lvl+0x73/0xb0
[   12.679260]  print_report+0xd1/0x650
[   12.679312]  ? __virt_addr_valid+0x1db/0x2d0
[   12.679360]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   12.679408]  ? kasan_complete_mode_report_info+0x64/0x200
[   12.679444]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   12.679476]  kasan_report+0x141/0x180
[   12.679514]  ? kmem_cache_rcu_uaf+0x3e3/0x510
[   12.679559]  __asan_report_load1_noabort+0x18/0x20
[   12.679596]  kmem_cache_rcu_uaf+0x3e3/0x510
[   12.679648]  ? __pfx_kmem_cache_rcu_uaf+0x10/0x10
[   12.679687]  ? finish_task_switch.isra.0+0x153/0x700
[   12.679731]  ? __switch_to+0x5d9/0xf60
[   12.679767]  ? dequeue_task_fair+0x166/0x4e0
[   12.679811]  ? __pfx_read_tsc+0x10/0x10
[   12.679841]  ? ktime_get_ts64+0x86/0x230
[   12.679881]  kunit_try_run_case+0x1a5/0x480
[   12.679922]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.679956]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   12.679995]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   12.680033]  ? __kthread_parkme+0x82/0x180
[   12.680074]  ? preempt_count_sub+0x50/0x80
[   12.680123]  ? __pfx_kunit_try_run_case+0x10/0x10
[   12.680170]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.680214]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   12.680267]  kthread+0x337/0x6f0
[   12.680320]  ? trace_preempt_on+0x20/0xc0
[   12.680370]  ? __pfx_kthread+0x10/0x10
[   12.680398]  ? _raw_spin_unlock_irq+0x47/0x80
[   12.680420]  ? calculate_sigpending+0x7b/0xa0
[   12.680443]  ? __pfx_kthread+0x10/0x10
[   12.680462]  ret_from_fork+0x41/0x80
[   12.680483]  ? __pfx_kthread+0x10/0x10
[   12.680501]  ret_from_fork_asm+0x1a/0x30
[   12.680533]  </TASK>
[   12.680572] 
[   12.691494] Allocated by task 233:
[   12.691868]  kasan_save_stack+0x45/0x70
[   12.692192]  kasan_save_track+0x18/0x40
[   12.692516]  kasan_save_alloc_info+0x3b/0x50
[   12.692789]  __kasan_slab_alloc+0x91/0xa0
[   12.693074]  kmem_cache_alloc_noprof+0x123/0x3f0
[   12.693485]  kmem_cache_rcu_uaf+0x155/0x510
[   12.693747]  kunit_try_run_case+0x1a5/0x480
[   12.694100]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.695190]  kthread+0x337/0x6f0
[   12.695379]  ret_from_fork+0x41/0x80
[   12.695607]  ret_from_fork_asm+0x1a/0x30
[   12.695920] 
[   12.696077] Freed by task 0:
[   12.696248]  kasan_save_stack+0x45/0x70
[   12.696505]  kasan_save_track+0x18/0x40
[   12.696904]  kasan_save_free_info+0x3f/0x60
[   12.697234]  __kasan_slab_free+0x56/0x70
[   12.697671]  slab_free_after_rcu_debug+0xe4/0x310
[   12.698004]  rcu_core+0x66c/0x1c30
[   12.698174]  rcu_core_si+0x12/0x20
[   12.698599]  handle_softirqs+0x209/0x730
[   12.698927]  __irq_exit_rcu+0xc9/0x110
[   12.699195]  irq_exit_rcu+0x12/0x20
[   12.699581]  sysvec_apic_timer_interrupt+0x81/0x90
[   12.699824]  asm_sysvec_apic_timer_interrupt+0x1f/0x30
[   12.700031] 
[   12.700165] Last potentially related work creation:
[   12.701220]  kasan_save_stack+0x45/0x70
[   12.701674]  kasan_record_aux_stack+0xb2/0xc0
[   12.702002]  kmem_cache_free+0x131/0x420
[   12.702238]  kmem_cache_rcu_uaf+0x194/0x510
[   12.702713]  kunit_try_run_case+0x1a5/0x480
[   12.702951]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   12.703215]  kthread+0x337/0x6f0
[   12.703571]  ret_from_fork+0x41/0x80
[   12.703776]  ret_from_fork_asm+0x1a/0x30
[   12.704074] 
[   12.704176] The buggy address belongs to the object at ffff8881039eb000
[   12.704176]  which belongs to the cache test_cache of size 200
[   12.704870] The buggy address is located 0 bytes inside of
[   12.704870]  freed 200-byte region [ffff8881039eb000, ffff8881039eb0c8)
[   12.705524] 
[   12.705861] The buggy address belongs to the physical page:
[   12.706098] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039eb
[   12.707447] flags: 0x200000000000000(node=0|zone=2)
[   12.707750] page_type: f5(slab)
[   12.708026] raw: 0200000000000000 ffff888101e34500 dead000000000122 0000000000000000
[   12.708558] raw: 0000000000000000 00000000800f000f 00000000f5000000 0000000000000000
[   12.708959] page dumped because: kasan: bad access detected
[   12.709167] 
[   12.709435] Memory state around the buggy address:
[   12.709765]  ffff8881039eaf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.710108]  ffff8881039eaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.710646] >ffff8881039eb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   12.711062]                    ^
[   12.712085]  ffff8881039eb080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[   12.712583]  ffff8881039eb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   12.712859] ==================================================================