BUG: KASAN: slab-use-after-free in dm_setup_md_queue+0x4f4/0x590
Read of size 8 at addr ff1100000b4bc980 by task repro/6152

CPU: 2 PID: 6152 Comm: repro Tainted: G        W          6.6.144 #15
Call Trace:
 <TASK>
 kasan_report+0xc7/0x100
 dm_setup_md_queue+0x4f4/0x590
 table_load+0x56b/0x8b0
 ctl_ioctl+0x72a/0xcb0
 dm_ctl_ioctl+0x22/0x30
 </TASK>

Allocated by task 6148:
 dm_get_table_device+0x266/0x620
 dm_get_device+0x6a2/0x930
 linear_ctr+0x250/0x450
 dm_table_add_target+0x83f/0xf60
 table_load+0x36d/0x8b0

Freed by task 6148:
 dm_put_table_device+0x1eb/0x260
 dm_put_device+0x1c8/0x300
 linear_dtr+0x50/0x70
 dm_table_destroy+0x168/0x460
 table_load+0x4b2/0x8b0

The buggy address belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of freed 64-byte region


Follow-on page fault:
BUG: unable to handle page fault for address: 00383a37000001fb
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
Call Trace:
 mutex_lock+0x92/0xe0
 bd_link_disk_holder+...
 dm_setup_md_queue+0x280/0x590
 table_load+0x56b/0x8b0
