Nit: s/adopt/adapt in the title. > +again: > ptr1 = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); > > @@ -384,6 +386,13 @@ static void kmalloc_uaf2(struct kunit *test) > ptr2 = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); > > + /* > + * For tag-based KASAN ptr1 and ptr2 tags might happen to be the same. > + * Allow up to 4 attempts at generating different tags. > + */ > + if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && ptr1 == ptr2 && counter++ < 4) > + goto again; > + Looks like we are leaking memory allocated for ptr2 here?