<4>[ 38.796558] ? kmalloc_memmove_negative_size+0xeb/0x1f0 <4>[ 38.797376] ? __pfx_kmalloc_memmove_negative_size+0x10/0x10
Most certainly kmalloc_memmove_negative_size() is related. Looks like we fail to intercept the call to memmove() in this test, passing -2 to the actual __memmove().
This was introduced by 69d4c0d321869 ("entry, kasan, x86: Disallow overriding mem*() functions")
There's Marco's "kasan: Emit different calls for instrumentable memintrinsics", but it doesn't fix the problem for me (looking closer...), and GCC support is still not there, right?
Failing to intercept memcpy/memset/memmove should normally result in false negatives, but kmalloc_memmove_negative_size() makes a strong assumption that KASAN will catch and prevent memmove(dst, src, -2).