Hay
Date
July 3, 2025, 11:10 p.m.

Environment
qemu-arm64
qemu-x86_64

[   22.315591] ==================================================================
[   22.315748] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   22.315881] Free of addr fff00000c7958000 by task kunit_try_catch/237
[   22.316346] 
[   22.316523] CPU: 0 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   22.316741] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.316816] Hardware name: linux,dummy-virt (DT)
[   22.316896] Call trace:
[   22.316950]  show_stack+0x20/0x38 (C)
[   22.317400]  dump_stack_lvl+0x8c/0xd0
[   22.317613]  print_report+0x118/0x608
[   22.317873]  kasan_report_invalid_free+0xc0/0xe8
[   22.318006]  __kasan_mempool_poison_object+0x14c/0x150
[   22.318353]  mempool_free+0x28c/0x328
[   22.318543]  mempool_double_free_helper+0x150/0x2e8
[   22.318854]  mempool_kmalloc_large_double_free+0xc0/0x118
[   22.319115]  kunit_try_run_case+0x170/0x3f0
[   22.319318]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.319614]  kthread+0x328/0x630
[   22.319895]  ret_from_fork+0x10/0x20
[   22.320157] 
[   22.320204] The buggy address belongs to the physical page:
[   22.320294] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107958
[   22.320612] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   22.320946] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   22.321092] page_type: f8(unknown)
[   22.321186] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   22.321299] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000
[   22.321408] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   22.321750] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000
[   22.322180] head: 0bfffe0000000002 ffffc1ffc31e5601 00000000ffffffff 00000000ffffffff
[   22.322478] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   22.322811] page dumped because: kasan: bad access detected
[   22.322883] 
[   22.322931] Memory state around the buggy address:
[   22.323001]  fff00000c7957f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.323136]  fff00000c7957f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.323231] >fff00000c7958000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.323339]                    ^
[   22.323438]  fff00000c7958080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.323699]  fff00000c7958100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.323866] ==================================================================
[   22.333371] ==================================================================
[   22.333534] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   22.333718] Free of addr fff00000c7958000 by task kunit_try_catch/239
[   22.333882] 
[   22.333961] CPU: 0 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   22.334156] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.334219] Hardware name: linux,dummy-virt (DT)
[   22.334293] Call trace:
[   22.334341]  show_stack+0x20/0x38 (C)
[   22.334455]  dump_stack_lvl+0x8c/0xd0
[   22.334550]  print_report+0x118/0x608
[   22.334657]  kasan_report_invalid_free+0xc0/0xe8
[   22.334760]  __kasan_mempool_poison_pages+0xe0/0xe8
[   22.334855]  mempool_free+0x24c/0x328
[   22.334945]  mempool_double_free_helper+0x150/0x2e8
[   22.335062]  mempool_page_alloc_double_free+0xbc/0x118
[   22.335161]  kunit_try_run_case+0x170/0x3f0
[   22.335262]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.335366]  kthread+0x328/0x630
[   22.335470]  ret_from_fork+0x10/0x20
[   22.335587] 
[   22.335630] The buggy address belongs to the physical page:
[   22.335703] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107958
[   22.335827] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   22.335962] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000
[   22.336095] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   22.336188] page dumped because: kasan: bad access detected
[   22.336257] 
[   22.336294] Memory state around the buggy address:
[   22.336370]  fff00000c7957f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.336460]  fff00000c7957f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.336560] >fff00000c7958000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.336641]                    ^
[   22.336699]  fff00000c7958080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.336799]  fff00000c7958100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   22.336892] ==================================================================
[   22.283973] ==================================================================
[   22.284149] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8
[   22.284290] Free of addr fff00000c77efa00 by task kunit_try_catch/235
[   22.284388] 
[   22.284478] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT 
[   22.284691] Tainted: [B]=BAD_PAGE, [N]=TEST
[   22.284760] Hardware name: linux,dummy-virt (DT)
[   22.284845] Call trace:
[   22.284907]  show_stack+0x20/0x38 (C)
[   22.285277]  dump_stack_lvl+0x8c/0xd0
[   22.285429]  print_report+0x118/0x608
[   22.285541]  kasan_report_invalid_free+0xc0/0xe8
[   22.285653]  check_slab_allocation+0xd4/0x108
[   22.286682]  __kasan_mempool_poison_object+0x78/0x150
[   22.286860]  mempool_free+0x28c/0x328
[   22.286974]  mempool_double_free_helper+0x150/0x2e8
[   22.287119]  mempool_kmalloc_double_free+0xc0/0x118
[   22.287259]  kunit_try_run_case+0x170/0x3f0
[   22.287424]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.287558]  kthread+0x328/0x630
[   22.287693]  ret_from_fork+0x10/0x20
[   22.287842] 
[   22.287888] Allocated by task 235:
[   22.287962]  kasan_save_stack+0x3c/0x68
[   22.288076]  kasan_save_track+0x20/0x40
[   22.288147]  kasan_save_alloc_info+0x40/0x58
[   22.288231]  __kasan_mempool_unpoison_object+0x11c/0x180
[   22.288331]  remove_element+0x130/0x1f8
[   22.288798]  mempool_alloc_preallocated+0x58/0xc0
[   22.289131]  mempool_double_free_helper+0x94/0x2e8
[   22.289223]  mempool_kmalloc_double_free+0xc0/0x118
[   22.289353]  kunit_try_run_case+0x170/0x3f0
[   22.289631]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.289786]  kthread+0x328/0x630
[   22.289940]  ret_from_fork+0x10/0x20
[   22.290247] 
[   22.290302] Freed by task 235:
[   22.290423]  kasan_save_stack+0x3c/0x68
[   22.290522]  kasan_save_track+0x20/0x40
[   22.290610]  kasan_save_free_info+0x4c/0x78
[   22.290729]  __kasan_mempool_poison_object+0xc0/0x150
[   22.290837]  mempool_free+0x28c/0x328
[   22.290981]  mempool_double_free_helper+0x100/0x2e8
[   22.291323]  mempool_kmalloc_double_free+0xc0/0x118
[   22.291438]  kunit_try_run_case+0x170/0x3f0
[   22.291532]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   22.291631]  kthread+0x328/0x630
[   22.291700]  ret_from_fork+0x10/0x20
[   22.291780] 
[   22.291828] The buggy address belongs to the object at fff00000c77efa00
[   22.291828]  which belongs to the cache kmalloc-128 of size 128
[   22.291969] The buggy address is located 0 bytes inside of
[   22.291969]  128-byte region [fff00000c77efa00, fff00000c77efa80)
[   22.292330] 
[   22.292378] The buggy address belongs to the physical page:
[   22.292452] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077ef
[   22.292614] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   22.292738] page_type: f5(slab)
[   22.292840] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000
[   22.292982] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   22.293104] page dumped because: kasan: bad access detected
[   22.293186] 
[   22.293230] Memory state around the buggy address:
[   22.293312]  fff00000c77ef900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.293413]  fff00000c77ef980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.293509] >fff00000c77efa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   22.293597]                    ^
[   22.294831]  fff00000c77efa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   22.295104]  fff00000c77efb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   22.295213] ==================================================================

[   13.214066] ==================================================================
[   13.215734] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370
[   13.216146] Free of addr ffff888103960000 by task kunit_try_catch/254
[   13.216563] 
[   13.217021] CPU: 1 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   13.217071] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.217083] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.217105] Call Trace:
[   13.217116]  <TASK>
[   13.217171]  dump_stack_lvl+0x73/0xb0
[   13.217201]  print_report+0xd1/0x650
[   13.217224]  ? __virt_addr_valid+0x1db/0x2d0
[   13.217247]  ? kasan_addr_to_slab+0x11/0xa0
[   13.217268]  ? mempool_double_free_helper+0x184/0x370
[   13.217291]  kasan_report_invalid_free+0x10a/0x130
[   13.217316]  ? mempool_double_free_helper+0x184/0x370
[   13.217342]  ? mempool_double_free_helper+0x184/0x370
[   13.217364]  __kasan_mempool_poison_object+0x1b3/0x1d0
[   13.217387]  mempool_free+0x2ec/0x380
[   13.217409]  mempool_double_free_helper+0x184/0x370
[   13.217431]  ? __pfx_mempool_double_free_helper+0x10/0x10
[   13.217477]  ? update_load_avg+0x1be/0x21b0
[   13.217504]  ? finish_task_switch.isra.0+0x153/0x700
[   13.217528]  mempool_kmalloc_large_double_free+0xed/0x140
[   13.217552]  ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10
[   13.217579]  ? __pfx_mempool_kmalloc+0x10/0x10
[   13.217602]  ? __pfx_mempool_kfree+0x10/0x10
[   13.217626]  ? __pfx_read_tsc+0x10/0x10
[   13.217646]  ? ktime_get_ts64+0x86/0x230
[   13.217669]  kunit_try_run_case+0x1a5/0x480
[   13.217692]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.217714]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.217736]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.217758]  ? __kthread_parkme+0x82/0x180
[   13.217778]  ? preempt_count_sub+0x50/0x80
[   13.217800]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.217822]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.217845]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.217867]  kthread+0x337/0x6f0
[   13.217885]  ? trace_preempt_on+0x20/0xc0
[   13.217908]  ? __pfx_kthread+0x10/0x10
[   13.217928]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.217948]  ? calculate_sigpending+0x7b/0xa0
[   13.217972]  ? __pfx_kthread+0x10/0x10
[   13.217992]  ret_from_fork+0x116/0x1d0
[   13.218009]  ? __pfx_kthread+0x10/0x10
[   13.218028]  ret_from_fork_asm+0x1a/0x30
[   13.218057]  </TASK>
[   13.218067] 
[   13.233231] The buggy address belongs to the physical page:
[   13.233724] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103960
[   13.234225] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   13.234717] flags: 0x200000000000040(head|node=0|zone=2)
[   13.235259] page_type: f8(unknown)
[   13.235510] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   13.236182] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000
[   13.236474] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   13.237255] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000
[   13.237847] head: 0200000000000002 ffffea00040e5801 00000000ffffffff 00000000ffffffff
[   13.238089] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   13.238655] page dumped because: kasan: bad access detected
[   13.239255] 
[   13.239454] Memory state around the buggy address:
[   13.240151]  ffff88810395ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.240903]  ffff88810395ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.241533] >ffff888103960000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.241949]                    ^
[   13.242073]  ffff888103960080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.242394]  ffff888103960100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.243077] ==================================================================
[   13.247323] ==================================================================
[   13.247915] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370
[   13.248609] Free of addr ffff888103964000 by task kunit_try_catch/256
[   13.249466] 
[   13.249657] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   13.249705] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.249718] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.249739] Call Trace:
[   13.249753]  <TASK>
[   13.249768]  dump_stack_lvl+0x73/0xb0
[   13.249798]  print_report+0xd1/0x650
[   13.249819]  ? __virt_addr_valid+0x1db/0x2d0
[   13.249844]  ? kasan_addr_to_slab+0x11/0xa0
[   13.249863]  ? mempool_double_free_helper+0x184/0x370
[   13.249887]  kasan_report_invalid_free+0x10a/0x130
[   13.249911]  ? mempool_double_free_helper+0x184/0x370
[   13.249936]  ? mempool_double_free_helper+0x184/0x370
[   13.249958]  __kasan_mempool_poison_pages+0x115/0x130
[   13.249983]  mempool_free+0x290/0x380
[   13.250005]  mempool_double_free_helper+0x184/0x370
[   13.250028]  ? __pfx_mempool_double_free_helper+0x10/0x10
[   13.250055]  ? finish_task_switch.isra.0+0x153/0x700
[   13.250079]  mempool_page_alloc_double_free+0xe8/0x140
[   13.250102]  ? __pfx_mempool_page_alloc_double_free+0x10/0x10
[   13.250140]  ? __pfx_mempool_alloc_pages+0x10/0x10
[   13.250160]  ? __pfx_mempool_free_pages+0x10/0x10
[   13.250181]  ? __pfx_read_tsc+0x10/0x10
[   13.250201]  ? ktime_get_ts64+0x86/0x230
[   13.250224]  kunit_try_run_case+0x1a5/0x480
[   13.250247]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.250269]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.250292]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.250316]  ? __kthread_parkme+0x82/0x180
[   13.250338]  ? preempt_count_sub+0x50/0x80
[   13.250371]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.250394]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.250416]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.250449]  kthread+0x337/0x6f0
[   13.250468]  ? trace_preempt_on+0x20/0xc0
[   13.250490]  ? __pfx_kthread+0x10/0x10
[   13.250514]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.250534]  ? calculate_sigpending+0x7b/0xa0
[   13.250557]  ? __pfx_kthread+0x10/0x10
[   13.250578]  ret_from_fork+0x116/0x1d0
[   13.250597]  ? __pfx_kthread+0x10/0x10
[   13.250616]  ret_from_fork_asm+0x1a/0x30
[   13.250644]  </TASK>
[   13.250655] 
[   13.265790] The buggy address belongs to the physical page:
[   13.266140] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103964
[   13.266719] flags: 0x200000000000000(node=0|zone=2)
[   13.267073] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
[   13.267680] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   13.268438] page dumped because: kasan: bad access detected
[   13.268790] 
[   13.268863] Memory state around the buggy address:
[   13.269023]  ffff888103963f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.269298]  ffff888103963f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.269699] >ffff888103964000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.270027]                    ^
[   13.270247]  ffff888103964080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.270651]  ffff888103964100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   13.271237] ==================================================================
[   13.169488] ==================================================================
[   13.169941] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370
[   13.170221] Free of addr ffff88810319a600 by task kunit_try_catch/252
[   13.170630] 
[   13.170750] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc4 #1 PREEMPT(voluntary) 
[   13.170796] Tainted: [B]=BAD_PAGE, [N]=TEST
[   13.170809] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   13.170829] Call Trace:
[   13.170841]  <TASK>
[   13.170898]  dump_stack_lvl+0x73/0xb0
[   13.170928]  print_report+0xd1/0x650
[   13.171289]  ? __virt_addr_valid+0x1db/0x2d0
[   13.171341]  ? kasan_complete_mode_report_info+0x64/0x200
[   13.171364]  ? mempool_double_free_helper+0x184/0x370
[   13.171388]  kasan_report_invalid_free+0x10a/0x130
[   13.171412]  ? mempool_double_free_helper+0x184/0x370
[   13.171437]  ? mempool_double_free_helper+0x184/0x370
[   13.171458]  ? mempool_double_free_helper+0x184/0x370
[   13.171481]  check_slab_allocation+0x101/0x130
[   13.171502]  __kasan_mempool_poison_object+0x91/0x1d0
[   13.171526]  mempool_free+0x2ec/0x380
[   13.171549]  mempool_double_free_helper+0x184/0x370
[   13.171572]  ? __pfx_mempool_double_free_helper+0x10/0x10
[   13.171595]  ? __kasan_check_write+0x18/0x20
[   13.171615]  ? __pfx_sched_clock_cpu+0x10/0x10
[   13.171637]  ? finish_task_switch.isra.0+0x153/0x700
[   13.171662]  mempool_kmalloc_double_free+0xed/0x140
[   13.171685]  ? __pfx_mempool_kmalloc_double_free+0x10/0x10
[   13.171712]  ? __pfx_mempool_kmalloc+0x10/0x10
[   13.171735]  ? __pfx_mempool_kfree+0x10/0x10
[   13.171760]  ? __pfx_read_tsc+0x10/0x10
[   13.171782]  ? ktime_get_ts64+0x86/0x230
[   13.171806]  kunit_try_run_case+0x1a5/0x480
[   13.171829]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.171851]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   13.171873]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   13.171896]  ? __kthread_parkme+0x82/0x180
[   13.171917]  ? preempt_count_sub+0x50/0x80
[   13.171938]  ? __pfx_kunit_try_run_case+0x10/0x10
[   13.171961]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.171982]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   13.172006]  kthread+0x337/0x6f0
[   13.172026]  ? trace_preempt_on+0x20/0xc0
[   13.172048]  ? __pfx_kthread+0x10/0x10
[   13.172069]  ? _raw_spin_unlock_irq+0x47/0x80
[   13.172089]  ? calculate_sigpending+0x7b/0xa0
[   13.172112]  ? __pfx_kthread+0x10/0x10
[   13.172161]  ret_from_fork+0x116/0x1d0
[   13.172179]  ? __pfx_kthread+0x10/0x10
[   13.172199]  ret_from_fork_asm+0x1a/0x30
[   13.172230]  </TASK>
[   13.172241] 
[   13.187107] Allocated by task 252:
[   13.188380]  kasan_save_stack+0x45/0x70
[   13.188973]  kasan_save_track+0x18/0x40
[   13.189719]  kasan_save_alloc_info+0x3b/0x50
[   13.190460]  __kasan_mempool_unpoison_object+0x1a9/0x200
[   13.190900]  remove_element+0x11e/0x190
[   13.191049]  mempool_alloc_preallocated+0x4d/0x90
[   13.191225]  mempool_double_free_helper+0x8a/0x370
[   13.191886]  mempool_kmalloc_double_free+0xed/0x140
[   13.192544]  kunit_try_run_case+0x1a5/0x480
[   13.193115]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.194014]  kthread+0x337/0x6f0
[   13.194658]  ret_from_fork+0x116/0x1d0
[   13.194818]  ret_from_fork_asm+0x1a/0x30
[   13.194962] 
[   13.195033] Freed by task 252:
[   13.195231]  kasan_save_stack+0x45/0x70
[   13.195581]  kasan_save_track+0x18/0x40
[   13.196042]  kasan_save_free_info+0x3f/0x60
[   13.196538]  __kasan_mempool_poison_object+0x131/0x1d0
[   13.197075]  mempool_free+0x2ec/0x380
[   13.197521]  mempool_double_free_helper+0x109/0x370
[   13.197784]  mempool_kmalloc_double_free+0xed/0x140
[   13.197949]  kunit_try_run_case+0x1a5/0x480
[   13.198093]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   13.198617]  kthread+0x337/0x6f0
[   13.198911]  ret_from_fork+0x116/0x1d0
[   13.199302]  ret_from_fork_asm+0x1a/0x30
[   13.199823] 
[   13.199992] The buggy address belongs to the object at ffff88810319a600
[   13.199992]  which belongs to the cache kmalloc-128 of size 128
[   13.201099] The buggy address is located 0 bytes inside of
[   13.201099]  128-byte region [ffff88810319a600, ffff88810319a680)
[   13.202140] 
[   13.202238] The buggy address belongs to the physical page:
[   13.202812] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10319a
[   13.203585] flags: 0x200000000000000(node=0|zone=2)
[   13.203763] page_type: f5(slab)
[   13.203889] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   13.204134] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   13.204769] page dumped because: kasan: bad access detected
[   13.205320] 
[   13.205712] Memory state around the buggy address:
[   13.206225]  ffff88810319a500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   13.207005]  ffff88810319a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.207795] >ffff88810319a600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   13.208521]                    ^
[   13.208840]  ffff88810319a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   13.209498]  ffff88810319a700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   13.210407] ==================================================================