Date
July 1, 2025, 11:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.774343] ================================================================== [ 20.774899] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.775029] Free of addr fff00000c784c000 by task kunit_try_catch/238 [ 20.775081] [ 20.775699] CPU: 0 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.776204] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.776293] Hardware name: linux,dummy-virt (DT) [ 20.776404] Call trace: [ 20.776436] show_stack+0x20/0x38 (C) [ 20.776807] dump_stack_lvl+0x8c/0xd0 [ 20.777245] print_report+0x118/0x608 [ 20.777444] kasan_report_invalid_free+0xc0/0xe8 [ 20.777515] __kasan_mempool_poison_object+0x14c/0x150 [ 20.778031] mempool_free+0x28c/0x328 [ 20.778363] mempool_double_free_helper+0x150/0x2e8 [ 20.778561] mempool_kmalloc_large_double_free+0xc0/0x118 [ 20.778974] kunit_try_run_case+0x170/0x3f0 [ 20.779194] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.779529] kthread+0x328/0x630 [ 20.779736] ret_from_fork+0x10/0x20 [ 20.779997] [ 20.780056] The buggy address belongs to the physical page: [ 20.780099] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10784c [ 20.780564] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.780688] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.781011] page_type: f8(unknown) [ 20.781337] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.781415] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.781761] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.781952] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.782074] head: 0bfffe0000000002 ffffc1ffc31e1301 00000000ffffffff 00000000ffffffff [ 20.782357] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.782553] page dumped because: kasan: bad access detected [ 20.782755] [ 20.783000] Memory state around the buggy address: [ 20.783376] fff00000c784bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.783440] fff00000c784bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.783490] >fff00000c784c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.783896] ^ [ 20.784091] fff00000c784c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.784278] fff00000c784c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.784354] ================================================================== [ 20.809806] ================================================================== [ 20.810389] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.810496] Free of addr fff00000c784c000 by task kunit_try_catch/240 [ 20.810545] [ 20.810592] CPU: 0 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.810685] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.810715] Hardware name: linux,dummy-virt (DT) [ 20.811560] Call trace: [ 20.811664] show_stack+0x20/0x38 (C) [ 20.811747] dump_stack_lvl+0x8c/0xd0 [ 20.812205] print_report+0x118/0x608 [ 20.812310] kasan_report_invalid_free+0xc0/0xe8 [ 20.812489] __kasan_mempool_poison_pages+0xe0/0xe8 [ 20.812600] mempool_free+0x24c/0x328 [ 20.812872] mempool_double_free_helper+0x150/0x2e8 [ 20.813044] mempool_page_alloc_double_free+0xbc/0x118 [ 20.813105] kunit_try_run_case+0x170/0x3f0 [ 20.813175] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.813234] kthread+0x328/0x630 [ 20.813279] ret_from_fork+0x10/0x20 [ 20.813341] [ 20.813367] The buggy address belongs to the physical page: [ 20.813441] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10784c [ 20.813508] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.813601] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 20.813677] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 20.813736] page dumped because: kasan: bad access detected [ 20.813771] [ 20.813801] Memory state around the buggy address: [ 20.813851] fff00000c784bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.813901] fff00000c784bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.813951] >fff00000c784c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.814005] ^ [ 20.814039] fff00000c784c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.814097] fff00000c784c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.814189] ================================================================== [ 20.735370] ================================================================== [ 20.735551] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.735946] Free of addr fff00000c76c3100 by task kunit_try_catch/236 [ 20.736151] [ 20.736291] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.736453] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.736484] Hardware name: linux,dummy-virt (DT) [ 20.736768] Call trace: [ 20.737225] show_stack+0x20/0x38 (C) [ 20.737400] dump_stack_lvl+0x8c/0xd0 [ 20.737479] print_report+0x118/0x608 [ 20.737723] kasan_report_invalid_free+0xc0/0xe8 [ 20.738039] check_slab_allocation+0xd4/0x108 [ 20.738600] __kasan_mempool_poison_object+0x78/0x150 [ 20.738784] mempool_free+0x28c/0x328 [ 20.739031] mempool_double_free_helper+0x150/0x2e8 [ 20.739314] mempool_kmalloc_double_free+0xc0/0x118 [ 20.739401] kunit_try_run_case+0x170/0x3f0 [ 20.739460] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.739517] kthread+0x328/0x630 [ 20.739784] ret_from_fork+0x10/0x20 [ 20.740146] [ 20.740171] Allocated by task 236: [ 20.740603] kasan_save_stack+0x3c/0x68 [ 20.740805] kasan_save_track+0x20/0x40 [ 20.741194] kasan_save_alloc_info+0x40/0x58 [ 20.741424] __kasan_mempool_unpoison_object+0x11c/0x180 [ 20.741671] remove_element+0x130/0x1f8 [ 20.741943] mempool_alloc_preallocated+0x58/0xc0 [ 20.742107] mempool_double_free_helper+0x94/0x2e8 [ 20.742254] mempool_kmalloc_double_free+0xc0/0x118 [ 20.742336] kunit_try_run_case+0x170/0x3f0 [ 20.742654] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.742860] kthread+0x328/0x630 [ 20.743111] ret_from_fork+0x10/0x20 [ 20.743577] [ 20.743612] Freed by task 236: [ 20.743649] kasan_save_stack+0x3c/0x68 [ 20.743698] kasan_save_track+0x20/0x40 [ 20.743954] kasan_save_free_info+0x4c/0x78 [ 20.744161] __kasan_mempool_poison_object+0xc0/0x150 [ 20.744427] mempool_free+0x28c/0x328 [ 20.744651] mempool_double_free_helper+0x100/0x2e8 [ 20.744775] mempool_kmalloc_double_free+0xc0/0x118 [ 20.744941] kunit_try_run_case+0x170/0x3f0 [ 20.745041] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.745310] kthread+0x328/0x630 [ 20.745563] ret_from_fork+0x10/0x20 [ 20.746068] [ 20.746101] The buggy address belongs to the object at fff00000c76c3100 [ 20.746101] which belongs to the cache kmalloc-128 of size 128 [ 20.746360] The buggy address is located 0 bytes inside of [ 20.746360] 128-byte region [fff00000c76c3100, fff00000c76c3180) [ 20.746685] [ 20.746775] The buggy address belongs to the physical page: [ 20.747205] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c3 [ 20.747333] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.747406] page_type: f5(slab) [ 20.747618] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.747793] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.748092] page dumped because: kasan: bad access detected [ 20.748391] [ 20.748457] Memory state around the buggy address: [ 20.748970] fff00000c76c3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.749421] fff00000c76c3080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.749493] >fff00000c76c3100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.749750] ^ [ 20.750007] fff00000c76c3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.750242] fff00000c76c3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.750353] ==================================================================
[ 13.239534] ================================================================== [ 13.240139] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.240532] Free of addr ffff888103a80000 by task kunit_try_catch/256 [ 13.240814] [ 13.240908] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.240994] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.241007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.241029] Call Trace: [ 13.241042] <TASK> [ 13.241059] dump_stack_lvl+0x73/0xb0 [ 13.241089] print_report+0xd1/0x650 [ 13.241111] ? __virt_addr_valid+0x1db/0x2d0 [ 13.241135] ? kasan_addr_to_slab+0x11/0xa0 [ 13.241155] ? mempool_double_free_helper+0x184/0x370 [ 13.241178] kasan_report_invalid_free+0x10a/0x130 [ 13.241201] ? mempool_double_free_helper+0x184/0x370 [ 13.241226] ? mempool_double_free_helper+0x184/0x370 [ 13.241249] __kasan_mempool_poison_pages+0x115/0x130 [ 13.241273] mempool_free+0x290/0x380 [ 13.241296] mempool_double_free_helper+0x184/0x370 [ 13.241319] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.241341] ? update_load_avg+0x1be/0x21b0 [ 13.241367] ? finish_task_switch.isra.0+0x153/0x700 [ 13.241405] mempool_page_alloc_double_free+0xe8/0x140 [ 13.241429] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 13.241457] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 13.241475] ? __pfx_mempool_free_pages+0x10/0x10 [ 13.241497] ? __pfx_read_tsc+0x10/0x10 [ 13.241518] ? ktime_get_ts64+0x86/0x230 [ 13.241542] kunit_try_run_case+0x1a5/0x480 [ 13.241566] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.241588] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.241611] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.241634] ? __kthread_parkme+0x82/0x180 [ 13.241655] ? preempt_count_sub+0x50/0x80 [ 13.241677] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.241699] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.241720] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.241742] kthread+0x337/0x6f0 [ 13.241760] ? trace_preempt_on+0x20/0xc0 [ 13.241784] ? __pfx_kthread+0x10/0x10 [ 13.241803] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.241824] ? calculate_sigpending+0x7b/0xa0 [ 13.241846] ? __pfx_kthread+0x10/0x10 [ 13.241867] ret_from_fork+0x116/0x1d0 [ 13.241884] ? __pfx_kthread+0x10/0x10 [ 13.241903] ret_from_fork_asm+0x1a/0x30 [ 13.241944] </TASK> [ 13.241956] [ 13.251308] The buggy address belongs to the physical page: [ 13.251591] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a80 [ 13.251863] flags: 0x200000000000000(node=0|zone=2) [ 13.252046] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 13.252280] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 13.252693] page dumped because: kasan: bad access detected [ 13.252940] [ 13.253102] Memory state around the buggy address: [ 13.253255] ffff888103a7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.253747] ffff888103a7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.254191] >ffff888103a80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.254421] ^ [ 13.254541] ffff888103a80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.255301] ffff888103a80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.255608] ================================================================== [ 13.212186] ================================================================== [ 13.212776] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.213732] Free of addr ffff888103a80000 by task kunit_try_catch/254 [ 13.214185] [ 13.214523] CPU: 1 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.214700] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.214715] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.214738] Call Trace: [ 13.214752] <TASK> [ 13.214771] dump_stack_lvl+0x73/0xb0 [ 13.214805] print_report+0xd1/0x650 [ 13.214828] ? __virt_addr_valid+0x1db/0x2d0 [ 13.214854] ? kasan_addr_to_slab+0x11/0xa0 [ 13.214873] ? mempool_double_free_helper+0x184/0x370 [ 13.214896] kasan_report_invalid_free+0x10a/0x130 [ 13.214972] ? mempool_double_free_helper+0x184/0x370 [ 13.215001] ? mempool_double_free_helper+0x184/0x370 [ 13.215023] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 13.215046] mempool_free+0x2ec/0x380 [ 13.215070] mempool_double_free_helper+0x184/0x370 [ 13.215093] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.215114] ? update_load_avg+0x1be/0x21b0 [ 13.215142] ? finish_task_switch.isra.0+0x153/0x700 [ 13.215167] mempool_kmalloc_large_double_free+0xed/0x140 [ 13.215191] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 13.215234] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.215257] ? __pfx_mempool_kfree+0x10/0x10 [ 13.215293] ? __pfx_read_tsc+0x10/0x10 [ 13.215315] ? ktime_get_ts64+0x86/0x230 [ 13.215339] kunit_try_run_case+0x1a5/0x480 [ 13.215383] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.215404] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.215428] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.215464] ? __kthread_parkme+0x82/0x180 [ 13.215485] ? preempt_count_sub+0x50/0x80 [ 13.215507] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.215542] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.215566] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.215587] kthread+0x337/0x6f0 [ 13.215649] ? trace_preempt_on+0x20/0xc0 [ 13.215683] ? __pfx_kthread+0x10/0x10 [ 13.215703] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.215723] ? calculate_sigpending+0x7b/0xa0 [ 13.215748] ? __pfx_kthread+0x10/0x10 [ 13.215770] ret_from_fork+0x116/0x1d0 [ 13.215790] ? __pfx_kthread+0x10/0x10 [ 13.215810] ret_from_fork_asm+0x1a/0x30 [ 13.215841] </TASK> [ 13.215852] [ 13.229638] The buggy address belongs to the physical page: [ 13.230027] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a80 [ 13.230288] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.230532] flags: 0x200000000000040(head|node=0|zone=2) [ 13.230778] page_type: f8(unknown) [ 13.230982] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.231261] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.231714] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.232282] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.232690] head: 0200000000000002 ffffea00040ea001 00000000ffffffff 00000000ffffffff [ 13.233133] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 13.233428] page dumped because: kasan: bad access detected [ 13.233680] [ 13.233845] Memory state around the buggy address: [ 13.234130] ffff888103a7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.234429] ffff888103a7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.234794] >ffff888103a80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.235145] ^ [ 13.235302] ffff888103a80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.235666] ffff888103a80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.236216] ================================================================== [ 13.167510] ================================================================== [ 13.168348] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.169057] Free of addr ffff88810258da00 by task kunit_try_catch/252 [ 13.169725] [ 13.169934] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.169983] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.170018] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.170111] Call Trace: [ 13.170126] <TASK> [ 13.170144] dump_stack_lvl+0x73/0xb0 [ 13.170174] print_report+0xd1/0x650 [ 13.170197] ? __virt_addr_valid+0x1db/0x2d0 [ 13.170221] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.170242] ? mempool_double_free_helper+0x184/0x370 [ 13.170266] kasan_report_invalid_free+0x10a/0x130 [ 13.170289] ? mempool_double_free_helper+0x184/0x370 [ 13.170315] ? mempool_double_free_helper+0x184/0x370 [ 13.170336] ? mempool_double_free_helper+0x184/0x370 [ 13.170358] check_slab_allocation+0x101/0x130 [ 13.170390] __kasan_mempool_poison_object+0x91/0x1d0 [ 13.170413] mempool_free+0x2ec/0x380 [ 13.170436] mempool_double_free_helper+0x184/0x370 [ 13.170459] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.170483] ? kasan_save_track+0x18/0x40 [ 13.170501] ? kasan_save_alloc_info+0x3b/0x50 [ 13.170524] ? kasan_save_stack+0x45/0x70 [ 13.170547] mempool_kmalloc_double_free+0xed/0x140 [ 13.170569] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 13.170595] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.170617] ? __pfx_mempool_kfree+0x10/0x10 [ 13.170641] ? __pfx_read_tsc+0x10/0x10 [ 13.170661] ? ktime_get_ts64+0x86/0x230 [ 13.170685] kunit_try_run_case+0x1a5/0x480 [ 13.170709] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.170730] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.170753] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.170776] ? __kthread_parkme+0x82/0x180 [ 13.170796] ? preempt_count_sub+0x50/0x80 [ 13.170819] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.170842] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.170865] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.170888] kthread+0x337/0x6f0 [ 13.170906] ? trace_preempt_on+0x20/0xc0 [ 13.170929] ? __pfx_kthread+0x10/0x10 [ 13.170949] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.170969] ? calculate_sigpending+0x7b/0xa0 [ 13.170992] ? __pfx_kthread+0x10/0x10 [ 13.171013] ret_from_fork+0x116/0x1d0 [ 13.171030] ? __pfx_kthread+0x10/0x10 [ 13.171050] ret_from_fork_asm+0x1a/0x30 [ 13.171081] </TASK> [ 13.171093] [ 13.186429] Allocated by task 252: [ 13.187198] kasan_save_stack+0x45/0x70 [ 13.187426] kasan_save_track+0x18/0x40 [ 13.187807] kasan_save_alloc_info+0x3b/0x50 [ 13.188189] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 13.188617] remove_element+0x11e/0x190 [ 13.188986] mempool_alloc_preallocated+0x4d/0x90 [ 13.189366] mempool_double_free_helper+0x8a/0x370 [ 13.189759] mempool_kmalloc_double_free+0xed/0x140 [ 13.190238] kunit_try_run_case+0x1a5/0x480 [ 13.190465] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.190920] kthread+0x337/0x6f0 [ 13.191559] ret_from_fork+0x116/0x1d0 [ 13.191748] ret_from_fork_asm+0x1a/0x30 [ 13.191889] [ 13.192236] Freed by task 252: [ 13.192412] kasan_save_stack+0x45/0x70 [ 13.192901] kasan_save_track+0x18/0x40 [ 13.193138] kasan_save_free_info+0x3f/0x60 [ 13.193299] __kasan_mempool_poison_object+0x131/0x1d0 [ 13.193559] mempool_free+0x2ec/0x380 [ 13.193990] mempool_double_free_helper+0x109/0x370 [ 13.194237] mempool_kmalloc_double_free+0xed/0x140 [ 13.194468] kunit_try_run_case+0x1a5/0x480 [ 13.194673] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.195415] kthread+0x337/0x6f0 [ 13.195754] ret_from_fork+0x116/0x1d0 [ 13.196196] ret_from_fork_asm+0x1a/0x30 [ 13.196418] [ 13.196521] The buggy address belongs to the object at ffff88810258da00 [ 13.196521] which belongs to the cache kmalloc-128 of size 128 [ 13.197394] The buggy address is located 0 bytes inside of [ 13.197394] 128-byte region [ffff88810258da00, ffff88810258da80) [ 13.198282] [ 13.198400] The buggy address belongs to the physical page: [ 13.198830] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10258d [ 13.199365] flags: 0x200000000000000(node=0|zone=2) [ 13.199595] page_type: f5(slab) [ 13.200146] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.200453] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.201370] page dumped because: kasan: bad access detected [ 13.201815] [ 13.201914] Memory state around the buggy address: [ 13.202438] ffff88810258d900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.202867] ffff88810258d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.203499] >ffff88810258da00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.204030] ^ [ 13.204184] ffff88810258da80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.204520] ffff88810258db00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.205158] ==================================================================