Date
July 4, 2025, 11:11 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 20.189304] ================================================================== [ 20.189365] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.189422] Free of addr fff00000c77fc000 by task kunit_try_catch/239 [ 20.189465] [ 20.189498] CPU: 1 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.189694] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.189723] Hardware name: linux,dummy-virt (DT) [ 20.189900] Call trace: [ 20.190009] show_stack+0x20/0x38 (C) [ 20.190113] dump_stack_lvl+0x8c/0xd0 [ 20.190193] print_report+0x118/0x608 [ 20.190239] kasan_report_invalid_free+0xc0/0xe8 [ 20.190289] __kasan_mempool_poison_pages+0xe0/0xe8 [ 20.190356] mempool_free+0x24c/0x328 [ 20.190401] mempool_double_free_helper+0x150/0x2e8 [ 20.190457] mempool_page_alloc_double_free+0xbc/0x118 [ 20.190509] kunit_try_run_case+0x170/0x3f0 [ 20.190557] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.190609] kthread+0x328/0x630 [ 20.190651] ret_from_fork+0x10/0x20 [ 20.190696] [ 20.190718] The buggy address belongs to the physical page: [ 20.190748] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077fc [ 20.190995] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.191138] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 20.191315] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 20.191356] page dumped because: kasan: bad access detected [ 20.191387] [ 20.191404] Memory state around the buggy address: [ 20.191474] fff00000c77fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.191716] fff00000c77fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.191801] >fff00000c77fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.191864] ^ [ 20.191945] fff00000c77fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.191987] fff00000c77fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.192025] ================================================================== [ 20.174941] ================================================================== [ 20.174996] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.175049] Free of addr fff00000c77fc000 by task kunit_try_catch/237 [ 20.175089] [ 20.175240] CPU: 1 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.175322] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.175350] Hardware name: linux,dummy-virt (DT) [ 20.175586] Call trace: [ 20.175612] show_stack+0x20/0x38 (C) [ 20.175799] dump_stack_lvl+0x8c/0xd0 [ 20.176019] print_report+0x118/0x608 [ 20.176105] kasan_report_invalid_free+0xc0/0xe8 [ 20.176158] __kasan_mempool_poison_object+0x14c/0x150 [ 20.176293] mempool_free+0x28c/0x328 [ 20.176426] mempool_double_free_helper+0x150/0x2e8 [ 20.176784] mempool_kmalloc_large_double_free+0xc0/0x118 [ 20.177046] kunit_try_run_case+0x170/0x3f0 [ 20.177288] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.177486] kthread+0x328/0x630 [ 20.177631] ret_from_fork+0x10/0x20 [ 20.177704] [ 20.177727] The buggy address belongs to the physical page: [ 20.177932] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077fc [ 20.178196] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.178381] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.178509] page_type: f8(unknown) [ 20.178933] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.179074] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.179151] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.179199] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.179248] head: 0bfffe0000000002 ffffc1ffc31dff01 00000000ffffffff 00000000ffffffff [ 20.179433] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.179599] page dumped because: kasan: bad access detected [ 20.179663] [ 20.179965] Memory state around the buggy address: [ 20.180344] fff00000c77fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.180410] fff00000c77fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.180483] >fff00000c77fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.180598] ^ [ 20.180676] fff00000c77fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.180736] fff00000c77fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.180775] ================================================================== [ 20.160632] ================================================================== [ 20.160713] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 20.160837] Free of addr fff00000c76c4900 by task kunit_try_catch/235 [ 20.160902] [ 20.160940] CPU: 1 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 20.161020] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.161071] Hardware name: linux,dummy-virt (DT) [ 20.161242] Call trace: [ 20.161300] show_stack+0x20/0x38 (C) [ 20.161624] dump_stack_lvl+0x8c/0xd0 [ 20.161719] print_report+0x118/0x608 [ 20.161831] kasan_report_invalid_free+0xc0/0xe8 [ 20.161911] check_slab_allocation+0xd4/0x108 [ 20.161977] __kasan_mempool_poison_object+0x78/0x150 [ 20.162030] mempool_free+0x28c/0x328 [ 20.162095] mempool_double_free_helper+0x150/0x2e8 [ 20.162175] mempool_kmalloc_double_free+0xc0/0x118 [ 20.162242] kunit_try_run_case+0x170/0x3f0 [ 20.162323] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.162377] kthread+0x328/0x630 [ 20.162522] ret_from_fork+0x10/0x20 [ 20.162570] [ 20.162614] Allocated by task 235: [ 20.162788] kasan_save_stack+0x3c/0x68 [ 20.162911] kasan_save_track+0x20/0x40 [ 20.162989] kasan_save_alloc_info+0x40/0x58 [ 20.163127] __kasan_mempool_unpoison_object+0x11c/0x180 [ 20.163255] remove_element+0x130/0x1f8 [ 20.163438] mempool_alloc_preallocated+0x58/0xc0 [ 20.163566] mempool_double_free_helper+0x94/0x2e8 [ 20.163605] mempool_kmalloc_double_free+0xc0/0x118 [ 20.163646] kunit_try_run_case+0x170/0x3f0 [ 20.163844] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.163885] kthread+0x328/0x630 [ 20.163920] ret_from_fork+0x10/0x20 [ 20.163964] [ 20.163983] Freed by task 235: [ 20.164011] kasan_save_stack+0x3c/0x68 [ 20.164323] kasan_save_track+0x20/0x40 [ 20.164604] kasan_save_free_info+0x4c/0x78 [ 20.164647] __kasan_mempool_poison_object+0xc0/0x150 [ 20.164690] mempool_free+0x28c/0x328 [ 20.164725] mempool_double_free_helper+0x100/0x2e8 [ 20.164765] mempool_kmalloc_double_free+0xc0/0x118 [ 20.164817] kunit_try_run_case+0x170/0x3f0 [ 20.165132] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.165262] kthread+0x328/0x630 [ 20.165435] ret_from_fork+0x10/0x20 [ 20.165610] [ 20.165767] The buggy address belongs to the object at fff00000c76c4900 [ 20.165767] which belongs to the cache kmalloc-128 of size 128 [ 20.165927] The buggy address is located 0 bytes inside of [ 20.165927] 128-byte region [fff00000c76c4900, fff00000c76c4980) [ 20.165986] [ 20.166005] The buggy address belongs to the physical page: [ 20.166048] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1076c4 [ 20.166278] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.166351] page_type: f5(slab) [ 20.166461] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.166799] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.166993] page dumped because: kasan: bad access detected [ 20.167121] [ 20.167201] Memory state around the buggy address: [ 20.167351] fff00000c76c4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.167396] fff00000c76c4880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.167439] >fff00000c76c4900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.167478] ^ [ 20.167506] fff00000c76c4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.167547] fff00000c76c4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.167585] ==================================================================
[ 13.673854] ================================================================== [ 13.674813] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.675179] Free of addr ffff888103a3c000 by task kunit_try_catch/254 [ 13.675400] [ 13.675517] CPU: 1 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.675567] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.675580] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.675603] Call Trace: [ 13.675619] <TASK> [ 13.675638] dump_stack_lvl+0x73/0xb0 [ 13.675753] print_report+0xd1/0x650 [ 13.675777] ? __virt_addr_valid+0x1db/0x2d0 [ 13.675801] ? kasan_addr_to_slab+0x11/0xa0 [ 13.675820] ? mempool_double_free_helper+0x184/0x370 [ 13.675843] kasan_report_invalid_free+0x10a/0x130 [ 13.675866] ? mempool_double_free_helper+0x184/0x370 [ 13.675892] ? mempool_double_free_helper+0x184/0x370 [ 13.675914] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 13.675938] mempool_free+0x2ec/0x380 [ 13.675961] mempool_double_free_helper+0x184/0x370 [ 13.675983] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.676008] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.676030] ? finish_task_switch.isra.0+0x153/0x700 [ 13.676055] mempool_kmalloc_large_double_free+0xed/0x140 [ 13.676078] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 13.676105] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.676128] ? __pfx_mempool_kfree+0x10/0x10 [ 13.676154] ? __pfx_read_tsc+0x10/0x10 [ 13.676175] ? ktime_get_ts64+0x86/0x230 [ 13.676198] kunit_try_run_case+0x1a5/0x480 [ 13.676235] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.676256] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.676279] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.676302] ? __kthread_parkme+0x82/0x180 [ 13.676322] ? preempt_count_sub+0x50/0x80 [ 13.676343] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.676366] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.676387] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.676409] kthread+0x337/0x6f0 [ 13.676426] ? trace_preempt_on+0x20/0xc0 [ 13.676448] ? __pfx_kthread+0x10/0x10 [ 13.676469] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.676488] ? calculate_sigpending+0x7b/0xa0 [ 13.676511] ? __pfx_kthread+0x10/0x10 [ 13.676531] ret_from_fork+0x116/0x1d0 [ 13.676549] ? __pfx_kthread+0x10/0x10 [ 13.676568] ret_from_fork_asm+0x1a/0x30 [ 13.676599] </TASK> [ 13.676609] [ 13.686602] The buggy address belongs to the physical page: [ 13.686883] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a3c [ 13.687147] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.688582] flags: 0x200000000000040(head|node=0|zone=2) [ 13.688886] page_type: f8(unknown) [ 13.689067] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.689621] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.689962] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.690572] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.690923] head: 0200000000000002 ffffea00040e8f01 00000000ffffffff 00000000ffffffff [ 13.691638] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 13.691975] page dumped because: kasan: bad access detected [ 13.692268] [ 13.692471] Memory state around the buggy address: [ 13.692719] ffff888103a3bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.693051] ffff888103a3bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.693523] >ffff888103a3c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.693883] ^ [ 13.694091] ffff888103a3c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.694549] ffff888103a3c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.694883] ================================================================== [ 13.699074] ================================================================== [ 13.699768] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.700138] Free of addr ffff888103a3c000 by task kunit_try_catch/256 [ 13.700935] [ 13.701063] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.701116] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.701129] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.701154] Call Trace: [ 13.701172] <TASK> [ 13.701193] dump_stack_lvl+0x73/0xb0 [ 13.701242] print_report+0xd1/0x650 [ 13.701266] ? __virt_addr_valid+0x1db/0x2d0 [ 13.701289] ? kasan_addr_to_slab+0x11/0xa0 [ 13.701308] ? mempool_double_free_helper+0x184/0x370 [ 13.701333] kasan_report_invalid_free+0x10a/0x130 [ 13.701356] ? mempool_double_free_helper+0x184/0x370 [ 13.701381] ? mempool_double_free_helper+0x184/0x370 [ 13.701403] __kasan_mempool_poison_pages+0x115/0x130 [ 13.701511] mempool_free+0x290/0x380 [ 13.701538] mempool_double_free_helper+0x184/0x370 [ 13.701561] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.701588] ? finish_task_switch.isra.0+0x153/0x700 [ 13.701614] mempool_page_alloc_double_free+0xe8/0x140 [ 13.701638] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 13.701665] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 13.701684] ? __pfx_mempool_free_pages+0x10/0x10 [ 13.701706] ? __pfx_read_tsc+0x10/0x10 [ 13.701727] ? ktime_get_ts64+0x86/0x230 [ 13.701751] kunit_try_run_case+0x1a5/0x480 [ 13.701775] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.701796] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.701820] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.701841] ? __kthread_parkme+0x82/0x180 [ 13.701861] ? preempt_count_sub+0x50/0x80 [ 13.701883] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.701906] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.701928] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.701950] kthread+0x337/0x6f0 [ 13.701968] ? trace_preempt_on+0x20/0xc0 [ 13.701990] ? __pfx_kthread+0x10/0x10 [ 13.702009] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.702028] ? calculate_sigpending+0x7b/0xa0 [ 13.702051] ? __pfx_kthread+0x10/0x10 [ 13.702072] ret_from_fork+0x116/0x1d0 [ 13.702090] ? __pfx_kthread+0x10/0x10 [ 13.702109] ret_from_fork_asm+0x1a/0x30 [ 13.702138] </TASK> [ 13.702150] [ 13.710677] The buggy address belongs to the physical page: [ 13.710975] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a3c [ 13.711781] flags: 0x200000000000000(node=0|zone=2) [ 13.712014] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 13.712473] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 13.712745] page dumped because: kasan: bad access detected [ 13.712933] [ 13.713006] Memory state around the buggy address: [ 13.713331] ffff888103a3bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.713624] ffff888103a3bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.713939] >ffff888103a3c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.714287] ^ [ 13.714435] ffff888103a3c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.714759] ffff888103a3c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.715079] ================================================================== [ 13.639750] ================================================================== [ 13.640247] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.640900] Free of addr ffff888103980b00 by task kunit_try_catch/252 [ 13.641211] [ 13.641531] CPU: 1 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.641586] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.641681] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.641708] Call Trace: [ 13.641723] <TASK> [ 13.641744] dump_stack_lvl+0x73/0xb0 [ 13.641781] print_report+0xd1/0x650 [ 13.641804] ? __virt_addr_valid+0x1db/0x2d0 [ 13.641831] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.641852] ? mempool_double_free_helper+0x184/0x370 [ 13.641876] kasan_report_invalid_free+0x10a/0x130 [ 13.641900] ? mempool_double_free_helper+0x184/0x370 [ 13.641924] ? mempool_double_free_helper+0x184/0x370 [ 13.641948] ? mempool_double_free_helper+0x184/0x370 [ 13.641969] check_slab_allocation+0x101/0x130 [ 13.641990] __kasan_mempool_poison_object+0x91/0x1d0 [ 13.642013] mempool_free+0x2ec/0x380 [ 13.642037] mempool_double_free_helper+0x184/0x370 [ 13.642060] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.642082] ? update_load_avg+0x1be/0x21b0 [ 13.642105] ? update_load_avg+0x1be/0x21b0 [ 13.642719] ? update_curr+0x80/0x810 [ 13.642751] ? finish_task_switch.isra.0+0x153/0x700 [ 13.642778] mempool_kmalloc_double_free+0xed/0x140 [ 13.642802] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 13.642828] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.642853] ? __pfx_mempool_kfree+0x10/0x10 [ 13.642880] ? __pfx_read_tsc+0x10/0x10 [ 13.642902] ? ktime_get_ts64+0x86/0x230 [ 13.642926] kunit_try_run_case+0x1a5/0x480 [ 13.642952] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.642974] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.642999] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.643021] ? __kthread_parkme+0x82/0x180 [ 13.643042] ? preempt_count_sub+0x50/0x80 [ 13.643064] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.643087] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.643109] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.643131] kthread+0x337/0x6f0 [ 13.643150] ? trace_preempt_on+0x20/0xc0 [ 13.643173] ? __pfx_kthread+0x10/0x10 [ 13.643193] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.643244] ? calculate_sigpending+0x7b/0xa0 [ 13.643269] ? __pfx_kthread+0x10/0x10 [ 13.643289] ret_from_fork+0x116/0x1d0 [ 13.643308] ? __pfx_kthread+0x10/0x10 [ 13.643327] ret_from_fork_asm+0x1a/0x30 [ 13.643359] </TASK> [ 13.643371] [ 13.656718] Allocated by task 252: [ 13.656938] kasan_save_stack+0x45/0x70 [ 13.657155] kasan_save_track+0x18/0x40 [ 13.658073] kasan_save_alloc_info+0x3b/0x50 [ 13.658474] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 13.658751] remove_element+0x11e/0x190 [ 13.659025] mempool_alloc_preallocated+0x4d/0x90 [ 13.659206] mempool_double_free_helper+0x8a/0x370 [ 13.659647] mempool_kmalloc_double_free+0xed/0x140 [ 13.659963] kunit_try_run_case+0x1a5/0x480 [ 13.660127] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.660536] kthread+0x337/0x6f0 [ 13.660847] ret_from_fork+0x116/0x1d0 [ 13.660999] ret_from_fork_asm+0x1a/0x30 [ 13.661202] [ 13.661543] Freed by task 252: [ 13.661722] kasan_save_stack+0x45/0x70 [ 13.661880] kasan_save_track+0x18/0x40 [ 13.662053] kasan_save_free_info+0x3f/0x60 [ 13.662280] __kasan_mempool_poison_object+0x131/0x1d0 [ 13.662862] mempool_free+0x2ec/0x380 [ 13.663006] mempool_double_free_helper+0x109/0x370 [ 13.663257] mempool_kmalloc_double_free+0xed/0x140 [ 13.663625] kunit_try_run_case+0x1a5/0x480 [ 13.663922] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.664113] kthread+0x337/0x6f0 [ 13.664283] ret_from_fork+0x116/0x1d0 [ 13.664490] ret_from_fork_asm+0x1a/0x30 [ 13.664680] [ 13.664754] The buggy address belongs to the object at ffff888103980b00 [ 13.664754] which belongs to the cache kmalloc-128 of size 128 [ 13.665288] The buggy address is located 0 bytes inside of [ 13.665288] 128-byte region [ffff888103980b00, ffff888103980b80) [ 13.665771] [ 13.665870] The buggy address belongs to the physical page: [ 13.666121] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103980 [ 13.666483] flags: 0x200000000000000(node=0|zone=2) [ 13.666712] page_type: f5(slab) [ 13.666893] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.667208] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.667446] page dumped because: kasan: bad access detected [ 13.667762] [ 13.667948] Memory state around the buggy address: [ 13.668179] ffff888103980a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.668471] ffff888103980a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.668698] >ffff888103980b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.669140] ^ [ 13.669336] ffff888103980b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.669659] ffff888103980c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.669944] ==================================================================