Date
July 10, 2025, 11:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.065161] ================================================================== [ 18.065264] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 18.065350] Free of addr fff00000c6454000 by task kunit_try_catch/235 [ 18.065394] [ 18.065432] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.065514] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.065651] Hardware name: linux,dummy-virt (DT) [ 18.065686] Call trace: [ 18.065711] show_stack+0x20/0x38 (C) [ 18.066156] dump_stack_lvl+0x8c/0xd0 [ 18.066262] print_report+0x118/0x608 [ 18.066414] kasan_report_invalid_free+0xc0/0xe8 [ 18.066505] check_slab_allocation+0xd4/0x108 [ 18.066711] __kasan_mempool_poison_object+0x78/0x150 [ 18.066923] mempool_free+0x28c/0x328 [ 18.067115] mempool_double_free_helper+0x150/0x2e8 [ 18.067261] mempool_kmalloc_double_free+0xc0/0x118 [ 18.067351] kunit_try_run_case+0x170/0x3f0 [ 18.067442] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.067599] kthread+0x328/0x630 [ 18.067687] ret_from_fork+0x10/0x20 [ 18.068067] [ 18.068181] Allocated by task 235: [ 18.068217] kasan_save_stack+0x3c/0x68 [ 18.068386] kasan_save_track+0x20/0x40 [ 18.068677] kasan_save_alloc_info+0x40/0x58 [ 18.068794] __kasan_mempool_unpoison_object+0x11c/0x180 [ 18.068874] remove_element+0x130/0x1f8 [ 18.069022] mempool_alloc_preallocated+0x58/0xc0 [ 18.069102] mempool_double_free_helper+0x94/0x2e8 [ 18.069469] mempool_kmalloc_double_free+0xc0/0x118 [ 18.069646] kunit_try_run_case+0x170/0x3f0 [ 18.069718] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.069857] kthread+0x328/0x630 [ 18.069896] ret_from_fork+0x10/0x20 [ 18.069934] [ 18.070114] Freed by task 235: [ 18.070166] kasan_save_stack+0x3c/0x68 [ 18.070357] kasan_save_track+0x20/0x40 [ 18.070518] kasan_save_free_info+0x4c/0x78 [ 18.070608] __kasan_mempool_poison_object+0xc0/0x150 [ 18.070760] mempool_free+0x28c/0x328 [ 18.070838] mempool_double_free_helper+0x100/0x2e8 [ 18.070909] mempool_kmalloc_double_free+0xc0/0x118 [ 18.070949] kunit_try_run_case+0x170/0x3f0 [ 18.071361] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.071994] kthread+0x328/0x630 [ 18.072315] ret_from_fork+0x10/0x20 [ 18.072383] [ 18.072403] The buggy address belongs to the object at fff00000c6454000 [ 18.072403] which belongs to the cache kmalloc-128 of size 128 [ 18.072467] The buggy address is located 0 bytes inside of [ 18.072467] 128-byte region [fff00000c6454000, fff00000c6454080) [ 18.072556] [ 18.072579] The buggy address belongs to the physical page: [ 18.072612] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106454 [ 18.072675] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.072738] page_type: f5(slab) [ 18.072787] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.072854] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.072905] page dumped because: kasan: bad access detected [ 18.072951] [ 18.072977] Memory state around the buggy address: [ 18.073010] fff00000c6453f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 18.073055] fff00000c6453f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.073111] >fff00000c6454000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.073148] ^ [ 18.073185] fff00000c6454080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.073236] fff00000c6454100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.073276] ================================================================== [ 18.106671] ================================================================== [ 18.106734] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 18.106883] Free of addr fff00000c78a4000 by task kunit_try_catch/239 [ 18.106928] [ 18.106979] CPU: 0 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.107070] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.107106] Hardware name: linux,dummy-virt (DT) [ 18.107137] Call trace: [ 18.107159] show_stack+0x20/0x38 (C) [ 18.107327] dump_stack_lvl+0x8c/0xd0 [ 18.107394] print_report+0x118/0x608 [ 18.107444] kasan_report_invalid_free+0xc0/0xe8 [ 18.107496] __kasan_mempool_poison_pages+0xe0/0xe8 [ 18.107550] mempool_free+0x24c/0x328 [ 18.107596] mempool_double_free_helper+0x150/0x2e8 [ 18.107646] mempool_page_alloc_double_free+0xbc/0x118 [ 18.107699] kunit_try_run_case+0x170/0x3f0 [ 18.107763] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.107818] kthread+0x328/0x630 [ 18.107861] ret_from_fork+0x10/0x20 [ 18.107915] [ 18.107935] The buggy address belongs to the physical page: [ 18.107969] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078a4 [ 18.108028] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.108133] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 18.108185] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 18.108226] page dumped because: kasan: bad access detected [ 18.108255] [ 18.108273] Memory state around the buggy address: [ 18.108313] fff00000c78a3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.108365] fff00000c78a3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.108408] >fff00000c78a4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.108445] ^ [ 18.108471] fff00000c78a4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.108513] fff00000c78a4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.108550] ================================================================== [ 18.088400] ================================================================== [ 18.088532] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 18.088604] Free of addr fff00000c780c000 by task kunit_try_catch/237 [ 18.088652] [ 18.088944] CPU: 0 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.089049] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.089256] Hardware name: linux,dummy-virt (DT) [ 18.089333] Call trace: [ 18.089359] show_stack+0x20/0x38 (C) [ 18.089508] dump_stack_lvl+0x8c/0xd0 [ 18.089564] print_report+0x118/0x608 [ 18.089624] kasan_report_invalid_free+0xc0/0xe8 [ 18.089716] __kasan_mempool_poison_object+0x14c/0x150 [ 18.090204] mempool_free+0x28c/0x328 [ 18.090281] mempool_double_free_helper+0x150/0x2e8 [ 18.090336] mempool_kmalloc_large_double_free+0xc0/0x118 [ 18.090391] kunit_try_run_case+0x170/0x3f0 [ 18.090744] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.090983] kthread+0x328/0x630 [ 18.091830] ret_from_fork+0x10/0x20 [ 18.092480] [ 18.092516] The buggy address belongs to the physical page: [ 18.092579] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10780c [ 18.092696] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.092745] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.093119] page_type: f8(unknown) [ 18.093195] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.093404] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.093558] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.093667] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.093741] head: 0bfffe0000000002 ffffc1ffc31e0301 00000000ffffffff 00000000ffffffff [ 18.094205] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.094294] page dumped because: kasan: bad access detected [ 18.094429] [ 18.094467] Memory state around the buggy address: [ 18.094501] fff00000c780bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.094572] fff00000c780bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.094774] >fff00000c780c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.094820] ^ [ 18.095177] fff00000c780c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.095364] fff00000c780c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.095432] ==================================================================
[ 14.385226] ================================================================== [ 14.385845] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.386590] Free of addr ffff8881039f4000 by task kunit_try_catch/257 [ 14.387230] [ 14.387373] CPU: 0 UID: 0 PID: 257 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.387418] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.387430] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.387452] Call Trace: [ 14.387464] <TASK> [ 14.387480] dump_stack_lvl+0x73/0xb0 [ 14.387632] print_report+0xd1/0x650 [ 14.387654] ? __virt_addr_valid+0x1db/0x2d0 [ 14.387679] ? kasan_addr_to_slab+0x11/0xa0 [ 14.387699] ? mempool_double_free_helper+0x184/0x370 [ 14.387723] kasan_report_invalid_free+0x10a/0x130 [ 14.387749] ? mempool_double_free_helper+0x184/0x370 [ 14.387776] ? mempool_double_free_helper+0x184/0x370 [ 14.387802] __kasan_mempool_poison_pages+0x115/0x130 [ 14.387828] mempool_free+0x290/0x380 [ 14.387855] mempool_double_free_helper+0x184/0x370 [ 14.387879] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.387905] ? __kasan_check_write+0x18/0x20 [ 14.387927] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.387950] ? finish_task_switch.isra.0+0x153/0x700 [ 14.387976] mempool_page_alloc_double_free+0xe8/0x140 [ 14.388002] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 14.388031] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 14.388056] ? __pfx_mempool_free_pages+0x10/0x10 [ 14.388082] ? __pfx_read_tsc+0x10/0x10 [ 14.388103] ? ktime_get_ts64+0x86/0x230 [ 14.388128] kunit_try_run_case+0x1a5/0x480 [ 14.388154] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.388184] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.388208] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.388232] ? __kthread_parkme+0x82/0x180 [ 14.388252] ? preempt_count_sub+0x50/0x80 [ 14.388274] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.388299] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.388323] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.388348] kthread+0x337/0x6f0 [ 14.388385] ? trace_preempt_on+0x20/0xc0 [ 14.388408] ? __pfx_kthread+0x10/0x10 [ 14.388453] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.388474] ? calculate_sigpending+0x7b/0xa0 [ 14.388498] ? __pfx_kthread+0x10/0x10 [ 14.388519] ret_from_fork+0x116/0x1d0 [ 14.388537] ? __pfx_kthread+0x10/0x10 [ 14.388557] ret_from_fork_asm+0x1a/0x30 [ 14.388590] </TASK> [ 14.388600] [ 14.401164] The buggy address belongs to the physical page: [ 14.401370] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039f4 [ 14.401788] flags: 0x200000000000000(node=0|zone=2) [ 14.402122] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 14.402439] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 14.402898] page dumped because: kasan: bad access detected [ 14.403142] [ 14.403233] Memory state around the buggy address: [ 14.403425] ffff8881039f3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.403699] ffff8881039f3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.403985] >ffff8881039f4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.404513] ^ [ 14.404661] ffff8881039f4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.404922] ffff8881039f4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.405149] ================================================================== [ 14.357090] ================================================================== [ 14.357866] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.358349] Free of addr ffff8881039f4000 by task kunit_try_catch/255 [ 14.359164] [ 14.359500] CPU: 0 UID: 0 PID: 255 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.359547] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.359560] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.359580] Call Trace: [ 14.359591] <TASK> [ 14.359606] dump_stack_lvl+0x73/0xb0 [ 14.359637] print_report+0xd1/0x650 [ 14.359659] ? __virt_addr_valid+0x1db/0x2d0 [ 14.359683] ? kasan_addr_to_slab+0x11/0xa0 [ 14.359703] ? mempool_double_free_helper+0x184/0x370 [ 14.359728] kasan_report_invalid_free+0x10a/0x130 [ 14.359754] ? mempool_double_free_helper+0x184/0x370 [ 14.359781] ? mempool_double_free_helper+0x184/0x370 [ 14.359804] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 14.359830] mempool_free+0x2ec/0x380 [ 14.359858] mempool_double_free_helper+0x184/0x370 [ 14.359883] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.359909] ? update_load_avg+0x1be/0x21b0 [ 14.359936] ? finish_task_switch.isra.0+0x153/0x700 [ 14.359962] mempool_kmalloc_large_double_free+0xed/0x140 [ 14.359988] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 14.360017] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.360040] ? __pfx_mempool_kfree+0x10/0x10 [ 14.360065] ? __pfx_read_tsc+0x10/0x10 [ 14.360087] ? ktime_get_ts64+0x86/0x230 [ 14.360111] kunit_try_run_case+0x1a5/0x480 [ 14.360135] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.360158] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.360187] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.360211] ? __kthread_parkme+0x82/0x180 [ 14.360232] ? preempt_count_sub+0x50/0x80 [ 14.360255] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.360280] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.360304] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.360329] kthread+0x337/0x6f0 [ 14.360397] ? trace_preempt_on+0x20/0xc0 [ 14.360425] ? __pfx_kthread+0x10/0x10 [ 14.360447] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.360468] ? calculate_sigpending+0x7b/0xa0 [ 14.360491] ? __pfx_kthread+0x10/0x10 [ 14.360513] ret_from_fork+0x116/0x1d0 [ 14.360532] ? __pfx_kthread+0x10/0x10 [ 14.360552] ret_from_fork_asm+0x1a/0x30 [ 14.360583] </TASK> [ 14.360593] [ 14.373303] The buggy address belongs to the physical page: [ 14.373747] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039f4 [ 14.374322] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.374895] flags: 0x200000000000040(head|node=0|zone=2) [ 14.375225] page_type: f8(unknown) [ 14.375424] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.375966] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.376441] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.376882] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.377277] head: 0200000000000002 ffffea00040e7d01 00000000ffffffff 00000000ffffffff [ 14.377787] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.378122] page dumped because: kasan: bad access detected [ 14.378698] [ 14.378801] Memory state around the buggy address: [ 14.378990] ffff8881039f3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.379542] ffff8881039f3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.379957] >ffff8881039f4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.380336] ^ [ 14.380773] ffff8881039f4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.381165] ffff8881039f4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.381585] ================================================================== [ 14.327213] ================================================================== [ 14.328456] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.328820] Free of addr ffff888102d5ff00 by task kunit_try_catch/253 [ 14.329076] [ 14.329183] CPU: 1 UID: 0 PID: 253 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.329225] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.329237] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.329256] Call Trace: [ 14.329268] <TASK> [ 14.329283] dump_stack_lvl+0x73/0xb0 [ 14.329310] print_report+0xd1/0x650 [ 14.329332] ? __virt_addr_valid+0x1db/0x2d0 [ 14.329368] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.329392] ? mempool_double_free_helper+0x184/0x370 [ 14.329416] kasan_report_invalid_free+0x10a/0x130 [ 14.329441] ? mempool_double_free_helper+0x184/0x370 [ 14.329480] ? mempool_double_free_helper+0x184/0x370 [ 14.329503] ? mempool_double_free_helper+0x184/0x370 [ 14.329526] check_slab_allocation+0x101/0x130 [ 14.329548] __kasan_mempool_poison_object+0x91/0x1d0 [ 14.329573] mempool_free+0x2ec/0x380 [ 14.329599] mempool_double_free_helper+0x184/0x370 [ 14.329624] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.329647] ? update_load_avg+0x1be/0x21b0 [ 14.329673] ? finish_task_switch.isra.0+0x153/0x700 [ 14.329698] mempool_kmalloc_double_free+0xed/0x140 [ 14.329722] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 14.329750] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.329773] ? __pfx_mempool_kfree+0x10/0x10 [ 14.329797] ? __pfx_read_tsc+0x10/0x10 [ 14.329818] ? ktime_get_ts64+0x86/0x230 [ 14.329842] kunit_try_run_case+0x1a5/0x480 [ 14.329866] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.329890] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.329914] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.329938] ? __kthread_parkme+0x82/0x180 [ 14.329961] ? preempt_count_sub+0x50/0x80 [ 14.329985] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.330010] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.330034] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.330059] kthread+0x337/0x6f0 [ 14.330078] ? trace_preempt_on+0x20/0xc0 [ 14.330100] ? __pfx_kthread+0x10/0x10 [ 14.330121] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.330143] ? calculate_sigpending+0x7b/0xa0 [ 14.330168] ? __pfx_kthread+0x10/0x10 [ 14.330189] ret_from_fork+0x116/0x1d0 [ 14.330208] ? __pfx_kthread+0x10/0x10 [ 14.330229] ret_from_fork_asm+0x1a/0x30 [ 14.330260] </TASK> [ 14.330270] [ 14.339209] Allocated by task 253: [ 14.339423] kasan_save_stack+0x45/0x70 [ 14.339654] kasan_save_track+0x18/0x40 [ 14.339851] kasan_save_alloc_info+0x3b/0x50 [ 14.340090] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 14.340348] remove_element+0x11e/0x190 [ 14.340553] mempool_alloc_preallocated+0x4d/0x90 [ 14.340715] mempool_double_free_helper+0x8a/0x370 [ 14.340869] mempool_kmalloc_double_free+0xed/0x140 [ 14.341101] kunit_try_run_case+0x1a5/0x480 [ 14.341526] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.341846] kthread+0x337/0x6f0 [ 14.342017] ret_from_fork+0x116/0x1d0 [ 14.342257] ret_from_fork_asm+0x1a/0x30 [ 14.342700] [ 14.342828] Freed by task 253: [ 14.342959] kasan_save_stack+0x45/0x70 [ 14.343190] kasan_save_track+0x18/0x40 [ 14.343325] kasan_save_free_info+0x3f/0x60 [ 14.343677] __kasan_mempool_poison_object+0x131/0x1d0 [ 14.343928] mempool_free+0x2ec/0x380 [ 14.344110] mempool_double_free_helper+0x109/0x370 [ 14.344285] mempool_kmalloc_double_free+0xed/0x140 [ 14.344661] kunit_try_run_case+0x1a5/0x480 [ 14.344880] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.345221] kthread+0x337/0x6f0 [ 14.345550] ret_from_fork+0x116/0x1d0 [ 14.345742] ret_from_fork_asm+0x1a/0x30 [ 14.345919] [ 14.345991] The buggy address belongs to the object at ffff888102d5ff00 [ 14.345991] which belongs to the cache kmalloc-128 of size 128 [ 14.346460] The buggy address is located 0 bytes inside of [ 14.346460] 128-byte region [ffff888102d5ff00, ffff888102d5ff80) [ 14.346943] [ 14.347038] The buggy address belongs to the physical page: [ 14.347269] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102d5f [ 14.347849] flags: 0x200000000000000(node=0|zone=2) [ 14.348095] page_type: f5(slab) [ 14.348273] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.348754] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 14.349043] page dumped because: kasan: bad access detected [ 14.349217] [ 14.349311] Memory state around the buggy address: [ 14.349678] ffff888102d5fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.350048] ffff888102d5fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.350493] >ffff888102d5ff00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.350763] ^ [ 14.350927] ffff888102d5ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.351608] ffff888102d60000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.351911] ==================================================================