Date
July 10, 2025, 11:10 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.121783] ================================================================== [ 18.121948] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 18.122122] Free of addr fff00000c6454401 by task kunit_try_catch/241 [ 18.122221] [ 18.122257] CPU: 0 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.122675] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.122768] Hardware name: linux,dummy-virt (DT) [ 18.122873] Call trace: [ 18.122898] show_stack+0x20/0x38 (C) [ 18.122993] dump_stack_lvl+0x8c/0xd0 [ 18.123894] print_report+0x118/0x608 [ 18.124549] kasan_report_invalid_free+0xc0/0xe8 [ 18.124610] check_slab_allocation+0xfc/0x108 [ 18.125018] __kasan_mempool_poison_object+0x78/0x150 [ 18.125161] mempool_free+0x28c/0x328 [ 18.125242] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 18.125471] mempool_kmalloc_invalid_free+0xc0/0x118 [ 18.125647] kunit_try_run_case+0x170/0x3f0 [ 18.126143] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.126290] kthread+0x328/0x630 [ 18.126444] ret_from_fork+0x10/0x20 [ 18.126522] [ 18.126542] Allocated by task 241: [ 18.126599] kasan_save_stack+0x3c/0x68 [ 18.126964] kasan_save_track+0x20/0x40 [ 18.127200] kasan_save_alloc_info+0x40/0x58 [ 18.127407] __kasan_mempool_unpoison_object+0x11c/0x180 [ 18.127527] remove_element+0x130/0x1f8 [ 18.127590] mempool_alloc_preallocated+0x58/0xc0 [ 18.127684] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 18.127942] mempool_kmalloc_invalid_free+0xc0/0x118 [ 18.128209] kunit_try_run_case+0x170/0x3f0 [ 18.128388] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.128486] kthread+0x328/0x630 [ 18.128616] ret_from_fork+0x10/0x20 [ 18.128714] [ 18.129093] The buggy address belongs to the object at fff00000c6454400 [ 18.129093] which belongs to the cache kmalloc-128 of size 128 [ 18.129319] The buggy address is located 1 bytes inside of [ 18.129319] 128-byte region [fff00000c6454400, fff00000c6454480) [ 18.129424] [ 18.129707] The buggy address belongs to the physical page: [ 18.129851] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106454 [ 18.129956] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.130046] page_type: f5(slab) [ 18.130211] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.130288] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.130477] page dumped because: kasan: bad access detected [ 18.130881] [ 18.130903] Memory state around the buggy address: [ 18.130940] fff00000c6454300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.131015] fff00000c6454380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.131279] >fff00000c6454400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.131525] ^ [ 18.131673] fff00000c6454480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.131887] fff00000c6454500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.131973] ================================================================== [ 18.143798] ================================================================== [ 18.143881] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 18.144394] Free of addr fff00000c78a4001 by task kunit_try_catch/243 [ 18.144740] [ 18.144811] CPU: 0 UID: 0 PID: 243 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 18.144899] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.144927] Hardware name: linux,dummy-virt (DT) [ 18.144969] Call trace: [ 18.144996] show_stack+0x20/0x38 (C) [ 18.145181] dump_stack_lvl+0x8c/0xd0 [ 18.145413] print_report+0x118/0x608 [ 18.145477] kasan_report_invalid_free+0xc0/0xe8 [ 18.145529] __kasan_mempool_poison_object+0xfc/0x150 [ 18.145583] mempool_free+0x28c/0x328 [ 18.145629] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 18.146240] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 18.146389] kunit_try_run_case+0x170/0x3f0 [ 18.146462] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.146519] kthread+0x328/0x630 [ 18.146562] ret_from_fork+0x10/0x20 [ 18.146747] [ 18.146960] The buggy address belongs to the physical page: [ 18.147022] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078a4 [ 18.147371] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 18.147497] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 18.147601] page_type: f8(unknown) [ 18.147707] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.147786] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.147911] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 18.147996] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 18.148144] head: 0bfffe0000000002 ffffc1ffc31e2901 00000000ffffffff 00000000ffffffff [ 18.148367] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 18.148685] page dumped because: kasan: bad access detected [ 18.148763] [ 18.148844] Memory state around the buggy address: [ 18.148883] fff00000c78a3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.149153] fff00000c78a3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 18.149317] >fff00000c78a4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.149434] ^ [ 18.149490] fff00000c78a4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.149558] fff00000c78a4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 18.149723] ==================================================================
[ 14.410434] ================================================================== [ 14.411728] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412005] Free of addr ffff8881027a3d01 by task kunit_try_catch/259 [ 14.412217] [ 14.412302] CPU: 0 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.412344] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.412386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.412406] Call Trace: [ 14.412418] <TASK> [ 14.412432] dump_stack_lvl+0x73/0xb0 [ 14.412460] print_report+0xd1/0x650 [ 14.412483] ? __virt_addr_valid+0x1db/0x2d0 [ 14.412508] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.412531] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412558] kasan_report_invalid_free+0x10a/0x130 [ 14.412583] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412611] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412648] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412674] check_slab_allocation+0x11f/0x130 [ 14.412696] __kasan_mempool_poison_object+0x91/0x1d0 [ 14.412721] mempool_free+0x2ec/0x380 [ 14.412744] ? mempool_alloc_preallocated+0x5b/0x90 [ 14.412768] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.412795] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 14.412821] ? update_load_avg+0x1be/0x21b0 [ 14.412848] ? finish_task_switch.isra.0+0x153/0x700 [ 14.412874] mempool_kmalloc_invalid_free+0xed/0x140 [ 14.412897] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 14.412925] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.412948] ? __pfx_mempool_kfree+0x10/0x10 [ 14.412973] ? __pfx_read_tsc+0x10/0x10 [ 14.412994] ? ktime_get_ts64+0x86/0x230 [ 14.413018] kunit_try_run_case+0x1a5/0x480 [ 14.413042] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.413064] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.413088] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.413111] ? __kthread_parkme+0x82/0x180 [ 14.413133] ? preempt_count_sub+0x50/0x80 [ 14.413155] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.413179] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.413204] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.413229] kthread+0x337/0x6f0 [ 14.413247] ? trace_preempt_on+0x20/0xc0 [ 14.413270] ? __pfx_kthread+0x10/0x10 [ 14.413290] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.413312] ? calculate_sigpending+0x7b/0xa0 [ 14.413336] ? __pfx_kthread+0x10/0x10 [ 14.413374] ret_from_fork+0x116/0x1d0 [ 14.413393] ? __pfx_kthread+0x10/0x10 [ 14.413413] ret_from_fork_asm+0x1a/0x30 [ 14.413444] </TASK> [ 14.413455] [ 14.427961] Allocated by task 259: [ 14.428125] kasan_save_stack+0x45/0x70 [ 14.428331] kasan_save_track+0x18/0x40 [ 14.428685] kasan_save_alloc_info+0x3b/0x50 [ 14.428845] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 14.429018] remove_element+0x11e/0x190 [ 14.429208] mempool_alloc_preallocated+0x4d/0x90 [ 14.429444] mempool_kmalloc_invalid_free_helper+0x83/0x2e0 [ 14.429720] mempool_kmalloc_invalid_free+0xed/0x140 [ 14.429956] kunit_try_run_case+0x1a5/0x480 [ 14.430107] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.430382] kthread+0x337/0x6f0 [ 14.430759] ret_from_fork+0x116/0x1d0 [ 14.431015] ret_from_fork_asm+0x1a/0x30 [ 14.431219] [ 14.431313] The buggy address belongs to the object at ffff8881027a3d00 [ 14.431313] which belongs to the cache kmalloc-128 of size 128 [ 14.431911] The buggy address is located 1 bytes inside of [ 14.431911] 128-byte region [ffff8881027a3d00, ffff8881027a3d80) [ 14.432392] [ 14.432488] The buggy address belongs to the physical page: [ 14.432660] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027a3 [ 14.432970] flags: 0x200000000000000(node=0|zone=2) [ 14.433201] page_type: f5(slab) [ 14.433457] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.433697] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.433968] page dumped because: kasan: bad access detected [ 14.434215] [ 14.434306] Memory state around the buggy address: [ 14.434844] ffff8881027a3c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.435120] ffff8881027a3c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.435528] >ffff8881027a3d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.435751] ^ [ 14.435867] ffff8881027a3d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.436131] ffff8881027a3e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.436471] ================================================================== [ 14.441523] ================================================================== [ 14.441997] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.442310] Free of addr ffff888102a50001 by task kunit_try_catch/261 [ 14.442613] [ 14.442769] CPU: 1 UID: 0 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.442812] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.442824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.442845] Call Trace: [ 14.442856] <TASK> [ 14.442872] dump_stack_lvl+0x73/0xb0 [ 14.442901] print_report+0xd1/0x650 [ 14.442923] ? __virt_addr_valid+0x1db/0x2d0 [ 14.442945] ? kasan_addr_to_slab+0x11/0xa0 [ 14.442966] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.442995] kasan_report_invalid_free+0x10a/0x130 [ 14.443027] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.443058] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.443085] __kasan_mempool_poison_object+0x102/0x1d0 [ 14.443111] mempool_free+0x2ec/0x380 [ 14.443136] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 14.443163] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 14.443190] ? __kasan_check_write+0x18/0x20 [ 14.443222] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.443243] ? irqentry_exit+0x2a/0x60 [ 14.443266] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 14.443292] mempool_kmalloc_large_invalid_free+0xed/0x140 [ 14.443319] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 14.443348] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.443383] ? __pfx_mempool_kfree+0x10/0x10 [ 14.443407] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 14.443448] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 14.443618] kunit_try_run_case+0x1a5/0x480 [ 14.443653] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.443676] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.443700] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.443724] ? __kthread_parkme+0x82/0x180 [ 14.443744] ? preempt_count_sub+0x50/0x80 [ 14.443767] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.443791] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.443815] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.443840] kthread+0x337/0x6f0 [ 14.443859] ? trace_preempt_on+0x20/0xc0 [ 14.443882] ? __pfx_kthread+0x10/0x10 [ 14.443902] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.443923] ? calculate_sigpending+0x7b/0xa0 [ 14.443947] ? __pfx_kthread+0x10/0x10 [ 14.443968] ret_from_fork+0x116/0x1d0 [ 14.443987] ? __pfx_kthread+0x10/0x10 [ 14.444007] ret_from_fork_asm+0x1a/0x30 [ 14.444037] </TASK> [ 14.444047] [ 14.453674] The buggy address belongs to the physical page: [ 14.453931] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a50 [ 14.454221] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.454786] flags: 0x200000000000040(head|node=0|zone=2) [ 14.455087] page_type: f8(unknown) [ 14.455214] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.455459] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.455795] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.456146] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.456500] head: 0200000000000002 ffffea00040a9401 00000000ffffffff 00000000ffffffff [ 14.456876] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.457107] page dumped because: kasan: bad access detected [ 14.457405] [ 14.457515] Memory state around the buggy address: [ 14.457746] ffff888102a4ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.458048] ffff888102a4ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.458300] >ffff888102a50000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.458954] ^ [ 14.459091] ffff888102a50080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.459424] ffff888102a50100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.459707] ==================================================================