Date
July 12, 2025, 11:09 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.759605] ================================================================== [ 21.759732] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 21.759862] Read of size 1 at addr fff00000c79b2001 by task kunit_try_catch/224 [ 21.759923] [ 21.759975] CPU: 1 UID: 0 PID: 224 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.760078] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.760109] Hardware name: linux,dummy-virt (DT) [ 21.760147] Call trace: [ 21.760175] show_stack+0x20/0x38 (C) [ 21.760238] dump_stack_lvl+0x8c/0xd0 [ 21.760295] print_report+0x118/0x608 [ 21.760348] kasan_report+0xdc/0x128 [ 21.760397] __asan_report_load1_noabort+0x20/0x30 [ 21.760454] mempool_oob_right_helper+0x2ac/0x2f0 [ 21.760505] mempool_kmalloc_large_oob_right+0xc4/0x120 [ 21.760560] kunit_try_run_case+0x170/0x3f0 [ 21.760614] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.760672] kthread+0x328/0x630 [ 21.760720] ret_from_fork+0x10/0x20 [ 21.760778] [ 21.760805] The buggy address belongs to the physical page: [ 21.760861] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079b0 [ 21.760927] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.760980] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 21.761047] page_type: f8(unknown) [ 21.761097] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.761241] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.761351] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.761466] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.761567] head: 0bfffe0000000002 ffffc1ffc31e6c01 00000000ffffffff 00000000ffffffff [ 21.761663] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 21.761784] page dumped because: kasan: bad access detected [ 21.761878] [ 21.761913] Memory state around the buggy address: [ 21.761989] fff00000c79b1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.762094] fff00000c79b1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.762189] >fff00000c79b2000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 21.762255] ^ [ 21.762292] fff00000c79b2080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 21.762340] fff00000c79b2100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 21.762383] ================================================================== [ 21.702635] ================================================================== [ 21.702881] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 21.702993] Read of size 1 at addr fff00000c599f673 by task kunit_try_catch/222 [ 21.703055] [ 21.703104] CPU: 0 UID: 0 PID: 222 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.703203] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.703233] Hardware name: linux,dummy-virt (DT) [ 21.703271] Call trace: [ 21.703299] show_stack+0x20/0x38 (C) [ 21.703361] dump_stack_lvl+0x8c/0xd0 [ 21.703418] print_report+0x118/0x608 [ 21.703473] kasan_report+0xdc/0x128 [ 21.703524] __asan_report_load1_noabort+0x20/0x30 [ 21.703581] mempool_oob_right_helper+0x2ac/0x2f0 [ 21.703636] mempool_kmalloc_oob_right+0xc4/0x120 [ 21.703689] kunit_try_run_case+0x170/0x3f0 [ 21.703747] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.703806] kthread+0x328/0x630 [ 21.703884] ret_from_fork+0x10/0x20 [ 21.703942] [ 21.703965] Allocated by task 222: [ 21.704001] kasan_save_stack+0x3c/0x68 [ 21.704054] kasan_save_track+0x20/0x40 [ 21.704097] kasan_save_alloc_info+0x40/0x58 [ 21.704143] __kasan_mempool_unpoison_object+0x11c/0x180 [ 21.704194] remove_element+0x130/0x1f8 [ 21.704238] mempool_alloc_preallocated+0x58/0xc0 [ 21.704282] mempool_oob_right_helper+0x98/0x2f0 [ 21.704326] mempool_kmalloc_oob_right+0xc4/0x120 [ 21.704368] kunit_try_run_case+0x170/0x3f0 [ 21.704412] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.704461] kthread+0x328/0x630 [ 21.704497] ret_from_fork+0x10/0x20 [ 21.704539] [ 21.704563] The buggy address belongs to the object at fff00000c599f600 [ 21.704563] which belongs to the cache kmalloc-128 of size 128 [ 21.704630] The buggy address is located 0 bytes to the right of [ 21.704630] allocated 115-byte region [fff00000c599f600, fff00000c599f673) [ 21.704701] [ 21.704728] The buggy address belongs to the physical page: [ 21.704766] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10599f [ 21.704853] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.704918] page_type: f5(slab) [ 21.704971] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 21.705030] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.705074] page dumped because: kasan: bad access detected [ 21.705110] [ 21.705147] Memory state around the buggy address: [ 21.705208] fff00000c599f500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.705259] fff00000c599f580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.705305] >fff00000c599f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 21.705347] ^ [ 21.705391] fff00000c599f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.705439] fff00000c599f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 21.705480] ================================================================== [ 21.788081] ================================================================== [ 21.788359] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 21.788709] Read of size 1 at addr fff00000c59442bb by task kunit_try_catch/226 [ 21.788909] [ 21.789001] CPU: 1 UID: 0 PID: 226 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.789197] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.789255] Hardware name: linux,dummy-virt (DT) [ 21.789343] Call trace: [ 21.789762] show_stack+0x20/0x38 (C) [ 21.789960] dump_stack_lvl+0x8c/0xd0 [ 21.790079] print_report+0x118/0x608 [ 21.790217] kasan_report+0xdc/0x128 [ 21.790353] __asan_report_load1_noabort+0x20/0x30 [ 21.790480] mempool_oob_right_helper+0x2ac/0x2f0 [ 21.790604] mempool_slab_oob_right+0xc0/0x118 [ 21.790692] kunit_try_run_case+0x170/0x3f0 [ 21.790783] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.791490] kthread+0x328/0x630 [ 21.792106] ret_from_fork+0x10/0x20 [ 21.792716] [ 21.792779] Allocated by task 226: [ 21.792874] kasan_save_stack+0x3c/0x68 [ 21.792992] kasan_save_track+0x20/0x40 [ 21.793082] kasan_save_alloc_info+0x40/0x58 [ 21.793174] __kasan_mempool_unpoison_object+0xbc/0x180 [ 21.793259] remove_element+0x16c/0x1f8 [ 21.793326] mempool_alloc_preallocated+0x58/0xc0 [ 21.794162] mempool_oob_right_helper+0x98/0x2f0 [ 21.794445] mempool_slab_oob_right+0xc0/0x118 [ 21.794658] kunit_try_run_case+0x170/0x3f0 [ 21.795319] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.795471] kthread+0x328/0x630 [ 21.795568] ret_from_fork+0x10/0x20 [ 21.795659] [ 21.795717] The buggy address belongs to the object at fff00000c5944240 [ 21.795717] which belongs to the cache test_cache of size 123 [ 21.795874] The buggy address is located 0 bytes to the right of [ 21.795874] allocated 123-byte region [fff00000c5944240, fff00000c59442bb) [ 21.796048] [ 21.796128] The buggy address belongs to the physical page: [ 21.796243] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105944 [ 21.796443] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.796626] page_type: f5(slab) [ 21.796725] raw: 0bfffe0000000000 fff00000c3eaa3c0 dead000000000122 0000000000000000 [ 21.796866] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 21.796977] page dumped because: kasan: bad access detected [ 21.797059] [ 21.797106] Memory state around the buggy address: [ 21.797182] fff00000c5944180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.797283] fff00000c5944200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 21.797875] >fff00000c5944280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 21.798038] ^ [ 21.798166] fff00000c5944300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.798672] fff00000c5944380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.798807] ==================================================================
[ 14.056500] ================================================================== [ 14.057071] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 14.057426] Read of size 1 at addr ffff888103b72001 by task kunit_try_catch/241 [ 14.058352] [ 14.058584] CPU: 1 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.058654] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.058817] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.058840] Call Trace: [ 14.058853] <TASK> [ 14.058869] dump_stack_lvl+0x73/0xb0 [ 14.058901] print_report+0xd1/0x650 [ 14.058923] ? __virt_addr_valid+0x1db/0x2d0 [ 14.058947] ? mempool_oob_right_helper+0x318/0x380 [ 14.058970] ? kasan_addr_to_slab+0x11/0xa0 [ 14.058991] ? mempool_oob_right_helper+0x318/0x380 [ 14.059015] kasan_report+0x141/0x180 [ 14.059037] ? mempool_oob_right_helper+0x318/0x380 [ 14.059065] __asan_report_load1_noabort+0x18/0x20 [ 14.059090] mempool_oob_right_helper+0x318/0x380 [ 14.059115] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 14.059141] ? __kasan_check_write+0x18/0x20 [ 14.059161] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.059184] ? finish_task_switch.isra.0+0x153/0x700 [ 14.059211] mempool_kmalloc_large_oob_right+0xf2/0x150 [ 14.059237] ? __pfx_mempool_kmalloc_large_oob_right+0x10/0x10 [ 14.059265] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.059290] ? __pfx_mempool_kfree+0x10/0x10 [ 14.059315] ? __pfx_read_tsc+0x10/0x10 [ 14.059336] ? ktime_get_ts64+0x86/0x230 [ 14.059360] kunit_try_run_case+0x1a5/0x480 [ 14.059384] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.059407] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.059431] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.059455] ? __kthread_parkme+0x82/0x180 [ 14.059476] ? preempt_count_sub+0x50/0x80 [ 14.059499] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.059523] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.059547] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.059573] kthread+0x337/0x6f0 [ 14.059591] ? trace_preempt_on+0x20/0xc0 [ 14.059615] ? __pfx_kthread+0x10/0x10 [ 14.059636] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.059716] ? calculate_sigpending+0x7b/0xa0 [ 14.059741] ? __pfx_kthread+0x10/0x10 [ 14.059773] ret_from_fork+0x116/0x1d0 [ 14.059792] ? __pfx_kthread+0x10/0x10 [ 14.059812] ret_from_fork_asm+0x1a/0x30 [ 14.059843] </TASK> [ 14.059854] [ 14.071970] The buggy address belongs to the physical page: [ 14.072595] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103b70 [ 14.073086] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.073370] flags: 0x200000000000040(head|node=0|zone=2) [ 14.073607] page_type: f8(unknown) [ 14.073818] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.074487] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.074935] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.075405] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.075824] head: 0200000000000002 ffffea00040edc01 00000000ffffffff 00000000ffffffff [ 14.076143] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.076675] page dumped because: kasan: bad access detected [ 14.077082] [ 14.077292] Memory state around the buggy address: [ 14.077493] ffff888103b71f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.078009] ffff888103b71f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.078426] >ffff888103b72000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 14.078925] ^ [ 14.079100] ffff888103b72080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 14.079549] ffff888103b72100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 14.080105] ================================================================== [ 14.023233] ================================================================== [ 14.023890] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 14.024230] Read of size 1 at addr ffff888102655873 by task kunit_try_catch/239 [ 14.024447] [ 14.024591] CPU: 1 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.024640] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.024776] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.024804] Call Trace: [ 14.024818] <TASK> [ 14.024837] dump_stack_lvl+0x73/0xb0 [ 14.024872] print_report+0xd1/0x650 [ 14.024896] ? __virt_addr_valid+0x1db/0x2d0 [ 14.024922] ? mempool_oob_right_helper+0x318/0x380 [ 14.024946] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.024969] ? mempool_oob_right_helper+0x318/0x380 [ 14.024994] kasan_report+0x141/0x180 [ 14.025015] ? mempool_oob_right_helper+0x318/0x380 [ 14.025043] __asan_report_load1_noabort+0x18/0x20 [ 14.025068] mempool_oob_right_helper+0x318/0x380 [ 14.025094] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 14.025119] ? __kasan_check_write+0x18/0x20 [ 14.025139] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.025163] ? finish_task_switch.isra.0+0x153/0x700 [ 14.025190] mempool_kmalloc_oob_right+0xf2/0x150 [ 14.025213] ? __pfx_mempool_kmalloc_oob_right+0x10/0x10 [ 14.025241] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.025267] ? __pfx_mempool_kfree+0x10/0x10 [ 14.025292] ? __pfx_read_tsc+0x10/0x10 [ 14.025314] ? ktime_get_ts64+0x86/0x230 [ 14.025339] kunit_try_run_case+0x1a5/0x480 [ 14.025366] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.025388] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.025414] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.025439] ? __kthread_parkme+0x82/0x180 [ 14.025460] ? preempt_count_sub+0x50/0x80 [ 14.025483] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.025508] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.025533] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.025558] kthread+0x337/0x6f0 [ 14.025578] ? trace_preempt_on+0x20/0xc0 [ 14.025602] ? __pfx_kthread+0x10/0x10 [ 14.025622] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.025687] ? calculate_sigpending+0x7b/0xa0 [ 14.025714] ? __pfx_kthread+0x10/0x10 [ 14.025735] ret_from_fork+0x116/0x1d0 [ 14.025765] ? __pfx_kthread+0x10/0x10 [ 14.025786] ret_from_fork_asm+0x1a/0x30 [ 14.025819] </TASK> [ 14.025830] [ 14.040187] Allocated by task 239: [ 14.040330] kasan_save_stack+0x45/0x70 [ 14.040479] kasan_save_track+0x18/0x40 [ 14.040617] kasan_save_alloc_info+0x3b/0x50 [ 14.041092] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 14.041555] remove_element+0x11e/0x190 [ 14.041989] mempool_alloc_preallocated+0x4d/0x90 [ 14.042678] mempool_oob_right_helper+0x8a/0x380 [ 14.043634] mempool_kmalloc_oob_right+0xf2/0x150 [ 14.044458] kunit_try_run_case+0x1a5/0x480 [ 14.044930] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.045197] kthread+0x337/0x6f0 [ 14.045723] ret_from_fork+0x116/0x1d0 [ 14.046078] ret_from_fork_asm+0x1a/0x30 [ 14.046226] [ 14.046298] The buggy address belongs to the object at ffff888102655800 [ 14.046298] which belongs to the cache kmalloc-128 of size 128 [ 14.046870] The buggy address is located 0 bytes to the right of [ 14.046870] allocated 115-byte region [ffff888102655800, ffff888102655873) [ 14.047827] [ 14.047958] The buggy address belongs to the physical page: [ 14.048197] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102655 [ 14.048532] flags: 0x200000000000000(node=0|zone=2) [ 14.048808] page_type: f5(slab) [ 14.048945] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.049345] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.049706] page dumped because: kasan: bad access detected [ 14.049995] [ 14.050086] Memory state around the buggy address: [ 14.050307] ffff888102655700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.050591] ffff888102655780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.050941] >ffff888102655800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 14.051333] ^ [ 14.051730] ffff888102655880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.052150] ffff888102655900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 14.052600] ================================================================== [ 14.084525] ================================================================== [ 14.085849] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 14.086449] Read of size 1 at addr ffff888103ace2bb by task kunit_try_catch/243 [ 14.087072] [ 14.087367] CPU: 0 UID: 0 PID: 243 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.087417] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.087429] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.087451] Call Trace: [ 14.087465] <TASK> [ 14.087482] dump_stack_lvl+0x73/0xb0 [ 14.087515] print_report+0xd1/0x650 [ 14.087539] ? __virt_addr_valid+0x1db/0x2d0 [ 14.087564] ? mempool_oob_right_helper+0x318/0x380 [ 14.087589] ? kasan_complete_mode_report_info+0x2a/0x200 [ 14.087612] ? mempool_oob_right_helper+0x318/0x380 [ 14.087636] kasan_report+0x141/0x180 [ 14.087808] ? mempool_oob_right_helper+0x318/0x380 [ 14.087839] __asan_report_load1_noabort+0x18/0x20 [ 14.087865] mempool_oob_right_helper+0x318/0x380 [ 14.087937] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 14.087967] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.087992] ? finish_task_switch.isra.0+0x153/0x700 [ 14.088019] mempool_slab_oob_right+0xed/0x140 [ 14.088044] ? __pfx_mempool_slab_oob_right+0x10/0x10 [ 14.088073] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 14.088100] ? __pfx_mempool_free_slab+0x10/0x10 [ 14.088126] ? __pfx_read_tsc+0x10/0x10 [ 14.088149] ? ktime_get_ts64+0x86/0x230 [ 14.088173] kunit_try_run_case+0x1a5/0x480 [ 14.088199] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.088222] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.088248] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.088271] ? __kthread_parkme+0x82/0x180 [ 14.088292] ? preempt_count_sub+0x50/0x80 [ 14.088316] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.088340] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.088365] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.088390] kthread+0x337/0x6f0 [ 14.088410] ? trace_preempt_on+0x20/0xc0 [ 14.088434] ? __pfx_kthread+0x10/0x10 [ 14.088454] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.088476] ? calculate_sigpending+0x7b/0xa0 [ 14.088501] ? __pfx_kthread+0x10/0x10 [ 14.088522] ret_from_fork+0x116/0x1d0 [ 14.088541] ? __pfx_kthread+0x10/0x10 [ 14.088561] ret_from_fork_asm+0x1a/0x30 [ 14.088593] </TASK> [ 14.088604] [ 14.106499] Allocated by task 243: [ 14.106645] kasan_save_stack+0x45/0x70 [ 14.107409] kasan_save_track+0x18/0x40 [ 14.108069] kasan_save_alloc_info+0x3b/0x50 [ 14.108592] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 14.109388] remove_element+0x11e/0x190 [ 14.109996] mempool_alloc_preallocated+0x4d/0x90 [ 14.110280] mempool_oob_right_helper+0x8a/0x380 [ 14.110567] mempool_slab_oob_right+0xed/0x140 [ 14.111255] kunit_try_run_case+0x1a5/0x480 [ 14.111467] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.111998] kthread+0x337/0x6f0 [ 14.112426] ret_from_fork+0x116/0x1d0 [ 14.112616] ret_from_fork_asm+0x1a/0x30 [ 14.113077] [ 14.113228] The buggy address belongs to the object at ffff888103ace240 [ 14.113228] which belongs to the cache test_cache of size 123 [ 14.114183] The buggy address is located 0 bytes to the right of [ 14.114183] allocated 123-byte region [ffff888103ace240, ffff888103ace2bb) [ 14.115071] [ 14.115194] The buggy address belongs to the physical page: [ 14.115410] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103ace [ 14.116394] flags: 0x200000000000000(node=0|zone=2) [ 14.116604] page_type: f5(slab) [ 14.116797] raw: 0200000000000000 ffff888101342780 dead000000000122 0000000000000000 [ 14.117508] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 14.118050] page dumped because: kasan: bad access detected [ 14.118421] [ 14.118717] Memory state around the buggy address: [ 14.119164] ffff888103ace180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.119609] ffff888103ace200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 14.120019] >ffff888103ace280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 14.120342] ^ [ 14.120565] ffff888103ace300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.121393] ffff888103ace380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.121835] ==================================================================