Date
Nov. 28, 2024, 2:36 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.196044] ================================================================== [ 33.197103] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a0 [ 33.197880] Free of addr fff00000c653c001 by task kunit_try_catch/231 [ 33.199692] [ 33.200067] CPU: 0 UID: 0 PID: 231 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 33.201067] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.201567] Hardware name: linux,dummy-virt (DT) [ 33.202040] Call trace: [ 33.202863] show_stack+0x20/0x38 (C) [ 33.203365] dump_stack_lvl+0x8c/0xd0 [ 33.203967] print_report+0x118/0x5e0 [ 33.204574] kasan_report_invalid_free+0xb0/0xd8 [ 33.205984] __kasan_mempool_poison_object+0xfc/0x150 [ 33.206592] mempool_free+0x28c/0x328 [ 33.207176] mempool_kmalloc_invalid_free_helper+0x118/0x2a0 [ 33.207877] mempool_kmalloc_large_invalid_free+0xb8/0x110 [ 33.208594] kunit_try_run_case+0x14c/0x3d0 [ 33.209271] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.209914] kthread+0x24c/0x2d0 [ 33.210487] ret_from_fork+0x10/0x20 [ 33.211018] [ 33.211810] The buggy address belongs to the physical page: [ 33.212437] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10653c [ 33.214141] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.214939] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.215732] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.216559] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 33.217694] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.218522] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 33.219545] head: 0bfffe0000000002 ffffc1ffc3194f01 ffffffffffffffff 0000000000000000 [ 33.220421] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 33.221197] page dumped because: kasan: bad access detected [ 33.221800] [ 33.222150] Memory state around the buggy address: [ 33.222730] fff00000c653bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.223981] fff00000c653bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.224783] >fff00000c653c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.225568] ^ [ 33.226027] fff00000c653c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.227289] fff00000c653c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.228071] ================================================================== [ 33.142041] ================================================================== [ 33.143199] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a0 [ 33.144002] Free of addr fff00000c6362501 by task kunit_try_catch/229 [ 33.144622] [ 33.145060] CPU: 0 UID: 0 PID: 229 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 33.146306] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.147407] Hardware name: linux,dummy-virt (DT) [ 33.147958] Call trace: [ 33.148378] show_stack+0x20/0x38 (C) [ 33.149092] dump_stack_lvl+0x8c/0xd0 [ 33.149660] print_report+0x118/0x5e0 [ 33.150561] kasan_report_invalid_free+0xb0/0xd8 [ 33.151413] check_slab_allocation+0xfc/0x108 [ 33.152141] __kasan_mempool_poison_object+0x78/0x150 [ 33.152955] mempool_free+0x28c/0x328 [ 33.153479] mempool_kmalloc_invalid_free_helper+0x118/0x2a0 [ 33.155010] mempool_kmalloc_invalid_free+0xb8/0x110 [ 33.155695] kunit_try_run_case+0x14c/0x3d0 [ 33.156317] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.157012] kthread+0x24c/0x2d0 [ 33.157772] ret_from_fork+0x10/0x20 [ 33.159485] [ 33.159859] Allocated by task 229: [ 33.160387] kasan_save_stack+0x3c/0x68 [ 33.160989] kasan_save_track+0x20/0x40 [ 33.161874] kasan_save_alloc_info+0x40/0x58 [ 33.162424] __kasan_mempool_unpoison_object+0x11c/0x180 [ 33.163511] remove_element+0x130/0x1f8 [ 33.163947] mempool_alloc_preallocated+0x58/0xc0 [ 33.164878] mempool_kmalloc_invalid_free_helper+0x94/0x2a0 [ 33.165592] mempool_kmalloc_invalid_free+0xb8/0x110 [ 33.166641] kunit_try_run_case+0x14c/0x3d0 [ 33.167217] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.168149] kthread+0x24c/0x2d0 [ 33.168820] ret_from_fork+0x10/0x20 [ 33.169428] [ 33.170104] The buggy address belongs to the object at fff00000c6362500 [ 33.170104] which belongs to the cache kmalloc-128 of size 128 [ 33.171484] The buggy address is located 1 bytes inside of [ 33.171484] 128-byte region [fff00000c6362500, fff00000c6362580) [ 33.173283] [ 33.173566] The buggy address belongs to the physical page: [ 33.174031] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106362 [ 33.175182] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.175831] page_type: f5(slab) [ 33.176374] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 33.177239] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 33.178069] page dumped because: kasan: bad access detected [ 33.178739] [ 33.179057] Memory state around the buggy address: [ 33.180405] fff00000c6362400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.181215] fff00000c6362480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.181900] >fff00000c6362500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.183171] ^ [ 33.183616] fff00000c6362580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.184478] fff00000c6362600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.185917] ==================================================================
[ 24.054895] ================================================================== [ 24.055801] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.057196] Free of addr ffff888101b62c01 by task kunit_try_catch/249 [ 24.057912] [ 24.058147] CPU: 1 UID: 0 PID: 249 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 24.058954] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.059235] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.060503] Call Trace: [ 24.060794] <TASK> [ 24.061313] dump_stack_lvl+0x73/0xb0 [ 24.061922] print_report+0xd1/0x640 [ 24.062714] ? __virt_addr_valid+0x1db/0x2d0 [ 24.063134] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.063746] ? kasan_complete_mode_report_info+0x2a/0x200 [ 24.064795] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.065735] kasan_report_invalid_free+0xc0/0xf0 [ 24.066148] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.066716] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.067196] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.068508] check_slab_allocation+0x11f/0x130 [ 24.068918] __kasan_mempool_poison_object+0x91/0x1d0 [ 24.069595] mempool_free+0x2ec/0x380 [ 24.069989] mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.070886] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 24.072020] ? finish_task_switch.isra.0+0x153/0x700 [ 24.072590] mempool_kmalloc_invalid_free+0xb1/0x100 [ 24.073751] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 24.074566] ? __switch_to+0x5d9/0xf60 [ 24.075061] ? __pfx_mempool_kmalloc+0x10/0x10 [ 24.075596] ? __pfx_mempool_kfree+0x10/0x10 [ 24.076012] ? __pfx_read_tsc+0x10/0x10 [ 24.076318] ? ktime_get_ts64+0x84/0x230 [ 24.076827] kunit_try_run_case+0x1b3/0x490 [ 24.077358] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.077953] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.078600] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.079147] ? __kthread_parkme+0x82/0x160 [ 24.079578] ? preempt_count_sub+0x50/0x80 [ 24.080351] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.080957] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.081840] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.082470] kthread+0x257/0x310 [ 24.082782] ? __pfx_kthread+0x10/0x10 [ 24.083220] ret_from_fork+0x41/0x80 [ 24.083923] ? __pfx_kthread+0x10/0x10 [ 24.084483] ret_from_fork_asm+0x1a/0x30 [ 24.084897] </TASK> [ 24.085240] [ 24.085420] Allocated by task 249: [ 24.085923] kasan_save_stack+0x3d/0x60 [ 24.086429] kasan_save_track+0x18/0x40 [ 24.086783] kasan_save_alloc_info+0x3b/0x50 [ 24.088304] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 24.088973] remove_element+0x11e/0x190 [ 24.089634] mempool_alloc_preallocated+0x4d/0x90 [ 24.090110] mempool_kmalloc_invalid_free_helper+0x84/0x2e0 [ 24.091018] mempool_kmalloc_invalid_free+0xb1/0x100 [ 24.091476] kunit_try_run_case+0x1b3/0x490 [ 24.091947] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.093103] kthread+0x257/0x310 [ 24.093796] ret_from_fork+0x41/0x80 [ 24.094129] ret_from_fork_asm+0x1a/0x30 [ 24.094833] [ 24.094986] The buggy address belongs to the object at ffff888101b62c00 [ 24.094986] which belongs to the cache kmalloc-128 of size 128 [ 24.096613] The buggy address is located 1 bytes inside of [ 24.096613] 128-byte region [ffff888101b62c00, ffff888101b62c80) [ 24.097646] [ 24.097901] The buggy address belongs to the physical page: [ 24.098543] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101b62 [ 24.099532] flags: 0x200000000000000(node=0|zone=2) [ 24.100617] page_type: f5(slab) [ 24.101076] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 24.101796] raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 [ 24.102500] page dumped because: kasan: bad access detected [ 24.103221] [ 24.103409] Memory state around the buggy address: [ 24.104038] ffff888101b62b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.104719] ffff888101b62b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.105571] >ffff888101b62c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.106357] ^ [ 24.106859] ffff888101b62c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.107506] ffff888101b62d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.108440] ================================================================== [ 24.114719] ================================================================== [ 24.116568] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.117428] Free of addr ffff888102bd4001 by task kunit_try_catch/251 [ 24.118352] [ 24.118640] CPU: 0 UID: 0 PID: 251 Comm: kunit_try_catch Tainted: G B N 6.12.0-next-20241128 #1 [ 24.120014] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.120900] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 24.122315] Call Trace: [ 24.122874] <TASK> [ 24.123120] dump_stack_lvl+0x73/0xb0 [ 24.123856] print_report+0xd1/0x640 [ 24.124100] ? __virt_addr_valid+0x1db/0x2d0 [ 24.125141] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.126021] ? kasan_addr_to_slab+0x11/0xa0 [ 24.126760] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.127531] kasan_report_invalid_free+0xc0/0xf0 [ 24.128292] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.128909] ? mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.129598] __kasan_mempool_poison_object+0x102/0x1d0 [ 24.130433] mempool_free+0x2ec/0x380 [ 24.130868] mempool_kmalloc_invalid_free_helper+0x133/0x2e0 [ 24.131678] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 24.132744] ? finish_task_switch.isra.0+0x153/0x700 [ 24.133694] mempool_kmalloc_large_invalid_free+0xb1/0x100 [ 24.134271] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 24.134761] ? __switch_to+0x5d9/0xf60 [ 24.135124] ? __pfx_mempool_kmalloc+0x10/0x10 [ 24.135829] ? __pfx_mempool_kfree+0x10/0x10 [ 24.136407] ? __pfx_read_tsc+0x10/0x10 [ 24.136804] ? ktime_get_ts64+0x84/0x230 [ 24.137251] kunit_try_run_case+0x1b3/0x490 [ 24.137853] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.138439] ? _raw_spin_lock_irqsave+0xa2/0x110 [ 24.138872] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 24.139980] ? __kthread_parkme+0x82/0x160 [ 24.140430] ? preempt_count_sub+0x50/0x80 [ 24.141498] ? __pfx_kunit_try_run_case+0x10/0x10 [ 24.141938] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 24.143045] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 24.144065] kthread+0x257/0x310 [ 24.144607] ? __pfx_kthread+0x10/0x10 [ 24.145380] ret_from_fork+0x41/0x80 [ 24.146045] ? __pfx_kthread+0x10/0x10 [ 24.146701] ret_from_fork_asm+0x1a/0x30 [ 24.146921] </TASK> [ 24.147038] [ 24.147216] The buggy address belongs to the physical page: [ 24.147616] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102bd4 [ 24.148667] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.149756] flags: 0x200000000000040(head|node=0|zone=2) [ 24.150644] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.151616] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 24.152423] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.153330] head: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 24.154019] head: 0200000000000002 ffffea00040af501 ffffffffffffffff 0000000000000000 [ 24.154986] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 24.155852] page dumped because: kasan: bad access detected [ 24.156462] [ 24.156720] Memory state around the buggy address: [ 24.157723] ffff888102bd3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.158667] ffff888102bd3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.159549] >ffff888102bd4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.160695] ^ [ 24.161023] ffff888102bd4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.161898] ffff888102bd4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.163282] ==================================================================