Date
May 15, 2025, 10:38 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.884210] ================================================================== [ 19.884269] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 19.884319] Read of size 1 at addr fff00000c774e001 by task kunit_try_catch/223 [ 19.884374] [ 19.884404] CPU: 0 UID: 0 PID: 223 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 19.884488] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.884514] Hardware name: linux,dummy-virt (DT) [ 19.884544] Call trace: [ 19.884567] show_stack+0x20/0x38 (C) [ 19.884615] dump_stack_lvl+0x8c/0xd0 [ 19.884661] print_report+0x118/0x608 [ 19.884707] kasan_report+0xdc/0x128 [ 19.884751] __asan_report_load1_noabort+0x20/0x30 [ 19.884801] mempool_oob_right_helper+0x2ac/0x2f0 [ 19.884848] mempool_kmalloc_large_oob_right+0xc4/0x120 [ 19.884897] kunit_try_run_case+0x170/0x3f0 [ 19.884943] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.884993] kthread+0x328/0x630 [ 19.885038] ret_from_fork+0x10/0x20 [ 19.885086] [ 19.885106] The buggy address belongs to the physical page: [ 19.885312] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10774c [ 19.885383] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.885432] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.885526] page_type: f8(unknown) [ 19.885564] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.885613] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.885662] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.885708] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.885784] head: 0bfffe0000000002 ffffc1ffc31dd301 00000000ffffffff 00000000ffffffff [ 19.885847] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 19.885886] page dumped because: kasan: bad access detected [ 19.885917] [ 19.885935] Memory state around the buggy address: [ 19.885966] fff00000c774df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.886008] fff00000c774df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.886048] >fff00000c774e000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 19.886090] ^ [ 19.886131] fff00000c774e080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 19.886183] fff00000c774e100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 19.886318] ================================================================== [ 19.876013] ================================================================== [ 19.876093] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 19.876187] Read of size 1 at addr fff00000c1718973 by task kunit_try_catch/221 [ 19.876238] [ 19.876279] CPU: 0 UID: 0 PID: 221 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 19.876371] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.876398] Hardware name: linux,dummy-virt (DT) [ 19.876433] Call trace: [ 19.876458] show_stack+0x20/0x38 (C) [ 19.876512] dump_stack_lvl+0x8c/0xd0 [ 19.876562] print_report+0x118/0x608 [ 19.876609] kasan_report+0xdc/0x128 [ 19.876656] __asan_report_load1_noabort+0x20/0x30 [ 19.876706] mempool_oob_right_helper+0x2ac/0x2f0 [ 19.876753] mempool_kmalloc_oob_right+0xc4/0x120 [ 19.876802] kunit_try_run_case+0x170/0x3f0 [ 19.876852] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.876903] kthread+0x328/0x630 [ 19.876949] ret_from_fork+0x10/0x20 [ 19.876998] [ 19.877017] Allocated by task 221: [ 19.877047] kasan_save_stack+0x3c/0x68 [ 19.877088] kasan_save_track+0x20/0x40 [ 19.877126] kasan_save_alloc_info+0x40/0x58 [ 19.877176] __kasan_mempool_unpoison_object+0x11c/0x180 [ 19.877218] remove_element+0x130/0x1f8 [ 19.877255] mempool_alloc_preallocated+0x58/0xc0 [ 19.877293] mempool_oob_right_helper+0x98/0x2f0 [ 19.877330] mempool_kmalloc_oob_right+0xc4/0x120 [ 19.877367] kunit_try_run_case+0x170/0x3f0 [ 19.877406] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.877449] kthread+0x328/0x630 [ 19.877483] ret_from_fork+0x10/0x20 [ 19.877520] [ 19.877540] The buggy address belongs to the object at fff00000c1718900 [ 19.877540] which belongs to the cache kmalloc-128 of size 128 [ 19.877597] The buggy address is located 0 bytes to the right of [ 19.877597] allocated 115-byte region [fff00000c1718900, fff00000c1718973) [ 19.877659] [ 19.877681] The buggy address belongs to the physical page: [ 19.877713] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101718 [ 19.877767] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.877820] page_type: f5(slab) [ 19.877860] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.877909] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.877950] page dumped because: kasan: bad access detected [ 19.877982] [ 19.878001] Memory state around the buggy address: [ 19.878035] fff00000c1718800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.878077] fff00000c1718880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.878119] >fff00000c1718900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 19.878166] ^ [ 19.878204] fff00000c1718980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.878245] fff00000c1718a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 19.878284] ================================================================== [ 19.897281] ================================================================== [ 19.897342] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x2ac/0x2f0 [ 19.897405] Read of size 1 at addr fff00000c76702bb by task kunit_try_catch/225 [ 19.897454] [ 19.897486] CPU: 0 UID: 0 PID: 225 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT [ 19.897581] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.897664] Hardware name: linux,dummy-virt (DT) [ 19.897707] Call trace: [ 19.897731] show_stack+0x20/0x38 (C) [ 19.897792] dump_stack_lvl+0x8c/0xd0 [ 19.898044] print_report+0x118/0x608 [ 19.898111] kasan_report+0xdc/0x128 [ 19.898226] __asan_report_load1_noabort+0x20/0x30 [ 19.898346] mempool_oob_right_helper+0x2ac/0x2f0 [ 19.898479] mempool_slab_oob_right+0xc0/0x118 [ 19.898582] kunit_try_run_case+0x170/0x3f0 [ 19.898664] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.899690] kthread+0x328/0x630 [ 19.899794] ret_from_fork+0x10/0x20 [ 19.899945] [ 19.899995] Allocated by task 225: [ 19.900184] kasan_save_stack+0x3c/0x68 [ 19.900233] kasan_save_track+0x20/0x40 [ 19.900303] kasan_save_alloc_info+0x40/0x58 [ 19.900607] __kasan_mempool_unpoison_object+0xbc/0x180 [ 19.900659] remove_element+0x16c/0x1f8 [ 19.900697] mempool_alloc_preallocated+0x58/0xc0 [ 19.901064] mempool_oob_right_helper+0x98/0x2f0 [ 19.901179] mempool_slab_oob_right+0xc0/0x118 [ 19.901226] kunit_try_run_case+0x170/0x3f0 [ 19.901264] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.901557] kthread+0x328/0x630 [ 19.901720] ret_from_fork+0x10/0x20 [ 19.902001] [ 19.902029] The buggy address belongs to the object at fff00000c7670240 [ 19.902029] which belongs to the cache test_cache of size 123 [ 19.902103] The buggy address is located 0 bytes to the right of [ 19.902103] allocated 123-byte region [fff00000c7670240, fff00000c76702bb) [ 19.902177] [ 19.902199] The buggy address belongs to the physical page: [ 19.902690] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107670 [ 19.902995] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.903314] page_type: f5(slab) [ 19.903522] raw: 0bfffe0000000000 fff00000c17368c0 dead000000000122 0000000000000000 [ 19.903596] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 19.903638] page dumped because: kasan: bad access detected [ 19.904020] [ 19.904040] Memory state around the buggy address: [ 19.904143] fff00000c7670180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.904196] fff00000c7670200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 19.904239] >fff00000c7670280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 19.904276] ^ [ 19.904579] fff00000c7670300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.904840] fff00000c7670380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.904884] ==================================================================
[ 15.690966] ================================================================== [ 15.691410] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 15.691928] Read of size 1 at addr ffff888102b682bb by task kunit_try_catch/243 [ 15.692667] [ 15.692924] CPU: 0 UID: 0 PID: 243 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) [ 15.693344] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.693382] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.693451] Call Trace: [ 15.693479] <TASK> [ 15.693520] dump_stack_lvl+0x73/0xb0 [ 15.693631] print_report+0xd1/0x650 [ 15.693678] ? __virt_addr_valid+0x1db/0x2d0 [ 15.693725] ? mempool_oob_right_helper+0x318/0x380 [ 15.693769] ? kasan_complete_mode_report_info+0x2a/0x200 [ 15.693812] ? mempool_oob_right_helper+0x318/0x380 [ 15.693855] kasan_report+0x141/0x180 [ 15.693896] ? mempool_oob_right_helper+0x318/0x380 [ 15.693933] __asan_report_load1_noabort+0x18/0x20 [ 15.693956] mempool_oob_right_helper+0x318/0x380 [ 15.693984] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 15.694014] ? __pfx_sched_clock_cpu+0x10/0x10 [ 15.694042] ? finish_task_switch.isra.0+0x153/0x700 [ 15.694073] mempool_slab_oob_right+0xed/0x140 [ 15.694098] ? __pfx_mempool_slab_oob_right+0x10/0x10 [ 15.694125] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 15.694149] ? __pfx_mempool_free_slab+0x10/0x10 [ 15.694174] ? __pfx_read_tsc+0x10/0x10 [ 15.694197] ? ktime_get_ts64+0x86/0x230 [ 15.694248] kunit_try_run_case+0x1a5/0x480 [ 15.694280] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.694306] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.694341] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.694376] ? __kthread_parkme+0x82/0x180 [ 15.694403] ? preempt_count_sub+0x50/0x80 [ 15.694430] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.694462] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.694534] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.694580] kthread+0x337/0x6f0 [ 15.694614] ? trace_preempt_on+0x20/0xc0 [ 15.694654] ? __pfx_kthread+0x10/0x10 [ 15.694676] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.694698] ? calculate_sigpending+0x7b/0xa0 [ 15.694724] ? __pfx_kthread+0x10/0x10 [ 15.694747] ret_from_fork+0x116/0x1d0 [ 15.694766] ? __pfx_kthread+0x10/0x10 [ 15.694788] ret_from_fork_asm+0x1a/0x30 [ 15.694822] </TASK> [ 15.694835] [ 15.706611] Allocated by task 243: [ 15.706905] kasan_save_stack+0x45/0x70 [ 15.707247] kasan_save_track+0x18/0x40 [ 15.707549] kasan_save_alloc_info+0x3b/0x50 [ 15.707857] __kasan_mempool_unpoison_object+0x1bb/0x200 [ 15.708754] remove_element+0x11e/0x190 [ 15.709054] mempool_alloc_preallocated+0x4d/0x90 [ 15.709352] mempool_oob_right_helper+0x8a/0x380 [ 15.709805] mempool_slab_oob_right+0xed/0x140 [ 15.710133] kunit_try_run_case+0x1a5/0x480 [ 15.710426] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.710937] kthread+0x337/0x6f0 [ 15.711198] ret_from_fork+0x116/0x1d0 [ 15.711414] ret_from_fork_asm+0x1a/0x30 [ 15.712109] [ 15.712254] The buggy address belongs to the object at ffff888102b68240 [ 15.712254] which belongs to the cache test_cache of size 123 [ 15.713076] The buggy address is located 0 bytes to the right of [ 15.713076] allocated 123-byte region [ffff888102b68240, ffff888102b682bb) [ 15.713704] [ 15.713859] The buggy address belongs to the physical page: [ 15.714234] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b68 [ 15.714924] flags: 0x200000000000000(node=0|zone=2) [ 15.715164] page_type: f5(slab) [ 15.715444] raw: 0200000000000000 ffff8881009b3c80 dead000000000122 0000000000000000 [ 15.716190] raw: 0000000000000000 0000000080150015 00000000f5000000 0000000000000000 [ 15.716847] page dumped because: kasan: bad access detected [ 15.717092] [ 15.717195] Memory state around the buggy address: [ 15.717699] ffff888102b68180: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.718111] ffff888102b68200: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 15.718648] >ffff888102b68280: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 15.719048] ^ [ 15.719299] ffff888102b68300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.720167] ffff888102b68380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.720741] ================================================================== [ 15.660100] ================================================================== [ 15.660553] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 15.661334] Read of size 1 at addr ffff888103c2a001 by task kunit_try_catch/241 [ 15.662112] [ 15.662303] CPU: 1 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) [ 15.662414] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.662433] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.662460] Call Trace: [ 15.662486] <TASK> [ 15.662515] dump_stack_lvl+0x73/0xb0 [ 15.662556] print_report+0xd1/0x650 [ 15.662580] ? __virt_addr_valid+0x1db/0x2d0 [ 15.662605] ? mempool_oob_right_helper+0x318/0x380 [ 15.662628] ? kasan_addr_to_slab+0x11/0xa0 [ 15.662648] ? mempool_oob_right_helper+0x318/0x380 [ 15.662670] kasan_report+0x141/0x180 [ 15.662691] ? mempool_oob_right_helper+0x318/0x380 [ 15.662718] __asan_report_load1_noabort+0x18/0x20 [ 15.662737] mempool_oob_right_helper+0x318/0x380 [ 15.662761] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 15.662786] ? __pfx_sched_clock_cpu+0x10/0x10 [ 15.662810] ? finish_task_switch.isra.0+0x153/0x700 [ 15.662836] mempool_kmalloc_large_oob_right+0xf2/0x150 [ 15.662859] ? __pfx_mempool_kmalloc_large_oob_right+0x10/0x10 [ 15.662884] ? __pfx_mempool_kmalloc+0x10/0x10 [ 15.662906] ? __pfx_mempool_kfree+0x10/0x10 [ 15.662927] ? __pfx_read_tsc+0x10/0x10 [ 15.662948] ? ktime_get_ts64+0x86/0x230 [ 15.662973] kunit_try_run_case+0x1a5/0x480 [ 15.662999] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.663019] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.663042] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.663064] ? __kthread_parkme+0x82/0x180 [ 15.663085] ? preempt_count_sub+0x50/0x80 [ 15.663107] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.663129] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.663151] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.663173] kthread+0x337/0x6f0 [ 15.663192] ? trace_preempt_on+0x20/0xc0 [ 15.663214] ? __pfx_kthread+0x10/0x10 [ 15.663261] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.663431] ? calculate_sigpending+0x7b/0xa0 [ 15.663575] ? __pfx_kthread+0x10/0x10 [ 15.663621] ret_from_fork+0x116/0x1d0 [ 15.663663] ? __pfx_kthread+0x10/0x10 [ 15.663707] ret_from_fork_asm+0x1a/0x30 [ 15.663791] </TASK> [ 15.663817] [ 15.674855] The buggy address belongs to the physical page: [ 15.675313] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103c28 [ 15.675830] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 15.676563] flags: 0x200000000000040(head|node=0|zone=2) [ 15.676922] page_type: f8(unknown) [ 15.677264] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 15.677886] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 15.678340] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 15.678782] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 15.679179] head: 0200000000000002 ffffea00040f0a01 00000000ffffffff 00000000ffffffff [ 15.679681] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 15.679940] page dumped because: kasan: bad access detected [ 15.680133] [ 15.680315] Memory state around the buggy address: [ 15.680747] ffff888103c29f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.681385] ffff888103c29f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 15.681865] >ffff888103c2a000: 01 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 15.682371] ^ [ 15.682546] ffff888103c2a080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 15.683151] ffff888103c2a100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 15.683693] ================================================================== [ 15.625661] ================================================================== [ 15.626110] BUG: KASAN: slab-out-of-bounds in mempool_oob_right_helper+0x318/0x380 [ 15.626869] Read of size 1 at addr ffff888102b5b373 by task kunit_try_catch/239 [ 15.627435] [ 15.628046] CPU: 0 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.15.0-rc6-next-20250515 #1 PREEMPT(voluntary) [ 15.628169] Tainted: [B]=BAD_PAGE, [N]=TEST [ 15.628194] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.628250] Call Trace: [ 15.628292] <TASK> [ 15.628384] dump_stack_lvl+0x73/0xb0 [ 15.628560] print_report+0xd1/0x650 [ 15.628628] ? __virt_addr_valid+0x1db/0x2d0 [ 15.628674] ? mempool_oob_right_helper+0x318/0x380 [ 15.628704] ? kasan_complete_mode_report_info+0x2a/0x200 [ 15.628727] ? mempool_oob_right_helper+0x318/0x380 [ 15.628751] kasan_report+0x141/0x180 [ 15.628773] ? mempool_oob_right_helper+0x318/0x380 [ 15.628802] __asan_report_load1_noabort+0x18/0x20 [ 15.628823] mempool_oob_right_helper+0x318/0x380 [ 15.628848] ? __pfx_mempool_oob_right_helper+0x10/0x10 [ 15.628875] ? __pfx_sched_clock_cpu+0x10/0x10 [ 15.628899] ? irqentry_exit+0x2a/0x60 [ 15.628922] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 15.628949] mempool_kmalloc_oob_right+0xf2/0x150 [ 15.628973] ? __pfx_mempool_kmalloc_oob_right+0x10/0x10 [ 15.629001] ? __pfx_mempool_kmalloc+0x10/0x10 [ 15.629022] ? __pfx_mempool_kfree+0x10/0x10 [ 15.629043] ? __pfx_mempool_kmalloc_oob_right+0x10/0x10 [ 15.629069] ? __pfx_mempool_kmalloc_oob_right+0x10/0x10 [ 15.629094] kunit_try_run_case+0x1a5/0x480 [ 15.629121] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.629142] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 15.629165] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 15.629187] ? __kthread_parkme+0x82/0x180 [ 15.629210] ? preempt_count_sub+0x50/0x80 [ 15.629257] ? __pfx_kunit_try_run_case+0x10/0x10 [ 15.629283] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.629307] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 15.629329] kthread+0x337/0x6f0 [ 15.629349] ? trace_preempt_on+0x20/0xc0 [ 15.629372] ? __pfx_kthread+0x10/0x10 [ 15.629392] ? _raw_spin_unlock_irq+0x47/0x80 [ 15.629414] ? calculate_sigpending+0x7b/0xa0 [ 15.629440] ? __pfx_kthread+0x10/0x10 [ 15.629476] ret_from_fork+0x116/0x1d0 [ 15.629523] ? __pfx_kthread+0x10/0x10 [ 15.629557] ret_from_fork_asm+0x1a/0x30 [ 15.629610] </TASK> [ 15.629630] [ 15.639245] Allocated by task 239: [ 15.639428] kasan_save_stack+0x45/0x70 [ 15.639639] kasan_save_track+0x18/0x40 [ 15.639936] kasan_save_alloc_info+0x3b/0x50 [ 15.640340] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 15.640769] remove_element+0x11e/0x190 [ 15.641071] mempool_alloc_preallocated+0x4d/0x90 [ 15.641318] mempool_oob_right_helper+0x8a/0x380 [ 15.641504] mempool_kmalloc_oob_right+0xf2/0x150 [ 15.641696] kunit_try_run_case+0x1a5/0x480 [ 15.642011] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 15.642395] kthread+0x337/0x6f0 [ 15.642678] ret_from_fork+0x116/0x1d0 [ 15.642940] ret_from_fork_asm+0x1a/0x30 [ 15.643114] [ 15.643414] The buggy address belongs to the object at ffff888102b5b300 [ 15.643414] which belongs to the cache kmalloc-128 of size 128 [ 15.644881] The buggy address is located 0 bytes to the right of [ 15.644881] allocated 115-byte region [ffff888102b5b300, ffff888102b5b373) [ 15.645518] [ 15.645826] The buggy address belongs to the physical page: [ 15.646134] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102b5b [ 15.646780] flags: 0x200000000000000(node=0|zone=2) [ 15.647129] page_type: f5(slab) [ 15.647432] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 15.647732] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 15.647988] page dumped because: kasan: bad access detected [ 15.648187] [ 15.648560] Memory state around the buggy address: [ 15.648925] ffff888102b5b200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 15.649403] ffff888102b5b280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.650416] >ffff888102b5b300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 15.651004] ^ [ 15.651264] ffff888102b5b380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 15.651735] ffff888102b5b400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fc [ 15.652267] ==================================================================