Date
June 16, 2025, 7:07 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 22.082851] ================================================================== [ 22.083005] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 22.083107] Free of addr fff00000c78d8001 by task kunit_try_catch/252 [ 22.083468] [ 22.083580] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 22.083699] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.084001] Hardware name: linux,dummy-virt (DT) [ 22.084056] Call trace: [ 22.084309] show_stack+0x20/0x38 (C) [ 22.084414] dump_stack_lvl+0x8c/0xd0 [ 22.084485] print_report+0x118/0x608 [ 22.084681] kasan_report_invalid_free+0xc0/0xe8 [ 22.084901] __kasan_mempool_poison_object+0xfc/0x150 [ 22.085021] mempool_free+0x28c/0x328 [ 22.085081] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 22.085142] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 22.085535] kunit_try_run_case+0x170/0x3f0 [ 22.085623] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.085739] kthread+0x328/0x630 [ 22.085833] ret_from_fork+0x10/0x20 [ 22.085974] [ 22.086070] The buggy address belongs to the physical page: [ 22.086400] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1078d8 [ 22.086520] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 22.086587] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 22.086702] page_type: f8(unknown) [ 22.086779] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.086874] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 22.087216] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 22.087518] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 22.087626] head: 0bfffe0000000002 ffffc1ffc31e3601 00000000ffffffff 00000000ffffffff [ 22.087757] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 22.087915] page dumped because: kasan: bad access detected [ 22.087959] [ 22.087990] Memory state around the buggy address: [ 22.088048] fff00000c78d7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.088102] fff00000c78d7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.088492] >fff00000c78d8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.088618] ^ [ 22.088664] fff00000c78d8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.088904] fff00000c78d8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.089081] ================================================================== [ 22.059622] ================================================================== [ 22.059718] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 22.059808] Free of addr fff00000c6587201 by task kunit_try_catch/250 [ 22.060739] [ 22.060996] CPU: 0 UID: 0 PID: 250 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT [ 22.061166] Tainted: [B]=BAD_PAGE, [N]=TEST [ 22.061204] Hardware name: linux,dummy-virt (DT) [ 22.061244] Call trace: [ 22.061276] show_stack+0x20/0x38 (C) [ 22.061352] dump_stack_lvl+0x8c/0xd0 [ 22.061441] print_report+0x118/0x608 [ 22.061502] kasan_report_invalid_free+0xc0/0xe8 [ 22.061561] check_slab_allocation+0xfc/0x108 [ 22.061703] __kasan_mempool_poison_object+0x78/0x150 [ 22.061767] mempool_free+0x28c/0x328 [ 22.061842] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 22.062052] mempool_kmalloc_invalid_free+0xc0/0x118 [ 22.062130] kunit_try_run_case+0x170/0x3f0 [ 22.062195] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.062271] kthread+0x328/0x630 [ 22.062414] ret_from_fork+0x10/0x20 [ 22.062486] [ 22.062511] Allocated by task 250: [ 22.062552] kasan_save_stack+0x3c/0x68 [ 22.062604] kasan_save_track+0x20/0x40 [ 22.062652] kasan_save_alloc_info+0x40/0x58 [ 22.062695] __kasan_mempool_unpoison_object+0x11c/0x180 [ 22.062747] remove_element+0x130/0x1f8 [ 22.062789] mempool_alloc_preallocated+0x58/0xc0 [ 22.062992] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 22.063176] mempool_kmalloc_invalid_free+0xc0/0x118 [ 22.063311] kunit_try_run_case+0x170/0x3f0 [ 22.063490] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 22.063555] kthread+0x328/0x630 [ 22.063599] ret_from_fork+0x10/0x20 [ 22.063643] [ 22.063671] The buggy address belongs to the object at fff00000c6587200 [ 22.063671] which belongs to the cache kmalloc-128 of size 128 [ 22.063740] The buggy address is located 1 bytes inside of [ 22.063740] 128-byte region [fff00000c6587200, fff00000c6587280) [ 22.063810] [ 22.064055] The buggy address belongs to the physical page: [ 22.064248] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106587 [ 22.064324] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 22.064725] page_type: f5(slab) [ 22.064922] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 22.065012] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 22.065066] page dumped because: kasan: bad access detected [ 22.065113] [ 22.065259] Memory state around the buggy address: [ 22.065492] fff00000c6587100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.065656] fff00000c6587180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.065910] >fff00000c6587200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.066077] ^ [ 22.066125] fff00000c6587280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.066187] fff00000c6587300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.066236] ==================================================================
[ 13.251784] ================================================================== [ 13.252207] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.252482] Free of addr ffff888103a0c001 by task kunit_try_catch/268 [ 13.252892] [ 13.253453] CPU: 0 UID: 0 PID: 268 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 13.253508] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.253520] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.253542] Call Trace: [ 13.253555] <TASK> [ 13.253574] dump_stack_lvl+0x73/0xb0 [ 13.253719] print_report+0xd1/0x650 [ 13.253743] ? __virt_addr_valid+0x1db/0x2d0 [ 13.253768] ? kasan_addr_to_slab+0x11/0xa0 [ 13.253789] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.253815] kasan_report_invalid_free+0x10a/0x130 [ 13.253838] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.253865] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.253888] __kasan_mempool_poison_object+0x102/0x1d0 [ 13.253912] mempool_free+0x2ec/0x380 [ 13.253952] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.253977] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 13.254004] ? __kasan_check_write+0x18/0x20 [ 13.254023] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.254045] ? finish_task_switch.isra.0+0x153/0x700 [ 13.254072] mempool_kmalloc_large_invalid_free+0xed/0x140 [ 13.254096] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 13.254122] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.254144] ? __pfx_mempool_kfree+0x10/0x10 [ 13.254168] ? __pfx_read_tsc+0x10/0x10 [ 13.254189] ? ktime_get_ts64+0x86/0x230 [ 13.254213] kunit_try_run_case+0x1a5/0x480 [ 13.254237] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.254258] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.254280] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.254302] ? __kthread_parkme+0x82/0x180 [ 13.254323] ? preempt_count_sub+0x50/0x80 [ 13.254345] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.254368] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.254389] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.254515] kthread+0x337/0x6f0 [ 13.254536] ? trace_preempt_on+0x20/0xc0 [ 13.254561] ? __pfx_kthread+0x10/0x10 [ 13.254582] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.254602] ? calculate_sigpending+0x7b/0xa0 [ 13.254627] ? __pfx_kthread+0x10/0x10 [ 13.254648] ret_from_fork+0x116/0x1d0 [ 13.254666] ? __pfx_kthread+0x10/0x10 [ 13.254686] ret_from_fork_asm+0x1a/0x30 [ 13.254717] </TASK> [ 13.254729] [ 13.266274] The buggy address belongs to the physical page: [ 13.266843] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a0c [ 13.267350] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.267919] flags: 0x200000000000040(head|node=0|zone=2) [ 13.268354] page_type: f8(unknown) [ 13.268663] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.268991] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.269290] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.269916] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.270587] head: 0200000000000002 ffffea00040e8301 00000000ffffffff 00000000ffffffff [ 13.271113] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 13.271771] page dumped because: kasan: bad access detected [ 13.272126] [ 13.272220] Memory state around the buggy address: [ 13.272658] ffff888103a0bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.273028] ffff888103a0bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.273310] >ffff888103a0c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.274068] ^ [ 13.274300] ffff888103a0c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.274874] ffff888103a0c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.275378] ================================================================== [ 13.211750] ================================================================== [ 13.212165] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.212586] Free of addr ffff8881028e2d01 by task kunit_try_catch/266 [ 13.213669] [ 13.213990] CPU: 1 UID: 0 PID: 266 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc2-next-20250616 #1 PREEMPT(voluntary) [ 13.214116] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.214131] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.214153] Call Trace: [ 13.214166] <TASK> [ 13.214183] dump_stack_lvl+0x73/0xb0 [ 13.214216] print_report+0xd1/0x650 [ 13.214238] ? __virt_addr_valid+0x1db/0x2d0 [ 13.214262] ? kasan_complete_mode_report_info+0x2a/0x200 [ 13.214283] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.214308] kasan_report_invalid_free+0x10a/0x130 [ 13.214332] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.214357] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.214421] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.214445] check_slab_allocation+0x11f/0x130 [ 13.214466] __kasan_mempool_poison_object+0x91/0x1d0 [ 13.214489] mempool_free+0x2ec/0x380 [ 13.214516] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 13.214540] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 13.214565] ? __kasan_check_write+0x18/0x20 [ 13.214584] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.214605] ? irqentry_exit+0x2a/0x60 [ 13.214626] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 13.214651] mempool_kmalloc_invalid_free+0xed/0x140 [ 13.214673] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 13.214699] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.214723] ? __pfx_mempool_kfree+0x10/0x10 [ 13.214746] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 13.214771] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 13.214796] kunit_try_run_case+0x1a5/0x480 [ 13.214821] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.214842] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.214864] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.214885] ? __kthread_parkme+0x82/0x180 [ 13.214906] ? preempt_count_sub+0x50/0x80 [ 13.214942] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.214966] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.214988] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.215009] kthread+0x337/0x6f0 [ 13.215028] ? trace_preempt_on+0x20/0xc0 [ 13.215052] ? __pfx_kthread+0x10/0x10 [ 13.215072] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.215091] ? calculate_sigpending+0x7b/0xa0 [ 13.215115] ? __pfx_kthread+0x10/0x10 [ 13.215136] ret_from_fork+0x116/0x1d0 [ 13.215155] ? __pfx_kthread+0x10/0x10 [ 13.215174] ret_from_fork_asm+0x1a/0x30 [ 13.215205] </TASK> [ 13.215217] [ 13.234443] Allocated by task 266: [ 13.234870] kasan_save_stack+0x45/0x70 [ 13.235168] kasan_save_track+0x18/0x40 [ 13.235370] kasan_save_alloc_info+0x3b/0x50 [ 13.235783] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 13.236165] remove_element+0x11e/0x190 [ 13.236462] mempool_alloc_preallocated+0x4d/0x90 [ 13.236770] mempool_kmalloc_invalid_free_helper+0x83/0x2e0 [ 13.237415] mempool_kmalloc_invalid_free+0xed/0x140 [ 13.237579] kunit_try_run_case+0x1a5/0x480 [ 13.237879] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.238533] kthread+0x337/0x6f0 [ 13.238827] ret_from_fork+0x116/0x1d0 [ 13.239176] ret_from_fork_asm+0x1a/0x30 [ 13.239545] [ 13.239703] The buggy address belongs to the object at ffff8881028e2d00 [ 13.239703] which belongs to the cache kmalloc-128 of size 128 [ 13.240634] The buggy address is located 1 bytes inside of [ 13.240634] 128-byte region [ffff8881028e2d00, ffff8881028e2d80) [ 13.241530] [ 13.241603] The buggy address belongs to the physical page: [ 13.241776] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1028e2 [ 13.242022] flags: 0x200000000000000(node=0|zone=2) [ 13.242189] page_type: f5(slab) [ 13.242307] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.242527] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.242743] page dumped because: kasan: bad access detected [ 13.242904] [ 13.243113] Memory state around the buggy address: [ 13.243560] ffff8881028e2c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.244335] ffff8881028e2c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.245014] >ffff8881028e2d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.245723] ^ [ 13.246057] ffff8881028e2d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.246708] ffff8881028e2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.247520] ==================================================================