[   36.026346] ==================================================================
[   36.026474] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   36.026586] Free of addr fff00000c77e6501 by task kunit_try_catch/252
[   36.026687] 
[   36.026756] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250624 #1 PREEMPT 
[   36.026970] Tainted: [B]=BAD_PAGE, [N]=TEST
[   36.027038] Hardware name: linux,dummy-virt (DT)
[   36.027169] Call trace:
[   36.027240]  show_stack+0x20/0x38 (C)
[   36.027379]  dump_stack_lvl+0x8c/0xd0
[   36.027542]  print_report+0x118/0x608
[   36.027699]  kasan_report_invalid_free+0xc0/0xe8
[   36.027844]  check_slab_allocation+0xfc/0x108
[   36.027997]  __kasan_mempool_poison_object+0x78/0x150
[   36.028256]  mempool_free+0x28c/0x328
[   36.028478]  mempool_kmalloc_invalid_free_helper+0x118/0x2a8
[   36.028744]  mempool_kmalloc_invalid_free+0xc0/0x118
[   36.028868]  kunit_try_run_case+0x170/0x3f0
[   36.029067]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.029438]  kthread+0x328/0x630
[   36.029719]  ret_from_fork+0x10/0x20
[   36.029931] 
[   36.029980] Allocated by task 252:
[   36.030058]  kasan_save_stack+0x3c/0x68
[   36.030196]  kasan_save_track+0x20/0x40
[   36.030310]  kasan_save_alloc_info+0x40/0x58
[   36.030426]  __kasan_mempool_unpoison_object+0x11c/0x180
[   36.030553]  remove_element+0x130/0x1f8
[   36.030649]  mempool_alloc_preallocated+0x58/0xc0
[   36.030751]  mempool_kmalloc_invalid_free_helper+0x94/0x2a8
[   36.030901]  mempool_kmalloc_invalid_free+0xc0/0x118
[   36.031036]  kunit_try_run_case+0x170/0x3f0
[   36.031155]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   36.031336]  kthread+0x328/0x630
[   36.031651]  ret_from_fork+0x10/0x20
[   36.031841] 
[   36.031915] The buggy address belongs to the object at fff00000c77e6500
[   36.031915]  which belongs to the cache kmalloc-128 of size 128
[   36.032085] The buggy address is located 1 bytes inside of
[   36.032085]  128-byte region [fff00000c77e6500, fff00000c77e6580)
[   36.033219] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)
[   36.034156] page dumped because: kasan: bad access detected
[   36.035472]  fff00000c77e6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.047402] Free of addr fff00000c781c001 by task kunit_try_catch/254
[   36.049753]  mempool_kmalloc_large_invalid_free+0xc0/0x118
[   36.051050] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff)
[   36.051303] page_type: f8(unknown)
[   36.051431] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.051732] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000
[   36.051851] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   36.052109] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   36.052282] 
[   36.052330] Memory state around the buggy address:
[   36.052462]  fff00000c781bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   36.052770] >fff00000c781c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   36.062003]     ok 54 mempool_kmalloc_large_invalid_free
[   36.073823] Read of size 1 at addr ffffac8ac84c668d by task kunit_try_catch/256
[   36.074148] Hardware name: linux,dummy-virt (DT)
[   36.074336]  print_report+0x310/0x608
[   36.074575]  kunit_try_run_case+0x170/0x3f0
[   36.075086]  global_array+0xd/0x40
[   36.075212] 
[   36.075350] The buggy address belongs to the virtual mapping at
[   36.075350]  [ffffac8ac6660000, ffffac8ac8581000) created by:
[   36.075350]  paging_init+0x66c/0x7d0
[   36.075544] 
[   36.075809] The buggy address belongs to the physical page:
[   36.075909] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x47cc6
[   36.076045] flags: 0x3fffe0000002000(reserved|node=0|zone=0|lastcpupid=0x1ffff)
[   36.109468] ==================================================================

[   31.319854] ==================================================================
[   31.320613] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.321159] Free of addr ffff888102df6201 by task kunit_try_catch/271
[   31.321735] 
[   31.321985] CPU: 0 UID: 0 PID: 271 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) 
[   31.322103] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.322136] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   31.322181] Call Trace:
[   31.322210]  <TASK>
[   31.322250]  dump_stack_lvl+0x73/0xb0
[   31.322329]  print_report+0xd1/0x650
[   31.322392]  ? __virt_addr_valid+0x1db/0x2d0
[   31.322463]  ? kasan_complete_mode_report_info+0x2a/0x200
[   31.322534]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.322759]  kasan_report_invalid_free+0x10a/0x130
[   31.322856]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.322933]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.322998]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.323060]  check_slab_allocation+0x11f/0x130
[   31.323135]  __kasan_mempool_poison_object+0x91/0x1d0
[   31.323215]  mempool_free+0x2ec/0x380
[   31.323280]  mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.323338]  ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10
[   31.323377]  ? __pfx_sched_clock_cpu+0x10/0x10
[   31.323410]  ? finish_task_switch.isra.0+0x153/0x700
[   31.323508]  mempool_kmalloc_invalid_free+0xed/0x140
[   31.323580]  ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10
[   31.323641]  ? __pfx_mempool_kmalloc+0x10/0x10
[   31.323691]  ? __pfx_mempool_kfree+0x10/0x10
[   31.323748]  ? __pfx_read_tsc+0x10/0x10
[   31.323798]  ? ktime_get_ts64+0x86/0x230
[   31.323878]  kunit_try_run_case+0x1a5/0x480
[   31.323923]  ? __pfx_kunit_try_run_case+0x10/0x10
[   31.323955]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   31.323991]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   31.324023]  ? __kthread_parkme+0x82/0x180
[   31.324052]  ? preempt_count_sub+0x50/0x80
[   31.324109]  ? __pfx_kunit_try_run_case+0x10/0x10
[   31.324167]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   31.324234]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   31.324270]  kthread+0x337/0x6f0
[   31.324298]  ? trace_preempt_on+0x20/0xc0
[   31.324333]  ? __pfx_kthread+0x10/0x10
[   31.324361]  ? _raw_spin_unlock_irq+0x47/0x80
[   31.324392]  ? calculate_sigpending+0x7b/0xa0
[   31.324424]  ? __pfx_kthread+0x10/0x10
[   31.324453]  ret_from_fork+0x116/0x1d0
[   31.324480]  ? __pfx_kthread+0x10/0x10
[   31.324507]  ret_from_fork_asm+0x1a/0x30
[   31.324571]  </TASK>
[   31.324588] 
[   31.346963] Allocated by task 271:
[   31.347163]  kasan_save_stack+0x45/0x70
[   31.348142]  kasan_save_track+0x18/0x40
[   31.348623]  kasan_save_alloc_info+0x3b/0x50
[   31.349117]  __kasan_mempool_unpoison_object+0x1a9/0x200
[   31.350108]  remove_element+0x11e/0x190
[   31.350407]  mempool_alloc_preallocated+0x4d/0x90
[   31.351006]  mempool_kmalloc_invalid_free_helper+0x83/0x2e0
[   31.351496]  mempool_kmalloc_invalid_free+0xed/0x140
[   31.352234]  kunit_try_run_case+0x1a5/0x480
[   31.352590]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   31.352981]  kthread+0x337/0x6f0
[   31.353245]  ret_from_fork+0x116/0x1d0
[   31.353514]  ret_from_fork_asm+0x1a/0x30
[   31.354857] 
[   31.355068] The buggy address belongs to the object at ffff888102df6200
[   31.355068]  which belongs to the cache kmalloc-128 of size 128
[   31.355851] The buggy address is located 1 bytes inside of
[   31.355851]  128-byte region [ffff888102df6200, ffff888102df6280)
[   31.356801] 
[   31.357026] The buggy address belongs to the physical page:
[   31.357480] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102df6
[   31.358027] flags: 0x200000000000000(node=0|zone=2)
[   31.358661] page_type: f5(slab)
[   31.359003] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000
[   31.359897] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[   31.360473] page dumped because: kasan: bad access detected
[   31.361439] 
[   31.361621] Memory state around the buggy address:
[   31.362232]  ffff888102df6100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   31.362747]  ffff888102df6180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.363410] >ffff888102df6200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   31.364050]                    ^
[   31.364835]  ffff888102df6280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   31.365454]  ffff888102df6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   31.366020] ==================================================================
[   31.372508] ==================================================================
[   31.373580] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.374405] Free of addr ffff888103be0001 by task kunit_try_catch/273
[   31.375257] 
[   31.375425] CPU: 1 UID: 0 PID: 273 Comm: kunit_try_catch Tainted: G    B            N  6.16.0-rc3-next-20250624 #1 PREEMPT(voluntary) 
[   31.375561] Tainted: [B]=BAD_PAGE, [N]=TEST
[   31.375596] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   31.376019] Call Trace:
[   31.376058]  <TASK>
[   31.376116]  dump_stack_lvl+0x73/0xb0
[   31.376194]  print_report+0xd1/0x650
[   31.376230]  ? __virt_addr_valid+0x1db/0x2d0
[   31.376267]  ? kasan_addr_to_slab+0x11/0xa0
[   31.376295]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.376329]  kasan_report_invalid_free+0x10a/0x130
[   31.376361]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.376397]  ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.376429]  __kasan_mempool_poison_object+0x102/0x1d0
[   31.376461]  mempool_free+0x2ec/0x380
[   31.376495]  mempool_kmalloc_invalid_free_helper+0x132/0x2e0
[   31.376528]  ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10
[   31.376586]  ? __pfx_sched_clock_cpu+0x10/0x10
[   31.376618]  ? finish_task_switch.isra.0+0x153/0x700
[   31.376688]  mempool_kmalloc_large_invalid_free+0xed/0x140
[   31.376723]  ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10
[   31.376758]  ? __pfx_mempool_kmalloc+0x10/0x10
[   31.376788]  ? __pfx_mempool_kfree+0x10/0x10
[   31.376820]  ? __pfx_read_tsc+0x10/0x10
[   31.376849]  ? ktime_get_ts64+0x86/0x230
[   31.376883]  kunit_try_run_case+0x1a5/0x480
[   31.376917]  ? __pfx_kunit_try_run_case+0x10/0x10
[   31.376947]  ? _raw_spin_lock_irqsave+0xa1/0x100
[   31.376981]  ? _raw_spin_unlock_irqrestore+0x5f/0x90
[   31.377013]  ? __kthread_parkme+0x82/0x180
[   31.377039]  ? preempt_count_sub+0x50/0x80
[   31.377087]  ? __pfx_kunit_try_run_case+0x10/0x10
[   31.377142]  kunit_generic_run_threadfn_adapter+0x85/0xf0
[   31.377195]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[   31.377249]  kthread+0x337/0x6f0
[   31.377295]  ? trace_preempt_on+0x20/0xc0
[   31.377346]  ? __pfx_kthread+0x10/0x10
[   31.377395]  ? _raw_spin_unlock_irq+0x47/0x80
[   31.377434]  ? calculate_sigpending+0x7b/0xa0
[   31.377468]  ? __pfx_kthread+0x10/0x10
[   31.377497]  ret_from_fork+0x116/0x1d0
[   31.377523]  ? __pfx_kthread+0x10/0x10
[   31.377576]  ret_from_fork_asm+0x1a/0x30
[   31.377618]  </TASK>
[   31.377638] 
[   31.396399] The buggy address belongs to the physical page:
[   31.397075] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103be0
[   31.398080] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   31.398847] flags: 0x200000000000040(head|node=0|zone=2)
[   31.399318] page_type: f8(unknown)
[   31.399641] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   31.400154] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   31.400855] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000
[   31.401275] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000
[   31.402580] head: 0200000000000002 ffffea00040ef801 00000000ffffffff 00000000ffffffff
[   31.402991] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   31.403892] page dumped because: kasan: bad access detected
[   31.404483] 
[   31.404744] Memory state around the buggy address:
[   31.405209]  ffff888103bdff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.405976]  ffff888103bdff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   31.406689] >ffff888103be0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   31.407134]                    ^
[   31.407473]  ffff888103be0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   31.408602]  ffff888103be0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   31.409189] ==================================================================