Date
June 25, 2025, 8:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 28.809079] ================================================================== [ 28.809132] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 28.809188] Free of addr fff00000c79f4001 by task kunit_try_catch/255 [ 28.809367] [ 28.809548] CPU: 0 UID: 0 PID: 255 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 28.809690] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.809767] Hardware name: linux,dummy-virt (DT) [ 28.809799] Call trace: [ 28.809829] show_stack+0x20/0x38 (C) [ 28.809879] dump_stack_lvl+0x8c/0xd0 [ 28.809926] print_report+0x118/0x608 [ 28.809970] kasan_report_invalid_free+0xc0/0xe8 [ 28.810028] __kasan_mempool_poison_object+0xfc/0x150 [ 28.810080] mempool_free+0x28c/0x328 [ 28.810122] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 28.810173] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 28.810243] kunit_try_run_case+0x170/0x3f0 [ 28.810290] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 28.810342] kthread+0x328/0x630 [ 28.810387] ret_from_fork+0x10/0x20 [ 28.810443] [ 28.810462] The buggy address belongs to the physical page: [ 28.810493] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079f4 [ 28.810544] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 28.810590] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 28.810641] page_type: f8(unknown) [ 28.810679] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 28.810726] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 28.810774] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 28.810820] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 28.810868] head: 0bfffe0000000002 ffffc1ffc31e7d01 00000000ffffffff 00000000ffffffff [ 28.810914] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 28.810954] page dumped because: kasan: bad access detected [ 28.810983] [ 28.811008] Memory state around the buggy address: [ 28.811039] fff00000c79f3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 28.811082] fff00000c79f3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 28.811131] >fff00000c79f4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.811175] ^ [ 28.811202] fff00000c79f4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.811246] fff00000c79f4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.811292] ================================================================== [ 28.794087] ================================================================== [ 28.794146] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 28.794203] Free of addr fff00000c786a801 by task kunit_try_catch/253 [ 28.794245] [ 28.794717] CPU: 0 UID: 0 PID: 253 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT [ 28.795277] Tainted: [B]=BAD_PAGE, [N]=TEST [ 28.795447] Hardware name: linux,dummy-virt (DT) [ 28.795606] Call trace: [ 28.795628] show_stack+0x20/0x38 (C) [ 28.795682] dump_stack_lvl+0x8c/0xd0 [ 28.796074] print_report+0x118/0x608 [ 28.796706] kasan_report_invalid_free+0xc0/0xe8 [ 28.797173] check_slab_allocation+0xfc/0x108 [ 28.797623] __kasan_mempool_poison_object+0x78/0x150 [ 28.797687] mempool_free+0x28c/0x328 [ 28.797736] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 28.797792] mempool_kmalloc_invalid_free+0xc0/0x118 [ 28.797844] kunit_try_run_case+0x170/0x3f0 [ 28.797891] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 28.797945] kthread+0x328/0x630 [ 28.799670] ret_from_fork+0x10/0x20 [ 28.799734] [ 28.799753] Allocated by task 253: [ 28.799791] kasan_save_stack+0x3c/0x68 [ 28.799833] kasan_save_track+0x20/0x40 [ 28.799878] kasan_save_alloc_info+0x40/0x58 [ 28.799914] __kasan_mempool_unpoison_object+0x11c/0x180 [ 28.800836] remove_element+0x130/0x1f8 [ 28.800888] mempool_alloc_preallocated+0x58/0xc0 [ 28.800929] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 28.800974] mempool_kmalloc_invalid_free+0xc0/0x118 [ 28.801014] kunit_try_run_case+0x170/0x3f0 [ 28.801053] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 28.801096] kthread+0x328/0x630 [ 28.801127] ret_from_fork+0x10/0x20 [ 28.801161] [ 28.801183] The buggy address belongs to the object at fff00000c786a800 [ 28.801183] which belongs to the cache kmalloc-128 of size 128 [ 28.803412] The buggy address is located 1 bytes inside of [ 28.803412] 128-byte region [fff00000c786a800, fff00000c786a880) [ 28.803482] [ 28.803501] The buggy address belongs to the physical page: [ 28.803533] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10786a [ 28.803584] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 28.803633] page_type: f5(slab) [ 28.803670] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 28.803719] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 28.803759] page dumped because: kasan: bad access detected [ 28.803788] [ 28.803807] Memory state around the buggy address: [ 28.803836] fff00000c786a700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.803889] fff00000c786a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.803932] >fff00000c786a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.803968] ^ [ 28.803996] fff00000c786a880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.804038] fff00000c786a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.804076] ==================================================================
[ 23.597785] ================================================================== [ 23.598244] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.598612] Free of addr ffff88810396c001 by task kunit_try_catch/272 [ 23.598855] [ 23.598953] CPU: 1 UID: 0 PID: 272 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 23.599002] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.599015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.599036] Call Trace: [ 23.599048] <TASK> [ 23.599064] dump_stack_lvl+0x73/0xb0 [ 23.599090] print_report+0xd1/0x650 [ 23.599110] ? __virt_addr_valid+0x1db/0x2d0 [ 23.599133] ? kasan_addr_to_slab+0x11/0xa0 [ 23.599151] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.599176] kasan_report_invalid_free+0x10a/0x130 [ 23.599198] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.599223] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.599245] __kasan_mempool_poison_object+0x102/0x1d0 [ 23.599268] mempool_free+0x2ec/0x380 [ 23.599292] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.599315] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 23.599337] ? update_load_avg+0x1be/0x21b0 [ 23.599376] ? finish_task_switch.isra.0+0x153/0x700 [ 23.599402] mempool_kmalloc_large_invalid_free+0xed/0x140 [ 23.599424] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 23.599469] ? __pfx_mempool_kmalloc+0x10/0x10 [ 23.599490] ? __pfx_mempool_kfree+0x10/0x10 [ 23.599513] ? __pfx_read_tsc+0x10/0x10 [ 23.599534] ? ktime_get_ts64+0x86/0x230 [ 23.599557] kunit_try_run_case+0x1a5/0x480 [ 23.599582] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.599604] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.599625] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.599649] ? __kthread_parkme+0x82/0x180 [ 23.599668] ? preempt_count_sub+0x50/0x80 [ 23.599689] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.599712] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.599734] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.599756] kthread+0x337/0x6f0 [ 23.599775] ? trace_preempt_on+0x20/0xc0 [ 23.599796] ? __pfx_kthread+0x10/0x10 [ 23.599826] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.599848] ? calculate_sigpending+0x7b/0xa0 [ 23.599869] ? __pfx_kthread+0x10/0x10 [ 23.599889] ret_from_fork+0x116/0x1d0 [ 23.599907] ? __pfx_kthread+0x10/0x10 [ 23.599925] ret_from_fork_asm+0x1a/0x30 [ 23.599962] </TASK> [ 23.599974] [ 23.608548] The buggy address belongs to the physical page: [ 23.608984] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10396c [ 23.609618] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 23.609908] flags: 0x200000000000040(head|node=0|zone=2) [ 23.610085] page_type: f8(unknown) [ 23.610204] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 23.610618] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 23.611351] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 23.611762] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 23.612183] head: 0200000000000002 ffffea00040e5b01 00000000ffffffff 00000000ffffffff [ 23.612493] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 23.612797] page dumped because: kasan: bad access detected [ 23.613015] [ 23.613082] Memory state around the buggy address: [ 23.613229] ffff88810396bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 23.613644] ffff88810396bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 23.613971] >ffff88810396c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.614253] ^ [ 23.614365] ffff88810396c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.614688] ffff88810396c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.615348] ================================================================== [ 23.567167] ================================================================== [ 23.567750] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.568443] Free of addr ffff8881039c3a01 by task kunit_try_catch/270 [ 23.568857] [ 23.568965] CPU: 1 UID: 0 PID: 270 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc3-next-20250625 #1 PREEMPT(voluntary) [ 23.569016] Tainted: [B]=BAD_PAGE, [N]=TEST [ 23.569029] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 23.569049] Call Trace: [ 23.569063] <TASK> [ 23.569316] dump_stack_lvl+0x73/0xb0 [ 23.569348] print_report+0xd1/0x650 [ 23.569368] ? __virt_addr_valid+0x1db/0x2d0 [ 23.569393] ? kasan_complete_mode_report_info+0x2a/0x200 [ 23.569418] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.569442] kasan_report_invalid_free+0x10a/0x130 [ 23.569464] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.569489] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.569511] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.569534] check_slab_allocation+0x11f/0x130 [ 23.569554] __kasan_mempool_poison_object+0x91/0x1d0 [ 23.569576] mempool_free+0x2ec/0x380 [ 23.569601] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 23.569624] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 23.569647] ? update_load_avg+0x1be/0x21b0 [ 23.569673] ? finish_task_switch.isra.0+0x153/0x700 [ 23.569698] mempool_kmalloc_invalid_free+0xed/0x140 [ 23.569719] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 23.569743] ? __pfx_mempool_kmalloc+0x10/0x10 [ 23.569764] ? __pfx_mempool_kfree+0x10/0x10 [ 23.569787] ? __pfx_read_tsc+0x10/0x10 [ 23.569823] ? ktime_get_ts64+0x86/0x230 [ 23.569847] kunit_try_run_case+0x1a5/0x480 [ 23.569871] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.569893] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 23.569913] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 23.569949] ? __kthread_parkme+0x82/0x180 [ 23.569968] ? preempt_count_sub+0x50/0x80 [ 23.569990] ? __pfx_kunit_try_run_case+0x10/0x10 [ 23.570012] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.570034] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 23.570057] kthread+0x337/0x6f0 [ 23.570075] ? trace_preempt_on+0x20/0xc0 [ 23.570097] ? __pfx_kthread+0x10/0x10 [ 23.570116] ? _raw_spin_unlock_irq+0x47/0x80 [ 23.570139] ? calculate_sigpending+0x7b/0xa0 [ 23.570161] ? __pfx_kthread+0x10/0x10 [ 23.570180] ret_from_fork+0x116/0x1d0 [ 23.570198] ? __pfx_kthread+0x10/0x10 [ 23.570217] ret_from_fork_asm+0x1a/0x30 [ 23.570246] </TASK> [ 23.570256] [ 23.582416] Allocated by task 270: [ 23.582610] kasan_save_stack+0x45/0x70 [ 23.582783] kasan_save_track+0x18/0x40 [ 23.583262] kasan_save_alloc_info+0x3b/0x50 [ 23.583441] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 23.583677] remove_element+0x11e/0x190 [ 23.583841] mempool_alloc_preallocated+0x4d/0x90 [ 23.584448] mempool_kmalloc_invalid_free_helper+0x83/0x2e0 [ 23.584683] mempool_kmalloc_invalid_free+0xed/0x140 [ 23.585024] kunit_try_run_case+0x1a5/0x480 [ 23.585324] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 23.585538] kthread+0x337/0x6f0 [ 23.585769] ret_from_fork+0x116/0x1d0 [ 23.585902] ret_from_fork_asm+0x1a/0x30 [ 23.586256] [ 23.586349] The buggy address belongs to the object at ffff8881039c3a00 [ 23.586349] which belongs to the cache kmalloc-128 of size 128 [ 23.586810] The buggy address is located 1 bytes inside of [ 23.586810] 128-byte region [ffff8881039c3a00, ffff8881039c3a80) [ 23.587503] [ 23.587601] The buggy address belongs to the physical page: [ 23.588133] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c3 [ 23.588539] flags: 0x200000000000000(node=0|zone=2) [ 23.588711] page_type: f5(slab) [ 23.588949] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 23.589559] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 23.590006] page dumped because: kasan: bad access detected [ 23.590305] [ 23.590378] Memory state around the buggy address: [ 23.590575] ffff8881039c3900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.590854] ffff8881039c3980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.591455] >ffff8881039c3a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.591803] ^ [ 23.592005] ffff8881039c3a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.592489] ffff8881039c3b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.592782] ==================================================================