Date
July 8, 2025, 11:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 33.389961] ================================================================== [ 33.390025] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 33.390279] Free of addr fff00000c9adf701 by task kunit_try_catch/272 [ 33.390356] [ 33.390478] CPU: 0 UID: 0 PID: 272 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.390573] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.390601] Hardware name: linux,dummy-virt (DT) [ 33.390700] Call trace: [ 33.390727] show_stack+0x20/0x38 (C) [ 33.390809] dump_stack_lvl+0x8c/0xd0 [ 33.390975] print_report+0x118/0x5d0 [ 33.391031] kasan_report_invalid_free+0xc0/0xe8 [ 33.391134] check_slab_allocation+0xfc/0x108 [ 33.391185] __kasan_mempool_poison_object+0x78/0x150 [ 33.391256] mempool_free+0x28c/0x328 [ 33.391500] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 33.391717] mempool_kmalloc_invalid_free+0xc0/0x118 [ 33.391781] kunit_try_run_case+0x170/0x3f0 [ 33.391906] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.391997] kthread+0x328/0x630 [ 33.392041] ret_from_fork+0x10/0x20 [ 33.392255] [ 33.392273] Allocated by task 272: [ 33.392413] kasan_save_stack+0x3c/0x68 [ 33.392467] kasan_save_track+0x20/0x40 [ 33.392507] kasan_save_alloc_info+0x40/0x58 [ 33.392697] __kasan_mempool_unpoison_object+0x11c/0x180 [ 33.392799] remove_element+0x130/0x1f8 [ 33.393017] mempool_alloc_preallocated+0x58/0xc0 [ 33.393122] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 33.393195] mempool_kmalloc_invalid_free+0xc0/0x118 [ 33.393335] kunit_try_run_case+0x170/0x3f0 [ 33.393394] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.393463] kthread+0x328/0x630 [ 33.393592] ret_from_fork+0x10/0x20 [ 33.393656] [ 33.393805] The buggy address belongs to the object at fff00000c9adf700 [ 33.393805] which belongs to the cache kmalloc-128 of size 128 [ 33.393966] The buggy address is located 1 bytes inside of [ 33.393966] 128-byte region [fff00000c9adf700, fff00000c9adf780) [ 33.394061] [ 33.394082] The buggy address belongs to the physical page: [ 33.394227] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109adf [ 33.394291] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 33.394343] page_type: f5(slab) [ 33.394450] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 33.394520] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 33.394561] page dumped because: kasan: bad access detected [ 33.394590] [ 33.394618] Memory state around the buggy address: [ 33.394651] fff00000c9adf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.394695] fff00000c9adf680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.394753] >fff00000c9adf700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.394809] ^ [ 33.394845] fff00000c9adf780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.394888] fff00000c9adf800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.394936] ================================================================== [ 33.405163] ================================================================== [ 33.405273] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 33.405349] Free of addr fff00000c9b94001 by task kunit_try_catch/274 [ 33.405470] [ 33.405570] CPU: 0 UID: 0 PID: 274 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT [ 33.405709] Tainted: [B]=BAD_PAGE, [N]=TEST [ 33.405778] Hardware name: linux,dummy-virt (DT) [ 33.405839] Call trace: [ 33.405871] show_stack+0x20/0x38 (C) [ 33.406052] dump_stack_lvl+0x8c/0xd0 [ 33.406107] print_report+0x118/0x5d0 [ 33.406286] kasan_report_invalid_free+0xc0/0xe8 [ 33.406554] __kasan_mempool_poison_object+0xfc/0x150 [ 33.406660] mempool_free+0x28c/0x328 [ 33.406770] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 33.406858] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 33.407015] kunit_try_run_case+0x170/0x3f0 [ 33.407097] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 33.407205] kthread+0x328/0x630 [ 33.407287] ret_from_fork+0x10/0x20 [ 33.407394] [ 33.407444] The buggy address belongs to the physical page: [ 33.407515] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b94 [ 33.407613] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 33.407685] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 33.407821] page_type: f8(unknown) [ 33.407874] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.407950] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 33.408255] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 33.408324] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 33.408425] head: 0bfffe0000000002 ffffc1ffc326e501 00000000ffffffff 00000000ffffffff [ 33.408485] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 33.408525] page dumped because: kasan: bad access detected [ 33.408852] [ 33.408899] Memory state around the buggy address: [ 33.409012] fff00000c9b93f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.409091] fff00000c9b93f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 33.409180] >fff00000c9b94000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.409254] ^ [ 33.409311] fff00000c9b94080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.409481] fff00000c9b94100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.409574] ==================================================================
[ 25.154403] ================================================================== [ 25.155218] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.155596] Free of addr ffff8881063d8001 by task kunit_try_catch/291 [ 25.155875] [ 25.156098] CPU: 0 UID: 0 PID: 291 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 25.156154] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.156166] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.156190] Call Trace: [ 25.156205] <TASK> [ 25.156225] dump_stack_lvl+0x73/0xb0 [ 25.156272] print_report+0xd1/0x610 [ 25.156295] ? __virt_addr_valid+0x1db/0x2d0 [ 25.156321] ? kasan_addr_to_slab+0x11/0xa0 [ 25.156341] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.156368] kasan_report_invalid_free+0x10a/0x130 [ 25.156393] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.156423] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.156448] __kasan_mempool_poison_object+0x102/0x1d0 [ 25.156688] mempool_free+0x2ec/0x380 [ 25.156719] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.156760] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 25.156792] ? finish_task_switch.isra.0+0x153/0x700 [ 25.156819] mempool_kmalloc_large_invalid_free+0xed/0x140 [ 25.156846] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 25.156875] ? __pfx_mempool_kmalloc+0x10/0x10 [ 25.156900] ? __pfx_mempool_kfree+0x10/0x10 [ 25.156928] ? __pfx_read_tsc+0x10/0x10 [ 25.156953] ? ktime_get_ts64+0x86/0x230 [ 25.156981] kunit_try_run_case+0x1a5/0x480 [ 25.157005] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.157026] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.157048] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.157079] ? __kthread_parkme+0x82/0x180 [ 25.157101] ? preempt_count_sub+0x50/0x80 [ 25.157125] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.157147] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.157175] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.157209] kthread+0x337/0x6f0 [ 25.157231] ? trace_preempt_on+0x20/0xc0 [ 25.157269] ? __pfx_kthread+0x10/0x10 [ 25.157293] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.157319] ? calculate_sigpending+0x7b/0xa0 [ 25.157347] ? __pfx_kthread+0x10/0x10 [ 25.157371] ret_from_fork+0x116/0x1d0 [ 25.157391] ? __pfx_kthread+0x10/0x10 [ 25.157414] ret_from_fork_asm+0x1a/0x30 [ 25.157449] </TASK> [ 25.157460] [ 25.169485] The buggy address belongs to the physical page: [ 25.169858] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1063d8 [ 25.170367] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 25.170687] flags: 0x200000000000040(head|node=0|zone=2) [ 25.171263] page_type: f8(unknown) [ 25.171421] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.171937] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.172391] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 25.172863] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 25.173294] head: 0200000000000002 ffffea000418f601 00000000ffffffff 00000000ffffffff [ 25.173689] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 25.174235] page dumped because: kasan: bad access detected [ 25.174447] [ 25.174633] Memory state around the buggy address: [ 25.175129] ffff8881063d7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.175567] ffff8881063d7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.176027] >ffff8881063d8000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.176300] ^ [ 25.176469] ffff8881063d8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.176780] ffff8881063d8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.177395] ================================================================== [ 25.122257] ================================================================== [ 25.122666] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.124040] Free of addr ffff8881059c8101 by task kunit_try_catch/289 [ 25.124599] [ 25.124708] CPU: 0 UID: 0 PID: 289 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5-next-20250708 #1 PREEMPT(voluntary) [ 25.124764] Tainted: [B]=BAD_PAGE, [N]=TEST [ 25.124786] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 25.124810] Call Trace: [ 25.124824] <TASK> [ 25.125061] dump_stack_lvl+0x73/0xb0 [ 25.125105] print_report+0xd1/0x610 [ 25.125131] ? __virt_addr_valid+0x1db/0x2d0 [ 25.125157] ? kasan_complete_mode_report_info+0x2a/0x200 [ 25.125187] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.125222] kasan_report_invalid_free+0x10a/0x130 [ 25.125261] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.125289] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.125315] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.125340] check_slab_allocation+0x11f/0x130 [ 25.125362] __kasan_mempool_poison_object+0x91/0x1d0 [ 25.125387] mempool_free+0x2ec/0x380 [ 25.125416] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 25.125443] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 25.125469] ? update_load_avg+0x1be/0x21b0 [ 25.125496] ? dequeue_entities+0x27e/0x1740 [ 25.125526] ? finish_task_switch.isra.0+0x153/0x700 [ 25.125552] mempool_kmalloc_invalid_free+0xed/0x140 [ 25.125578] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 25.125604] ? __pfx_mempool_kmalloc+0x10/0x10 [ 25.125630] ? __pfx_mempool_kfree+0x10/0x10 [ 25.125658] ? __pfx_read_tsc+0x10/0x10 [ 25.125683] ? ktime_get_ts64+0x86/0x230 [ 25.125711] kunit_try_run_case+0x1a5/0x480 [ 25.125922] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.125956] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 25.125981] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 25.126012] ? __kthread_parkme+0x82/0x180 [ 25.126033] ? preempt_count_sub+0x50/0x80 [ 25.126057] ? __pfx_kunit_try_run_case+0x10/0x10 [ 25.126080] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.126109] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 25.126138] kthread+0x337/0x6f0 [ 25.126160] ? trace_preempt_on+0x20/0xc0 [ 25.126185] ? __pfx_kthread+0x10/0x10 [ 25.126208] ? _raw_spin_unlock_irq+0x47/0x80 [ 25.126235] ? calculate_sigpending+0x7b/0xa0 [ 25.126276] ? __pfx_kthread+0x10/0x10 [ 25.126300] ret_from_fork+0x116/0x1d0 [ 25.126321] ? __pfx_kthread+0x10/0x10 [ 25.126344] ret_from_fork_asm+0x1a/0x30 [ 25.126379] </TASK> [ 25.126391] [ 25.138997] Allocated by task 289: [ 25.139424] kasan_save_stack+0x45/0x70 [ 25.139613] kasan_save_track+0x18/0x40 [ 25.139917] kasan_save_alloc_info+0x3b/0x50 [ 25.140103] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 25.140341] remove_element+0x11e/0x190 [ 25.140504] mempool_alloc_preallocated+0x4d/0x90 [ 25.140724] mempool_kmalloc_invalid_free_helper+0x83/0x2e0 [ 25.140948] mempool_kmalloc_invalid_free+0xed/0x140 [ 25.141582] kunit_try_run_case+0x1a5/0x480 [ 25.141749] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 25.142316] kthread+0x337/0x6f0 [ 25.142614] ret_from_fork+0x116/0x1d0 [ 25.142758] ret_from_fork_asm+0x1a/0x30 [ 25.143028] [ 25.143426] The buggy address belongs to the object at ffff8881059c8100 [ 25.143426] which belongs to the cache kmalloc-128 of size 128 [ 25.144088] The buggy address is located 1 bytes inside of [ 25.144088] 128-byte region [ffff8881059c8100, ffff8881059c8180) [ 25.144708] [ 25.144922] The buggy address belongs to the physical page: [ 25.145307] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059c8 [ 25.145699] flags: 0x200000000000000(node=0|zone=2) [ 25.146031] page_type: f5(slab) [ 25.146516] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 25.146815] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 25.147465] page dumped because: kasan: bad access detected [ 25.147665] [ 25.147753] Memory state around the buggy address: [ 25.148070] ffff8881059c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.148383] ffff8881059c8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.148678] >ffff8881059c8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.148973] ^ [ 25.149546] ffff8881059c8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.149862] ffff8881059c8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.150483] ==================================================================