Date
June 17, 2025, 3:40 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 24.323465] ================================================================== [ 24.323649] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 24.323820] Free of addr fff00000c7a48000 by task kunit_try_catch/239 [ 24.323921] [ 24.324010] CPU: 0 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT [ 24.324210] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.324277] Hardware name: linux,dummy-virt (DT) [ 24.324358] Call trace: [ 24.324412] show_stack+0x20/0x38 (C) [ 24.324532] dump_stack_lvl+0x8c/0xd0 [ 24.325141] print_report+0x118/0x608 [ 24.325621] kasan_report_invalid_free+0xc0/0xe8 [ 24.325757] __kasan_mempool_poison_object+0x14c/0x150 [ 24.325896] mempool_free+0x28c/0x328 [ 24.326021] mempool_double_free_helper+0x150/0x2e8 [ 24.326145] mempool_kmalloc_large_double_free+0xc0/0x118 [ 24.326282] kunit_try_run_case+0x170/0x3f0 [ 24.326463] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.326644] kthread+0x328/0x630 [ 24.326822] ret_from_fork+0x10/0x20 [ 24.326936] [ 24.326979] The buggy address belongs to the physical page: [ 24.327039] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107a48 [ 24.327181] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 24.327286] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 24.327477] page_type: f8(unknown) [ 24.327631] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.327835] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.327989] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 24.328151] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 24.328321] head: 0bfffe0000000002 ffffc1ffc31e9201 00000000ffffffff 00000000ffffffff [ 24.328445] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 24.328597] page dumped because: kasan: bad access detected [ 24.328702] [ 24.328758] Memory state around the buggy address: [ 24.328849] fff00000c7a47f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.328960] fff00000c7a47f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.329065] >fff00000c7a48000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.329159] ^ [ 24.329235] fff00000c7a48080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.329360] fff00000c7a48100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.329453] ================================================================== [ 24.295341] ================================================================== [ 24.295530] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 24.295683] Free of addr fff00000c73ad000 by task kunit_try_catch/237 [ 24.297600] [ 24.297703] CPU: 0 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT [ 24.298403] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.298497] Hardware name: linux,dummy-virt (DT) [ 24.298577] Call trace: [ 24.298628] show_stack+0x20/0x38 (C) [ 24.298778] dump_stack_lvl+0x8c/0xd0 [ 24.298907] print_report+0x118/0x608 [ 24.299025] kasan_report_invalid_free+0xc0/0xe8 [ 24.299143] check_slab_allocation+0xd4/0x108 [ 24.299256] __kasan_mempool_poison_object+0x78/0x150 [ 24.299386] mempool_free+0x28c/0x328 [ 24.299512] mempool_double_free_helper+0x150/0x2e8 [ 24.299651] mempool_kmalloc_double_free+0xc0/0x118 [ 24.299794] kunit_try_run_case+0x170/0x3f0 [ 24.299968] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.300116] kthread+0x328/0x630 [ 24.300236] ret_from_fork+0x10/0x20 [ 24.300362] [ 24.300439] Allocated by task 237: [ 24.300521] kasan_save_stack+0x3c/0x68 [ 24.300668] kasan_save_track+0x20/0x40 [ 24.300814] kasan_save_alloc_info+0x40/0x58 [ 24.300909] __kasan_mempool_unpoison_object+0x11c/0x180 [ 24.301288] remove_element+0x130/0x1f8 [ 24.301374] mempool_alloc_preallocated+0x58/0xc0 [ 24.301478] mempool_double_free_helper+0x94/0x2e8 [ 24.301589] mempool_kmalloc_double_free+0xc0/0x118 [ 24.301703] kunit_try_run_case+0x170/0x3f0 [ 24.301810] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.301922] kthread+0x328/0x630 [ 24.302066] ret_from_fork+0x10/0x20 [ 24.302162] [ 24.302217] Freed by task 237: [ 24.302323] kasan_save_stack+0x3c/0x68 [ 24.302452] kasan_save_track+0x20/0x40 [ 24.302576] kasan_save_free_info+0x4c/0x78 [ 24.302666] __kasan_mempool_poison_object+0xc0/0x150 [ 24.302763] mempool_free+0x28c/0x328 [ 24.302838] mempool_double_free_helper+0x100/0x2e8 [ 24.302928] mempool_kmalloc_double_free+0xc0/0x118 [ 24.303059] kunit_try_run_case+0x170/0x3f0 [ 24.303200] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.303348] kthread+0x328/0x630 [ 24.303476] ret_from_fork+0x10/0x20 [ 24.303597] [ 24.303659] The buggy address belongs to the object at fff00000c73ad000 [ 24.303659] which belongs to the cache kmalloc-128 of size 128 [ 24.303808] The buggy address is located 0 bytes inside of [ 24.303808] 128-byte region [fff00000c73ad000, fff00000c73ad080) [ 24.303989] [ 24.304118] The buggy address belongs to the physical page: [ 24.304191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1073ad [ 24.304327] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 24.304457] page_type: f5(slab) [ 24.304581] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 24.304713] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 24.304847] page dumped because: kasan: bad access detected [ 24.304964] [ 24.305019] Memory state around the buggy address: [ 24.305129] fff00000c73acf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.305253] fff00000c73acf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.305381] >fff00000c73ad000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.305475] ^ [ 24.305547] fff00000c73ad080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.305653] fff00000c73ad100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.305750] ================================================================== [ 24.372593] ================================================================== [ 24.374347] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 24.374525] Free of addr fff00000c7a48000 by task kunit_try_catch/241 [ 24.374620] [ 24.374761] CPU: 0 UID: 0 PID: 241 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT [ 24.375332] Tainted: [B]=BAD_PAGE, [N]=TEST [ 24.375467] Hardware name: linux,dummy-virt (DT) [ 24.375564] Call trace: [ 24.375617] show_stack+0x20/0x38 (C) [ 24.375758] dump_stack_lvl+0x8c/0xd0 [ 24.375871] print_report+0x118/0x608 [ 24.376333] kasan_report_invalid_free+0xc0/0xe8 [ 24.376493] __kasan_mempool_poison_pages+0xe0/0xe8 [ 24.376630] mempool_free+0x24c/0x328 [ 24.376759] mempool_double_free_helper+0x150/0x2e8 [ 24.376877] mempool_page_alloc_double_free+0xbc/0x118 [ 24.377004] kunit_try_run_case+0x170/0x3f0 [ 24.377132] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 24.377269] kthread+0x328/0x630 [ 24.377417] ret_from_fork+0x10/0x20 [ 24.377963] [ 24.378045] The buggy address belongs to the physical page: [ 24.378324] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107a48 [ 24.378479] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 24.378613] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 24.378725] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 24.378868] page dumped because: kasan: bad access detected [ 24.378969] [ 24.379038] Memory state around the buggy address: [ 24.379119] fff00000c7a47f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.379249] fff00000c7a47f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.379384] >fff00000c7a48000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.379493] ^ [ 24.379570] fff00000c7a48080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.379681] fff00000c7a48100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 24.379788] ==================================================================
[ 21.876747] ================================================================== [ 21.878019] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 21.879120] Free of addr ffff888102a08000 by task kunit_try_catch/257 [ 21.880643] [ 21.880881] CPU: 0 UID: 0 PID: 257 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT(voluntary) [ 21.881210] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.881246] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.881281] Call Trace: [ 21.881325] <TASK> [ 21.881352] dump_stack_lvl+0x73/0xb0 [ 21.881396] print_report+0xd1/0x650 [ 21.881434] ? __virt_addr_valid+0x1db/0x2d0 [ 21.881471] ? kasan_addr_to_slab+0x11/0xa0 [ 21.881504] ? mempool_double_free_helper+0x184/0x370 [ 21.881545] kasan_report_invalid_free+0x10a/0x130 [ 21.881585] ? mempool_double_free_helper+0x184/0x370 [ 21.881627] ? mempool_double_free_helper+0x184/0x370 [ 21.881663] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 21.881702] mempool_free+0x2ec/0x380 [ 21.881741] mempool_double_free_helper+0x184/0x370 [ 21.881783] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 21.881822] ? update_load_avg+0x1be/0x21b0 [ 21.881853] ? dequeue_entities+0x27e/0x1740 [ 21.881891] ? finish_task_switch.isra.0+0x153/0x700 [ 21.881932] mempool_kmalloc_large_double_free+0xed/0x140 [ 21.881972] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 21.882012] ? dequeue_task_fair+0x166/0x4e0 [ 21.882322] ? __pfx_mempool_kmalloc+0x10/0x10 [ 21.882369] ? __pfx_mempool_kfree+0x10/0x10 [ 21.882405] ? __pfx_read_tsc+0x10/0x10 [ 21.882443] ? ktime_get_ts64+0x86/0x230 [ 21.882484] kunit_try_run_case+0x1a5/0x480 [ 21.882528] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.882565] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.882604] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.882643] ? __kthread_parkme+0x82/0x180 [ 21.882678] ? preempt_count_sub+0x50/0x80 [ 21.882717] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.882754] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.882790] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.882826] kthread+0x337/0x6f0 [ 21.882850] ? trace_preempt_on+0x20/0xc0 [ 21.882888] ? __pfx_kthread+0x10/0x10 [ 21.882915] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.882948] ? calculate_sigpending+0x7b/0xa0 [ 21.883046] ? __pfx_kthread+0x10/0x10 [ 21.883127] ret_from_fork+0x41/0x80 [ 21.883167] ? __pfx_kthread+0x10/0x10 [ 21.883194] ret_from_fork_asm+0x1a/0x30 [ 21.883242] </TASK> [ 21.883258] [ 21.907070] The buggy address belongs to the physical page: [ 21.907597] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a08 [ 21.908612] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.909563] flags: 0x200000000000040(head|node=0|zone=2) [ 21.909953] page_type: f8(unknown) [ 21.910363] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.912695] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.913464] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.914734] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.915656] head: 0200000000000002 ffffea00040a8201 00000000ffffffff 00000000ffffffff [ 21.916765] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 21.917807] page dumped because: kasan: bad access detected [ 21.918601] [ 21.918772] Memory state around the buggy address: [ 21.919253] ffff888102a07f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.919799] ffff888102a07f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.921749] >ffff888102a08000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.922626] ^ [ 21.922959] ffff888102a08080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.923745] ffff888102a08100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.924712] ================================================================== [ 21.932320] ================================================================== [ 21.933193] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 21.934344] Free of addr ffff888103928000 by task kunit_try_catch/259 [ 21.934985] [ 21.935729] CPU: 1 UID: 0 PID: 259 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT(voluntary) [ 21.935867] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.935924] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.936362] Call Trace: [ 21.936408] <TASK> [ 21.936457] dump_stack_lvl+0x73/0xb0 [ 21.936558] print_report+0xd1/0x650 [ 21.936637] ? __virt_addr_valid+0x1db/0x2d0 [ 21.936700] ? kasan_addr_to_slab+0x11/0xa0 [ 21.936738] ? mempool_double_free_helper+0x184/0x370 [ 21.936779] kasan_report_invalid_free+0x10a/0x130 [ 21.936851] ? mempool_double_free_helper+0x184/0x370 [ 21.936904] ? mempool_double_free_helper+0x184/0x370 [ 21.936942] __kasan_mempool_poison_pages+0x115/0x130 [ 21.937020] mempool_free+0x290/0x380 [ 21.937278] mempool_double_free_helper+0x184/0x370 [ 21.937352] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 21.937396] ? dequeue_entities+0x852/0x1740 [ 21.937438] ? irqentry_exit+0x2a/0x60 [ 21.937466] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 21.937510] mempool_page_alloc_double_free+0xe8/0x140 [ 21.937544] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 21.937581] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 21.937613] ? __pfx_mempool_free_pages+0x10/0x10 [ 21.937647] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 21.937684] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 21.937720] kunit_try_run_case+0x1a5/0x480 [ 21.937761] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.937798] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.937838] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.937875] ? __kthread_parkme+0x82/0x180 [ 21.937909] ? preempt_count_sub+0x50/0x80 [ 21.937950] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.938031] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.938111] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.938152] kthread+0x337/0x6f0 [ 21.938179] ? trace_preempt_on+0x20/0xc0 [ 21.938219] ? __pfx_kthread+0x10/0x10 [ 21.938247] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.938280] ? calculate_sigpending+0x7b/0xa0 [ 21.938341] ? __pfx_kthread+0x10/0x10 [ 21.938370] ret_from_fork+0x41/0x80 [ 21.938406] ? __pfx_kthread+0x10/0x10 [ 21.938437] ret_from_fork_asm+0x1a/0x30 [ 21.938486] </TASK> [ 21.938502] [ 21.965673] The buggy address belongs to the physical page: [ 21.966319] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103928 [ 21.966984] flags: 0x200000000000000(node=0|zone=2) [ 21.968150] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 21.968757] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 21.970094] page dumped because: kasan: bad access detected [ 21.970718] [ 21.970942] Memory state around the buggy address: [ 21.972120] ffff888103927f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.973461] ffff888103927f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.973961] >ffff888103928000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.974643] ^ [ 21.974968] ffff888103928080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.976459] ffff888103928100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.978194] ================================================================== [ 21.811576] ================================================================== [ 21.812959] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 21.813584] Free of addr ffff8881030b5200 by task kunit_try_catch/255 [ 21.814058] [ 21.815360] CPU: 0 UID: 0 PID: 255 Comm: kunit_try_catch Tainted: G B N 6.15.3-rc1 #1 PREEMPT(voluntary) [ 21.815478] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.815501] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 21.815532] Call Trace: [ 21.815551] <TASK> [ 21.815577] dump_stack_lvl+0x73/0xb0 [ 21.815621] print_report+0xd1/0x650 [ 21.815659] ? __virt_addr_valid+0x1db/0x2d0 [ 21.815696] ? kasan_complete_mode_report_info+0x64/0x200 [ 21.815733] ? mempool_double_free_helper+0x184/0x370 [ 21.815775] kasan_report_invalid_free+0x10a/0x130 [ 21.815817] ? mempool_double_free_helper+0x184/0x370 [ 21.815862] ? mempool_double_free_helper+0x184/0x370 [ 21.815920] ? mempool_double_free_helper+0x184/0x370 [ 21.816017] check_slab_allocation+0x101/0x130 [ 21.816117] __kasan_mempool_poison_object+0x91/0x1d0 [ 21.816170] mempool_free+0x2ec/0x380 [ 21.816211] mempool_double_free_helper+0x184/0x370 [ 21.816254] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 21.816321] ? dequeue_entities+0x852/0x1740 [ 21.816366] ? finish_task_switch.isra.0+0x153/0x700 [ 21.816410] mempool_kmalloc_double_free+0xed/0x140 [ 21.816451] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 21.816492] ? dequeue_task_fair+0x166/0x4e0 [ 21.816529] ? __pfx_mempool_kmalloc+0x10/0x10 [ 21.816561] ? __pfx_mempool_kfree+0x10/0x10 [ 21.816596] ? __pfx_read_tsc+0x10/0x10 [ 21.816629] ? ktime_get_ts64+0x86/0x230 [ 21.816669] kunit_try_run_case+0x1a5/0x480 [ 21.816709] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.816747] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 21.816787] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 21.816825] ? __kthread_parkme+0x82/0x180 [ 21.816860] ? preempt_count_sub+0x50/0x80 [ 21.816897] ? __pfx_kunit_try_run_case+0x10/0x10 [ 21.816936] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.817030] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 21.817120] kthread+0x337/0x6f0 [ 21.817160] ? trace_preempt_on+0x20/0xc0 [ 21.817201] ? __pfx_kthread+0x10/0x10 [ 21.817229] ? _raw_spin_unlock_irq+0x47/0x80 [ 21.817265] ? calculate_sigpending+0x7b/0xa0 [ 21.817329] ? __pfx_kthread+0x10/0x10 [ 21.817363] ret_from_fork+0x41/0x80 [ 21.817400] ? __pfx_kthread+0x10/0x10 [ 21.817427] ret_from_fork_asm+0x1a/0x30 [ 21.817476] </TASK> [ 21.817492] [ 21.839122] Allocated by task 255: [ 21.839563] kasan_save_stack+0x45/0x70 [ 21.840234] kasan_save_track+0x18/0x40 [ 21.840679] kasan_save_alloc_info+0x3b/0x50 [ 21.841544] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 21.842410] remove_element+0x11e/0x190 [ 21.842843] mempool_alloc_preallocated+0x4d/0x90 [ 21.843459] mempool_double_free_helper+0x8a/0x370 [ 21.844086] mempool_kmalloc_double_free+0xed/0x140 [ 21.844586] kunit_try_run_case+0x1a5/0x480 [ 21.845447] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.846159] kthread+0x337/0x6f0 [ 21.846646] ret_from_fork+0x41/0x80 [ 21.847068] ret_from_fork_asm+0x1a/0x30 [ 21.847664] [ 21.847920] Freed by task 255: [ 21.848365] kasan_save_stack+0x45/0x70 [ 21.848685] kasan_save_track+0x18/0x40 [ 21.849042] kasan_save_free_info+0x3f/0x60 [ 21.849560] __kasan_mempool_poison_object+0x131/0x1d0 [ 21.850144] mempool_free+0x2ec/0x380 [ 21.851082] mempool_double_free_helper+0x109/0x370 [ 21.851990] mempool_kmalloc_double_free+0xed/0x140 [ 21.852588] kunit_try_run_case+0x1a5/0x480 [ 21.853053] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 21.854068] kthread+0x337/0x6f0 [ 21.854577] ret_from_fork+0x41/0x80 [ 21.855276] ret_from_fork_asm+0x1a/0x30 [ 21.855890] [ 21.856281] The buggy address belongs to the object at ffff8881030b5200 [ 21.856281] which belongs to the cache kmalloc-128 of size 128 [ 21.857144] The buggy address is located 0 bytes inside of [ 21.857144] 128-byte region [ffff8881030b5200, ffff8881030b5280) [ 21.858378] [ 21.858827] The buggy address belongs to the physical page: [ 21.859333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1030b5 [ 21.860035] flags: 0x200000000000000(node=0|zone=2) [ 21.860916] page_type: f5(slab) [ 21.861595] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 21.862275] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.863345] page dumped because: kasan: bad access detected [ 21.863783] [ 21.864024] Memory state around the buggy address: [ 21.864587] ffff8881030b5100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.865728] ffff8881030b5180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.866304] >ffff8881030b5200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.867214] ^ [ 21.867605] ffff8881030b5280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.868237] ffff8881030b5300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.868953] ==================================================================