Date
July 15, 2025, 2:09 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.997109] ================================================================== [ 19.997504] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 19.997721] Free of addr fff00000c59cb201 by task kunit_try_catch/243 [ 19.997765] [ 19.998247] CPU: 0 UID: 0 PID: 243 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 19.998409] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.998577] Hardware name: linux,dummy-virt (DT) [ 19.998613] Call trace: [ 19.998636] show_stack+0x20/0x38 (C) [ 19.998691] dump_stack_lvl+0x8c/0xd0 [ 19.998747] print_report+0x118/0x5d0 [ 19.998792] kasan_report_invalid_free+0xc0/0xe8 [ 19.998842] check_slab_allocation+0xfc/0x108 [ 19.998895] __kasan_mempool_poison_object+0x78/0x150 [ 19.998947] mempool_free+0x28c/0x328 [ 19.999004] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 19.999074] mempool_kmalloc_invalid_free+0xc0/0x118 [ 19.999141] kunit_try_run_case+0x170/0x3f0 [ 19.999191] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.999259] kthread+0x328/0x630 [ 19.999305] ret_from_fork+0x10/0x20 [ 19.999353] [ 19.999387] Allocated by task 243: [ 19.999423] kasan_save_stack+0x3c/0x68 [ 19.999480] kasan_save_track+0x20/0x40 [ 19.999516] kasan_save_alloc_info+0x40/0x58 [ 19.999564] __kasan_mempool_unpoison_object+0x11c/0x180 [ 19.999617] remove_element+0x130/0x1f8 [ 19.999668] mempool_alloc_preallocated+0x58/0xc0 [ 19.999720] mempool_kmalloc_invalid_free_helper+0x94/0x2a8 [ 19.999766] mempool_kmalloc_invalid_free+0xc0/0x118 [ 19.999807] kunit_try_run_case+0x170/0x3f0 [ 19.999853] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.999899] kthread+0x328/0x630 [ 19.999953] ret_from_fork+0x10/0x20 [ 19.999988] [ 20.000006] The buggy address belongs to the object at fff00000c59cb200 [ 20.000006] which belongs to the cache kmalloc-128 of size 128 [ 20.000066] The buggy address is located 1 bytes inside of [ 20.000066] 128-byte region [fff00000c59cb200, fff00000c59cb280) [ 20.000129] [ 20.000149] The buggy address belongs to the physical page: [ 20.000610] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1059cb [ 20.000689] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 20.001038] page_type: f5(slab) [ 20.001172] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 20.001259] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 20.001488] page dumped because: kasan: bad access detected [ 20.001663] [ 20.001722] Memory state around the buggy address: [ 20.001826] fff00000c59cb100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.002021] fff00000c59cb180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.002079] >fff00000c59cb200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.002363] ^ [ 20.002445] fff00000c59cb280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 20.002744] fff00000c59cb300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.002914] ================================================================== [ 20.010921] ================================================================== [ 20.011159] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 20.011433] Free of addr fff00000c793c001 by task kunit_try_catch/245 [ 20.011499] [ 20.011883] CPU: 0 UID: 0 PID: 245 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT [ 20.011991] Tainted: [B]=BAD_PAGE, [N]=TEST [ 20.012348] Hardware name: linux,dummy-virt (DT) [ 20.012438] Call trace: [ 20.012462] show_stack+0x20/0x38 (C) [ 20.012526] dump_stack_lvl+0x8c/0xd0 [ 20.012632] print_report+0x118/0x5d0 [ 20.012696] kasan_report_invalid_free+0xc0/0xe8 [ 20.012758] __kasan_mempool_poison_object+0xfc/0x150 [ 20.013052] mempool_free+0x28c/0x328 [ 20.013145] mempool_kmalloc_invalid_free_helper+0x118/0x2a8 [ 20.013216] mempool_kmalloc_large_invalid_free+0xc0/0x118 [ 20.013271] kunit_try_run_case+0x170/0x3f0 [ 20.013325] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 20.013379] kthread+0x328/0x630 [ 20.013674] ret_from_fork+0x10/0x20 [ 20.013863] [ 20.013969] The buggy address belongs to the physical page: [ 20.014028] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10793c [ 20.014159] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 20.014240] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 20.014295] page_type: f8(unknown) [ 20.014510] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.014737] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.014854] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 20.014925] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 20.014992] head: 0bfffe0000000002 ffffc1ffc31e4f01 00000000ffffffff 00000000ffffffff [ 20.015416] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 20.015513] page dumped because: kasan: bad access detected [ 20.015813] [ 20.015857] Memory state around the buggy address: [ 20.015948] fff00000c793bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.016013] fff00000c793bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 20.016090] >fff00000c793c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.016476] ^ [ 20.016521] fff00000c793c080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.016582] fff00000c793c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 20.016902] ==================================================================
[ 12.702160] ================================================================== [ 12.702661] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.703210] Free of addr ffff888103a34201 by task kunit_try_catch/260 [ 12.703436] [ 12.703548] CPU: 1 UID: 0 PID: 260 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 12.703591] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.703603] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.703623] Call Trace: [ 12.703635] <TASK> [ 12.703649] dump_stack_lvl+0x73/0xb0 [ 12.703675] print_report+0xd1/0x610 [ 12.703697] ? __virt_addr_valid+0x1db/0x2d0 [ 12.703719] ? kasan_complete_mode_report_info+0x2a/0x200 [ 12.703741] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.703767] kasan_report_invalid_free+0x10a/0x130 [ 12.703792] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.703819] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.703843] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.703867] check_slab_allocation+0x11f/0x130 [ 12.703903] __kasan_mempool_poison_object+0x91/0x1d0 [ 12.704118] mempool_free+0x2ec/0x380 [ 12.704147] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.704174] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 12.704198] ? dequeue_entities+0x852/0x1740 [ 12.704221] ? finish_task_switch.isra.0+0x153/0x700 [ 12.704247] mempool_kmalloc_invalid_free+0xed/0x140 [ 12.704271] ? __pfx_mempool_kmalloc_invalid_free+0x10/0x10 [ 12.704294] ? dequeue_task_fair+0x166/0x4e0 [ 12.704316] ? __pfx_mempool_kmalloc+0x10/0x10 [ 12.704334] ? __pfx_mempool_kfree+0x10/0x10 [ 12.704356] ? __pfx_read_tsc+0x10/0x10 [ 12.704376] ? ktime_get_ts64+0x86/0x230 [ 12.704399] kunit_try_run_case+0x1a5/0x480 [ 12.704421] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.704439] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.704463] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.704486] ? __kthread_parkme+0x82/0x180 [ 12.704508] ? preempt_count_sub+0x50/0x80 [ 12.704532] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.704552] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.704574] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.704597] kthread+0x337/0x6f0 [ 12.704613] ? trace_preempt_on+0x20/0xc0 [ 12.704635] ? __pfx_kthread+0x10/0x10 [ 12.704652] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.704673] ? calculate_sigpending+0x7b/0xa0 [ 12.704695] ? __pfx_kthread+0x10/0x10 [ 12.704712] ret_from_fork+0x41/0x80 [ 12.704733] ? __pfx_kthread+0x10/0x10 [ 12.704750] ret_from_fork_asm+0x1a/0x30 [ 12.704779] </TASK> [ 12.704790] [ 12.718627] Allocated by task 260: [ 12.719026] kasan_save_stack+0x45/0x70 [ 12.719378] kasan_save_track+0x18/0x40 [ 12.719558] kasan_save_alloc_info+0x3b/0x50 [ 12.720000] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 12.720243] remove_element+0x11e/0x190 [ 12.720419] mempool_alloc_preallocated+0x4d/0x90 [ 12.720623] mempool_kmalloc_invalid_free_helper+0x83/0x2e0 [ 12.721285] mempool_kmalloc_invalid_free+0xed/0x140 [ 12.721655] kunit_try_run_case+0x1a5/0x480 [ 12.722055] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.722300] kthread+0x337/0x6f0 [ 12.722461] ret_from_fork+0x41/0x80 [ 12.722637] ret_from_fork_asm+0x1a/0x30 [ 12.723348] [ 12.723538] The buggy address belongs to the object at ffff888103a34200 [ 12.723538] which belongs to the cache kmalloc-128 of size 128 [ 12.724617] The buggy address is located 1 bytes inside of [ 12.724617] 128-byte region [ffff888103a34200, ffff888103a34280) [ 12.725461] [ 12.725563] The buggy address belongs to the physical page: [ 12.725750] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103a34 [ 12.726004] flags: 0x200000000000000(node=0|zone=2) [ 12.726167] page_type: f5(slab) [ 12.726286] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 12.726517] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 12.726740] page dumped because: kasan: bad access detected [ 12.727379] [ 12.727977] Memory state around the buggy address: [ 12.728426] ffff888103a34100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 12.728982] ffff888103a34180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.729631] >ffff888103a34200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.730144] ^ [ 12.730455] ffff888103a34280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 12.731063] ffff888103a34300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.731364] ================================================================== [ 12.735899] ================================================================== [ 12.736663] BUG: KASAN: invalid-free in mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.737386] Free of addr ffff888102acc001 by task kunit_try_catch/262 [ 12.737678] [ 12.737784] CPU: 0 UID: 0 PID: 262 Comm: kunit_try_catch Tainted: G B N 6.15.7-rc1 #1 PREEMPT(voluntary) [ 12.737829] Tainted: [B]=BAD_PAGE, [N]=TEST [ 12.737840] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.737859] Call Trace: [ 12.737870] <TASK> [ 12.737894] dump_stack_lvl+0x73/0xb0 [ 12.737918] print_report+0xd1/0x610 [ 12.737939] ? __virt_addr_valid+0x1db/0x2d0 [ 12.737961] ? kasan_addr_to_slab+0x11/0xa0 [ 12.737980] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.738006] kasan_report_invalid_free+0x10a/0x130 [ 12.738030] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.738057] ? mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.738081] __kasan_mempool_poison_object+0x102/0x1d0 [ 12.738105] mempool_free+0x2ec/0x380 [ 12.738127] mempool_kmalloc_invalid_free_helper+0x132/0x2e0 [ 12.738652] ? __pfx_mempool_kmalloc_invalid_free_helper+0x10/0x10 [ 12.738705] ? dequeue_entities+0x852/0x1740 [ 12.738730] ? irqentry_exit+0x2a/0x60 [ 12.738751] ? sysvec_apic_timer_interrupt+0x50/0x90 [ 12.738773] mempool_kmalloc_large_invalid_free+0xed/0x140 [ 12.738798] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 12.738825] ? __pfx_mempool_kmalloc+0x10/0x10 [ 12.738844] ? __pfx_mempool_kfree+0x10/0x10 [ 12.738863] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 12.738904] ? __pfx_mempool_kmalloc_large_invalid_free+0x10/0x10 [ 12.738930] kunit_try_run_case+0x1a5/0x480 [ 12.738950] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.738967] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 12.738990] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 12.739012] ? __kthread_parkme+0x82/0x180 [ 12.739033] ? preempt_count_sub+0x50/0x80 [ 12.739056] ? __pfx_kunit_try_run_case+0x10/0x10 [ 12.739076] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 12.739098] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 12.739120] kthread+0x337/0x6f0 [ 12.739135] ? trace_preempt_on+0x20/0xc0 [ 12.739157] ? __pfx_kthread+0x10/0x10 [ 12.739174] ? _raw_spin_unlock_irq+0x47/0x80 [ 12.739195] ? calculate_sigpending+0x7b/0xa0 [ 12.739216] ? __pfx_kthread+0x10/0x10 [ 12.739233] ret_from_fork+0x41/0x80 [ 12.739253] ? __pfx_kthread+0x10/0x10 [ 12.739270] ret_from_fork_asm+0x1a/0x30 [ 12.739299] </TASK> [ 12.739309] [ 12.751831] The buggy address belongs to the physical page: [ 12.752108] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102acc [ 12.752455] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 12.752691] flags: 0x200000000000040(head|node=0|zone=2) [ 12.753100] page_type: f8(unknown) [ 12.753360] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.753680] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.754119] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 12.754454] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 12.754747] head: 0200000000000002 ffffea00040ab301 00000000ffffffff 00000000ffffffff [ 12.755437] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 12.756048] page dumped because: kasan: bad access detected [ 12.756287] [ 12.756380] Memory state around the buggy address: [ 12.756815] ffff888102acbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.757147] ffff888102acbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 12.757599] >ffff888102acc000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.758160] ^ [ 12.758284] ffff888102acc080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.758735] ffff888102acc100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 12.759258] ==================================================================