Date
July 1, 2025, 12:10 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.571162] ================================================================== [ 19.571438] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 19.571598] Free of addr fff00000c79b8000 by task kunit_try_catch/239 [ 19.571808] [ 19.571972] CPU: 0 UID: 0 PID: 239 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 19.572059] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.572489] Hardware name: linux,dummy-virt (DT) [ 19.572531] Call trace: [ 19.572555] show_stack+0x20/0x38 (C) [ 19.572610] dump_stack_lvl+0x8c/0xd0 [ 19.572670] print_report+0x118/0x608 [ 19.572982] kasan_report_invalid_free+0xc0/0xe8 [ 19.573035] __kasan_mempool_poison_pages+0xe0/0xe8 [ 19.573085] mempool_free+0x24c/0x328 [ 19.573492] mempool_double_free_helper+0x150/0x2e8 [ 19.573561] mempool_page_alloc_double_free+0xbc/0x118 [ 19.574094] kunit_try_run_case+0x170/0x3f0 [ 19.574467] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.574823] kthread+0x328/0x630 [ 19.574967] ret_from_fork+0x10/0x20 [ 19.575046] [ 19.575084] The buggy address belongs to the physical page: [ 19.575125] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079b8 [ 19.575350] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.575592] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 19.575738] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 19.575830] page dumped because: kasan: bad access detected [ 19.575871] [ 19.575889] Memory state around the buggy address: [ 19.576573] fff00000c79b7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.576626] fff00000c79b7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.576671] >fff00000c79b8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.576711] ^ [ 19.576954] fff00000c79b8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.577006] fff00000c79b8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.577071] ================================================================== [ 19.549349] ================================================================== [ 19.549747] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 19.549806] Free of addr fff00000c79b4000 by task kunit_try_catch/237 [ 19.549850] [ 19.549882] CPU: 0 UID: 0 PID: 237 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 19.550357] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.550397] Hardware name: linux,dummy-virt (DT) [ 19.550664] Call trace: [ 19.550689] show_stack+0x20/0x38 (C) [ 19.550997] dump_stack_lvl+0x8c/0xd0 [ 19.551056] print_report+0x118/0x608 [ 19.551392] kasan_report_invalid_free+0xc0/0xe8 [ 19.551473] __kasan_mempool_poison_object+0x14c/0x150 [ 19.551525] mempool_free+0x28c/0x328 [ 19.551579] mempool_double_free_helper+0x150/0x2e8 [ 19.551627] mempool_kmalloc_large_double_free+0xc0/0x118 [ 19.552256] kunit_try_run_case+0x170/0x3f0 [ 19.552420] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.552592] kthread+0x328/0x630 [ 19.552652] ret_from_fork+0x10/0x20 [ 19.552811] [ 19.553000] The buggy address belongs to the physical page: [ 19.553035] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079b4 [ 19.553547] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.553623] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.553815] page_type: f8(unknown) [ 19.553856] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.554037] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.554206] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.554483] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.554916] head: 0bfffe0000000002 ffffc1ffc31e6d01 00000000ffffffff 00000000ffffffff [ 19.555066] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 19.555112] page dumped because: kasan: bad access detected [ 19.555239] [ 19.555258] Memory state around the buggy address: [ 19.555506] fff00000c79b3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.555568] fff00000c79b3f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.555935] >fff00000c79b4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.556178] ^ [ 19.556313] fff00000c79b4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.556363] fff00000c79b4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.556404] ================================================================== [ 19.524199] ================================================================== [ 19.524266] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 19.524326] Free of addr fff00000c79f0100 by task kunit_try_catch/235 [ 19.524370] [ 19.524794] CPU: 0 UID: 0 PID: 235 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 19.524905] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.525689] Hardware name: linux,dummy-virt (DT) [ 19.525727] Call trace: [ 19.525848] show_stack+0x20/0x38 (C) [ 19.525982] dump_stack_lvl+0x8c/0xd0 [ 19.526097] print_report+0x118/0x608 [ 19.526142] kasan_report_invalid_free+0xc0/0xe8 [ 19.526193] check_slab_allocation+0xd4/0x108 [ 19.526242] __kasan_mempool_poison_object+0x78/0x150 [ 19.526779] mempool_free+0x28c/0x328 [ 19.526872] mempool_double_free_helper+0x150/0x2e8 [ 19.527673] mempool_kmalloc_double_free+0xc0/0x118 [ 19.527749] kunit_try_run_case+0x170/0x3f0 [ 19.527808] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.527863] kthread+0x328/0x630 [ 19.527904] ret_from_fork+0x10/0x20 [ 19.527953] [ 19.527974] Allocated by task 235: [ 19.528521] kasan_save_stack+0x3c/0x68 [ 19.528699] kasan_save_track+0x20/0x40 [ 19.528750] kasan_save_alloc_info+0x40/0x58 [ 19.528791] __kasan_mempool_unpoison_object+0x11c/0x180 [ 19.529826] remove_element+0x130/0x1f8 [ 19.530477] mempool_alloc_preallocated+0x58/0xc0 [ 19.530532] mempool_double_free_helper+0x94/0x2e8 [ 19.530572] mempool_kmalloc_double_free+0xc0/0x118 [ 19.530759] kunit_try_run_case+0x170/0x3f0 [ 19.530797] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.530842] kthread+0x328/0x630 [ 19.530873] ret_from_fork+0x10/0x20 [ 19.530981] [ 19.531085] Freed by task 235: [ 19.531280] kasan_save_stack+0x3c/0x68 [ 19.531336] kasan_save_track+0x20/0x40 [ 19.531375] kasan_save_free_info+0x4c/0x78 [ 19.531413] __kasan_mempool_poison_object+0xc0/0x150 [ 19.531836] mempool_free+0x28c/0x328 [ 19.531934] mempool_double_free_helper+0x100/0x2e8 [ 19.531981] mempool_kmalloc_double_free+0xc0/0x118 [ 19.532246] kunit_try_run_case+0x170/0x3f0 [ 19.532661] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.533007] kthread+0x328/0x630 [ 19.533098] ret_from_fork+0x10/0x20 [ 19.533235] [ 19.533383] The buggy address belongs to the object at fff00000c79f0100 [ 19.533383] which belongs to the cache kmalloc-128 of size 128 [ 19.533462] The buggy address is located 0 bytes inside of [ 19.533462] 128-byte region [fff00000c79f0100, fff00000c79f0180) [ 19.533985] [ 19.534014] The buggy address belongs to the physical page: [ 19.534184] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079f0 [ 19.534350] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.534677] page_type: f5(slab) [ 19.534724] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.534800] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.535004] page dumped because: kasan: bad access detected [ 19.535037] [ 19.535055] Memory state around the buggy address: [ 19.535268] fff00000c79f0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.535332] fff00000c79f0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.535424] >fff00000c79f0100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.535584] ^ [ 19.535778] fff00000c79f0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.536130] fff00000c79f0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.536337] ==================================================================
[ 13.085724] ================================================================== [ 13.086997] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.087260] Free of addr ffff888103990000 by task kunit_try_catch/254 [ 13.087462] [ 13.087551] CPU: 1 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.087595] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.087607] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.087626] Call Trace: [ 13.087638] <TASK> [ 13.087652] dump_stack_lvl+0x73/0xb0 [ 13.087680] print_report+0xd1/0x650 [ 13.087702] ? __virt_addr_valid+0x1db/0x2d0 [ 13.087725] ? kasan_addr_to_slab+0x11/0xa0 [ 13.087745] ? mempool_double_free_helper+0x184/0x370 [ 13.087768] kasan_report_invalid_free+0x10a/0x130 [ 13.087793] ? mempool_double_free_helper+0x184/0x370 [ 13.087820] ? mempool_double_free_helper+0x184/0x370 [ 13.087844] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 13.087867] mempool_free+0x2ec/0x380 [ 13.087890] mempool_double_free_helper+0x184/0x370 [ 13.087913] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.087939] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.087961] ? finish_task_switch.isra.0+0x153/0x700 [ 13.087985] mempool_kmalloc_large_double_free+0xed/0x140 [ 13.088009] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 13.088046] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.088068] ? __pfx_mempool_kfree+0x10/0x10 [ 13.088092] ? __pfx_read_tsc+0x10/0x10 [ 13.088112] ? ktime_get_ts64+0x86/0x230 [ 13.088135] kunit_try_run_case+0x1a5/0x480 [ 13.088160] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.088184] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.088207] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.088230] ? __kthread_parkme+0x82/0x180 [ 13.088250] ? preempt_count_sub+0x50/0x80 [ 13.088700] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.088727] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.088752] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.088774] kthread+0x337/0x6f0 [ 13.088795] ? trace_preempt_on+0x20/0xc0 [ 13.088819] ? __pfx_kthread+0x10/0x10 [ 13.088839] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.088859] ? calculate_sigpending+0x7b/0xa0 [ 13.088884] ? __pfx_kthread+0x10/0x10 [ 13.088905] ret_from_fork+0x116/0x1d0 [ 13.088924] ? __pfx_kthread+0x10/0x10 [ 13.088943] ret_from_fork_asm+0x1a/0x30 [ 13.088973] </TASK> [ 13.088983] [ 13.103268] The buggy address belongs to the physical page: [ 13.103502] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x103990 [ 13.103856] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.104573] flags: 0x200000000000040(head|node=0|zone=2) [ 13.104823] page_type: f8(unknown) [ 13.105174] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.105722] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.106368] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.106793] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.107351] head: 0200000000000002 ffffea00040e6401 00000000ffffffff 00000000ffffffff [ 13.107805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 13.108557] page dumped because: kasan: bad access detected [ 13.108801] [ 13.108878] Memory state around the buggy address: [ 13.109498] ffff88810398ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.109885] ffff88810398ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.110436] >ffff888103990000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.110872] ^ [ 13.111044] ffff888103990080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.111796] ffff888103990100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.112352] ================================================================== [ 13.115896] ================================================================== [ 13.116426] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.117115] Free of addr ffff8881029d0000 by task kunit_try_catch/256 [ 13.117459] [ 13.117669] CPU: 0 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.117714] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.117727] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.117748] Call Trace: [ 13.117760] <TASK> [ 13.117776] dump_stack_lvl+0x73/0xb0 [ 13.117806] print_report+0xd1/0x650 [ 13.117827] ? __virt_addr_valid+0x1db/0x2d0 [ 13.117852] ? kasan_addr_to_slab+0x11/0xa0 [ 13.117871] ? mempool_double_free_helper+0x184/0x370 [ 13.117895] kasan_report_invalid_free+0x10a/0x130 [ 13.117919] ? mempool_double_free_helper+0x184/0x370 [ 13.117944] ? mempool_double_free_helper+0x184/0x370 [ 13.117967] __kasan_mempool_poison_pages+0x115/0x130 [ 13.117991] mempool_free+0x290/0x380 [ 13.118015] mempool_double_free_helper+0x184/0x370 [ 13.118054] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.118081] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.118103] ? finish_task_switch.isra.0+0x153/0x700 [ 13.118129] mempool_page_alloc_double_free+0xe8/0x140 [ 13.118173] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 13.118202] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 13.118220] ? __pfx_mempool_free_pages+0x10/0x10 [ 13.118241] ? __pfx_read_tsc+0x10/0x10 [ 13.118262] ? ktime_get_ts64+0x86/0x230 [ 13.118287] kunit_try_run_case+0x1a5/0x480 [ 13.118330] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.118352] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.118374] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.118396] ? __kthread_parkme+0x82/0x180 [ 13.118417] ? preempt_count_sub+0x50/0x80 [ 13.118439] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.118461] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.118482] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.118505] kthread+0x337/0x6f0 [ 13.118522] ? trace_preempt_on+0x20/0xc0 [ 13.118545] ? __pfx_kthread+0x10/0x10 [ 13.118565] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.118585] ? calculate_sigpending+0x7b/0xa0 [ 13.118607] ? __pfx_kthread+0x10/0x10 [ 13.118628] ret_from_fork+0x116/0x1d0 [ 13.118645] ? __pfx_kthread+0x10/0x10 [ 13.118664] ret_from_fork_asm+0x1a/0x30 [ 13.118694] </TASK> [ 13.118705] [ 13.128003] The buggy address belongs to the physical page: [ 13.128482] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1029d0 [ 13.128819] flags: 0x200000000000000(node=0|zone=2) [ 13.129040] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 13.129616] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 13.130016] page dumped because: kasan: bad access detected [ 13.130306] [ 13.130405] Memory state around the buggy address: [ 13.130627] ffff8881029cff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.130915] ffff8881029cff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.131139] >ffff8881029d0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.131439] ^ [ 13.131629] ffff8881029d0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.131987] ffff8881029d0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.132704] ================================================================== [ 13.057503] ================================================================== [ 13.058605] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.059298] Free of addr ffff88810312fe00 by task kunit_try_catch/252 [ 13.059634] [ 13.059724] CPU: 1 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.059768] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.059779] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.059802] Call Trace: [ 13.059813] <TASK> [ 13.059827] dump_stack_lvl+0x73/0xb0 [ 13.059856] print_report+0xd1/0x650 [ 13.059879] ? __virt_addr_valid+0x1db/0x2d0 [ 13.059902] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.059925] ? mempool_double_free_helper+0x184/0x370 [ 13.059949] kasan_report_invalid_free+0x10a/0x130 [ 13.059972] ? mempool_double_free_helper+0x184/0x370 [ 13.059997] ? mempool_double_free_helper+0x184/0x370 [ 13.060019] ? mempool_double_free_helper+0x184/0x370 [ 13.060054] check_slab_allocation+0x101/0x130 [ 13.060075] __kasan_mempool_poison_object+0x91/0x1d0 [ 13.060099] mempool_free+0x2ec/0x380 [ 13.060121] mempool_double_free_helper+0x184/0x370 [ 13.060144] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.060167] ? update_load_avg+0x1be/0x21b0 [ 13.060189] ? dequeue_entities+0x27e/0x1740 [ 13.060214] ? finish_task_switch.isra.0+0x153/0x700 [ 13.060239] mempool_kmalloc_double_free+0xed/0x140 [ 13.060263] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 13.060290] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.060316] ? __pfx_mempool_kfree+0x10/0x10 [ 13.060340] ? __pfx_read_tsc+0x10/0x10 [ 13.060363] ? ktime_get_ts64+0x86/0x230 [ 13.060387] kunit_try_run_case+0x1a5/0x480 [ 13.060412] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.060433] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.060456] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.060478] ? __kthread_parkme+0x82/0x180 [ 13.060499] ? preempt_count_sub+0x50/0x80 [ 13.060521] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.060545] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.060568] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.060592] kthread+0x337/0x6f0 [ 13.060637] ? trace_preempt_on+0x20/0xc0 [ 13.060660] ? __pfx_kthread+0x10/0x10 [ 13.060680] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.060700] ? calculate_sigpending+0x7b/0xa0 [ 13.060723] ? __pfx_kthread+0x10/0x10 [ 13.060744] ret_from_fork+0x116/0x1d0 [ 13.060762] ? __pfx_kthread+0x10/0x10 [ 13.060781] ret_from_fork_asm+0x1a/0x30 [ 13.060811] </TASK> [ 13.060823] [ 13.069790] Allocated by task 252: [ 13.069980] kasan_save_stack+0x45/0x70 [ 13.070392] kasan_save_track+0x18/0x40 [ 13.070530] kasan_save_alloc_info+0x3b/0x50 [ 13.070678] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 13.070848] remove_element+0x11e/0x190 [ 13.071020] mempool_alloc_preallocated+0x4d/0x90 [ 13.071254] mempool_double_free_helper+0x8a/0x370 [ 13.071582] mempool_kmalloc_double_free+0xed/0x140 [ 13.072061] kunit_try_run_case+0x1a5/0x480 [ 13.072490] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.072678] kthread+0x337/0x6f0 [ 13.072800] ret_from_fork+0x116/0x1d0 [ 13.072931] ret_from_fork_asm+0x1a/0x30 [ 13.073141] [ 13.073236] Freed by task 252: [ 13.073395] kasan_save_stack+0x45/0x70 [ 13.073707] kasan_save_track+0x18/0x40 [ 13.073913] kasan_save_free_info+0x3f/0x60 [ 13.074277] __kasan_mempool_poison_object+0x131/0x1d0 [ 13.074521] mempool_free+0x2ec/0x380 [ 13.074714] mempool_double_free_helper+0x109/0x370 [ 13.074884] mempool_kmalloc_double_free+0xed/0x140 [ 13.075063] kunit_try_run_case+0x1a5/0x480 [ 13.075304] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.075554] kthread+0x337/0x6f0 [ 13.075721] ret_from_fork+0x116/0x1d0 [ 13.075925] ret_from_fork_asm+0x1a/0x30 [ 13.076146] [ 13.076249] The buggy address belongs to the object at ffff88810312fe00 [ 13.076249] which belongs to the cache kmalloc-128 of size 128 [ 13.076757] The buggy address is located 0 bytes inside of [ 13.076757] 128-byte region [ffff88810312fe00, ffff88810312fe80) [ 13.077130] [ 13.077304] The buggy address belongs to the physical page: [ 13.077556] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10312f [ 13.077896] flags: 0x200000000000000(node=0|zone=2) [ 13.078073] page_type: f5(slab) [ 13.078286] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.078612] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.078837] page dumped because: kasan: bad access detected [ 13.079065] [ 13.079197] Memory state around the buggy address: [ 13.079431] ffff88810312fd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.079746] ffff88810312fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.080186] >ffff88810312fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.080468] ^ [ 13.080586] ffff88810312fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.080802] ffff88810312ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.081076] ==================================================================