Date
July 1, 2025, 3:08 p.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 19.015712] ================================================================== [ 19.015803] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 19.015873] Free of addr fff00000c7bc4000 by task kunit_try_catch/238 [ 19.016063] [ 19.016136] CPU: 0 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 19.016233] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.016260] Hardware name: linux,dummy-virt (DT) [ 19.016494] Call trace: [ 19.016670] show_stack+0x20/0x38 (C) [ 19.016813] dump_stack_lvl+0x8c/0xd0 [ 19.016868] print_report+0x118/0x608 [ 19.016915] kasan_report_invalid_free+0xc0/0xe8 [ 19.017339] __kasan_mempool_poison_object+0x14c/0x150 [ 19.017426] mempool_free+0x28c/0x328 [ 19.017489] mempool_double_free_helper+0x150/0x2e8 [ 19.017540] mempool_kmalloc_large_double_free+0xc0/0x118 [ 19.017799] kunit_try_run_case+0x170/0x3f0 [ 19.018010] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.018130] kthread+0x328/0x630 [ 19.018192] ret_from_fork+0x10/0x20 [ 19.018482] [ 19.018621] The buggy address belongs to the physical page: [ 19.018784] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107bc4 [ 19.019177] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.019266] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 19.019541] page_type: f8(unknown) [ 19.019734] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.019862] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.019965] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 19.020277] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 19.020385] head: 0bfffe0000000002 ffffc1ffc31ef101 00000000ffffffff 00000000ffffffff [ 19.020501] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 19.020675] page dumped because: kasan: bad access detected [ 19.020725] [ 19.021053] Memory state around the buggy address: [ 19.021108] fff00000c7bc3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.021398] fff00000c7bc3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.021558] >fff00000c7bc4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.021704] ^ [ 19.021740] fff00000c7bc4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022086] fff00000c7bc4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.022305] ================================================================== [ 18.996761] ================================================================== [ 18.996829] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 18.996900] Free of addr fff00000c669fe00 by task kunit_try_catch/236 [ 18.996955] [ 18.996994] CPU: 0 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.997077] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.997105] Hardware name: linux,dummy-virt (DT) [ 18.997137] Call trace: [ 18.997159] show_stack+0x20/0x38 (C) [ 18.997213] dump_stack_lvl+0x8c/0xd0 [ 18.997284] print_report+0x118/0x608 [ 18.997934] kasan_report_invalid_free+0xc0/0xe8 [ 18.998037] check_slab_allocation+0xd4/0x108 [ 18.998113] __kasan_mempool_poison_object+0x78/0x150 [ 18.998398] mempool_free+0x28c/0x328 [ 18.998587] mempool_double_free_helper+0x150/0x2e8 [ 18.998733] mempool_kmalloc_double_free+0xc0/0x118 [ 18.999002] kunit_try_run_case+0x170/0x3f0 [ 18.999185] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.999320] kthread+0x328/0x630 [ 18.999375] ret_from_fork+0x10/0x20 [ 18.999606] [ 18.999749] Allocated by task 236: [ 18.999795] kasan_save_stack+0x3c/0x68 [ 18.999861] kasan_save_track+0x20/0x40 [ 18.999994] kasan_save_alloc_info+0x40/0x58 [ 19.000090] __kasan_mempool_unpoison_object+0x11c/0x180 [ 19.000272] remove_element+0x130/0x1f8 [ 19.000339] mempool_alloc_preallocated+0x58/0xc0 [ 19.000705] mempool_double_free_helper+0x94/0x2e8 [ 19.000784] mempool_kmalloc_double_free+0xc0/0x118 [ 19.000900] kunit_try_run_case+0x170/0x3f0 [ 19.001008] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.001089] kthread+0x328/0x630 [ 19.001215] ret_from_fork+0x10/0x20 [ 19.001273] [ 19.001294] Freed by task 236: [ 19.001544] kasan_save_stack+0x3c/0x68 [ 19.001721] kasan_save_track+0x20/0x40 [ 19.001910] kasan_save_free_info+0x4c/0x78 [ 19.002098] __kasan_mempool_poison_object+0xc0/0x150 [ 19.002199] mempool_free+0x28c/0x328 [ 19.002243] mempool_double_free_helper+0x100/0x2e8 [ 19.002464] mempool_kmalloc_double_free+0xc0/0x118 [ 19.002657] kunit_try_run_case+0x170/0x3f0 [ 19.002720] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.002850] kthread+0x328/0x630 [ 19.002928] ret_from_fork+0x10/0x20 [ 19.002963] [ 19.003314] The buggy address belongs to the object at fff00000c669fe00 [ 19.003314] which belongs to the cache kmalloc-128 of size 128 [ 19.003634] The buggy address is located 0 bytes inside of [ 19.003634] 128-byte region [fff00000c669fe00, fff00000c669fe80) [ 19.003888] [ 19.003913] The buggy address belongs to the physical page: [ 19.004126] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10669f [ 19.004427] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.004559] page_type: f5(slab) [ 19.005247] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 19.005368] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 19.005508] page dumped because: kasan: bad access detected [ 19.005633] [ 19.005773] Memory state around the buggy address: [ 19.005838] fff00000c669fd00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.005885] fff00000c669fd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.005930] >fff00000c669fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 19.006246] ^ [ 19.006423] fff00000c669fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.006621] fff00000c669ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.006717] ================================================================== [ 19.040642] ================================================================== [ 19.040822] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 19.040893] Free of addr fff00000c7bc4000 by task kunit_try_catch/240 [ 19.041145] [ 19.041192] CPU: 0 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 19.041502] Tainted: [B]=BAD_PAGE, [N]=TEST [ 19.041652] Hardware name: linux,dummy-virt (DT) [ 19.041688] Call trace: [ 19.041719] show_stack+0x20/0x38 (C) [ 19.041935] dump_stack_lvl+0x8c/0xd0 [ 19.042128] print_report+0x118/0x608 [ 19.042199] kasan_report_invalid_free+0xc0/0xe8 [ 19.042346] __kasan_mempool_poison_pages+0xe0/0xe8 [ 19.042463] mempool_free+0x24c/0x328 [ 19.042658] mempool_double_free_helper+0x150/0x2e8 [ 19.042767] mempool_page_alloc_double_free+0xbc/0x118 [ 19.042855] kunit_try_run_case+0x170/0x3f0 [ 19.043181] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 19.043349] kthread+0x328/0x630 [ 19.043634] ret_from_fork+0x10/0x20 [ 19.043759] [ 19.043806] The buggy address belongs to the physical page: [ 19.044008] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107bc4 [ 19.044210] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 19.044355] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 19.044600] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 19.044670] page dumped because: kasan: bad access detected [ 19.045023] [ 19.045331] Memory state around the buggy address: [ 19.045382] fff00000c7bc3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.045429] fff00000c7bc3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.045474] >fff00000c7bc4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.045515] ^ [ 19.045543] fff00000c7bc4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.045598] fff00000c7bc4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 19.046031] ==================================================================
[ 13.317367] ================================================================== [ 13.317894] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.318266] Free of addr ffff8881039c4000 by task kunit_try_catch/254 [ 13.318542] [ 13.318649] CPU: 0 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.318699] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.318712] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.318735] Call Trace: [ 13.318748] <TASK> [ 13.318767] dump_stack_lvl+0x73/0xb0 [ 13.318795] print_report+0xd1/0x650 [ 13.318819] ? __virt_addr_valid+0x1db/0x2d0 [ 13.318843] ? kasan_addr_to_slab+0x11/0xa0 [ 13.318863] ? mempool_double_free_helper+0x184/0x370 [ 13.318886] kasan_report_invalid_free+0x10a/0x130 [ 13.318910] ? mempool_double_free_helper+0x184/0x370 [ 13.318935] ? mempool_double_free_helper+0x184/0x370 [ 13.318957] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 13.318981] mempool_free+0x2ec/0x380 [ 13.319002] mempool_double_free_helper+0x184/0x370 [ 13.319036] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.319058] ? update_load_avg+0x1be/0x21b0 [ 13.319084] ? finish_task_switch.isra.0+0x153/0x700 [ 13.319108] mempool_kmalloc_large_double_free+0xed/0x140 [ 13.319133] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 13.319159] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.319181] ? __pfx_mempool_kfree+0x10/0x10 [ 13.319204] ? __pfx_read_tsc+0x10/0x10 [ 13.319224] ? ktime_get_ts64+0x86/0x230 [ 13.319247] kunit_try_run_case+0x1a5/0x480 [ 13.319272] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.319293] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.319316] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.319339] ? __kthread_parkme+0x82/0x180 [ 13.319359] ? preempt_count_sub+0x50/0x80 [ 13.319381] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.319404] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.319426] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.319448] kthread+0x337/0x6f0 [ 13.319467] ? trace_preempt_on+0x20/0xc0 [ 13.319490] ? __pfx_kthread+0x10/0x10 [ 13.319509] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.319530] ? calculate_sigpending+0x7b/0xa0 [ 13.319553] ? __pfx_kthread+0x10/0x10 [ 13.319573] ret_from_fork+0x116/0x1d0 [ 13.319591] ? __pfx_kthread+0x10/0x10 [ 13.319611] ret_from_fork_asm+0x1a/0x30 [ 13.319641] </TASK> [ 13.319653] [ 13.328355] The buggy address belongs to the physical page: [ 13.328554] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1039c4 [ 13.328886] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 13.329135] flags: 0x200000000000040(head|node=0|zone=2) [ 13.329339] page_type: f8(unknown) [ 13.329525] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.330126] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.330437] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 13.330816] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 13.331186] head: 0200000000000002 ffffea00040e7101 00000000ffffffff 00000000ffffffff [ 13.331535] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 13.331961] page dumped because: kasan: bad access detected [ 13.332239] [ 13.332337] Memory state around the buggy address: [ 13.332570] ffff8881039c3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.332961] ffff8881039c3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.333194] >ffff8881039c4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.333407] ^ [ 13.333523] ffff8881039c4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.334003] ffff8881039c4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.334343] ================================================================== [ 13.342409] ================================================================== [ 13.343115] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.343535] Free of addr ffff888102a8c000 by task kunit_try_catch/256 [ 13.343901] [ 13.344038] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.344086] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.344100] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.344122] Call Trace: [ 13.344135] <TASK> [ 13.344161] dump_stack_lvl+0x73/0xb0 [ 13.344194] print_report+0xd1/0x650 [ 13.344218] ? __virt_addr_valid+0x1db/0x2d0 [ 13.344244] ? kasan_addr_to_slab+0x11/0xa0 [ 13.344264] ? mempool_double_free_helper+0x184/0x370 [ 13.344288] kasan_report_invalid_free+0x10a/0x130 [ 13.344311] ? mempool_double_free_helper+0x184/0x370 [ 13.344336] ? mempool_double_free_helper+0x184/0x370 [ 13.344358] __kasan_mempool_poison_pages+0x115/0x130 [ 13.344381] mempool_free+0x290/0x380 [ 13.344404] mempool_double_free_helper+0x184/0x370 [ 13.344427] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.344453] ? finish_task_switch.isra.0+0x153/0x700 [ 13.344481] mempool_page_alloc_double_free+0xe8/0x140 [ 13.344504] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 13.344531] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 13.344550] ? __pfx_mempool_free_pages+0x10/0x10 [ 13.344571] ? __pfx_read_tsc+0x10/0x10 [ 13.344592] ? ktime_get_ts64+0x86/0x230 [ 13.344617] kunit_try_run_case+0x1a5/0x480 [ 13.344701] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.344726] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.344751] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.344773] ? __kthread_parkme+0x82/0x180 [ 13.344794] ? preempt_count_sub+0x50/0x80 [ 13.344816] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.344839] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.344861] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.344884] kthread+0x337/0x6f0 [ 13.344903] ? trace_preempt_on+0x20/0xc0 [ 13.344927] ? __pfx_kthread+0x10/0x10 [ 13.344948] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.344968] ? calculate_sigpending+0x7b/0xa0 [ 13.344992] ? __pfx_kthread+0x10/0x10 [ 13.345013] ret_from_fork+0x116/0x1d0 [ 13.345043] ? __pfx_kthread+0x10/0x10 [ 13.345063] ret_from_fork_asm+0x1a/0x30 [ 13.345093] </TASK> [ 13.345106] [ 13.356191] The buggy address belongs to the physical page: [ 13.356428] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102a8c [ 13.356793] flags: 0x200000000000000(node=0|zone=2) [ 13.357768] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 13.358094] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 13.358421] page dumped because: kasan: bad access detected [ 13.358741] [ 13.358850] Memory state around the buggy address: [ 13.359078] ffff888102a8bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.359422] ffff888102a8bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.359734] >ffff888102a8c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.360014] ^ [ 13.360194] ffff888102a8c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.360587] ffff888102a8c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 13.360914] ================================================================== [ 13.275224] ================================================================== [ 13.276467] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 13.277597] Free of addr ffff8881027e1100 by task kunit_try_catch/252 [ 13.277948] [ 13.278063] CPU: 1 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 13.278113] Tainted: [B]=BAD_PAGE, [N]=TEST [ 13.278125] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 13.278149] Call Trace: [ 13.278162] <TASK> [ 13.278181] dump_stack_lvl+0x73/0xb0 [ 13.278213] print_report+0xd1/0x650 [ 13.278236] ? __virt_addr_valid+0x1db/0x2d0 [ 13.278263] ? kasan_complete_mode_report_info+0x64/0x200 [ 13.278284] ? mempool_double_free_helper+0x184/0x370 [ 13.278307] kasan_report_invalid_free+0x10a/0x130 [ 13.278330] ? mempool_double_free_helper+0x184/0x370 [ 13.278355] ? mempool_double_free_helper+0x184/0x370 [ 13.278376] ? mempool_double_free_helper+0x184/0x370 [ 13.278398] check_slab_allocation+0x101/0x130 [ 13.278418] __kasan_mempool_poison_object+0x91/0x1d0 [ 13.278466] mempool_free+0x2ec/0x380 [ 13.278491] mempool_double_free_helper+0x184/0x370 [ 13.278514] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 13.278540] ? __pfx_sched_clock_cpu+0x10/0x10 [ 13.278561] ? finish_task_switch.isra.0+0x153/0x700 [ 13.278588] mempool_kmalloc_double_free+0xed/0x140 [ 13.278611] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 13.278708] ? __pfx_mempool_kmalloc+0x10/0x10 [ 13.278736] ? __pfx_mempool_kfree+0x10/0x10 [ 13.278761] ? __pfx_read_tsc+0x10/0x10 [ 13.278783] ? ktime_get_ts64+0x86/0x230 [ 13.278809] kunit_try_run_case+0x1a5/0x480 [ 13.278836] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.278857] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 13.278881] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 13.278903] ? __kthread_parkme+0x82/0x180 [ 13.278925] ? preempt_count_sub+0x50/0x80 [ 13.278948] ? __pfx_kunit_try_run_case+0x10/0x10 [ 13.278971] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.278993] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 13.279015] kthread+0x337/0x6f0 [ 13.279046] ? trace_preempt_on+0x20/0xc0 [ 13.279071] ? __pfx_kthread+0x10/0x10 [ 13.279090] ? _raw_spin_unlock_irq+0x47/0x80 [ 13.279111] ? calculate_sigpending+0x7b/0xa0 [ 13.279135] ? __pfx_kthread+0x10/0x10 [ 13.279156] ret_from_fork+0x116/0x1d0 [ 13.279175] ? __pfx_kthread+0x10/0x10 [ 13.279194] ret_from_fork_asm+0x1a/0x30 [ 13.279224] </TASK> [ 13.279237] [ 13.290129] Allocated by task 252: [ 13.290303] kasan_save_stack+0x45/0x70 [ 13.290507] kasan_save_track+0x18/0x40 [ 13.290988] kasan_save_alloc_info+0x3b/0x50 [ 13.291237] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 13.291474] remove_element+0x11e/0x190 [ 13.292130] mempool_alloc_preallocated+0x4d/0x90 [ 13.292348] mempool_double_free_helper+0x8a/0x370 [ 13.292569] mempool_kmalloc_double_free+0xed/0x140 [ 13.293013] kunit_try_run_case+0x1a5/0x480 [ 13.293231] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.293462] kthread+0x337/0x6f0 [ 13.293625] ret_from_fork+0x116/0x1d0 [ 13.294119] ret_from_fork_asm+0x1a/0x30 [ 13.294309] [ 13.294401] Freed by task 252: [ 13.294545] kasan_save_stack+0x45/0x70 [ 13.295163] kasan_save_track+0x18/0x40 [ 13.295440] kasan_save_free_info+0x3f/0x60 [ 13.295830] __kasan_mempool_poison_object+0x131/0x1d0 [ 13.296069] mempool_free+0x2ec/0x380 [ 13.296240] mempool_double_free_helper+0x109/0x370 [ 13.296447] mempool_kmalloc_double_free+0xed/0x140 [ 13.297185] kunit_try_run_case+0x1a5/0x480 [ 13.297377] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 13.297557] kthread+0x337/0x6f0 [ 13.298059] ret_from_fork+0x116/0x1d0 [ 13.298798] ret_from_fork_asm+0x1a/0x30 [ 13.299265] [ 13.299479] The buggy address belongs to the object at ffff8881027e1100 [ 13.299479] which belongs to the cache kmalloc-128 of size 128 [ 13.300401] The buggy address is located 0 bytes inside of [ 13.300401] 128-byte region [ffff8881027e1100, ffff8881027e1180) [ 13.301785] [ 13.301887] The buggy address belongs to the physical page: [ 13.302149] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1027e1 [ 13.303051] flags: 0x200000000000000(node=0|zone=2) [ 13.303547] page_type: f5(slab) [ 13.303705] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 13.304206] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 13.304606] page dumped because: kasan: bad access detected [ 13.304902] [ 13.305132] Memory state around the buggy address: [ 13.305635] ffff8881027e1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.306263] ffff8881027e1080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.306886] >ffff8881027e1100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 13.307545] ^ [ 13.307887] ffff8881027e1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 13.308404] ffff8881027e1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 13.309102] ==================================================================