Date
July 9, 2025, 12:11 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 21.763039] ================================================================== [ 21.763161] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 21.763224] Free of addr fff00000c7848000 by task kunit_try_catch/240 [ 21.763326] [ 21.763363] CPU: 1 UID: 0 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.763698] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.763744] Hardware name: linux,dummy-virt (DT) [ 21.763879] Call trace: [ 21.763906] show_stack+0x20/0x38 (C) [ 21.763963] dump_stack_lvl+0x8c/0xd0 [ 21.764167] print_report+0x118/0x608 [ 21.764265] kasan_report_invalid_free+0xc0/0xe8 [ 21.764424] __kasan_mempool_poison_pages+0xe0/0xe8 [ 21.764579] mempool_free+0x24c/0x328 [ 21.764638] mempool_double_free_helper+0x150/0x2e8 [ 21.764690] mempool_page_alloc_double_free+0xbc/0x118 [ 21.764749] kunit_try_run_case+0x170/0x3f0 [ 21.764800] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.765044] kthread+0x328/0x630 [ 21.765194] ret_from_fork+0x10/0x20 [ 21.765307] [ 21.765367] The buggy address belongs to the physical page: [ 21.765447] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107848 [ 21.765717] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.765917] raw: 0bfffe0000000000 0000000000000000 dead000000000122 0000000000000000 [ 21.766057] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 21.766101] page dumped because: kasan: bad access detected [ 21.766151] [ 21.766330] Memory state around the buggy address: [ 21.766513] fff00000c7847f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.766653] fff00000c7847f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.766718] >fff00000c7848000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.766765] ^ [ 21.766832] fff00000c7848080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.767021] fff00000c7848100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.767142] ================================================================== [ 21.729903] ================================================================== [ 21.730157] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 21.730577] Free of addr fff00000c64b5e00 by task kunit_try_catch/236 [ 21.730677] [ 21.730715] CPU: 1 UID: 0 PID: 236 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.731075] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.731414] Hardware name: linux,dummy-virt (DT) [ 21.731467] Call trace: [ 21.731506] show_stack+0x20/0x38 (C) [ 21.731815] dump_stack_lvl+0x8c/0xd0 [ 21.731954] print_report+0x118/0x608 [ 21.732030] kasan_report_invalid_free+0xc0/0xe8 [ 21.732187] check_slab_allocation+0xd4/0x108 [ 21.732291] __kasan_mempool_poison_object+0x78/0x150 [ 21.732446] mempool_free+0x28c/0x328 [ 21.732515] mempool_double_free_helper+0x150/0x2e8 [ 21.732568] mempool_kmalloc_double_free+0xc0/0x118 [ 21.732627] kunit_try_run_case+0x170/0x3f0 [ 21.732676] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.732730] kthread+0x328/0x630 [ 21.733063] ret_from_fork+0x10/0x20 [ 21.733270] [ 21.733319] Allocated by task 236: [ 21.733731] kasan_save_stack+0x3c/0x68 [ 21.733837] kasan_save_track+0x20/0x40 [ 21.733988] kasan_save_alloc_info+0x40/0x58 [ 21.734067] __kasan_mempool_unpoison_object+0x11c/0x180 [ 21.734191] remove_element+0x130/0x1f8 [ 21.734268] mempool_alloc_preallocated+0x58/0xc0 [ 21.734327] mempool_double_free_helper+0x94/0x2e8 [ 21.734632] mempool_kmalloc_double_free+0xc0/0x118 [ 21.734730] kunit_try_run_case+0x170/0x3f0 [ 21.734777] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.735048] kthread+0x328/0x630 [ 21.735147] ret_from_fork+0x10/0x20 [ 21.735276] [ 21.735346] Freed by task 236: [ 21.735491] kasan_save_stack+0x3c/0x68 [ 21.735595] kasan_save_track+0x20/0x40 [ 21.735647] kasan_save_free_info+0x4c/0x78 [ 21.735688] __kasan_mempool_poison_object+0xc0/0x150 [ 21.735801] mempool_free+0x28c/0x328 [ 21.735840] mempool_double_free_helper+0x100/0x2e8 [ 21.735882] mempool_kmalloc_double_free+0xc0/0x118 [ 21.735923] kunit_try_run_case+0x170/0x3f0 [ 21.735977] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.736031] kthread+0x328/0x630 [ 21.736291] ret_from_fork+0x10/0x20 [ 21.736490] [ 21.736672] The buggy address belongs to the object at fff00000c64b5e00 [ 21.736672] which belongs to the cache kmalloc-128 of size 128 [ 21.736808] The buggy address is located 0 bytes inside of [ 21.736808] 128-byte region [fff00000c64b5e00, fff00000c64b5e80) [ 21.736895] [ 21.736922] The buggy address belongs to the physical page: [ 21.737036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1064b5 [ 21.737157] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 21.737276] page_type: f5(slab) [ 21.737570] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 21.737706] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 21.738067] page dumped because: kasan: bad access detected [ 21.738289] [ 21.738554] Memory state around the buggy address: [ 21.738618] fff00000c64b5d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.738949] fff00000c64b5d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.739182] >fff00000c64b5e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.739634] ^ [ 21.740159] fff00000c64b5e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.740248] fff00000c64b5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.740323] ================================================================== [ 21.750414] ================================================================== [ 21.750472] BUG: KASAN: double-free in mempool_double_free_helper+0x150/0x2e8 [ 21.750532] Free of addr fff00000c7848000 by task kunit_try_catch/238 [ 21.750575] [ 21.750608] CPU: 1 UID: 0 PID: 238 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT [ 21.750757] Tainted: [B]=BAD_PAGE, [N]=TEST [ 21.750796] Hardware name: linux,dummy-virt (DT) [ 21.750989] Call trace: [ 21.751040] show_stack+0x20/0x38 (C) [ 21.751164] dump_stack_lvl+0x8c/0xd0 [ 21.751219] print_report+0x118/0x608 [ 21.751284] kasan_report_invalid_free+0xc0/0xe8 [ 21.751769] __kasan_mempool_poison_object+0x14c/0x150 [ 21.751829] mempool_free+0x28c/0x328 [ 21.751905] mempool_double_free_helper+0x150/0x2e8 [ 21.752292] mempool_kmalloc_large_double_free+0xc0/0x118 [ 21.752353] kunit_try_run_case+0x170/0x3f0 [ 21.752675] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 21.752854] kthread+0x328/0x630 [ 21.752930] ret_from_fork+0x10/0x20 [ 21.753323] [ 21.753479] The buggy address belongs to the physical page: [ 21.753555] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107848 [ 21.753680] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 21.753757] flags: 0xbfffe0000000040(head|node=0|zone=2|lastcpupid=0x1ffff) [ 21.754026] page_type: f8(unknown) [ 21.754090] raw: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.754177] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.754497] head: 0bfffe0000000040 0000000000000000 dead000000000122 0000000000000000 [ 21.754746] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 21.754842] head: 0bfffe0000000002 ffffc1ffc31e1201 00000000ffffffff 00000000ffffffff [ 21.755115] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 21.755253] page dumped because: kasan: bad access detected [ 21.755287] [ 21.755604] Memory state around the buggy address: [ 21.755698] fff00000c7847f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.755823] fff00000c7847f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.755878] >fff00000c7848000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.756041] ^ [ 21.756150] fff00000c7848080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.756348] fff00000c7848100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 21.756526] ==================================================================
[ 14.354530] ================================================================== [ 14.355435] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.356232] Free of addr ffff88810a5ec000 by task kunit_try_catch/256 [ 14.356669] [ 14.356901] CPU: 1 UID: 0 PID: 256 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.357061] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.357077] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.357100] Call Trace: [ 14.357126] <TASK> [ 14.357146] dump_stack_lvl+0x73/0xb0 [ 14.357183] print_report+0xd1/0x650 [ 14.357207] ? __virt_addr_valid+0x1db/0x2d0 [ 14.357233] ? kasan_addr_to_slab+0x11/0xa0 [ 14.357253] ? mempool_double_free_helper+0x184/0x370 [ 14.357289] kasan_report_invalid_free+0x10a/0x130 [ 14.357313] ? mempool_double_free_helper+0x184/0x370 [ 14.357340] ? mempool_double_free_helper+0x184/0x370 [ 14.357364] __kasan_mempool_poison_pages+0x115/0x130 [ 14.357389] mempool_free+0x290/0x380 [ 14.357417] mempool_double_free_helper+0x184/0x370 [ 14.357442] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.357469] ? __pfx_sched_clock_cpu+0x10/0x10 [ 14.357493] ? finish_task_switch.isra.0+0x153/0x700 [ 14.357520] mempool_page_alloc_double_free+0xe8/0x140 [ 14.357547] ? __pfx_mempool_page_alloc_double_free+0x10/0x10 [ 14.357577] ? __pfx_mempool_alloc_pages+0x10/0x10 [ 14.357600] ? __pfx_mempool_free_pages+0x10/0x10 [ 14.357627] ? __pfx_read_tsc+0x10/0x10 [ 14.357650] ? ktime_get_ts64+0x86/0x230 [ 14.357675] kunit_try_run_case+0x1a5/0x480 [ 14.357702] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.357726] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.357751] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.357775] ? __kthread_parkme+0x82/0x180 [ 14.357797] ? preempt_count_sub+0x50/0x80 [ 14.357820] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.357844] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.357869] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.357895] kthread+0x337/0x6f0 [ 14.357913] ? trace_preempt_on+0x20/0xc0 [ 14.358001] ? __pfx_kthread+0x10/0x10 [ 14.358025] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.358047] ? calculate_sigpending+0x7b/0xa0 [ 14.358071] ? __pfx_kthread+0x10/0x10 [ 14.358093] ret_from_fork+0x116/0x1d0 [ 14.358112] ? __pfx_kthread+0x10/0x10 [ 14.358132] ret_from_fork_asm+0x1a/0x30 [ 14.358164] </TASK> [ 14.358175] [ 14.374049] The buggy address belongs to the physical page: [ 14.374671] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a5ec [ 14.375729] flags: 0x200000000000000(node=0|zone=2) [ 14.375925] raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 [ 14.376176] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 14.376993] page dumped because: kasan: bad access detected [ 14.377642] [ 14.377853] Memory state around the buggy address: [ 14.378452] ffff88810a5ebf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.379252] ffff88810a5ebf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.379650] >ffff88810a5ec000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.379866] ^ [ 14.380307] ffff88810a5ec080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.380977] ffff88810a5ec100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.381693] ================================================================== [ 14.329649] ================================================================== [ 14.330196] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.330517] Free of addr ffff88810a62c000 by task kunit_try_catch/254 [ 14.330777] [ 14.330893] CPU: 0 UID: 0 PID: 254 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.330951] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.330963] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.330985] Call Trace: [ 14.330997] <TASK> [ 14.331016] dump_stack_lvl+0x73/0xb0 [ 14.331048] print_report+0xd1/0x650 [ 14.331071] ? __virt_addr_valid+0x1db/0x2d0 [ 14.331096] ? kasan_addr_to_slab+0x11/0xa0 [ 14.331116] ? mempool_double_free_helper+0x184/0x370 [ 14.331142] kasan_report_invalid_free+0x10a/0x130 [ 14.331167] ? mempool_double_free_helper+0x184/0x370 [ 14.331194] ? mempool_double_free_helper+0x184/0x370 [ 14.331219] __kasan_mempool_poison_object+0x1b3/0x1d0 [ 14.331244] mempool_free+0x2ec/0x380 [ 14.331526] mempool_double_free_helper+0x184/0x370 [ 14.331559] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.331585] ? update_load_avg+0x1be/0x21b0 [ 14.331610] ? native_smp_send_reschedule+0x43/0x70 [ 14.331638] ? finish_task_switch.isra.0+0x153/0x700 [ 14.331664] mempool_kmalloc_large_double_free+0xed/0x140 [ 14.331691] ? __pfx_mempool_kmalloc_large_double_free+0x10/0x10 [ 14.331721] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.331746] ? __pfx_mempool_kfree+0x10/0x10 [ 14.331772] ? __pfx_read_tsc+0x10/0x10 [ 14.331794] ? ktime_get_ts64+0x86/0x230 [ 14.331819] kunit_try_run_case+0x1a5/0x480 [ 14.331845] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.331869] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.331895] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.331919] ? __kthread_parkme+0x82/0x180 [ 14.332039] ? preempt_count_sub+0x50/0x80 [ 14.332065] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.332092] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.332118] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.332142] kthread+0x337/0x6f0 [ 14.332162] ? trace_preempt_on+0x20/0xc0 [ 14.332187] ? __pfx_kthread+0x10/0x10 [ 14.332207] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.332232] ? calculate_sigpending+0x7b/0xa0 [ 14.332257] ? __pfx_kthread+0x10/0x10 [ 14.332292] ret_from_fork+0x116/0x1d0 [ 14.332311] ? __pfx_kthread+0x10/0x10 [ 14.332332] ret_from_fork_asm+0x1a/0x30 [ 14.332363] </TASK> [ 14.332374] [ 14.342987] The buggy address belongs to the physical page: [ 14.343528] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a62c [ 14.343872] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 14.344334] flags: 0x200000000000040(head|node=0|zone=2) [ 14.344636] page_type: f8(unknown) [ 14.344919] raw: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.345555] raw: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.345944] head: 0200000000000040 0000000000000000 dead000000000122 0000000000000000 [ 14.346281] head: 0000000000000000 0000000000000000 00000001f8000000 0000000000000000 [ 14.346831] head: 0200000000000002 ffffea0004298b01 00000000ffffffff 00000000ffffffff [ 14.347339] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 14.347748] page dumped because: kasan: bad access detected [ 14.348129] [ 14.348212] Memory state around the buggy address: [ 14.348477] ffff88810a62bf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.348769] ffff88810a62bf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.349435] >ffff88810a62c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.349734] ^ [ 14.349890] ffff88810a62c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.350422] ffff88810a62c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 14.350721] ================================================================== [ 14.302143] ================================================================== [ 14.302727] BUG: KASAN: double-free in mempool_double_free_helper+0x184/0x370 [ 14.303024] Free of addr ffff8881026ad400 by task kunit_try_catch/252 [ 14.303351] [ 14.303470] CPU: 0 UID: 0 PID: 252 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc5 #1 PREEMPT(voluntary) [ 14.303514] Tainted: [B]=BAD_PAGE, [N]=TEST [ 14.303526] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 14.303548] Call Trace: [ 14.303560] <TASK> [ 14.303578] dump_stack_lvl+0x73/0xb0 [ 14.303609] print_report+0xd1/0x650 [ 14.303634] ? __virt_addr_valid+0x1db/0x2d0 [ 14.303658] ? kasan_complete_mode_report_info+0x64/0x200 [ 14.303684] ? mempool_double_free_helper+0x184/0x370 [ 14.303722] kasan_report_invalid_free+0x10a/0x130 [ 14.303759] ? mempool_double_free_helper+0x184/0x370 [ 14.303787] ? mempool_double_free_helper+0x184/0x370 [ 14.303811] ? mempool_double_free_helper+0x184/0x370 [ 14.303834] check_slab_allocation+0x101/0x130 [ 14.303856] __kasan_mempool_poison_object+0x91/0x1d0 [ 14.303882] mempool_free+0x2ec/0x380 [ 14.303909] mempool_double_free_helper+0x184/0x370 [ 14.303945] ? __pfx_mempool_double_free_helper+0x10/0x10 [ 14.303982] ? kasan_save_track+0x18/0x40 [ 14.304001] ? kasan_save_alloc_info+0x3b/0x50 [ 14.304025] ? kasan_save_stack+0x45/0x70 [ 14.304049] mempool_kmalloc_double_free+0xed/0x140 [ 14.304074] ? __pfx_mempool_kmalloc_double_free+0x10/0x10 [ 14.304101] ? __pfx_mempool_kmalloc+0x10/0x10 [ 14.304125] ? __pfx_mempool_kfree+0x10/0x10 [ 14.304150] ? __pfx_read_tsc+0x10/0x10 [ 14.304172] ? ktime_get_ts64+0x86/0x230 [ 14.304197] kunit_try_run_case+0x1a5/0x480 [ 14.304223] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.304246] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 14.304271] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 14.304294] ? __kthread_parkme+0x82/0x180 [ 14.304316] ? preempt_count_sub+0x50/0x80 [ 14.304341] ? __pfx_kunit_try_run_case+0x10/0x10 [ 14.304373] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.304407] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 14.304441] kthread+0x337/0x6f0 [ 14.304460] ? trace_preempt_on+0x20/0xc0 [ 14.304484] ? __pfx_kthread+0x10/0x10 [ 14.304505] ? _raw_spin_unlock_irq+0x47/0x80 [ 14.304527] ? calculate_sigpending+0x7b/0xa0 [ 14.304552] ? __pfx_kthread+0x10/0x10 [ 14.304573] ret_from_fork+0x116/0x1d0 [ 14.304592] ? __pfx_kthread+0x10/0x10 [ 14.304612] ret_from_fork_asm+0x1a/0x30 [ 14.304644] </TASK> [ 14.304655] [ 14.314059] Allocated by task 252: [ 14.314259] kasan_save_stack+0x45/0x70 [ 14.314458] kasan_save_track+0x18/0x40 [ 14.314622] kasan_save_alloc_info+0x3b/0x50 [ 14.314820] __kasan_mempool_unpoison_object+0x1a9/0x200 [ 14.315213] remove_element+0x11e/0x190 [ 14.315434] mempool_alloc_preallocated+0x4d/0x90 [ 14.315620] mempool_double_free_helper+0x8a/0x370 [ 14.315852] mempool_kmalloc_double_free+0xed/0x140 [ 14.316203] kunit_try_run_case+0x1a5/0x480 [ 14.316394] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.316589] kthread+0x337/0x6f0 [ 14.316772] ret_from_fork+0x116/0x1d0 [ 14.317023] ret_from_fork_asm+0x1a/0x30 [ 14.317224] [ 14.317341] Freed by task 252: [ 14.317471] kasan_save_stack+0x45/0x70 [ 14.317618] kasan_save_track+0x18/0x40 [ 14.317812] kasan_save_free_info+0x3f/0x60 [ 14.318206] __kasan_mempool_poison_object+0x131/0x1d0 [ 14.318391] mempool_free+0x2ec/0x380 [ 14.318531] mempool_double_free_helper+0x109/0x370 [ 14.318697] mempool_kmalloc_double_free+0xed/0x140 [ 14.318866] kunit_try_run_case+0x1a5/0x480 [ 14.319068] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 14.319321] kthread+0x337/0x6f0 [ 14.319586] ret_from_fork+0x116/0x1d0 [ 14.320072] ret_from_fork_asm+0x1a/0x30 [ 14.320282] [ 14.320377] The buggy address belongs to the object at ffff8881026ad400 [ 14.320377] which belongs to the cache kmalloc-128 of size 128 [ 14.320850] The buggy address is located 0 bytes inside of [ 14.320850] 128-byte region [ffff8881026ad400, ffff8881026ad480) [ 14.321522] [ 14.321624] The buggy address belongs to the physical page: [ 14.321817] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1026ad [ 14.322147] flags: 0x200000000000000(node=0|zone=2) [ 14.322576] page_type: f5(slab) [ 14.322749] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 14.323369] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 14.323674] page dumped because: kasan: bad access detected [ 14.323854] [ 14.323924] Memory state around the buggy address: [ 14.324094] ffff8881026ad300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.324349] ffff8881026ad380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.324664] >ffff8881026ad400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 14.324993] ^ [ 14.325155] ffff8881026ad480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 14.325463] ffff8881026ad500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 14.325672] ==================================================================