Skip to content

Kernel panics in ipts when shutting down #1181

Description

@ishland

Description of the bug or feature

As the title says, but this only happened once. Possible use-after-free?

Environment

  • Hardware model: Surface Pro 5
  • Kernel version: Linux SurfacePro-6846 6.3.7-surface #1 SMP PREEMPT_DYNAMIC Wed Jun 14 12:57:39 UTC 2023 x86_64 GNU/Linux
  • Distribution: Debian GNU/Linux trixie/sid x86_64
`dmesg` output

dmesg.txt

... truncated, see attached file for full dmesg

[   23.291185] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping
[   23.292266] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping
[   23.293346] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping
[   23.294473] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping
[   23.304661] dptf_power INT3407:00: Unsupported event [0x82]
[  312.066874] warning: `kded5' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[  317.815595] Bluetooth: RFCOMM TTY layer initialized
[  317.815619] Bluetooth: RFCOMM socket layer initialized
[  317.815638] Bluetooth: RFCOMM ver 1.11
[  320.539537] audit: type=1400 audit(1688735077.901:49): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/system/node/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[  320.541239] audit: type=1400 audit(1688735077.905:50): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/home/ishland/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[  320.541650] audit: type=1400 audit(1688735077.905:51): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/bus/nd/devices/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[  320.741156] audit: type=1400 audit(1688735078.104:52): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/system/node/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[  320.741584] audit: type=1400 audit(1688735078.104:53): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/home/ishland/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[  320.741605] audit: type=1400 audit(1688735078.104:54): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/bus/nd/devices/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[  320.962424] audit: type=1400 audit(1688735078.324:55): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/block/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[  321.001830] audit: type=1400 audit(1688735078.364:56): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/pci0000:00/0000:00:1d.0/0000:02:00.0/nvme/nvme0/nvme0n1/queue/physical_block_size" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 3966.439837] hid-generic 0005:045E:0921.0004: item fetching failed at offset 43/44
[ 3966.439850] hid-generic: probe of 0005:045E:0921.0004 failed with error -22
[ 4203.091503] hid-generic 0005:045E:0921.0005: item fetching failed at offset 43/44
[ 4203.091522] hid-generic: probe of 0005:045E:0921.0005 failed with error -22
[ 4869.902978] hid-generic 0005:045E:0921.0006: item fetching failed at offset 43/44
[ 4869.902998] hid-generic: probe of 0005:045E:0921.0006 failed with error -22
[ 5370.147697] hid-generic 0005:045E:0921.0007: item fetching failed at offset 43/44
[ 5370.147735] hid-generic: probe of 0005:045E:0921.0007 failed with error -22
[ 5644.721181] hid-generic 0005:045E:0921.0008: item fetching failed at offset 43/44
[ 5644.721238] hid-generic: probe of 0005:045E:0921.0008 failed with error -22
[10844.874897] audit: type=1400 audit(1688745601.983:57): apparmor="DENIED" operation="capable" class="cap" profile="/usr/sbin/cupsd" pid=15742 comm="cupsd" capability=12  capname="net_admin"
[12436.682599] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Stopping IPTS
[12436.696060] ------------[ cut here ]------------
[12436.696067] refcount_t: addition on 0; use-after-free.
[12436.696081] WARNING: CPU: 1 PID: 1049 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0x110
[12436.696093] Modules linked in: uhid rfcomm tls snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_nat veth xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo br_netfilter nft_masq nft_chain_nat nf_nat bridge stp llc qrtr overlay cmac algif_hash algif_skcipher af_alg bnep zstd btusb btrtl btbcm btintel btmtk bluetooth ecdh_generic ecc snd_sof_pci_intel_skl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence input_leds snd_sof_intel_hda snd_sof_pci ip6t_REJECT snd_sof_xtensa_dsp nf_reject_ipv6 snd_sof xt_hl snd_sof_utils ip6_tables soundwire_bus intel_tcc_cooling ip6t_rt x86_pkg_temp_thermal snd_soc_avs intel_powerclamp snd_soc_hda_codec coretemp snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core kvm_intel snd_soc_sst_ipc ipt_REJECT nf_reject_ipv4 snd_soc_sst_dsp kvm hid_multitouch xt_LOG snd_soc_acpi_intel_match nf_log_syslog snd_soc_acpi snd_hda_codec_hdmi xt_multiport snd_soc_core irqbypass crct10dif_pclmul snd_hda_codec_realtek snd_hda_codec_generic nft_limit snd_compress
[12436.696189]  polyval_clmulni ledtrig_audio ac97_bus polyval_generic snd_pcm_dmaengine ghash_clmulni_intel sha512_ssse3 snd_hda_intel xt_limit snd_intel_dspcfg aesni_intel snd_intel_sdw_acpi xt_addrtype crypto_simd snd_hda_codec xt_tcpudp joydev cryptd snd_hda_core xt_conntrack snd_hwdep surface_platform_profile dw9719 rapl mei_pxp mei_hdcp nf_conntrack ipts binfmt_misc platform_profile snd_pcm intel_rapl_msr hid_sensor_rotation hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_als mwifiex_pcie processor_thermal_device_pci_legacy intel_cstate nf_defrag_ipv6 gpio_keys tcp_bbr ipu3_imgu(C) ipu3_cio2 snd_timer hid_sensor_trigger processor_thermal_device mwifiex nf_defrag_ipv4 pcspkr videobuf2_dma_sg surface_gpe snd industrialio_triggered_buffer processor_thermal_rfim ov8865 ov5693 ov7251 mei_me nft_compat intel_skl_int3472_tps68470 msr cfg80211 videobuf2_memops soundcore kfifo_buf 8250_dw processor_thermal_mbox v4l2_fwnode mei tps68470_regulator parport_pc nf_tables videobuf2_v4l2 hid_sensor_iio_common
[12436.696285]  processor_thermal_rapl intel_rapl_common v4l2_async ppdev intel_pch_thermal clk_tps68470 industrialio nfnetlink videobuf2_common intel_soc_dts_iosf videodev intel_xhci_usb_role_switch mc intel_skl_int3472_discrete int3400_thermal lp int3403_thermal surfacepro3_button nls_iso8859_1 surface_acpi_notify surface_aggregator_registry soc_button_array acpi_tad acpi_pad dptf_power acpi_thermal_rel int340x_thermal_zone mac_hid parport efi_pstore dmi_sysfs ip_tables x_tables autofs4 btrfs xor raid6_pq libcrc32c hid_sensor_hub uas usb_storage intel_ishtp_hid hid_generic usbhid hid i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper syscopyarea sysfillrect sysimgblt intel_lpss_pci nvme intel_ish_ipc intel_lpss xhci_pci video crc32_pclmul nvme_core drm intel_ishtp idma64 xhci_pci_renesas wmi nvme_common surface_aggregator pinctrl_sunrisepoint
[12436.696369] CPU: 1 PID: 1049 Comm: iptsd Kdump: loaded Tainted: G         C         6.3.7-surface #1
[12436.696375] Hardware name: Microsoft Corporation Surface Pro/Surface Pro, BIOS 238.167.768 05.07.2014
[12436.696377] RIP: 0010:refcount_warn_saturate+0x7a/0x110
[12436.696386] Code: 01 e8 ca 6f 9e ff 0f 0b 5d c3 cc cc cc cc 80 3d 9a 90 5e 01 00 75 c9 48 c7 c7 a8 0c 36 9b c6 05 8a 90 5e 01 01 e8 a6 6f 9e ff <0f> 0b 5d c3 cc cc cc cc 80 3d 78 90 5e 01 00 75 a5 48 c7 c7 80 0c
[12436.696390] RSP: 0018:ffffacee00f87cc0 EFLAGS: 00010282
[12436.696394] RAX: 0000000000000000 RBX: ffff93618c9415e8 RCX: 0000000000000027
[12436.696398] RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9362e74a0548
[12436.696401] RBP: ffffacee00f87cc0 R08: 0000000000000000 R09: ffffacee00f87b28
[12436.696404] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9361aa1e9a00
[12436.696407] R13: ffff9361aa1e9a28 R14: ffff93619411fdf8 R15: 0000000000000002
[12436.696409] FS:  00007fd55f6a5740(0000) GS:ffff9362e7480000(0000) knlGS:0000000000000000
[12436.696413] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12436.696416] CR2: 000055b72c7b8370 CR3: 000000010ce46002 CR4: 00000000003706e0
[12436.696419] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[12436.696422] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[12436.696425] Call Trace:
[12436.696427]  <TASK>
[12436.696431]  ? show_regs+0x68/0x70
[12436.696436]  ? refcount_warn_saturate+0x7a/0x110
[12436.696441]  ? __warn+0x8f/0x150
[12436.696447]  ? refcount_warn_saturate+0x7a/0x110
[12436.696452]  ? report_bug+0x1c2/0x1d0
[12436.696458]  ? console_unlock+0x74/0xd0
[12436.696462]  ? irq_work_queue+0x10/0x50
[12436.696467]  ? handle_bug+0x46/0x80
[12436.696473]  ? exc_invalid_op+0x19/0x70
[12436.696478]  ? asm_exc_invalid_op+0x1b/0x20
[12436.696484]  ? refcount_warn_saturate+0x7a/0x110
[12436.696490]  kthread_stop+0x18d/0x1a0
[12436.696496]  ipts_thread_stop+0x32/0x60 [ipts]
[12436.696505]  ipts_receiver_stop+0x22/0x60 [ipts]
[12436.696514]  _ipts_control_stop+0x2f/0xd0 [ipts]
[12436.696522]  ipts_control_restart+0x13/0x40 [ipts]
[12436.696529]  ipts_hid_raw_request+0x1cd/0x250 [ipts]
[12436.696537]  hid_hw_raw_request+0x3d/0x50 [hid]
[12436.696549]  hidraw_send_report+0xa2/0x150 [hid]
[12436.696563]  hidraw_ioctl+0x25a/0x3a0 [hid]
[12436.696575]  __x64_sys_ioctl+0x92/0xd0
[12436.696581]  do_syscall_64+0x59/0x90
[12436.696587]  ? syscall_exit_to_user_mode+0x26/0x50
[12436.696592]  ? do_syscall_64+0x69/0x90
[12436.696596]  ? exit_to_user_mode_prepare+0x3d/0x190
[12436.696602]  ? do_user_addr_fault+0x1e5/0x6e0
[12436.696607]  ? irqentry_exit_to_user_mode+0x9/0x20
[12436.696611]  ? irqentry_exit+0x3b/0x50
[12436.696616]  ? exc_page_fault+0x87/0x180
[12436.696620]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[12436.696625] RIP: 0033:0x7fd55f23c4eb
[12436.696629] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[12436.696633] RSP: 002b:00007ffe7fcb4ab0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[12436.696637] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fd55f23c4eb
[12436.696639] RDX: 00007ffe7fcb4b38 RSI: 00000000c0024806 RDI: 0000000000000003
[12436.696642] RBP: 0000000000a54f80 R08: 0000000000000007 R09: 0000000000a553c0
[12436.696644] R10: 71b550f12e327857 R11: 0000000000000246 R12: 0000000000a553c0
[12436.696647] R13: 00007ffe7fcb4c20 R14: 0000000000a553c1 R15: 0000000000000042
[12436.696653]  </TASK>
[12436.696655] ---[ end trace 0000000000000000 ]---
[12436.696660] BUG: kernel NULL pointer dereference, address: 0000000000000000
[12436.696663] #PF: supervisor write access in kernel mode
[12436.696666] #PF: error_code(0x0002) - not-present page
[12436.696668] PGD 800000012a6b4067 P4D 800000012a6b4067 PUD 12a6b5067 PMD 0 
[12436.696675] Oops: 0002 [#1] PREEMPT SMP PTI
[12436.696679] CPU: 1 PID: 1049 Comm: iptsd Kdump: loaded Tainted: G        WC         6.3.7-surface #1
[12436.696684] Hardware name: Microsoft Corporation Surface Pro/Surface Pro, BIOS 238.167.768 05.07.2014
[12436.696686] RIP: 0010:kthread_stop+0x54/0x1a0
[12436.696691] Code: c0 0f 84 4f 01 00 00 0f 88 17 01 00 00 83 c0 01 0f 88 0e 01 00 00 41 f6 44 24 2e 20 0f 84 1b 01 00 00 49 8b 9c 24 80 0a 00 00 <f0> 80 0b 02 4c 89 e7 e8 00 fc ff ff f0 41 80 4c 24 02 02 4c 89 e7
[12436.696695] RSP: 0018:ffffacee00f87cd0 EFLAGS: 00010202
[12436.696698] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027
[12436.696701] RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9362e74a0548
[12436.696704] RBP: ffffacee00f87cf0 R08: 0000000000000000 R09: ffffacee00f87b28
[12436.696706] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9361aa1e9a00
[12436.696709] R13: ffff9361aa1e9a28 R14: ffff93619411fdf8 R15: 0000000000000002
[12436.696711] FS:  00007fd55f6a5740(0000) GS:ffff9362e7480000(0000) knlGS:0000000000000000
[12436.696715] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12436.696717] CR2: 0000000000000000 CR3: 000000010ce46002 CR4: 00000000003706e0
[12436.696720] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[12436.696722] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[12436.696724] Call Trace:
[12436.696726]  <TASK>
[12436.696728]  ? show_regs+0x68/0x70
[12436.696732]  ? __die_body+0x20/0x70
[12436.696736]  ? __die+0x2b/0x40
[12436.696740]  ? page_fault_oops+0x154/0x4a0
[12436.696747]  ? __warn+0xb5/0x150
[12436.696752]  ? do_user_addr_fault+0x321/0x6e0
[12436.696756]  ? irq_work_queue+0x10/0x50
[12436.696761]  ? exc_page_fault+0x76/0x180
[12436.696766]  ? asm_exc_page_fault+0x27/0x30
[12436.696773]  ? kthread_stop+0x54/0x1a0
[12436.696779]  ipts_thread_stop+0x32/0x60 [ipts]
[12436.696787]  ipts_receiver_stop+0x22/0x60 [ipts]
[12436.696795]  _ipts_control_stop+0x2f/0xd0 [ipts]
[12436.696803]  ipts_control_restart+0x13/0x40 [ipts]
[12436.696810]  ipts_hid_raw_request+0x1cd/0x250 [ipts]
[12436.696819]  hid_hw_raw_request+0x3d/0x50 [hid]
[12436.696830]  hidraw_send_report+0xa2/0x150 [hid]
[12436.696843]  hidraw_ioctl+0x25a/0x3a0 [hid]
[12436.696855]  __x64_sys_ioctl+0x92/0xd0
[12436.696862]  do_syscall_64+0x59/0x90
[12436.696866]  ? syscall_exit_to_user_mode+0x26/0x50
[12436.696871]  ? do_syscall_64+0x69/0x90
[12436.696875]  ? exit_to_user_mode_prepare+0x3d/0x190
[12436.696879]  ? do_user_addr_fault+0x1e5/0x6e0
[12436.696883]  ? irqentry_exit_to_user_mode+0x9/0x20
[12436.696888]  ? irqentry_exit+0x3b/0x50
[12436.696892]  ? exc_page_fault+0x87/0x180
[12436.696896]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[12436.696900] RIP: 0033:0x7fd55f23c4eb
[12436.696903] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[12436.696906] RSP: 002b:00007ffe7fcb4ab0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[12436.696911] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fd55f23c4eb
[12436.696913] RDX: 00007ffe7fcb4b38 RSI: 00000000c0024806 RDI: 0000000000000003
[12436.696916] RBP: 0000000000a54f80 R08: 0000000000000007 R09: 0000000000a553c0
[12436.696919] R10: 71b550f12e327857 R11: 0000000000000246 R12: 0000000000a553c0
[12436.696921] R13: 00007ffe7fcb4c20 R14: 0000000000a553c1 R15: 0000000000000042
[12436.696927]  </TASK>
[12436.696929] Modules linked in: uhid rfcomm tls snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_nat veth xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo br_netfilter nft_masq nft_chain_nat nf_nat bridge stp llc qrtr overlay cmac algif_hash algif_skcipher af_alg bnep zstd btusb btrtl btbcm btintel btmtk bluetooth ecdh_generic ecc snd_sof_pci_intel_skl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence input_leds snd_sof_intel_hda snd_sof_pci ip6t_REJECT snd_sof_xtensa_dsp nf_reject_ipv6 snd_sof xt_hl snd_sof_utils ip6_tables soundwire_bus intel_tcc_cooling ip6t_rt x86_pkg_temp_thermal snd_soc_avs intel_powerclamp snd_soc_hda_codec coretemp snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core kvm_intel snd_soc_sst_ipc ipt_REJECT nf_reject_ipv4 snd_soc_sst_dsp kvm hid_multitouch xt_LOG snd_soc_acpi_intel_match nf_log_syslog snd_soc_acpi snd_hda_codec_hdmi xt_multiport snd_soc_core irqbypass crct10dif_pclmul snd_hda_codec_realtek snd_hda_codec_generic nft_limit snd_compress
[12436.697023]  polyval_clmulni ledtrig_audio ac97_bus polyval_generic snd_pcm_dmaengine ghash_clmulni_intel sha512_ssse3 snd_hda_intel xt_limit snd_intel_dspcfg aesni_intel snd_intel_sdw_acpi xt_addrtype crypto_simd snd_hda_codec xt_tcpudp joydev cryptd snd_hda_core xt_conntrack snd_hwdep surface_platform_profile dw9719 rapl mei_pxp mei_hdcp nf_conntrack ipts binfmt_misc platform_profile snd_pcm intel_rapl_msr hid_sensor_rotation hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_als mwifiex_pcie processor_thermal_device_pci_legacy intel_cstate nf_defrag_ipv6 gpio_keys tcp_bbr ipu3_imgu(C) ipu3_cio2 snd_timer hid_sensor_trigger processor_thermal_device mwifiex nf_defrag_ipv4 pcspkr videobuf2_dma_sg surface_gpe snd industrialio_triggered_buffer processor_thermal_rfim ov8865 ov5693 ov7251 mei_me nft_compat intel_skl_int3472_tps68470 msr cfg80211 videobuf2_memops soundcore kfifo_buf 8250_dw processor_thermal_mbox v4l2_fwnode mei tps68470_regulator parport_pc nf_tables videobuf2_v4l2 hid_sensor_iio_common
[12436.697111]  processor_thermal_rapl intel_rapl_common v4l2_async ppdev intel_pch_thermal clk_tps68470 industrialio nfnetlink videobuf2_common intel_soc_dts_iosf videodev intel_xhci_usb_role_switch mc intel_skl_int3472_discrete int3400_thermal lp int3403_thermal surfacepro3_button nls_iso8859_1 surface_acpi_notify surface_aggregator_registry soc_button_array acpi_tad acpi_pad dptf_power acpi_thermal_rel int340x_thermal_zone mac_hid parport efi_pstore dmi_sysfs ip_tables x_tables autofs4 btrfs xor raid6_pq libcrc32c hid_sensor_hub uas usb_storage intel_ishtp_hid hid_generic usbhid hid i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper syscopyarea sysfillrect sysimgblt intel_lpss_pci nvme intel_ish_ipc intel_lpss xhci_pci video crc32_pclmul nvme_core drm intel_ishtp idma64 xhci_pci_renesas wmi nvme_common surface_aggregator pinctrl_sunrisepoint
[12436.697192] CR2: 0000000000000000

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions