linux-kernel - Re: iwl_mvm_add_new_dqa_stream_wk BUG in lib/list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <29401822-d7e9-430b-d284-706bf68acb8a@pp3345.net>
Date:   Fri, 7 Jun 2019 22:20:56 +0200
From:   Yussuf Khalil <dev@...345.net>
To:     Marc Haber <mh+netdev@...schlus.de>, linux-wireless@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        Johannes Berg <johannes.berg@...el.com>,
        Emmanuel Grumbach <emmanuel.grumbach@...el.com>,
        Luca Coelho <luciano.coelho@...el.com>,
        Intel Linux Wireless <linuxwifi@...el.com>
Subject: Re: iwl_mvm_add_new_dqa_stream_wk BUG in lib/list_debug.c:56

CC'ing iwlwifi maintainers to get some attention for this issue.

I am experiencing the very same bug on a ThinkPad T480s running 5.1.6 
with Fedora 30. A friend is seeing it on his X1 Carbon 6th Gen, too. 
Both have an "Intel Corporation Wireless 8265 / 8275" card according to 
lspci.

Notably, in all cases I've observed it occurred right after roaming from 
one AP to another (though I can't guarantee this isn't a coincidence). 
Here is the dmesg output from my machine:

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: disconnect from AP 9c:1c:12:82:5a:b0 for new auth to ac:a3:1e:d9:5e:d0

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: authenticate with ac:a3:1e:d9:5e:d0

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: send auth to ac:a3:1e:d9:5e:d0 (try 1/3)

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: send auth to ac:a3:1e:d9:5e:d0 (try 2/3)

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: send auth to ac:a3:1e:d9:5e:d0 (try 3/3)

> Jun 02 00:38:25 pp3345-laptop kernel: wlp61s0: authentication with ac:a3:1e:d9:5e:d0 timed out

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: authenticate with 9c:1c:12:82:5a:b0

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: send auth to 9c:1c:12:82:5a:b0 (try 1/3)

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: authenticated

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: associate with 9c:1c:12:82:5a:b0 (try 1/3)

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: RX AssocResp from 9c:1c:12:82:5a:b0 (capab=0x1 status=0 aid=4)

> Jun 02 00:38:26 pp3345-laptop kernel: wlp61s0: associated

> Jun 02 00:38:26 pp3345-laptop kernel: list_del corruption. next->prev should be ffff9a9f64e527f8, but was ffff9a9f64e52108

> Jun 02 00:38:26 pp3345-laptop kernel: ------------[ cut here ]------------

> Jun 02 00:38:26 pp3345-laptop kernel: kernel BUG at lib/list_debug.c:54!

> Jun 02 00:38:26 pp3345-laptop kernel: invalid opcode: 0000 [#1] SMP PTI

> Jun 02 00:38:26 pp3345-laptop kernel: CPU: 5 PID: 2128 Comm: kworker/5:3 Not tainted 5.1.6-300.fc30.x86_64 #1

> Jun 02 00:38:26 pp3345-laptop kernel: Hardware name: LENOVO 20L8S02E00/20L8S02E00, BIOS N22ET54W (1.31 ) 04/22/2019

> Jun 02 00:38:26 pp3345-laptop kernel: Workqueue: events iwl_mvm_add_new_dqa_stream_wk [iwlmvm]

> Jun 02 00:38:26 pp3345-laptop kernel: RIP: 0010:__list_del_entry_valid.cold+0x1d/0x55

> Jun 02 00:38:26 pp3345-laptop kernel: Code: c7 c7 18 55 11 b8 e8 f5 0b c7 ff 0f 0b 48 89 fe 48 c7 c7 a8 55 11 b8 e8 e4 0b c7 ff 0f 0b 48 c7 c7 58 56 11 b8 e8 d6 0b c7 ff <0f> 0b 48 89 f2 48 89 fe 48 c7 c7 18 56 11 b8 e8 c2 0b c7 ff 0f 0b

> Jun 02 00:38:26 pp3345-laptop kernel: RSP: 0000:ffffa8ec4ad73dc8 EFLAGS: 00010246

> Jun 02 00:38:26 pp3345-laptop kernel: RAX: 0000000000000054 RBX: ffff9a9f64e527f8 RCX: 0000000000000000

> Jun 02 00:38:26 pp3345-laptop kernel: RDX: 0000000000000000 RSI: ffff9a9fcf3568c8 RDI: ffff9a9fcf3568c8

> Jun 02 00:38:26 pp3345-laptop kernel: RBP: ffff9a9f64e56898 R08: ffff9a9fcf3568c8 R09: 0000000000000c6f

> Jun 02 00:38:26 pp3345-laptop kernel: R10: ffffffffb89f930c R11: 0000000000000003 R12: 0000000000000004

> Jun 02 00:38:26 pp3345-laptop kernel: R13: ffff9a9fc879a388 R14: 0000000000000000 R15: ffff9a9fc8799608

> Jun 02 00:38:26 pp3345-laptop kernel: FS:  0000000000000000(0000) GS:ffff9a9fcf340000(0000) knlGS:0000000000000000

> Jun 02 00:38:26 pp3345-laptop kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

> Jun 02 00:38:26 pp3345-laptop kernel: CR2: 00001d3a916bf000 CR3: 0000000487c94003 CR4: 00000000003606e0

> Jun 02 00:38:26 pp3345-laptop kernel: Call Trace:

> Jun 02 00:38:26 pp3345-laptop kernel:  iwl_mvm_add_new_dqa_stream_wk+0x2f3/0x870 [iwlmvm]

> Jun 02 00:38:26 pp3345-laptop kernel:  ? __switch_to+0x40/0x4c0

> Jun 02 00:38:26 pp3345-laptop kernel:  process_one_work+0x19d/0x380

> Jun 02 00:38:26 pp3345-laptop kernel:  worker_thread+0x50/0x3b0

> Jun 02 00:38:26 pp3345-laptop kernel:  kthread+0xfb/0x130

> Jun 02 00:38:26 pp3345-laptop kernel:  ? process_one_work+0x380/0x380

> Jun 02 00:38:26 pp3345-laptop kernel:  ? kthread_park+0x90/0x90

> Jun 02 00:38:26 pp3345-laptop kernel:  ret_from_fork+0x35/0x40

> Jun 02 00:38:26 pp3345-laptop kernel: Modules linked in: xt_CHECKSUM ipt_MASQUERADE tun bridge stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast xt_CT ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables bnep sunrpc vfat fat arc4 elan_i2c iwlmvm mac80211 mei_hdcp iTCO_wdt iTCO_vendor_support snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core snd_soc_skl_ipc snd_soc_sst_ipc intel_rapl snd_soc_sst_dsp iwlwifi snd_soc_acpi_intel_match snd_soc_acpi uvcvideo snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp btusb coretemp btrtl btbcm snd_soc_core btintel kvm_intel videobuf2_vmalloc bluetooth snd_hda_codec_realtek videobuf2_memops videobuf2_v4l2 videobuf2_common snd_hda_codec_generic videodev snd_compress

> Jun 02 00:38:26 pp3345-laptop kernel:  ac97_bus snd_pcm_dmaengine joydev snd_hda_intel kvm cfg80211 snd_hda_codec intel_wmi_thunderbolt wmi_bmof thunderbolt media snd_hda_core ecdh_generic snd_hwdep irqbypass snd_seq intel_cstate intel_uncore snd_seq_device intel_rapl_perf snd_pcm snd_timer thinkpad_acpi mei_me intel_xhci_usb_role_switch idma64 i2c_i801 mei roles ledtrig_audio ucsi_acpi snd intel_lpss_pci typec_ucsi intel_lpss processor_thermal_device intel_pch_thermal typec intel_soc_dts_iosf soundcore rfkill int3403_thermal int340x_thermal_zone int3400_thermal acpi_pad acpi_thermal_rel pcc_cpufreq dm_crypt i915 nouveau mxm_wmi ttm crct10dif_pclmul crc32_pclmul i2c_algo_bit crc32c_intel drm_kms_helper nvme drm nvme_core e1000e ghash_clmulni_intel uas usb_storage serio_raw wmi video fuse

> Jun 02 00:38:26 pp3345-laptop kernel: ---[ end trace 718b0122155852c5 ]---

> Jun 02 00:38:26 pp3345-laptop kernel: RIP: 0010:__list_del_entry_valid.cold+0x1d/0x55

> Jun 02 00:38:26 pp3345-laptop kernel: Code: c7 c7 18 55 11 b8 e8 f5 0b c7 ff 0f 0b 48 89 fe 48 c7 c7 a8 55 11 b8 e8 e4 0b c7 ff 0f 0b 48 c7 c7 58 56 11 b8 e8 d6 0b c7 ff <0f> 0b 48 89 f2 48 89 fe 48 c7 c7 18 56 11 b8 e8 c2 0b c7 ff 0f 0b

> Jun 02 00:38:26 pp3345-laptop kernel: RSP: 0000:ffffa8ec4ad73dc8 EFLAGS: 00010246

> Jun 02 00:38:26 pp3345-laptop kernel: RAX: 0000000000000054 RBX: ffff9a9f64e527f8 RCX: 0000000000000000

> Jun 02 00:38:26 pp3345-laptop kernel: RDX: 0000000000000000 RSI: ffff9a9fcf3568c8 RDI: ffff9a9fcf3568c8

> Jun 02 00:38:26 pp3345-laptop kernel: RBP: ffff9a9f64e56898 R08: ffff9a9fcf3568c8 R09: 0000000000000c6f

> Jun 02 00:38:26 pp3345-laptop kernel: R10: ffffffffb89f930c R11: 0000000000000003 R12: 0000000000000004

> Jun 02 00:38:26 pp3345-laptop kernel: R13: ffff9a9fc879a388 R14: 0000000000000000 R15: ffff9a9fc8799608

> Jun 02 00:38:26 pp3345-laptop kernel: FS:  0000000000000000(0000) GS:ffff9a9fcf340000(0000) knlGS:0000000000000000

> Jun 02 00:38:26 pp3345-laptop kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

> Jun 02 00:38:26 pp3345-laptop kernel: CR2: 00001d3a916bf000 CR3: 0000000487c94003 CR4: 00000000003606e0


Am 02.06.19 um 15:48 schrieb Marc Haber:
> On Thu, May 30, 2019 at 10:12:57AM +0200, Marc Haber wrote:
>> on my primary notebook, a Lenovo X260, with an Intel Wireless 8260
>> (8086:24f3), running Debian unstable, I have started to see network
>> hangs since upgrading to kernel 5.1. In this situation, I cannot
>> restart Network-Manager (the call just hangs), I can log out of X, but
>> the system does not cleanly shut down and I need to Magic SysRq myself
>> out of the running system. This happens about once every two days.
> 
> The issue is also present in 5.1.5 and 5.1.6.
> 
> Greetings
> Marc
>