Message-ID: <e12b5e52-1c94-472d-949b-2ee158857584@molgen.mpg.de>
Date: Mon, 29 Jan 2024 12:57:11 +0100
From: Paul Menzel <pmenzel@...gen.mpg.de>
To: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: typec_altmode_release → refcount_t: underflow; use-after-free.

Dear Linux folks,


I noticed the message first time with Linux 6.6.8 on December 26th, and 
also with 6.6.11, 6.7 and 6.7.1. I am unsure how to reproduce it though.

Here the trace from Linux 6.7.1-1~exp1:

```
[    0.000000] Linux version 6.7-amd64 (debian-kernel@...ts.debian.org) 
(x86_64-linux-gnu-gcc-13 (Debian 13.2.0-10) 13.2.0, GNU ld (GNU Binutils 
for Debian) 2.41.90.20240115) #1 SMP PREEMPT_DYNAMIC Debian 6.7.1-1~exp1 
(2024-01-22)
[…]
[    0.000000] DMI: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 06/02/2022
[…]
[ 9068.294345] ucsi_acpi USBC000:00: failed to re-enable notifications 
(-110)
[ 9068.499156] ------------[ cut here ]------------
[ 9068.499172] refcount_t: underflow; use-after-free.
[ 9068.499199] WARNING: CPU: 0 PID: 5598 at lib/refcount.c:28 
refcount_warn_saturate+0xbe/0x110
[ 9068.499209] Modules linked in: uinput rfcomm cmac algif_hash 
algif_skcipher af_alg bnep xfrm_interface xfrm6_tunnel tunnel6 tunnel4 
xfrm_user l2tp_ppp xfrm_algo l2tp_netlink l2tp_core ip6_udp_tunnel 
udp_tunnel pppox ppp_generic slhc ctr ccm typec_displayport 
snd_seq_dummy snd_hrtimer snd_seq snd_seq_device qrtr binfmt_misc 
snd_sof_pci_intel_skl snd_sof_intel_hda_common soundwire_intel 
soundwire_generic_allocation snd_sof_intel_hda_mlink soundwire_cadence 
snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils 
soundwire_bus snd_hda_codec_hdmi snd_soc_avs snd_soc_hda_codec 
snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core snd_soc_sst_ipc 
snd_soc_sst_dsp snd_soc_acpi_intel_match snd_soc_acpi snd_ctl_led btusb 
snd_soc_core btrtl btintel snd_hda_codec_realtek ath10k_pci btbcm 
x86_pkg_temp_thermal nls_ascii btmtk intel_powerclamp 
snd_hda_codec_generic bluetooth mei_hdcp mei_pxp mei_wdt ath10k_core 
coretemp snd_compress nls_cp437 snd_pcm_dmaengine kvm_intel vfat 
snd_hda_intel ath snd_intel_dspcfg fat
[ 9068.499300]  snd_intel_sdw_acpi kvm mac80211 snd_hda_codec 
intel_rapl_msr dell_laptop ledtrig_audio i915 snd_hda_core sha3_generic 
jitterentropy_rng irqbypass libarc4 dell_smm_hwmon snd_hwdep dell_wmi 
rapl cfg80211 uvcvideo snd_pcm intel_cstate dell_smbios joydev 
videobuf2_vmalloc iTCO_wdt intel_pmc_bxt drbg intel_uncore dcdbas 
ansi_cprng uvc snd_timer iTCO_vendor_support dell_wmi_descriptor 
intel_wmi_thunderbolt videobuf2_memops snd videobuf2_v4l2 watchdog 
ecdh_generic wmi_bmof pcspkr videodev soundcore rfkill mei_me ucsi_acpi 
mei typec_ucsi videobuf2_common ecc typec mc drm_buddy intel_pch_thermal 
drm_display_helper sg processor_thermal_device_pci_legacy cec 
processor_thermal_device processor_thermal_wt_hint rc_core intel_vbtn 
processor_thermal_rfim soc_button_array processor_thermal_rapl 
intel_rapl_common ttm processor_thermal_wt_req drm_kms_helper 
int3403_thermal processor_thermal_power_floor evdev 
processor_thermal_mbox intel_xhci_usb_role_switch int340x_thermal_zone 
intel_pmc_core i2c_algo_bit intel_hid
[ 9068.499386]  int3400_thermal intel_soc_dts_iosf acpi_pad roles ac 
acpi_thermal_rel sparse_keymap button hid_multitouch serio_raw msr 
parport_pc ppdev lp parport loop efi_pstore configfs nfnetlink efivarfs 
ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic sd_mod 
r8153_ecm cdc_ether usbnet r8152 mii uas usb_storage scsi_mod 
scsi_common usbhid dm_crypt dm_mod hid_generic nvme i2c_hid_acpi 
crc32_pclmul i2c_hid crc32c_intel nvme_core t10_pi xhci_pci 
ghash_clmulni_intel drm crc64_rocksoft_generic xhci_hcd crc64_rocksoft 
crc_t10dif sha512_ssse3 sha512_generic crct10dif_generic intel_lpss_pci 
crct10dif_pclmul i2c_i801 sha256_ssse3 intel_lpss crc64 usbcore 
sha1_ssse3 crct10dif_common i2c_smbus idma64 hid usb_common battery 
video wmi aesni_intel crypto_simd cryptd
[ 9068.499459] CPU: 0 PID: 5598 Comm: kworker/0:1 Not tainted 6.7-amd64 
#1  Debian 6.7.1-1~exp1
[ 9068.499471] Hardware name: Dell Inc. XPS 13 9360/0596KF, BIOS 2.21.0 
06/02/2022
[ 9068.499473] Workqueue: events ucsi_handle_connector_change [typec_ucsi]
[ 9068.499484] RIP: 0010:refcount_warn_saturate+0xbe/0x110
[ 9068.499496] Code: 01 01 e8 d5 21 a9 ff 0f 0b c3 cc cc cc cc 80 3d bf 
61 7e 01 00 75 85 48 c7 c7 30 ca 8f aa c6 05 af 61 7e 01 01 e8 b2 21 a9 
ff <0f> 0b c3 cc cc cc cc 80 3d 9d 61 7e 01 00 0f 85 5e ff ff ff 48 c7
[ 9068.499498] RSP: 0018:ffffae5a05d67d90 EFLAGS: 00010282
[ 9068.499500] RAX: 0000000000000000 RBX: ffff8d8a094d2c08 RCX: 
0000000000000027
[ 9068.499502] RDX: ffff8d8d6f021408 RSI: 0000000000000001 RDI: 
ffff8d8d6f021400
[ 9068.499503] RBP: ffff8d8a094d2c00 R08: 0000000000000000 R09: 
ffffae5a05d67c18
[ 9068.499504] R10: 0000000000000003 R11: ffff8d8d80ffffe8 R12: 
0000000000000000
[ 9068.499506] R13: ffff8d8a038a51d0 R14: ffffffffaa520100 R15: 
ffff8d8a4028b038
[ 9068.499507] FS:  0000000000000000(0000) GS:ffff8d8d6f000000(0000) 
knlGS:0000000000000000
[ 9068.499509] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9068.499516] CR2: 000002f9ce649010 CR3: 000000010cc86004 CR4: 
00000000003706f0
[ 9068.499517] Call Trace:
[ 9068.499521]  <TASK>
[ 9068.499522]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499526]  ? __warn+0x81/0x130
[ 9068.499533]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499545]  ? report_bug+0x171/0x1a0
[ 9068.499549]  ? console_unlock+0x78/0x120
[ 9068.499553]  ? handle_bug+0x3c/0x80
[ 9068.499557]  ? exc_invalid_op+0x17/0x70
[ 9068.499565]  ? asm_exc_invalid_op+0x1a/0x20
[ 9068.499570]  ? refcount_warn_saturate+0xbe/0x110
[ 9068.499576]  typec_altmode_release+0x49/0xc0 [typec]
[ 9068.499615]  device_release+0x34/0x90
[ 9068.499624]  kobject_put+0x78/0x190
[ 9068.499629]  ucsi_unregister_altmodes+0x41/0xa0 [typec_ucsi]
[ 9068.499648]  ucsi_unregister_partner.part.0+0x77/0xa0 [typec_ucsi]
[ 9068.499662]  ucsi_handle_connector_change+0x1bb/0x310 [typec_ucsi]
[ 9068.499671]  process_one_work+0x171/0x340
[ 9068.499676]  worker_thread+0x27b/0x3a0
[ 9068.499679]  ? __pfx_worker_thread+0x10/0x10
[ 9068.499681]  kthread+0xe5/0x120
[ 9068.499690]  ? __pfx_kthread+0x10/0x10
[ 9068.499693]  ret_from_fork+0x31/0x50
[ 9068.499698]  ? __pfx_kthread+0x10/0x10
[ 9068.499700]  ret_from_fork_asm+0x1b/0x30
[ 9068.499714]  </TASK>
[ 9068.499715] ---[ end trace 0000000000000000 ]---
```

Please find the full output of `dmesg` attached.


Kind regards,

Paul


PS: More traces:

Linux 6.6.8:

Dez 26 23:43:09 abreu kernel: pcieport 0000:02:02.0: BAR 15: failed to 
assign [mem size 0x00200000 64bit pref]
Dez 26 23:43:09 abreu kernel: printk: Suspending console(s) (use 
no_console_suspend to debug)
Dez 26 23:43:09 abreu kernel: ------------[ cut here ]------------
Dez 26 23:43:09 abreu kernel: refcount_t: underflow; use-after-free.
Dez 26 23:43:09 abreu kernel: WARNING: CPU: 0 PID: 10062 at 
lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
Dez 26 23:43:09 abreu kernel: Modules linked in: typec_displayport 
snd_usb_audio snd_usbmidi_lib snd_rawmidi hid_plantronics xfrm_interface 
xfrm6_tunnel tunnel6 l2tp_ppp tunnel4 l2tp_netlink xfrm_user l2tp_core>
Dez 26 23:43:09 abreu kernel:  mei_wdt mei_hdcp mei_pxp bluetooth 
uvcvideo libarc4 snd_hda_intel vfat i915 fat videobuf2_vmalloc 
intel_rapl_msr snd_intel_dspcfg uvc dell_smm_hwmon snd_intel_sdw_acpi 
cfg80211 vi>
Dez 26 23:43:09 abreu kernel:  hid_multitouch serio_raw msr parport_pc 
ppdev lp parport loop efi_pstore configfs nfnetlink efivarfs ip_tables 
x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic sd_mod r8153>
Dez 26 23:43:09 abreu kernel: CPU: 0 PID: 10062 Comm: kworker/0:0 Not 
tainted 6.6.8-amd64 #1  Debian 6.6.8-1
Dez 26 23:43:09 abreu kernel: Hardware name: Dell Inc. XPS 13 
9360/0596KF, BIOS 2.21.0 06/02/2022
Dez 26 23:43:09 abreu kernel: Workqueue: events 
ucsi_handle_connector_change [typec_ucsi]
Dez 26 23:43:09 abreu kernel: RIP: 0010:refcount_warn_saturate+0xbe/0x110
Dez 26 23:43:09 abreu kernel: Code: 01 01 e8 25 4c a9 ff 0f 0b c3 cc cc 
cc cc 80 3d 83 95 7e 01 00 75 85 48 c7 c7 60 b6 6e ba c6 05 73 95 7e 01 
01 e8 02 4c a9 ff <0f> 0b c3 cc cc cc cc 80 3d 61 95 7e 01 00 0f 8>
Dez 26 23:43:09 abreu kernel: RSP: 0018:ffffc9000e66fd90 EFLAGS: 00010282
Dez 26 23:43:09 abreu kernel: RAX: 0000000000000000 RBX: 
ffff888108eb5808 RCX: 0000000000000027
Dez 26 23:43:09 abreu kernel: RDX: ffff8884714213c8 RSI: 
0000000000000001 RDI: ffff8884714213c0
Dez 26 23:43:09 abreu kernel: RBP: ffff888108eb5800 R08: 
ffffffffbafb0ec0 R09: 65646e75203a745f
Dez 26 23:43:09 abreu kernel: R10: 75203b776f6c6672 R11: 
72657466612d6573 R12: 0000000000000000
Dez 26 23:43:09 abreu kernel: R13: ffff88816c4b6330 R14: 
ffffffffba321b60 R15: ffff888102d24838
Dez 26 23:43:09 abreu kernel: FS:  0000000000000000(0000) 
GS:ffff888471400000(0000) knlGS:0000000000000000
Dez 26 23:43:09 abreu kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
Dez 26 23:43:09 abreu kernel: CR2: 00007ff1d5e4a940 CR3: 
000000031832c005 CR4: 00000000003706f0
Dez 26 23:43:09 abreu kernel: Call Trace:
Dez 26 23:43:09 abreu kernel:  <TASK>
Dez 26 23:43:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Dez 26 23:43:09 abreu kernel:  ? __warn+0x81/0x130
Dez 26 23:43:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Dez 26 23:43:09 abreu kernel:  ? report_bug+0x171/0x1a0
Dez 26 23:43:09 abreu kernel:  ? console_unlock+0xcb/0x120
Dez 26 23:43:09 abreu kernel:  ? handle_bug+0x3c/0x80
Dez 26 23:43:09 abreu kernel:  ? exc_invalid_op+0x17/0x70
Dez 26 23:43:09 abreu kernel:  ? asm_exc_invalid_op+0x1a/0x20
Dez 26 23:43:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Dez 26 23:43:09 abreu kernel:  typec_altmode_release+0x49/0xc0 [typec]
Dez 26 23:43:09 abreu kernel:  device_release+0x34/0x90
Dez 26 23:43:09 abreu kernel:  kobject_put+0x78/0x190
Dez 26 23:43:09 abreu kernel:  ucsi_unregister_altmodes+0x41/0xa0 
[typec_ucsi]
Dez 26 23:43:09 abreu kernel:  ucsi_unregister_partner.part.0+0x77/0xa0 
[typec_ucsi]
Dez 26 23:43:09 abreu kernel:  ucsi_handle_connector_change+0x1bb/0x310 
[typec_ucsi]
Dez 26 23:43:09 abreu kernel:  process_one_work+0x171/0x340
Dez 26 23:43:09 abreu kernel:  worker_thread+0x27b/0x3a0
Dez 26 23:43:09 abreu kernel:  ? __pfx_worker_thread+0x10/0x10
Dez 26 23:43:09 abreu kernel:  kthread+0xe5/0x120
Dez 26 23:43:09 abreu kernel:  ? __pfx_kthread+0x10/0x10
Dez 26 23:43:09 abreu kernel:  ret_from_fork+0x31/0x50
Dez 26 23:43:09 abreu kernel:  ? __pfx_kthread+0x10/0x10
Dez 26 23:43:09 abreu kernel:  ret_from_fork_asm+0x1b/0x30
Dez 26 23:43:09 abreu kernel:  </TASK>
Dez 26 23:43:09 abreu kernel: ---[ end trace 0000000000000000 ]---
Dez 26 23:43:09 abreu kernel: ACPI: EC: interrupt blocked

Linux 6.6.11:

Jan 15 18:57:48 abreu kernel: ------------[ cut here ]------------
Jan 15 18:57:48 abreu kernel: refcount_t: underflow; use-after-free.
Jan 15 18:57:48 abreu kernel: WARNING: CPU: 0 PID: 7665 at 
lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
Jan 15 18:57:48 abreu kernel: Modules linked in: sd_mod sg uas 
usb_storage scsi_mod scsi_common xfrm_interface xfrm6_tunnel tunnel6 
tunnel4 l2tp_ppp xfrm_user l2tp_netlink l2tp_core xfrm_algo 
ip6_udp_tunnel udp>
Jan 15 18:57:48 abreu kernel:  dell_laptop btmtk ledtrig_audio 
snd_hda_codec dell_smm_hwmon irqbypass uvcvideo dell_wmi i915 rapl 
snd_hda_core libarc4 intel_cstate bluetooth videobuf2_vmalloc uvc 
snd_hwdep dell>
Jan 15 18:57:48 abreu kernel:  nfnetlink efivarfs ip_tables x_tables 
autofs4 ext4 crc16 mbcache jbd2 crc32c_generic r8153_ecm cdc_ether 
usbnet r8152 mii usbhid dm_crypt dm_mod crc32_pclmul crc32c_intel nvme xhc>
Jan 15 18:57:48 abreu kernel: CPU: 0 PID: 7665 Comm: kworker/0:1 Not 
tainted 6.6.11-amd64 #1  Debian 6.6.11-1
Jan 15 18:57:48 abreu kernel: Hardware name: Dell Inc. XPS 13 
9360/0596KF, BIOS 2.21.0 06/02/2022
Jan 15 18:57:48 abreu kernel: Workqueue: events 
ucsi_handle_connector_change [typec_ucsi]
Jan 15 18:57:48 abreu kernel: RIP: 0010:refcount_warn_saturate+0xbe/0x110
Jan 15 18:57:48 abreu kernel: Code: 01 01 e8 c5 4b a9 ff 0f 0b c3 cc cc 
cc cc 80 3d 73 94 7e 01 00 75 85 48 c7 c7 e8 b8 ae b7 c6 05 63 94 7e 01 
01 e8 a2 4b a9 ff <0f> 0b c3 cc cc cc cc 80 3d 51 94 7e 01 00 0f 8>
Jan 15 18:57:48 abreu kernel: RSP: 0018:ffffc9000e4ffd90 EFLAGS: 00010282
Jan 15 18:57:48 abreu kernel: RAX: 0000000000000000 RBX: 
ffff888104bd4808 RCX: 0000000000000027
Jan 15 18:57:48 abreu kernel: RDX: ffff8884714213c8 RSI: 
0000000000000001 RDI: ffff8884714213c0
Jan 15 18:57:48 abreu kernel: RBP: ffff888104bd4800 R08: 
0000000000000000 R09: ffffc9000e4ffc18
Jan 15 18:57:48 abreu kernel: R10: 0000000000000003 R11: 
ffffffffb82d20e8 R12: 0000000000000000
Jan 15 18:57:48 abreu kernel: R13: ffff888105d7e5f0 R14: 
ffffffffb7721b60 R15: ffff888104da3038
Jan 15 18:57:48 abreu kernel: FS:  0000000000000000(0000) 
GS:ffff888471400000(0000) knlGS:0000000000000000
Jan 15 18:57:48 abreu kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
Jan 15 18:57:48 abreu kernel: CR2: 00007ff910002018 CR3: 
000000010fe20004 CR4: 00000000003706f0
Jan 15 18:57:48 abreu kernel: Call Trace:
Jan 15 18:57:48 abreu kernel:  <TASK>
Jan 15 18:57:48 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 15 18:57:48 abreu kernel:  ? __warn+0x81/0x130
Jan 15 18:57:48 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 15 18:57:48 abreu kernel:  ? report_bug+0x171/0x1a0
Jan 15 18:57:48 abreu kernel:  ? console_unlock+0x78/0x120
Jan 15 18:57:48 abreu kernel:  ? handle_bug+0x3c/0x80
Jan 15 18:57:48 abreu kernel:  ? exc_invalid_op+0x17/0x70
Jan 15 18:57:48 abreu kernel:  ? asm_exc_invalid_op+0x1a/0x20
Jan 15 18:57:48 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 15 18:57:48 abreu kernel:  typec_altmode_release+0x49/0xc0 [typec]
Jan 15 18:57:48 abreu kernel:  device_release+0x34/0x90
Jan 15 18:57:48 abreu kernel:  kobject_put+0x78/0x190
Jan 15 18:57:48 abreu kernel:  ucsi_unregister_altmodes+0x41/0xa0 
[typec_ucsi]
Jan 15 18:57:48 abreu kernel:  ucsi_unregister_partner.part.0+0x77/0xa0 
[typec_ucsi]
Jan 15 18:57:48 abreu kernel:  ucsi_handle_connector_change+0x1bb/0x310 
[typec_ucsi]
Jan 15 18:57:48 abreu kernel:  process_one_work+0x171/0x340
Jan 15 18:57:48 abreu kernel:  worker_thread+0x27b/0x3a0
Jan 15 18:57:48 abreu kernel:  ? __pfx_worker_thread+0x10/0x10
Jan 15 18:57:48 abreu kernel:  kthread+0xe5/0x120
Jan 15 18:57:48 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 15 18:57:48 abreu kernel:  ret_from_fork+0x31/0x50
Jan 15 18:57:48 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 15 18:57:48 abreu kernel:  ret_from_fork_asm+0x1b/0x30
Jan 15 18:57:48 abreu kernel:  </TASK>
Jan 15 18:57:48 abreu kernel: ---[ end trace 0000000000000000 ]---

Linux 6.7-1~exp1:

Jan 16 08:27:07 abreu NetworkManager[849]: <info>  [1705390027.6340] 
agent-manager: 
agent[186633de9f7e0377,:1.136/org.gnome.Shell.NetworkAgent/5272]: agent 
registered
Jan 16 08:27:08 abreu kernel: ucsi_acpi USBC000:00: failed to re-enable 
notifications (-110)
Jan 16 08:27:09 abreu kernel: ------------[ cut here ]------------
Jan 16 08:27:09 abreu kernel: refcount_t: underflow; use-after-free.
Jan 16 08:27:09 abreu kernel: WARNING: CPU: 0 PID: 14058 at 
lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
Jan 16 08:27:09 abreu kernel: Modules linked in: st sr_mod cdrom nvram 
xfrm_interface xfrm6_tunnel tunnel6 tunnel4 xfrm_user l2tp_ppp xfrm_algo 
l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppox ppp_generic>
Jan 16 08:27:09 abreu kernel:  irqbypass rapl vfat snd_hda_core 
dell_laptop fat ledtrig_audio intel_cstate snd_hwdep sha3_generic 
snd_pcm dell_smm_hwmon libarc4 uvcvideo jitterentropy_rng dell_wmi 
intel_uncore >
Jan 16 08:27:09 abreu kernel:  button hid_multitouch acpi_thermal_rel 
evdev serio_raw msr parport_pc ppdev lp parport loop efi_pstore configfs 
nfnetlink efivarfs ip_tables x_tables autofs4 ext4 crc16 mbcache jb>
Jan 16 08:27:09 abreu kernel: CPU: 0 PID: 14058 Comm: kworker/0:1 Not 
tainted 6.7-amd64 #1  Debian 6.7-1~exp1
Jan 16 08:27:09 abreu kernel: Hardware name: Dell Inc. XPS 13 
9360/0596KF, BIOS 2.21.0 06/02/2022
Jan 16 08:27:09 abreu kernel: Workqueue: events 
ucsi_handle_connector_change [typec_ucsi]
Jan 16 08:27:09 abreu kernel: RIP: 0010:refcount_warn_saturate+0xbe/0x110
Jan 16 08:27:09 abreu kernel: Code: 01 01 e8 f5 22 a9 ff 0f 0b c3 cc cc 
cc cc 80 3d e1 62 7e 01 00 75 85 48 c7 c7 38 ca cf a2 c6 05 d1 62 7e 01 
01 e8 d2 22 a9 ff <0f> 0b c3 cc cc cc cc 80 3d bf 62 7e 01 00 0f 8>
Jan 16 08:27:09 abreu kernel: RSP: 0000:ffffb7a54727bd90 EFLAGS: 00010282
Jan 16 08:27:09 abreu kernel: RAX: 0000000000000000 RBX: 
ffff89c4c5daac08 RCX: 0000000000000027
Jan 16 08:27:09 abreu kernel: RDX: ffff89c831421408 RSI: 
0000000000000001 RDI: ffff89c831421400
Jan 16 08:27:09 abreu kernel: RBP: ffff89c4c5daac00 R08: 
0000000000000000 R09: ffffb7a54727bc18
Jan 16 08:27:09 abreu kernel: R10: 0000000000000003 R11: 
ffffffffa34d2428 R12: 0000000000000000
Jan 16 08:27:09 abreu kernel: R13: ffff89c4c36d32b0 R14: 
ffffffffa291ffa0 R15: ffff89c4c3aeb838
Jan 16 08:27:09 abreu kernel: FS:  0000000000000000(0000) 
GS:ffff89c831400000(0000) knlGS:0000000000000000
Jan 16 08:27:09 abreu kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
Jan 16 08:27:09 abreu kernel: CR2: 00007f92f8d66008 CR3: 
000000016bf5a001 CR4: 00000000003706f0
Jan 16 08:27:09 abreu kernel: Call Trace:
Jan 16 08:27:09 abreu kernel:  <TASK>
Jan 16 08:27:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 16 08:27:09 abreu kernel:  ? __warn+0x81/0x130
Jan 16 08:27:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 16 08:27:09 abreu kernel:  ? report_bug+0x171/0x1a0
Jan 16 08:27:09 abreu kernel:  ? console_unlock+0x78/0x120
Jan 16 08:27:09 abreu kernel:  ? handle_bug+0x3c/0x80
Jan 16 08:27:09 abreu kernel:  ? exc_invalid_op+0x17/0x70
Jan 16 08:27:09 abreu kernel:  ? asm_exc_invalid_op+0x1a/0x20
Jan 16 08:27:09 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 16 08:27:09 abreu kernel:  typec_altmode_release+0x49/0xc0 [typec]
Jan 16 08:27:09 abreu kernel:  device_release+0x34/0x90
Jan 16 08:27:09 abreu kernel:  kobject_put+0x78/0x190
Jan 16 08:27:09 abreu kernel:  ucsi_unregister_altmodes+0x41/0xa0 
[typec_ucsi]
Jan 16 08:27:09 abreu kernel:  ucsi_unregister_partner.part.0+0x77/0xa0 
[typec_ucsi]
Jan 16 08:27:09 abreu kernel:  ucsi_handle_connector_change+0x1bb/0x310 
[typec_ucsi]
Jan 16 08:27:09 abreu kernel:  process_one_work+0x171/0x340
Jan 16 08:27:09 abreu kernel:  worker_thread+0x27b/0x3a0
Jan 16 08:27:09 abreu kernel:  ? __pfx_worker_thread+0x10/0x10
Jan 16 08:27:09 abreu kernel:  kthread+0xe5/0x120
Jan 16 08:27:09 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 16 08:27:09 abreu kernel:  ret_from_fork+0x31/0x50
Jan 16 08:27:09 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 16 08:27:09 abreu kernel:  ret_from_fork_asm+0x1b/0x30
Jan 16 08:27:09 abreu kernel:  </TASK>
Jan 16 08:27:09 abreu kernel: ---[ end trace 0000000000000000 ]---
Jan 16 08:27:09 abreu systemd[1]: systemd-rfkill.service: Deactivated 
successfully.
Jan 16 08:27:09 abreu ModemManager[927]: <msg> [base-manager] couldn't 
check support for device 
'/sys/devices/pci0000:00/0000:00:1c.4/0000:3a:00.0': not supported by 
any plugin

Linux 6.7-1~exp1:

Jan 17 11:47:15 abreu kernel: i915 0000:00:02.0: [drm] [ENCODER:113:DDI 
C/PHY C] is disabled/in DSI mode with an ungated DDI clock, gate it
Jan 17 11:47:15 abreu kernel: usb 1-5: reset high-speed USB device 
number 4 using xhci_hcd
Jan 17 11:47:15 abreu kernel: ------------[ cut here ]------------
Jan 17 11:47:15 abreu kernel: refcount_t: underflow; use-after-free.
Jan 17 11:47:15 abreu kernel: WARNING: CPU: 2 PID: 54815 at 
lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
Jan 17 11:47:15 abreu kernel: Modules linked in: sctp libcrc32c 
typec_displayport r8153_ecm cdc_ether usbnet sd_mod r8152 sg mii uas 
usb_storage scsi_mod scsi_common l2tp_ppp xfrm_interface l2tp_netlink 
xfrm6_tunnel l2tp_core tunnel6 tunnel4 ip6_udp_tunnel xfrm_user 
udp_tunnel xfrm_algo pppox ppp_generic slhc ctr ccm snd_seq_dummy 
snd_hrtimer snd_seq snd_seq_device qrtr snd_sof_pci_intel_skl 
snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation 
snd_hda_codec_hdmi snd_sof_intel_hda_mlink soundwire_cadence 
snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils 
soundwire_bus snd_ctl_led snd_soc_avs snd_soc_hda_codec snd_soc_skl 
snd_hda_codec_realtek snd_soc_hdac_hda ath10k_pci snd_hda_ext_core 
binfmt_misc snd_hda_codec_generic ath10k_core btusb snd_soc_sst_ipc 
btrtl snd_soc_sst_dsp snd_soc_acpi_intel_match btintel nls_ascii btbcm 
nls_cp437 ath snd_soc_acpi btmtk mac80211 vfat bluetooth snd_soc_core 
x86_pkg_temp_thermal fat intel_powerclamp coretemp kvm_intel 
snd_compress snd_pcm_dmaengine dell_laptop
Jan 17 11:47:15 abreu kernel:  snd_hda_intel mei_pxp mei_hdcp mei_wdt 
i915 ledtrig_audio snd_intel_dspcfg libarc4 snd_intel_sdw_acpi kvm 
intel_rapl_msr snd_hda_codec sha3_generic joydev jitterentropy_rng 
dell_smm_hwmon uvcvideo snd_hda_core cfg80211 videobuf2_vmalloc drbg uvc 
irqbypass snd_hwdep rapl snd_pcm videobuf2_memops videobuf2_v4l2 
dell_wmi intel_cstate ansi_cprng dell_smbios videodev snd_timer dcdbas 
intel_uncore ucsi_acpi ecdh_generic mei_me typec_ucsi iTCO_wdt 
intel_pmc_bxt snd iTCO_vendor_support wmi_bmof intel_wmi_thunderbolt 
watchdog dell_wmi_descriptor pcspkr mei videobuf2_common soundcore 
rfkill drm_buddy typec ecc mc intel_pch_thermal drm_display_helper cec 
intel_vbtn soc_button_array rc_core processor_thermal_device_pci_legacy 
processor_thermal_device ttm processor_thermal_wt_hint 
processor_thermal_rfim processor_thermal_rapl int3400_thermal 
drm_kms_helper int3403_thermal intel_rapl_common acpi_thermal_rel 
intel_pmc_core intel_hid intel_xhci_usb_role_switch 
processor_thermal_wt_req button processor_thermal_power_floor
Jan 17 11:47:15 abreu kernel:  processor_thermal_mbox sparse_keymap 
evdev acpi_pad int340x_thermal_zone ac intel_soc_dts_iosf i2c_algo_bit 
roles hid_multitouch serio_raw msr parport_pc ppdev lp parport loop 
efi_pstore configfs nfnetlink efivarfs ip_tables x_tables autofs4 ext4 
crc16 mbcache jbd2 crc32c_generic dm_crypt dm_mod usbhid nvme 
crc32_pclmul crc32c_intel nvme_core t10_pi hid_generic 
ghash_clmulni_intel crc64_rocksoft_generic sha512_ssse3 crc64_rocksoft 
i2c_hid_acpi crc_t10dif i2c_hid crct10dif_generic xhci_pci 
sha512_generic drm xhci_hcd sha256_ssse3 intel_lpss_pci crct10dif_pclmul 
i2c_i801 crc64 usbcore sha1_ssse3 crct10dif_common i2c_smbus hid battery 
intel_lpss idma64 usb_common video wmi aesni_intel crypto_simd cryptd
Jan 17 11:47:15 abreu kernel: CPU: 2 PID: 54815 Comm: kworker/u8:61 Not 
tainted 6.7-amd64 #1  Debian 6.7-1~exp1
Jan 17 11:47:15 abreu kernel: Hardware name: Dell Inc. XPS 13 
9360/0596KF, BIOS 2.21.0 06/02/2022
Jan 17 11:47:15 abreu kernel: Workqueue: USBC000:00-con1 
ucsi_poll_worker [typec_ucsi]
Jan 17 11:47:15 abreu kernel: RIP: 0010:refcount_warn_saturate+0xbe/0x110
Jan 17 11:47:15 abreu kernel: Code: 01 01 e8 f5 22 a9 ff 0f 0b c3 cc cc 
cc cc 80 3d e1 62 7e 01 00 75 85 48 c7 c7 38 ca 8f 89 c6 05 d1 62 7e 01 
01 e8 d2 22 a9 ff <0f> 0b c3 cc cc cc cc 80 3d bf 62 7e 01 00 0f 85 5e 
ff ff ff 48 c7
Jan 17 11:47:15 abreu kernel: RSP: 0000:ffffb653c149fd90 EFLAGS: 00010282
Jan 17 11:47:15 abreu kernel: RAX: 0000000000000000 RBX: 
ffffa07c8687ac08 RCX: 0000000000000027
Jan 17 11:47:15 abreu kernel: RDX: ffffa07ff1521408 RSI: 
0000000000000001 RDI: ffffa07ff1521400
Jan 17 11:47:15 abreu kernel: RBP: ffffa07c8687ac00 R08: 
0000000000000000 R09: 65646e75203a745f
Jan 17 11:47:15 abreu kernel: R10: 75203b776f6c6672 R11: 
72657466612d6573 R12: 0000000000000000
Jan 17 11:47:15 abreu kernel: R13: ffffa07c8484fc40 R14: 
ffffffff8951ffa0 R15: ffffa07ee4b06b48
Jan 17 11:47:15 abreu kernel: FS:  0000000000000000(0000) 
GS:ffffa07ff1500000(0000) knlGS:0000000000000000
Jan 17 11:47:15 abreu kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
Jan 17 11:47:15 abreu kernel: CR2: 0000000000000000 CR3: 
0000000246820001 CR4: 00000000003706f0
Jan 17 11:47:15 abreu kernel: Call Trace:
Jan 17 11:47:15 abreu kernel:  <TASK>
Jan 17 11:47:15 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 17 11:47:15 abreu kernel:  ? __warn+0x81/0x130
Jan 17 11:47:15 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 17 11:47:15 abreu kernel:  ? report_bug+0x171/0x1a0
Jan 17 11:47:15 abreu kernel:  ? console_unlock+0xcb/0x120
Jan 17 11:47:15 abreu kernel:  ? handle_bug+0x3c/0x80
Jan 17 11:47:15 abreu kernel:  ? exc_invalid_op+0x17/0x70
Jan 17 11:47:15 abreu kernel:  ? asm_exc_invalid_op+0x1a/0x20
Jan 17 11:47:15 abreu kernel:  ? refcount_warn_saturate+0xbe/0x110
Jan 17 11:47:15 abreu kernel:  typec_altmode_release+0x49/0xc0 [typec]
Jan 17 11:47:15 abreu kernel:  device_release+0x34/0x90
Jan 17 11:47:15 abreu kernel:  kobject_put+0x78/0x190
Jan 17 11:47:15 abreu kernel:  ucsi_unregister_altmodes+0x41/0xa0 
[typec_ucsi]
Jan 17 11:47:15 abreu kernel:  ucsi_unregister_partner.part.0+0x77/0xa0 
[typec_ucsi]
Jan 17 11:47:15 abreu kernel:  ucsi_check_connection+0x73/0xc0 [typec_ucsi]
Jan 17 11:47:15 abreu kernel:  ucsi_poll_worker+0x3a/0x110 [typec_ucsi]
Jan 17 11:47:15 abreu kernel:  process_one_work+0x171/0x340
Jan 17 11:47:15 abreu kernel:  worker_thread+0x27b/0x3a0
Jan 17 11:47:15 abreu kernel:  ? __pfx_worker_thread+0x10/0x10
Jan 17 11:47:15 abreu kernel:  kthread+0xe5/0x120
Jan 17 11:47:15 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 17 11:47:15 abreu kernel:  ret_from_fork+0x31/0x50
Jan 17 11:47:15 abreu kernel:  ? __pfx_kthread+0x10/0x10
Jan 17 11:47:15 abreu kernel:  ret_from_fork_asm+0x1b/0x30
Jan 17 11:47:15 abreu kernel:  </TASK>
Jan 17 11:47:15 abreu kernel: ---[ end trace 0000000000000000 ]---
Jan 17 11:47:15 abreu kernel: usb 1-3: reset full-speed USB device 
number 2 using xhci_hcd
Jan 17 11:47:15 abreu kernel: usb 1-4: reset full-speed USB device 
number 3 using xhci_hcd
View attachment "20240129–dell-xps-13-9360–linux-6.7.1-i8042.dumbkbd.txt" of type "text/plain" (150343 bytes)

Powered by blists - more mailing lists