lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aSQpjzgczUx4JKCP@kuha>
Date: Mon, 24 Nov 2025 11:50:03 +0200
From: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
To: Stephanie Gawroriski <xerthesquirrel@...il.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: Linux 6.18-rc6

Hi Stephanie,

Wed, Nov 19, 2025 at 10:04:35AM -0500, Stephanie Gawroriski kirjoitti:
> On Wednesday, 19 November 2025 04:08:35 EST Heikki Krogerus wrote:
> > Hi
> > 
> > > > > Unrelated to this, after suspending and docking my laptop to my dock,
> > > > > I
> > > > > get
> > > > > this now:
> > > > > 
> > > > > [50598.774359] ------------[ cut here ]------------
> > > > > [50598.774371] kernfs: can not remove 'typec', no directory
> > > > > [50598.774389] WARNING: CPU: 2 PID: 48932 at fs/kernfs/dir.c:1706
> > > > > kernfs_remove_by_name_ns+0xcf/0xe0
> > > > 
> > > > Ok, that is indeed unrelated, and should be mostly harmless apart from
> > > > the scary message. Do you see any other effects than the noise in the
> > > > logs?
> > > 
> > > Not that I know of.
> > > 
> > > > Somebody is trying to remove a sysfs entry that has no parent,
> > > > presumably because it was never registered in the first place.
> > > > 
> > > > At a guess, it's some error handling cleanup that is done
> > > > unconditionally, unregistering an entry even when the original
> > > > registration failed. Or unregistering twice.
> > > > 
> > > > Looks like ucsi / typec handling:
> > > > > [50598.774763] Call Trace:
> > > > > [50598.774775]  typec_unregister_partner+0x6c/0x110
> > > > > [50598.774787]  ucsi_unregister_partner+0x103/0x140
> > > > > [50598.774794]  ucsi_handle_connector_change+0x34d/0x3e0
> > > > > [50598.774803]  process_one_work+0x18b/0x340
> > > > > [50598.774811]  worker_thread+0x256/0x3a0
> > > > > [50598.774824]  kthread+0xfc/0x240
> > > > 
> > > > but that said, I don't see why this would be new behavior. I don't see
> > > > anything that has changed in this area lately in the typec class
> > > > handling.
> > > > 
> > > > In fact, looking around, I see much older reports that look a bit like
> > > > this, so I don't think it's new.
> > > > 
> > > > Adding Greg and Heikki who might know what is going on. See
> > > > 
> > > >    https://lore.kernel.org/all/2203148.PYKUYFuaPT@arborvitaetree/
> > > > 
> > > > for original report.
> > > > 
> > > >                 Linus
> > > 
> > > I really only noticed it when I was looking in dmesg very recently to see
> > > if there were any application crashes due to huge_memory issue. I do look
> > > in dmesg often enough, but mostly to see if devices are being recognized
> > > properly or other events such as when the embedded JVM I am working on
> > > split locks.
> > Thanks for the report. It looks like the code does not increment the
> > reference count of the USB device that is liked to the typec partner.
> > 
> > Is it possible for you to test this?
> > 
> > diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> > index 9b2647cb199b..4ace92af9856 100644
> > --- a/drivers/usb/typec/class.c
> > +++ b/drivers/usb/typec/class.c
> > @@ -805,6 +805,8 @@ static void typec_partner_link_device(struct
> > typec_partner *partner, struct devi return;
> >         }
> > 
> > +       get_device(dev);
> > +
> >         if (partner->attach)
> >                 partner->attach(partner, dev);
> >  }
> > @@ -816,6 +818,8 @@ static void typec_partner_unlink_device(struct
> > typec_partner *partner, struct de
> > 
> >         if (partner->deattach)
> >                 partner->deattach(partner, dev);
> > +
> > +       put_device(dev);
> >  }
> > 
> >  /**
> 
> Okay, so I figured out that it does appear if I boot already connected to my 
> dock and then suspend the system. Unfortunately, the patch does not cause the 
> trace to go away. I have put extra context around the trace, hopefully it has 
> some use. Making a guess, but would the `typec` directory get removed from all 
> the disconnects before the suspend?

I'm still trying to figure this out, but let's rule out one of my
concerns..

Can you check are the symlinks pointing to the correct USB devices
under /sys/class/typec ?

It's probable easiest with just one USB device connected to the
system. With one USB device connected to the system there should be
only one partner under /sys/class/typec (for example port0-partner),
so it should be easy to check if the symlink under that partner
device is pointing to the correct USB device.

        % ls -la /sys/class/typec/port<x>-partner/

You should see a symlink to an USB device under it. Can you check if
it's the correct USB device?

If it's not the correct USB device, then the ACPI table may have wrong
_PLD (Physical Location of Device) objects for these USB port or USB
Type-C connector device nodes. The code uses the _PLD to link the
correct USB port to the USB Type-C connector.

thanks,

> [  197.556838] usb 3-3: USB disconnect, device number 5
> [  197.556858] usb 3-3.1: USB disconnect, device number 6
> [  197.557394] usb 3-3.4: USB disconnect, device number 7
> [  197.557402] usb 3-3.4.1: USB disconnect, device number 9
> [  197.557407] usb 3-3.4.1.1: USB disconnect, device number 10
> [  197.557988] thunderbolt 1-0:1.1: retimer disconnected
> [  197.563900] thunderbolt 1-1: device disconnected
> [  197.591868] usb 2-3: USB disconnect, device number 2
> [  197.591876] usb 2-3.4: USB disconnect, device number 3
> [  197.591878] usb 2-3.4.2: USB disconnect, device number 4
> [  197.592041] cdc_ncm 2-3.4.2:2.0 enx[REDACTED]: unregister 'cdc_ncm' 
> usb-0000:00:0d.0-3.4.2, CDC NCM (NO ZLP)
> [  197.645038] usb 3-3.4.1.2: USB disconnect, device number 11
> [  197.835260] ------------[ cut here ]------------
> [  197.835269] kernfs: can not remove 'typec', no directory
> [  197.835284] WARNING: CPU: 6 PID: 3566 at fs/kernfs/dir.c:1706 
> kernfs_remove_by_name_ns+0xcf/0xe0
> [  197.835294] Modules linked in: xt_conntrack xt_MASQUERADE xt_set ip_set 
> xt_addrtype xfrm_user xfrm_algo snd_seq_dummy snd_hrtimer snd_seq nls_utf8 
> cifs cifs_md4 dns_resolver netfs iscsi_tcp nft_masq libiscsi_tcp libiscsi 
> scsi_transport_iscsi target_core_user uio target_core_pscsi target_core_file 
> target_core_iblock iscsi_target_mod target_core_mod xt_tcpudp nft_compat 
> x_tables nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet 
> nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat 
> nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr at24 ee1004 rfcomm 
> bnep snd_ctl_led snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers 
> snd_soc_intel_hda_dsp_common snd_sof_probes vhba(O) snd_hda_codec_intelhdmi 
> br_netfilter snd_hda_codec_alc269 bridge snd_hda_scodec_component stp 
> snd_hda_codec_realtek_lib snd_soc_dmic llc snd_hda_codec_generic snd_hda_intel 
> pkcs8_key_parser snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl 
> snd_sof_intel_hda_generic soundwire_intel soundwire_generic_allocation
> [  197.835371]  snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common 
> snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_hda_codec_hdmi 
> soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_soc_avs 
> snd_sof_utils snd_soc_hda_codec snd_soc_acpi_intel_match snd_hda_ext_core 
> snd_soc_acpi_intel_sdca_quirks snd_hda_codec snd_soc_acpi uvcvideo 
> snd_hda_core crc8 videobuf2_vmalloc snd_intel_dspcfg snd_usb_audio nls_ascii 
> soundwire_bus hid_sensor_gyro_3d hid_sensor_custom_intel_hinge 
> hid_sensor_accel_3d btusb uvc intel_uncore_frequency snd_intel_sdw_acpi 
> snd_usbmidi_lib nls_cp437 snd_soc_sdca hid_sensor_trigger btmtk 
> videobuf2_memops intel_uncore_frequency_common snd_hwdep snd_soc_core 
> hid_sensor_iio_common btrtl videobuf2_v4l2 coretemp snd_rawmidi snd_compress 
> intel_pmc_core btbcm industrialio_triggered_buffer videodev mei_hdcp mei_pxp 
> rapl snd_seq_device snd_pcm_dmaengine pmt_telemetry btintel kfifo_buf 
> videobuf2_common spi_nor iosm intel_cstate mei_me snd_pcm pmt_discovery 
> industrialio bluetooth mc mtd wwan
> [  197.835438]  intel_uncore mei snd_timer pcspkr pmt_class igen6_edac button 
> soc_button_array ac intel_pmc_ssram_telemetry acpi_tad acpi_pad snd mei_vsc_hw 
> joydev evdev soundcore vboxnetadp(O) vboxnetflt(O) vboxdrv(O) hid_xpadneo(O) 
> ff_memless parport_pc ppdev lp parport loop nvme_fabrics efi_pstore nfnetlink 
> zram 842_decompress 842_compress autofs4 hid_sensor_custom hid_multitouch 
> psmouse i2c_i801 hid_sensor_hub i2c_hid_acpi serio_raw i2c_smbus hid_generic 
> i2c_hid
> [  197.835483] CPU: 6 UID: 0 PID: 3566 Comm: kworker/6:3 Tainted: G     U     
> O        6.18.0-rc6 #7 PREEMPT(full) 
> [  197.835490] Tainted: [U]=USER, [O]=OOT_MODULE
> [  197.835492] Hardware name: LENOVO 21HQCTO1WW/21HQCTO1WW, BIOS N3XET62W 
> (1.37 ) 07/28/2025
> [  197.835495] Workqueue: events ucsi_handle_connector_change
> [  197.835505] RIP: 0010:kernfs_remove_by_name_ns+0xcf/0xe0
> [  197.835509] Code: 5b 5d 41 5c 41 5d c3 cc cc cc cc 48 89 ef e8 58 1a c0 ff 
> b8 fe ff ff ff eb e6 0f 0b eb 9f 48 c7 c7 d0 5b bc a9 e8 e1 41 b7 ff <0f> 0b eb e5 
> 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
> [  197.835513] RSP: 0018:ffffd2768b5dfda8 EFLAGS: 00010286
> [  197.835517] RAX: 0000000000000000 RBX: ffff89d541a4c8b0 RCX: 0000000000000027
> [  197.835520] RDX: ffff89e45f398a48 RSI: 0000000000000001 RDI: ffff89e45f398a40
> [  197.835523] RBP: ffff89d55f722800 R08: 0000000000000000 R09: ffff89e49f761168
> [  197.835525] R10: ffff89e49f731128 R11: 0000000000000003 R12: ffffffffa9daab01
> [  197.835527] R13: ffff89d590c294e0 R14: 0000000000000000 R15: 0000000000000000
> [  197.835529] FS:  0000000000000000(0000) GS:ffff89e4b403d000(0000) knlGS:
> 0000000000000000
> [  197.835532] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  197.835535] CR2: 000056339a2b30c0 CR3: 000000019214d004 CR4: 
> 0000000000f70ef0
> [  197.835538] PKRU: 55555554
> [  197.835540] Call Trace:
> [  197.835544]  <TASK>
> [  197.835550]  typec_partner_unlink_device+0x30/0x60
> [  197.835557]  typec_unregister_partner+0x64/0xa0
> [  197.835562]  ucsi_unregister_partner+0x103/0x140
> [  197.835567]  ucsi_handle_connector_change+0x34d/0x3e0
> [  197.835580]  process_one_work+0x18b/0x340
> [  197.835585]  worker_thread+0x256/0x3a0
> [  197.835589]  ? __pfx_worker_thread+0x10/0x10
> [  197.835593]  kthread+0xfc/0x240
> [  197.835599]  ? __pfx_kthread+0x10/0x10
> [  197.835604]  ? __pfx_kthread+0x10/0x10
> [  197.835608]  ret_from_fork+0x1c9/0x200
> [  197.835614]  ? __pfx_kthread+0x10/0x10
> [  197.835619]  ret_from_fork_asm+0x1a/0x30
> [  197.835627]  </TASK>
> [  197.835628] ---[ end trace 0000000000000000 ]---
> [  198.154306] usb 3-3.4.1.4: USB disconnect, device number 12
> [  198.161398] usb 3-3.5: USB disconnect, device number 8
> [  199.059821] pcieport 0000:50:00.0: not ready 1023ms after resume; giving up
> [  199.059906] pcieport 0000:00:07.2: pciehp: Slot(5): Card not present
> [  199.067233] pci_bus 0000:52: busn_res: [bus 52] is released
> [  199.067486] pci_bus 0000:53: busn_res: [bus 53-5f] is released
> [  199.067820] pci_bus 0000:60: busn_res: [bus 60-6c] is released
> [  199.068013] pci_bus 0000:6d: busn_res: [bus 6d-78] is released
> [  199.068295] pci_bus 0000:79: busn_res: [bus 79] is released
> [  199.068463] pci_bus 0000:51: busn_res: [bus 51-79] is released
> [  200.802421] wlan0: deauthenticating from [REDACTED] by local choice 
> (Reason: 3=DEAUTH_LEAVING)
> [  201.679172] PM: suspend entry (s2idle)
> [  206.409358] Filesystems sync: 4.730 seconds
> [  206.613445] Freezing user space processes
> [  206.616008] Freezing user space processes completed (elapsed 0.002 seconds)
> [  206.616016] OOM killer disabled.
> [  206.616018] Freezing remaining freezable tasks
> [  211.905879] Freezing remaining freezable tasks completed (elapsed 5.289 
> seconds)
> [  211.905912] printk: Suspending console(s) (use no_console_suspend to debug)
> [  211.976568] sd 1:0:0:0: [sda] Synchronizing SCSI cache
> [  212.442684] ACPI: EC: interrupt blocked
> [  218.598684] typec port1-partner: PM: parent port1 should not be sleeping
> [  218.798599] ACPI: EC: interrupt unblocked
> [  219.056659] i915 0000:00:02.0: [drm] GT0: GuC firmware i915/adlp_guc_70.bin 
> version 70.49.4
> [  219.056672] i915 0000:00:02.0: [drm] GT0: HuC firmware i915/tgl_huc.bin 
> version 7.9.3
> [  219.073475] i915 0000:00:02.0: [drm] GT0: HuC: authenticated for all 
> workloads
> [  219.074666] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
> [  219.074676] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
> [  219.075617] i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
> [  219.105707] nvme nvme0: 20/0/0 default/read/poll queues
> [  219.470735] thunderbolt 1-1: new device found, vendor=0x1df device=0x112
> [  219.470749] thunderbolt 1-1: Sabrent Rocket docking station
> [  219.470931] typec port1: bound usb3-port3 (ops connector_ops)
> [  219.470955] typec port1: bound usb2-port3 (ops connector_ops)
> [  219.470971] typec port1: bound usb4_port7 (ops connector_ops)
> [  219.770124] thunderbolt 1-0:1.1: new retimer found, vendor=0x8087 
> device=0x15ee
> [  220.256910] mei_hdcp 0000:00:16.0-[REDACTED]: bound 0000:00:02.0 (ops 
> i915_hdcp_ops)
> [  220.258650] mei_pxp 0000:00:16.0-[REDACTED]: bound 0000:00:02.0 (ops 
> i915_pxp_tee_component_ops)
> [  220.258713] OOM killer enabled.
> [  220.258719] Restarting tasks: Starting
> [  220.261104] Restarting tasks: Done
> 
> 
> 

-- 
heikki

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ