linux-kernel - Re: BUG: kernel NULL pointer dereference, address: 0000000000000000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADVatmM_mRnkDX=hpUjbyKkZnGynxJfRSujGxm2LaWWMEL_2ew@mail.gmail.com>
Date: Mon, 1 Dec 2025 13:25:59 +0000
From: Sudip Mukherjee <sudipm.mukherjee@...il.com>
To: Paul Menzel <pmenzel@...gen.mpg.de>
Cc: Sudip Mukherjee <sudip.mukherjee@...ethink.co.uk>, linux-kernel@...r.kernel.org, 
	Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org
Subject: Re: BUG: kernel NULL pointer dereference, address: 0000000000000000

On Thu, 27 Nov 2025 at 22:55, Paul Menzel <pmenzel@...gen.mpg.de> wrote:
>
> Dear Linux folks,
>
>
> Am 27.11.25 um 19:51 schrieb Paul Menzel:
>
> > Unfortunately, not reproducible, but starting with Linux 6.18-rc7, I got
> > the oops below *once*:
> >
> > ```

<snip>

>
> Building and booting Linux 6.18.0-rc7-00041-g765e56e41a5a, I got another
> oops.
>
>      [   15.234799] ppdev lp.0: really_probe: driver_sysfs_add failed
>      [   15.234852] ------------[ cut here ]------------
>      [   15.234854] refcount_t: addition on 0; use-after-free.
>      [   15.234864] WARNING: CPU: 0 PID: 353 at lib/refcount.c:25
> refcount_warn_saturate+0xcd/0xf0
>
> Please find the output of `dmesg` attached.
>
> (It might be related to booting with an USB-C mini-dock connected, but I
> do not know yet.)

In both cases, it seems the underlying hardware was removed  or the
module was unloaded while it was still registering.

In the first case, 'parport_default_proc_unregister' has been called
while parport driver is still checking for all the connected devices
and was executing 'lp_attach'.
'parport_default_proc_unregister' will only be called when the parport
module is exiting.

Same in the second case,  'lp_attach' was still executing and
'ppdev_cleanup' was called.

Are you seeing the crash only from v6.18-rc7 onwards? Was v6.18-rc6 or
v6.17 ok for you ?

-- 
Regards
Sudip