Message-ID: <1056aea9-1977-440e-9ad3-8a0b8b746288@gmx.de>
Date: Tue, 16 Dec 2025 17:06:56 +0100
From: Ronald Warsow <rwarsow@....de>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org
Cc: patches@...ts.linux.dev, linux-kernel@...r.kernel.org,
 torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
 linux@...ck-us.net, shuah@...nel.org, patches@...nelci.org,
 lkft-triage@...ts.linaro.org, pavel@...x.de, jonathanh@...dia.com,
 f.fainelli@...il.com, sudipm.mukherjee@...il.com, conor@...nel.org,
 hargar@...rosoft.com, broonie@...nel.org, achill@...ill.org,
 sr@...dewatkins.com
Subject: Re: [PATCH 6.18 000/614] 6.18.2-rc1 review

Hi

no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only* 
when running GPU driver i915.

with GPU driver xe I get here:

[   14.391631] rfkill: input handler disabled
[   14.787149] ------------[ cut here ]------------
[   14.787153] refcount_t: underflow; use-after-free.
[   14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28 
refcount_warn_saturate+0xbe/0x110
[   14.787174] Modules linked in: vboxnetadp(OE) vboxnetflt(OE) 
vboxdrv(OE) rfcomm nf_conntrack_netbios_ns nf_conntrack_broadcast 
nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet 
nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat 
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables bnep iwlmvm 
mac80211 mei_hdcp mei_pxp btusb kvm_intel btintel iwlwifi bluetooth kvm 
cfg80211 ecdh_generic irqbypass mei_me wmi_bmof mei nfnetlink xe 
intel_vsec drm_suballoc_helper gpu_sched drm_gpuvm drm_exec i915 
i2c_algo_bit drm_buddy drm_display_helper video wmi
[   14.787203] CPU: 10 UID: 60578 PID: 2463 Comm: pool-8 Tainted: G 
U     OE       6.18.2-rc1_MY #1 PREEMPT(lazy)
[   14.787205] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[   14.787206] Hardware name: ASUS System Product Name/ROG STRIX B560-G 
GAMING WIFI, BIOS 2302 11/13/2024
[   14.787207] RIP: 0010:refcount_warn_saturate+0xbe/0x110
[   14.787210] Code: 02 01 e8 05 de 52 ff 0f 0b e9 7e ba a1 00 80 3d 8d 
16 41 02 00 75 85 48 c7 c7 00 d5 f5 9e c6 05 7d 16 41 02 01 e8 e2 dd 52 
ff <0f> 0b e9 5b ba a1 00 80 3d 6b 16 41 02 00 0f 85 5e ff ff ff 48 c7
[   14.787211] RSP: 0018:ffffa0ba88dbf918 EFLAGS: 00010246
[   14.787213] RAX: 0000000000000000 RBX: ffff900804a13800 RCX: 
0000000000000027
[   14.787214] RDX: ffff900b4f917a88 RSI: 0000000000000001 RDI: 
ffff900b4f917a80
[   14.787215] RBP: ffff90082578c000 R08: 0000000000000000 R09: 
ffffa0ba88dbf7b0
[   14.787215] R10: ffffffff9fb451e8 R11: ffffffff9fa951e0 R12: 
0000000000000000
[   14.787216] R13: ffffa0ba88dbf970 R14: ffff9008213f0218 R15: 
0000000000000000
[   14.787217] FS:  0000000000000000(0000) GS:ffff900baedd9000(0000) 
knlGS:0000000000000000
[   14.787218] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   14.787219] CR2: 00007fc6a725fed0 CR3: 000000011f3c5001 CR4: 
0000000000770ef0
[   14.787220] PKRU: 55555554
[   14.787220] Call Trace:
[   14.787222]  <TASK>
[   14.787224]  xe_exec_queue_destroy+0x165/0x1a0 [xe]
[   14.787326]  xe_vm_close_and_put+0x1e3/0x950 [xe]
[   14.787414]  xe_file_close+0x108/0x1e0 [xe]
[   14.787463]  drm_file_free+0x238/0x2a0
[   14.787466]  drm_release_noglobal+0x78/0xc0
[   14.787468]  __fput+0xe6/0x2a0
[   14.787471]  task_work_run+0x5d/0x90
[   14.787473]  do_exit+0x273/0xa60
[   14.787476]  ? timerqueue_del+0x2e/0x60
[   14.787478]  ? __remove_hrtimer+0x41/0xb0
[   14.787480]  do_group_exit+0x2e/0xb0
[   14.787482]  ? hrtimer_cancel+0x21/0x40
[   14.787484]  get_signal+0x8b0/0x8f0
[   14.787485]  arch_do_signal_or_restart+0x8d/0x2a0
[   14.787489]  exit_to_user_mode_loop+0x80/0x170
[   14.787492]  do_syscall_64+0x1c5/0xfa0
[   14.787494]  ? __pfx_hrtimer_wakeup+0x10/0x10
[   14.787496]  ? __rseq_handle_notify_resume+0xa4/0x4d0
[   14.787499]  ? switch_fpu_return+0x4e/0xd0
[   14.787501]  ? do_syscall_64+0x1f8/0xfa0
[   14.787503]  ? __rseq_handle_notify_resume+0xa4/0x4d0
[   14.787504]  ? f_dupfd+0x62/0xa0
[   14.787506]  ? switch_fpu_return+0x4e/0xd0
[   14.787507]  ? do_syscall_64+0x1f8/0xfa0
[   14.787509]  ? __x64_sys_fcntl+0x96/0x110
[   14.787512]  ? do_syscall_64+0x7c/0xfa0
[   14.787514]  ? flush_tlb_func+0x119/0x380
[   14.787516]  ? sched_clock+0x10/0x30
[   14.787518]  ? sched_clock_cpu+0xf/0x230
[   14.787520]  ? __flush_smp_call_function_queue+0xae/0x410
[   14.787522]  ? sched_clock_cpu+0xf/0x230
[   14.787523]  ? irqtime_account_irq+0x3c/0xc0
[   14.787525]  ? clear_bhb_loop+0x40/0x90
[   14.787527]  ? clear_bhb_loop+0x40/0x90
[   14.787528]  ? clear_bhb_loop+0x40/0x90
[   14.787529]  ? clear_bhb_loop+0x40/0x90
[   14.787530]  entry_SYSCALL_64_after_hwframe+0x71/0x79
[   14.787532] RIP: 0033:0x7fa07a4ff34d
[   14.787540] Code: Unable to access opcode bytes at 0x7fa07a4ff323.
[   14.787541] RSP: 002b:00007f9f8bffe478 EFLAGS: 00000246 ORIG_RAX: 
00000000000000ca
[   14.787543] RAX: fffffffffffffdfc RBX: 0000000000000001 RCX: 
00007fa07a4ff34d
[   14.787544] RDX: 0000000000000002 RSI: 0000000000000080 RDI: 
000055c50d821a20
[   14.787544] RBP: 00007f9f8bffe4e0 R08: 00007fa07b3c7000 R09: 
000000000000000e
[   14.787545] R10: 00007f9f8bffe4a0 R11: 0000000000000246 R12: 
00000000018ae951
[   14.787546] R13: 0000000000000001 R14: 0000000000000002 R15: 
000055c50d821a10
[   14.787548]  </TASK>
[   14.787548] ---[ end trace 0000000000000000 ]---

====

If I did the bisect correct, bisect-log:

# status: waiting for both good and bad commits
# good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
# status: waiting for bad commit, 1 good commit known
# bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
# bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL 
pointer dereference in crashstate_get_vm_logs()
git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd



Thanks

Tested-by: Ronald Warsow <rwarsow@....de>

Powered by blists - more mailing lists