Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

[F6BVP <f6bvp@free.fr>]

[-- Attachment #1: Type: text/plain, Size: 1208 bytes --]

Dan, I thank you for explaining why the patch actually did not prevent 
the bug to be still present.

I captured via netconsole two occurence of kernel panic that did not 
follow exactly the same chain.

I hope these files may help to find where things go bad.

Bug is systematically triggered when running netromd daemon and 
performing a connexion using ax25_call()

[syzbot] mail reported KMSAN found uinit-value both in kiss_unesc 
(mkiss.c:303) and in mkiss_receive_buf() (mkiss.c:901).

However I did not identified the bug.

Regards,

Bernard

Le 25/08/2025 à 14:40, Dan Carpenter a écrit :
> No, this patch doesn't do anything.  "p" is never used without being
> initialized.  Plus, I bet that if you do:
> 
> 	grep CONFIG_INIT_STACK_ALL_ZERO .config
> 
> You will find it is set to =y which means the compiler is already
> initializing pointers to NULL anyway.
> 
> Perhaps you're worried that about this line:
> 
> 	p = kmalloc(struct_size(p, data, 2 * size), GFP_ATOMIC | __GFP_NOWARN);
> 
> where it seems to call "struct_size(p" where p is not initialized?  On
> that line the compiler is just doing a sizeof(*p) and not really using
> the value of p at all.
> 
> regards,
> dan carpenter
> 

[-- Attachment #2: netconsole_1.log --]
[-- Type: text/plain, Size: 6970 bytes --]

[ 5410.128592] Here I am: flush_to_ldisc:494
[ 5410.128953] Here I am: receive_buf:467
[ 5410.129319] Here I am: tty_port_default_receive_buf:29
[ 5410.129688] Here I am: tty_ldisc_receive_buf:415 count:24 bytes processed
[ 5411.100089] Here I am: __tty_insert_flip_string_flags:351 8 copied
[ 5411.100468] Here I am: flush_to_ldisc:494
[ 5411.100940] Here I am: receive_buf:467
[ 5411.101357] Here I am: tty_port_default_receive_buf:29
[ 5411.101717] Here I am: tty_ldisc_receive_buf:415 count:8 bytes processed
[ 5412.131968] Here I am: __tty_insert_flip_string_flags:351 68 copied
[ 5412.133016] Here I am: flush_to_ldisc:494
[ 5412.134007] Here I am: receive_buf:467
[ 5412.134862] Here I am: tty_port_default_receive_buf:29
[ 5412.135967] Here I am: tty_ldisc_receive_buf:415 count:68 bytes processed
[ 5412.147321] Here I am: __tty_insert_flip_string_flags:351 68 copied
[ 5412.148471] Here I am: flush_to_ldisc:494
[ 5412.149639] Here I am: receive_buf:467
[ 5412.150656] Here I am: tty_port_default_receive_buf:29
[ 5412.151844] BUG: kernel NULL pointer dereference, address: 00000000000000d0
[ 5412.151982] Here I am: __tty_insert_flip_string_flags:351 67 copied
[ 5412.152832] #PF: supervisor read access in kernel mode
[ 5412.153886] Here I am: flush_to_ldisc:494
[ 5412.154390] #PF: error_code(0x0000) - not-present page
[ 5412.154393] PGD 0 P4D 0 
[ 5412.154396] Oops: Oops: 0000 [#1] SMP PTI
[ 5412.154399] CPU: 0 UID: 0 PID: 4760 Comm: kworker/u16:0 Not tainted 6.17.0-rc2-f6bvp+ #23 PREEMPT(voluntary) 
[ 5412.154832] Here I am: receive_buf:467
[ 5412.155125] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020
[ 5412.155566] Here I am: tty_port_default_receive_buf:29
[ 5412.155889] Workqueue: events_unbound flush_to_ldisc
[ 5412.156349] Here I am: tty_ldisc_receive_buf:415 count:67 bytes processed
[ 5412.156648] 
[ 5412.158431] RIP: 0010:__netif_receive_skb_core.constprop.0+0xfe5/0x12d0
[ 5412.158786] Code: 6c 0f 82 24 01 00 00 48 01 93 c0 00 00 00 e9 52 f5 ff ff 48 89 df 4d 89 f5 e8 e7 b4 fd ff e9 c9 fd ff ff 4c 8d 88 d0 00 00 00 <48> 8b 80 d0 00 00 00 4c 8d 78 c8 49 39 c1 0f 84 6c fa ff ff 44 88
[ 5412.159182] RSP: 0018:ffffcd1940003c98 EFLAGS: 00010286
[ 5412.159606] RAX: 0000000000000000 RBX: ffff88a36fef0900 RCX: 0000000000000000
[ 5412.160022] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 5412.160441] RBP: ffffcd1940003da8 R08: 0000000000000200 R09: 00000000000000d0
[ 5412.160861] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88a37059ed40
[ 5412.161279] R13: 0000000000000000 R14: 0000000000000200 R15: ffff88a371fca0d0
[ 5412.161700] FS:  0000000000000000(0000) GS:ffff88a4ecabb000(0000) knlGS:0000000000000000
[ 5412.162128] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5412.162553] CR2: 00000000000000d0 CR3: 000000013aa40006 CR4: 00000000001726f0
[ 5412.162975] Call Trace:
[ 5412.163399]  <IRQ>
[ 5412.163803]  ? default_wake_function+0x1a/0x40
[ 5412.164210]  ? ep_autoremove_wake_function+0x12/0x40
[ 5412.164614]  ? __wake_up_common+0x79/0xb0
[ 5412.165019]  ? __wake_up+0x45/0x70
[ 5412.165425]  __netif_receive_skb_one_core+0x3d/0xa0
[ 5412.165825]  __netif_receive_skb+0x15/0x60
[ 5412.166227]  process_backlog+0x90/0x160
[ 5412.166624]  __napi_poll+0x33/0x230
[ 5412.167018]  net_rx_action+0x20b/0x3f0
[ 5412.167414]  ? update_process_times+0x89/0xd0
[ 5412.167812]  handle_softirqs+0xe7/0x340
[ 5412.168211]  __do_softirq+0x10/0x18
[ 5412.168602]  do_softirq.part.0+0x3f/0x80
[ 5412.168994]  </IRQ>
[ 5412.169383]  <TASK>
[ 5412.169772]  __local_bh_enable_ip+0x6e/0x70
[ 5412.170166]  _raw_spin_unlock_bh+0x1d/0x30
[ 5412.170565]  mkiss_receive_buf+0x36b/0x4b0 [mkiss]
[ 5412.170961]  tty_ldisc_receive_buf+0x78/0x80
[ 5412.171361]  tty_port_default_receive_buf+0x5e/0xa0
[ 5412.171760]  flush_to_ldisc+0xf9/0x1f0
[ 5412.172158]  process_one_work+0x191/0x3e0
[ 5412.172548]  worker_thread+0x2e3/0x420
[ 5412.172941]  ? __pfx_worker_thread+0x10/0x10
[ 5412.173332]  kthread+0x10d/0x230
[ 5412.173722]  ? __pfx_kthread+0x10/0x10
[ 5412.174111]  ret_from_fork+0x1a4/0x1d0
[ 5412.174501]  ? __pfx_kthread+0x10/0x10
[ 5412.174888]  ret_from_fork_asm+0x1a/0x30
[ 5412.175280]  </TASK>
[ 5412.175695] Modules linked in: netrom mkiss rose ax25 netconsole snd_seq_dummy snd_hrtimer cmac nls_utf8 cifs cifs_arc4 nls_ucs2_utils netfs cifs_md4 snd_hda_codec_intelhdmi qrtr snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp coretemp i915 snd_hda_codec_alc269 snd_hda_scodec_component snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel kvm_intel snd_intel_dspcfg spi_nor snd_hda_codec kvm snd_hwdep mtd binfmt_misc snd_hda_core mei_pxp processor_thermal_device_pci_legacy spi_intel_platform irqbypass intel_soc_dts_iosf snd_pcm at24 mei_hdcp intel_rapl_msr spi_intel processor_thermal_device polyval_clmulni processor_thermal_wt_hint ghash_clmulni_intel platform_temperature_control processor_thermal_rfim snd_seq aesni_intel processor_thermal_rapl i2c_algo_bit intel_rapl_common drm_buddy rapl nls_iso8859_1 snd_seq_device snd_timer i2c_i801 intel_cstate processor_thermal_wt_req ttm snd mei_me i2c_smbus processor_thermal_power_floor intel_pch_thermal lpc_ich drm_display_helper mei processor_thermal_mbox
[ 5412.175760]  soundcore intel_pmc_core int340x_thermal_zone pmt_telemetry video pmt_discovery pmt_class wmi intel_pmc_ssram_telemetry acpi_pad intel_vsec input_leds mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs autofs4 hid_generic usbhid hid r8169 ahci libahci realtek uas usb_storage [last unloaded: mkiss]
[ 5412.179250] CR2: 00000000000000d0
[ 5412.179757] ---[ end trace 0000000000000000 ]---
[ 5412.258374] pstore: backend (efi_pstore) writing error (-5)
[ 5412.258977] RIP: 0010:__netif_receive_skb_core.constprop.0+0xfe5/0x12d0
[ 5412.259599] Code: 6c 0f 82 24 01 00 00 48 01 93 c0 00 00 00 e9 52 f5 ff ff 48 89 df 4d 89 f5 e8 e7 b4 fd ff e9 c9 fd ff ff 4c 8d 88 d0 00 00 00 <48> 8b 80 d0 00 00 00 4c 8d 78 c8 49 39 c1 0f 84 6c fa ff ff 44 88
[ 5412.260252] RSP: 0018:ffffcd1940003c98 EFLAGS: 00010286
[ 5412.260926] RAX: 0000000000000000 RBX: ffff88a36fef0900 RCX: 0000000000000000
[ 5412.261600] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 5412.262276] RBP: ffffcd1940003da8 R08: 0000000000000200 R09: 00000000000000d0
[ 5412.262922] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88a37059ed40
[ 5412.263535] R13: 0000000000000000 R14: 0000000000000200 R15: ffff88a371fca0d0
[ 5412.264150] FS:  0000000000000000(0000) GS:ffff88a4ecabb000(0000) knlGS:0000000000000000
[ 5412.264756] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5412.265362] CR2: 00000000000000d0 CR3: 000000013aa40006 CR4: 00000000001726f0
[ 5412.265974] Kernel panic - not syncing: Fatal exception in interrupt
[ 5412.266515] Kernel Offset: 0x1ee00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 5412.344532] Rebooting in 60 seconds..


[-- Attachment #3: netconsole_2.log --]
[-- Type: text/plain, Size: 7465 bytes --]

[ 4405.445220] Here I am: receive_buf:467
[ 4405.445221] Here I am: tty_port_default_receive_buf:29
[ 4405.445222] Here I am: tty_ldisc_receive_buf:415 count:26 bytes processed
[ 4405.445233] mkiss: ax0: Trying crc-smack
[ 4405.445238] Here I am: __tty_buffer_request_room:304 size:20
[ 4405.445240] Here I am: __tty_insert_flip_string_flags:351 20 copied
[ 4405.445245] Here I am: flush_to_ldisc:494
[ 4405.445246] Here I am: tty_buffer_free:210
[ 4405.445247] Here I am: receive_buf:467
[ 4405.445248] Here I am: tty_port_default_receive_buf:29
[ 4405.445251] Here I am: tty_ldisc_receive_buf:415 count:20 bytes processed
[ 4405.446487] Here I am: __tty_buffer_request_room:304 size:18
[ 4405.450656] Here I am: __tty_insert_flip_string_flags:351 18 copied
[ 4405.450740] Here I am: flush_to_ldisc:494
[ 4405.451637] Here I am: tty_buffer_free:210
[ 4405.451639] Here I am: receive_buf:467
[ 4405.451640] Here I am: tty_port_default_receive_buf:29
[ 4405.451654] Here I am: tty_ldisc_receive_buf:415 count:18 bytes processed
[ 4405.451670] Here I am: __tty_insert_flip_string_flags:351 14 copied
[ 4405.453616] Here I am: flush_to_ldisc:494
[ 4405.453987] Here I am: receive_buf:467
[ 4405.454380] Here I am: tty_port_default_receive_buf:29
[ 4405.454460] Here I am: __tty_insert_flip_string_flags:351 272 copied
[ 4405.454825] Here I am: tty_ldisc_receive_buf:415 count:14 bytes processed
[ 4405.455218] Here I am: flush_to_ldisc:494
[ 4405.455228] Here I am: __tty_insert_flip_string_flags:351 215 copied
[ 4405.456669] Here I am: receive_buf:467
[ 4405.456670] Here I am: tty_port_default_receive_buf:29
[ 4405.456687] BUG: kernel NULL pointer dereference, address: 00000000000000d0
[ 4405.456711] Here I am: __tty_insert_flip_string_flags:351 253 copied
[ 4405.456723] Here I am: flush_to_ldisc:494
[ 4405.456726] Here I am: receive_buf:467
[ 4405.456728] Here I am: tty_port_default_receive_buf:29
[ 4405.456730] Here I am: tty_ldisc_receive_buf:415 count:253 bytes processed
[ 4405.459672] #PF: supervisor read access in kernel mode
[ 4405.459676] #PF: error_code(0x0000) - not-present page
[ 4405.459678] PGD 0 P4D 0 
[ 4405.459682] Oops: Oops: 0000 [#1] SMP PTI
[ 4405.461239] CPU: 1 UID: 0 PID: 2953 Comm: kworker/u16:1 Not tainted 6.17.0-rc2-f6bvp+ #23 PREEMPT(voluntary) 
[ 4405.461243] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020
[ 4405.461245] Workqueue: events_unbound flush_to_ldisc
[ 4405.461252] RIP: 0010:__netif_receive_skb_core.constprop.0+0xfe5/0x12d0
[ 4405.461258] Code: 6c 0f 82 24 01 00 00 48 01 93 c0 00 00 00 e9 52 f5 ff ff 48 89 df 4d 89 f5 e8 e7 b4 fd ff e9 c9 fd ff ff 4c 8d 88 d0 00 00 00 <48> 8b 80 d0 00 00 00 4c 8d 78 c8 49 39 c1 0f 84 6c fa ff ff 44 88
[ 4405.461261] RSP: 0018:ffffd254c0016c98 EFLAGS: 00010286
[ 4405.461264] RAX: 0000000000000000 RBX: ffff8aca56b4c300 RCX: 0000000000000000
[ 4405.461266] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 4405.461268] RBP: ffffd254c0016da8 R08: 0000000000000200 R09: 00000000000000d0
[ 4405.461270] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8aca6d5b6d40
[ 4405.461272] R13: 0000000000000000 R14: 0000000000000200 R15: ffff8aca522870d0
[ 4405.461274] FS:  0000000000000000(0000) GS:ffff8acbec13b000(0000) knlGS:0000000000000000
[ 4405.461277] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4405.461279] CR2: 00000000000000d0 CR3: 00000001a7c40003 CR4: 00000000001726f0
[ 4405.461281] Call Trace:
[ 4405.461283]  <IRQ>
[ 4405.461286]  ? attach_entity_load_avg+0x1d1/0x1f0
[ 4405.461293]  ? psi_group_change+0x201/0x4e0
[ 4405.461298]  ? skb_free_head+0xa4/0xd0
[ 4405.468661]  ? skb_release_data+0x186/0x210
[ 4405.468667]  __netif_receive_skb_one_core+0x3d/0xa0
[ 4405.468670]  __netif_receive_skb+0x15/0x60
[ 4405.470017]  process_backlog+0x90/0x160
[ 4405.470400]  __napi_poll+0x33/0x230
[ 4405.470780]  net_rx_action+0x20b/0x3f0
[ 4405.471156]  handle_softirqs+0xe7/0x340
[ 4405.471528]  __do_softirq+0x10/0x18
[ 4405.471903]  do_softirq.part.0+0x3f/0x80
[ 4405.472305]  </IRQ>
[ 4405.472702]  <TASK>
[ 4405.473104]  __local_bh_enable_ip+0x6e/0x70
[ 4405.473503]  _raw_spin_unlock_bh+0x1d/0x30
[ 4405.473907]  mkiss_receive_buf+0x36b/0x4b0 [mkiss]
[ 4405.474310]  tty_ldisc_receive_buf+0x78/0x80
[ 4405.474710]  tty_port_default_receive_buf+0x5e/0xa0
[ 4405.475099]  flush_to_ldisc+0xf9/0x1f0
[ 4405.475482]  process_one_work+0x191/0x3e0
[ 4405.475875]  worker_thread+0x2e3/0x420
[ 4405.476273]  ? __pfx_worker_thread+0x10/0x10
[ 4405.476657]  kthread+0x10d/0x230
[ 4405.477025]  ? __pfx_kthread+0x10/0x10
[ 4405.477387]  ret_from_fork+0x1a4/0x1d0
[ 4405.477750]  ? __pfx_kthread+0x10/0x10
[ 4405.478110]  ret_from_fork_asm+0x1a/0x30
[ 4405.478471]  </TASK>
[ 4405.478827] Modules linked in: netrom netconsole mkiss ax25 snd_seq_dummy snd_hrtimer cmac nls_utf8 cifs cifs_arc4 nls_ucs2_utils netfs cifs_md4 qrtr snd_hda_codec_intelhdmi snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_codec_alc269 kvm_intel snd_hda_scodec_component snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_intel kvm snd_intel_dspcfg spi_nor processor_thermal_device_pci_legacy snd_hda_codec intel_soc_dts_iosf mtd irqbypass snd_hwdep binfmt_misc processor_thermal_device snd_hda_core processor_thermal_wt_hint snd_pcm polyval_clmulni at24 spi_intel_platform mei_hdcp mei_pxp ghash_clmulni_intel intel_rapl_msr platform_temperature_control spi_intel aesni_intel processor_thermal_rfim snd_seq processor_thermal_rapl nls_iso8859_1 snd_seq_device rapl intel_rapl_common i2c_algo_bit snd_timer drm_buddy mei_me intel_pmc_core processor_thermal_wt_req i2c_i801 snd ttm processor_thermal_power_floor pmt_telemetry mei intel_cstate intel_pch_thermal i2c_smbus pmt_discovery
[ 4405.478885]  drm_display_helper lpc_ich processor_thermal_mbox soundcore int340x_thermal_zone video pmt_class wmi input_leds intel_pmc_ssram_telemetry intel_vsec acpi_pad mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs autofs4 hid_generic usbhid hid r8169 ahci realtek libahci uas usb_storage
[ 4405.481860] CR2: 00000000000000d0
[ 4405.482371] ---[ end trace 0000000000000000 ]---
[ 4405.563737] pstore: backend (efi_pstore) writing error (-5)
[ 4405.564259] RIP: 0010:__netif_receive_skb_core.constprop.0+0xfe5/0x12d0
[ 4405.564776] Code: 6c 0f 82 24 01 00 00 48 01 93 c0 00 00 00 e9 52 f5 ff ff 48 89 df 4d 89 f5 e8 e7 b4 fd ff e9 c9 fd ff ff 4c 8d 88 d0 00 00 00 <48> 8b 80 d0 00 00 00 4c 8d 78 c8 49 39 c1 0f 84 6c fa ff ff 44 88
[ 4405.565314] RSP: 0018:ffffd254c0016c98 EFLAGS: 00010286
[ 4405.565841] RAX: 0000000000000000 RBX: ffff8aca56b4c300 RCX: 0000000000000000
[ 4405.566369] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 4405.566890] RBP: ffffd254c0016da8 R08: 0000000000000200 R09: 00000000000000d0
[ 4405.567423] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8aca6d5b6d40
[ 4405.567958] R13: 0000000000000000 R14: 0000000000000200 R15: ffff8aca522870d0
[ 4405.568479] FS:  0000000000000000(0000) GS:ffff8acbec13b000(0000) knlGS:0000000000000000
[ 4405.569013] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4405.569538] CR2: 00000000000000d0 CR3: 00000001a7c40003 CR4: 00000000001726f0
[ 4405.570073] Kernel panic - not syncing: Fatal exception in interrupt
[ 4405.570562] Kernel Offset: 0x1f800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 4405.651489] Rebooting in 30 seconds..