Re: [ROSE] [AX25] 6.15.10 long term stable kernel oops

[F6BVP <f6bvp@free.fr>]

[-- Attachment #1: Type: text/plain, Size: 1396 bytes --]

Florian, thanks a lot for suggestions I followed when I understood more 
clearly what to do....

Here is linux-6.15.1 kernel panic captured by netconsole remotely and 
decoded by stacktrace script.

I guess next step is bisecting between 6.14.11 (good) and 6.15.1 (bad).

Regards,

Bernard

Le 27/08/2025 à 19:30, Florian Westphal a écrit :
> F6BVP <f6bvp@free.fr> wrote:
>> Here I am. Next step is probably to discover why the call to
>> receive_buf() fails when bytes are not small and tty_ldisc_deref() is
>> acting after flush_to_ldisc probably leading to an error. What value is
>> wrong ? ld->tty , p, f ?
> 
> Did you enable CONFIG_KASAN?
> 
> Also, since you seem to be able to reproduce this easily, did you
> try a 'git bisect' to identify the breaking change?
> 
> That would allow to CC the author of that change.
> 
>> 4,19346,153786988,-;Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020
>> 4,19347,153786990,-;Workqueue: events_unbound flush_to_ldisc
>> 4,19348,153786998,-;Here I am: tty_ldisc_deref:283 !tty
>> 4,19349,153787003,-;Here I am: tty_ldisc_deref:283 !tty
>> 4,19350,153787005,-;RIP: 0010:__netif_receive_skb_core.constprop.0+0xfe5/0x12d0
>> 4,19398,153787265,-; __netif_receive_skb_one_core+0x3d/0xa0
> 
> as Eric noted, you need to pipe this through
> 
> scripts/decode_stacktrace.sh so this gets translated to line numbers.

[-- Attachment #2: linux-6.15.1_stacktrace.txt --]
[-- Type: text/plain, Size: 12602 bytes --]

6,1088,187160578,-;NET: Registered PF_AX25 protocol family
6,1089,187171606,-;mkiss: AX.25 Multikiss, Hans Albas PE1AYX
6,1090,189184303,-;mkiss: ax0: crc mode is auto.
6,1091,243510195,-;printk: legacy console [netcon_ext0] disabled
6,1094,243576964,-;netpoll: netconsole: local port 4444
6,1095,243576979,-;netpoll: netconsole: local IPv4 address 44.168.19.9
6,1096,243576985,-;netpoll: netconsole: interface name 'enp2s0'
6,1097,243576989,-;netpoll: netconsole: local ethernet address 'ff:ff:ff:ff:ff:ff'
6,1098,243576994,-;netpoll: netconsole: remote port 6666
6,1099,243576997,-;netpoll: netconsole: remote IPv4 address 44.168.19.6
6,1100,243577001,-;netpoll: netconsole: remote ethernet address b8:27:eb:16:10:a5
6,1101,243577182,-;printk: legacy console [netcon_ext0] enabled
6,1102,243577280,-;printk: legacy console [netcon0] enabled
6,1103,243577297,-;netconsole: network logging started
6,1104,264640762,-;NET: Registered PF_NETROM protocol family
6,1105,292182165,-;mkiss: ax0: Trying crc-smack
6,1106,292185839,-;mkiss: ax0: Trying crc-flexnet
4,1107,292188215,-;Oops: general protection fault, probably for non-canonical address 0xdffffc000000001a: 0000 [#1] SMP KASAN PTI
1,1108,292188298,-;KASAN: null-ptr-deref in range [0x00000000000000d0-0x00000000000000d7]
4,1109,292188328,-;CPU: 0 UID: 0 PID: 197 Comm: kworker/u16:4 Not tainted 6.15.1-f6bvp #1 PREEMPT(voluntary)
4,1110,292188357,-;Hardware name: To be filled by O.E.M. To be filled by O.E.M./CK3, BIOS 5.011 09/16/2020
4,1111,292188395,-;Workqueue: events_unbound flush_to_ldisc
4,1112,292188459,-;RIP: 0010:__netif_receive_skb_core.constprop.0 (net/core/dev.c:2430 (discriminator 2) net/core/dev.c:5847 (discriminator 2)) 
4,1113,292188505,-;Code: e8 cc 11 f9 ff e9 6f fe ff ff 45 31 f6 e9 c7 ee ff ff 4d 8d 85 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 c1 48 c1 e9 03 <80> 3c 01 00 0f 85 3a 11 00 00 49 8b 85 d0 00 00 00 4c 8d 68 c8 49
All code
========
   0:	e8 cc 11 f9 ff       	call   0xfffffffffff911d1
   5:	e9 6f fe ff ff       	jmp    0xfffffffffffffe79
   a:	45 31 f6             	xor    %r14d,%r14d
   d:	e9 c7 ee ff ff       	jmp    0xffffffffffffeed9
  12:	4d 8d 85 d0 00 00 00 	lea    0xd0(%r13),%r8
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df 
  23:	4c 89 c1             	mov    %r8,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)		<-- trapping instruction
  2e:	0f 85 3a 11 00 00    	jne    0x116e
  34:	49 8b 85 d0 00 00 00 	mov    0xd0(%r13),%rax
  3b:	4c 8d 68 c8          	lea    -0x38(%rax),%r13
  3f:	49                   	rex.WB

Code starting with the faulting instruction
===========================================
   0:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
   4:	0f 85 3a 11 00 00    	jne    0x1144
   a:	49 8b 85 d0 00 00 00 	mov    0xd0(%r13),%rax
  11:	4c 8d 68 c8          	lea    -0x38(%rax),%r13
  15:	49                   	rex.WB
4,1114,292188537,-;RSP: 0018:ffffc90000007930 EFLAGS: 00010202
4,1115,292188572,-;RAX: dffffc0000000000 RBX: 0000000000000200 RCX: 000000000000001a
4,1116,292188604,-;RDX: ffff888113851690 RSI: ffff88813ecc2000 RDI: ffff88812d792578
4,1117,292188632,-;RBP: ffffc90000007b78 R08: 00000000000000d0 R09: 0000000000000000
4,1118,292188656,-;R10: ffff888113851680 R11: 0000000000000000 R12: 0000000000000000
4,1119,292188672,-;R13: 0000000000000000 R14: ffff88812d792540 R15: ffff88813ecc2098
4,1120,292188688,-;FS:  0000000000000000(0000) GS:ffff88825629b000(0000) knlGS:0000000000000000
4,1121,292188704,-;CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
4,1122,292188719,-;CR2: 00007fa3b50ee230 CR3: 000000011849c006 CR4: 00000000001726f0
4,1123,292188736,-;Call Trace:
4,1124,292188751,-; <IRQ>
4,1125,292188768,-; ? stack_depot_save_flags (lib/stackdepot.c:610) 
4,1126,292188793,-; ? __pfx___netif_receive_skb_core.constprop.0 (net/core/dev.c:5659) 
4,1127,292188816,-; ? kasan_save_stack (mm/kasan/common.c:49) 
4,1128,292188837,-; ? kasan_save_stack (mm/kasan/common.c:48) 
4,1129,292188854,-; ? __pfx_sched_balance_find_src_group (kernel/sched/fair.c:11296) 
4,1130,292188877,-; ? __pfx_sugov_get_util (kernel/sched/cpufreq_schedutil.c:225) 
4,1131,292188896,-; ? sched_clock_noinstr (arch/x86/kernel/tsc.c:271) 
4,1132,292188926,-; ? sched_clock (./arch/x86/include/asm/preempt.h:95 (discriminator 1) arch/x86/kernel/tsc.c:288 (discriminator 1)) 
4,1133,292188947,-; __netif_receive_skb_one_core (net/core/dev.c:5886) 
4,1134,292188966,-; ? __pfx___netif_receive_skb_one_core (net/core/dev.c:5880) 
4,1135,292188984,-; ? sched_balance_rq (kernel/sched/fair.c:11769) 
4,1136,292189001,-; ? __kasan_check_write (mm/kasan/shadow.c:38) 
4,1137,292189017,-; ? _raw_spin_lock_irq (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:120 (discriminator 4) kernel/locking/spinlock.c:170 (discriminator 4)) 
4,1138,292189034,-; ? __pfx__raw_spin_lock_irq (kernel/locking/spinlock.c:169) 
4,1139,292189051,-; __netif_receive_skb (net/core/dev.c:6003) 
4,1140,292189070,-; process_backlog (./include/linux/rcupdate.h:873 net/core/dev.c:6353) 
4,1141,292189086,-; __napi_poll (net/core/dev.c:7324) 
4,1142,292189102,-; net_rx_action (net/core/dev.c:7390 net/core/dev.c:7510) 
4,1143,292189117,-; ? __pfx_sugov_get_util (kernel/sched/cpufreq_schedutil.c:225) 
4,1144,292189135,-; ? __pfx_net_rx_action (net/core/dev.c:7472) 
4,1145,292189151,-; ? __pfx_sched_balance_domains (kernel/sched/fair.c:12187) 
4,1146,292189169,-; ? sched_clock_cpu (kernel/sched/clock.c:394 (discriminator 1)) 
4,1147,292189185,-; ? sched_balance_softirq (kernel/sched/fair.c:12928) 
4,1148,292189201,-; handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580) 
4,1149,292189219,-; ? __pfx_handle_softirqs (kernel/softirq.c:537) 
4,1150,292189235,-; ? tick_nohz_irq_exit (kernel/time/tick-sched.c:1296) 
4,1151,292189253,-; __do_softirq (kernel/softirq.c:614) 
4,1152,292189269,-; do_softirq.part.0 (kernel/softirq.c:480 (discriminator 32)) 
4,1153,292189285,-; </IRQ>
4,1154,292189299,-; <TASK>
4,1155,292189312,-; __local_bh_enable_ip (./arch/x86/include/asm/preempt.h:27 (discriminator 1) kernel/softirq.c:407 (discriminator 1)) 
4,1156,292189329,-; _raw_spin_unlock_bh (kernel/locking/spinlock.c:211) 
4,1157,292189344,-; mkiss_receive_buf (./include/linux/spinlock.h:397 drivers/net/hamradio/mkiss.c:298 drivers/net/hamradio/mkiss.c:310 drivers/net/hamradio/mkiss.c:901) mkiss 
4,1158,292189362,-; ? __kasan_check_write (mm/kasan/shadow.c:38) 
4,1159,292189377,-; ? ldsem_down_read_trylock (./arch/x86/include/asm/atomic64_64.h:101 (discriminator 1) ./include/linux/atomic/atomic-arch-fallback.h:4256 (discriminator 1) ./include/linux/atomic/atomic-long.h:1458 (discriminator 1) ./include/linux/atomic/atomic-instrumented.h:4436 (discriminator 1) drivers/tty/tty_ldsem.c:351 (discriminator 1)) 
4,1160,292189396,-; tty_ldisc_receive_buf (drivers/tty/tty_buffer.c:391) 
4,1161,292189414,-; tty_port_default_receive_buf (drivers/tty/tty_port.c:39) 
4,1162,292189431,-; flush_to_ldisc (drivers/tty/tty_buffer.c:446 drivers/tty/tty_buffer.c:495) 
4,1163,292189448,-; ? __pfx___kasan_check_read (??:?) 
4,1164,292189464,-; process_one_work (kernel/workqueue.c:3243) 
4,1165,292189481,-; ? __kasan_check_write (mm/kasan/shadow.c:38) 
4,1166,292189498,-; worker_thread (kernel/workqueue.c:3313 (discriminator 2) kernel/workqueue.c:3400 (discriminator 2)) 
4,1167,292189513,-; ? __pfx_try_to_wake_up (kernel/sched/core.c:4175) 
4,1168,292189531,-; ? __pfx_worker_thread (kernel/workqueue.c:3346) 
4,1169,292189547,-; kthread (kernel/kthread.c:464) 
4,1170,292189562,-; ? __pfx__raw_spin_lock_irq (kernel/locking/spinlock.c:169) 
4,1171,292189578,-; ? __pfx_kthread (kernel/kthread.c:413) 
4,1172,292189598,-; ? __kasan_check_write (mm/kasan/shadow.c:38) 
4,1173,292189613,-; ? recalc_sigpending (./arch/x86/include/asm/bitops.h:75 ./include/asm-generic/bitops/instrumented-atomic.h:42 ./include/linux/thread_info.h:102 kernel/signal.c:181 kernel/signal.c:177) 
4,1174,292189630,-; ? ret_from_fork (arch/x86/kernel/process.c:152 (discriminator 1)) 
4,1175,292189647,-; ? calculate_sigpending (kernel/signal.c:195) 
4,1176,292189663,-; ? __pfx_kthread (kernel/kthread.c:413) 
4,1177,292189678,-; ret_from_fork (arch/x86/kernel/process.c:159) 
4,1178,292189693,-; ? __pfx_kthread (kernel/kthread.c:413) 
4,1179,292189708,-; ret_from_fork_asm (arch/x86/entry/entry_64.S:258) 
4,1180,292189726,-; </TASK>
4,1181,292189739,-,ncfrag=0/1022;Modules linked in: netrom netconsole mkiss ax25 snd_seq_dummy snd_hrtimer cmac nls_utf8 cifs cifs_arc4 nls_ucs2_utils netfs cifs_md4 qrtr snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp i915 coretemp kvm_intel kvm snd_hda_codec_realtek spi_nor snd_hda_codec_generic snd_hda_scodec_component mtd snd_hda_intel snd_intel_dspcfg mei_hdcp mei_pxp snd_hda_codec at24 spi_intel_platform intel_rapl_msr spi_intel irqbypass snd_hwdep polyval_clmulni snd_hda_core snd_pcm polyval_generic ghash_clmulni_intel processor_thermal_device_pci_legacy aesni_intel crypto_simd intel_soc_dts_iosf processor_thermal_device cryptd processor_thermal_wt_hint snd_seq processor_thermal_rfim mei_me i2c_algo_bit rapl binfmt_misc processor_thermal_rapl drm_buddy intel_cstate snd_seq_device ttm i2c_i801 intel_rapl_common snd_timer intel_pch_thermal i2c_smbus mei processor_thermal_wt_req lpc_ich processor_thermal_power_floor drm_display_helper snd processor_thermal_mbox int340x_the4,1181,292189739,-,ncfrag=967/1022;rmal_zone soundcore intel_pmc_core video pmt_telemetry
4,1182,292189921,c; wmi pmt_class acpi_pad intel_vsec nls_iso8859_1 input_leds mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs autofs4 r8169 ahci realtek libahci hid_generic usbhid hid uas usb_storage [last unloaded: netconsole]
4,1183,292190085,-;---[ end trace 0000000000000000 ]---
3,1184,292227984,-;pstore: backend (efi_pstore) writing error (-5)
4,1185,292228068,-;RIP: 0010:__netif_receive_skb_core.constprop.0 (net/core/dev.c:2430 (discriminator 2) net/core/dev.c:5847 (discriminator 2)) 
4,1186,292228114,-;Code: e8 cc 11 f9 ff e9 6f fe ff ff 45 31 f6 e9 c7 ee ff ff 4d 8d 85 d0 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 c1 48 c1 e9 03 <80> 3c 01 00 0f 85 3a 11 00 00 49 8b 85 d0 00 00 00 4c 8d 68 c8 49
All code
========
   0:	e8 cc 11 f9 ff       	call   0xfffffffffff911d1
   5:	e9 6f fe ff ff       	jmp    0xfffffffffffffe79
   a:	45 31 f6             	xor    %r14d,%r14d
   d:	e9 c7 ee ff ff       	jmp    0xffffffffffffeed9
  12:	4d 8d 85 d0 00 00 00 	lea    0xd0(%r13),%r8
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df 
  23:	4c 89 c1             	mov    %r8,%rcx
  26:	48 c1 e9 03          	shr    $0x3,%rcx
  2a:*	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)		<-- trapping instruction
  2e:	0f 85 3a 11 00 00    	jne    0x116e
  34:	49 8b 85 d0 00 00 00 	mov    0xd0(%r13),%rax
  3b:	4c 8d 68 c8          	lea    -0x38(%rax),%r13
  3f:	49                   	rex.WB

Code starting with the faulting instruction
===========================================
   0:	80 3c 01 00          	cmpb   $0x0,(%rcx,%rax,1)
   4:	0f 85 3a 11 00 00    	jne    0x1144
   a:	49 8b 85 d0 00 00 00 	mov    0xd0(%r13),%rax
  11:	4c 8d 68 c8          	lea    -0x38(%rax),%r13
  15:	49                   	rex.WB
4,1187,292228147,-;RSP: 0018:ffffc90000007930 EFLAGS: 00010202
4,1188,292228181,-;RAX: dffffc0000000000 RBX: 0000000000000200 RCX: 000000000000001a
4,1189,292228208,-;RDX: ffff888113851690 RSI: ffff88813ecc2000 RDI: ffff88812d792578
4,1190,292228235,-;RBP: ffffc90000007b78 R08: 00000000000000d0 R09: 0000000000000000
4,1191,292228264,-;R10: ffff888113851680 R11: 0000000000000000 R12: 0000000000000000
4,1192,292228291,-;R13: 0000000000000000 R14: ffff88812d792540 R15: ffff88813ecc2098
4,1193,292228319,-;FS:  0000000000000000(0000) GS:ffff88825629b000(0000) knlGS:0000000000000000
4,1194,292228348,-;CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
4,1195,292228375,-;CR2: 00007fa3b50ee230 CR3: 00000001136d0005 CR4: 00000000001726f0
0,1196,292228427,-;Kernel panic - not syncing: Fatal exception in interrupt
0,1197,292228467,-;Kernel Offset: 0x32200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
0,1198,292263791,-;Rebooting in 30 seconds..