"refcount_t: underflow; use-after-free" when removing a SD card

Heiner Kallweit
2017-06-11T07:27:15Z

When removing a SD card I get the following error. IIRC this did not
happen when I started testing the Meson GPIO IRQ driver few weeks ago.

It occurs in card detect polling mode and in cd irq mode as well.

Looking at recent changes to the mmc core I didn't find anything
clearly related to this error.

[ 32.661577] mmc1: new high speed SDHC card at address 1234
[ 32.669902] mmcblk1: mmc1:1234 SA08G 7.21 GiB
[ 32.674059] mmcblk1: p1
[ 44.958867] mmc1: card 1234 removed
[ 44.990779] refcount_t: underflow; use-after-free.
[ 44.991112] ------------[ cut here ]------------
[ 44.994658] WARNING: CPU: 0 PID: 1126 at lib/refcount.c:184 refcount_sub_and_test+0xc4/0xe0
[ 45.002850] Modules linked in: dwc2 udc_core fb_sh1106(C) fbtft(C) syscopyarea sysfillrect sysimgblt fb_sys_fops dwmac_generic realtek fb rtc_ds1307 ir_lirc_codec dwmac_meson8b ir_sony_decoder lirc_dev regmap_i2c at24 usbcore stm mac_platform phy_meson8b_usb2 stmmac meson_rng spi_gpio meson_ir spi_bitbang rng_core meson_gxbb_wdt meson_saradc rc _core industrialio usb_common i2c_meson i2c_core leds_gpio nvmem_meson_efuse led_class nvmem_core ipv6
[ 45.041870] CPU: 0 PID: 1126 Comm: kworker/0:4 Tainted: G C 4.12.0-rc4-next-20170609+ #15
[ 45.051062] Hardware name: Hardkernel ODROID-C2 (DT)
[ 45.056025] Workqueue: events_freezable mmc_rescan
[ 45.060734] task: ffff800071090000 task.stack: ffff800071b70000
[ 45.066625] PC is at refcount_sub_and_test+0xc4/0xe0
[ 45.071532] LR is at refcount_sub_and_test+0xc4/0xe0
[ 45.076431] pc : [<ffff0000083047fc>] lr : [<ffff0000083047fc>] pstate: 00000145
[ 45.083747] sp : ffff800071b73ad0
[ 45.087028] x29: ffff800071b73ad0 x28: 0000000000000000
[ 45.092288] x27: 0000000000000000 x26: ffff0000085f95c8
[ 45.097549] x25: 00000000fffffef7 x24: ffff800071b62818
[ 45.102810] x23: 0000000000000060 x22: 0000000000000004
[ 45.108073] x21: ffff80006deacb00 x20: ffff800071b63000
[ 45.113334] x19: ffff8000712eb918 x18: 0000000000000010
[ 45.118594] x17: 0000ffff80dd19d8 x16: 0000000000000000
[ 45.123856] x15: ffffffffffffffff x14: ffff0000887451f7
[ 45.129117] x13: ffff0000086d8938 x12: ffff000008363150
[ 45.134378] x11: 0000000005f5e0ff x10: 0000000000000005
[ 45.139639] x9 : 00000000ffffffd0 x8 : 6572662d72657466
[ 45.144901] x7 : 612d657375203b77 x6 : 00000000000000d6
[ 45.150160] x5 : 0000000000000000 x4 : 0000000000000000
[ 45.155422] x3 : 0000000000000000 x2 : ffff80007ff807c0
[ 45.160684] x1 : 00008000778b8000 x0 : 0000000000000026
[ 45.165945] Call trace:
[ 45.168384] Exception stack(0xffff800071b73900 to 0xffff800071b73a30)
[ 45.174773] 3900: ffff8000712eb918 0001000000000000 ffff800071b73ad0 ffff0000083047fc
[ 45.182531] 3920: 0000000000000000 0000000000000000 ffff800071b73970 0000000000000000
[ 45.190296] 3940: ffff800071b73ad0 ffff800071b73ad0 ffff800071b73a90 00000000ffffffc8
[ 45.198059] 3960: ffff800071b73990 ffff0000080e98e4 ffff800071b73ad0 ffff800071b73ad0
[ 45.205821] 3980: ffff800071b73a90 00000000ffffffc8 ffff800071b73a40 ffff000008142c30
[ 45.213582] 39a0: 0000000000000026 00008000778b8000 ffff80007ff807c0 0000000000000000
[ 45.221343] 39c0: 0000000000000000 0000000000000000 00000000000000d6 612d657375203b77
[ 45.229106] 39e0: 6572662d72657466 00000000ffffffd0 0000000000000005 0000000005f5e0ff
[ 45.236871] 3a00: ffff000008363150 ffff0000086d8938 ffff0000887451f7 ffffffffffffffff
[ 45.244619] 3a20: 0000000000000000 0000ffff80dd19d8
[ 45.249472] [<ffff0000083047fc>] refcount_sub_and_test+0xc4/0xe0
[ 45.255420] [<ffff00000830482c>] refcount_dec_and_test+0x14/0x20
[ 45.261363] [<ffff0000082ec43c>] kobject_put+0x24/0xe0
[ 45.266461] [<ffff0000082bd4a0>] blk_put_queue+0x10/0x18
[ 45.271716] [<ffff0000082d2f70>] disk_release+0x90/0xb0
[ 45.276900] [<ffff00000837f22c>] device_release+0x34/0x90
[ 45.282234] [<ffff0000082ec48c>] kobject_put+0x74/0xe0
[ 45.287320] [<ffff0000082d2064>] put_disk+0x14/0x28
[ 45.292159] [<ffff0000083f6654>] mmc_blk_put+0x64/0x90
[ 45.297250] [<ffff0000083f7c9c>] mmc_blk_remove_req.part.13+0x74/0x80
[ 45.303626] [<ffff0000083f7e3c>] mmc_blk_remove+0x104/0x198
[ 45.309143] [<ffff0000083e9aec>] mmc_bus_remove+0x1c/0x28
[ 45.314500] [<ffff000008384d3c>] device_release_driver_internal+0x174/0x200
[ 45.321391] [<ffff000008384ddc>] device_release_driver+0x14/0x20
[ 45.327342] [<ffff000008383c2c>] bus_remove_device+0x12c/0x150
[ 45.333131] [<ffff00000838071c>] device_del+0x1ac/0x300
[ 45.338297] [<ffff0000083ea238>] mmc_remove_card+0x48/0x88
[ 45.343739] [<ffff0000083ef340>] mmc_sd_detect+0x38/0x70
[ 45.348990] [<ffff0000083e94ec>] mmc_rescan+0xbc/0x3b8
[ 45.354085] [<ffff0000080bd54c>] process_one_work+0x1dc/0x340
[ 45.359770] [<ffff0000080bd6f8>] worker_thread+0x48/0x480
[ 45.365129] [<ffff0000080c345c>] kthread+0x12c/0x130
[ 45.370040] [<ffff0000080826c0>] ret_from_fork+0x10/0x50
[ 45.375280] ---[ end trace 68e15ca00eff8617 ]---