* [BUG] general protection fault when connecting an old mp3/usb device
@ 2025-08-18 9:50 David Wang
2025-08-19 19:20 ` Bart Van Assche
0 siblings, 1 reply; 5+ messages in thread
From: David Wang @ 2025-08-18 9:50 UTC (permalink / raw)
To: James.Bottomley, martin.petersen; +Cc: linux-scsi, linux-kernel
Hi,
My loptop is running 6.16.0, once when I connect with an old mp3 via usb for file
transfer, the connection could not be established correctly, after I reconnect it
several times, got following kernel error:
(The device is old, and maybe buggy, but it works. And eventually I can connect it
for file transfers)
[Sat Aug 23 03:56:02 2025] usb 1-5: new high-speed USB device number 35 using xhci_hcd
[Sat Aug 23 03:56:02 2025] usb 1-5: New USB device found, idVendor=12d1, idProduct=1082, bcdDevice= 3.18
[Sat Aug 23 03:56:02 2025] usb 1-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[Sat Aug 23 03:56:02 2025] usb 1-5: Product: ATU-AL10
[Sat Aug 23 03:56:02 2025] usb 1-5: Manufacturer: HUAWEI
[Sat Aug 23 03:56:02 2025] usb 1-5: SerialNumber: TPE9X18915C02308
[Sat Aug 23 03:56:02 2025] usb-storage 1-5:1.1: USB Mass Storage device detected
[Sat Aug 23 03:56:02 2025] scsi host2: usb-storage 1-5:1.1
[Sat Aug 23 03:56:03 2025] scsi 2:0:0:0: CD-ROM Linux File-CD Gadget 0318 PQ: 0 ANSI: 2
[Sat Aug 23 03:56:03 2025] sr 2:0:0:0: Power-on or device reset occurred
[Sat Aug 23 03:56:03 2025] sr 2:0:0:0: [sr0] scsi3-mmc drive: 0x/0x caddy
[Sat Aug 23 03:56:03 2025] sr 2:0:0:0: Attached scsi CD-ROM sr0
[Sat Aug 23 03:56:03 2025] sr 2:0:0:0: Attached scsi generic sg0 type 5
[Sat Aug 23 03:56:03 2025] /dev/sr0: Can't open blockdev
[Sat Aug 23 03:56:03 2025] ISO 9660 Extensions: Microsoft Joliet Level 1
[Sat Aug 23 03:56:03 2025] ISOFS: changing to secondary root
[Sat Aug 23 03:56:07 2025] usb 1-5: reset high-speed USB device number 35 using xhci_hcd
[Sat Aug 23 03:56:07 2025] sr 2:0:0:0: Power-on or device reset occurred
[Sat Aug 23 03:56:07 2025] usb 1-5: reset high-speed USB device number 35 using xhci_hcd
[Sat Aug 23 03:56:08 2025] sr 2:0:0:0: Power-on or device reset occurred
[Sat Aug 23 03:56:09 2025] usb 1-5: USB disconnect, device number 35
[Sat Aug 23 03:56:09 2025] Oops: general protection fault, probably for non-canonical address 0x2e2e2f2e2e2f308e: 0000 [#1] SMP NOPTI
[Sat Aug 23 03:56:09 2025] CPU: 6 UID: 0 PID: 355615 Comm: umount Not tainted 6.16.0-linan-0 #50 PREEMPT(voluntary)
[Sat Aug 23 03:56:09 2025] Hardware name: Acer S40-53/Lily_TL, BIOS V1.01 08/28/2020
[Sat Aug 23 03:56:09 2025] RIP: 0010:scsi_block_when_processing_errors+0x27/0xf0 [scsi_mod]
[Sat Aug 23 03:56:09 2025] Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 53 48 83 ec 30 65 48 8b 1d 61 b1 13 f0 48 89 5c 24 28 48 89 fb e8 2c 73 cd ee 48 8b 13 <8b> 82 60 02 00 00 83 e8 05 83 f8 02 76 09 f6 82 20 02 00 00 10 74
[Sat Aug 23 03:56:09 2025] RSP: 0018:ffffaff30f777c70 EFLAGS: 00010246
[Sat Aug 23 03:56:09 2025] RAX: 0000000000000000 RBX: ffff920700e06000 RCX: 0000000000000000
[Sat Aug 23 03:56:09 2025] RDX: 2e2e2f2e2e2f2e2e RSI: ffffaff30f777d40 RDI: ffff920700e06000
[Sat Aug 23 03:56:09 2025] RBP: ffff920700e06000 R08: ffffaff30f777db4 R09: 0000000000000004
[Sat Aug 23 03:56:09 2025] R10: ffffaff30f777db4 R11: ffffffffb06dff80 R12: ffffaff30f777cc0
[Sat Aug 23 03:56:09 2025] R13: ffff9206360b2c00 R14: 0000000000000000 R15: ffffaff30f777d40
[Sat Aug 23 03:56:09 2025] FS: 00007f28311db840(0000) GS:ffff92092fe60000(0000) knlGS:0000000000000000
[Sat Aug 23 03:56:09 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Sat Aug 23 03:56:09 2025] CR2: 000055c1ad2b1058 CR3: 000000011eaae002 CR4: 0000000000f72ef0
[Sat Aug 23 03:56:09 2025] PKRU: 55555554
[Sat Aug 23 03:56:09 2025] Call Trace:
[Sat Aug 23 03:56:09 2025] <TASK>
[Sat Aug 23 03:56:09 2025] sr_do_ioctl+0x5b/0x1c0 [sr_mod]
[Sat Aug 23 03:56:09 2025] sr_packet+0x2c/0x50 [sr_mod]
[Sat Aug 23 03:56:09 2025] cdrom_get_disc_info+0x60/0xe0 [cdrom]
[Sat Aug 23 03:56:09 2025] cdrom_mrw_exit+0x29/0xb0 [cdrom]
[Sat Aug 23 03:56:09 2025] ? xa_destroy+0xaa/0x120
[Sat Aug 23 03:56:09 2025] unregister_cdrom+0x76/0xc0 [cdrom]
[Sat Aug 23 03:56:09 2025] sr_free_disk+0x44/0x50 [sr_mod]
[Sat Aug 23 03:56:09 2025] disk_release+0xb0/0xe0
[Sat Aug 23 03:56:09 2025] device_release+0x37/0x90
[Sat Aug 23 03:56:09 2025] kobject_put+0x8e/0x1d0
[Sat Aug 23 03:56:09 2025] blkdev_release+0x11/0x20
[Sat Aug 23 03:56:09 2025] __fput+0xe3/0x2a0
[Sat Aug 23 03:56:09 2025] task_work_run+0x59/0x90
[Sat Aug 23 03:56:09 2025] exit_to_user_mode_loop+0xd6/0xe0
[Sat Aug 23 03:56:09 2025] do_syscall_64+0x1c1/0x1e0
[Sat Aug 23 03:56:09 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[Sat Aug 23 03:56:09 2025] RIP: 0033:0x7f2831407b37
[Sat Aug 23 03:56:09 2025] Code: cf 92 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 99 92 0c 00 f7 d8 64 89 02 b8
[Sat Aug 23 03:56:09 2025] RSP: 002b:00007ffd4805c858 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[Sat Aug 23 03:56:09 2025] RAX: 0000000000000000 RBX: 00005590f636c0f8 RCX: 00007f2831407b37
[Sat Aug 23 03:56:09 2025] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00005590f636c210
[Sat Aug 23 03:56:09 2025] RBP: 0000000000000002 R08: 00007f28314d1cc0 R09: 0000000000000040
[Sat Aug 23 03:56:09 2025] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f2831542264
[Sat Aug 23 03:56:09 2025] R13: 00005590f636c210 R14: 00005590f63716f0 R15: 00005590f636bfe0
[Sat Aug 23 03:56:09 2025] </TASK>
[Sat Aug 23 03:56:09 2025] Modules linked in: sd_mod isofs sr_mod cdrom sg uas usb_storage snd_usb_audio snd_usbmidi_lib snd_rawmidi hid_generic usbhid hid ccm rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_CHECKSUM ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_tcpudp nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc cmac algif_hash algif_skcipher af_alg qrtr bnep binfmt_misc nls_ascii nls_cp437 vfat fat snd_ctl_led snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers snd_soc_intel_hda_dsp_common snd_sof_probes snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel soundwire_generic_allocation snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_hda_codec_hdmi snd_hda_ext_core soundwire_cadence snd_sof_pci intel_rapl_msr snd_sof_xtensa_dsp intel_rapl_common snd_sof
[Sat Aug 23 03:56:09 2025] x86_pkg_temp_thermal snd_sof_utils snd_soc_acpi_intel_match intel_powerclamp snd_soc_acpi_intel_sdca_quirks coretemp snd_soc_acpi crc8 iwlmvm soundwire_bus kvm_intel snd_soc_sdca snd_soc_core mac80211 snd_compress kvm libarc4 snd_hda_intel ptp btusb snd_intel_dspcfg uvcvideo pps_core mei_hdcp irqbypass btrtl snd_intel_sdw_acpi ghash_clmulni_intel videobuf2_vmalloc aesni_intel btintel uvc snd_hda_codec videobuf2_memops btbcm videobuf2_v4l2 rapl snd_hda_core iwlwifi snd_hwdep intel_cstate snd_pcsp videodev bluetooth iTCO_wdt snd_pcm videobuf2_common ecdh_generic acer_wmi mc intel_uncore snd_timer intel_pmc_bxt ecc platform_profile wmi_bmof snd cfg80211 iTCO_vendor_support ee1004 mei_me soundcore watchdog mei rfkill ac intel_hid sparse_keymap acpi_pad joydev acer_wireless evdev serio_raw msr parport_pc ppdev lp parport fuse loop efi_pstore dm_mod configfs autofs4 ext4 crc16 mbcache jbd2 btrfs blake2b_generic efivarfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq raid1
[Sat Aug 23 03:56:09 2025] raid0 md_mod ahci libahci libata nvme scsi_mod nvme_core scsi_common i915 cec drm_buddy ttm i2c_algo_bit r8169 drm_display_helper xhci_pci drm_client_lib realtek xhci_hcd mdio_devres drm_kms_helper psmouse libphy usbcore intel_lpss_pci drm mdio_bus i2c_i801 intel_lpss i2c_smbus usb_common idma64 vmd fan video button battery wmi
[Sat Aug 23 03:56:09 2025] ---[ end trace 0000000000000000 ]---
[Sat Aug 23 03:56:10 2025] pstore: backend (efi_pstore) writing error (-28)
[Sat Aug 23 03:56:10 2025] RIP: 0010:scsi_block_when_processing_errors+0x27/0xf0 [scsi_mod]
[Sat Aug 23 03:56:10 2025] Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 53 48 83 ec 30 65 48 8b 1d 61 b1 13 f0 48 89 5c 24 28 48 89 fb e8 2c 73 cd ee 48 8b 13 <8b> 82 60 02 00 00 83 e8 05 83 f8 02 76 09 f6 82 20 02 00 00 10 74
[Sat Aug 23 03:56:10 2025] RSP: 0018:ffffaff30f777c70 EFLAGS: 00010246
[Sat Aug 23 03:56:10 2025] RAX: 0000000000000000 RBX: ffff920700e06000 RCX: 0000000000000000
[Sat Aug 23 03:56:10 2025] RDX: 2e2e2f2e2e2f2e2e RSI: ffffaff30f777d40 RDI: ffff920700e06000
[Sat Aug 23 03:56:10 2025] RBP: ffff920700e06000 R08: ffffaff30f777db4 R09: 0000000000000004
[Sat Aug 23 03:56:10 2025] R10: ffffaff30f777db4 R11: ffffffffb06dff80 R12: ffffaff30f777cc0
[Sat Aug 23 03:56:10 2025] R13: ffff9206360b2c00 R14: 0000000000000000 R15: ffffaff30f777d40
[Sat Aug 23 03:56:10 2025] FS: 00007f28311db840(0000) GS:ffff92092fe60000(0000) knlGS:0000000000000000
[Sat Aug 23 03:56:10 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Sat Aug 23 03:56:10 2025] CR2: 000055c1ad2b1058 CR3: 000000011eaae002 CR4: 0000000000f72ef0
[Sat Aug 23 03:56:10 2025] PKRU: 55555554
Parsing with a vmlinux image build with DEBUG_INFO:
[Sat Aug 23 03:56:09 2025] Oops: general protection fault, probably for non-canonical address 0x2e2e2f2e2e2f308e: 0000 [#1] SMP NOPTI
[Sat Aug 23 03:56:09 2025] CPU: 6 UID: 0 PID: 355615 Comm: umount Not tainted 6.16.0-linan-0 #50 PREEMPT(voluntary)
[Sat Aug 23 03:56:09 2025] Hardware name: Acer S40-53/Lily_TL, BIOS V1.01 08/28/2020
[Sat Aug 23 03:56:09 2025] RIP: 0010:scsi_block_when_processing_errors (./include/scsi/scsi_host.h:755 drivers/scsi/scsi_error.c:388) scsi_mod
[Sat Aug 23 03:56:09 2025] Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 53 48 83 ec 30 65 48 8b 1d 61 b1 13 f0 48 89 5c 24 28 48 89 fb e8 2c 73 cd ee 48 8b 13 <8b> 82 60 02 00 00 83 e8 05 83 f8 02 76 09 f6 82 20 02 00 00 10 74
All code
========
0: 90 nop
1: 90 nop
2: 90 nop
3: f3 0f 1e fa endbr64
7: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
c: 55 push %rbp
d: 53 push %rbx
e: 48 83 ec 30 sub $0x30,%rsp
12: 65 48 8b 1d 61 b1 13 mov %gs:-0xfec4e9f(%rip),%rbx # 0xfffffffff013b17b
19: f0
1a: 48 89 5c 24 28 mov %rbx,0x28(%rsp)
1f: 48 89 fb mov %rdi,%rbx
22: e8 2c 73 cd ee call 0xffffffffeecd7353
27: 48 8b 13 mov (%rbx),%rdx
2a:* 8b 82 60 02 00 00 mov 0x260(%rdx),%eax <-- trapping instruction
30: 83 e8 05 sub $0x5,%eax
33: 83 f8 02 cmp $0x2,%eax
36: 76 09 jbe 0x41
38: f6 82 20 02 00 00 10 testb $0x10,0x220(%rdx)
3f: 74 .byte 0x74
Code starting with the faulting instruction
===========================================
0: 8b 82 60 02 00 00 mov 0x260(%rdx),%eax
6: 83 e8 05 sub $0x5,%eax
9: 83 f8 02 cmp $0x2,%eax
c: 76 09 jbe 0x17
e: f6 82 20 02 00 00 10 testb $0x10,0x220(%rdx)
15: 74 .byte 0x74
[Sat Aug 23 03:56:09 2025] RSP: 0018:ffffaff30f777c70 EFLAGS: 00010246
[Sat Aug 23 03:56:09 2025] RAX: 0000000000000000 RBX: ffff920700e06000 RCX: 0000000000000000
[Sat Aug 23 03:56:09 2025] RDX: 2e2e2f2e2e2f2e2e RSI: ffffaff30f777d40 RDI: ffff920700e06000
[Sat Aug 23 03:56:09 2025] RBP: ffff920700e06000 R08: ffffaff30f777db4 R09: 0000000000000004
[Sat Aug 23 03:56:09 2025] R10: ffffaff30f777db4 R11: ffffffffb06dff80 R12: ffffaff30f777cc0
[Sat Aug 23 03:56:09 2025] R13: ffff9206360b2c00 R14: 0000000000000000 R15: ffffaff30f777d40
[Sat Aug 23 03:56:09 2025] FS: 00007f28311db840(0000) GS:ffff92092fe60000(0000) knlGS:0000000000000000
[Sat Aug 23 03:56:09 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Sat Aug 23 03:56:09 2025] CR2: 000055c1ad2b1058 CR3: 000000011eaae002 CR4: 0000000000f72ef0
[Sat Aug 23 03:56:09 2025] PKRU: 55555554
[Sat Aug 23 03:56:09 2025] Call Trace:
[Sat Aug 23 03:56:09 2025] <TASK>
[Sat Aug 23 03:56:09 2025] sr_do_ioctl (drivers/scsi/sr_ioctl.c:202 (discriminator 1)) sr_mod
[Sat Aug 23 03:56:09 2025] sr_packet (drivers/scsi/sr.c:928) sr_mod
[Sat Aug 23 03:56:09 2025] cdrom_get_disc_info (drivers/cdrom/cdrom.c:385) cdrom
[Sat Aug 23 03:56:09 2025] cdrom_mrw_exit (drivers/cdrom/cdrom.c:538) cdrom
[Sat Aug 23 03:56:09 2025] ? xa_destroy (lib/xarray.c:956 lib/xarray.c:2390)
[Sat Aug 23 03:56:09 2025] unregister_cdrom (drivers/cdrom/cdrom.c:657) cdrom
[Sat Aug 23 03:56:09 2025] sr_free_disk (drivers/scsi/sr.c:578) sr_mod
[Sat Aug 23 03:56:09 2025] disk_release (block/genhd.c:1312)
[Sat Aug 23 03:56:09 2025] device_release (drivers/base/core.c:2572)
[Sat Aug 23 03:56:09 2025] kobject_put (lib/kobject.c:693 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)
[Sat Aug 23 03:56:09 2025] blkdev_release (block/fops.c:686)
[Sat Aug 23 03:56:09 2025] __fput (fs/file_table.c:465)
[Sat Aug 23 03:56:09 2025] task_work_run (kernel/task_work.c:227)
[Sat Aug 23 03:56:09 2025] exit_to_user_mode_loop (./include/linux/resume_user_mode.h:50 kernel/entry/common.c:114)
[Sat Aug 23 03:56:09 2025] do_syscall_64 (./include/linux/entry-common.h:330 ./include/linux/entry-common.h:414 ./include/linux/entry-common.h:449 arch/x86/entry/syscall_64.c:100)
[Sat Aug 23 03:56:09 2025] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[Sat Aug 23 03:56:09 2025] RIP: 0033:0x7f2831407b37
The offending address 0x2e2e2f2e2e2f308e seems interesting:
0x2e2e2f2e2e2f308e = 0x2e2e2f2e2e2f2e2e+0x260
as in:
2a:* 8b 82 60 02 00 00 mov 0x260(%rdx),%eax <-- trapping instruction
It seems part of the device structure has been erased with 0x2e2e2f2e2e2f2e2e, when
scsi_block_when_processing_errors tried to access it.
Thanks
David
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] general protection fault when connecting an old mp3/usb device
2025-08-18 9:50 [BUG] general protection fault when connecting an old mp3/usb device David Wang
@ 2025-08-19 19:20 ` Bart Van Assche
2025-08-20 1:38 ` David Wang
2025-08-20 10:02 ` David Wang
0 siblings, 2 replies; 5+ messages in thread
From: Bart Van Assche @ 2025-08-19 19:20 UTC (permalink / raw)
To: phil; +Cc: David Wang, linux-scsi, linux-kernel, James.Bottomley,
martin.petersen
On 8/18/25 2:50 AM, David Wang wrote:
> [Sat Aug 23 03:56:09 2025] Oops: general protection fault, probably for non-canonical address 0x2e2e2f2e2e2f308e: 0000 [#1] SMP NOPTI
> [Sat Aug 23 03:56:09 2025] Call Trace:
> [Sat Aug 23 03:56:09 2025] <TASK>
> [Sat Aug 23 03:56:09 2025] sr_do_ioctl+0x5b/0x1c0 [sr_mod]
> [Sat Aug 23 03:56:09 2025] sr_packet+0x2c/0x50 [sr_mod]
> [Sat Aug 23 03:56:09 2025] cdrom_get_disc_info+0x60/0xe0 [cdrom]
> [Sat Aug 23 03:56:09 2025] cdrom_mrw_exit+0x29/0xb0 [cdrom]
> [Sat Aug 23 03:56:09 2025] ? xa_destroy+0xaa/0x120
> [Sat Aug 23 03:56:09 2025] unregister_cdrom+0x76/0xc0 [cdrom]
> [Sat Aug 23 03:56:09 2025] sr_free_disk+0x44/0x50 [sr_mod]
> [Sat Aug 23 03:56:09 2025] disk_release+0xb0/0xe0
> [Sat Aug 23 03:56:09 2025] device_release+0x37/0x90
> [Sat Aug 23 03:56:09 2025] kobject_put+0x8e/0x1d0
> [Sat Aug 23 03:56:09 2025] blkdev_release+0x11/0x20
> [Sat Aug 23 03:56:09 2025] __fput+0xe3/0x2a0
> [Sat Aug 23 03:56:09 2025] task_work_run+0x59/0x90
> [Sat Aug 23 03:56:09 2025] exit_to_user_mode_loop+0xd6/0xe0
> [Sat Aug 23 03:56:09 2025] do_syscall_64+0x1c1/0x1e0
> [Sat Aug 23 03:56:09 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Phillip, is this behavior perhaps introduced by commit 5ec9d26b78c4
("cdrom: Call cdrom_mrw_exit from cdrom_release function")? Please do
not call code that invokes ioctls from the disk_release() callback.
Thanks,
Bart.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] general protection fault when connecting an old mp3/usb device
2025-08-19 19:20 ` Bart Van Assche
@ 2025-08-20 1:38 ` David Wang
2025-08-20 10:02 ` David Wang
1 sibling, 0 replies; 5+ messages in thread
From: David Wang @ 2025-08-20 1:38 UTC (permalink / raw)
To: Bart Van Assche
Cc: phil, linux-scsi, linux-kernel, James.Bottomley, martin.petersen
At 2025-08-20 03:20:51, "Bart Van Assche" <bvanassche@acm.org> wrote:
>On 8/18/25 2:50 AM, David Wang wrote:
>> [Sat Aug 23 03:56:09 2025] Oops: general protection fault, probably for non-canonical address 0x2e2e2f2e2e2f308e: 0000 [#1] SMP NOPTI
>> [Sat Aug 23 03:56:09 2025] Call Trace:
>> [Sat Aug 23 03:56:09 2025] <TASK>
>> [Sat Aug 23 03:56:09 2025] sr_do_ioctl+0x5b/0x1c0 [sr_mod]
>> [Sat Aug 23 03:56:09 2025] sr_packet+0x2c/0x50 [sr_mod]
>> [Sat Aug 23 03:56:09 2025] cdrom_get_disc_info+0x60/0xe0 [cdrom]
>> [Sat Aug 23 03:56:09 2025] cdrom_mrw_exit+0x29/0xb0 [cdrom]
>> [Sat Aug 23 03:56:09 2025] ? xa_destroy+0xaa/0x120
>> [Sat Aug 23 03:56:09 2025] unregister_cdrom+0x76/0xc0 [cdrom]
>> [Sat Aug 23 03:56:09 2025] sr_free_disk+0x44/0x50 [sr_mod]
>> [Sat Aug 23 03:56:09 2025] disk_release+0xb0/0xe0
>> [Sat Aug 23 03:56:09 2025] device_release+0x37/0x90
>> [Sat Aug 23 03:56:09 2025] kobject_put+0x8e/0x1d0
>> [Sat Aug 23 03:56:09 2025] blkdev_release+0x11/0x20
>> [Sat Aug 23 03:56:09 2025] __fput+0xe3/0x2a0
>> [Sat Aug 23 03:56:09 2025] task_work_run+0x59/0x90
>> [Sat Aug 23 03:56:09 2025] exit_to_user_mode_loop+0xd6/0xe0
>> [Sat Aug 23 03:56:09 2025] do_syscall_64+0x1c1/0x1e0
>> [Sat Aug 23 03:56:09 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
>Phillip, is this behavior perhaps introduced by commit 5ec9d26b78c4
>("cdrom: Call cdrom_mrw_exit from cdrom_release function")? Please do
I caught this on 6.16.0 which does not have this commit, and on the contrary, base
on the commit message, this commit may help in the positive direction.
I will try to figure out a procedure to reproduce this on my laptop, and if that possible,
I will upgrade my laptop to 6.17-rc1 to give it a trial.
And update later.
Thanks
David
>not call code that invokes ioctls from the disk_release() callback.
>
>Thanks,
>
>Bart.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] general protection fault when connecting an old mp3/usb device
2025-08-19 19:20 ` Bart Van Assche
2025-08-20 1:38 ` David Wang
@ 2025-08-20 10:02 ` David Wang
2025-08-20 20:06 ` Phillip Potter
1 sibling, 1 reply; 5+ messages in thread
From: David Wang @ 2025-08-20 10:02 UTC (permalink / raw)
To: Bart Van Assche, phil
Cc: linux-scsi, linux-kernel, James.Bottomley, martin.petersen
>Phillip, is this behavior perhaps introduced by commit 5ec9d26b78c4
>("cdrom: Call cdrom_mrw_exit from cdrom_release function")? Please do
I manage to reproduce this, but It turns out this is not about my old mp3 device, but about my phone:
Just connect-umount-discnnect, and repeat, after several rounds, an error log would show up.
(I should pay attention to the USB Product name in log......
It is just that I check the log only when I have trouble connecting my mp3 device, and assuming the log is about my mp3 device.)
But I cannot reproduce the address pattern 0x2e2e2f2e2e2f2e2e, this time all I got is NULL:
[Tue Aug 26 00:15:00 2025] usb 1-5: USB disconnect, device number 94
[Tue Aug 26 00:15:01 2025] usb 1-5: new high-speed USB device number 95 using xhci_hcd
[Tue Aug 26 00:15:04 2025] usb 1-5: new high-speed USB device number 96 using xhci_hcd
[Tue Aug 26 00:15:04 2025] usb 1-5: New USB device found, idVendor=12d1, idProduct=1082, bcdDevice= 3.18
[Tue Aug 26 00:15:04 2025] usb 1-5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[Tue Aug 26 00:15:04 2025] usb 1-5: Product: ATU-AL10
[Tue Aug 26 00:15:04 2025] usb 1-5: Manufacturer: HUAWEI
[Tue Aug 26 00:15:04 2025] usb 1-5: SerialNumber: TPE9X18915C02308
[Tue Aug 26 00:15:04 2025] usb-storage 1-5:1.1: USB Mass Storage device detected
[Tue Aug 26 00:15:04 2025] scsi host2: usb-storage 1-5:1.1
[Tue Aug 26 00:15:05 2025] scsi 2:0:0:0: CD-ROM Linux File-CD Gadget 0318 PQ: 0 ANSI: 2
[Tue Aug 26 00:15:05 2025] sr 2:0:0:0: Power-on or device reset occurred
[Tue Aug 26 00:15:05 2025] sr 2:0:0:0: [sr0] scsi3-mmc drive: 0x/0x caddy
[Tue Aug 26 00:15:05 2025] sr 2:0:0:0: Attached scsi CD-ROM sr0
[Tue Aug 26 00:15:05 2025] sr 2:0:0:0: Attached scsi generic sg0 type 5
[Tue Aug 26 00:15:05 2025] /dev/sr0: Can't open blockdev
[Tue Aug 26 00:15:05 2025] ISO 9660 Extensions: Microsoft Joliet Level 1
[Tue Aug 26 00:15:05 2025] ISOFS: changing to secondary root
[Tue Aug 26 00:15:06 2025] usb 1-5: USB disconnect, device number 96
[Tue Aug 26 00:15:06 2025] BUG: kernel NULL pointer dereference, address: 0000000000000260
[Tue Aug 26 00:15:06 2025] #PF: supervisor read access in kernel mode
[Tue Aug 26 00:15:06 2025] #PF: error_code(0x0000) - not-present page
[Tue Aug 26 00:15:06 2025] PGD 0 P4D 0
[Tue Aug 26 00:15:06 2025] Oops: Oops: 0000 [#4] SMP NOPTI
[Tue Aug 26 00:15:06 2025] CPU: 0 UID: 0 PID: 886295 Comm: umount Tainted: G D 6.16.0-linan-0 #50 PREEMPT(voluntary)
[Tue Aug 26 00:15:06 2025] Tainted: [D]=DIE
[Tue Aug 26 00:15:06 2025] Hardware name: Acer S40-53/Lily_TL, BIOS V1.01 08/28/2020
[Tue Aug 26 00:15:06 2025] RIP: 0010:scsi_block_when_processing_errors+0x27/0xf0 [scsi_mod]
[Tue Aug 26 00:15:06 2025] Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 53 48 83 ec 30 65 48 8b 1d 61 b1 13 f0 48 89 5c 24 28 48 89 fb e8 2c 73 cd ee 48 8b 13 <8b> 82 60 02 00 00 83 e8 05 83 f8 02 76 09 f6 82 20 02 00 00 10 74
[Tue Aug 26 00:15:06 2025] RSP: 0018:ffffaff309d47c70 EFLAGS: 00010246
[Tue Aug 26 00:15:06 2025] RAX: 0000000000000000 RBX: ffff920601613000 RCX: 0000000000000000
[Tue Aug 26 00:15:06 2025] RDX: 0000000000000000 RSI: ffffaff309d47d40 RDI: ffff920601613000
[Tue Aug 26 00:15:06 2025] RBP: ffff920601613000 R08: ffffaff309d47db4 R09: 0000000000000004
[Tue Aug 26 00:15:06 2025] R10: ffffaff309d47db4 R11: ffffffffb06dff80 R12: ffffaff309d47cc0
[Tue Aug 26 00:15:06 2025] R13: ffff92055577d400 R14: 0000000000000000 R15: ffffaff309d47d40
[Tue Aug 26 00:15:06 2025] FS: 00007f5fb1d2e840(0000) GS:ffff92092fb60000(0000) knlGS:0000000000000000
[Tue Aug 26 00:15:06 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Tue Aug 26 00:15:06 2025] CR2: 0000000000000260 CR3: 000000015eb7c004 CR4: 0000000000f72ef0
[Tue Aug 26 00:15:06 2025] PKRU: 55555554
[Tue Aug 26 00:15:06 2025] Call Trace:
[Tue Aug 26 00:15:06 2025] <TASK>
[Tue Aug 26 00:15:06 2025] sr_do_ioctl+0x5b/0x1c0 [sr_mod]
[Tue Aug 26 00:15:06 2025] sr_packet+0x2c/0x50 [sr_mod]
[Tue Aug 26 00:15:06 2025] cdrom_get_disc_info+0x60/0xe0 [cdrom]
[Tue Aug 26 00:15:06 2025] cdrom_mrw_exit+0x29/0xb0 [cdrom]
[Tue Aug 26 00:15:06 2025] ? xa_destroy+0xaa/0x120
[Tue Aug 26 00:15:06 2025] unregister_cdrom+0x76/0xc0 [cdrom]
[Tue Aug 26 00:15:06 2025] sr_free_disk+0x44/0x50 [sr_mod]
[Tue Aug 26 00:15:06 2025] disk_release+0xb0/0xe0
[Tue Aug 26 00:15:06 2025] device_release+0x37/0x90
[Tue Aug 26 00:15:06 2025] kobject_put+0x8e/0x1d0
[Tue Aug 26 00:15:06 2025] blkdev_release+0x11/0x20
[Tue Aug 26 00:15:06 2025] __fput+0xe3/0x2a0
[Tue Aug 26 00:15:06 2025] task_work_run+0x59/0x90
[Tue Aug 26 00:15:06 2025] exit_to_user_mode_loop+0xd6/0xe0
[Tue Aug 26 00:15:06 2025] do_syscall_64+0x1c1/0x1e0
[Tue Aug 26 00:15:06 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[Tue Aug 26 00:15:06 2025] RIP: 0033:0x7f5fb1f5ab37
And after I upgrade to 6.17-rc1, it could not be reproduced ( I managed to test 10+ rounds of connect/umount/disconnect cycle)
So I think commit 5ec9d26b78c4 does fix my problem.
Thanks
David
>Bart.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] general protection fault when connecting an old mp3/usb device
2025-08-20 10:02 ` David Wang
@ 2025-08-20 20:06 ` Phillip Potter
0 siblings, 0 replies; 5+ messages in thread
From: Phillip Potter @ 2025-08-20 20:06 UTC (permalink / raw)
To: David Wang
Cc: Bart Van Assche, phil, linux-scsi, linux-kernel, James.Bottomley,
martin.petersen
On Wed, Aug 20, 2025 at 06:02:05PM +0800, David Wang wrote:
>
> >Phillip, is this behavior perhaps introduced by commit 5ec9d26b78c4
> >("cdrom: Call cdrom_mrw_exit from cdrom_release function")? Please do
>
> I manage to reproduce this, but It turns out this is not about my old mp3 device, but about my phone:
> Just connect-umount-discnnect, and repeat, after several rounds, an error log would show up.
> (I should pay attention to the USB Product name in log......
> It is just that I check the log only when I have trouble connecting my mp3 device, and assuming the log is about my mp3 device.)
>
Interesting. It seems your phone is emulating a CD-ROM/optical device,
which is why the driver is being loaded and attached to it.
>
>
> And after I upgrade to 6.17-rc1, it could not be reproduced ( I managed to test 10+ rounds of connect/umount/disconnect cycle)
> So I think commit 5ec9d26b78c4 does fix my problem.
>
> Thanks
> David
>
> >Bart.
Yes, as you point out, this commit became part of 6.17-rc1 - it was not
present in 6.16.0. It actually removes the cdrom_mrw_exit call from the
module unregistration function, and puts it in cdrom_release instead.
This seems to have helped with the original issue - that of crashes when
removing USB optical drives on Chromebooks, and has likely helped here
for the same reason. Good to hear, and thanks for testing/confirming
that 6.17-rc1 has helped.
Regards,
Phil
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-08-20 20:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-18 9:50 [BUG] general protection fault when connecting an old mp3/usb device David Wang
2025-08-19 19:20 ` Bart Van Assche
2025-08-20 1:38 ` David Wang
2025-08-20 10:02 ` David Wang
2025-08-20 20:06 ` Phillip Potter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox