Re: [PATCH 6.18 000/614] 6.18.2-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
> Hi
> 
> no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only* when
> running GPU driver i915.
> 
> with GPU driver xe I get here:
> 
> [   14.391631] rfkill: input handler disabled
> [   14.787149] ------------[ cut here ]------------
> [   14.787153] refcount_t: underflow; use-after-free.
> [   14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28
> refcount_warn_saturate+0xbe/0x110
> [   14.787174] Modules linked in: vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE)
> rfcomm nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet
> nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4
> nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack
> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables bnep iwlmvm mac80211 mei_hdcp
> mei_pxp btusb kvm_intel btintel iwlwifi bluetooth kvm cfg80211 ecdh_generic
> irqbypass mei_me wmi_bmof mei nfnetlink xe intel_vsec drm_suballoc_helper
> gpu_sched drm_gpuvm drm_exec i915 i2c_algo_bit drm_buddy drm_display_helper
> video wmi
> [   14.787203] CPU: 10 UID: 60578 PID: 2463 Comm: pool-8 Tainted: G U     OE
> 6.18.2-rc1_MY #1 PREEMPT(lazy)
> [   14.787205] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [   14.787206] Hardware name: ASUS System Product Name/ROG STRIX B560-G
> GAMING WIFI, BIOS 2302 11/13/2024
> [   14.787207] RIP: 0010:refcount_warn_saturate+0xbe/0x110
> [   14.787210] Code: 02 01 e8 05 de 52 ff 0f 0b e9 7e ba a1 00 80 3d 8d 16
> 41 02 00 75 85 48 c7 c7 00 d5 f5 9e c6 05 7d 16 41 02 01 e8 e2 dd 52 ff <0f>
> 0b e9 5b ba a1 00 80 3d 6b 16 41 02 00 0f 85 5e ff ff ff 48 c7
> [   14.787211] RSP: 0018:ffffa0ba88dbf918 EFLAGS: 00010246
> [   14.787213] RAX: 0000000000000000 RBX: ffff900804a13800 RCX:
> 0000000000000027
> [   14.787214] RDX: ffff900b4f917a88 RSI: 0000000000000001 RDI:
> ffff900b4f917a80
> [   14.787215] RBP: ffff90082578c000 R08: 0000000000000000 R09:
> ffffa0ba88dbf7b0
> [   14.787215] R10: ffffffff9fb451e8 R11: ffffffff9fa951e0 R12:
> 0000000000000000
> [   14.787216] R13: ffffa0ba88dbf970 R14: ffff9008213f0218 R15:
> 0000000000000000
> [   14.787217] FS:  0000000000000000(0000) GS:ffff900baedd9000(0000)
> knlGS:0000000000000000
> [   14.787218] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   14.787219] CR2: 00007fc6a725fed0 CR3: 000000011f3c5001 CR4:
> 0000000000770ef0
> [   14.787220] PKRU: 55555554
> [   14.787220] Call Trace:
> [   14.787222]  <TASK>
> [   14.787224]  xe_exec_queue_destroy+0x165/0x1a0 [xe]
> [   14.787326]  xe_vm_close_and_put+0x1e3/0x950 [xe]
> [   14.787414]  xe_file_close+0x108/0x1e0 [xe]
> [   14.787463]  drm_file_free+0x238/0x2a0
> [   14.787466]  drm_release_noglobal+0x78/0xc0
> [   14.787468]  __fput+0xe6/0x2a0
> [   14.787471]  task_work_run+0x5d/0x90
> [   14.787473]  do_exit+0x273/0xa60
> [   14.787476]  ? timerqueue_del+0x2e/0x60
> [   14.787478]  ? __remove_hrtimer+0x41/0xb0
> [   14.787480]  do_group_exit+0x2e/0xb0
> [   14.787482]  ? hrtimer_cancel+0x21/0x40
> [   14.787484]  get_signal+0x8b0/0x8f0
> [   14.787485]  arch_do_signal_or_restart+0x8d/0x2a0
> [   14.787489]  exit_to_user_mode_loop+0x80/0x170
> [   14.787492]  do_syscall_64+0x1c5/0xfa0
> [   14.787494]  ? __pfx_hrtimer_wakeup+0x10/0x10
> [   14.787496]  ? __rseq_handle_notify_resume+0xa4/0x4d0
> [   14.787499]  ? switch_fpu_return+0x4e/0xd0
> [   14.787501]  ? do_syscall_64+0x1f8/0xfa0
> [   14.787503]  ? __rseq_handle_notify_resume+0xa4/0x4d0
> [   14.787504]  ? f_dupfd+0x62/0xa0
> [   14.787506]  ? switch_fpu_return+0x4e/0xd0
> [   14.787507]  ? do_syscall_64+0x1f8/0xfa0
> [   14.787509]  ? __x64_sys_fcntl+0x96/0x110
> [   14.787512]  ? do_syscall_64+0x7c/0xfa0
> [   14.787514]  ? flush_tlb_func+0x119/0x380
> [   14.787516]  ? sched_clock+0x10/0x30
> [   14.787518]  ? sched_clock_cpu+0xf/0x230
> [   14.787520]  ? __flush_smp_call_function_queue+0xae/0x410
> [   14.787522]  ? sched_clock_cpu+0xf/0x230
> [   14.787523]  ? irqtime_account_irq+0x3c/0xc0
> [   14.787525]  ? clear_bhb_loop+0x40/0x90
> [   14.787527]  ? clear_bhb_loop+0x40/0x90
> [   14.787528]  ? clear_bhb_loop+0x40/0x90
> [   14.787529]  ? clear_bhb_loop+0x40/0x90
> [   14.787530]  entry_SYSCALL_64_after_hwframe+0x71/0x79
> [   14.787532] RIP: 0033:0x7fa07a4ff34d
> [   14.787540] Code: Unable to access opcode bytes at 0x7fa07a4ff323.
> [   14.787541] RSP: 002b:00007f9f8bffe478 EFLAGS: 00000246 ORIG_RAX:
> 00000000000000ca
> [   14.787543] RAX: fffffffffffffdfc RBX: 0000000000000001 RCX:
> 00007fa07a4ff34d
> [   14.787544] RDX: 0000000000000002 RSI: 0000000000000080 RDI:
> 000055c50d821a20
> [   14.787544] RBP: 00007f9f8bffe4e0 R08: 00007fa07b3c7000 R09:
> 000000000000000e
> [   14.787545] R10: 00007f9f8bffe4a0 R11: 0000000000000246 R12:
> 00000000018ae951
> [   14.787546] R13: 0000000000000001 R14: 0000000000000002 R15:
> 000055c50d821a10
> [   14.787548]  </TASK>
> [   14.787548] ---[ end trace 0000000000000000 ]---
> 
> ====
> 
> If I did the bisect correct, bisect-log:
> 
> # status: waiting for both good and bad commits
> # good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
> git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
> # status: waiting for bad commit, 1 good commit known
> # bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
> git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
> # bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL pointer
> dereference in crashstate_get_vm_logs()
> git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd

Is this also an issue with 6.19-rc1?  Are we missing something here?

thanks,

greg k-h