Package: src:linux Version: 6.1.180-1 Severity: important Tags: patch upstream Control: found -1 6.1.190-1 X-Debbugs-Cc: [email protected]
Dear Maintainer, since linux-image-6.1.0-52-amd64 (6.1.180-1) our SAN-booted servers with Emulex FC HBAs fail to boot. 6.1.0-51 (6.1.177-1) boots reliably on the same machines. 6.12.115+deb13.1 (trixie) works. A note on how this report was produced: the crashes, the version history, the kernel logs and the gdb output below are real and were observed or captured by me on our machines. The analysis of these data (reading the logs, comparing the kernel sources, identifying the commit and writing the patch) was done with the help of an AI assistant (Claude, by Anthropic). I have checked it for plausibility, but I cannot guarantee that the analysis is correct. The patch is not build-tested and not runtime-tested. 1. Observations Hardware: Fujitsu PRIMERGY RX2530 M7 (D3982-A1), BIOS V1.0.0.0 R2.13.0 06/12/2026 1x Intel Xeon Gold 5415+, 768 GiB RAM Emulex LPe31000/LPe32000 series FC HBA, 2 ports, boot from SAN (Dell PowerStore, dm-multipath) lspci -nn (full output attached):16:00.0 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01) 16:00.1 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01)
HBA firmware (/sys/class/scsi_host/host*/fwrev):
14.4.393.25, sli-4:2:c
14.4.393.25, sli-4:2:c
lpfc module options: lpfc_lun_queue_depth=64
Version history on the affected node (from dpkg.log and kern.log):
6.1.177-1 (6.1.0-51): boots fine (all boots in October 2026)
6.1.180-1 (6.1.0-52): fails to boot (first installed 2026-08-06,
removed one hour later)
6.1.190-1 (6.1.0-54): fails the same way (crash in the slab allocator
during lpfc_sli4_enable_intr)
A few seconds after /init starts, while lpfc probes the HBA in the
initramfs, the kernel crashes. Boot of 6.1.180-1 with slub_debug=FZPU
(full log attached, see below):
lpfc 0000:16:00.0: 0:2574 IO channels: hdwQ 8 IRQ 8 MRQ: 0
BUG kmalloc-512 (Not tainted): Poison overwritten
0xff35a2b750cf6e00-0xff35a2b750cf6f57 @offset=28160. First byte 0x0
instead of 0x6b
Allocated in mempool_alloc+0x82/0x1b0 age=7 cpu=0 pid=150 __kmalloc+0x49/0x150 mempool_alloc+0x82/0x1b0 lpfc_pci_probe_one+0xef6/0x17c0 [lpfc] Freed in lpfc_pci_probe_one+0xf9b/0x17c0 [lpfc] age=7 cpu=0 pid=150 ...CPU: 0 PID: 150 Comm: kworker/0:2 Not tainted 6.1.0-52-amd64 #1 Debian 6.1.180-1
Call Trace: check_object+0x22b/0x280 alloc_debug_processing+0xa8/0x120 ... kmalloc_node_trace+0x23/0x90 alloc_desc+0x35/0x250 ... pci_alloc_irq_vectors_affinity+0xa9/0x110 lpfc_sli4_enable_intr+0x2b8/0xa60 [lpfc] lpfc_pci_probe_one.cold+0x9c8/0x1173 [lpfc] ...list_del corruption, ffd525d181433c08->next is LIST_POISON1 (dead000000000100)
kernel BUG at lib/list_debug.c:53! invalid opcode: 0000 [#1] PREEMPT SMP NOPTICPU: 13 PID: 402 Comm: (udev-worker) Tainted: G B 6.1.0-52-amd64 #1 Debian 6.1.180-1
RIP: 0010:__list_del_entry_valid.cold+0x5c/0x6f
Call Trace:
free_to_partial_list+0x437/0x4f0
__free_slab+0x82/0x1a0
...
Kernel panic - not syncing: Fatal exception
gdb with lpfc.ko from linux-image-6.1.0-52-amd64-dbg (6.1.180-1):
0x54866 is in lpfc_pci_probe_one (drivers/scsi/lpfc/lpfc_init.c:8109).
0x5490b is in lpfc_pci_probe_one (drivers/scsi/lpfc/lpfc_init.c:8180).
The failure was first seen on bookworm in August 2026. The log above
was captured later on the same machine after the upgrade to trixie,
booting the bookworm kernel package (dracut initramfs, efi_pstore
loaded early).
2. Analysis (AI-assisted, see note above)
Both lines are in lpfc_sli4_driver_resource_setup(). In v6.1.180,
mempool_free(mboxq) (line 8178) comes before
lpfc_get_sli4_parameters(phba, mboxq) (line 8187), which still uses
mboxq: a use-after-free. The error paths after it free mboxq a second
time. The overwritten data in the SLUB report starts with a 16-byte
list_head followed by command byte 0x9B (MBX_SLI4_CONFIG), which fits
the SLI4_CONFIG mailbox issued by lpfc_get_sli4_parameters().
The only change to lpfc_init.c between v6.1.177 and v6.1.180 is the
6.1.y backport of upstream commit 1bd28625e25b ("scsi: lpfc: Fix memory
leak in lpfc_sli4_driver_resource_setup()", stable commit 299f5baa1321,
CVE-2026-72087). In mainline and 6.12.y the free is placed after the
lpfc_get_sli4_parameters() error handling. In 6.1.y the hunk apparently
applied at an identical-looking context about 35 lines too early.
v6.1.190 is unchanged at this spot.
The attached patch moves the free behind the error handling, as in
mainline. It uses 12 lines of context so that it cannot land at the
wrong place again. It applies with patch --fuzz=0 to v6.1.180 and
v6.1.190. It is not build-tested and not runtime-tested.
Attachments:
lpfc-6.1-mboxq-uaf-fix.patch
lspci-nn.txt: full output of lspci -nn
pstore-6.1.0-52.tar.xz: the kernel log of the 6.1.180-1 test boot with
slub_debug=FZPU, as written to efi-pstore by the crashing kernel and
archived by systemd-pstore at the next boot. Two dumps:
Oops#1 = 1793893400/001 (parts 18-4) followed by 1793893399/001
(parts 3-1, newest), Panic#2 = 1793893403/002 followed by
1793893402/002. The directory names are the write times of the
individual parts.
Regards,
Th. Schlichting
pstore-6.1.0-52.tar.xz
Description: application/xz
00:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 00:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 00:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 00:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 00:14.0 USB controller [0c03]: Intel Corporation Emmitsburg (C740 Family) USB 3.2 Gen 1 xHCI Controller [8086:1bcd] (rev 11) 00:14.2 RAM memory [0500]: Intel Corporation Device [8086:1bce] (rev 11) 00:14.4 Host bridge [0600]: Intel Corporation Device [8086:1bfe] (rev 11) 00:15.0 System peripheral [0880]: Intel Corporation Device [8086:1bff] (rev 11) 00:16.0 Communication controller [0780]: Intel Corporation Device [8086:1be0] (rev 11) 00:16.1 Communication controller [0780]: Intel Corporation Device [8086:1be1] (rev 11) 00:16.4 Communication controller [0780]: Intel Corporation Device [8086:1be4] (rev 11) 00:17.0 SATA controller [0106]: Intel Corporation C740 Series (Emmitsburg) Chipsets SATA0 Controller (AHCI) [8086:1ba2] (rev 11) 00:19.0 SATA controller [0106]: Intel Corporation Sapphire Rapids SATA AHCI Controller [8086:1bd2] (rev 11) 00:1b.0 PCI bridge [0604]: Intel Corporation C740 Series (Emmitsburg) Chipsets PCI Express Root Port [8086:1bb5] (rev 11) 00:1f.0 ISA bridge [0601]: Intel Corporation C740 Series (Emmitsburg) Chipsets eSPI Controller [8086:1b81] (rev 11) 00:1f.4 SMBus [0c05]: Intel Corporation C740 Series (Emmitsburg) Chipsets SMBus [8086:1bc9] (rev 11) 00:1f.5 Serial bus controller [0c80]: Intel Corporation Device [8086:1bca] (rev 11) 01:00.0 PCI bridge [0604]: ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge [1a03:1150] (rev 06) 02:00.0 VGA compatible controller [0300]: ASPEED Technology, Inc. ASPEED Graphics Family [1a03:2000] (rev 52) 02:01.0 Co-processor [0b40]: ASPEED Technology, Inc. Device [1a03:2402] 15:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 15:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 15:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 15:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 15:01.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port A [8086:352a] (rev 04) 16:00.0 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01) 16:00.1 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01) 22:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 22:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 22:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 22:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 22:01.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port A [8086:352a] (rev 04) 23:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GBASE-T [8086:15ff] (rev 02) 23:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GBASE-T [8086:15ff] (rev 02) 2f:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 2f:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 2f:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 2f:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 2f:01.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port A [8086:352a] (rev 04) 30:00.0 Ethernet controller [0200]: Intel Corporation I350 Gigabit Network Connection [8086:1521] (rev 01) 30:00.1 Ethernet controller [0200]: Intel Corporation I350 Gigabit Network Connection [8086:1521] (rev 01) 30:00.2 Ethernet controller [0200]: Intel Corporation I350 Gigabit Network Connection [8086:1521] (rev 01) 30:00.3 Ethernet controller [0200]: Intel Corporation I350 Gigabit Network Connection [8086:1521] (rev 01) 3c:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 3c:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 3c:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 3c:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 49:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) 49:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) 49:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) 49:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] 49:01.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port A [8086:352a] (rev 04) 49:03.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port B [8086:352b] (rev 04) 49:05.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port C [8086:352c] (rev 04) 49:07.0 PCI bridge [0604]: Intel Corporation PCI Express Gen5 Port D [8086:352d] (rev 04) f2:00.0 System peripheral [0880]: Intel Corporation Ice Lake Memory Map/VT-d [8086:09a2] (rev 20) f2:00.1 System peripheral [0880]: Intel Corporation Ice Lake Mesh 2 PCIe [8086:09a4] (rev 20) f2:00.2 System peripheral [0880]: Intel Corporation Ice Lake RAS [8086:09a3] (rev 20) f2:00.4 Root Complex Event Collector [0807]: Intel Corporation Xeon Root Event Collector [8086:0b23] f2:01.0 System peripheral [0880]: Intel Corporation Data Streaming Accelerator (DSA) [8086:0b25] f2:02.0 System peripheral [0880]: Intel Corporation In-Memory Analytics Accelerator (IAA) [8086:0cfe] f2:03.0 System peripheral [0880]: Intel Corporation Ice Lake MSM [8086:09a6] f2:03.1 System peripheral [0880]: Intel Corporation Ice Lake PMON MSM [8086:09a7] f3:00.0 Co-processor [0b40]: Intel Corporation 401xx Series QAT [8086:4942] (rev 40) f5:00.0 Co-processor [0b40]: Intel Corporation Dynamic Load Balancer 2.0 (DLB) [8086:2710] fe:00.0 System peripheral [0880]: Intel Corporation Device [8086:3250] fe:00.1 System peripheral [0880]: Intel Corporation Device [8086:3251] fe:00.2 System peripheral [0880]: Intel Corporation Device [8086:3252] fe:00.3 Host bridge [0600]: Intel Corporation Ice Lake IEH [8086:0998] fe:00.5 System peripheral [0880]: Intel Corporation Device [8086:3255] fe:01.0 System peripheral [0880]: Intel Corporation Device [8086:3240] fe:01.1 System peripheral [0880]: Intel Corporation Device [8086:3241] fe:01.2 System peripheral [0880]: Intel Corporation Device [8086:3242] fe:02.0 System peripheral [0880]: Intel Corporation Device [8086:3240] fe:02.1 System peripheral [0880]: Intel Corporation Device [8086:3241] fe:02.2 System peripheral [0880]: Intel Corporation Device [8086:3242] fe:03.0 System peripheral [0880]: Intel Corporation Device [8086:3240] fe:03.1 System peripheral [0880]: Intel Corporation Device [8086:3241] fe:03.2 System peripheral [0880]: Intel Corporation Device [8086:3242] fe:05.0 System peripheral [0880]: Intel Corporation Xeon UPI Mesh Stop M2UPI Registers [8086:3245] fe:05.1 System peripheral [0880]: Intel Corporation Device [8086:3246] fe:05.2 System peripheral [0880]: Intel Corporation Device [8086:3247] fe:06.0 System peripheral [0880]: Intel Corporation Xeon UPI Mesh Stop M2UPI Registers [8086:3245] fe:06.1 System peripheral [0880]: Intel Corporation Device [8086:3246] fe:06.2 System peripheral [0880]: Intel Corporation Device [8086:3247] fe:07.0 System peripheral [0880]: Intel Corporation Xeon UPI Mesh Stop M2UPI Registers [8086:3245] fe:07.1 System peripheral [0880]: Intel Corporation Device [8086:3246] fe:07.2 System peripheral [0880]: Intel Corporation Device [8086:3247] fe:0c.0 Performance counters [1101]: Intel Corporation Xeon IMC0 Mesh to Mem Registers [8086:324a] fe:0d.0 Performance counters [1101]: Intel Corporation Xeon IMC0 Mesh to Mem Registers [8086:324a] fe:0e.0 Performance counters [1101]: Intel Corporation Xeon IMC0 Mesh to Mem Registers [8086:324a] fe:0f.0 Performance counters [1101]: Intel Corporation Xeon IMC0 Mesh to Mem Registers [8086:324a] fe:1a.0 Performance counters [1101]: Intel Corporation Ice Lake DDRIO Registers [8086:2880] fe:1b.0 Performance counters [1101]: Intel Corporation Ice Lake DDRIO Registers [8086:2880] fe:1c.0 Performance counters [1101]: Intel Corporation Ice Lake DDRIO Registers [8086:2880] fe:1d.0 Performance counters [1101]: Intel Corporation Ice Lake DDRIO Registers [8086:2880] ff:00.0 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.1 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.2 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.3 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.4 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.5 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.6 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:00.7 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:01.0 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:01.1 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:01.2 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:01.3 System peripheral [0880]: Intel Corporation Xeon Unicast Group1 CHA Registers [8086:324c] ff:0a.0 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.1 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.2 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.3 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.4 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.5 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.6 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0a.7 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0b.0 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0b.1 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0b.2 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:0b.3 System peripheral [0880]: Intel Corporation Xeon Unicast Group0 CHA Registers [8086:324d] ff:1d.0 System peripheral [0880]: Intel Corporation Ice Lake CHA Registers [8086:344f] ff:1d.1 System peripheral [0880]: Intel Corporation Ice Lake CHA Registers [8086:3457] ff:1e.0 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR0 [8086:3258] (rev 08) ff:1e.1 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR1 [8086:3259] (rev 08) ff:1e.2 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR2 [8086:325a] (rev 08) ff:1e.3 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR3 [8086:325b] (rev 08) ff:1e.4 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR4 [8086:325c] (rev 08) ff:1e.5 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR5 [8086:325d] (rev 08) ff:1e.6 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR6 [8086:325e] (rev 08) ff:1e.7 System peripheral [0880]: Intel Corporation Power Control Unit (PCU) CR7 [8086:325f] (rev 08)
lpfc: 6.1.y backport of 1bd28625e25b frees mboxq before its last use
The 6.1.y backport of upstream commit 1bd28625e25b ("scsi: lpfc: Fix
memory leak in lpfc_sli4_driver_resource_setup()") placed
mempool_free(mboxq) before lpfc_get_sli4_parameters(phba, mboxq), which
still uses mboxq. Move it behind the lpfc_get_sli4_parameters() error
handling, as in mainline. Against v6.1.180 (identical in v6.1.190).
Not build-tested, not runtime-tested. Only checked that it applies with
patch --fuzz=0 to v6.1.180 and v6.1.190 and gives the intended result.
Assisted-by: Claude:claude-opus-5-5
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -8166,25 +8166,24 @@
phba->cfg_xri_rebalancing = 0;
if (phba->irq_chann_mode == NHT_MODE) {
phba->cfg_irq_chann =
phba->sli4_hba.num_present_cpu;
phba->cfg_hdw_queue =
phba->sli4_hba.num_present_cpu;
phba->irq_chann_mode = NORMAL_MODE;
}
break;
}
}
}
- mempool_free(mboxq, phba->mbox_mem_pool);
lpfc_nvme_mod_param_dep(phba);
/*
* Get sli4 parameters that override parameters from Port capabilities.
* If this call fails, it isn't critical unless the SLI4 parameters come
* back in conflict.
*/
rc = lpfc_get_sli4_parameters(phba, mboxq);
if (rc) {
if_type = bf_get(lpfc_sli_intf_if_type,
&phba->sli4_hba.sli_intf);
@@ -8200,24 +8199,25 @@
mempool_free(mboxq, phba->mbox_mem_pool);
rc = -EIO;
goto out_free_bsmbx;
}
}
if (!(if_type == LPFC_SLI_INTF_IF_TYPE_0 &&
if_fam == LPFC_SLI_INTF_FAMILY_BE2)) {
mempool_free(mboxq, phba->mbox_mem_pool);
rc = -EIO;
goto out_free_bsmbx;
}
}
+ mempool_free(mboxq, phba->mbox_mem_pool);
/*
* 1 for cmd, 1 for rsp, NVME adds an extra one
* for boundary conditions in its max_sgl_segment template.
*/
extra = 2;
if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME)
extra++;
/*
* It doesn't matter what family our adapter is in, we are
* limited to 2 Pages, 512 SGEs, for our SGL.
