[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-mtk/5.15.0-1030.34 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-done-jammy- linux-mtk'. If the problem still exists, change the tag 'verification- needed-jammy-linux-mtk' to 'verification-failed-jammy-linux-mtk'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-mtk-v2 verification-needed-jammy-linux-mtk -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-xilinx- zynqmp/5.15.0-1025.29 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-xilinx-zynqmp' to 'verification-done-jammy-linux-xilinx-zynqmp'. If the problem still exists, change the tag 'verification-needed-jammy-linux-xilinx-zynqmp' to 'verification-failed-jammy-linux-xilinx-zynqmp'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-xilinx-zynqmp-v2 verification-needed-jammy-linux-xilinx-zynqmp -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-gcp-tcpx/5.15.0-1002.2 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-gcp-tcpx' to 'verification-done- focal-linux-gcp-tcpx'. If the problem still exists, change the tag 'verification-needed-focal-linux-gcp-tcpx' to 'verification-failed- focal-linux-gcp-tcpx'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-focal-linux-gcp-tcpx-v2 verification-needed-focal-linux-gcp-tcpx -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-nvidia- tegra-5.15/5.15.0-1018.18~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux- nvidia-tegra-5.15' to 'verification-done-focal-linux-nvidia-tegra-5.15'. If the problem still exists, change the tag 'verification-needed-focal- linux-nvidia-tegra-5.15' to 'verification-failed-focal-linux-nvidia- tegra-5.15'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-focal-linux-nvidia-tegra-5.15-v2 verification-needed-focal-linux-nvidia-tegra-5.15 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-nvidia-tegra- igx/5.15.0-1005.5 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-nvidia-tegra- igx' to 'verification-done-jammy-linux-nvidia-tegra-igx'. If the problem still exists, change the tag 'verification-needed-jammy-linux-nvidia- tegra-igx' to 'verification-failed-jammy-linux-nvidia-tegra-igx'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-nvidia-tegra-igx-v2 verification-needed-jammy-linux-nvidia-tegra-igx -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-intel- iotg-5.15/5.15.0-1043.49~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux- intel-iotg-5.15' to 'verification-done-focal-linux-intel-iotg-5.15'. If the problem still exists, change the tag 'verification-needed-focal- linux-intel-iotg-5.15' to 'verification-failed-focal-linux-intel- iotg-5.15'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-focal-linux-intel-iotg-5.15-v2 verification-needed-focal-linux-intel-iotg-5.15 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux- bluefield/5.15.0-1027.29 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-bluefield' to 'verification-done-jammy-linux-bluefield'. If the problem still exists, change the tag 'verification-needed-jammy-linux-bluefield' to 'verification-failed-jammy-linux-bluefield'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-bluefield-v2 verification-needed-jammy-linux-bluefield -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-raspi/5.15.0-1040.43 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-raspi' to 'verification-done-jammy- linux-raspi'. If the problem still exists, change the tag 'verification- needed-jammy-linux-raspi' to 'verification-failed-jammy-linux-raspi'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-raspi-v2 verification-needed-jammy-linux-raspi -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-nvidia- tegra/5.15.0-1018.18 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-nvidia-tegra' to 'verification-done-jammy-linux-nvidia-tegra'. If the problem still exists, change the tag 'verification-needed-jammy-linux-nvidia-tegra' to 'verification-failed-jammy-linux-nvidia-tegra'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-nvidia-tegra-v2 verification-needed-jammy-linux-nvidia-tegra -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-aws/5.15.0-1048.53 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-aws' to 'verification-done-jammy- linux-aws'. If the problem still exists, change the tag 'verification- needed-jammy-linux-aws' to 'verification-failed-jammy-linux-aws'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-aws-v2 verification-needed-jammy-linux-aws -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug is awaiting verification that the linux-azure/5.15.0-1050.57 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure' to 'verification-done-jammy- linux-azure'. If the problem still exists, change the tag 'verification- needed-jammy-linux-azure' to 'verification-failed-jammy-linux-azure'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-jammy-linux-azure-v2 verification-needed-jammy-linux-azure -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Released Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ?
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
This bug was fixed in the package linux - 5.15.0-86.96 --- linux (5.15.0-86.96) jammy; urgency=medium * jammy/linux: 5.15.0-86.96 -proposed tracker (LP: #2036575) * 5.15.0-85 live migration regression (LP: #2036675) - Revert "KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES" - Revert "x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0" * Regression for ubuntu_bpf test build on Jammy 5.15.0-85.95 (LP: #2035181) - selftests/bpf: fix static assert compilation issue for test_cls_*.c * `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic (LP: #2034447) - crypto: rsa-pkcs1pad - Use helper to set reqsize linux (5.15.0-85.95) jammy; urgency=medium * jammy/linux: 5.15.0-85.95 -proposed tracker (LP: #2033821) * Please enable Renesas RZ platform serial installer (LP: #2022361) - [Config] enable hihope RZ/G2M serial console - [Config] Mark sh-sci as built-in * Request backport of xen timekeeping performance improvements (LP: #2033122) - x86/xen/time: prefer tsc as clocksource when it is invariant * kdump doesn't work with UEFI secure boot and kernel lockdown enabled on ARM64 (LP: #2033007) - [Config]: Enable CONFIG_KEXEC_IMAGE_VERIFY_SIG - kexec, KEYS: make the code in bzImage64_verify_sig generic - arm64: kexec_file: use more system keyrings to verify kernel image signature * ubuntu_kernel_selftests:net:vrf-xfrm-tests.sh: 8 failed test cases on jammy/fips (LP: #2019880) - selftests: net: vrf-xfrm-tests: change authentication and encryption algos * ubuntu_kernel_selftests:net:tls: 88 failed test cases on jammy/fips (LP: #2019868) - selftests/harness: allow tests to be skipped during setup - selftests: net: tls: check if FIPS mode is enabled * A general-proteciton exception during guest migration to unsupported PKRU machine (LP: 2032164, reverted) - x86/kvm/fpu: Limit guest user_xfeatures to supported bits of XCR0 - KVM: x86: Always enable legacy FP/SSE in allowed user XFEATURES * CVE-2023-4569 - netfilter: nf_tables: deactivate catchall elements in next generation * CVE-2023-20569 - x86/cpu, kvm: Add support for CPUID_8021_EAX - x86/srso: Add a Speculative RAS Overflow mitigation - x86/srso: Add IBPB_BRTYPE support - x86/srso: Add SRSO_NO support - x86/srso: Add IBPB - x86/srso: Add IBPB on VMEXIT - x86/srso: Fix return thunks in generated code - x86/srso: Tie SBPB bit setting to microcode patch detection - x86: fix backwards merge of GDS/SRSO bit - x86/srso: Fix build breakage with the LLVM linker - x86/cpu: Fix __x86_return_thunk symbol type - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() - x86/alternative: Make custom return thunk unconditional - objtool: Add frame-pointer-specific function ignore - x86/ibt: Add ANNOTATE_NOENDBR - x86/cpu: Clean up SRSO return thunk mess - x86/cpu: Rename original retbleed methods - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 - x86/cpu: Cleanup the untrain mess - x86/srso: Explain the untraining sequences a bit more - x86/static_call: Fix __static_call_fixup() - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() - x86/srso: Disable the mitigation on unaffected configurations - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG - objtool/x86: Fixup frame-pointer vs rethunk - x86/srso: Correct the mitigation status when SMT is disabled - objtool/x86: Fix SRSO mess - Ubuntu: [Config]: enable Speculative Return Stack Overflow mitigation * Fix unreliable ethernet cable detection on I219 NIC (LP: #2028122) - e1000e: Use PME poll to circumvent unreliable ACPI wake * Need to get fine-grained control for FAN(TFN) Participant. (LP: #2031333) - ACPI: fan: Separate file for attributes creation - ACPI: fan: Optimize struct acpi_fan_fif - ACPI: fan: Properly handle fine grain control - ACPI: fan: Add additional attributes for fine grain control * [SRU][Ubuntu 22.04.1] Unable to interpret the frequency values in cpuinfo_min_freq and cpuino_max_freq sysfs files. (LP: #2030924) - cpufreq: intel_pstate: Fix scaling for hybrid-capable * CVE-2023-40283 - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb * CVE-2023-20588 - x86/bugs: Increase the x86 bugs vector size to two u32s - x86/CPU/AMD: Do not leak quotient data after a division by 0 - x86/CPU/AMD: Fix the DIV(0) initial fix attempt * CVE-2023-4194 - net: tun_chr_open(): set sk_uid from current_fsuid() - net: tap_open(): set sk_uid from current_fsuid() * CVE-2023-4155 - KVM: SEV: Refactor out sev_es_state struct - KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary - KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
** Changed in: linux (Ubuntu Jammy) Status: Triaged => Fix Committed -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Fix Committed Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385] public_key_verify_signature_2+0x15/0x20 [ 58.936389] verify_signature+0x37/0x60 [ 58.936393] pkcs7_validate_trust_one.constprop.0+0x156/0x1e0 [ 58.936400] pkcs7_validate_trust+0x4a/0xa0 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
** Also affects: linux (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: linux (Ubuntu Jammy) Importance: Undecided => High ** Changed in: linux (Ubuntu Jammy) Status: New => Triaged ** Changed in: linux (Ubuntu) Status: Incomplete => Fix Released -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Triaged Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385]
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
probably caused by 32a99d9afc4d, details at https://www.spinics.net/lists/stable/msg678947.html -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Fix Released Status in linux source package in Jammy: Triaged Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385] public_key_verify_signature_2+0x15/0x20 [ 58.936389] verify_signature+0x37/0x60 [ 58.936393] pkcs7_validate_trust_one.constprop.0+0x156/0x1e0 [ 58.936400] pkcs7_validate_trust+0x4a/0xa0
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
Current upstream stable level is v5.15.122, latest is v5.15.130. Between those versions there seem to be no additional related patches. -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Incomplete Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385] public_key_verify_signature_2+0x15/0x20 [ 58.936389] verify_signature+0x37/0x60 [ 58.936393] pkcs7_validate_trust_one.constprop.0+0x156/0x1e0 [ 58.936400] pkcs7_validate_trust+0x4a/0xa0 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
Since this is somewhere in crypto and I saw QAT in the messages, this is the list of related changes between -83 and -85: 88c7bf897ef7 crypto: qat - unmap buffers before free for RSA d66aa0d64549 crypto: qat - unmap buffer before free for DH 32a99d9afc4d crypto: qat - Use helper to set reqsize d389108b0aee crypto: kpp - Add helper to set reqsize 18d6f474609d crypto: qat - use reference to structure in dma_map_single() d72b1246a048 crypto: qat - replace get_current_node() with numa_node_id() abcd04ccb419 crypto: qat - honor CRYPTO_TFM_REQ_MAY_SLEEP flag -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Incomplete Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
apport information ** Tags added: apport-collected jammy uec-images ** Description changed: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385] public_key_verify_signature_2+0x15/0x20 [ 58.936389] verify_signature+0x37/0x60 [ 58.936393] pkcs7_validate_trust_one.constprop.0+0x156/0x1e0 [ 58.936400] pkcs7_validate_trust+0x4a/0xa0 [ 58.936406] verify_pkcs7_message_sig+0x83/0x120 [ 58.936418] verify_pkcs7_signature+0x4f/0x80 [ 58.936424] mod_verify_sig+0xb5/0xf0 [ 58.936435] load_module+0x275/0xbc0 [ 58.936440] ? kernel_read_file_from_fd+0x56/0xa0 [ 58.936450] __do_sys_finit_module+0xbf/0x120 [ 58.936496] __x64_sys_finit_module+0x18/0x20 [ 58.936504]
[Kernel-packages] [Bug 2034447] Re: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic
Here's the full log from where that snippet was pulled. ** Attachment added: "hidon.log.1" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2034447/+attachment/5697793/+files/hidon.log.1 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/2034447 Title: `refcount_t: underflow; use-after-free.` on hidon w/ 5.15.0-85-generic Status in linux package in Ubuntu: Incomplete Bug description: Seeing a panic on hidon (an Nvidia H100) after booting the 5.15.0-85-generic kernel: [ 58.935877] [ cut here ] [ 58.935893] refcount_t: underflow; use-after-free. [ 58.935920] WARNING: CPU: 207 PID: 2985 at lib/refcount.c:28 refcount_warn_saturate+0xf7/0x150 [ 58.935943] Modules linked in: x86_pkg_temp_thermal(+) intel_powerclamp coretemp nls_iso8859_1 rapl irdma(+) i40e qat_4xxx(+) isst_if_mbox_pci intel_qat pmt_telemetry pmt_crashlog idxd(+) isst_if_mmio pmt_class isst_if_common authenc idxd_bus intel_th_gth mei_me intel_th_pci intel_th mei switchtec ipmi_ssif acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler mac_hid sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 multipath linear mlx5_ib ib_uverbs ib_core ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper raid0 mlx5_core syscopyarea sysfillrect sysimgblt crct10dif_pclmul fb_sys_fops crc32_pclmul ixgbe cec mlxfw ghash_clmulni_intel aesni_intel psample crypto_simd xfrm_algo ice rc_core cryptd tls nvme i2c_i801 dca xhci_pci intel_pmt drm [ 58.936077] pci_hyperv_intf i2c_ismt i2c_smbus [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936080] QAT: Could not find a device on node 1 [ 58.936083] mdio [ 58.936096] xhci_pci_renesas nvme_core wmi pinctrl_emmitsburg [ 58.936106] CPU: 207 PID: 2985 Comm: systemd-udevd Not tainted 5.15.0-85-generic #95-Ubuntu [ 58.936115] Hardware name: NVIDIA DGXH100/DGXH100, BIOS 1.0.7 05/08/2023 [ 58.936119] RIP: 0010:refcount_warn_saturate+0xf7/0x150 [ 58.936130] Code: eb 9e 0f b6 1d 5e e6 b9 01 80 fb 01 0f 87 f4 63 6f 00 83 e3 01 75 89 48 c7 c7 88 c3 23 9e c6 05 42 e6 b9 01 01 e8 d8 e4 6b 00 <0f> 0b e9 6f ff ff ff 0f b6 1d 2d e6 b9 01 80 fb 01 0f 87 b1 63 6f [ 58.936135] RSP: 0018:ff4d5d94b2c7fa28 EFLAGS: 00010282 [ 58.936142] RAX: RBX: RCX: 0027 [ 58.936146] RDX: ff314dbbbf9e0588 RSI: 0001 RDI: ff314dbbbf9e0580 [ 58.936149] RBP: ff4d5d94b2c7fa30 R08: 0026 R09: ff4d5d94b2c7f9c0 [ 58.936153] R10: 0028 R11: 0001 R12: [ 58.936156] R13: ff314cbfdbcb6900 R14: ff314cbfdbcb67b8 R15: ff314cbfd24b4000 [ 58.936159] FS: 7fadd2f6c8c0() GS:ff314dbbbf9c() knlGS: [ 58.936163] CS: 0010 DS: ES: CR0: 80050033 [ 58.936167] CR2: 7fadd243b584 CR3: 00012972c006 CR4: 00771ee0 [ 58.936171] DR0: DR1: DR2: [ 58.936174] DR3: DR6: fffe07f0 DR7: 0400 [ 58.936177] PKRU: 5554 [ 58.936179] Call Trace: [ 58.936184] [ 58.936188] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936204] ? show_trace_log_lvl+0x1d6/0x2ea [ 58.936212] ? crypto_mod_put+0x6b/0x80 [ 58.936225] ? show_regs.part.0+0x23/0x29 [ 58.936232] ? show_regs.cold+0x8/0xd [ 58.936239] ? refcount_warn_saturate+0xf7/0x150 [ 58.936246] ? __warn+0x8c/0x100 [ 58.936255] ? refcount_warn_saturate+0xf7/0x150 [ 58.936263] ? report_bug+0xa4/0xd0 [ 58.936274] ? down_trylock+0x2e/0x40 [ 58.936285] ? handle_bug+0x39/0x90 [ 58.936296] ? exc_invalid_op+0x19/0x70 [ 58.936301] ? asm_exc_invalid_op+0x1b/0x20 [ 58.936310] ? refcount_warn_saturate+0xf7/0x150 [ 58.936317] ? refcount_warn_saturate+0xf7/0x150 [ 58.936323] crypto_mod_put+0x6b/0x80 [ 58.936329] crypto_destroy_tfm+0x4e/0xa0 [ 58.936336] pkcs1pad_exit_tfm+0x15/0x20 [ 58.936345] crypto_akcipher_exit_tfm+0x13/0x20 [ 58.936352] crypto_destroy_tfm+0x43/0xa0 [ 58.936358] public_key_verify_signature+0x2dc/0x3c0 [ 58.936366] ? find_asymmetric_key+0xd2/0x1d0 [ 58.936374] ? kfree+0x1f7/0x250 [ 58.936385] public_key_verify_signature_2+0x15/0x20 [ 58.936389] verify_signature+0x37/0x60 [ 58.936393] pkcs7_validate_trust_one.constprop.0+0x156/0x1e0 [
