Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #94270 > unrolled thread
| Started by | Philip Dodd <orangespyderman@gmail.com> |
|---|---|
| First post | 2026-09-30 12:20 +0200 |
| Last post | 2026-10-30 22:20 +0100 |
| Articles | 8 — 5 participants |
Back to article view | Back to linux.debian.kernel
Bug#1149525: linux-image-7.2.6+deb14-arm64: 7.2.6 and 7.2.8 both fail gc_worker+0x130/0x780, address 0x10037 on rockpro64 Philip Dodd <orangespyderman@gmail.com> - 2026-09-30 12:20 +0200
Bug#1149525: Also affects 7.2.12 Philip Dodd <orange.spyderman@gmail.com> - 2026-10-26 08:40 +0100
Bug#1149525: invalid pointer in nf_conntrack Uwe Kleine-König <ukleinek@debian.org> - 2026-10-27 19:20 +0100
Bug#1149525: invalid pointer in nf_conntrack Florian Westphal <fw@strlen.de> - 2026-10-29 11:40 +0100
Processed: invalid pointer in nf_conntrack "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-27 19:20 +0100
Bug#1149525: Debian package 7.3~rc7-1~exp1 not affected Philip Dodd <orange.spyderman@gmail.com> - 2026-10-29 10:20 +0100
Bug#1149525: invalid pointer in nf_conntrack Uwe Kleine-König <ukleinek@debian.org> - 2026-10-30 08:50 +0100
Bug#1149525: marked as done (linux: RockPro64 conntrack oops with 7.2.x) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-30 22:20 +0100
| From | Philip Dodd <orangespyderman@gmail.com> |
|---|---|
| Date | 2026-09-30 12:20 +0200 |
| Subject | Bug#1149525: linux-image-7.2.6+deb14-arm64: 7.2.6 and 7.2.8 both fail gc_worker+0x130/0x780, address 0x10037 on rockpro64 |
| Message-ID | <NIZzP-2Hoc-1@gated-at.bofh.it> |
Package: src:linux
Version: 7.2.6-1
Severity: important
Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
Installing 7.2.6 (or 7.2.8 from sid) to a running testing system provokes kernel Oops in conntrack.
Tested with both flash-kernel which was patched to work around 7.2 changing module path and dracut.
7.1.13 runs correctly.
-- Package-specific info:
** Version:
Linux version 7.2.6+deb14-arm64 (debian-kernel@lists.debian.org) (aarch64-linux-gnu-gcc-16 (Debian 16.2.0-2) 16.2.0, GNU ld (GNU Binutils for Debian) 2.47) #1 SMP PREEMPT Debian 7.2.6-1 (2026-09-16)
** Command line:
root=UUID=20250184-e767-46df-b2fb-b5287461fafb ro quiet
** Tainted: D (128)
* kernel died recently, i.e. there was an OOPS or BUG
** Kernel log:
[ 19.059332] dwhdmi-rockchip ff940000.hdmi: Detected HDMI TX controller v2.11a with HDCP (DWC HDMI 2.0 TX PHY)
[ 19.061229] rockchip-drm display-subsystem: bound ff940000.hdmi (ops dw_hdmi_rockchip_ops [rockchipdrm])
[ 19.071276] rockchip-rga ff680000.rga: HW Version: 0x03.02
[ 19.075296] rockchip-rga ff680000.rga: Registered rockchip-rga as /dev/video0
[ 19.079468] [drm] Initialized rockchip 1.0.0 for display-subsystem on minor 0
[ 19.079579] rockchip-drm display-subsystem: [drm] Cannot find any crtc or sizes
[ 19.080198] rockchip-drm display-subsystem: [drm] Cannot find any crtc or sizes
[ 19.089101] ieee80211 phy0: brcmf_c_preinit_dcmds: Default MAC is used, replacing with random MAC to avoid conflicts
[ 19.102008] brcmfmac: brcmf_c_process_txcap_blob: no txcap_blob available (err=-2)
[ 19.102505] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Apr 15 2021 03:03:20 version 7.45.234 (4ca95bb CY) FWID 01-996384e2
[ 19.122380] Bluetooth: HCI UART driver ver 2.3
[ 19.122399] Bluetooth: HCI UART protocol H4 registered
[ 19.122472] Bluetooth: HCI UART protocol LL registered
[ 19.122477] Bluetooth: HCI UART protocol ATH3K registered
[ 19.122500] Bluetooth: HCI UART protocol Three-wire (H5) registered
[ 19.122720] Bluetooth: HCI UART protocol Intel registered
[ 19.122866] Bluetooth: HCI UART protocol Broadcom registered
[ 19.122892] Bluetooth: HCI UART protocol QCA registered
[ 19.122896] Bluetooth: HCI UART protocol AG6XX registered
[ 19.122916] Bluetooth: HCI UART protocol Marvell registered
[ 19.154050] RTL8211F Gigabit Ethernet stmmac-0:00: attached PHY driver (mii_bus:phy_addr=stmmac-0:00, irq=POLL)
[ 19.184792] hantro-vpu ff650000.video-codec: registered rockchip,rk3399-vpu-enc as /dev/video1
[ 19.185033] hantro-vpu ff650000.video-codec: registered rockchip,rk3399-vpu-dec as /dev/video2
[ 19.267950] dw-apb-uart ff180000.serial: failed to request DMA
[ 19.479970] panfrost ff9a0000.gpu: clock rate = 500000000
[ 19.487345] panfrost ff9a0000.gpu: EM: created perf domain
[ 19.488022] panfrost ff9a0000.gpu: mali-t860 id 0x860 major 0x2 minor 0x0 status 0x0
[ 19.488058] panfrost ff9a0000.gpu: features: 00000000,00000407, issues: 00000000,24040400
[ 19.488069] panfrost ff9a0000.gpu: Features: L2:0x07120206 Shader:0x00000000 Tiler:0x00000809 Mem:0x1 MMU:0x00002830 AS:0xff JS:0x7
[ 19.488080] panfrost ff9a0000.gpu: shader_present=0xf l2_present=0x1
[ 19.496551] Bluetooth: hci0: BCM: chip id 107
[ 19.497552] Bluetooth: hci0: BCM: features 0x2f
[ 19.501013] Bluetooth: hci0: BCM4345C0
[ 19.501059] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0000
[ 19.502399] Bluetooth: hci0: BCM4345C0 'brcm/BCM4345C0.pine64,rockpro64-v2.1.hcd' Patch
[ 19.506578] panfrost ff9a0000.gpu: [drm] Using Transparent Hugepage
[ 19.546490] rockchip-i2s ff890000.i2s: using zero-initialized flat cache, this may cause unexpected behavior
[ 19.559558] Registered IR keymap rc-empty
[ 19.565221] rc rc0: gpio_ir_recv as /devices/platform/ir-receiver/rc/rc0
[ 19.572356] [drm] Initialized panfrost 1.6.0 for ff9a0000.gpu on minor 1
[ 19.574708] rc rc0: lirc_dev: driver gpio_ir_recv registered at minor = 0, raw IR receiver, no transmitter
[ 19.574854] input: gpio_ir_recv as /devices/platform/ir-receiver/rc/rc0/input3
[ 20.006398] Registered IR keymap rc-cec
[ 20.006606] rc rc1: dw_hdmi as /devices/platform/ff940000.hdmi/rc/rc1
[ 20.006714] input: dw_hdmi as /devices/platform/ff940000.hdmi/rc/rc1/input4
[ 20.150977] rk_gmac-dwmac fe300000.ethernet end0: renamed from eth0
[ 20.206697] rk_gmac-dwmac fe300000.ethernet end0: Register MEM_TYPE_PAGE_POOL RxQ-0
[ 20.235402] rk_gmac-dwmac fe300000.ethernet end0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=POLL)
[ 20.243503] rk_gmac-dwmac fe300000.ethernet end0: No Safety Features support found
[ 20.244369] rk_gmac-dwmac fe300000.ethernet end0: PTP not supported by HW
[ 20.244411] rk_gmac-dwmac fe300000.ethernet end0: configuring for phy/rgmii link mode
[ 20.322138] tun: Universal TUN/TAP device driver, 1.6
[ 20.481393] Bluetooth: hci0: BCM: features 0x2f
[ 20.484216] Bluetooth: hci0: BCM4345C0 Ampak 0073
[ 20.484254] Bluetooth: hci0: BCM4345C0 (003.001.025) build 0075
[ 23.332171] rk_gmac-dwmac fe300000.ethernet end0: Link is Up - 1Gbps/Full - flow control off
[ 23.392173] systemd-journald[405]: Time jumped backwards, rotating.
[ 28.900461] Unable to handle kernel paging request at virtual address 0000000000010037
[ 28.901172] Mem abort info:
[ 28.901420] ESR = 0x0000000096000006
[ 28.901752] EC = 0x25: DABT (current EL), IL = 32 bits
[ 28.902219] SET = 0, FnV = 0
[ 28.902491] EA = 0, S1PTW = 0
[ 28.902769] FSC = 0x06: level 2 translation fault
[ 28.903220] Data abort info:
[ 28.903475] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
[ 28.903963] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 28.904407] GCS = 0, Overlay = 0, DirtyBit = 0
[ 28.904814] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000020140000
[ 28.905380] [0000000000010037] pgd=08000000f03b1403, p4d=08000000f03b1403, pud=08000000f033f403, pmd=0000000000000000
[ 28.906319] Internal error: Oops: 0000000096000006 [#1] SMP
[ 28.906817] Modules linked in: xt_connmark xt_conntrack xt_MASQUERADE xt_tcpudp xt_mark nft_compat x_tables nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tun snd_soc_hdmi_codec dw_hdmi_cec dw_hdmi_i2s_audio snd_soc_spdif_tx snd_soc_simple_card snd_soc_audio_graph_card panfrost gpio_ir_recv gpu_sched snd_soc_simple_card_utils leds_gpio drm_shmem_helper hantro_vpu rockchip_vdec snd_soc_rockchip_i2s hci_uart v4l2_jpeg brcmfmac_wcc btqca rockchip_rga v4l2_vp9 realtek btrtl v4l2_h264 phy_package btintel videobuf2_dma_contig btbcm snd_soc_es8316 btsdio rockchipdrm v4l2_mem2mem videobuf2_dma_sg snd_soc_core dw_hdmi_qp bluetooth dw_mipi_dsi videobuf2_memops snd_compress videobuf2_v4l2 dw_hdmi snd_pcm_dmaengine snd_pcm videodev analogix_dp dwmac_rk ecdh_generic drm_dp_aux_bus brcmfmac snd_timer stmmac_platform ofpart drm_display_helper videobuf2_common snd spi_nor mc brcmutil cec soundcore stmmac rockchip_saradc mtd rc_core binfmt_misc coresight_cpu_debug industrialio_triggered_buffer kfifo_buf pcs_xpcs
[ 28.906995] drm_client_lib coresight_etm4x industrialio drm_dma_helper phylink drm_kms_helper coresight rockchip_thermal cpufreq_dt evdev cfg80211 rfkill nf_tables dm_mod efi_pstore configfs ext4 crc16 mbcache jbd2 xhci_plat_hcd xhci_hcd fusb302 dwc3 tcpm aux_hpd_bridge udc_core reset_gpio rk808_regulator drm ulpi ghash_ce typec fan53555 gf128mul gpio_rockchip pwm_regulator dwc3_of_simple fixed pwm_fan ohci_platform gpio_keys ehci_platform sdhci_of_arasan ehci_hcd ohci_hcd sdhci_pltfm dw_wdt phy_rockchip_inno_usb2 usbcore sdhci phy_rockchip_pcie phy_rockchip_emmc rockchip_dfi pl330 io_domain pwm_rockchip phy_rockchip_typec dw_mmc_rockchip cqhci nvmem_rockchip_efuse spi_rockchip dw_mmc_pltfm i2c_rk3x usb_common dw_mmc autofs4 aes_ce_blk aes_neon_bs
[ 28.920668] CPU: 4 UID: 0 PID: 76 Comm: kworker/4:1 Not tainted 7.2.6+deb14-arm64 #1 PREEMPTLAZY Debian 7.2.6-1
[ 28.921568] Hardware name: Pine64 RockPro64 v2.1 (DT)
[ 28.922014] Workqueue: events_power_efficient gc_worker [nf_conntrack]
[ 28.922626] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 28.923239] pc : gc_worker+0x130/0x780 [nf_conntrack]
[ 28.923708] lr : process_one_work+0x17c/0x4d8
[ 28.924097] sp : ffff800080673d40
[ 28.924390] x29: ffff800080673d40 x28: 0000000000005abb x27: ffffc56708d06a00
[ 28.925023] x26: 000000000000007d x25: 0000000000000000 x24: 0000000000010000
[ 28.925655] x23: ffff0000111e4e00 x22: 00000000000124f7 x21: 000000000000be60
[ 28.926285] x20: ffffc566b910a968 x19: ffffc566b910de08 x18: 0000000000000004
[ 28.926915] x17: ffff3a99eeb46000 x16: 000009867b3de706 x15: ffffc56708d12218
[ 28.927547] x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101
[ 28.928177] x11: 00000000fffef740 x10: feff736d64686268 x9 : 0000000000000038
[ 28.928809] x8 : 8080000000000000 x7 : ffffc56708d06000 x6 : fefefefefefefeff
[ 28.929439] x5 : ffff0000011ffbc8 x4 : ffffc566b910a970 x3 : 0000000000010000
[ 28.930070] x2 : fffffffffffffff0 x1 : 0000000000000000 x0 : 0000000000000000
[ 28.930702] Call trace:
[ 28.930922] gc_worker+0x130/0x780 [nf_conntrack] (P)
[ 28.931390] process_one_work+0x17c/0x4d8
[ 28.931746] worker_thread+0x194/0x2f8
[ 28.932079] kthread+0x134/0x150
[ 28.932370] ret_from_fork+0x10/0x20
[ 28.932703] Code: f94042e0 37180300 f9400318 37000a78 (3940df00)
[ 28.933243] ---[ end trace 0000000000000000 ]---
[ 28.933705] note: kworker/4:1[76] exited with preempt_count 1
[ 30.182686] platform sound-dit: deferred probe pending: asoc-audio-graph-card: parse error
** Model information
Device Tree model: Pine64 RockPro64 v2.1
** Configuration for modprobe:
blacklist arkfb
blacklist aty128fb
blacklist atyfb
blacklist cirrusfb
blacklist cyber2000fb
blacklist kyrofb
blacklist matroxfb_base
blacklist mb862xxfb
blacklist neofb
blacklist pm2fb
blacklist pm3fb
blacklist radeonfb
blacklist rk_crypto
blacklist s3fb
blacklist savagefb
blacklist sisfb
blacklist tdfxfb
blacklist tridentfb
blacklist vt8623fb
install rk_crypto /bin/false
options bonding max_bonds=0
options cx88_alsa index=-2
options dummy numdummies=0
options ifb numifbs=0
options snd_atiixp_modem index=-2
options snd_intel8x0m index=-2
options snd_pcsp index=-2
options snd_via82xx_modem index=-2
** Loaded modules:
aes_ce_blk
aes_neon_bs
analogix_dp
autofs4
aux_hpd_bridge
binfmt_misc
bluetooth
brcmfmac
brcmfmac_wcc
brcmutil
btbcm
btintel
btqca
btrtl
btsdio
cec
cfg80211
configfs
coresight
coresight_cpu_debug
coresight_etm4x
cpufreq_dt
cqhci
crc16
dm_mod
drm
drm_client_lib
drm_display_helper
drm_dma_helper
drm_dp_aux_bus
drm_kms_helper
drm_shmem_helper
dw_hdmi
dw_hdmi_cec
dw_hdmi_i2s_audio
dw_hdmi_qp
dw_mipi_dsi
dw_mmc
dw_mmc_pltfm
dw_mmc_rockchip
dw_wdt
dwc3
dwc3_of_simple
dwmac_rk
ecdh_generic
efi_pstore
ehci_hcd
ehci_platform
evdev
ext4
fan53555
fixed
fusb302
gf128mul
ghash_ce
gpio_ir_recv
gpio_keys
gpio_rockchip
gpu_sched
hantro_vpu
hci_uart
i2c_rk3x
industrialio
industrialio_triggered_buffer
io_domain
jbd2
kfifo_buf
leds_gpio
mbcache
mc
mtd
nf_conntrack
nf_defrag_ipv4
nf_defrag_ipv6
nf_nat
nf_tables
nft_chain_nat
nft_compat
nvmem_rockchip_efuse
ofpart
ohci_hcd
ohci_platform
panfrost
pcs_xpcs
phy_package
phy_rockchip_emmc
phy_rockchip_inno_usb2
phy_rockchip_pcie
phy_rockchip_typec
phylink
pl330
pwm_fan
pwm_regulator
pwm_rockchip
rc_core
realtek
reset_gpio
rfkill
rk808_regulator
rockchip_dfi
rockchip_rga
rockchip_saradc
rockchip_thermal
rockchip_vdec
rockchipdrm
sdhci
sdhci_of_arasan
sdhci_pltfm
snd
snd_compress
snd_pcm
snd_pcm_dmaengine
snd_soc_audio_graph_card
snd_soc_core
snd_soc_es8316
snd_soc_hdmi_codec
snd_soc_rockchip_i2s
snd_soc_simple_card
snd_soc_simple_card_utils
snd_soc_spdif_tx
snd_timer
soundcore
spi_nor
spi_rockchip
stmmac
stmmac_platform
tcpm
tun
typec
udc_core
ulpi
usb_common
usbcore
v4l2_h264
v4l2_jpeg
v4l2_mem2mem
v4l2_vp9
videobuf2_common
videobuf2_dma_contig
videobuf2_dma_sg
videobuf2_memops
videobuf2_v4l2
videodev
x_tables
xhci_hcd
xhci_plat_hcd
xt_MASQUERADE
xt_connmark
xt_conntrack
xt_mark
xt_tcpudp
** Out of tree modules:
None found
** Network interface configuration:
*** /etc/network/interfaces:
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
** Network status:
*** IP interfaces and addresses:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: end0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 1e:f3:dd:c3:de:22 brd ff:ff:ff:ff:ff:ff
altname enx1ef3ddc3de22
inet 192.168.1.245/24 brd 192.168.1.255 scope global end0
valid_lft forever preferred_lft forever
inet6 2a01:e0a:deb:c440:1cf3:ddff:fec3:de22/64 scope global dynamic mngtmpaddr noprefixroute
valid_lft 86325sec preferred_lft 86325sec
inet6 2a01:e0a:deb:c440::245/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::1cf3:ddff:fec3:de22/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 3e:cf:ef:5d:68:69 brd ff:ff:ff:ff:ff:ff
4: tailscale0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 100.64.0.9/32 scope global tailscale0
valid_lft forever preferred_lft forever
inet6 fd7a:115c:a1e0::9/128 scope global
valid_lft forever preferred_lft forever
inet6 fe80::aaca:6ea3:3972:488a/64 scope link stable-privacy proto kernel_ll
valid_lft forever preferred_lft forever
*** Device statistics:
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 4102393 2949 0 0 0 0 0 0 4102393 2949 0 0 0 0 0 0
end0: 3405892 16913 0 8113 0 0 0 0 1141813 6705 0 0 0 0 0 0
wlan0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
tailscale0: 86 1 0 0 0 0 0 0 1032 14 0 0 0 0 0 0
** PCI devices:
** USB devices:
/: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=ehci-platform/1p, 480M
ID 1d6b:0002 Linux Foundation 2.0 root hub
/: Bus 002.Port 001: Dev 001, Class=root_hub, Driver=ohci-platform/1p, 12M
ID 1d6b:0001 Linux Foundation 1.1 root hub
/: Bus 003.Port 001: Dev 001, Class=root_hub, Driver=ehci-platform/1p, 480M
ID 1d6b:0002 Linux Foundation 2.0 root hub
/: Bus 004.Port 001: Dev 001, Class=root_hub, Driver=ohci-platform/1p, 12M
ID 1d6b:0001 Linux Foundation 1.1 root hub
/: Bus 005.Port 001: Dev 001, Class=root_hub, Driver=xhci-hcd/1p, 480M
ID 1d6b:0002 Linux Foundation 2.0 root hub
/: Bus 006.Port 001: Dev 001, Class=root_hub, Driver=xhci-hcd/1p, 5000M
ID 1d6b:0003 Linux Foundation 3.0 root hub
/: Bus 007.Port 001: Dev 001, Class=root_hub, Driver=xhci-hcd/1p, 480M
ID 1d6b:0002 Linux Foundation 2.0 root hub
/: Bus 008.Port 001: Dev 001, Class=root_hub, Driver=xhci-hcd/1p, 5000M
ID 1d6b:0003 Linux Foundation 3.0 root hub
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing'), (1, 'unstable')
Architecture: arm64 (aarch64)
Kernel: Linux 7.2.6+deb14-arm64 (SMP w/6 CPU threads; PREEMPT)
Kernel taint flags: TAINT_DIE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages linux-image-7.2.6+deb14-arm64 depends on:
ii dracut [linux-initramfs-tool] 112-6
ii linux-base 4.17
ii linux-base-7.2.6+deb14-arm64 7.2.6-1
ii linux-binary-7.2.6+deb14-arm64 7.2.6-1
ii linux-modules-7.2.6+deb14-arm64 7.2.6-1
Versions of packages linux-image-7.2.6+deb14-arm64 recommends:
ii apparmor 4.1.8-2
Versions of packages linux-image-7.2.6+deb14-arm64 suggests:
pn debian-kernel-handbook <none>
pn firmware-linux-free <none>
pn linux-doc-7.2 <none>
Versions of packages linux-image-7.2.6+deb14-arm64 is related to:
pn firmware-amd-graphics <none>
pn firmware-atheros <none>
pn firmware-bnx2 <none>
pn firmware-bnx2x <none>
ii firmware-brcm80211 20260810-1
pn firmware-cavium <none>
pn firmware-cirrus <none>
pn firmware-intel-graphics <none>
pn firmware-intel-misc <none>
pn firmware-intel-sound <none>
pn firmware-ipw2x00 <none>
pn firmware-ivtv <none>
pn firmware-iwlwifi <none>
pn firmware-libertas <none>
pn firmware-marvell-prestera <none>
pn firmware-mediatek <none>
pn firmware-misc-nonfree <none>
pn firmware-myricom <none>
pn firmware-netronome <none>
pn firmware-netxen <none>
pn firmware-nvidia-graphics <none>
pn firmware-qcom-soc <none>
pn firmware-qlogic <none>
pn firmware-realtek <none>
pn firmware-samsung <none>
pn firmware-siano <none>
pn firmware-ti-connectivity <none>
pn xen-hypervisor <none>
-- no debconf information
[toc] | [next] | [standalone]
| From | Philip Dodd <orange.spyderman@gmail.com> |
|---|---|
| Date | 2026-10-26 08:40 +0100 |
| Subject | Bug#1149525: Also affects 7.2.12 |
| Message-ID | <NSntg-7WCx-19@gated-at.bofh.it> |
| In reply to | #94270 |
7.2.12+deb14-arm64 is affected in the same way, reproduced by just loading the nf_conntrack module shortly after boot. After the failure: nf_conntrack module use count: 0 net.netfilter.nf_conntrack_count: 0 nf_conntrack hashsize: 65536 /proc/sys/kernel/tainted: 128 No nf_nat or xt_* modules were loaded. This time the fault occurred on CPU 1 rather than CPU 4. The faulting address is 0xfff8, with x24 again containing 0x10000. Trace : [ 234.152118] Unable to handle kernel paging request at virtual address 000000000000fff8 [ 234.152884] Mem abort info: [ 234.153151] ESR = 0x0000000096000007 [ 234.153502] EC = 0x25: DABT (current EL), IL = 32 bits [ 234.153993] SET = 0, FnV = 0 [ 234.154283] EA = 0, S1PTW = 0 [ 234.154580] FSC = 0x07: level 3 translation fault [ 234.155031] Data abort info: [ 234.155302] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 234.155807] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 234.156343] GCS = 0, Overlay = 0, DirtyBit = 0 [ 234.156774] user pgtable: 4k pages, 48-bit VAs, pgdp=000000000fdf4000 [ 234.157367] [000000000000fff8] pgd=0800000010988403, p4d=0800000010988403, pud=0800000010987403, pmd=080000000d349403, pte=0000000000000000 [ 234.158531] Internal error: Oops: 0000000096000007 [#1] SMP [ 234.159050] Modules linked in: nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 snd_soc_hdmi_codec snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd soundcore dw_hdmi_cec dw_hdmi_i2s_audio gpio_ir_recv hantro_vpu leds_gpio binfmt_misc rockchipdrm panfrost rockchip_vdec dw_hdmi_qp gpu_sched v4l2_jpeg dw_mipi_dsi rockchip_rga drm_shmem_helper dw_hdmi v4l2_vp9 v4l2_h264 videobuf2_dma_contig analogix_dp realtek v4l2_mem2mem videobuf2_dma_sg phy_package videobuf2_memops drm_dp_aux_bus ofpart videobuf2_v4l2 drm_display_helper videodev dwmac_rk spi_nor stmmac_platform rockchip_saradc cec rockchip_thermal stmmac mtd rc_core industrialio_triggered_buffer videobuf2_common drm_client_lib kfifo_buf coresight_cpu_debug drm_dma_helper coresight_etm4x mc industrialio pcs_xpcs drm_kms_helper coresight phylink cpufreq_dt evdev cfg80211 rfkill nf_tables dm_mod efi_pstore configfs ext4 crc16 mbcache jbd2 xhci_plat_hcd xhci_hcd fusb302 tcpm aux_hpd_bridge drm dwc3 reset_gpio rk808_regulator udc_core typec ulpi fan53555 ghash_ce [ 234.159475] gpio_rockchip dwc3_of_simple gf128mul pwm_regulator pwm_fan fixed gpio_keys phy_rockchip_inno_usb2 ohci_platform sdhci_of_arasan ehci_platform phy_rockchip_emmc phy_rockchip_pcie sdhci_pltfm io_domain ehci_hcd ohci_hcd sdhci usbcore dw_mmc_rockchip rockchip_dfi pwm_rockchip dw_mmc_pltfm dw_wdt spi_rockchip pl330 phy_rockchip_typec cqhci nvmem_rockchip_efuse dw_mmc usb_common i2c_rk3x autofs4 aes_ce_blk aes_neon_bs [ 234.170887] CPU: 1 UID: 0 PID: 50 Comm: kworker/1:1 Not tainted 7.2.12+deb14-arm64 #1 PREEMPTLAZY Debian 7.2.12-1 [ 234.171846] Hardware name: Pine64 RockPro64 v2.1 (DT) [ 234.172322] Workqueue: events_power_efficient gc_worker [nf_conntrack] [ 234.173021] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 234.173652] pc : gc_worker+0x13c/0x780 [nf_conntrack] [ 234.174191] lr : process_one_work+0x17c/0x4d8 [ 234.174600] sp : ffff800080313d40 [ 234.174905] x29: ffff800080313d40 x28: 0000000000003a98 x27: ffffcb2f7fce6a00 [ 234.175568] x26: 0000000000000064 x25: 0000000000000000 x24: 0000000000010000 [ 234.176238] x23: 000000000000fff0 x22: 00000000000124f7 x21: 000000000000b770 [ 234.176911] x20: ffffcb2f04df7968 x19: ffffcb2f04dfae08 x18: 0000000000000001 [ 234.177587] x17: 000000040044ffff x16: ffffcb2f7d51d7d0 x15: ffffcb2f7fcf2218 [ 234.178263] x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101 [ 234.178938] x11: 7f7f7f7f7f7f7f7f x10: feff736d64686268 x9 : 0000000000000038 [ 234.179613] x8 : 8080000000000000 x7 : ffffcb2f7fce6000 x6 : fefefefefefefeff [ 234.180291] x5 : ffff000000e44388 x4 : ffffcb2f04df7970 x3 : 0000000000010000 [ 234.180968] x2 : fffffffffffffff0 x1 : 0000000000000000 x0 : fffffffffffffff0 [ 234.181629] Call trace: [ 234.181862] gc_worker+0x13c/0x780 [nf_conntrack] (P) [ 234.182415] process_one_work+0x17c/0x4d8 [ 234.182790] worker_thread+0x194/0x2f8 [ 234.183139] kthread+0x134/0x150 [ 234.183445] ret_from_fork+0x10/0x20 [ 234.183787] Code: 37000a78 3940df00 9ba98800 8b000317 (b9400ae1) [ 234.184341] ---[ end trace 0000000000000000 ]---
[toc] | [prev] | [next] | [standalone]
| From | Uwe Kleine-König <ukleinek@debian.org> |
|---|---|
| Date | 2026-10-27 19:20 +0100 |
| Subject | Bug#1149525: invalid pointer in nf_conntrack |
| Message-ID | <NSTW9-8hpZ-3@gated-at.bofh.it> |
| In reply to | #94628 |
[Multipart message — attachments visible in raw view] — view raw
Control: forwarded 1149525 https://lore.kernel.org/netfilter-devel/auDhy6OW5SrGg3jv@monoceros
Hello,
this is about a bug report filed against the Debian 7.2.12 kernel. Further
context can be found at https://bugs.debian.org/1149525.
Note this is an arm64 machine, and the problem doesn't reproduce on 7.3.
On Mon, Oct 26, 2026 at 08:36:01AM +0100, Philip Dodd wrote:
> 7.2.12+deb14-arm64 is affected in the same way, reproduced by just loading
> the nf_conntrack module shortly after boot.
>
> After the failure:
> nf_conntrack module use count: 0
> net.netfilter.nf_conntrack_count: 0
> nf_conntrack hashsize: 65536
> /proc/sys/kernel/tainted: 128
>
> No nf_nat or xt_* modules were loaded.
>
> This time the fault occurred on CPU 1 rather than CPU 4. The faulting
> address is 0xfff8, with x24 again containing 0x10000.
>
> Trace :
>
> [ 234.152118] Unable to handle kernel paging request at virtual address 000000000000fff8
> [ 234.152884] Mem abort info:
> [ 234.153151] ESR = 0x0000000096000007
> [ 234.153502] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 234.153993] SET = 0, FnV = 0
> [ 234.154283] EA = 0, S1PTW = 0
> [ 234.154580] FSC = 0x07: level 3 translation fault
> [ 234.155031] Data abort info:
> [ 234.155302] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
> [ 234.155807] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 234.156343] GCS = 0, Overlay = 0, DirtyBit = 0
> [ 234.156774] user pgtable: 4k pages, 48-bit VAs, pgdp=000000000fdf4000
> [ 234.157367] [000000000000fff8] pgd=0800000010988403, p4d=0800000010988403, pud=0800000010987403, pmd=080000000d349403, pte=0000000000000000
> [ 234.158531] Internal error: Oops: 0000000096000007 [#1] SMP
> [ 234.159050] Modules linked in: nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 snd_soc_hdmi_codec snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd soundcore dw_hdmi_cec dw_hdmi_i2s_audio gpio_ir_recv hantro_vpu leds_gpio binfmt_misc rockchipdrm panfrost rockchip_vdec dw_hdmi_qp gpu_sched v4l2_jpeg dw_mipi_dsi rockchip_rga drm_shmem_helper dw_hdmi v4l2_vp9 v4l2_h264 videobuf2_dma_contig analogix_dp realtek v4l2_mem2mem videobuf2_dma_sg phy_package videobuf2_memops drm_dp_aux_bus ofpart videobuf2_v4l2 drm_display_helper videodev dwmac_rk spi_nor stmmac_platform rockchip_saradc cec rockchip_thermal stmmac mtd rc_core industrialio_triggered_buffer videobuf2_common drm_client_lib kfifo_buf coresight_cpu_debug drm_dma_helper coresight_etm4x mc industrialio pcs_xpcs drm_kms_helper coresight phylink cpufreq_dt evdev cfg80211 rfkill nf_tables dm_mod efi_pstore configfs ext4 crc16 mbcache jbd2 xhci_plat_hcd xhci_hcd fusb302 tcpm aux_hpd_bridge drm dwc3 reset_gpio rk808_regulator udc_core typec ulpi fan53555 ghash_ce
> [ 234.159475] gpio_rockchip dwc3_of_simple gf128mul pwm_regulator pwm_fan fixed gpio_keys phy_rockchip_inno_usb2 ohci_platform sdhci_of_arasan ehci_platform phy_rockchip_emmc phy_rockchip_pcie sdhci_pltfm io_domain ehci_hcd ohci_hcd sdhci usbcore dw_mmc_rockchip rockchip_dfi pwm_rockchip dw_mmc_pltfm dw_wdt spi_rockchip pl330 phy_rockchip_typec cqhci nvmem_rockchip_efuse dw_mmc usb_common i2c_rk3x autofs4 aes_ce_blk aes_neon_bs
> [ 234.170887] CPU: 1 UID: 0 PID: 50 Comm: kworker/1:1 Not tainted 7.2.12+deb14-arm64 #1 PREEMPTLAZY Debian 7.2.12-1
> [ 234.171846] Hardware name: Pine64 RockPro64 v2.1 (DT)
> [ 234.172322] Workqueue: events_power_efficient gc_worker [nf_conntrack]
> [ 234.173021] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 234.173652] pc : gc_worker+0x13c/0x780 [nf_conntrack]
> [ 234.174191] lr : process_one_work+0x17c/0x4d8
> [ 234.174600] sp : ffff800080313d40
> [ 234.174905] x29: ffff800080313d40 x28: 0000000000003a98 x27: ffffcb2f7fce6a00
> [ 234.175568] x26: 0000000000000064 x25: 0000000000000000 x24: 0000000000010000
> [ 234.176238] x23: 000000000000fff0 x22: 00000000000124f7 x21: 000000000000b770
> [ 234.176911] x20: ffffcb2f04df7968 x19: ffffcb2f04dfae08 x18: 0000000000000001
> [ 234.177587] x17: 000000040044ffff x16: ffffcb2f7d51d7d0 x15: ffffcb2f7fcf2218
> [ 234.178263] x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101
> [ 234.178938] x11: 7f7f7f7f7f7f7f7f x10: feff736d64686268 x9 : 0000000000000038
> [ 234.179613] x8 : 8080000000000000 x7 : ffffcb2f7fce6000 x6 : fefefefefefefeff
> [ 234.180291] x5 : ffff000000e44388 x4 : ffffcb2f04df7970 x3 : 0000000000010000
> [ 234.180968] x2 : fffffffffffffff0 x1 : 0000000000000000 x0 : fffffffffffffff0
> [ 234.181629] Call trace:
> [ 234.181862] gc_worker+0x13c/0x780 [nf_conntrack] (P)
> [ 234.182415] process_one_work+0x17c/0x4d8
> [ 234.182790] worker_thread+0x194/0x2f8
> [ 234.183139] kthread+0x134/0x150
> [ 234.183445] ret_from_fork+0x10/0x20
> [ 234.183787] Code: 37000a78 3940df00 9ba98800 8b000317 (b9400ae1)
> [ 234.184341] ---[ end trace 0000000000000000 ]---
The problematic code location is
if (nf_ct_is_expired(tmp)) {
in net/netfilter/nf_conntrack_core.c with
static inline bool nf_ct_is_expired(const struct nf_conn *ct)
{
return (__s32)(READ_ONCE(ct->timeout) - nfct_time_stamp) <= 0;
}
.
In assembly that is:
2f78: 9a812000 csel x0, x0, x1, cs // cs = hs, nlast
2f7c: cb1c0000 sub x0, x0, x28
2f80: 9ada0c00 sdiv x0, x0, x26
2f84: 8b00039c add x28, x28, x0
2f88: f94042e0 ldr x0, [x23, #128]
2f8c: 37180300 tbnz w0, #3, 2fec <gc_worker+0x184>
2f90: f9400318 ldr x24, [x24]
2f94: 37000a78 tbnz w24, #0, 30e0 <gc_worker+0x278>
2f98: 3940df00 ldrb w0, [x24, #55]
2f9c: 9ba98800 umsubl x0, w0, w9, x2
2fa0: 8b000317 add x23, x24, x0
* 2fa4: b9400ae1 ldr w1, [x23, #8]
2fa8: f940036b ldr x11, [x27]
I think the original issue was a few lines above (i.e.
ldrb w0, [x24, #55]), because the tripping address was 0000000000010037
(with 55 = 0x37). That is in nf_ct_tuplehash_to_ctrack(h).
All in all it looks like `h` is invalid.
Does that ring a bell? After starring at the code for a while I don't
spot the culprit. Also looking over the changes between 7.2.12 and 7.3
I don't spot a suspicious commit.
Best regards
Uwe
[toc] | [prev] | [next] | [standalone]
| From | Florian Westphal <fw@strlen.de> |
|---|---|
| Date | 2026-10-29 11:40 +0100 |
| Subject | Bug#1149525: invalid pointer in nf_conntrack |
| Message-ID | <NTvI5-8BqY-5@gated-at.bofh.it> |
| In reply to | #94648 |
Uwe Kleine-König <ukleinek@debian.org> wrote:
>
> this is about a bug report filed against the Debian 7.2.12 kernel. Further
> context can be found at https://bugs.debian.org/1149525.
>
> Note this is an arm64 machine, and the problem doesn't reproduce on 7.3.
>
> On Mon, Oct 26, 2026 at 08:36:01AM +0100, Philip Dodd wrote:
> > 7.2.12+deb14-arm64 is affected in the same way, reproduced by just loading
> > the nf_conntrack module shortly after boot.
> >
> > After the failure:
> > nf_conntrack module use count: 0
> > net.netfilter.nf_conntrack_count: 0
> > nf_conntrack hashsize: 65536
> > /proc/sys/kernel/tainted: 128
> >
> > No nf_nat or xt_* modules were loaded.
If thats the case, why is there a conntrack entry in the first place?
Is 'enable_hooks' modparam used?
If not, conntrack hooks are not registered so it cannot pick up
any entries (you need some rules configured that require conntrack
without that modparam on).
That would imply that hlist_nulls_for_each_entry_rcu() is causing loop
execution for an empty list.
> The problematic code location is
>
> if (nf_ct_is_expired(tmp)) {
>
> in net/netfilter/nf_conntrack_core.c with
>
> static inline bool nf_ct_is_expired(const struct nf_conn *ct)
> {
> return (__s32)(READ_ONCE(ct->timeout) - nfct_time_stamp) <= 0;
> }
>
> .
>
> In assembly that is:
>
> 2f78: 9a812000 csel x0, x0, x1, cs // cs = hs, nlast
> 2f7c: cb1c0000 sub x0, x0, x28
> 2f80: 9ada0c00 sdiv x0, x0, x26
> 2f84: 8b00039c add x28, x28, x0
> 2f88: f94042e0 ldr x0, [x23, #128]
> 2f8c: 37180300 tbnz w0, #3, 2fec <gc_worker+0x184>
> 2f90: f9400318 ldr x24, [x24]
> 2f94: 37000a78 tbnz w24, #0, 30e0 <gc_worker+0x278>
> 2f98: 3940df00 ldrb w0, [x24, #55]
> 2f9c: 9ba98800 umsubl x0, w0, w9, x2
> 2fa0: 8b000317 add x23, x24, x0
> * 2fa4: b9400ae1 ldr w1, [x23, #8]
> 2fa8: f940036b ldr x11, [x27]
>
> I think the original issue was a few lines above (i.e.
> ldrb w0, [x24, #55]), because the tripping address was 0000000000010037
> (with 55 = 0x37). That is in nf_ct_tuplehash_to_ctrack(h).
>
> All in all it looks like `h` is invalid.
Its a garbage address, yes.
> Does that ring a bell? After starring at the code for a while I don't
> spot the culprit. Also looking over the changes between 7.2.12 and 7.3
> I don't spot a suspicious commit.
Never seen this before.
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2026-10-27 19:20 +0100 |
| Subject | Processed: invalid pointer in nf_conntrack |
| Message-ID | <NSTW9-8hpZ-7@gated-at.bofh.it> |
| In reply to | #94270 |
Processing control commands: > forwarded 1149525 https://lore.kernel.org/netfilter-devel/auDhy6OW5SrGg3jv@monoceros Bug #1149525 [src:linux] linux: RockPro64 conntrack oops with 7.2.x Set Bug forwarded-to-address to 'https://lore.kernel.org/netfilter-devel/auDhy6OW5SrGg3jv@monoceros'. -- 1149525: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149525 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | Philip Dodd <orange.spyderman@gmail.com> |
|---|---|
| Date | 2026-10-29 10:20 +0100 |
| Subject | Bug#1149525: Debian package 7.3~rc7-1~exp1 not affected |
| Message-ID | <NTusF-8AOA-5@gated-at.bofh.it> |
| In reply to | #94270 |
As per the subject, and just for completion, the 7.3~rc7-1~exp1 package currently in experimental doesn't show this issue with nf_conntrack loaded (in the same way my own upstream 7.3 package didn't)
[toc] | [prev] | [next] | [standalone]
| From | Uwe Kleine-König <ukleinek@debian.org> |
|---|---|
| Date | 2026-10-30 08:50 +0100 |
| Subject | Bug#1149525: invalid pointer in nf_conntrack |
| Message-ID | <NTPx7-8LTc-1@gated-at.bofh.it> |
| In reply to | #94270 |
[Multipart message — attachments visible in raw view] — view raw
Hello Philip, On Fri, Oct 30, 2026 at 08:00:31AM +0100, Philip Dodd wrote: > On 29/10/2026 11:29, Florian Westphal wrote: > > Uwe Kleine-König <ukleinek@debian.org> wrote: > > > this is about a bug report filed against the Debian 7.2.12 kernel. Further > > > context can be found at https://bugs.debian.org/1149525. > > > > > > Note this is an arm64 machine, and the problem doesn't reproduce on 7.3. > > > > > > On Mon, Oct 26, 2026 at 08:36:01AM +0100, Philip Dodd wrote: > > > > 7.2.12+deb14-arm64 is affected in the same way, reproduced by just loading > > > > the nf_conntrack module shortly after boot. > > > > > > > > After the failure: > > > > nf_conntrack module use count: 0 > > > > net.netfilter.nf_conntrack_count: 0 > > > > nf_conntrack hashsize: 65536 > > > > /proc/sys/kernel/tainted: 128 > > > > > > > > No nf_nat or xt_* modules were loaded. > > If thats the case, why is there a conntrack entry in the first place? > > Is 'enable_hooks' modparam used? > > No, I'm not explicitly using |enable_hooks|. Simply running |sudo modprobe > nf_conntrack|is sufficient to trigger the oops. > > For context, I originally encountered the oops shortly after boot during > normal operation. I narrowed it down to occurring shortly after > |tailscaled|started, but subsequently found that even with Tailscale > disabled, simply loading |nf_conntrack|triggers the same oops almost > immediately; and since I've reproduced this on all the 7.2.x kernels I've > tested (the versions mentioned earlier in the Debian bug report), but also > kernels compiled directly from upstream sources. > > The same |modprobe nf_conntrack|command does not trigger the oops on 7.1.x > or 7.3.x kernels; Prior to upgrading to the first 7.2.x kernel, this host > had also been running Tailscale with |nf_conntrack|loaded for weeks (at > least) without any problems and yesterday, I installed the 7.3.x kernel > packages from Debian experimental and ran Tailscale for an extended period > without encountering any issues. Given that you know how to compile kernels for your machine, can you please test plain 7.2? Depending on that being good or bad, I'd ask you to do a bisection either between 7.2 and 7.2.12 (to find the breaking commit) or between 7.2 and 7.3 (to find the fixing commit). If you report the state of 7.2, I can prepare more detailed instruction for the bisect if needed. Thanks Uwe
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2026-10-30 22:20 +0100 |
| Subject | Bug#1149525: marked as done (linux: RockPro64 conntrack oops with 7.2.x) |
| Message-ID | <NU2aZ-8SMg-5@gated-at.bofh.it> |
| In reply to | #94270 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Fri, 30 Oct 2026 22:09:27 +0100 with message-id <auUFc76KW7-_u4R0@monoceros> and subject line Re: Bug#1149525: invalid pointer in nf_conntrack has caused the Debian Bug report #1149525, regarding linux: RockPro64 conntrack oops with 7.2.x to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1149525: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149525 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web