Bug 2227221

Summary: USB disconnect causes kernel crash
Product: [Fedora] Fedora Reporter: Dr J Austin <ja>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 38CC: acaringi, adscvr, airlied, alciregi, bskeggs, hdegoede, hpa, jarodwilson, josef, kernel-maint, lgoncalv, linville, masami256, mchehab, ptalbert, stanley.king, steved
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
journalctl output for kernels kernel-6.4.4-200.fc38.x86_64 & rawhide none

Description Dr J Austin 2023-07-28 11:35:21 UTC 
Created attachment 1980428 [details]
journalctl output for kernels kernel-6.4.4-200.fc38.x86_64 & rawhide

1. Please describe the problem:
When a KVM switch disconnects from a machine then "sometimes" the machine freezes
and required a physical power off.
The basic error is of the form
Jul 28 09:37:25 naxos.jaa.org.uk kernel: usb 4-2.1: USB disconnect, device number 5
Jul 28 09:37:25 naxos.jaa.org.uk kernel: usb 3-2.1: USB disconnect, device number 10
Jul 28 09:37:25 naxos.jaa.org.uk kernel: usb 3-2.1.4: USB disconnect, device number 11
Jul 28 09:37:25 naxos.jaa.org.uk kernel: BUG: unable to handle page fault for address: ffffa14dc8f5fa70
Jul 28 09:37:25 naxos.jaa.org.uk kernel: #PF: supervisor write access in kernel mode
Jul 28 09:37:25 naxos.jaa.org.uk kernel: #PF: error_code(0x0002) - not-present page


2. What is the Version-Release number of the kernel:
These kernels fail:
kernel-6.4.4-200.fc38.x86_64
kernel-6.4.6-200.fc38.x86_64

3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :

This one OK
kernel-6.3.11-200.fc38.x86_64

4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:
Yes - boot the failing kernel and switch back and forth to another machine
running a working kernel.
After 1, 2, 3, .. switches the faulty machine will freeze.
An existing ssh connection will be maintained from the "good" machine.
A new ssh connection is not possible.
shutdown -h now does not close the faulty machine cleanly.
A physical power off is required.

5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:
Yes, but appears to occur less often.
6.5.0-0.rc3.20230726git18b44bc5a672.25.fc39.x86_64

Additional core dumps are given
systemd-coredump[3643]: Process 3389 (xfce4-panel) of user 1000 dumped core.

6. Are you running any modules that not shipped with directly Fedora's kernel?:
No

7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.
Comment 1 Stan King 2023-08-07 22:28:19 UTC 
(I'm adding this comment to bugzillae 2227968 and 2227221, which appear to be duplicates of each other.)

I'm having this same problem, with very similar dmesg output, triggered by the USB disconnect that occurs when switching ports on a KVM switch that implements a USB hub to provide the connection to the keyboard and mouse.

It started with kernel kernel-6.4.4-200.fc38.x86_64 and persists with 6.4.7.

Kernel kernel-6.3.12-200.fc38.x86_64 is OK.

I see this on three of my systems, the newest of which has an Intel i5-11400 processor.
Two of my systems seem immune to this, the oldest of which has an Intel i7-3770 processor.

I'd be happy to try a debug kernel on my affected i7-8550U system, but I'd have to be stepped through the generation process.
Comment 2 Dr J Austin 2023-08-14 13:54:41 UTC 
The problem is still present in the following kernels
6.4.9-200.fc38.x86_64
6.4.10-200.fc38.x86_64

6.5.0-0.rc5.20230811git25aa0bebba72.40.fc40.x86_64

It took 6 "switches" to obtain a failure with 6.4.10-200

Aug 14 14:36:42 naxos.jaa.org.uk kernel: usb 4-2.1: USB disconnect, device number 9
Aug 14 14:36:42 naxos.jaa.org.uk kernel: usb 3-2.1: USB disconnect, device number 18
Aug 14 14:36:42 naxos.jaa.org.uk kernel: usb 3-2.1.4: USB disconnect, device number 19
Aug 14 14:36:42 naxos.jaa.org.uk kernel: BUG: unable to handle page fault for address: ffffac240e108458
Aug 14 14:36:42 naxos.jaa.org.uk kernel: #PF: supervisor write access in kernel mode
Aug 14 14:36:42 naxos.jaa.org.uk kernel: #PF: error_code(0x0002) - not-present page
Aug 14 14:36:42 naxos.jaa.org.uk kernel: PGD 100000067 P4D 100000067 PUD 10020f067 PMD 100e53067 PTE 0
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Oops: 0002 [#1] PREEMPT SMP PTI
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CPU: 3 PID: 719 Comm: kworker/3:3 Tainted: G          I        6.4.10-200.fc38.x86_64 #1
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z170 Gaming-ITX/ac, BIOS P7.30 01/23/2018
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Workqueue: usb_hub_wq hub_event
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Code: 75 4e 48 8b 13 48 83 7a 28 00 74 75 45 31 ff 31 c0 eb 10 48 8b 13 41 83 c7 01 49 63 c7 48 3b 42 28 73 5e 48 8b 52 20 8b 14 82 <f0> 48 0f ab 54 24 08 48 8b 13 4c 89 f1 4c 89 e6 48 89 ef 48 8b 52
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RSP: 0000:ffffac24006f77b8 EFLAGS: 00010297
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RAX: 0000000000000003 RBX: ffff8ede2ef7b800 RCX: ffff8ede06f39000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RDX: 000000006d0864e4 RSI: 00000000116d6407 RDI: ffff8ede2ef7b800
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RBP: ffff8ede2ef7b838 R08: 0000000000000007 R09: ffff8edec5999312
Aug 14 14:36:42 naxos.jaa.org.uk kernel: R10: ffffffffffffffff R11: 0000000000000000 R12: ffff8eddc5999000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: R13: 0000000000000000 R14: ffff8ede06f39000 R15: 0000000000000003
Aug 14 14:36:42 naxos.jaa.org.uk kernel: FS:  0000000000000000(0000) GS:ffff8ee1270c0000(0000) knlGS:0000000000000000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CR2: ffffac240e108458 CR3: 000000011716e002 CR4: 00000000003706e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Call Trace:
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  <TASK>
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? __die+0x23/0x70
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? page_fault_oops+0x171/0x4e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? exc_page_fault+0x175/0x180
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? asm_exc_page_fault+0x26/0x30
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? power_supply_uevent+0xee/0x1d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? power_supply_uevent+0x10d/0x1d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  dev_uevent+0x10f/0x2d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  kobject_uevent_env+0x291/0x680
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  power_supply_unregister+0x8e/0xa0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  release_nodes+0x3d/0xb0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  devres_release_all+0x8c/0xc0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_unbind_cleanup+0xe/0x70
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_release_driver_internal+0x1cc/0x200
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  bus_remove_device+0xc6/0x130
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_del+0x15c/0x3e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? __queue_work+0x1df/0x440
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  hid_destroy_device+0x4b/0x60
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  logi_dj_remove+0x9a/0x100 [hid_logitech_dj]
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  hid_device_remove+0x44/0x90
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_release_driver_internal+0x19f/0x200
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  bus_remove_device+0xc6/0x130
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_del+0x15c/0x3e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? __queue_work+0x1df/0x440
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  hid_destroy_device+0x4b/0x60
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  usbhid_disconnect+0x47/0x60
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  usb_unbind_interface+0x90/0x270
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_release_driver_internal+0x19f/0x200
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  bus_remove_device+0xc6/0x130
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  device_del+0x15c/0x3e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? kobject_put+0xa0/0x1d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  usb_disable_device+0xcd/0x1e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  usb_disconnect+0xde/0x2c0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  usb_disconnect+0xc3/0x2c0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  hub_event+0xf05/0x1ce0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? rps_work+0x72/0x2f0 [i915]
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  process_one_work+0x1c4/0x3d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  worker_thread+0x51/0x390
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? __pfx_worker_thread+0x10/0x10
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  kthread+0xe5/0x120
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ? __pfx_kthread+0x10/0x10
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  ret_from_fork+0x29/0x50
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  </TASK>
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Modules linked in: rfcomm snd_seq_dummy snd_hrtimer rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ppdev parport_pc parport vmw_vsock_vmci_transport vsock vmw_vmci ip_set nf_tables nfnetlink bnep nct6775 nct6775_core hwmon_vid b43 cordic mac80211 snd_soc_avs libarc4 snd_hda_codec_hdmi snd_soc_hda_codec snd_hda_ext_core cfg80211 snd_hda_codec_realtek snd_soc_core snd_hda_codec_generic ledtrig_audio intel_rapl_msr intel_rapl_common snd_compress ac97_bus intel_tcc_cooling snd_pcm_dmaengine snd_hda_intel x86_pkg_temp_thermal intel_powerclamp btusb coretemp btrtl kvm_intel snd_intel_dspcfg ssb btbcm btintel btmtk snd_intel_sdw_acpi snd_hda_codec bluetooth mmc_core kvm snd_hda_core snd_hwdep snd_seq snd_seq_device iTCO_wdt rfkill ee1004 intel_pmc_bxt irqbypass iTCO_vendor_support snd_pcm rapl snd_timer
Aug 14 14:36:42 naxos.jaa.org.uk kernel:  intel_cstate intel_uncore snd i2c_i801 bcma pcspkr vfat i2c_smbus soundcore fat intel_pch_thermal joydev acpi_pad loop zram hid_logitech_hidpp hid_logitech_dj i915 crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni drm_buddy polyval_generic i2c_algo_bit ghash_clmulni_intel nvme drm_display_helper e1000e nvme_core sha512_ssse3 cec nvme_common ttm video wmi sunrpc be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls cxgb3i cxgb3 mdio libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CR2: ffffac240e108458
Aug 14 14:36:42 naxos.jaa.org.uk kernel: ---[ end trace 0000000000000000 ]---
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0
Aug 14 14:36:42 naxos.jaa.org.uk kernel: Code: 75 4e 48 8b 13 48 83 7a 28 00 74 75 45 31 ff 31 c0 eb 10 48 8b 13 41 83 c7 01 49 63 c7 48 3b 42 28 73 5e 48 8b 52 20 8b 14 82 <f0> 48 0f ab 54 24 08 48 8b 13 4c 89 f1 4c 89 e6 48 89 ef 48 8b 52
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RSP: 0000:ffffac24006f77b8 EFLAGS: 00010297
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RAX: 0000000000000003 RBX: ffff8ede2ef7b800 RCX: ffff8ede06f39000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RDX: 000000006d0864e4 RSI: 00000000116d6407 RDI: ffff8ede2ef7b800
Aug 14 14:36:42 naxos.jaa.org.uk kernel: RBP: ffff8ede2ef7b838 R08: 0000000000000007 R09: ffff8edec5999312
Aug 14 14:36:42 naxos.jaa.org.uk kernel: R10: ffffffffffffffff R11: 0000000000000000 R12: ffff8eddc5999000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: R13: 0000000000000000 R14: ffff8ede06f39000 R15: 0000000000000003
Aug 14 14:36:42 naxos.jaa.org.uk kernel: FS:  0000000000000000(0000) GS:ffff8ee1270c0000(0000) knlGS:0000000000000000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 14 14:36:42 naxos.jaa.org.uk kernel: CR2: ffffac240e108458 CR3: 000000011716e002 CR4: 00000000003706e0
Aug 14 14:36:42 naxos.jaa.org.uk kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Aug 14 14:36:42 naxos.jaa.org.uk kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Aug 14 14:36:42 naxos.jaa.org.uk kernel: note: kworker/3:3[719] exited with irqs disabled
Aug 14 14:36:44 naxos.jaa.org.uk abrt-dump-journal-oops[1026]: abrt-dump-journal-oops: Found oopses: 1
Aug 14 14:36:44 naxos.jaa.org.uk abrt-dump-journal-oops[1026]: abrt-dump-journal-oops: Creating problem directories
Aug 14 14:36:44 naxos.jaa.org.uk abrt-server[3366]: Can't find a meaningful backtrace for hashing in '.'
Aug 14 14:36:44 naxos.jaa.org.uk abrt-server[3366]: Deleting non-reportable oops '.' because DropNotReportableOopses is set to 'yes'
Aug 14 14:36:44 naxos.jaa.org.uk abrt-server[3366]: 'post-create' on '/var/spool/abrt/oops-2023-08-14-14:36:44-1026-0' exited with 1
Aug 14 14:36:44 naxos.jaa.org.uk abrt-server[3366]: Deleting problem directory '/var/spool/abrt/oops-2023-08-14-14:36:44-1026-0'
Aug 14 14:36:44 naxos.jaa.org.uk abrt-server[3366]: Lock file '.lock' was locked by process 3378, but it crashed?
Aug 14 14:36:45 naxos.jaa.org.uk abrt-dump-journal-oops[1026]: Reported 1 kernel oopses to Abrt
Aug 14 14:37:48 naxos.jaa.org.uk systemd-logind[970]: The system will power off now!
Aug 14 14:37:48 naxos.jaa.org.uk systemd-logind[970]: System is powering down.