A race condition causes a kernel panic when unplugging the USB cable.

[Hugal31]

Description

Sometimes, when unplugging the USB cable while sending CAN packets, the module causes a kernel panic.

Journal attached

Mar 02 11:48:53.459664 lc-rc-02 kernel: usb 1-2: USB disconnect, device number 2
Mar 02 11:48:53.461890 lc-rc-02 kernel: ------------[ cut here ]------------
Mar 02 11:48:53.462051 lc-rc-02 kernel: refcount_t: underflow; use-after-free.
Mar 02 11:48:53.462203 lc-rc-02 kernel: WARNING: CPU: 0 PID: 5330 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
Mar 02 11:48:53.462414 lc-rc-02 kernel: Modules linked in: ccm can_raw can snd_hda_codec_realtek snd_hda_codec_generic joydev btusb btrtl btintel btbcm btmtk bluetooth hid_generic usbhid udt1cri_usb(OE) ecdh_generic cp210x can_dev ecc hid cdc_acm usbserial qrtr intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal binfmt_misc intel_powerclamp coretemp nls_iso8859_1 iwlmvm kvm_intel i915 mac80211 kvm snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi libarc4 snd_hda_codec irqbypass crct10dif_pclmul snd_hda_core crc32_pclmul polyval_clmulni drm_buddy snd_hwdep polyval_generic ttm mei_pxp mei_hdcp ghash_clmulni_intel cmdlinepart snd_pcm iwlwifi sha256_ssse3 drm_display_helper spi_nor cec snd_timer sha1_ssse3 ee1004 mtd intel_wmi_thunderbolt rapl wmi_bmof r8169 mei_me rc_core snd cfg80211 e1000e intel_cstate i2c_algo_bit realtek spi_intel_pci mei ahci i2c_i801 soundcore spi_intel xhci_pci i2c_smbus libahci xhci_pci_renesas video intel_pmc_core wmi intel_vsec pmt_telemetry pmt_class acpi_pad
Mar 02 11:48:53.463019 lc-rc-02 kernel:  acpi_tad mac_hid sch_fq_codel dm_multipath efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 nvme nvme_core nvme_auth aesni_intel crypto_simd cryptd
Mar 02 11:48:53.463154 lc-rc-02 kernel: CPU: 0 PID: 5330 Comm: ntrollerManager Tainted: G           OE      6.8.0-101-generic #101-Ubuntu
Mar 02 11:48:53.463327 lc-rc-02 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./H570M-ITX/ac, BIOS P1.00 01/11/2021
Mar 02 11:48:53.463440 lc-rc-02 kernel: RIP: 0010:refcount_warn_saturate+0xfb/0x150
Mar 02 11:48:53.463558 lc-rc-02 kernel: Code: eb 9a 0f b6 1d 36 eb 17 02 80 fb 01 0f 87 42 94 98 00 83 e3 01 75 85 48 c7 c7 20 92 4b ac c6 05 1a eb 17 02 01 e8 a5 d9 88 ff <0f> 0b e9 6b ff ff ff 0f b6 1d 08 eb 17 02 80 fb 01 0f 87 ff 93 98
Mar 02 11:48:53.464740 lc-rc-02 kernel: RSP: 0018:ffffcfe46037f688 EFLAGS: 00010246
Mar 02 11:48:53.464821 lc-rc-02 kernel: RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Mar 02 11:48:53.464879 lc-rc-02 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 11:48:53.464956 lc-rc-02 kernel: RBP: ffffcfe46037f690 R08: 0000000000000000 R09: 0000000000000000
Mar 02 11:48:53.465014 lc-rc-02 kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8be101372554
Mar 02 11:48:53.465077 lc-rc-02 kernel: R13: ffff8be120128000 R14: ffff8be10404da00 R15: ffff8be120128000
Mar 02 11:48:53.465127 lc-rc-02 kernel: FS:  0000700148f096c0(0000) GS:ffff8be45c400000(0000) knlGS:0000000000000000
Mar 02 11:48:53.465182 lc-rc-02 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 11:48:53.465244 lc-rc-02 kernel: CR2: 000000c002815000 CR3: 000000012b058005 CR4: 00000000003706f0
Mar 02 11:48:53.465300 lc-rc-02 kernel: Call Trace:
Mar 02 11:48:53.465363 lc-rc-02 kernel:  <TASK>
Mar 02 11:48:53.465419 lc-rc-02 kernel:  sock_wfree+0x11b/0x210
Mar 02 11:48:53.465477 lc-rc-02 kernel:  skb_release_head_state+0x24/0xb0
Mar 02 11:48:53.465527 lc-rc-02 kernel:  consume_skb+0x33/0xf0
Mar 02 11:48:53.465578 lc-rc-02 kernel:  udt1cri_usb_start_xmit+0x22d/0x340 [udt1cri_usb]
Mar 02 11:48:53.465669 lc-rc-02 kernel:  dev_hard_start_xmit+0x62/0x1e0
Mar 02 11:48:53.465733 lc-rc-02 kernel:  sch_direct_xmit+0x10b/0x350
Mar 02 11:48:53.465791 lc-rc-02 kernel:  __dev_xmit_skb+0x37e/0x5c0
Mar 02 11:48:53.465841 lc-rc-02 kernel:  __dev_queue_xmit+0x36b/0x740
Mar 02 11:48:53.465892 lc-rc-02 kernel:  ? _copy_from_iter+0x9d/0x590
Mar 02 11:48:53.465948 lc-rc-02 kernel:  ? check_heap_object+0x186/0x1e0
Mar 02 11:48:53.466004 lc-rc-02 kernel:  can_send+0x15f/0x2a0 [can]
Mar 02 11:48:53.466061 lc-rc-02 kernel:  raw_sendmsg+0x22b/0x3a0 [can_raw]
Mar 02 11:48:53.466117 lc-rc-02 kernel:  sock_write_iter+0x18e/0x1a0
Mar 02 11:48:53.466173 lc-rc-02 kernel:  vfs_write+0x3d2/0x470
Mar 02 11:48:53.466237 lc-rc-02 kernel:  ksys_write+0xc9/0x100
Mar 02 11:48:53.466293 lc-rc-02 kernel:  __x64_sys_write+0x19/0x30
Mar 02 11:48:53.466514 lc-rc-02 kernel:  x64_sys_call+0x7e/0x25a0
Mar 02 11:48:53.466584 lc-rc-02 kernel:  do_syscall_64+0x7f/0x180
Mar 02 11:48:53.466666 lc-rc-02 kernel:  ? sched_clock+0x10/0x30
Mar 02 11:48:53.466730 lc-rc-02 kernel:  ? __smp_call_single_queue+0x44/0x180
Mar 02 11:48:53.466787 lc-rc-02 kernel:  ? ttwu_queue_wakelist+0x135/0x1c0
Mar 02 11:48:53.466843 lc-rc-02 kernel:  ? try_to_wake_up+0x11b/0x640
Mar 02 11:48:53.466900 lc-rc-02 kernel:  ? wake_up_q+0x50/0xa0
Mar 02 11:48:53.466970 lc-rc-02 kernel:  ? futex_wake+0x167/0x190
Mar 02 11:48:53.467021 lc-rc-02 kernel:  ? do_futex+0x18e/0x260
Mar 02 11:48:53.467085 lc-rc-02 kernel:  ? __x64_sys_futex+0x12a/0x200
Mar 02 11:48:53.467136 lc-rc-02 kernel:  ? nohz_balance_exit_idle+0xd6/0x100
Mar 02 11:48:53.467188 lc-rc-02 kernel:  ? arch_exit_to_user_mode_prepare.isra.0+0x1a/0xe0
Mar 02 11:48:53.467244 lc-rc-02 kernel:  ? syscall_exit_to_user_mode+0x43/0x1e0
Mar 02 11:48:53.467305 lc-rc-02 kernel:  ? do_syscall_64+0x8c/0x180
Mar 02 11:48:53.467362 lc-rc-02 kernel:  ? scheduler_tick+0x158/0x390
Mar 02 11:48:53.467427 lc-rc-02 kernel:  ? update_process_times+0x8e/0xb0
Mar 02 11:48:53.467486 lc-rc-02 kernel:  ? tick_sched_handle+0x32/0x70
Mar 02 11:48:53.467539 lc-rc-02 kernel:  ? timerqueue_add+0xa6/0xd0
Mar 02 11:48:53.467595 lc-rc-02 kernel:  ? ktime_get+0x45/0xc0
Mar 02 11:48:53.474829 lc-rc-02 kernel:  ? __pfx_tick_nohz_highres_handler+0x10/0x10
Mar 02 11:48:53.474880 lc-rc-02 kernel:  ? lapic_next_deadline+0x2c/0x50
Mar 02 11:48:53.474920 lc-rc-02 kernel:  ? clockevents_program_event+0xbe/0x150
Mar 02 11:48:53.474960 lc-rc-02 kernel:  ? tick_program_event+0x43/0xa0
Mar 02 11:48:53.474996 lc-rc-02 kernel:  ? hrtimer_interrupt+0x11f/0x250
Mar 02 11:48:53.475043 lc-rc-02 kernel:  ? arch_exit_to_user_mode_prepare.isra.0+0x1a/0xe0
Mar 02 11:48:53.475082 lc-rc-02 kernel:  ? irqentry_exit_to_user_mode+0x38/0x1e0
Mar 02 11:48:53.475122 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.475161 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.475197 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.475231 lc-rc-02 kernel:  entry_SYSCALL_64_after_hwframe+0x78/0x80
Mar 02 11:48:53.475275 lc-rc-02 kernel: RIP: 0033:0x7001c131c5dd
Mar 02 11:48:53.475315 lc-rc-02 kernel: Code: e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 88 bf f7 ff 48 8b 55 e8 48 8b 75 f0 41 89 c0 8b 7d f8 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 45 f8 e8 df bf f7 ff 48 8b
Mar 02 11:48:53.475353 lc-rc-02 kernel: RSP: 002b:0000700148f08870 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
Mar 02 11:48:53.475398 lc-rc-02 kernel: RAX: ffffffffffffffda RBX: 00005895a0cc67a0 RCX: 00007001c131c5dd
Mar 02 11:48:53.475438 lc-rc-02 kernel: RDX: 0000000000000010 RSI: 0000700148f08900 RDI: 0000000000000052
Mar 02 11:48:53.475477 lc-rc-02 kernel: RBP: 0000700148f08890 R08: 0000000000000000 R09: 0000000000000000
Mar 02 11:48:53.475519 lc-rc-02 kernel: R10: 0000000000000000 R11: 0000000000000293 R12: 0000700130000be0
Mar 02 11:48:53.475562 lc-rc-02 kernel: R13: 00005895a0691c38 R14: 0000700148f08900 R15: 0000700130000bd0
Mar 02 11:48:53.475601 lc-rc-02 kernel:  </TASK>
Mar 02 11:48:53.475660 lc-rc-02 kernel: ---[ end trace 0000000000000000 ]---
Mar 02 11:48:53.475703 lc-rc-02 kernel: ------------[ cut here ]------------
Mar 02 11:48:53.475733 lc-rc-02 kernel: refcount_t: saturated; leaking memory.
Mar 02 11:48:53.475776 lc-rc-02 kernel: WARNING: CPU: 0 PID: 5330 at lib/refcount.c:22 refcount_warn_saturate+0x148/0x150
Mar 02 11:48:53.475816 lc-rc-02 kernel: Modules linked in: ccm can_raw can snd_hda_codec_realtek snd_hda_codec_generic joydev btusb btrtl btintel btbcm btmtk bluetooth hid_generic usbhid udt1cri_usb(OE) ecdh_generic cp210x can_dev ecc hid cdc_acm usbserial qrtr intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal binfmt_misc intel_powerclamp coretemp nls_iso8859_1 iwlmvm kvm_intel i915 mac80211 kvm snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi libarc4 snd_hda_codec irqbypass crct10dif_pclmul snd_hda_core crc32_pclmul polyval_clmulni drm_buddy snd_hwdep polyval_generic ttm mei_pxp mei_hdcp ghash_clmulni_intel cmdlinepart snd_pcm iwlwifi sha256_ssse3 drm_display_helper spi_nor cec snd_timer sha1_ssse3 ee1004 mtd intel_wmi_thunderbolt rapl wmi_bmof r8169 mei_me rc_core snd cfg80211 e1000e intel_cstate i2c_algo_bit realtek spi_intel_pci mei ahci i2c_i801 soundcore spi_intel xhci_pci i2c_smbus libahci xhci_pci_renesas video intel_pmc_core wmi intel_vsec pmt_telemetry pmt_class acpi_pad
Mar 02 11:48:53.475899 lc-rc-02 kernel:  acpi_tad mac_hid sch_fq_codel dm_multipath efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 nvme nvme_core nvme_auth aesni_intel crypto_simd cryptd
Mar 02 11:48:53.475940 lc-rc-02 kernel: CPU: 0 PID: 5330 Comm: ntrollerManager Tainted: G        W  OE      6.8.0-101-generic #101-Ubuntu
Mar 02 11:48:53.475986 lc-rc-02 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./H570M-ITX/ac, BIOS P1.00 01/11/2021
Mar 02 11:48:53.476023 lc-rc-02 kernel: RIP: 0010:refcount_warn_saturate+0x148/0x150
Mar 02 11:48:53.476062 lc-rc-02 kernel: Code: f0 91 4b ac c6 05 e8 ea 17 02 01 e8 72 d9 88 ff 0f 0b e9 38 ff ff ff 48 c7 c7 c8 91 4b ac c6 05 cf ea 17 02 01 e8 58 d9 88 ff <0f> 0b e9 1e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
Mar 02 11:48:53.476111 lc-rc-02 kernel: RSP: 0018:ffffcfe46037fae0 EFLAGS: 00010246
Mar 02 11:48:53.476157 lc-rc-02 kernel: RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Mar 02 11:48:53.476193 lc-rc-02 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
Mar 02 11:48:53.476230 lc-rc-02 kernel: RBP: ffffcfe46037fae8 R08: 0000000000000000 R09: 0000000000000000
Mar 02 11:48:53.476269 lc-rc-02 kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8be101372400
Mar 02 11:48:53.476312 lc-rc-02 kernel: R13: 7fffffffffffffff R14: ffff8be101372400 R15: 0000000000000000
Mar 02 11:48:53.476357 lc-rc-02 kernel: FS:  0000700148f096c0(0000) GS:ffff8be45c400000(0000) knlGS:0000000000000000
Mar 02 11:48:53.476393 lc-rc-02 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 02 11:48:53.476429 lc-rc-02 kernel: CR2: 000000c002815000 CR3: 000000012b058005 CR4: 00000000003706f0
Mar 02 11:48:53.476469 lc-rc-02 kernel: Call Trace:
Mar 02 11:48:53.476499 lc-rc-02 kernel:  <TASK>
Mar 02 11:48:53.476533 lc-rc-02 kernel:  skb_set_owner_w+0xe8/0x110
Mar 02 11:48:53.476572 lc-rc-02 kernel:  sock_alloc_send_pskb+0x219/0x250
Mar 02 11:48:53.476613 lc-rc-02 kernel:  ? __smp_call_single_queue+0x44/0x180
Mar 02 11:48:53.476669 lc-rc-02 kernel:  raw_sendmsg+0xab/0x3a0 [can_raw]
Mar 02 11:48:53.476707 lc-rc-02 kernel:  sock_write_iter+0x18e/0x1a0
Mar 02 11:48:53.476741 lc-rc-02 kernel:  vfs_write+0x3d2/0x470
Mar 02 11:48:53.476777 lc-rc-02 kernel:  ksys_write+0xc9/0x100
Mar 02 11:48:53.476816 lc-rc-02 kernel:  __x64_sys_write+0x19/0x30
Mar 02 11:48:53.476851 lc-rc-02 kernel:  x64_sys_call+0x7e/0x25a0
Mar 02 11:48:53.476886 lc-rc-02 kernel:  do_syscall_64+0x7f/0x180
Mar 02 11:48:53.476921 lc-rc-02 kernel:  ? update_process_times+0x8e/0xb0
Mar 02 11:48:53.476964 lc-rc-02 kernel:  ? tick_sched_handle+0x32/0x70
Mar 02 11:48:53.477000 lc-rc-02 kernel:  ? timerqueue_add+0xa6/0xd0
Mar 02 11:48:53.477035 lc-rc-02 kernel:  ? ktime_get+0x45/0xc0
Mar 02 11:48:53.477070 lc-rc-02 kernel:  ? __pfx_tick_nohz_highres_handler+0x10/0x10
Mar 02 11:48:53.477105 lc-rc-02 kernel:  ? lapic_next_deadline+0x2c/0x50
Mar 02 11:48:53.477142 lc-rc-02 kernel:  ? clockevents_program_event+0xbe/0x150
Mar 02 11:48:53.477172 lc-rc-02 kernel:  ? tick_program_event+0x43/0xa0
Mar 02 11:48:53.477307 lc-rc-02 kernel:  ? hrtimer_interrupt+0x11f/0x250
Mar 02 11:48:53.477349 lc-rc-02 kernel:  ? arch_exit_to_user_mode_prepare.isra.0+0x1a/0xe0
Mar 02 11:48:53.477379 lc-rc-02 kernel:  ? irqentry_exit_to_user_mode+0x38/0x1e0
Mar 02 11:48:53.477412 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.477446 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.477474 lc-rc-02 kernel:  ? clear_bhb_loop+0x30/0x80
Mar 02 11:48:53.477508 lc-rc-02 kernel:  entry_SYSCALL_64_after_hwframe+0x78/0x80
Mar 02 11:48:53.477543 lc-rc-02 kernel: RIP: 0033:0x7001c131c5dd
Mar 02 11:48:53.477577 lc-rc-02 kernel: Code: e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 88 bf f7 ff 48 8b 55 e8 48 8b 75 f0 41 89 c0 8b 7d f8 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 45 f8 e8 df bf f7 ff 48 8b
Mar 02 11:48:53.477614 lc-rc-02 kernel: RSP: 002b:0000700148f08870 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
Mar 02 11:48:53.477657 lc-rc-02 kernel: RAX: ffffffffffffffda RBX: 00005895a0cc67a0 RCX: 00007001c131c5dd
Mar 02 11:48:53.477699 lc-rc-02 kernel: RDX: 0000000000000010 RSI: 0000700148f08900 RDI: 0000000000000052
Mar 02 11:48:53.477729 lc-rc-02 kernel: RBP: 0000700148f08890 R08: 0000000000000000 R09: 0000000000000000
Mar 02 11:48:53.483796 lc-rc-02 kernel: R10: 0000000000000000 R11: 0000000000000293 R12: 0000700130000be0
Mar 02 11:48:53.483829 lc-rc-02 kernel: R13: 00005895a0691c38 R14: 0000700148f08900 R15: 0000700130000bd0
Mar 02 11:48:53.483855 lc-rc-02 kernel:  </TASK>
Mar 02 11:48:53.483909 lc-rc-02 kernel: ---[ end trace 0000000000000000 ]---
Mar 02 11:48:53.483933 lc-rc-02 kernel: ------------[ cut here ]------------
Mar 02 11:48:53.483953 lc-rc-02 kernel: kernel BUG at mm/slub.c:553!

How to reproduce

1. Run while true; cansend can0 '1F334455#1122334455667788'; end
2. Plug & unplug the USB cable until the kernel panic.

Info

Module version: fe34150 (commit of the 8 of Nov, 2022).
Linux version: Linux myNux 6.8.0-101-generic #101-Ubuntu SMP PREEMPT_DYNAMIC Mon Feb 9 10:15:05 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux