Open ishland opened 11 months ago
zeek-zag
commented
11 months ago Seems like it happens on other distros too. Encountered this bug 3 times already. Once on 6.3.7 and twice on 6.3.9.
ishland
commented
11 months ago This time it crashed at system startup for kernel 6.4.2-surface. The kernel log is mostly the same: dmesg.txt
StollD
commented
11 months ago Could you try out if this commit and see if it fixes the issue? https://github.com/linux-surface/intel-precise-touch/commit/0e9e07d096efb57e3719441d5e8c03b9d50de7ba
You need to clone the ipts repo, check out the disable-hid-on-stop branch, build the module and then load it. For this to work, you must disable secureboot. You also must install the package that provides kernel headers on your distribution (kernel-surface-devel on Fedora, linux-surface-headers on Arch and linux-headers-surface on Debian).
$ git clone https://github.com/linux-surface/intel-precise-touch
$ cd intel-precise-touch
$ git checkout disable-hid-on-stop
$ make
$ sudo rmmod ipts
$ sudo insmod src/ipts.koMy system went straight into kdump when that revision of ipts loaded.
... truncated
[ 496.900369] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Stopping IPTS
[ 502.454193] ipts: loading out-of-tree module taints kernel.
[ 502.468179] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Starting IPTS
[ 502.470058] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: IPTS EDS Version: 1
[ 502.472657] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: IPTS running in event mode
[ 502.473046] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to add HID device: -19
[ 502.516040] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to initialize HID device: -19
[ 502.516063] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to start IPTS: -19
[ 502.523823] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 502.523845] #PF: supervisor read access in kernel mode
[ 502.523857] #PF: error_code(0x0000) - not-present page
[ 502.523867] PGD 0 P4D 0
[ 502.523883] Oops: 0000 [#1] PREEMPT SMP PTI
[ 502.523899] CPU: 1 PID: 7553 Comm: ipts_event Kdump: loaded Tainted: G C O 6.4.2-surface #1
[ 502.523918] Hardware name: Microsoft Corporation Surface Pro/Surface Pro, BIOS 238.167.768 05.07.2014
[ 502.523927] RIP: 0010:ipts_mei_search+0x5f/0x160 [ipts]
[ 502.523971] Code: 48 89 c7 48 89 45 d0 4d 8d 77 08 e8 fb 6e e3 ca 49 8b 5f 08 4c 39 f3 75 11 e9 e1 00 00 00 48 8b 1b 4c 39 f3 0f 84 d5 00 00 00 <44> 39 6b 10 75 ee 48 8b 7d d0 e8 72 41 0d ca 4c 39 f3 0f 84 c6 00
[ 502.523986] RSP: 0018:ffffb9af67537d78 EFLAGS: 00010213
[ 502.524001] RAX: ffff95a5d0724e01 RBX: 0000000000000000 RCX: 0000000000000000
[ 502.524012] RDX: ffff95a5d0724e00 RSI: 0000000000000100 RDI: ffff95a3d0dd9860
[ 502.524023] RBP: ffffb9af67537da8 R08: 0000007500c0d52a R09: 0000000000000000
[ 502.524033] R10: 0000000000000080 R11: 0000000000000000 R12: ffffb9af67537e50
[ 502.524043] R13: 0000000080000005 R14: ffff95a3d0dd9838 R15: ffff95a3d0dd9830
[ 502.524054] FS: 0000000000000000(0000) GS:ffff95a627480000(0000) knlGS:0000000000000000
[ 502.524069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 502.524082] CR2: 0000000000000010 CR3: 000000016d232002 CR4: 00000000003706e0
[ 502.524094] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 502.524104] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 502.524115] Call Trace:
[ 502.524124] <TASK>
[ 502.524138] ? show_regs+0x68/0x70
[ 502.524160] ? __die_body+0x20/0x70
[ 502.524178] ? __die+0x2b/0x40
[ 502.524194] ? page_fault_oops+0x154/0x4a0
[ 502.524221] ? do_user_addr_fault+0x434/0x7b0
[ 502.524239] ? update_load_avg+0x82/0x760
[ 502.524260] ? psi_group_change+0x1a5/0x390
[ 502.524281] ? exc_page_fault+0x79/0x180
[ 502.524306] ? asm_exc_page_fault+0x27/0x30
[ 502.524342] ? ipts_mei_search+0x5f/0x160 [ipts]
[ 502.524381] ? ipts_mei_search+0x45/0x160 [ipts]
[ 502.524414] ? __pfx_ipts_thread_runner+0x10/0x10 [ipts]
[ 502.524450] ipts_mei_recv+0x123/0x150 [ipts]
[ 502.524481] ? hrtimer_try_to_cancel+0x2c/0x110
[ 502.524502] ? __pfx_ipts_thread_runner+0x10/0x10 [ipts]
[ 502.524539] ipts_cmd_recv_timeout+0x30/0x90 [ipts]
[ 502.524576] ipts_control_wait_data+0x46/0xd0 [ipts]
[ 502.524616] ipts_receiver_event_loop+0xbb/0x230 [ipts]
[ 502.524650] ipts_thread_runner+0x1f/0x50 [ipts]
[ 502.524681] kthread+0xf7/0x130
[ 502.524697] ? __pfx_kthread+0x10/0x10
[ 502.524713] ret_from_fork+0x29/0x50
[ 502.524736] </TASK>
[ 502.524743] Modules linked in: ipts(O) tls uhid rfcomm xt_connmark xt_mark iptable_mangle xt_comment iptable_raw bpfilter wireguard curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305_x86_64 libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_nat veth xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo br_netfilter nft_masq nft_chain_nat nf_nat qrtr bridge stp llc overlay cmac algif_hash algif_skcipher af_alg bnep zstd btusb btrtl btbcm btintel btmtk bluetooth ecdh_generic ecc input_leds snd_sof_pci_intel_skl snd_sof_intel_hda_common soundwire_intel soundwire_cadence snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof ip6t_REJECT snd_sof_utils nf_reject_ipv6 soundwire_generic_allocation soundwire_bus xt_hl snd_soc_avs ip6t_rt snd_soc_hda_codec snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core ipt_REJECT snd_soc_sst_ipc nf_reject_ipv4 intel_tcc_cooling snd_soc_sst_dsp xt_LOG x86_pkg_temp_thermal snd_hda_codec_hdmi
[ 502.525102] hid_multitouch snd_soc_acpi_intel_match nf_log_syslog intel_powerclamp snd_soc_acpi coretemp xt_multiport snd_soc_core kvm_intel snd_hda_codec_realtek nft_limit snd_compress snd_hda_codec_generic kvm ledtrig_audio ac97_bus snd_pcm_dmaengine xt_limit snd_hda_intel xt_addrtype irqbypass snd_intel_dspcfg xt_tcpudp crct10dif_pclmul polyval_clmulni polyval_generic xt_conntrack ghash_clmulni_intel nf_conntrack sha512_ssse3 snd_intel_sdw_acpi aesni_intel snd_hda_codec nf_defrag_ipv6 joydev crypto_simd nf_defrag_ipv4 dw9719 snd_hda_core snd_hwdep hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_als hid_sensor_rotation cryptd surface_platform_profile rapl nft_compat mei_pxp snd_pcm mei_hdcp hid_sensor_trigger platform_profile ipu3_imgu(C) ipu3_cio2 intel_rapl_msr binfmt_misc intel_cstate processor_thermal_device_pci_legacy nf_tables processor_thermal_device mwifiex_pcie surface_gpe snd_timer industrialio_triggered_buffer gpio_keys ov7251 videobuf2_dma_sg ov5693 ov8865 tcp_bbr pcspkr nfnetlink
[ 502.525353] processor_thermal_rfim kfifo_buf snd videobuf2_memops mwifiex v4l2_fwnode mei_me intel_skl_int3472_tps68470 tps68470_regulator processor_thermal_mbox hid_sensor_iio_common soundcore videobuf2_v4l2 8250_dw v4l2_async mei processor_thermal_rapl clk_tps68470 msr cfg80211 industrialio videobuf2_common nls_iso8859_1 videodev intel_pch_thermal intel_rapl_common parport_pc intel_xhci_usb_role_switch intel_soc_dts_iosf mc intel_skl_int3472_discrete ppdev int3403_thermal lp int3400_thermal surfacepro3_button surface_acpi_notify surface_aggregator_registry int340x_thermal_zone dptf_power acpi_thermal_rel acpi_pad soc_button_array acpi_tad mac_hid parport efi_pstore dmi_sysfs ip_tables x_tables autofs4 btrfs xor raid6_pq libcrc32c hid_sensor_hub hid_generic uas usbhid intel_ishtp_hid usb_storage hid i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper syscopyarea sysfillrect nvme intel_lpss_pci sysimgblt nvme_core intel_ish_ipc intel_lpss drm xhci_pci crc32_pclmul video intel_ishtp
[ 502.525587] nvme_common idma64 xhci_pci_renesas wmi pinctrl_sunrisepoint surface_aggregator [last unloaded: ipts]
[ 502.525618] CR2: 0000000000000010Looks like it might have solved the problem on Fedora though. I haven't seen a single kernel panic during shutdown so far. Gonna test it for a few more days.
StollD
commented
11 months ago My system went straight into kdump when that revision of ipts loaded.
I am not quite sure why it dereferences an invalid pointer, but I hope that fixing the error that was printed before will also fix that. I updated the commit on my branch, so please try it again. Since I force pushed, you need to run these commands:
$ git fetch
$ git reset --hard origin/disable-hid-on-stopIt appears to be loaded just fine and it did not panic during shutdown. I'm going to daily drive with this module for a few days and see if it happens again.
ishland
commented
11 months ago There are some errors in the system log during shutdown last night. It did not panic but this might worth noting:
But that did not happen on another reboot attempt.
ishland
commented
11 months ago There are no panics so far, but today the touchscreen have completely stopped working.
Jul 15 07:26:02 <hostname> kernel: ipts: loading out-of-tree module taints kernel.
Jul 15 07:26:02 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Starting IPTS
Jul 15 07:26:02 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: IPTS EDS Version: 1
Jul 15 07:26:02 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: IPTS running in event mode
Jul 15 07:26:03 <hostname> systemd[1]: Created slice system-iptsd.slice - Slice /system/iptsd.
Jul 15 07:26:06 <hostname> systemd[1]: Started iptsd@dev-hidraw0.service - Intel Precise Touch & Stylus Daemon.
Jul 15 07:26:06 <hostname> iptsd[1018]: [07:26:06.454] [info] Connected to device 045E:001F
Jul 15 07:26:06 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Stopping IPTS
Jul 15 07:26:07 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: QUIESCE_IO: recv failed: -11
Jul 15 07:26:07 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to wait for flush: -11
Jul 15 07:26:07 <hostname> kernel: bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
Jul 15 07:26:08 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Starting IPTS
Jul 15 07:26:09 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: GET_DEVICE_INFO: recv failed: -11
Jul 15 07:26:09 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to get device info: -11
Jul 15 07:26:09 <hostname> kernel: ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Failed to switch modes: -11
Jul 15 07:26:09 <hostname> iptsd[1018]: [07:26:09.645] [error] Resource temporarily unavailable
Jul 15 07:26:09 <hostname> systemd[1]: iptsd@dev-hidraw0.service: Main process exited, code=exited, status=1/FAILURE
Jul 15 07:26:09 <hostname> systemd[1]: iptsd@dev-hidraw0.service: Failed with result 'exit-code'.Reloading the module fixes the problem.
StollD
commented
11 months ago Both these errors are the same: The hardware starts to time out when it is shut down. And this also seems to affect restarting it again.
I dont really know what could cause this. But you could try changing this line https://github.com/linux-surface/intel-precise-touch/blob/master/src/control.c#L211 to:
ret = ipts_cmd_recv_timeout(ipts, IPTS_CMD_QUIESCE_IO, &rsp, 10000);That will make the driver wait 10 seconds for the response instead of just one.
ishland
commented
10 months ago The issue still exists but it is a lot rarer than before. Only happened once after that single-line change.
But this looks like a separate issue. The system runs smoothly without any panics in the last 2 weeks with the replaced ipts module.
ishland
commented
5 months ago I redid my installation to use full disk encryption months ago and haven't been able to use the dkms module, since there isn't a good way to pair shim and systemd-boot in debian.
The above issue just happened again yesterday with the builtin ipts when I explicitly restart the iptsd service, but reinserting the module doesn't help. Only suspend then resume fixes this.
ishland
commented
4 months ago The original problem happened again on my machine:
ishland
commented
1 month ago The problem has been happening randomly recently for at least 5 times in 2 weeks.
zeek-zag
commented
1 month ago It started happening to me too again, fresh install of Fedora 40 KDE. Same device as before, Surface Book 2 (no dgpu), kernel 6.8.8-1, secure boot off. Shutdown freezes shortly after iptsd@dev-hidraw2.service hangs and I have to force it with a power button. Happens every 2-3 boots.
Issue #1423 might also be related.
Description of the bug or feature
As the title says, but this only happened once. Possible use-after-free?
Environment
Linux SurfacePro-6846 6.3.7-surface #1 SMP PREEMPT_DYNAMIC Wed Jun 14 12:57:39 UTC 2023 x86_64 GNU/Linux`dmesg` output
[dmesg.txt](https://github.com/linux-surface/linux-surface/files/11988807/dmesg.txt) ``` ... truncated, see attached file for full dmesg [ 23.291185] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping [ 23.292266] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping [ 23.293346] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping [ 23.294473] surface_serial_hub serial0-0: rx: parser: invalid start of frame, skipping [ 23.304661] dptf_power INT3407:00: Unsupported event [0x82] [ 312.066874] warning: `kded5' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 317.815595] Bluetooth: RFCOMM TTY layer initialized [ 317.815619] Bluetooth: RFCOMM socket layer initialized [ 317.815638] Bluetooth: RFCOMM ver 1.11 [ 320.539537] audit: type=1400 audit(1688735077.901:49): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/system/node/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 320.541239] audit: type=1400 audit(1688735077.905:50): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/home/ishland/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 [ 320.541650] audit: type=1400 audit(1688735077.905:51): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/bus/nd/devices/" pid=4960 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 320.741156] audit: type=1400 audit(1688735078.104:52): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/system/node/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 320.741584] audit: type=1400 audit(1688735078.104:53): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/home/ishland/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 [ 320.741605] audit: type=1400 audit(1688735078.104:54): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/bus/nd/devices/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 320.962424] audit: type=1400 audit(1688735078.324:55): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/block/" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 321.001830] audit: type=1400 audit(1688735078.364:56): apparmor="DENIED" operation="open" class="file" profile="mariadbd_akonadi" name="/sys/devices/pci0000:00/0000:00:1d.0/0000:02:00.0/nvme/nvme0/nvme0n1/queue/physical_block_size" pid=4968 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 [ 3966.439837] hid-generic 0005:045E:0921.0004: item fetching failed at offset 43/44 [ 3966.439850] hid-generic: probe of 0005:045E:0921.0004 failed with error -22 [ 4203.091503] hid-generic 0005:045E:0921.0005: item fetching failed at offset 43/44 [ 4203.091522] hid-generic: probe of 0005:045E:0921.0005 failed with error -22 [ 4869.902978] hid-generic 0005:045E:0921.0006: item fetching failed at offset 43/44 [ 4869.902998] hid-generic: probe of 0005:045E:0921.0006 failed with error -22 [ 5370.147697] hid-generic 0005:045E:0921.0007: item fetching failed at offset 43/44 [ 5370.147735] hid-generic: probe of 0005:045E:0921.0007 failed with error -22 [ 5644.721181] hid-generic 0005:045E:0921.0008: item fetching failed at offset 43/44 [ 5644.721238] hid-generic: probe of 0005:045E:0921.0008 failed with error -22 [10844.874897] audit: type=1400 audit(1688745601.983:57): apparmor="DENIED" operation="capable" class="cap" profile="/usr/sbin/cupsd" pid=15742 comm="cupsd" capability=12 capname="net_admin" [12436.682599] ipts 0000:00:16.4-3e8d0870-271a-4208-8eb5-9acb9402ae04: Stopping IPTS [12436.696060] ------------[ cut here ]------------ [12436.696067] refcount_t: addition on 0; use-after-free. [12436.696081] WARNING: CPU: 1 PID: 1049 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0x110 [12436.696093] Modules linked in: uhid rfcomm tls snd_seq_dummy snd_hrtimer snd_seq snd_seq_device xt_nat veth xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo br_netfilter nft_masq nft_chain_nat nf_nat bridge stp llc qrtr overlay cmac algif_hash algif_skcipher af_alg bnep zstd btusb btrtl btbcm btintel btmtk bluetooth ecdh_generic ecc snd_sof_pci_intel_skl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence input_leds snd_sof_intel_hda snd_sof_pci ip6t_REJECT snd_sof_xtensa_dsp nf_reject_ipv6 snd_sof xt_hl snd_sof_utils ip6_tables soundwire_bus intel_tcc_cooling ip6t_rt x86_pkg_temp_thermal snd_soc_avs intel_powerclamp snd_soc_hda_codec coretemp snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core kvm_intel snd_soc_sst_ipc ipt_REJECT nf_reject_ipv4 snd_soc_sst_dsp kvm hid_multitouch xt_LOG snd_soc_acpi_intel_match nf_log_syslog snd_soc_acpi snd_hda_codec_hdmi xt_multiport snd_soc_core irqbypass crct10dif_pclmul snd_hda_codec_realtek snd_hda_codec_generic nft_limit snd_compress [12436.696189] polyval_clmulni ledtrig_audio ac97_bus polyval_generic snd_pcm_dmaengine ghash_clmulni_intel sha512_ssse3 snd_hda_intel xt_limit snd_intel_dspcfg aesni_intel snd_intel_sdw_acpi xt_addrtype crypto_simd snd_hda_codec xt_tcpudp joydev cryptd snd_hda_core xt_conntrack snd_hwdep surface_platform_profile dw9719 rapl mei_pxp mei_hdcp nf_conntrack ipts binfmt_misc platform_profile snd_pcm intel_rapl_msr hid_sensor_rotation hid_sensor_gyro_3d hid_sensor_accel_3d hid_sensor_als mwifiex_pcie processor_thermal_device_pci_legacy intel_cstate nf_defrag_ipv6 gpio_keys tcp_bbr ipu3_imgu(C) ipu3_cio2 snd_timer hid_sensor_trigger processor_thermal_device mwifiex nf_defrag_ipv4 pcspkr videobuf2_dma_sg surface_gpe snd industrialio_triggered_buffer processor_thermal_rfim ov8865 ov5693 ov7251 mei_me nft_compat intel_skl_int3472_tps68470 msr cfg80211 videobuf2_memops soundcore kfifo_buf 8250_dw processor_thermal_mbox v4l2_fwnode mei tps68470_regulator parport_pc nf_tables videobuf2_v4l2 hid_sensor_iio_common [12436.696285] processor_thermal_rapl intel_rapl_common v4l2_async ppdev intel_pch_thermal clk_tps68470 industrialio nfnetlink videobuf2_common intel_soc_dts_iosf videodev intel_xhci_usb_role_switch mc intel_skl_int3472_discrete int3400_thermal lp int3403_thermal surfacepro3_button nls_iso8859_1 surface_acpi_notify surface_aggregator_registry soc_button_array acpi_tad acpi_pad dptf_power acpi_thermal_rel int340x_thermal_zone mac_hid parport efi_pstore dmi_sysfs ip_tables x_tables autofs4 btrfs xor raid6_pq libcrc32c hid_sensor_hub uas usb_storage intel_ishtp_hid hid_generic usbhid hid i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core drm_kms_helper syscopyarea sysfillrect sysimgblt intel_lpss_pci nvme intel_ish_ipc intel_lpss xhci_pci video crc32_pclmul nvme_core drm intel_ishtp idma64 xhci_pci_renesas wmi nvme_common surface_aggregator pinctrl_sunrisepoint [12436.696369] CPU: 1 PID: 1049 Comm: iptsd Kdump: loaded Tainted: G C 6.3.7-surface #1 [12436.696375] Hardware name: Microsoft Corporation Surface Pro/Surface Pro, BIOS 238.167.768 05.07.2014 [12436.696377] RIP: 0010:refcount_warn_saturate+0x7a/0x110 [12436.696386] Code: 01 e8 ca 6f 9e ff 0f 0b 5d c3 cc cc cc cc 80 3d 9a 90 5e 01 00 75 c9 48 c7 c7 a8 0c 36 9b c6 05 8a 90 5e 01 01 e8 a6 6f 9e ff <0f> 0b 5d c3 cc cc cc cc 80 3d 78 90 5e 01 00 75 a5 48 c7 c7 80 0c [12436.696390] RSP: 0018:ffffacee00f87cc0 EFLAGS: 00010282 [12436.696394] RAX: 0000000000000000 RBX: ffff93618c9415e8 RCX: 0000000000000027 [12436.696398] RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9362e74a0548 [12436.696401] RBP: ffffacee00f87cc0 R08: 0000000000000000 R09: ffffacee00f87b28 [12436.696404] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9361aa1e9a00 [12436.696407] R13: ffff9361aa1e9a28 R14: ffff93619411fdf8 R15: 0000000000000002 [12436.696409] FS: 00007fd55f6a5740(0000) GS:ffff9362e7480000(0000) knlGS:0000000000000000 [12436.696413] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12436.696416] CR2: 000055b72c7b8370 CR3: 000000010ce46002 CR4: 00000000003706e0 [12436.696419] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [12436.696422] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [12436.696425] Call Trace: [12436.696427]