Linux kernel crash report

// lib/debugobjects.c:611
611 static void debug_print_object(struct debug_obj *obj, char *msg)
612 {
613 const struct debug_obj_descr *descr = obj->descr;
614 static int limit;
615 
616 /*
617  * Don't report if lookup_object_or_alloc() by the current thread
618  * failed because lookup_object_or_alloc()/debug_objects_oom() by a
619  * concurrent thread turned off debug_objects_enabled and cleared
620  * the hash buckets.
621  */
622 if (!debug_objects_enabled)
623 return;
624 
625 if (limit < 5 && descr != descr_test) {
626 void *hint = descr->debug_hint ?
627 descr->debug_hint(obj->object) : NULL;
628 limit++;
629 WARN(1, KERN_ERR "ODEBUG: %s %s (active state %u) "
630  "object: %p object type: %s hint: %pS\n",
631 msg, obj_states[obj->state], obj->astate,
632 obj->object, descr->name, hint);   // <<< WARN fires here
633 }
634 debug_objects_warnings++;
635 }

// lib/debugobjects.c:747
747 static void
748 __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack)
749 {
750 struct debug_obj *obj, o;
751 struct debug_bucket *db;
752 unsigned long flags;
753 
754 debug_objects_fill_pool();
755 
756 db = get_bucket((unsigned long) addr);
757 
758 raw_spin_lock_irqsave(&db->lock, flags);
759 
760 obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
761 if (unlikely(!obj)) {
762 raw_spin_unlock_irqrestore(&db->lock, flags);
763 debug_objects_oom();
764 return;
765 }
766 
767 switch (obj->state) {
768 case ODEBUG_STATE_NONE:
769 case ODEBUG_STATE_INIT:
770 case ODEBUG_STATE_INACTIVE:
771 obj->state = ODEBUG_STATE_INIT;
772 raw_spin_unlock_irqrestore(&db->lock, flags);
773 return;
774 default:
775 break;
776 }
777 
778 o = *obj;
779 raw_spin_unlock_irqrestore(&db->lock, flags);
780 debug_print_object(&o, "init");    // <<< called when state is not NONE/INIT/INACTIVE
781 
782 if (o.state == ODEBUG_STATE_ACTIVE)
783 debug_object_fixup(descr->fixup_init, addr, o.state);
784 }

// kernel/time/timer.c:786
786 static inline void debug_timer_init(struct timer_list *timer)
787 {
788 debug_object_init(timer, &timer_debug_descr);  // <<< [inline] backtrace entry
789 }

// kernel/time/timer.c:834
834 static inline void debug_init(struct timer_list *timer)
835 {
836 debug_timer_init(timer);   // <<< [inline] backtrace entry
837 trace_timer_init(timer);
838 }

// kernel/time/timer.c:876
876 void timer_init_key(struct timer_list *timer,
877     void (*func)(struct timer_list *), unsigned int flags,
878     const char *name, struct lock_class_key *key)
879 {
880 debug_init(timer);                          // <<< backtrace entry
881 do_init_timer(timer, func, flags, name, key);
882 }
883 EXPORT_SYMBOL(timer_init_key);

// net/atm/lec.c:1264
1264 static void lec_arp_init(struct lec_priv *priv)
1265 {
1266 unsigned short i;
1267 
1268 for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
1269 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
1270 INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
1271 INIT_HLIST_HEAD(&priv->lec_no_forward);
1272 INIT_HLIST_HEAD(&priv->mcast_fwds);
1273 spin_lock_init(&priv->lec_arp_lock);
1274 INIT_DELAYED_WORK(&priv->lec_arp_work, lec_arp_check_expire);  // <<< inlined entry
1275 schedule_delayed_work(&priv->lec_arp_work, LEC_ARP_REFRESH_INTERVAL);
1276 }

// net/atm/lec.c:748
748 static int lecd_attach(struct atm_vcc *vcc, int arg)
749 {
750 int i;
751 struct lec_priv *priv;
752 
753 lockdep_assert_held(&lec_mutex);
754 if (arg < 0)
755 arg = 0;
756 if (arg >= MAX_LEC_ITF)
757 return -EINVAL;
758 i = array_index_nospec(arg, MAX_LEC_ITF);
759 if (!dev_lec[i]) {
760 int size;
761 
762 size = sizeof(struct lec_priv);
763 dev_lec[i] = alloc_etherdev(size);
764 if (!dev_lec[i])
765 return -ENOMEM;
766 dev_lec[i]->netdev_ops = &lec_netdev_ops;
767 dev_lec[i]->max_mtu = 18190;
768 snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i);
769 if (register_netdev(dev_lec[i])) {
770 free_netdev(dev_lec[i]);
771 dev_lec[i] = NULL;
772 return -EINVAL;
773 }
774 
775 priv = netdev_priv(dev_lec[i]);
776 } else {
776 priv = netdev_priv(dev_lec[i]);
777 if (rcu_access_pointer(priv->lecd))
778 return -EADDRINUSE;
779 }
781 lec_arp_init(priv);   // <<< called unconditionally for both new and existing priv
782 ...

// net/atm/lec.c:1018
1018 static int lane_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1019 {
1020 struct atm_vcc *vcc = ATM_SD(sock);
1021 int err = 0;
1022 
1023 switch (cmd) {
1024 case ATMLEC_CTRL:
1025 case ATMLEC_MCAST:
1026 case ATMLEC_DATA:
1027 if (!capable(CAP_NET_ADMIN))
1028 return -EPERM;
1029 break;
1030 default:
1031 return -ENOIOCTLCMD;
1032 }
1033 
1034 mutex_lock(&lec_mutex);
1035 switch (cmd) {
1036 case ATMLEC_CTRL:
1037 err = lecd_attach(vcc, (int)arg);   // <<< backtrace entry
1038 if (err >= 0)
1039 sock->state = SS_CONNECTED;
1040 break;
1041 ...
1049 mutex_unlock(&lec_mutex);
1050 return err;
1051 }

// net/atm/ioctl.c:153
153 error = -ENOIOCTLCMD;
154 
155 mutex_lock(&ioctl_mutex);
156 list_for_each(pos, &ioctl_list) {
157 struct atm_ioctl *ic = list_entry(pos, struct atm_ioctl, list);
158 if (try_module_get(ic->owner)) {
159 error = ic->ioctl(sock, cmd, arg);  // <<< backtrace entry — calls lane_ioctl
160 module_put(ic->owner);
161 if (error != -ENOIOCTLCMD)
162 break;
163 }
164 }
165 mutex_unlock(&ioctl_mutex);

// lib/debugobjects.c:767
767     switch (obj->state) {
768     case ODEBUG_STATE_NONE:
769     case ODEBUG_STATE_INIT:
770     case ODEBUG_STATE_INACTIVE:
771         obj->state = ODEBUG_STATE_INIT;
772         raw_spin_unlock_irqrestore(&db->lock, flags);
773         return;                  // ← safe cases return here
774     default:
775         break;
776     }
780     debug_print_object(&o, "init");   // ← fires when state == ACTIVE (3)

// net/atm/lec.c:1264
1264 static void lec_arp_init(struct lec_priv *priv)
1265 {
1266     unsigned short i;
1267     for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
1268         INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
1269     INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
1270     INIT_HLIST_HEAD(&priv->lec_no_forward);
1271     INIT_HLIST_HEAD(&priv->mcast_fwds);
1272     spin_lock_init(&priv->lec_arp_lock);
→ 1274     INIT_DELAYED_WORK(&priv->lec_arp_work, lec_arp_check_expire);  // ← WARN triggered here
1275     schedule_delayed_work(&priv->lec_arp_work, LEC_ARP_REFRESH_INTERVAL);
1276 }

// net/atm/lec.c:748
748 static int lecd_attach(struct atm_vcc *vcc, int arg)
749 {
        ...
759     if (!dev_lec[i]) {
            // new device: allocate, register, set priv
775         priv = netdev_priv(dev_lec[i]);
776     } else {
777         priv = netdev_priv(dev_lec[i]);
778         if (rcu_access_pointer(priv->lecd))
779             return -EADDRINUSE;          // ← blocks if daemon already attached
780     }
→ 781     lec_arp_init(priv);    // ← called for existing priv WITHOUT cancelling work

// net/atm/lec.c:487
487 static void lec_atm_close(struct atm_vcc *vcc)
488 {
489     struct net_device *dev = (struct net_device *)vcc->proto_data;
490     struct lec_priv *priv = netdev_priv(dev);
491
492     rcu_assign_pointer(priv->lecd, NULL);  // ← lecd cleared here
493     synchronize_rcu();                     // ← wait for RCU readers
494     /* Do something needful? */
495     netif_stop_queue(dev);
496
497     lec_arp_destroy(priv);                 // ← work cancelled here (too late)

    } else {
        priv = netdev_priv(dev_lec[i]);
        if (rcu_access_pointer(priv->lecd))
            return -EADDRINUSE;
+       cancel_delayed_work_sync(&priv->lec_arp_work);
    }
    lec_arp_init(priv);

--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -776,6 +776,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
 } else {
 priv = netdev_priv(dev_lec[i]);
 if (rcu_access_pointer(priv->lecd))
 return -EADDRINUSE;
+cancel_delayed_work_sync(&priv->lec_arp_work);
 }
 lec_arp_init(priv);