6.5 kernel BUG at mm/slub.c:440 when cycling bluetooth

Bug #2035028 reported by Julian Andres Klode
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

In 6.5.0-4-generic, tried switching Momentum 4 wireless headphones between headset and handsfree profiles and I think also ended up cycling it on/off, causing a kernel bug in the memory management.

Sep 08 15:54:45 jak-t14-g3 kernel: ------------[ cut here ]------------
Sep 08 15:54:45 jak-t14-g3 kernel: kernel BUG at mm/slub.c:440!
Sep 08 15:54:45 jak-t14-g3 kernel: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
Sep 08 15:54:45 jak-t14-g3 kernel: CPU: 4 PID: 353971 Comm: kworker/u33:3 Not tainted 6.5.0-4-generic #4-Ubuntu
Sep 08 15:54:45 jak-t14-g3 kernel: Hardware name: LENOVO 21CF004PGE/21CF004PGE, BIOS R23ET65W (1.35 ) 03/21/2023
Sep 08 15:54:45 jak-t14-g3 kernel: Workqueue: hci0 hci_devcd_rx [bluetooth]
Sep 08 15:54:45 jak-t14-g3 kernel: RIP: 0010:__slab_free+0x156/0x2e0
Sep 08 15:54:45 jak-t14-g3 kernel: Code: 8b 06 48 89 0c 24 48 c1 e8 36 48 8b 84 c3 d8 00 00 00 48 89 c7 48 89 44 24 20 e8 65 6c cc 00 48 8b 0c 24 48 89 44 24 08 eb 83 <0f> 0b f7 43 08 00 0d 21 00 75 ca eb bf f7 43 08 00 0d 21 00 0f 84
Sep 08 15:54:45 jak-t14-g3 kernel: RSP: 0018:ffffae30a77fbc80 EFLAGS: 00010246
Sep 08 15:54:45 jak-t14-g3 kernel: RAX: ffff9c11644bac00 RBX: ffff9c0dc0042c00 RCX: 000000008010000f
Sep 08 15:54:45 jak-t14-g3 kernel: RDX: ffff9c11644ba800 RSI: ffff9c11644ba800 RDI: ffffae30a77fbcf0
Sep 08 15:54:45 jak-t14-g3 kernel: RBP: ffffae30a77fbd20 R08: 0000000000000001 R09: ffffffff8bfd9f77
Sep 08 15:54:45 jak-t14-g3 kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff9c11644ba800
Sep 08 15:54:45 jak-t14-g3 kernel: R13: ffff9c11644ba800 R14: ffffec1352912e00 R15: 0000000000000000
Sep 08 15:54:45 jak-t14-g3 kernel: FS: 0000000000000000(0000) GS:ffff9c14def00000(0000) knlGS:0000000000000000
Sep 08 15:54:45 jak-t14-g3 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 08 15:54:45 jak-t14-g3 kernel: CR2: 000055ddb6efdcd8 CR3: 000000068703a000 CR4: 0000000000750ee0
Sep 08 15:54:45 jak-t14-g3 kernel: PKRU: 55555554
Sep 08 15:54:45 jak-t14-g3 kernel: Call Trace:
Sep 08 15:54:45 jak-t14-g3 kernel: <TASK>
Sep 08 15:54:45 jak-t14-g3 kernel: ? show_regs+0x6d/0x80
Sep 08 15:54:45 jak-t14-g3 kernel: ? die+0x37/0xa0
Sep 08 15:54:45 jak-t14-g3 kernel: ? do_trap+0xd4/0xf0
Sep 08 15:54:45 jak-t14-g3 kernel: ? do_error_trap+0x71/0xb0
Sep 08 15:54:45 jak-t14-g3 kernel: ? __slab_free+0x156/0x2e0
Sep 08 15:54:45 jak-t14-g3 kernel: ? exc_invalid_op+0x52/0x80
Sep 08 15:54:45 jak-t14-g3 kernel: ? __slab_free+0x156/0x2e0
Sep 08 15:54:45 jak-t14-g3 kernel: ? asm_exc_invalid_op+0x1b/0x20
Sep 08 15:54:45 jak-t14-g3 kernel: ? skb_free_head+0x87/0xd0
Sep 08 15:54:45 jak-t14-g3 kernel: ? __slab_free+0x156/0x2e0
Sep 08 15:54:45 jak-t14-g3 kernel: __kmem_cache_free+0x318/0x360
Sep 08 15:54:45 jak-t14-g3 kernel: ? skb_free_head+0x87/0xd0
Sep 08 15:54:45 jak-t14-g3 kernel: ? srso_alias_return_thunk+0x5/0x7f
Sep 08 15:54:45 jak-t14-g3 kernel: kfree+0x78/0x120
Sep 08 15:54:45 jak-t14-g3 kernel: skb_free_head+0x87/0xd0
Sep 08 15:54:45 jak-t14-g3 kernel: skb_release_data+0x159/0x200
Sep 08 15:54:45 jak-t14-g3 kernel: kfree_skb_reason+0x55/0x140
Sep 08 15:54:45 jak-t14-g3 kernel: hci_devcd_rx+0x99/0x580 [bluetooth]
Sep 08 15:54:45 jak-t14-g3 kernel: process_one_work+0x223/0x440
Sep 08 15:54:45 jak-t14-g3 kernel: worker_thread+0x4d/0x3f0
Sep 08 15:54:45 jak-t14-g3 kernel: ? srso_alias_return_thunk+0x5/0x7f
Sep 08 15:54:45 jak-t14-g3 kernel: ? _raw_spin_lock_irqsave+0xe/0x20
Sep 08 15:54:45 jak-t14-g3 kernel: ? __pfx_worker_thread+0x10/0x10
Sep 08 15:54:45 jak-t14-g3 kernel: kthread+0xf2/0x120
Sep 08 15:54:45 jak-t14-g3 kernel: ? __pfx_kthread+0x10/0x10
Sep 08 15:54:45 jak-t14-g3 kernel: ret_from_fork+0x47/0x70
Sep 08 15:54:45 jak-t14-g3 kernel: ? __pfx_kthread+0x10/0x10
Sep 08 15:54:45 jak-t14-g3 kernel: ret_from_fork_asm+0x1b/0x30
Sep 08 15:54:45 jak-t14-g3 kernel: </TASK>
Sep 08 15:54:45 jak-t14-g3 kernel: Modules linked in: ccm michael_mic vhost_vsock vmw_vsock_virtio_transport_common vhost vhost_iotlb vsock rfcomm snd_seq_dummy snd_hrtimer wireguard curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305_x86_64 libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel cmac algif_hash algif_skcipher af_alg snd_usb_audio snd_usbmidi_lib snd_ump bnep overlay btusb btrtl btbcm btintel btmtk binfmt_misc bluetooth ecdh_generic ecc qrtr_mhi uvcvideo videobuf2_vmalloc cdc_mbim uvc cdc_wdm videobuf2_memops cdc_ncm videobuf2_v4l2 option cdc_ether usb_wwan usbnet videodev usbserial mii videobuf2_common mc xfs nls_iso8859_1 snd_soc_dmic snd_acp6x_pdm_dma intel_rapl_msr snd_soc_acp6x_mach intel_rapl_common snd_sof_amd_rembrandt snd_sof_amd_renoir snd_ctl_led joydev snd_sof_amd_acp snd_hda_codec_realtek snd_sof_pci snd_hda_codec_generic snd_sof_xtensa_dsp snd_hda_codec_hdmi snd_sof snd_hda_intel snd_sof_utils qrtr snd_intel_dspcfg edac_mce_amd snd_soc_core snd_intel_sdw_acpi ath11k_pci snd_hda_codec snd_compress
Sep 08 15:54:45 jak-t14-g3 kernel: ac97_bus ath11k snd_hda_core snd_pcm_dmaengine kvm_amd snd_hwdep snd_pci_ps qmi_helpers snd_rpl_pci_acp6x snd_seq_midi snd_seq_midi_event kvm snd_acp_pci snd_rawmidi mac80211 snd_pci_acp6x snd_seq snd_pcm irqbypass thinkpad_acpi think_lmi snd_seq_device snd_pci_acp5x rapl firmware_attributes_class wmi_bmof nvram snd_timer k10temp cfg80211 snd_rn_pci_acp3x snd_acp_config snd snd_soc_acpi libarc4 ledtrig_audio i2c_piix4 ccp mhi snd_pci_acp3x soundcore platform_profile amd_pmc acpi_tad input_leds hid_multitouch serio_raw mac_hid msr parport_pc ppdev lp parport efi_pstore dmi_sysfs ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq libcrc32c dm_crypt usbhid amdgpu amdxcp iommu_v2 drm_buddy gpu_sched i2c_algo_bit drm_suballoc_helper drm_ttm_helper ttm crct10dif_pclmul crc32_pclmul drm_display_helper polyval_clmulni cec polyval_generic rc_core ghash_clmulni_intel sha512_ssse3 hid_generic drm_kms_helper nvme aesni_intel ucsi_acpi crypto_simd i2c_hid_acpi nvme_core r8169 typec_ucsi video cryptd psmouse
Sep 08 15:54:45 jak-t14-g3 kernel: drm xhci_pci i2c_hid nvme_common realtek typec wmi xhci_pci_renesas hid zstd
Sep 08 15:54:45 jak-t14-g3 kernel: ---[ end trace 0000000000000000 ]---

ProblemType: Bug
DistroRelease: Ubuntu 23.10
Package: linux-image-6.5.0-5-generic 6.5.0-5.5
ProcVersionSignature: Ubuntu 6.5.0-5.5-generic 6.5.0
Uname: Linux 6.5.0-5-generic x86_64
ApportVersion: 2.27.0-0ubuntu2
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: GNOME
Date: Sun Sep 10 17:09:23 2023
InstallationDate: Installed on 2022-11-26 (288 days ago)
InstallationMedia: Ubuntu 23.04 "Lunar Lobster" - Alpha amd64 (20221126)
MachineType: {report['dmi.sys.vendor']} {report['dmi.product.name']}
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.5.0-5-generic root=/dev/mapper/ubuntu-root ro rootflags=subvol=@ quiet splash zswap.enabled=1 zswap.compressor=zstd zswap.max_pool_percent=20 zswap.zpool=zsmalloc
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
 linux-restricted-modules-6.5.0-5-generic N/A
 linux-backports-modules-6.5.0-5-generic N/A
 linux-firmware 20230815.git0e048b06-0ubuntu1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 03/21/2023
dmi.bios.release: 1.35
dmi.bios.vendor: LENOVO
dmi.bios.version: R23ET65W (1.35 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21CF004PGE
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T76538 WIN
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.28
dmi.modalias: dmi:bvnLENOVO:bvrR23ET65W(1.35):bd03/21/2023:br1.35:efr1.28:svnLENOVO:pn21CF004PGE:pvrThinkPadT14Gen3:rvnLENOVO:rn21CF004PGE:rvrSDK0T76538WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21CF_BU_Think_FM_ThinkPadT14Gen3:
dmi.product.family: ThinkPad T14 Gen 3
dmi.product.name: 21CF004PGE
dmi.product.sku: LENOVO_MT_21CF_BU_Think_FM_ThinkPad T14 Gen 3
dmi.product.version: ThinkPad T14 Gen 3
dmi.sys.vendor: LENOVO

Revision history for this message
Julian Andres Klode (juliank) wrote :
summary: - kernel BUG at mm/slub.c:440 when cycling bluetooth
+ 6.5 kernel BUG at mm/slub.c:440 when cycling bluetooth
Revision history for this message
Julian Andres Klode (juliank) wrote :

Complete journal from 15:40 to 16:00

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Revision history for this message
Julian Andres Klode (juliank) wrote (last edit ):

Another occurence in latest boot.

Actually the same call chain it seems.

Revision history for this message
Gerald Nunn (gnunn1) wrote :

I'm having the exact same issue albeit on a Lenovo Z16 running Arch Linux (kernel 6.5.7). I'm curious if your Thinkpad is using the Qualcomm Bluetooth stack like the Z16 is?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.