[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#917206: marked as done (linux-image-4.9.0-8-amd64: NULL ptr dereference in xhci_hub_control [xhci_hcd] with USB Mass Storage (Kingston))



Your message dated Wed, 2 Jan 2019 17:24:12 +0100
with message-id <[🔎] 20190102162412.GA13145@eldamar.local>
and subject line Re: Bug#917206: linux-image-4.9.0-8-amd64: NULL ptr dereference in xhci_hub_control [xhci_hcd] with USB Mass Storage (Kingston)
has caused the Debian Bug report #917206,
regarding linux-image-4.9.0-8-amd64: NULL ptr dereference in xhci_hub_control [xhci_hcd] with USB Mass Storage (Kingston)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
917206: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=917206
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: src:linux
Version: 4.9.135-1
Severity: important

Hi kernel team,

I've reproduced this kernel BUG a few times already, with simple
operations on various USB devices like brand new Kingston DataTraveler
3.0 (8, 16 or 32GB):

    [ 1992.998316] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
    [ 1992.998372] IP: [<ffffffffc038f32f>] xhci_hub_control+0x19cf/0x1c10 [xhci_hcd]


Steps to reproduce:
 - plug a USB device either on an port of the laptop's base, or on the
   USB3 port on the laptop;
 - zero out the /dev/sd? that pops up when the USB device is inserted,
   to make sure any preexisting partitioning is no factor (did that on
   the full device first time, then decided to only wipe out the
   beginning of the block device);
 - partprobe to make extra sure;
 - create a partition table with fdisk (not sure I did anything
   specific here, can double check, probably went for the default);
 - create a single partition with all free space;
 - assign type 'b' (W95 FAT32) to it;
 - use mkfs.vfat -F 32 on the new block device.

At this point, said block device appears in Xfce's file manager, Thunar.
With or without having copied a few files to it, clicking the “eject”
button is sufficient to trigger this BUG. When that happens, input
devices work for a few seconds but it isn't possible to get much done;
an already-running dmesg -w wouldn't show any traces. Only an UEFI
glitch at reboot time would make half a screen appear with a fuzzied
trace…

Here's a capture obtained through netconsole, enabled a bit before
triggering the crash:

    [ 1745.198739] console [netcon_ext0] disabled
    [ 1745.198753] console [netcon0] disabled
    [ 1748.295633] netpoll: netconsole: local port 6665
    [ 1748.295637] netpoll: netconsole: local IPv4 address 0.0.0.0
    [ 1748.295639] netpoll: netconsole: interface 'eth0'
    [ 1748.295640] netpoll: netconsole: remote port 6666
    [ 1748.295642] netpoll: netconsole: remote IPv4 address 192.168.0.1
    [ 1748.295644] netpoll: netconsole: remote ethernet address d8:cb:8a:98:29:59
    [ 1748.295647] netpoll: netconsole: local IP 192.168.0.21
    [ 1748.295702] console [netcon0] enabled
    [ 1748.295704] netconsole: network logging started
    [ 1799.971353] usb 2-2: new SuperSpeed USB device number 4 using xhci_hcd
    [ 1800.002355] usb 2-2: New USB device found, idVendor=0951, idProduct=1666
    [ 1800.002373] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [ 1800.002380] usb 2-2: Product: DataTraveler 3.0
    [ 1800.002386] usb 2-2: Manufacturer: Kingston
    [ 1800.002392] usb 2-2: SerialNumber: 60A44C413BF2F270B62830FF
    [ 1800.017208] usb-storage 2-2:1.0: USB Mass Storage device detected
    [ 1800.017367] scsi host3: usb-storage 2-2:1.0
    [ 1801.020259] scsi 3:0:0:0: Direct-Access     Kingston DataTraveler 3.0      PQ: 0 ANSI: 6
    [ 1801.021997] sd 3:0:0:0: Attached scsi generic sg1 type 0
    [ 1801.022211] sd 3:0:0:0: [sdb] 30218842 512-byte logical blocks: (15.5 GB/14.4 GiB)
    [ 1801.022788] sd 3:0:0:0: [sdb] Write Protect is off
    [ 1801.022819] sd 3:0:0:0: [sdb] Mode Sense: 4f 00 00 00
    [ 1801.023312] sd 3:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
    [ 1801.026302]  sdb: sdb1
    [ 1801.027383] sd 3:0:0:0: [sdb] Attached SCSI removable disk
    [ 1884.111187] device eth0 left promiscuous mode
    [ 1901.864615]  sdb: sdb1
    [ 1939.154007] usb 2-2: USB disconnect, device number 4
    [ 1941.618308] usb 2-2: new SuperSpeed USB device number 5 using xhci_hcd
    [ 1941.649852] usb 2-2: New USB device found, idVendor=0951, idProduct=1666
    [ 1941.649863] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [ 1941.649866] usb 2-2: Product: DataTraveler 3.0
    [ 1941.649869] usb 2-2: Manufacturer: Kingston
    [ 1941.649872] usb 2-2: SerialNumber: 60A44C413BF2F270B62830FF
    [ 1941.659124] usb-storage 2-2:1.0: USB Mass Storage device detected
    [ 1941.659303] scsi host3: usb-storage 2-2:1.0
    [ 1942.682536] scsi 3:0:0:0: Direct-Access     Kingston DataTraveler 3.0      PQ: 0 ANSI: 6
    [ 1942.683352] sd 3:0:0:0: [sdb] 30218842 512-byte logical blocks: (15.5 GB/14.4 GiB)
    [ 1942.683356] sd 3:0:0:0: Attached scsi generic sg1 type 0
    [ 1942.683517] sd 3:0:0:0: [sdb] Write Protect is off
    [ 1942.683525] sd 3:0:0:0: [sdb] Mode Sense: 4f 00 00 00
    [ 1942.683714] sd 3:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
    [ 1942.687527]  sdb: sdb1
    [ 1942.688360] sd 3:0:0:0: [sdb] Attached SCSI removable disk
    [ 1978.720932]  sdb: sdb1
    [ 1984.327018]  sdb: sdb1
    [ 1984.414750]  sdb: sdb1
    [ 1984.587241]  sdb: sdb1
    [ 1992.998123] usb 2-2: USB disconnect, device number 5
    [ 1992.998316] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
    [ 1992.998372] IP: [<ffffffffc038f32f>] xhci_hub_control+0x19cf/0x1c10 [xhci_hcd]
    [ 1992.998418] PGD 0 [ 1992.998433] 
    [ 1992.998450] Oops: 0000 [#1] SMP
    [ 1992.998475] Modules linked in: netconsole nfnetlink_queue nfnetlink_log nfnetlink rtl8192cu rtl_usb rtl8192c_common rtlwifi configfs rfcomm ip6t_REJECT nf_reject_ipv6 xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter cmac bnep binfmt_misc usblp arc4 snd_hda_codec_hdmi snd_hda_codec_conexant i2c_designware_platform i2c_designware_core snd_hda_codec_generic snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_soc_sst_match snd_soc_core snd_compress snd_hda_intel iwlmvm hp_wmi sparse_keymap snd_hda_codec mac80211 intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm snd_hda_core snd_hwdep irqbypass intel_cstate i915 snd_pcm intel_uncore snd_timer iwlwifi intel_rapl_perf snd soundcore cfg80211 idma64 serio_raw uvcvideo videobuf2_vmalloc iTCO_wdt videobuf2_memops iTCO_vendor_support videobuf2_v4l2 drm_kms_helper videobuf2_core btusb videodev qmi_wwan drm btrtl cdc_wdm btbcm evdev usbnet intel_lpss_pci media joydev mii intel_lpss i2c_algo_bit btintel sg shpchp mfd_core intel_pch_thermal mei_me bluetooth mei rfkill wmi battery ac video button hp_wireless acpi_pad tpm_infineon nfsd auth_rpcgss oid_registry nfs_acl lockd grace sunrpc parport_pc ppdev lp parport ip_tables x_tables autofs4 ext4 crc16 jbd2 fscrypto ecb mbcache btrfs algif_skcipher af_alg hid_generic usbhid uas usb_storage dm_crypt dm_mod raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c crc32c_generic raid1 raid0 multipath linear md_mod sd_mod crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd psmouse ahci libahci e1000e i2c_i801 ptp pps_core xhci_pci i2c_smbus libata xhci_hcd scsi_mod usbcore usb_common thermal i2c_hid hid [last unloaded: netconsole]
    [ 1992.999820] CPU: 1 PID: 6046 Comm: kworker/1:2 Not tainted 4.9.0-8-amd64 #1 Debian 4.9.135-1
    [ 1992.999857] Hardware name: HP HP EliteBook Folio 1040 G3/80FA, BIOS N83 Ver. 01.00 12/15/2015
    [ 1992.999902] Workqueue: usb_hub_wq hub_event [usbcore]
    [ 1992.999928] task: ffff9cac0a54b000 task.stack: ffffc02901df8000
    [ 1992.999959] RIP: 0010:[<ffffffffc038f32f>]  [<ffffffffc038f32f>] xhci_hub_control+0x19cf/0x1c10 [xhci_hcd]
    [ 1993.000012] RSP: 0018:ffffc02901dfba90  EFLAGS: 00010086
    [ 1993.000038] RAX: ffff9cabd8f18000 RBX: ffff9cac969b8000 RCX: 0000000000000000
    [ 1993.000070] RDX: 0000000000000060 RSI: 0000000000001201 RDI: ffff9cac968b4284
    [ 1993.000213] RBP: 00000000ffffffed R08: 0000000000000008 R09: 0000000000000001
    [ 1993.000251] R10: 0000000000000001 R11: 0000000000000212 R12: 000000000000000e
    [ 1993.000283] R13: ffff9cac968b4000 R14: ffff9cac968b4284 R15: 0000000000000002
    [ 1993.000318] FS:  0000000000000000(0000) GS:ffff9cacaf480000(0000) knlGS:0000000000000000
    [ 1993.000353] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 1993.000371] CR2: 000000000000001c CR3: 0000000314c36000 CR4: 0000000000360670
    [ 1993.000393] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 1993.000415] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [ 1993.000437] Stack:
    [ 1993.000445]  ffffffffb8aa4900 072e361b00000005 0000000000000006 ffff9cac00000000
    [ 1993.000475]  0000000000000005 ffff9cac968b4238 0000000000000000 ffffffffb8be0302
    [ 1993.000502]  ffff9cac9e800cc0 0000000001dfbba0 ffff9cac95d07240 ffff9cac9bafe700
    [ 1993.000529] Call Trace:
    [ 1993.000541]  [<ffffffffb8aa4900>] ? check_preempt_curr+0x20/0x90
    [ 1993.000562]  [<ffffffffb8be0302>] ? new_page+0x12/0xa0
    [ 1993.000580]  [<ffffffffb8c54266>] ? ep_poll_callback+0x106/0x230
    [ 1993.000606]  [<ffffffffc02e686a>] ? usb_hcd_submit_urb+0x2aa/0xaf0 [usbcore]
    [ 1993.000629]  [<ffffffffb8ef9d3e>] ? __kmalloc_reserve.isra.35+0x2e/0x80
    [ 1993.000652]  [<ffffffffb8ae7714>] ? lock_timer_base+0x74/0x90
    [ 1993.000672]  [<ffffffffb8ae759a>] ? __internal_add_timer+0x1a/0x50
    [ 1993.000692]  [<ffffffffb8ae9f20>] ? add_timer+0x110/0x270
    [ 1993.000715]  [<ffffffffc02e8aed>] ? usb_start_wait_urb+0x6d/0x170 [usbcore]
    [ 1993.000741]  [<ffffffffc02ed562>] ? usb_release_interface_cache+0x32/0x50 [usbcore]
    [ 1993.000768]  [<ffffffffc02e8ccd>] ? usb_control_msg+0xdd/0x140 [usbcore]
    [ 1993.000791]  [<ffffffffb8e7e3c0>] ? device_release+0x30/0x90
    [ 1993.000813]  [<ffffffffc02dbc54>] ? set_port_feature+0x44/0x50 [usbcore]
    [ 1993.000837]  [<ffffffffc02dd579>] ? hub_port_disable+0xc9/0x140 [usbcore]
    [ 1993.000863]  [<ffffffffc02e24eb>] ? hub_event+0xd8b/0x15c0 [usbcore]
    [ 1993.000884]  [<ffffffffb90190a4>] ? __switch_to_asm+0x34/0x70
    [ 1993.000904]  [<ffffffffb90190b0>] ? __switch_to_asm+0x40/0x70
    [ 1993.000923]  [<ffffffffb8a9421a>] ? process_one_work+0x18a/0x420
    [ 1993.000943]  [<ffffffffb8a944fd>] ? worker_thread+0x4d/0x490
    [ 1993.000962]  [<ffffffffb8a944b0>] ? process_one_work+0x420/0x420
    [ 1993.000982]  [<ffffffffb8a9a569>] ? kthread+0xd9/0xf0
    [ 1993.001000]  [<ffffffffb90190a4>] ? __switch_to_asm+0x34/0x70
    [ 1993.001019]  [<ffffffffb8a9a490>] ? kthread_park+0x60/0x60
    [ 1993.001038]  [<ffffffffb9019137>] ? ret_from_fork+0x57/0x70
    [ 1993.001056] Code: e9 2c e7 ff ff 45 31 e4 eb 11 49 83 c4 01 49 81 fc 00 01 00 00 0f 84 f5 f2 ff ff 4b 8b 84 e5 08 04 00 00 48 85 c0 74 e2 48 8b 08 <83> 79 1c 04 40 0f 96 c6 83 bb a0 00 00 00 3f 0f 9f c1 40 38 ce 
    [ 1993.001230] RIP  [<ffffffffc038f32f>] xhci_hub_control+0x19cf/0x1c10 [xhci_hcd]
    [ 1993.001270]  RSP <ffffc02901dfba90>
    [ 1993.001288] CR2: 000000000000001c
    [ 1993.013222] ---[ end trace 9533e904b0227a58 ]---
    [ 2014.005703] INFO: rcu_sched detected stalls on CPUs/tasks:
    [ 2014.005714] 	1-...: (1 GPs behind) idle=001/140000000000001/0 softirq=67859/67860 fqs=2620 
    [ 2014.005716] 	(detected by 2, t=5252 jiffies, g=54690, c=54689, q=1460)
    [ 2014.005719] Task dump for CPU 1:
    [ 2014.005721] kworker/1:2     R  running task        0  6046      2 0x00000008
    [ 2014.005731] Workqueue:  0x2de900087b88e8ff (ÿÿHû)
    [ 2014.005735]  ffff9cac9e800cc0 0000000001dfbba0 ffff9cac95d07240 ffff9cac9bafe700
    [ 2014.005741]  0000000000000000 ffff9cac00000000 0000000000000000 ffff9cac9750ef00
    [ 2014.005746]  ffffffffb8c54266 072e361ba39ee992 ffff9cac9b786cc0 00000000fffffff4
    [ 2014.005751] Call Trace:
    [ 2014.005756]  [<ffffffffb8c54266>] ? ep_poll_callback+0x106/0x230
    [ 2014.005765]  [<ffffffffc02e686a>] ? usb_hcd_submit_urb+0x2aa/0xaf0 [usbcore]
    [ 2014.005769]  [<ffffffffb8ef9d3e>] ? __kmalloc_reserve.isra.35+0x2e/0x80
    [ 2014.005772]  [<ffffffffb8ae7714>] ? lock_timer_base+0x74/0x90
    [ 2014.005775]  [<ffffffffb8ae759a>] ? __internal_add_timer+0x1a/0x50
    [ 2014.005778]  [<ffffffffb8ae9f20>] ? add_timer+0x110/0x270
    [ 2014.005801]  [<ffffffffc02e8aed>] ? usb_start_wait_urb+0x6d/0x170 [usbcore]
    [ 2014.005808]  [<ffffffffc02ed562>] ? usb_release_interface_cache+0x32/0x50 [usbcore]
    [ 2014.005814]  [<ffffffffc02e8ccd>] ? usb_control_msg+0xdd/0x140 [usbcore]
    [ 2014.005817]  [<ffffffffb8e7e3c0>] ? device_release+0x30/0x90
    [ 2014.005822]  [<ffffffffc02dbc54>] ? set_port_feature+0x44/0x50 [usbcore]
    [ 2014.005826]  [<ffffffffc02dd579>] ? hub_port_disable+0xc9/0x140 [usbcore]
    [ 2014.005831]  [<ffffffffc02e24eb>] ? hub_event+0xd8b/0x15c0 [usbcore]
    [ 2014.005834]  [<ffffffffb90190a4>] ? __switch_to_asm+0x34/0x70
    [ 2014.005837]  [<ffffffffb90190b0>] ? __switch_to_asm+0x40/0x70
    [ 2014.005839]  [<ffffffffb8b06cf9>] ? acct_collect+0x169/0x1a0
    [ 2014.005842]  [<ffffffffb8a7f18a>] ? do_exit+0x74a/0xaf0
    [ 2014.005845]  [<ffffffffb901a817>] ? rewind_stack_do_exit+0x17/0x20

This resembles #916455 a lot but its trace isn't really readable so I
thought a fresh bug report would make sense.

If that helps, I can probably test older kernels and/or different
devices but I bought a bunch of (two different kinds of) Kingston
devices recently, so I don't have much hardware diversity here.

At the moment I can't tell it's a regression from older versions as I
wasn't using USB devices until a few days ago (testing Tails on bare
metal).

Also, I can try and get the Xfce file manager out of the way as far as
steps to reproduce go; but it's a bit cumbersome to repeat the crash
as that happens on my main laptop, that's why I haven't done that yet.


-- Package-specific info:
** Version:
Linux version 4.9.0-8-amd64 (debian-kernel@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.135-1 (2018-11-11)

** Command line:
BOOT_IMAGE=/vmlinuz-4.9.0-8-amd64 root=/dev/mapper/armor--vg-root ro quiet net.ifnames=0 apparmor=1 security=apparmor

** Not tainted

** Kernel log:
[   10.700092] Bluetooth: hci0: Applying Intel DDC parameters completed
[   10.779320] [drm] RC6 on
[   10.890828] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   10.890830] Bluetooth: BNEP filters: protocol multicast
[   10.890834] Bluetooth: BNEP socket layer initialized
[   11.159820] NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory
[   11.160366] NFSD: starting 90-second grace period (net ffffffff934dbe80)
[   11.477970] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   11.719221] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   11.730965] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   11.733202] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   11.733588] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   11.869056] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   11.869446] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   11.952648] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   11.960907] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   11.961295] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   12.096700] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   12.097086] iwlwifi 0000:01:00.0: L1 Enabled - LTR Enabled
[   12.180128] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   12.354152] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.403960] Ebtables v2.0 registered
[   12.508110] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   12.995902] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[   13.000128] tun: Universal TUN/TAP device driver, 1.6
[   13.000130] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   13.063116] virbr46: port 1(virbr46-nic) entered blocking state
[   13.063118] virbr46: port 1(virbr46-nic) entered disabled state
[   13.063182] device virbr46-nic entered promiscuous mode
[   13.219681] nf_conntrack version 0.5.0 (65536 buckets, 262144 max)
[   13.253444] virbr46: port 1(virbr46-nic) entered blocking state
[   13.253446] virbr46: port 1(virbr46-nic) entered listening state
[   13.253488] IPv6: ADDRCONF(NETDEV_UP): virbr46: link is not ready
[   15.259047] virbr46: port 1(virbr46-nic) entered learning state
[   17.275104] virbr46: port 1(virbr46-nic) entered forwarding state
[   17.275108] virbr46: topology change detected, propagating
[   17.275190] IPv6: ADDRCONF(NETDEV_CHANGE): virbr46: link becomes ready
[   18.337131] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   18.380523] wlan0: authenticate with 14:0c:76:c9:bf:04
[   18.388813] wlan0: send auth to 14:0c:76:c9:bf:04 (try 1/3)
[   18.394332] wlan0: authenticated
[   18.394482] iwlwifi 0000:01:00.0 wlan0: disabling HT/VHT due to WEP/TKIP use
[   18.395055] wlan0: associate with 14:0c:76:c9:bf:04 (try 1/3)
[   18.396364] wlan0: RX AssocResp from 14:0c:76:c9:bf:04 (capab=0x111 status=0 aid=2)
[   18.397771] wlan0: associated
[   18.398320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   18.472067] wlan0: Limiting TX power to 24 (27 - 3) dBm as advertised by 14:0c:76:c9:bf:04
[   19.232404] virbr46: port 1(virbr46-nic) entered disabled state
[   19.339544] virbr4: port 1(virbr4-nic) entered blocking state
[   19.339551] virbr4: port 1(virbr4-nic) entered disabled state
[   19.339883] device virbr4-nic entered promiscuous mode
[   19.491900] virbr4: port 1(virbr4-nic) entered blocking state
[   19.491902] virbr4: port 1(virbr4-nic) entered listening state
[   19.545798] virbr4: port 1(virbr4-nic) entered disabled state
[   19.627370] virbr0: port 1(virbr0-nic) entered blocking state
[   19.627373] virbr0: port 1(virbr0-nic) entered disabled state
[   19.627539] device virbr0-nic entered promiscuous mode
[   19.821778] virbr0: port 1(virbr0-nic) entered blocking state
[   19.821780] virbr0: port 1(virbr0-nic) entered listening state
[   19.841921] virbr0: port 1(virbr0-nic) entered disabled state
[   20.897530] Bluetooth: RFCOMM TTY layer initialized
[   20.897535] Bluetooth: RFCOMM socket layer initialized
[   20.897540] Bluetooth: RFCOMM ver 1.11
[11478.460801] perf: interrupt took too long (2541 > 2500), lowering kernel.perf_event_max_sample_rate to 78500
[13673.066124] perf: interrupt took too long (3214 > 3176), lowering kernel.perf_event_max_sample_rate to 62000

** Model information
sys_vendor: HP
product_name: HP EliteBook Folio 1040 G3
product_version: 
chassis_vendor: HP
chassis_version: 
bios_vendor: HP
bios_version: N83 Ver. 01.00
board_vendor: HP
board_name: 80FA
board_version: KBC Version 01.2E

** Loaded modules:
rfcomm
xt_CHECKSUM
iptable_mangle
ipt_MASQUERADE
nf_nat_masquerade_ipv4
iptable_nat
nf_nat_ipv4
nf_nat
nf_conntrack_ipv4
nf_defrag_ipv4
xt_conntrack
nf_conntrack
ip6t_REJECT
nf_reject_ipv6
ipt_REJECT
nf_reject_ipv4
xt_tcpudp
tun
bridge
stp
llc
ebtable_filter
ebtables
ip6table_filter
ip6_tables
iptable_filter
cmac
bnep
binfmt_misc
hid_generic
arc4
snd_hda_codec_hdmi
snd_hda_codec_conexant
snd_hda_codec_generic
i2c_designware_platform
i2c_designware_core
iwlmvm
mac80211
intel_rapl
hp_wmi
sparse_keymap
x86_pkg_temp_thermal
intel_powerclamp
coretemp
kvm_intel
snd_soc_skl
kvm
snd_soc_skl_ipc
snd_soc_sst_ipc
irqbypass
snd_soc_sst_dsp
snd_hda_ext_core
snd_soc_sst_match
intel_cstate
snd_soc_core
snd_compress
intel_uncore
intel_rapl_perf
i915
snd_hda_intel
uvcvideo
videobuf2_vmalloc
snd_hda_codec
iwlwifi
videobuf2_memops
btusb
btrtl
btbcm
snd_hda_core
idma64
btintel
snd_hwdep
cfg80211
videobuf2_v4l2
bluetooth
evdev
videobuf2_core
joydev
snd_pcm
serio_raw
drm_kms_helper
snd_timer
snd
videodev
iTCO_wdt
soundcore
qmi_wwan
drm
iTCO_vendor_support
cdc_wdm
media
usbnet
intel_lpss_pci
mii
rfkill
mei_me
intel_lpss
sg
i2c_algo_bit
mei
shpchp
mfd_core
intel_pch_thermal
wmi
battery
video
hp_wireless
button
acpi_pad
tpm_infineon
ac
nfsd
auth_rpcgss
oid_registry
nfs_acl
lockd
grace
sunrpc
parport_pc
ppdev
lp
parport
ip_tables
x_tables
autofs4
ext4
crc16
jbd2
fscrypto
ecb
mbcache
btrfs
algif_skcipher
af_alg
dm_crypt
dm_mod
raid10
raid456
async_raid6_recov
async_memcpy
async_pq
async_xor
async_tx
xor
raid6_pq
libcrc32c
crc32c_generic
raid1
raid0
multipath
linear
md_mod
sd_mod
crct10dif_pclmul
crc32_pclmul
crc32c_intel
ghash_clmulni_intel
aesni_intel
aes_x86_64
lrw
gf128mul
glue_helper
ablk_helper
cryptd
psmouse
ahci
e1000e
libahci
ptp
pps_core
i2c_i801
i2c_smbus
xhci_pci
libata
xhci_hcd
scsi_mod
usbcore
usb_common
thermal
i2c_hid
hid

** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation Skylake Host Bridge/DRAM Registers [8086:1904] (rev 08)
	Subsystem: Hewlett-Packard Company Skylake Host Bridge/DRAM Registers [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ >SERR- <PERR- INTx-
	Latency: 0
	Capabilities: <access denied>
	Kernel driver in use: skl_uncore

00:02.0 VGA compatible controller [0300]: Intel Corporation HD Graphics 520 [8086:1916] (rev 07) (prog-if 00 [VGA controller])
	Subsystem: Hewlett-Packard Company HD Graphics 520 [103c:80fa]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 280
	Region 0: Memory at e0000000 (64-bit, non-prefetchable) [size=16M]
	Region 2: Memory at d0000000 (64-bit, prefetchable) [size=256M]
	Region 4: I/O ports at 3000 [size=64]
	[virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: i915
	Kernel modules: i915

00:14.0 USB controller [0c03]: Intel Corporation Sunrise Point-LP USB 3.0 xHCI Controller [8086:9d2f] (rev 21) (prog-if 30 [XHCI])
	Subsystem: Hewlett-Packard Company Sunrise Point-LP USB 3.0 xHCI Controller [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 275
	Region 0: Memory at e1120000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: xhci_hcd
	Kernel modules: xhci_pci

00:14.2 Signal processing controller [1180]: Intel Corporation Sunrise Point-LP Thermal subsystem [8086:9d31] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP Thermal subsystem [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin C routed to IRQ 18
	Region 0: Memory at e114b000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: intel_pch_thermal
	Kernel modules: intel_pch_thermal

00:15.0 Signal processing controller [1180]: Intel Corporation Sunrise Point-LP Serial IO I2C Controller #0 [8086:9d60] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP Serial IO I2C Controller [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 16
	Region 0: Memory at e114c000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: intel-lpss
	Kernel modules: intel_lpss_pci

00:15.1 Signal processing controller [1180]: Intel Corporation Sunrise Point-LP Serial IO I2C Controller #1 [8086:9d61] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP Serial IO I2C Controller [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin B routed to IRQ 17
	Region 0: Memory at e114d000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: intel-lpss
	Kernel modules: intel_lpss_pci

00:16.0 Communication controller [0780]: Intel Corporation Sunrise Point-LP CSME HECI #1 [8086:9d3a] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP CSME HECI [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 278
	Region 0: Memory at e114e000 (64-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: mei_me
	Kernel modules: mei_me

00:16.3 Serial controller [0700]: Intel Corporation Device [8086:9d3d] (rev 21) (prog-if 02 [16550])
	Subsystem: Hewlett-Packard Company Device [103c:80fa]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin D routed to IRQ 19
	Region 0: I/O ports at 3080 [size=8]
	Region 1: Memory at e114a000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: <access denied>
	Kernel driver in use: serial

00:17.0 SATA controller [0106]: Intel Corporation Sunrise Point-LP SATA Controller [AHCI mode] [8086:9d03] (rev 21) (prog-if 01 [AHCI 1.0])
	Subsystem: Hewlett-Packard Company Sunrise Point-LP SATA Controller [AHCI mode] [103c:80fa]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 276
	Region 0: Memory at e1148000 (32-bit, non-prefetchable) [size=8K]
	Region 1: Memory at e1151000 (32-bit, non-prefetchable) [size=256]
	Region 2: I/O ports at 3088 [size=8]
	Region 3: I/O ports at 3090 [size=4]
	Region 4: I/O ports at 3040 [size=32]
	Region 5: Memory at e114f000 (32-bit, non-prefetchable) [size=2K]
	Capabilities: <access denied>
	Kernel driver in use: ahci
	Kernel modules: ahci

00:1c.0 PCI bridge [0604]: Intel Corporation Device [8086:9d13] (rev f1) (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin D routed to IRQ 274
	Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
	Memory behind bridge: e1000000-e10fffff
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
	BridgeCtl: Parity- SERR- NoISA- VGA- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: <access denied>
	Kernel driver in use: pcieport
	Kernel modules: shpchp

00:1f.0 ISA bridge [0601]: Intel Corporation Sunrise Point-LP LPC Controller [8086:9d48] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP LPC Controller [103c:80fa]
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0

00:1f.2 Memory controller [0580]: Intel Corporation Sunrise Point-LP PMC [8086:9d21] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP PMC [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Region 0: Memory at e1140000 (32-bit, non-prefetchable) [size=16K]

00:1f.3 Audio device [0403]: Intel Corporation Sunrise Point-LP HD Audio [8086:9d70] (rev 21) (prog-if 80)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP HD Audio [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 64
	Interrupt: pin A routed to IRQ 281
	Region 0: Memory at e1144000 (64-bit, non-prefetchable) [size=16K]
	Region 4: Memory at e1130000 (64-bit, non-prefetchable) [size=64K]
	Capabilities: <access denied>
	Kernel driver in use: snd_hda_intel
	Kernel modules: snd_hda_intel, snd_soc_skl

00:1f.4 SMBus [0c05]: Intel Corporation Sunrise Point-LP SMBus [8086:9d23] (rev 21)
	Subsystem: Hewlett-Packard Company Sunrise Point-LP SMBus [103c:80fa]
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 16
	Region 0: Memory at e1150000 (64-bit, non-prefetchable) [size=256]
	Region 4: I/O ports at efa0 [size=32]
	Kernel driver in use: i801_smbus
	Kernel modules: i2c_i801

00:1f.6 Ethernet controller [0200]: Intel Corporation Ethernet Connection I219-LM [8086:156f] (rev 21)
	Subsystem: Hewlett-Packard Company Ethernet Connection I219-LM [103c:80fa]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 277
	Region 0: Memory at e1100000 (32-bit, non-prefetchable) [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: e1000e
	Kernel modules: e1000e

01:00.0 Network controller [0280]: Intel Corporation Wireless 8260 [8086:24f3] (rev 3a)
	Subsystem: Intel Corporation Dual Band Wireless-AC 8260 [8086:0010]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 279
	Region 0: Memory at e1000000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: <access denied>
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi


** USB devices:
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 05c8:0386 Cheng Uei Precision Industry Co., Ltd (Foxlink) 
Bus 001 Device 004: ID 138a:003f Validity Sensors, Inc. VFS495 Fingerprint Reader
Bus 001 Device 003: ID 8087:0a2b Intel Corp. 
Bus 001 Device 002: ID 03f0:9d1d Hewlett-Packard 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub


-- System Information:
Debian Release: 9.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-debug'), (500, 'proposed-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE= (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-4.9.0-8-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.130
ii  kmod                                    23-2
ii  linux-base                              4.5

Versions of packages linux-image-4.9.0-8-amd64 recommends:
ii  firmware-linux-free  3.4
ii  irqbalance           1.1.0-2.3

Versions of packages linux-image-4.9.0-8-amd64 suggests:
pn  debian-kernel-handbook  <none>
ii  extlinux                3:6.03+dfsg-14.1+deb9u1
ii  grub-pc                 2.02~beta3-5+deb9u1
pn  linux-doc-4.9           <none>

Versions of packages linux-image-4.9.0-8-amd64 is related to:
ii  firmware-amd-graphics     20161130-4
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
ii  firmware-iwlwifi          20180825+dfsg-1~bpo9+1
pn  firmware-libertas         <none>
ii  firmware-linux-nonfree    20161130-4
ii  firmware-misc-nonfree     20161130-4
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information


Cheers,
-- 
Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant

--- End Message ---
--- Begin Message ---
Source: linux
Source-Version: 4.9.144-1

Hi Christoph,

On Wed, Jan 02, 2019 at 12:29:02PM +0100, Christoph Pfister wrote:
> found 917206 4.9.130-2
> thanks
> 
> tl;dr: This is a regression introduced in Debian 9.6
> (linux/4.9.130-2); it is caused by [1] and fixed by [2]. Please fix :)
> 
> I'm taking the liberty to hijack this bug because I'm experiencing the
> same issue [3] when powering off a usb3 hdd. The oops is easy to
> reproduce; I've tested the following versions of
> linux-image-4.9.0-8-amd64:
> 
> - 4.9.110-3+deb9u6: works
> - 4.9.130-2 (current stretch): affected
> - 4.9.135-1 (stretch-proposed-updates): affected
> - 4.9.130-2 + manually applying [2]: works

So this should be fixed in 4.9.136 upstrean and the change included in
the 4.9.144-1 upload which is pending in stable-new, and thus the next
increment for stretch-proposed-updates and the next point release.

Thanks for your triaging work and pin-pointing the fix!

Regards,
Salvatore

--- End Message ---

Reply to: