Bug 219352

Summary: [6.11.2 regression, kernel warning] psmouse: kernfs: can not remove '0-0015', no directory
Product: Drivers Reporter: Oleksii Shevchuk (alxchk)
Component: Input DevicesAssignee: drivers_input-devices
Status: NEW ---    
Severity: normal CC: gavinnjohn
Priority: P3    
Hardware: All   
OS: Linux   
Kernel Version: Subsystem:
Regression: No Bisected commit-id:

Description Oleksii Shevchuk 2024-10-05 11:17:17 UTC
Kernel warning on rmmod psmouse and during boot

[  894.182192] ------------[ cut here ]------------
[  894.182199] kernfs: can not remove '0-0015', no directory
[  894.182215] WARNING: CPU: 7 PID: 559 at fs/kernfs/dir.c:1683 kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182228] Modules linked in: psmouse(-) tun snd_seq_dummy snd_hrtimer rfcomm snd_seq snd_seq_device uhid xfs wireguard libchacha20poly1305 chacha_x86_64 poly1305_x86_64 algif_aead des3_ede_x86_64 algif_skcipher algif_hash af_alg joydev mousedev bnep snd_hda_codec_hdmi elan_i2c snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component intel_uncore_frequency intel_uncore_frequency_common intel_pmc_core_pltdrv intel_pmc_core intel_vsec pmt_telemetry pmt_class kvm_intel btusb uvcvideo uvc snd_hda_intel videobuf2_vmalloc kvm btrtl videobuf2_memops snd_intel_dspcfg btbcm videobuf2_v4l2 crct10dif_pclmul snd_hda_codec btmtk crc32_pclmul polyval_clmulni videodev btintel polyval_generic snd_hwdep think_lmi ghash_clmulni_intel videobuf2_common iTCO_wdt snd_hda_core iwlmvm sha512_ssse3 bluetooth mc iTCO_vendor_support firmware_attributes_class wmi_bmof intel_wmi_thunderbolt snd_ctl_led mac80211 sha256_ssse3 sdhci_pci atkbd cqhci i915 vivaldi_fmap sha1_ssse3 snd_pcm thinkpad_acpi sdhci i2c_algo_bit drm_buddy
[  894.182332]  thunderbolt intel_rapl_msr mmc_core platform_profile mei_hdcp video iwlwifi mei_pxp snd_timer ttm i2c_i801 snd soundcore i2c_smbus drm_display_helper ucsi_acpi drm_kms_helper cfg80211 intel_gtt typec_ucsi agpgart rfkill roles typec wmi vboxnetadp(O) vboxnetflt(O) auth_rpcgss drm vboxdrv(O) i2c_core sunrpc [last unloaded: psmouse]
[  894.182386] CPU: 7 UID: 0 PID: 559 Comm: kworker/7:2 Tainted: G S   U  W  O       6.11.2 #2 c74b5120bb91b3476b5048457fde2ff492790d3d
[  894.182399] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [W]=WARN, [O]=OOT_MODULE
[  894.182402] Hardware name: LENOVO 20NXCTO1WW/20NXCTO1WW, BIOS N2JET97W (1.75 ) 11/19/2021
[  894.182406] Workqueue: psmouse-smbus psmouse_smbus_remove_i2c_device [psmouse]
[  894.182448] RIP: 0010:kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182458] Code: 31 d2 31 f6 31 ff c3 cc cc cc cc 48 89 ef e8 e1 cb b9 ff b8 fe ff ff ff eb e0 0f 0b eb ae 48 c7 c7 30 dc 9e bd e8 4a dc ae ff <0f> 0b eb e5 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90
[  894.182464] RSP: 0018:ffff9ae3c0667dc8 EFLAGS: 00010246
[  894.182472] RAX: 0000000000000000 RBX: ffff890286033840 RCX: 0000000000000000
[  894.182477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  894.182480] RBP: ffff890267376020 R08: 0000000000000000 R09: 0000000000000000
[  894.182484] R10: 0000000000000000 R11: 2c27353130302d30 R12: ffff890259aa8e08
[  894.182488] R13: ffff8905905ef700 R14: 0000000004208060 R15: ffff89024c5ca098
[  894.182492] FS:  0000000000000000(0000) GS:ffff8905905c0000(0000) knlGS:0000000000000000
[  894.182496] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  894.182501] CR2: 00007fc9dfdfe068 CR3: 0000000144c34004 CR4: 00000000003706f0
[  894.182505] Call Trace:
[  894.182510]  <TASK>
[  894.182513]  ? kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182520]  ? __warn.cold+0x8e/0xfb
[  894.182529]  ? kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182539]  ? report_bug+0xf9/0x140
[  894.182550]  ? handle_bug+0x40/0x80
[  894.182556]  ? exc_invalid_op+0x17/0x80
[  894.182562]  ? asm_exc_invalid_op+0x1a/0x40
[  894.182571]  ? kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182578]  ? kernfs_remove_by_name_ns+0xb6/0xc0
[  894.182585]  software_node_notify_remove+0x77/0xc0
[  894.182594]  device_del+0x17b/0x400
[  894.182602]  device_unregister+0x17/0x80
[  894.182610]  psmouse_smbus_remove_i2c_device+0x18/0x40 [psmouse 9c9f2a774796f560d72c605f37ea4001e749749d]
[  894.182646]  process_one_work+0x12d/0x2c0
[  894.182658]  worker_thread+0x33a/0x480
[  894.182667]  ? __pfx_worker_thread+0x40/0x40
[  894.182674]  kthread+0xbb/0x100
[  894.182681]  ? __pfx_kthread+0x40/0x40
[  894.182686]  ret_from_fork+0x31/0x80
[  894.182694]  ? __pfx_kthread+0x40/0x40
[  894.182698]  ret_from_fork_asm+0x1a/0x80
[  894.182710]  </TASK>
[  894.182713] ---[ end trace 0000000000000000 ]---
Comment 1 Gavin John 2024-11-15 08:41:06 UTC
I'm also hitting this. After about 4-6 hours, my Thinkpad t480s's trackpoint, trackpad, and trackpad mouse buttons stop working and I get a similar message. Restarting the psmouse kernel module restores trackpoint, trackpad, and trackpad button functionality. I am currently using the NixOS prebuilt kernel 6.11.7, and unfortunately I didn't record the kernel version where this first started and the kernel version before that.

[ 2476.508622] ------------[ cut here ]------------
[ 2476.508626] kernfs: can not remove '7-0015', no directory
[ 2476.508635] WARNING: CPU: 6 PID: 182027 at fs/kernfs/dir.c:1683 kernfs_remove_by_name_ns+0xc7/0xd0
[ 2476.508643] Modules linked in: qrtr uinput ccm rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device af_packet cmac algif_hash algif_skcipher af_alg bnep nf_log_syslog nft_log nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nf_tables libcrc32c snd_sof_pci_intel_skl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils soundwire_generic_allocation soundwire_bus snd_soc_avs intel_uncore_frequency intel_uncore_frequency_common intel_pmc_core_pltdrv intel_pmc_core intel_vsec snd_soc_hda_codec pmt_telemetry nls_iso8859_1 elan_i2c pmt_class snd_hda_codec_hdmi nls_cp437 snd_soc_skl intel_tcc_cooling vfat snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core iwlmvm fat x86_pkg_temp_thermal intel_powerclamp snd_soc_acpi_intel_match iTCO_wdt snd_hda_codec_realtek mei_wdt intel_pmc_bxt snd_soc_acpi ee1004 mei_hdcp watchdog mei_pxp
[ 2476.508712]  intel_rapl_msr coretemp snd_hda_codec_generic snd_soc_core snd_hda_scodec_component mac80211 crct10dif_pclmul snd_compress crc32_pclmul ac97_bus polyval_clmulni uvcvideo polyval_generic snd_pcm_dmaengine ghash_clmulni_intel libarc4 sha512_ssse3 sha256_ssse3 sha1_ssse3 aesni_intel gf128mul videobuf2_vmalloc crypto_simd snd_hda_intel uvc videobuf2_memops snd_intel_dspcfg cryptd videobuf2_v4l2 snd_intel_sdw_acpi rapl btusb iwlwifi videodev snd_hda_codec btrtl btintel btbcm intel_cstate sch_fq_codel snd_hda_core btmtk e1000e think_lmi videobuf2_common snd_hwdep processor_thermal_device_pci_legacy intel_uncore snd_ctl_led bluetooth mc intel_wmi_thunderbolt firmware_attributes_class psmouse(-) mousedev cfg80211 wmi_bmof joydev snd_pcm i2c_i801 ptp i2c_mux processor_thermal_device snd_timer i2c_smbus iosm pps_core processor_thermal_wt_hint processor_thermal_rfim thinkpad_acpi wwan mei_me processor_thermal_rapl nvram intel_lpss_pci intel_rapl_common mei intel_lpss platform_profile 8250_pci
[ 2476.508797]  processor_thermal_wt_req idma64 sparse_keymap virt_dma processor_thermal_power_floor intel_pch_thermal processor_thermal_mbox thermal intel_soc_dts_iosf ucsi_acpi rfkill typec_ucsi intel_xhci_usb_role_switch typec snd roles hid_multitouch int3403_thermal msr soundcore input_leds battery led_class ac int340x_thermal_zone tiny_power_button evdev mac_hid int3400_thermal acpi_thermal_rel button acpi_pad serio_raw loop tun tap macvlan bridge stp llc kvm_intel kvm fuse efi_pstore configfs nfnetlink dmi_sysfs ext4 crc32c_generic crc16 mbcache jbd2 hid_generic usbhid hid dm_mod dax tpm_crb nvme nvme_core atkbd libps2 vivaldi_fmap xhci_pci i8042 xhci_pci_renesas crc32c_intel nvme_auth tpm_tis rtc_cmos serio xhci_hcd tpm_tis_core i915 i2c_algo_bit drm_buddy video wmi backlight ttm intel_gtt drm_display_helper cec efivarfs tpm rng_core libaescfb ecdh_generic ecc autofs4
[ 2476.508883] CPU: 6 UID: 0 PID: 182027 Comm: kworker/6:1 Tainted: G S                 6.11.7 #1-NixOS
[ 2476.508888] Tainted: [S]=CPU_OUT_OF_SPEC
[ 2476.508889] Hardware name: LENOVO 20L7S37500/20L7S37500, BIOS N22ET70W (1.47 ) 08/11/2021
[ 2476.508891] Workqueue: psmouse-smbus psmouse_smbus_remove_i2c_device [psmouse]
[ 2476.508913] RIP: 0010:kernfs_remove_by_name_ns+0xc7/0xd0
[ 2476.508919] Code: ef e8 9d c5 c3 ff 5b b8 fe ff ff ff 5d 41 5c 41 5d 31 d2 31 f6 31 ff c3 cc cc cc cc 90 48 c7 c7 80 30 76 a0 e8 3a bc ba ff 90 <0f> 0b 90 90 eb d6 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90
[ 2476.508922] RSP: 0000:ffffa3d7cfbefdc0 EFLAGS: 00010246
[ 2476.508925] RAX: 0000000000000000 RBX: ffff9c6781485440 RCX: 0000000000000000
[ 2476.508927] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 2476.508929] RBP: ffff9c6785c54820 R08: 0000000000000000 R09: 0000000000000000
[ 2476.508931] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9c67814fcfb0
[ 2476.508933] R13: ffff9c68c1eadb40 R14: 0000000004208060 R15: ffff9c6783e34098
[ 2476.508935] FS:  0000000000000000(0000) GS:ffff9c6ce9700000(0000) knlGS:0000000000000000
[ 2476.508937] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2476.508940] CR2: 0000225c04097ea0 CR3: 0000000156f40005 CR4: 00000000003706f0
[ 2476.508942] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2476.508944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2476.508946] Call Trace:
[ 2476.508948]  <TASK>
[ 2476.508953]  ? __warn+0x80/0x120
[ 2476.508957]  ? kernfs_remove_by_name_ns+0xc7/0xd0
[ 2476.508961]  ? report_bug+0x172/0x1a0
[ 2476.508967]  ? handle_bug+0x61/0xb0
[ 2476.508972]  ? exc_invalid_op+0x17/0x80
[ 2476.508976]  ? asm_exc_invalid_op+0x1a/0x20
[ 2476.508983]  ? kernfs_remove_by_name_ns+0xc7/0xd0
[ 2476.508988]  software_node_notify_remove+0x77/0xb0
[ 2476.508992]  device_del+0x17b/0x3f0
[ 2476.508997]  device_unregister+0x17/0x70
[ 2476.509000]  psmouse_smbus_remove_i2c_device+0x18/0x40 [psmouse]
[ 2476.509013]  process_one_work+0x18f/0x3b0
[ 2476.509018]  worker_thread+0x230/0x340
[ 2476.509021]  ? __pfx_worker_thread+0x10/0x10
[ 2476.509023]  kthread+0xcd/0x100
[ 2476.509027]  ? __pfx_kthread+0x10/0x10
[ 2476.509029]  ret_from_fork+0x31/0x50
[ 2476.509034]  ? __pfx_kthread+0x10/0x10
[ 2476.509037]  ret_from_fork_asm+0x1a/0x30
[ 2476.509042]  </TASK>
[ 2476.509043] ---[ end trace 0000000000000000 ]---
[ 2476.509046] ------------[ cut here ]------------
[ 2476.509047] refcount_t: underflow; use-after-free.
[ 2476.509057] WARNING: CPU: 6 PID: 182027 at lib/refcount.c:28 refcount_warn_saturate+0xe0/0x140
[ 2476.509062] Modules linked in: qrtr uinput ccm rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device af_packet cmac algif_hash algif_skcipher af_alg bnep nf_log_syslog nft_log nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nf_tables libcrc32c snd_sof_pci_intel_skl snd_sof_intel_hda_generic soundwire_intel soundwire_cadence snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils soundwire_generic_allocation soundwire_bus snd_soc_avs intel_uncore_frequency intel_uncore_frequency_common intel_pmc_core_pltdrv intel_pmc_core intel_vsec snd_soc_hda_codec pmt_telemetry nls_iso8859_1 elan_i2c pmt_class snd_hda_codec_hdmi nls_cp437 snd_soc_skl intel_tcc_cooling vfat snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core iwlmvm fat x86_pkg_temp_thermal intel_powerclamp snd_soc_acpi_intel_match iTCO_wdt snd_hda_codec_realtek mei_wdt intel_pmc_bxt snd_soc_acpi ee1004 mei_hdcp watchdog mei_pxp
[ 2476.509121]  intel_rapl_msr coretemp snd_hda_codec_generic snd_soc_core snd_hda_scodec_component mac80211 crct10dif_pclmul snd_compress crc32_pclmul ac97_bus polyval_clmulni uvcvideo polyval_generic snd_pcm_dmaengine ghash_clmulni_intel libarc4 sha512_ssse3 sha256_ssse3 sha1_ssse3 aesni_intel gf128mul videobuf2_vmalloc crypto_simd snd_hda_intel uvc videobuf2_memops snd_intel_dspcfg cryptd videobuf2_v4l2 snd_intel_sdw_acpi rapl btusb iwlwifi videodev snd_hda_codec btrtl btintel btbcm intel_cstate sch_fq_codel snd_hda_core btmtk e1000e think_lmi videobuf2_common snd_hwdep processor_thermal_device_pci_legacy intel_uncore snd_ctl_led bluetooth mc intel_wmi_thunderbolt firmware_attributes_class psmouse(-) mousedev cfg80211 wmi_bmof joydev snd_pcm i2c_i801 ptp i2c_mux processor_thermal_device snd_timer i2c_smbus iosm pps_core processor_thermal_wt_hint processor_thermal_rfim thinkpad_acpi wwan mei_me processor_thermal_rapl nvram intel_lpss_pci intel_rapl_common mei intel_lpss platform_profile 8250_pci
[ 2476.509188]  processor_thermal_wt_req idma64 sparse_keymap virt_dma processor_thermal_power_floor intel_pch_thermal processor_thermal_mbox thermal intel_soc_dts_iosf ucsi_acpi rfkill typec_ucsi intel_xhci_usb_role_switch typec snd roles hid_multitouch int3403_thermal msr soundcore input_leds battery led_class ac int340x_thermal_zone tiny_power_button evdev mac_hid int3400_thermal acpi_thermal_rel button acpi_pad serio_raw loop tun tap macvlan bridge stp llc kvm_intel kvm fuse efi_pstore configfs nfnetlink dmi_sysfs ext4 crc32c_generic crc16 mbcache jbd2 hid_generic usbhid hid dm_mod dax tpm_crb nvme nvme_core atkbd libps2 vivaldi_fmap xhci_pci i8042 xhci_pci_renesas crc32c_intel nvme_auth tpm_tis rtc_cmos serio xhci_hcd tpm_tis_core i915 i2c_algo_bit drm_buddy video wmi backlight ttm intel_gtt drm_display_helper cec efivarfs tpm rng_core libaescfb ecdh_generic ecc autofs4
[ 2476.509255] CPU: 6 UID: 0 PID: 182027 Comm: kworker/6:1 Tainted: G S      W          6.11.7 #1-NixOS
[ 2476.509260] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 2476.509261] Hardware name: LENOVO 20L7S37500/20L7S37500, BIOS N22ET70W (1.47 ) 08/11/2021
[ 2476.509263] Workqueue: psmouse-smbus psmouse_smbus_remove_i2c_device [psmouse]
[ 2476.509280] RIP: 0010:refcount_warn_saturate+0xe0/0x140
[ 2476.509284] Code: f6 31 ff c3 cc cc cc cc 80 3d 6f 30 7c 01 00 0f 85 65 ff ff ff c6 05 62 30 7c 01 01 90 48 c7 c7 48 d3 76 a0 e8 71 a3 a6 ff 90 <0f> 0b 90 90 31 f6 31 ff c3 cc cc cc cc 80 3d 41 30 7c 01 00 0f 85
[ 2476.509287] RSP: 0000:ffffa3d7cfbefde0 EFLAGS: 00010246
[ 2476.509289] RAX: 0000000000000000 RBX: ffff9c6781485440 RCX: 0000000000000000
[ 2476.509291] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 2476.509293] RBP: ffff9c6785c54820 R08: 0000000000000000 R09: 0000000000000000
[ 2476.509294] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9c6781485400
[ 2476.509296] R13: ffff9c68c1eadb40 R14: 0000000004208060 R15: ffff9c6783e34098
[ 2476.509298] FS:  0000000000000000(0000) GS:ffff9c6ce9700000(0000) knlGS:0000000000000000
[ 2476.509300] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2476.509302] CR2: 0000225c04097ea0 CR3: 0000000156f40005 CR4: 00000000003706f0
[ 2476.509305] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2476.509306] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2476.509308] Call Trace:
[ 2476.509309]  <TASK>
[ 2476.509311]  ? __warn+0x80/0x120
[ 2476.509314]  ? refcount_warn_saturate+0xe0/0x140
[ 2476.509319]  ? report_bug+0x172/0x1a0
[ 2476.509324]  ? handle_bug+0x61/0xb0
[ 2476.509328]  ? exc_invalid_op+0x17/0x80
[ 2476.509331]  ? asm_exc_invalid_op+0x1a/0x20
[ 2476.509337]  ? refcount_warn_saturate+0xe0/0x140
[ 2476.509341]  software_node_notify_remove+0x8e/0xb0
[ 2476.509345]  device_del+0x17b/0x3f0
[ 2476.509349]  device_unregister+0x17/0x70
[ 2476.509352]  psmouse_smbus_remove_i2c_device+0x18/0x40 [psmouse]
[ 2476.509368]  process_one_work+0x18f/0x3b0
[ 2476.509372]  worker_thread+0x230/0x340
[ 2476.509375]  ? __pfx_worker_thread+0x10/0x10
[ 2476.509378]  kthread+0xcd/0x100
[ 2476.509381]  ? __pfx_kthread+0x10/0x10
[ 2476.509385]  ret_from_fork+0x31/0x50
[ 2476.509388]  ? __pfx_kthread+0x10/0x10
[ 2476.509391]  ret_from_fork_asm+0x1a/0x30
[ 2476.509397]  </TASK>
[ 2476.509398] ---[ end trace 0000000000000000 ]---

(I'm new to the kernel bugzilla; please let me know if I've done anything wrong!)
Comment 2 Gavin John 2024-11-19 22:18:32 UTC
It's gotten significantly worse since my last comment. This happens regularly at least once an hour. Rebooting does not seem to cause it to happen less frequently.