Bug #3882
__kmem_cache_alloc_node crashed and ZTE133 reboot "Unable to handle kernel paging request at virtual address 0020202020202420" during 5G iperf UDP-RX RvR test on intel ax210
0%
Description
1.0.29 FTTR TPT版本复现该问题:
[2025-12-19_19:22:14.446]w3_drv: rd paddr=0xf7004440 val=0x000128c4
[2025-12-19_19:22:14.989]Unable to handle kernel paging request at virtual address 0034303237202420
[2025-12-19_19:22:15.005]Mem abort info:
[2025-12-19_19:22:15.005] ESR = 0x0000000096000004
[2025-12-19_19:22:15.005] EC = 0x25: DABT (current EL), IL = 32 bits
[2025-12-19_19:22:15.005] SET = 0, FnV = 0
[2025-12-19_19:22:15.005] EA = 0, S1PTW = 0
[2025-12-19_19:22:15.005] FSC = 0x04: level 0 translation fault
[2025-12-19_19:22:15.005]Data abort info:
[2025-12-19_19:22:15.005] ISV = 0, ISS = 0x00000004
[2025-12-19_19:22:15.005] CM = 0, WnR = 0
[2025-12-19_19:22:15.005][0034303237202420] address between user and kernel address ranges
[2025-12-19_19:22:15.005]Internal error: Oops: 0000000096000004 [#1] SMP
[2025-12-19_19:22:15.054]11930:48:58 [OSS_Modules linked in: w3(OE) usrline_si(OE) nf_nat_tftp(E) nf_conntrack_tftp(E) nf_nat_pptp(E) nf_conntrack_pptp(E) nf_nat_ftp(E) nf_conntrack_ftp(E) nf_nat_sip(E) nf_conntrack_sip(E) nf_conn(OE) upload_optimize(OE) download(OE) olt_bob(OE) GN28L95 rtsp_alg(OE) dsp_dev(OE) voip_codec(OE) kudp(OE) optical(OE) switch(OE) multicast(OE) netdriver(OE) ffe(OE) iprt(OE) wan_bridge(OE) region_init(OE) qos_mod(OE) zx_ponreg_133(OE) woe_debug(OE) np_133(OE) ipsec(OE) ide(OE) nppt(OE) pps(OE) plat(OE) rlt8226b(OE) peripheral_201(OE) zxic_sensor(OE) bspdriver(OE) [last unloaded: w3(OE)]
[2025-12-19_19:22:15.101]CPU: 1 PID: 8468 Comm: dropbear Tainted: G W OE 6.1.33 #5
[2025-12-19_19:22:15.101]Hardware name: ZTE 133 (DT)
[2025-12-19_19:22:15.101]httpd][Error] [opstate: 20000005 (nzCv daif PAN -UAO -TCO -DIT -SSBS BTYPE=-)
[2025-12-19_19:22:15.101]ss_comm.c(2419)Sopc : _kmem_cache_alloc_node+0xb4/0x168
[2025-12-19_19:22:15.101]cketSynSendMsg] lr : __kmem_cache_alloc_node+0x6c/0x168
[2025-12-19_19:22:15.101]SocketSynSendMsgsp : ffffffc016ae32f0
[2025-12-19_19:22:15.101] sendto 0X000116x29: ffffffc016ae32f0 x28: ffffff80030b5068 x27: 00000000ffffffff
[2025-12-19_19:22:15.101]x26: 0000000000004282 x25: ffffffc008aff130 x24: ffffffc0084f8ee8
[2025-12-19_19:22:15.101]00 ERROR iLen=-1 x23: 0000000000000800 x22: 00000000ffffffff x21: 0000000000082a20
[2025-12-19_19:22:15.133]x20: ffffffc008a14000 x19: ffffff8001001600 x18: 0000000000000000
[2025-12-19_19:22:15.133]errno=[111:Connex17: 000000ca00d800ec x16: 0000000800000000 x15: 13afaa514e09f747
[2025-12-19_19:22:15.133]ction refused]!!!x14: 21432f9ad4c157b0 x13: dc2cfa0f5e966a27 x12: f802673c13afaa51
[2025-12-19_19:22:15.133]
[2025-12-19_19:22:15.133]11930x:48:581 1: 0b58e6de185281f2 x10: 4418aa880cb887da x9 : 0000000000000000
[2025-12-19_19:22:15.133]OSS_httpd][Error] [oss_common.c(867)SSEND] [tr069_wlan][00030300] SSEND Send Message[0X2402] to [wlan_mgr][00011600] socket failed
[2025-12-19_19:22:15.181]11930:48:58 [tr069_wlan][Error] [wlan_pmapi.c(5034)pm_wlan_list_ad] send msg fail iRet:-3
[2025-12-19_19:22:15.181]11930:48:58 [OSS_httpd][Error] [oss_comm.c(2419)SocketSynSendMsg] SocketSynSendMsg sendto 0X00011600 ERROR iLen=-1 errno=[111:Connection refused]!!!
[2025-12-19_19:22:15.181]11930:48:58 [OSS_httpd][Error] [oss_common.c(867)SSEND] [tr069_wlan][00030300] SSEND Send Message[0X2402] to [wlan_mgr][00011600] socket failed
[2025-12-19_19:22:15.181]11930:48:58 [tr069_wlan][Error] [wlan_pmapi.c(5034)pm_wlan_list_ad] send msg fail iRet:-3
[2025-12-19_19:22:15.229]11930:48:58 [OSS_httpd][Error] [oss_comm.c(2419)SocketSynSendMsg] SocketSynSendMsg sendto 0X00011600 ERROR iLen=-1 errno=[111:Connection refused]!!!
[2025-12-19_19:22:15.229]11930:48:58 [OSS_httpd][Error] [oss_common.c(867)SSEND] [tr069_wlan][00030300] SSEND Send Message[0X2402] to [wlan_mgr][00011600] socket failed
[2025-12-19_19:22:15.229]11930:48:58 [tr069_wlan][Error] [wlan_pmapi.c(5034)pm_wlan_list_ad] send msg fail iRet:-3
[2025-12-19_19:22:15.229]11930:48:58 [OSS_httpd][Error] [oss_comm.c(2419)SocketSynSendMsg] SocketSynSendMsg sendto 0X00011600 ERROR iLen=-1 errno=[111:Connection refused]!!!
[2025-12-19_19:22:15.277]11930:48:58 [OSS_httpd][Error] [oss_common.c(867)SSEND] [tr069_wlan][00030300] SSEND Send Message[0X2402] to [wlan_mgr][00011600] socket failed
[2025-12-19_19:22:15.277]11930:48:58 [tr069_wlan][Error] [wlan_pmapi.c(5034)pm_wlan_list_ad] send msg fail iRet:-3
[2025-12-19_19:22:15.277]x8 : ffffff8001a82138 x7 : 00000000ffffffff x6 : 0000000000082a20
[2025-12-19_19:22:15.277]x5 : 0000000000000800 x4 : ffffff801fea5130 x3 : 0000000000000001
[2025-12-19_19:22:15.277]x2 : 0000000000000400 x1 : 0000000000082a20 x0 : 3134303237202020
[2025-12-19_19:22:15.277]Call trace:
[2025-12-19_19:22:15.277] __kmem_cache_alloc_node+0xb4/0x168
[2025-12-19_19:22:15.277] __kmalloc_node_track_caller+0x48/0x58
[2025-12-19_19:22:15.277] kmalloc_reserve+0x50/0xb0
[2025-12-19_19:22:15.277] __alloc_skb+0x118/0x214
[2025-12-19_19:22:15.314] skb_segment+0x45c/0x9c4
[2025-12-19_19:22:15.314] tcp_gso_segment+0xf4/0x3f0
[2025-12-19_19:22:15.314] tcp4_gso_segment+0x8c/0xa0
[2025-12-19_19:22:15.314] inet_gso_segment+0x174/0x2f4
[2025-12-19_19:22:15.314] skb_mac_gso_segment+0x90/0xf0
[2025-12-19_19:22:15.314] __skb_gso_segment+0xb8/0x10c
[2025-12-19_19:22:15.314] validate_xmit_skb+0x94/0x1d0
[2025-12-19_19:22:15.314] __dev_queue_xmit+0x56c/0x684
[2025-12-19_19:22:15.314] ip_finish_output2+0x28c/0x2f0
[2025-12-19_19:22:15.314] __ip_finish_output+0xf0/0x14c
[2025-12-19_19:22:15.314] ip_output+0x7c/0xb4
[2025-12-19_19:22:15.314] dst_output+0x18/0x20
[2025-12-19_19:22:15.314] ip_local_out+0x38/0x48
[2025-12-19_19:22:15.314]11930:48:58 [OSS __ip_queue_xmit+0x288/0x2f4
[2025-12-19_19:22:15.314]pc][Warn] [pc.c(1585)ScanProgram] scan: hol23158 died counter=1
[2025-12-19_19:22:15.359]11930:48:58 [OSS_pc][Warn] [pc.c(1601)ScanProgram] hol23158 delay restart
[2025-12-19_19:22:15.359] ip_queue_xmit+0x10/0x18
[2025-12-19_19:22:15.359] __tcp_transmit_skb+0x77c/0x804
[2025-12-19_19:22:15.359] tcp_transmit_skb+0x10/0x18
[2025-12-19_19:22:15.359] tcp_write_xmit+0x52c/0xbc0
[2025-12-19_19:22:15.359] __tcp_push_pending_frames+0x38/0x7c
[2025-12-19_19:22:15.359] tcp_push+0x90/0x11c
[2025-12-19_19:22:15.359] tcp_sendmsg_locked+0x6cc/0x8ec
[2025-12-19_19:22:15.359] tcp_sendmsg+0x30/0x50
[2025-12-19_19:22:15.359] inet_sendmsg+0x40/0x58
[2025-12-19_19:22:15.359] sock_sendmsg+0x38/0x50
[2025-12-19_19:22:15.359] sock_write_iter+0xa8/0xe8
[2025-12-19_19:22:15.359] do_iter_readv_writev+0xe0/0x118
[2025-12-19_19:22:15.359] do_iter_write+0x78/0xb8
[2025-12-19_19:22:15.359] vfs_writev+0x74/0xb8
[2025-12-19_19:22:15.359] do_writev+0x80/0xd8
[2025-12-19_19:22:15.359] __arm64_sys_writev+0x18/0x20
[2025-12-19_19:22:15.405] invoke_syscall+0x74/0x108
[2025-12-19_19:22:15.405] el0_svc_common.constprop.3+0xac/0xe8
[2025-12-19_19:22:15.405] do_el0_svc_compat+0x18/0x2c
[2025-12-19_19:22:15.405] el0_svc_compat+0x1c/0x44
[2025-12-19_19:22:15.405] el0t_32_sync_handler+0xb0/0xfc
[2025-12-19_19:22:15.405] el0t_32_sync+0x160/0x164
[2025-12-19_19:22:15.405]Code: 97fff8d1 f90037a0 1400000e b9402a62 (f8626819)
[2025-12-19_19:22:15.405]---[ end trace 0000000000000000 ]---
[2025-12-19_19:22:15.405]Kernel panic - not syncing: Oops: Fatal exception in interrupt
[2025-12-19_19:22:15.405]SMP: stopping secondary CPUs
[2025-12-19_19:22:15.405]Kernel Offset: disabled
[2025-12-19_19:22:15.405]CPU features: 0x00000,00800084,0000420b
[2025-12-19_19:22:15.405]Memory Limit: none
[2025-12-19_19:22:15.405]w3_drv: amlogic 11ax WLAN driver:
[2025-12-19_19:22:15.454]w3_drv: - release: rel-v1.0.29
[2025-12-19_19:22:15.454]w3_drv: - build : sw - 2025-12-16 12:15:04
[2025-12-19_19:22:15.454]w3_drv: - commit : 1ed18389 (v1216-tput-release)
[2025-12-19_19:22:15.454]Rebooting in 2 seconds..
History
#1 Updated by 齐 刘 3 months ago
- Status changed from New to In Progress
[2025-12-19_19:22:14.446]w3_drv: rd paddr=0xf7004440 val=0x000128c4
[2025-12-19_19:22:14.989]Unable to handle kernel paging request at virtual address 0034303237202420
[2025-12-19_19:22:15.005][0034303237202420] address between user and kernel address ranges
[last unloaded: w3(OE)]
在 5G UDP RX RvR 高负载场景下，内核出现 Unable to handle kernel paging request 和 kmem_cache_alloc_node 崩溃，地址是明显垃圾值，且 taint 记录最近卸载模块为 w3(OE)，有没有可能 w3 的卸载流程不干净，留下了悬空回调或未清理的引用，导致后续中断/工作队列访问已释放的代码或数据，从而触发非法指针访问和 panic
如果不执行unload 问题是否还会出现
#2 Updated by jie cheng 3 months ago
齐 刘 wrote:
[2025-12-19_19:22:14.446]w3_drv: rd paddr=0xf7004440 val=0x000128c4
[2025-12-19_19:22:14.989]Unable to handle kernel paging request at virtual address 0034303237202420
[2025-12-19_19:22:15.005][0034303237202420] address between user and kernel address ranges[last unloaded: w3(OE)]
在 5G UDP RX RvR 高负载场景下，内核出现 Unable to handle kernel paging request 和 kmem_cache_alloc_node 崩溃，地址是明显垃圾值，且 taint 记录最近卸载模块为 w3(OE)，有没有可能 w3 的卸载流程不干净，留下了悬空回调或未清理的引用，导致后续中断/工作队列访问已释放的代码或数据，从而触发非法指针访问和 panic
如果不执行unload 问题是否还会出现
同样的w3软件在router版本无此问题，w3卸载是因为前面有oom kill多种进程，其中包括cspd进程，oom killer cspd时，会走卸载w3的逻辑，前因是oom, 且显示可用memory打开只有2m左右，怀疑是fttr版本的平台有内存泄漏，导致长时间memory不够用，需要先解决这类问题