On Thu, Jan 21, 2021 at 08:37:31AM +0000, Joakim Zhang wrote:
> Our auto test scripts reports below kernel dump, after revert Oleksij Rempel
> patch "286228d382ba can: can_create_echo_skb(): fix echo skb generation: always
> use skb_clone()", this issue disappeared.  What strange is that, commit message
> intends to fix this issue. Report it here to see if anyone meets the same issue
> or can give some suggestions. I will continue to dig how to reproduce it
> manually, now I don't know how to do it. Thanks.

The backtrace looks more or less like a normal TX-path to me. Although the send
is not directly in the call stack of a user space application, but it's
deferred and then sent by the net_tx_action().

I have the feeling, that this backtrace is triggered by the same problem that
Oleksij tried to fix. Some CAN frames were send on a socket, that socket was
closed and the skbs have reached 0 refcount, after this the frames were put
into the driver.

With Oleksij's patch the skb is always cloned, this means the refcount is
always checked. Reverting that patch covers the problem.

If you can reproduce, revert the patch and add a refcount check againt 0 only.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |