Used the rpi-update to get onto 6.1.y kernel branch, which is 6.1.74-v8+.
The system was up for about 2h 24m.? I connected to the gateway twice and exchanged mail.
First I got a kernel message about rmsgw, shortly after I connected and sent mail.
Feb 03 19:14:00 rpi3-dev rmsgw[1191]: sendrf(): [; KK6VLO de WA6BGS-10 SK
Feb 03 19:14:00 rpi3-dev rmsgw[1191]: sendrf(): wrote 25 of 25 characters
Feb 03 19:14:00 rpi3-dev rmsgw[1191]: Logout KK6VLO??? tx:63 rx:9902 173.0s 57.6 Bytes/s (0)
Feb 03 19:14:00 rpi3-dev rmsgw[1191]: CMS Disconnected
Feb 03 19:14:00 rpi3-dev kernel: ------------[ cut here ]------------
Feb 03 19:14:00 rpi3-dev kernel: refcount_t: underflow; use-after-free.
Feb 03 19:14:00 rpi3-dev kernel: WARNING: CPU: 2 PID: 1191 at lib/refcount.c:28 refcount_warn_saturate+0xf8/0x148
Feb 03 19:14:00 rpi3-dev kernel: Modules linked in: mkiss ax25 cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep vc4 brcmfmac snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper drm_kms_helper brcmutil binfmt_misc snd_soc_core hci_uart btbcm bluetooth cfg80211 snd_compress snd_pcm_dmaengine fb_sys_fops syscopyarea cdc_acm sysfillrect raspberrypi_hwmon sysimgblt bcm2835_codec(C) bcm2835_isp(C) bcm2835_v4l2(C) v4l2_mem2mem bcm2835_mmal_vchiq(C) videobuf2_dma_contig videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_bcm2835(C) videodev i2c_bcm2835 snd_pcm ecdh_generic ecc rfkill libaes snd_timer mc snd vc_sm_cma(C) raspberrypi_gpiomem uio_pdrv_genirq uio fuse drm dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6
Feb 03 19:14:00 rpi3-dev kernel: CPU: 2 PID: 1191 Comm: rmsgw Tainted: G???????? C???????? 6.1.74-v8+ #1725
Feb 03 19:14:00 rpi3-dev kernel: Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
Feb 03 19:14:00 rpi3-dev kernel: pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
Feb 03 19:14:00 rpi3-dev kernel: pc : refcount_warn_saturate+0xf8/0x148
Feb 03 19:14:00 rpi3-dev kernel: lr : refcount_warn_saturate+0xf8/0x148
Then it crashed a few minutes later on beacon...
Feb 03 19:20:01 rpi3-dev kernel: ------------[ cut here ]------------
Feb 03 19:20:01 rpi3-dev kernel: refcount_t: saturated; leaking memory.
Feb 03 19:20:01 rpi3-dev kernel: WARNING: CPU: 3 PID: 873 at lib/refcount.c:22 refcount_warn_saturate+0x78/0x148
Feb 03 19:20:01 rpi3-dev kernel: Modules linked in: mkiss ax25 cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep vc4 brcmfmac snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper drm_kms_helper brcmutil binfmt_misc snd_soc_core hci_uart btbcm bluetooth cfg80211 snd_compress snd_pcm_dmaengine fb_sys_fops syscopyarea cdc_acm sysfillrect raspberrypi_hwmon sysimgblt bcm2835_codec(C) bcm2835_isp(C) bcm2835_v4l2(C) v4l2_mem2mem bcm2835_mmal_vchiq(C) videobuf2_dma_contig videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_bcm2835(C) videodev i2c_bcm2835 snd_pcm ecdh_generic ecc rfkill libaes snd_timer mc snd vc_sm_cma(C) raspberrypi_gpiomem uio_pdrv_genirq uio fuse drm dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6
Feb 03 19:20:01 rpi3-dev kernel: CPU: 3 PID: 873 Comm: beacon Tainted: G??????? WC???????? 6.1.74-v8+ #1725
Feb 03 19:20:01 rpi3-dev kernel: Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
Feb 03 19:20:01 rpi3-dev kernel: pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
Feb 03 19:20:01 rpi3-dev kernel: pc : refcount_warn_saturate+0x78/0x148
Feb 03 19:20:01 rpi3-dev kernel: lr : refcount_warn_saturate+0x78/0x148
And strangely it still had enough to run one more cron entry.
Feb 03 19:42:01 rpi3-dev CRON[1246]: pam_unix(cron:session): session opened for user rmsgw(uid=999) by (uid=0)
Feb 03 19:42:01 rpi3-dev CRON[1247]: (rmsgw) CMD (/usr/local/bin/rmsgw_aci > /dev/null 2>&1)
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: WA6BGS-10 - Linux RMS Gateway ACI 2.5.1 Feb? 3 2024 (DM12ms)
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: shm_init(): shmkey = 159412 (0x26eb4)
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: shm_init(): shmid = 0 (0x0)
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Channel update interval = 7140
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Using channel file '/etc/rmsgw/channels.xml
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Channel file '/etc/rmsgw/channels.xml' age? 8109
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Channel: WA6BGS-10 on radio (145070000 Hz, mode 0)
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: /usr/local/bin/rmschanstat ax25 radio WA6BGS-10 reports unavailable
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Channel: WA6BGS-10 on radio is DOWN -- not updated
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Channel Stats: 1 read, 1 active, 1 down, 0 updated, 0 errors
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Version update interval = 86400
Feb 03 19:42:01 rpi3-dev rmsgw_aci[1248]: Version file '/usr/local/etc/rmsgw/stat/.version.WA6BGS-10' age 7578
Feb 03 19:42:01 rpi3-dev CRON[1246]: pam_unix(cron:session): session closed for user rmsgw
On the serial console, this appears.
[ 8670.831800] Call trace:
[ 8670.834290]? ax25cmp+0x14/0x60 [ax25]
[ 8670.838066]? ax25_bind+0x244/0x278 [ax25]
[ 8670.842194]? __sys_bind+0xe0/0x118
[ 8670.845668]? __arm64_sys_bind+0x28/0x38
[ 8670.849581]? invoke_syscall+0x4c/0x110
[ 8670.853409]? el0_svc_common.constprop.3+0x9c/0x100
[ 8670.858295]? do_el0_svc+0x34/0xd0
[ 8670.861679]? el0_svc+0x2c/0x78
[ 8670.864796]? el0t_64_sync_handler+0x98/0xc0
[ 8670.869059]? el0t_64_sync+0x18c/0x190
[ 8670.872800] Code: d503201f d2800002 d503233f 38626803 (38626824)
[ 8670.879001] ---[ end trace 0000000000000000 ]---
It's getting worse.
Time to find a release of Raspbian that will run 5.15, and while I work on that...? I'm going to load an x86_64 system and see if its any better.
