[Bug 2165889] Re: [SRU] Fix issues with dGPUs in eGPU enclosure

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165889 Title: [SRU] Fix issues with dGPUs in eGPU enclosure Status in linux package in Ubuntu: New Status in linux-oem-7.0 package in Ubuntu: New Bug description: BugLink: https://bugs.launchpad.net/bugs/2165889 [ Impact ] We found when some AMD eGPUs are connected via thunderbolt (thus through PCIe tunneling), pure compute workload via ROCm won't launch without also connecting the said eGPU to a display. This is due to mismatched expectation from runtime PM when dGPU is not connected to root port but is instead external. [ Fix ] Cherry-pick the following commit, which is currently in 7.3-rc1 (c52feb436539): - drm/amdgpu: Disable runtime PM for externally attached dGPUs [ Test plan ] - Connect the eGPU with thunderbolt - Without connecting the eGPU to any display, launch compute workload with ROCm - The workload should run. [ Where problems could occur ] This impacts runtime power management behavior for GPUs connected externally via thunderbolt. This in theory doesn't impact dGPUs and iGPUs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165889/+subscriptions

[Bug 2165930] Re: Kernel oops (GPF) in __run_timers via tmigr_handle_remote on 7.0.0-28-generic under network load

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165930 Title: Kernel oops (GPF) in __run_timers via tmigr_handle_remote on 7.0.0-28-generic under network load Status in linux package in Ubuntu: New Bug description: [Impact] Kernel takes a general protection fault in __run_timers while handling remote timer expiry for an idle CPU. The faulting address is 0xdead000000000122 (LIST_POISON2), indicating timer-wheel list corruption in the timer-migration (tmigr) subsystem. The oops is preceded by two WARNs at kernel/workqueue.c:2351 in __queue_work.part.0 from delayed_work_timer_fn. The system becomes unresponsive and reboots (panic=-1). [Environment] * Ubuntu 26.04 * Kernel: 7.0.0-28-generic (Ubuntu 7.0.0-28.28-generic 7.0.12) #28-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 21 01:01:36 UTC 2026 * Built with gcc 15.2.0-16ubuntu1, ld 2.46 * Ubuntu Core-style install: snapd_recovery_mode=run, immutable /usr, pc-kernel snap, Secure Boot enabled, kernel lockdown active * QEMU/KVM guest, Q35 + ICH9, BIOS 2025.11-3ubuntu7 03/31/2026, 4 vCPUs, ~8 GiB RAM * Boot log confirms timer migration is enabled: "Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level" [Steps to Reproduce] 1. Boot the VM into a normal graphical session. 2. Open Chromium (snap) and start a large HTTP(S) download (multi-hundred-MB or larger). 3. Within tens of seconds the two workqueue WARNs fire, followed shortly by the fatal GPF in __run_timers. The machine freezes or auto-reboots. The crashing task in every trace is swapper/N (idle CPU), not Chromium. The download is a workload trigger, not the cause -- it keeps enough delayed-work timers (netfilter conntrack, socket and writeback work, etc.) churning to expose the race in the timer-migration subsystem. No custom reproducer; any workload with sustained delayed-work timer traffic should suffice. [Key Trace -- abbreviated; full oops in attached pstore file] WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390, CPU#2: swapper/2/0 <IRQ> __queue_work+0x39/0xc0 delayed_work_timer_fn+0x19/0x30 call_timer_fn+0x30/0x170 __run_timers+0x1af/0x2c0 timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 handle_softirqs+0xe1/0x360 __irq_exit_rcu+0x100/0x120 sysvec_apic_timer_interrupt+0x9f/0xd0 Oops: general protection fault, probably for non-canonical address 0xdead00000000012a: 0000 [#1] SMP NOPTI RIP: 0010:__run_timers+0x1e0/0x2c0 RAX: dead000000000122 R12: dead000000000122 Call Trace: <IRQ> timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 Kernel taint at oops: G W (from the preceding workqueue WARNs only; no out-of-tree modules). [Likely Upstream Match] Two open syzbot reports appear to describe the same bug (both against 7.0 / net-7.0-rc1, both faulting in the timer-wheel expiry path with a LIST_POISON2 dereference in the range 0xdead000000000128..0xdead00000000012f): * syzbot+e53e8221436aa398a8be -- "general protection fault in __run_timers (4)", reported 2026-08-04, subsystem tag netfilter, faulting in detach_timer -> expire_timers -> __run_timers. * syzbot+1a48e52497e1769b08de -- "general protection fault in detach_timer (2)", reported 2026-02-20 in ktimers/0. Neither has a public reproducer. If Ubuntu backports the eventual upstream fix this bug should close by SRU. [Workaround] Setting kernel.timer_migration=0 via /etc/sysctl.d/99-timer-migration.conf reduces cross-CPU timer placement and, in local testing, prevents the crash under the same download workload. This is mitigation, not fix -- the underlying tmigr race remains. [Other Info] * ProblemType: Bug * DistroRelease: Ubuntu 26.04 * Package: linux-image-7.0.0-28-generic 7.0.0-28.28 * Regression: unknown (no prior 7.0.x kernel tested on this install) * Reproducible: yes, on demand under the workload above [Attachments] * /var/lib/systemd/pstore/dmesg-efi-* -- full oops recorded by the kernel before reboot * Full boot dmesg (journalctl -k -b) * uname -a * snap list --all pc-kernel * snap info pc-kernel * cat /proc/cmdline ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic (not installed) ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: user 3023 F.... wireplumber /dev/snd/seq: user 3016 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Mon Aug 31 14:22:44 2026 Lsusb: Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 001 Device 002: ID 0409:55aa NEC Corp. Hub Bus 001 Device 003: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet Bus 001 Device 005: ID 1050:0407 Yubico.com Yubikey 4/5 OTP+U2F+CCID Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub MachineType: QEMU Standard PC (Q35 + ICH9, 2009) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color ProcFB: 0 virtio_gpudrmfb ProcKernelCmdLine: snapd_recovery_mode=run console=ttyS0,115200n8 console=tty1 panic=-1 quiet splash snapd.xkb="us,pc105,," RfKill: SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/31/2026 dmi.bios.release: 0.0 dmi.bios.vendor: Ubuntu distribution of EDK II dmi.bios.version: 2025.11-3ubuntu7 dmi.chassis.type: 1 dmi.chassis.vendor: QEMU dmi.chassis.version: pc-q35-10.2 dmi.modalias: dmi:bvnUbuntudistributionofEDKII:bvr2025.11-3ubuntu7:bd03/31/2026:br0.0:svnQEMU:pnStandardPC(Q35+ICH9,2009):pvrpc-q35-10.2:cvnQEMU:ct1:cvrpc-q35-10.2:sku:pfa: dmi.product.name: Standard PC (Q35 + ICH9, 2009) dmi.product.version: pc-q35-10.2 dmi.sys.vendor: QEMU To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165930/+subscriptions

[Bug 2165844] Re: linux 7.0.0-30: kernel BUG at fs/iomap/buffered-io.c:1061 in iomap_write_end() on ntfs3 buffered write

Artem, we have some more recent builds of the kernel available for debugging purposes. The documentation on how to install them is here: https://wiki.ubuntu.com/Kernel/MainlineBuilds Could you follow those instructions to install the mainline 7.3 kernel and see if the problem persists? You can download it here: https://kernel.ubuntu.com/mainline/v7.3-rc1/ Thanks. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165844 Title: linux 7.0.0-30: kernel BUG at fs/iomap/buffered-io.c:1061 in iomap_write_end() on ntfs3 buffered write Status in linux package in Ubuntu: Confirmed Bug description: [Summary] Any buffered write() to an ntfs3-mounted volume can hit a BUG_ON in the generic iomap write path and panic the kernel. An unprivileged process (rsync, uid 1000) took the whole machine down; the system froze instantly, then kdump rebooted into the capture kernel. [Impact] This is reachable from unprivileged userspace with a plain write(2) syscall. Whatever the state of the NTFS volume, the correct outcome is -EIO returned to the caller, not a kernel panic. Reproducing it needs nothing but a writable NTFS mount, which udisks/GNOME Files creates by default when a user clicks a Windows partition. [Environment] Ubuntu 26.04, linux-image-7.0.0-30-generic 7.0.0-30.30, x86_64 ASUS ROG STRIX B550-XE GAMING WIFI, BIOS 3607 NTFS volume: 1.8 TB Windows system partition, mounted read-write by udisks (driver ntfs3, POSIX ACLs enabled) [What happened] Writing to the NTFS mount, the kernel hit the assertion and died: kernel BUG at fs/iomap/buffered-io.c:1061! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 2 UID: 1000 PID: 18561 Comm: rsync Kdump: loaded Tainted: G O Hardware name: ASUS System Product Name/ROG STRIX B550-XE GAMING WIFI RIP: 0010:iomap_write_end+0x1e0/0x1f0 Call Trace: iomap_write_iter+0x171/0x340 iomap_file_buffered_write+0xa6/0x110 ntfs_file_write_iter+0x267/0x310 [ntfs3] vfs_write+0x25b/0x490 ksys_write+0x71/0xf0 __x64_sys_write+0x19/0x30 do_syscall_64+0x105/0x5a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The faulting syscall was a 137-byte write(2) to fd 1 (ORIG_RAX 0x1, RDX 0x89) — an ordinary small buffered write, not anything exotic. The G/O taint is the out-of-tree NVIDIA module (595.84). It is unrelated to this code path; ntfs3, iomap and the write path are all in-tree. [Preceding symptom] About 14 minutes before the panic, ntfs3 logged a large burst of metadata repairs on the same volume: ntfs3(nvme0n1p2): ino=..., Correct links count -> N ntfs3: 15286 callbacks suppressed So the volume was not perfectly clean. That may well be what steers the write path into the bad state — but an inconsistent filesystem must not be able to panic the kernel, so it looks like a missing error path rather than a disk problem. [Reproducer] Not deterministic here, but the shape is simple: 1. Mount an NTFS volume read-write with ntfs3 (udisksctl mount is enough). 2. Run sustained buffered I/O against it (rsync of a large tree). The other reports linked below describe the same trace from ordinary file writes, including games writing save data. [Already reported elsewhere] Same trace, same line, on 7.0.x kernels since roughly April 2026: - https://github.com/CachyOS/linux-cachyos/issues/841 - https://discuss.cachyos.org/t/kernel-bug-in-iomap-write-end-triggered-by-ntfs3-buffered-write-linux-7-0-1-cachyos/28546 - https://bbs.archlinux.org/viewtopic.php?pid=2296728 - https://forum.manjaro.org/t/total-system-hangs-and-fs-iomap-kernel-panic-on-7-0-10-stable-on-6-18-lts/188283 I could not find an upstream fix. Upstream appears to be replacing ntfs3 with the new ntfsplus driver in 7.1 rather than fixing this one. [Suggestion for Ubuntu] Since 26.04 ships 7.0 and a user can trigger a kernel panic by copying files onto a Windows partition from the file manager, it may be worth either backporting a fix or having udisks default NTFS mounts to read-only until 7.1 lands via HWE. [Attached] Full kernel ring buffer from the kdump vmcore (VmCoreDmesg), plus the usual apport-collected hardware and package data. Sanitisation applied before upload: firewall log lines were dropped, and MAC addresses, the wireless BSSID/SSID and LAN IPv4 addresses were replaced with placeholders in VmCoreDmesg, CurrentDmesg and WifiSyslog. Nothing else was altered; the panic trace is untouched. An incomplete vmcore (2.3 GB, truncated because the machine was power-cycled during the dump) is available if it would help. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass Date: Sun Aug 30 11:45:03 2026 InstallationDate: Installed on 2026-07-12 (49 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: ASUS System Product Name PackageArchitecture: amd64 ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=5778b2dd-b496-4525-b52f-223e5be557bc ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux Title: linux 7.0.0-30: kernel BUG at fs/iomap/buffered-io.c:1061 in iomap_write_end() on ntfs3 buffered write UpgradeStatus: No upgrade log present (probably fresh install) _MarkForUpload: True dmi.bios.date: 03/18/2024 dmi.bios.release: 5.17 dmi.bios.vendor: American Megatrends Inc. dmi.bios.version: 3607 dmi.board.asset.tag: Default string dmi.board.name: ROG STRIX B550-XE GAMING WIFI dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: Rev X.0x dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Default string dmi.chassis.version: Default string dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr3607:bd03/18/2024:br5.17:svnASUS:pnSystemProductName:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnROGSTRIXB550-XEGAMINGWIFI:rvrRevX.0x:cvnDefaultstring:ct3:cvrDefaultstring:skuSKU:pfaTobefilledbyO.E.M.: dmi.product.family: To be filled by O.E.M. dmi.product.name: System Product Name dmi.product.sku: SKU dmi.product.version: System Version dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165844/+subscriptions

[Bug 2165857] Re: snd_ctxfi: CA20K2 SB1270 S/PDIF IEC61937 passthrough fails with multiple=2 due to unhandled DAIO conf 0x9

Hey Roman, thanks for filing a bug. Because you are running AnduinOS, you will need to file a bug with the AnduinOS team at https://github.com/Anduin2017/AnduinOS/discussions. Have a great day! ** Changed in: linux (Ubuntu) Status: New => Invalid -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165857 Title: snd_ctxfi: CA20K2 SB1270 S/PDIF IEC61937 passthrough fails with multiple=2 due to unhandled DAIO conf 0x9 Status in linux package in Ubuntu: Invalid Bug description: IEC61937 S/PDIF passthrough fails on a Creative Sound Blaster X-Fi Titanium HD SB1270 (CA20K2) using the snd_ctxfi driver when the driver operates with: reference_rate=48000 multiple=2 The same hardware and S/PDIF output work when using multiple=1. Affected Ubuntu kernel: linux-image-7.0.0-30-generic 7.0.0-30.30 The Apport report confirms that this kernel package has origin: Ubuntu. S/PDIF PCM device used for testing: hw:0,4 ## Steps to reproduce 1. Load the stock snd_ctxfi driver with: reference_rate=48000 multiple=2 2. Send an IEC61937 AC3/DTS encoded stream through the X-Fi S/PDIF PCM device hw:0,4. 3. Encoded S/PDIF passthrough fails. 4. Change the driver configuration to: reference_rate=48000 multiple=1 5. Repeat exactly the same IEC61937 test. Result: passthrough works. ## Expected result IEC61937 AC3/DTS passthrough should work with: reference_rate=48000 multiple=2 ## Actual result With the stock snd_ctxfi driver: multiple=2 -> FAIL multiple=1 -> PASS ## Root cause analysis The problem was isolated to the CA20K2 DAIO transmitter configuration. In: sound/pci/ctxfi/ctdaio.c the configuration is generated as: conf = (desc->msr & 0x7) | (desc->passthru << 3); For the failing passthrough configuration, this produces: conf == 0x9 The CA20K2 implementation in: sound/pci/ctxfi/cthw20k2.c uses: switch (conf & 0xf) to configure ATXCTL_NUC. The existing switch handles cases 1, 2, 4 and 8, but does not handle case 9. A minimal test modification was made so that configuration 9 is handled together with configuration 1: case 1: case 9: set_field(&ctl->txctl[idx], ATXCTL_NUC, 0); break; A replacement snd-ctxfi.ko was rebuilt from the source corresponding to the running Ubuntu kernel. No unrelated driver logic was changed. The rebuilt module has matching vermagic: 7.0.0-30-generic The patched driver was then tested again using the original configuration: reference_rate=48000 multiple=2 Results: IEC61937 AC3 passthrough: PASS IEC61937 DTS passthrough: PASS 5.1 decoding/output: PASS Additional regression tests of the audio driver passed. This demonstrates that multiple=1 is only a workaround. The CA20K2 hardware is capable of correct IEC61937 passthrough with multiple=2 once configuration 0x9 is explicitly handled. The same missing case 9 is also present in the current upstream Linux snd_ctxfi CA20K2 implementation, so this does not appear to be an Ubuntu-specific source modification. I can provide the exact minimal source diff/patch and additional test details if required. ProblemType: Bug DistroRelease: AnduinOS 2.0.2 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 [origin: Ubuntu] ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: zorgan 3141 F.... wireplumber /dev/snd/controlC1: zorgan 3141 F.... wireplumber /dev/snd/seq: zorgan 3133 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: GNOME Date: Sun Aug 30 21:38:19 2026 MachineType: Gigabyte Technology Co., Ltd. Z590 D ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=8506df91-3e89-4e62-8c8b-165299db5989 ro quiet splash preempt=full PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) WifiSyslog: dmi.bios.date: 06/10/2025 dmi.bios.release: 5.19 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: F11b dmi.board.asset.tag: Default string dmi.board.name: Z590 D dmi.board.vendor: Gigabyte Technology Co., Ltd. dmi.board.version: Default string dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Default string dmi.chassis.version: Default string dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrF11b:bd06/10/2025:br5.19:svnGigabyteTechnologyCo.,Ltd.:pnZ590D:pvrDefaultstring:rvnGigabyteTechnologyCo.,Ltd.:rnZ590D:rvrDefaultstring:cvnDefaultstring:ct3:cvrDefaultstring:skuDefaultstring:pfaZ590MB: dmi.product.family: Z590 MB dmi.product.name: Z590 D dmi.product.sku: Default string dmi.product.version: Default string dmi.sys.vendor: Gigabyte Technology Co., Ltd. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165857/+subscriptions

[Bug 2165854] Re: IPU6 ISYS never probes on Samsung Galaxy Book NP960QFG (RPL, OV02C1)

Hello Fernando, thank you for filing a bug. Because you are experiencing this bug on ZorinOS, you'll need to file a bug with the ZorinOS team at https://zorin.com/os/feedback/. Have a great day! ** Changed in: linux (Ubuntu) Status: New => Invalid -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165854 Title: IPU6 ISYS never probes on Samsung Galaxy Book NP960QFG (RPL, OV02C1) Status in linux package in Ubuntu: Invalid Bug description: [IMPACT] Webcam integrated on Samsung Galaxy Book NP960QFG-KA1AR is non-functional on Zorin OS 18.1 / Ubuntu 24.04 with kernel 7.0.0-30-generic. Driver loads PCI device, detects sensor, registers PSYS, but ISYS never completes probe and no firmware is loaded. Every V4L2 STREAMON returns ENOLINK ("Link has been severed"). [HARDWARE] Vendor: Samsung Electronics Co Ltd Model: Galaxy Book NP960QFG-KA1AR (RPL, 12th/13th gen) Subsystem: c1ca CPU: Intel Raptor Lake-P (Host bridge 0xa707) PCI device: 0000:00:05.0 Multimedia controller [0480] Intel Corporation Device a75d (IPU6-v3, hardware version 5) Sensor: OVTI02C1:00 (Omnivision OV02C1) on i2c-0 address 0x36 Lens cover: samsung-galaxybook SAM0429:00, currently open (not blocking) BIOS: P07ALN.260.240415.SH (Samsung) Secure Boot: disabled [SOFTWARE] Distro: Zorin OS 18.1 (based on Ubuntu 24.04 noble) Kernel: 7.0.0-30-generic (HWE) Kernel alt: 6.17.0-35-generic also installed in /boot Init system: systemd [PACKAGES] intel-ipu6-dkms 0~git202603270946.51fe7248-0ubuntu1+zorin1 libcamhal-common 0~git202601200757.9899efa~ubuntu24.04.3 libcamhal-ipu6ep 0~git202601200757.9899efa~ubuntu24.04.3 libcamhal-ipu6ep-common 0~git202601200757.9899efa~ubuntu24.04.3 libcamhal0 0~git202601200757.9899efa~ubuntu24.04.3 gstreamer1.0-icamera 0~git202509260937.4fb31db~ubuntu24.04.9 linux-modules-ipu6-7.0.0-30-generic 7.0.0-30.30~24.04.1 linux-modules-ipu6-generic-7.0 7.0.0-30.30~24.04.1 v4l2loopback-dkms 0.15.3-1ubuntu2+zorin1 v4l2-relayd 0.1.2-0ubuntu3.1 [FIRMWARE] /lib/firmware/intel/ipu/ipu6ep_fw.bin (467 KB, decompressed from .zst) /lib/firmware/intel/ipu/shisp_2401a0_v21.bin (12 MB, decompressed from .zst) /lib/firmware/intel/ipu/ipu6ep_fw.bin.zst (original) /lib/firmware/intel/ipu/shisp_2401a0_v21.bin.zst (original) Other ipu6 firmwares: ipu6epadln, ipu6epmtl, ipu6, ipu6se, ipu7, ipu7ptl, irci [DMESG OUTPUT (filtered to intel-ipu* and related)] [ 2.633510] intel-ipu6 0000:00:05.0: enabling device (0000 -> 0002) [ 2.642939] intel-ipu6 0000:00:05.0: Found supported sensor OVTI02C1:00 [ 2.643149] intel-ipu6 0000:00:05.0: Connected 1 cameras [ 2.644075] intel-ipu6 0000:00:05.0: IPU6-v3[a75d] hardware version 5 [ 2.672743] intel_ipu6_isys: loading out-of-tree module taints kernel. [ 2.672778] intel_ipu6_isys: module verification failed: signature and/or required key missing - tainting kernel [ 2.711217] intel_ipu6_psys.psys intel_ipu6.psys.40: pkg_dir entry count:8 [ 2.713832] intel_ipu6_psys.psys intel_ipu6.psys.40: psys probe minor: 0 NOTE: there is NO "isys probe minor" line. The ISYS subdriver binds to the intel_ipu6.isys.40 auxiliary device but the probe never logs completion and no ISYS firmware (ipu6ep_fw.bin, shisp_2401a0_v21.bin) is ever requested or loaded. Compare with healthy systems where dmesg shows: intel_ipu6_isys.isys intel_ipu6.isys.40: isys probe minor: 0 intel-ipu6 0000:00:05.0: Loading IPU6 ISYS firmware: ipu6ep_fw.bin intel-ipu6 0000:00:05.0: Loading IPU6 ISP firmware: shisp_2401a0_v21.bin None of those lines appear. [LSPCI -vvv -s 00:05.0] 00:05.0 Multimedia controller: Intel Corporation Device a75d DeviceName: Onboard - Sound Subsystem: Samsung Electronics Co Ltd Device c1ca Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort+ <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 16 IOMMU group: 0 Region 0: Memory at 603c000000 (64-bit, non-prefetchable) [size=16M] Capabilities: [70] Express (v2) Root Complex Integrated Endpoint, MSI 00 DevCap: MaxPayload 128 bytes, PhantFunc 0 ExtTag+ RBE+ FLReset+ DevCtl: CorrErr- NonFatalErr- FatalErr- UnsupReq- RlxdOrd- ExtTag- PhantFunc- AuxPwr- NoSnoop- FLReset- MaxPayload 128 bytes, MaxReadReq 128 bytes DevSta: CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend- DevCap2: Completion Timeout: Not Supported, TimeoutDis- NROPrPrP- LTR- 10BitTagComp- 10BitTagReq- OBFF Not Supported, ExtFmt- EETLPPrefix- EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit- FRS- AtomicOpsCap: 32bit- 64bit- 128bitCAS- DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR- 10BitTagReq- OBFF Disabled, AtomicOpsCtl: ReqEn- Capabilities: [d0] Power Management version 3 Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-) Status: D3 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME- Kernel driver in use: intel-ipu6 Kernel modules: intel_ipu6 [MEDIA TOPOLOGY] media controller API version 7.0.12 driver: intel-ipu6 model: ipu6 bus info: PCI:0000:00:05.0 hw revision: 0x144dc1ca 32 ISYS Capture nodes (/dev/video5..7, 9..13, 17, 23, 27, 28 exposed by driver; /dev/video0 is v4l2loopback; /dev/video1, 2, 3, 4, 8, 14..16, 18..22, 24..26, 29..32 exist but Driver not in use). 4 CSI-2 receiver subdevs (/dev/v4l-subdev0..3). 1 sensor subdev: /dev/v4l-subdev4 = ov02c10 0-0036, pad0 Source -> "Intel IPU6 CSI2 0":0 [ENABLED, IMMUTABLE] pad fmt: SGRBG10_1X10/1928x1092 field:none, link_freq=400 MHz, pixel_rate=80 MHz The CSI-2 receivers report fmt SGRBG10_1X10/4096x3072 (default, unconfigured). [REPRODUCTION] 1. Boot kernel 7.0.0-30-generic (Zorin OS 18.1 / Ubuntu 24.04 HWE). 2. sudo modprobe intel-ipu6 intel-ipu6-isys intel-ipu6-psys ov02c10 3. ls /dev/video* -> 33 nodes appear 4. v4l2-ctl -d /dev/video10 --stream-mmap=4 --stream-count=5 --stream-to=/tmp/test.raw -> "VIDIOC_STREAMON returned -1 (Link has been severed)" 5. File is empty (size 0). No frames captured. 6. Same result with gst-launch-1.0 v4l2src ! fakesink, with icamerasrc, with any other ISYS Capture node. [WHAT WAS TRIED] - linux-modules-ipu6-generic-7.0 (Ubuntu in-kernel): same failure - intel-ipu6-dkms 51fe7248 (PPA Zorin, upstream Intel): same failure - Upstream intel/ipu6-drivers @ main with manual DWC PHY HSFREQRANGE patch (commit 1f025c6, "Improve DWC PHY HSFREQRANGE band selection"): same failure - Firmware formats: .zst vs decompressed .bin, no change - HAL libcamhal-ipu6ep + gstreamer1.0-icamera: fails with "CamHAL[ERR] Stream config is not supported. format:V4L2_PIX_FMT_NV12 (1920x1080)" because HAL loads AIQB AR0234_TGL_10bits.aiqb which is for a different sensor - v4l2-ctl --set-fmt on ISYS Capture nodes: works for format negotiation but STREAMON still fails with ENOLINK - media-ctl -V: subdevs reject VIDIOC_SUBDEV_S_FMT ("Inappropriate ioctl") - modprobe bind/unbind, soft reset: no change - Power management: D3 NoSoftRst+ in lspci (PME disabled), no S0ix issues seen [EXPECTED] The ISYS subdriver should boot, load ipu6ep_fw.bin and shisp_2401a0_v21.bin, negotiate the CSI-2 link with the OV02C1 sensor, and STREAMON on a Capture node should return success, producing NV12 1920x1080 frames at 30 fps via the HAL or raw Bayer via V4L2. [WORKAROUNDS] None known for this hardware on kernel 7.0. External USB webcam is the only functional option today. [ADDITIONAL INFO] - Related issues: intel/ipu6-drivers#329 (Galaxy Book4 Pro 360, similar), #369 - The ISYS auxiliary device (intel_ipu6.isys.40) is created and bound to intel_ipu6_isys.isys driver, but the probe function either returns silently or fails before logging. - The PSYS auxiliary device (intel_ipu6.psys.40) probes and registers /dev/ipu-psys0 correctly. - Both the in-kernel driver and the DKMS share the same code path and fail at the same point, suggesting the issue is not in the driver glue but in the ISYS firmware boot sequence or in the hardware interaction. - The DWC PHY HSFREQRANGE patch (upstream commit 1f025c6) targets Arrow Lake / OV08X40, not RPL / OV02C1; the symptom (DDL lock instability) may not apply to this configuration. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165854/+subscriptions

[Bug 2165930] [NEW] Kernel oops (GPF) in __run_timers via tmigr_handle_remote on 7.0.0-28-generic under network load

Public bug reported: [Impact] Kernel takes a general protection fault in __run_timers while handling remote timer expiry for an idle CPU. The faulting address is 0xdead000000000122 (LIST_POISON2), indicating timer-wheel list corruption in the timer-migration (tmigr) subsystem. The oops is preceded by two WARNs at kernel/workqueue.c:2351 in __queue_work.part.0 from delayed_work_timer_fn. The system becomes unresponsive and reboots (panic=-1). [Environment] * Ubuntu 26.04 * Kernel: 7.0.0-28-generic (Ubuntu 7.0.0-28.28-generic 7.0.12) #28-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 21 01:01:36 UTC 2026 * Built with gcc 15.2.0-16ubuntu1, ld 2.46 * Ubuntu Core-style install: snapd_recovery_mode=run, immutable /usr, pc-kernel snap, Secure Boot enabled, kernel lockdown active * QEMU/KVM guest, Q35 + ICH9, BIOS 2025.11-3ubuntu7 03/31/2026, 4 vCPUs, ~8 GiB RAM * Boot log confirms timer migration is enabled: "Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level" [Steps to Reproduce] 1. Boot the VM into a normal graphical session. 2. Open Chromium (snap) and start a large HTTP(S) download (multi-hundred-MB or larger). 3. Within tens of seconds the two workqueue WARNs fire, followed shortly by the fatal GPF in __run_timers. The machine freezes or auto-reboots. The crashing task in every trace is swapper/N (idle CPU), not Chromium. The download is a workload trigger, not the cause -- it keeps enough delayed-work timers (netfilter conntrack, socket and writeback work, etc.) churning to expose the race in the timer-migration subsystem. No custom reproducer; any workload with sustained delayed-work timer traffic should suffice. [Key Trace -- abbreviated; full oops in attached pstore file] WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390, CPU#2: swapper/2/0 <IRQ> __queue_work+0x39/0xc0 delayed_work_timer_fn+0x19/0x30 call_timer_fn+0x30/0x170 __run_timers+0x1af/0x2c0 timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 handle_softirqs+0xe1/0x360 __irq_exit_rcu+0x100/0x120 sysvec_apic_timer_interrupt+0x9f/0xd0 Oops: general protection fault, probably for non-canonical address 0xdead00000000012a: 0000 [#1] SMP NOPTI RIP: 0010:__run_timers+0x1e0/0x2c0 RAX: dead000000000122 R12: dead000000000122 Call Trace: <IRQ> timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 Kernel taint at oops: G W (from the preceding workqueue WARNs only; no out-of-tree modules). [Likely Upstream Match] Two open syzbot reports appear to describe the same bug (both against 7.0 / net-7.0-rc1, both faulting in the timer-wheel expiry path with a LIST_POISON2 dereference in the range 0xdead000000000128..0xdead00000000012f): * syzbot+e53e8221436aa398a8be -- "general protection fault in __run_timers (4)", reported 2026-08-04, subsystem tag netfilter, faulting in detach_timer -> expire_timers -> __run_timers. * syzbot+1a48e52497e1769b08de -- "general protection fault in detach_timer (2)", reported 2026-02-20 in ktimers/0. Neither has a public reproducer. If Ubuntu backports the eventual upstream fix this bug should close by SRU. [Workaround] Setting kernel.timer_migration=0 via /etc/sysctl.d/99-timer-migration.conf reduces cross-CPU timer placement and, in local testing, prevents the crash under the same download workload. This is mitigation, not fix -- the underlying tmigr race remains. [Other Info] * ProblemType: Bug * DistroRelease: Ubuntu 26.04 * Package: linux-image-7.0.0-28-generic 7.0.0-28.28 * Regression: unknown (no prior 7.0.x kernel tested on this install) * Reproducible: yes, on demand under the workload above [Attachments] * /var/lib/systemd/pstore/dmesg-efi-* -- full oops recorded by the kernel before reboot * Full boot dmesg (journalctl -k -b) * uname -a * snap list --all pc-kernel * snap info pc-kernel * cat /proc/cmdline ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic (not installed) ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: user 3023 F.... wireplumber /dev/snd/seq: user 3016 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Mon Aug 31 14:22:44 2026 Lsusb: Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 001 Device 002: ID 0409:55aa NEC Corp. Hub Bus 001 Device 003: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet Bus 001 Device 005: ID 1050:0407 Yubico.com Yubikey 4/5 OTP+U2F+CCID Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub MachineType: QEMU Standard PC (Q35 + ICH9, 2009) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color ProcFB: 0 virtio_gpudrmfb ProcKernelCmdLine: snapd_recovery_mode=run console=ttyS0,115200n8 console=tty1 panic=-1 quiet splash snapd.xkb="us,pc105,," RfKill: SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/31/2026 dmi.bios.release: 0.0 dmi.bios.vendor: Ubuntu distribution of EDK II dmi.bios.version: 2025.11-3ubuntu7 dmi.chassis.type: 1 dmi.chassis.vendor: QEMU dmi.chassis.version: pc-q35-10.2 dmi.modalias: dmi:bvnUbuntudistributionofEDKII:bvr2025.11-3ubuntu7:bd03/31/2026:br0.0:svnQEMU:pnStandardPC(Q35+ICH9,2009):pvrpc-q35-10.2:cvnQEMU:ct1:cvrpc-q35-10.2:sku:pfa: dmi.product.name: Standard PC (Q35 + ICH9, 2009) dmi.product.version: pc-q35-10.2 dmi.sys.vendor: QEMU ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165930 Title: Kernel oops (GPF) in __run_timers via tmigr_handle_remote on 7.0.0-28-generic under network load Status in linux package in Ubuntu: New Bug description: [Impact] Kernel takes a general protection fault in __run_timers while handling remote timer expiry for an idle CPU. The faulting address is 0xdead000000000122 (LIST_POISON2), indicating timer-wheel list corruption in the timer-migration (tmigr) subsystem. The oops is preceded by two WARNs at kernel/workqueue.c:2351 in __queue_work.part.0 from delayed_work_timer_fn. The system becomes unresponsive and reboots (panic=-1). [Environment] * Ubuntu 26.04 * Kernel: 7.0.0-28-generic (Ubuntu 7.0.0-28.28-generic 7.0.12) #28-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 21 01:01:36 UTC 2026 * Built with gcc 15.2.0-16ubuntu1, ld 2.46 * Ubuntu Core-style install: snapd_recovery_mode=run, immutable /usr, pc-kernel snap, Secure Boot enabled, kernel lockdown active * QEMU/KVM guest, Q35 + ICH9, BIOS 2025.11-3ubuntu7 03/31/2026, 4 vCPUs, ~8 GiB RAM * Boot log confirms timer migration is enabled: "Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level" [Steps to Reproduce] 1. Boot the VM into a normal graphical session. 2. Open Chromium (snap) and start a large HTTP(S) download (multi-hundred-MB or larger). 3. Within tens of seconds the two workqueue WARNs fire, followed shortly by the fatal GPF in __run_timers. The machine freezes or auto-reboots. The crashing task in every trace is swapper/N (idle CPU), not Chromium. The download is a workload trigger, not the cause -- it keeps enough delayed-work timers (netfilter conntrack, socket and writeback work, etc.) churning to expose the race in the timer-migration subsystem. No custom reproducer; any workload with sustained delayed-work timer traffic should suffice. [Key Trace -- abbreviated; full oops in attached pstore file] WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390, CPU#2: swapper/2/0 <IRQ> __queue_work+0x39/0xc0 delayed_work_timer_fn+0x19/0x30 call_timer_fn+0x30/0x170 __run_timers+0x1af/0x2c0 timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 handle_softirqs+0xe1/0x360 __irq_exit_rcu+0x100/0x120 sysvec_apic_timer_interrupt+0x9f/0xd0 Oops: general protection fault, probably for non-canonical address 0xdead00000000012a: 0000 [#1] SMP NOPTI RIP: 0010:__run_timers+0x1e0/0x2c0 RAX: dead000000000122 R12: dead000000000122 Call Trace: <IRQ> timer_expire_remote+0x52/0x90 tmigr_handle_remote_cpu+0x10e/0x270 tmigr_handle_remote_up+0x115/0x160 tmigr_handle_remote+0xd5/0x140 run_timer_softirq+0xeb/0x100 Kernel taint at oops: G W (from the preceding workqueue WARNs only; no out-of-tree modules). [Likely Upstream Match] Two open syzbot reports appear to describe the same bug (both against 7.0 / net-7.0-rc1, both faulting in the timer-wheel expiry path with a LIST_POISON2 dereference in the range 0xdead000000000128..0xdead00000000012f): * syzbot+e53e8221436aa398a8be -- "general protection fault in __run_timers (4)", reported 2026-08-04, subsystem tag netfilter, faulting in detach_timer -> expire_timers -> __run_timers. * syzbot+1a48e52497e1769b08de -- "general protection fault in detach_timer (2)", reported 2026-02-20 in ktimers/0. Neither has a public reproducer. If Ubuntu backports the eventual upstream fix this bug should close by SRU. [Workaround] Setting kernel.timer_migration=0 via /etc/sysctl.d/99-timer-migration.conf reduces cross-CPU timer placement and, in local testing, prevents the crash under the same download workload. This is mitigation, not fix -- the underlying tmigr race remains. [Other Info] * ProblemType: Bug * DistroRelease: Ubuntu 26.04 * Package: linux-image-7.0.0-28-generic 7.0.0-28.28 * Regression: unknown (no prior 7.0.x kernel tested on this install) * Reproducible: yes, on demand under the workload above [Attachments] * /var/lib/systemd/pstore/dmesg-efi-* -- full oops recorded by the kernel before reboot * Full boot dmesg (journalctl -k -b) * uname -a * snap list --all pc-kernel * snap info pc-kernel * cat /proc/cmdline ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic (not installed) ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: user 3023 F.... wireplumber /dev/snd/seq: user 3016 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Mon Aug 31 14:22:44 2026 Lsusb: Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 001 Device 002: ID 0409:55aa NEC Corp. Hub Bus 001 Device 003: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet Bus 001 Device 005: ID 1050:0407 Yubico.com Yubikey 4/5 OTP+U2F+CCID Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub MachineType: QEMU Standard PC (Q35 + ICH9, 2009) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color ProcFB: 0 virtio_gpudrmfb ProcKernelCmdLine: snapd_recovery_mode=run console=ttyS0,115200n8 console=tty1 panic=-1 quiet splash snapd.xkb="us,pc105,," RfKill: SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/31/2026 dmi.bios.release: 0.0 dmi.bios.vendor: Ubuntu distribution of EDK II dmi.bios.version: 2025.11-3ubuntu7 dmi.chassis.type: 1 dmi.chassis.vendor: QEMU dmi.chassis.version: pc-q35-10.2 dmi.modalias: dmi:bvnUbuntudistributionofEDKII:bvr2025.11-3ubuntu7:bd03/31/2026:br0.0:svnQEMU:pnStandardPC(Q35+ICH9,2009):pvrpc-q35-10.2:cvnQEMU:ct1:cvrpc-q35-10.2:sku:pfa: dmi.product.name: Standard PC (Q35 + ICH9, 2009) dmi.product.version: pc-q35-10.2 dmi.sys.vendor: QEMU To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165930/+subscriptions

[Bug 2165729] Re: faulting task died holding the TTM LRU spinlock (exited with irqs disabled / preempt_count 1),

Second occurrence, 2026-08-31. Two things in the original description need correcting: this is not a one-off, and it is not specific to the Ubuntu kernel. Please add the kernel-bug-exists-upstream tag. REPRODUCED ON MAINLINE linux-image-unsigned-7.2.0-070200-generic 7.2.0-070200.202608162350 Linux version 7.2.0-070200-generic (kernel@balboa) ... #202608162350 SMP PREEMPT_DYNAMIC Wed Aug 19 18:42:46 UTC 2026 That is a mainline-builds PPA kernel with no Ubuntu patches applied. Same board, same iGPU, same boot cmdline as the original report. The defect is in mainline drm/amdgpu + ttm, not in the Ubuntu delta. FREQUENCY Twice in four days, so "Occurred once ... rare and timing-dependent" in the original description no longer holds: 2026-08-28 09:16:29 kernel 7.0.0-30-generic (original report) 2026-08-31 12:55:21 kernel 7.2.0-070200-generic (this one) Both were captured by pstore. THE WHOLE SEQUENCE COLLAPSED INTO 48 ms IN ONE PROCESS This is the useful part. In the original report the corruption and the fatal dereference were ten minutes and two processes apart, which made the causal link circumstantial. This time all three events are the same task, file-roller PID 316904, inside a single command-submission sequence: 12:55:21.088996 slab kmalloc-part-05-96 start ffff8997c7109840 pointer offset 64 size 96 12:55:21.093258 list_add corruption. prev->next should be next (ffff8997e240ee30), but was 0000000000000000. (prev=ffff8997c7109880). WARNING: lib/list_debug.c:32 at __list_add_valid_or_report+0x87/0xc0, CPU#5: file-roller/316904 ttm_resource_move_to_lru_tail.cold+0x8/0x76 [ttm] ttm_bo_populate+0x85/0xb0 [ttm] ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm] ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] ttm_bo_validate+0xc0/0x190 [ttm] amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] 12:55:21.114567 list_del corruption. prev->next should be ffff8997d152d340, but was ffff8997cda6bdc0. (prev=ffff8997d1532820) WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#8: file-roller/316904 ttm_resource_fini.cold+0xc/0x15 [ttm] ttm_sys_man_free+0x12/0x30 [ttm] ttm_resource_free+0xae/0x140 [ttm] ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm] ttm_bo_validate+0xc0/0x190 [ttm] 12:55:21.136759 BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode Oops: Oops: 0002 [#1] SMP NOPTI RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu] amdgpu_cs_ioctl+0x21b/0x360 [amdgpu] note: file-roller[316904] exited with irqs disabled note: file-roller[316904] exited with preempt_count 1 THE OOPS DEREFERENCES EXACTLY THE ADDRESSES NAMED IN THE WARNING The register state at the oops matches the pointers reported 43 ms earlier, so this is demonstrably the same list node rather than an inference: RAX: ffff8997e240ee30 == the "should be next" value from the list_add report R09: ffff8997c7109880 == the "prev=" value from the list_add report RDX: ffff8997c7109840 == the slab object start from the slab line RSI: 0000000000000000 == the bad prev->next that was reported as NULL CR2: 0000000000000008 The faulting instruction is 48 89 7e 08, a write to RSI+8, with RSI zero. Note ffff8997c7109880 = ffff8997c7109840 + 64, i.e. the damaged list_head sits at offset 64 of a 96-byte kmalloc object, matching "pointer offset 64 size 96" in the slab line. So the corrupted node and the node the oops walks into are one and the same allocation. I have not tried to identify which struct that is and would rather not guess. For comparison, the 7.0.0-30 oops was at the same RIP offset +0x1a5 with the same opcode, but RSI was 0x4000 rather than 0. Near-NULL there, plain NULL here. DAMAGED FROM THE INSERTION SIDE THIS TIME The original stage 1 was ttm_lru_bulk_move_del via amdgpu_vm_pt_free, i.e. page-table teardown. Here it is ttm_resource_move_to_lru_tail from ttm_bo_populate inside a bounce-buffer move during CS buffer validation, i.e. the insertion side. The same sublist is damaged from either direction, which suggests the problem is the sublist's own consistency rather than one particular caller's teardown ordering. WHY THE WARNING IS NOT SURVIVABLE The original description says the kernel "warns but continues". The mechanism is worth stating explicitly, because it is why stage 1 leads deterministically to stage 2. This kernel has: CONFIG_LIST_HARDENED=y # CONFIG_DEBUG_LIST is not set so these reports come from list hardening, not from DEBUG_LIST. Under LIST_HARDENED, __list_add_valid_or_report() returning false causes __list_add() to bail out without performing the insertion. The warning is therefore not advisory: the list operation is silently dropped, leaving the bulk-move sublist half-updated with a NULL link, which the next ttm_lru_bulk_move_tail() walk then writes through. Because that write happens under spin_lock, a would-be per-process oops becomes a machine-wide deadlock. (kmalloc-part-05-96 and kmalloc-rnd-01-192 in the slab lines are CONFIG_SLAB_BUCKETS=y bucket names, not different structures.) CASCADE AND RECOVERY As before, the leaked LRU spinlock took down every subsequent GPU consumer. Soft lockups began 27 s after the oops and climbed from 26 s to 551 s across chrome:cs0, gnome-shell, KMS thread, nvtop, claude-desktop and the ttm delayed-delete workqueue (kworker/u49:12, in ttm_bo_delayed_delete -> ttm_resource_free). Last log entry 13:05:12, hard reset required. Third distinct triggering application now: chrome, lact, file-roller. As the original description argued, the application is incidental. STILL NOT HARDWARE Re-verified for this occurrence: no machine-check exceptions, no EDAC errors, no NVMe errors, no OOM anywhere in the boot. The recurring "amdgpu ... REG_WAIT timeout ... optc314_disable_crtc" message appears on every boot including clean ones and is unrelated. OFFER Since this now reproduces every couple of days, I am willing to run a debug kernel to catch the corrupting write where it happens rather than at the point of death. Ubuntu ships no KASAN kernel, but CONFIG_SLUB_DEBUG=y is set, so I can boot with slub_debug=FZP for redzoning and poisoning on the TTM resource objects. If a KASAN build would be more useful, tell me which config you want and I will build and run it. Aug 31 12:55:21.088996 xxx kernel: slab kmalloc-part-05-96 start ffff8997c7109840 pointer offset 64 size 96 Aug 31 12:55:21.093226 xxx kernel: ------------[ cut here ]------------ Aug 31 12:55:21.093258 xxx kernel: list_add corruption. prev->next should be next (ffff8997e240ee30), but was 0000000000000000. (prev=ffff8997c7109880). Aug 31 12:55:21.093521 xxx kernel: WARNING: lib/list_debug.c:32 at __list_add_valid_or_report+0x87/0xc0, CPU#5: file-roller/316904 Aug 31 12:55:21.093609 xxx kernel: CPU: 5 UID: 1000 PID: 316904 Comm: file-roller Not tainted 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.093625 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.093644 xxx kernel: RIP: 0010:__list_add_valid_or_report+0x90/0xc0 Aug 31 12:55:21.093659 xxx kernel: Code: d4 48 89 f8 48 39 fe 74 28 48 39 fa 74 23 b0 01 eb 36 48 89 f7 e8 30 88 57 00 48 8d 3d 79 37 c7 02 48 8b 13 48 89 d9 4c 89 e 6 <67> 48 0f b9 3a eb a4 48 8d 3d 72 37 c7 02 4c 89 e1 48 89 da 48 89 Aug 31 12:55:21.093847 xxx kernel: RSP: 0018:ffffd122e70af528 EFLAGS: 00010246 Aug 31 12:55:21.093867 xxx kernel: RAX: 0000000000000000 RBX: ffff8997c7109880 RCX: ffff8997c7109880 Aug 31 12:55:21.093884 xxx kernel: RDX: 0000000000000000 RSI: ffff8997e240ee30 RDI: ffffffff9f0f5ff0 Aug 31 12:55:21.094059 xxx kernel: RBP: ffffd122e70af538 R08: 0000000000000000 R09: 0000000000000000 Aug 31 12:55:21.094318 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8997e240ee30 Aug 31 12:55:21.094331 xxx kernel: R13: ffff899f08b95a00 R14: 0000000000000001 R15: ffff899f84d5dc60 Aug 31 12:55:21.094369 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0c61000(0000) knlGS:0000000000000000 Aug 31 12:55:21.094385 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.094413 xxx kernel: CR2: 000073b618020000 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.094428 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.094439 xxx kernel: Call Trace: Aug 31 12:55:21.094618 xxx kernel: <TASK> Aug 31 12:55:21.094631 xxx kernel: ttm_resource_move_to_lru_tail.cold+0x8/0x76 [ttm] Aug 31 12:55:21.094642 xxx kernel: ? ttm_tt_populate+0x124/0x150 [ttm] Aug 31 12:55:21.094885 xxx kernel: ttm_bo_populate+0x85/0xb0 [ttm] Aug 31 12:55:21.094902 xxx kernel: ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm] Aug 31 12:55:21.094914 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] Aug 31 12:55:21.094925 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm] Aug 31 12:55:21.094941 xxx kernel: ? xas_load+0x11/0x100 Aug 31 12:55:21.094954 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] Aug 31 12:55:21.094969 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu] Aug 31 12:55:21.094988 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] Aug 31 12:55:21.095002 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.095113 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu] Aug 31 12:55:21.095220 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] Aug 31 12:55:21.104161 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.104184 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.104333 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.104364 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.104385 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.104403 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.104418 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.104621 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.104651 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.104662 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.104685 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.104696 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.105063 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105091 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105390 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.105414 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105427 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.105441 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.105558 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105571 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.113154 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113168 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.113353 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113371 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.113388 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113399 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.113411 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113425 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.113447 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113457 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.113636 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113731 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.113744 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113756 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.113769 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113781 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113790 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.113893 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113902 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.113918 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.113933 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.113944 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.113957 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.114068 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.114081 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.114094 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.114202 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.114312 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.114421 xxx kernel: </TASK> Aug 31 12:55:21.114434 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.114454 xxx kernel: slab kmalloc-part-05-96 start ffff8997d15327e0 pointer offset 64 size 96 Aug 31 12:55:21.114553 xxx kernel: ------------[ cut here ]------------ Aug 31 12:55:21.114567 xxx kernel: list_del corruption. prev->next should be ffff8997d152d340, but was ffff8997cda6bdc0. (prev=ffff8997d1532820) Aug 31 12:55:21.120053 xxx kernel: WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#8: file-roller/316904 Aug 31 12:55:21.120205 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm: file-roller Tainted: G W 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.120221 xxx kernel: Tainted: [W]=WARN Aug 31 12:55:21.120234 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.120245 xxx kernel: RIP: 0010:__list_del_entry_valid_or_report+0xee/0x10b Aug 31 12:55:21.120362 xxx kernel: Code: 08 4c 89 e1 48 89 de 67 48 0f b9 3a e9 7b ff ff ff 4c 89 ef e8 03 87 57 00 48 8d 3d bc 36 c7 02 49 8b 55 00 4c 89 e9 48 89 d e <67> 48 0f b9 3a e9 58 ff ff ff 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 Aug 31 12:55:21.120380 xxx kernel: RSP: 0018:ffffd122e70af4a8 EFLAGS: 00010246 Aug 31 12:55:21.120637 xxx kernel: RAX: 0000000000000000 RBX: ffff8997d152d340 RCX: ffff8997d1532820 Aug 31 12:55:21.120812 xxx kernel: RDX: ffff8997cda6bdc0 RSI: ffff8997d152d340 RDI: ffffffff9f0f6060 Aug 31 12:55:21.121006 xxx kernel: RBP: ffffd122e70af4c0 R08: 0000000000000000 R09: 0000000000000000 Aug 31 12:55:21.121021 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8997cda6bdc0 Aug 31 12:55:21.121127 xxx kernel: R13: ffff8997d1532820 R14: 0000000000000000 R15: ffffd122e70af6d0 Aug 31 12:55:21.121234 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.121328 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.127660 xxx kernel: CR2: 000018cc07cb7000 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.127676 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.127690 xxx kernel: Call Trace: Aug 31 12:55:21.127707 xxx kernel: <TASK> Aug 31 12:55:21.127718 xxx kernel: ttm_resource_fini.cold+0xc/0x15 [ttm] Aug 31 12:55:21.127838 xxx kernel: ttm_sys_man_free+0x12/0x30 [ttm] Aug 31 12:55:21.127850 xxx kernel: ttm_resource_free+0xae/0x140 [ttm] Aug 31 12:55:21.127865 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.127882 xxx kernel: ? amdgpu_bo_move_notify+0x61/0x150 [amdgpu] Aug 31 12:55:21.127893 xxx kernel: amdgpu_bo_move+0x1c1/0x3c0 [amdgpu] Aug 31 12:55:21.127992 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128002 xxx kernel: ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm] Aug 31 12:55:21.128011 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] Aug 31 12:55:21.128022 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm] Aug 31 12:55:21.128035 xxx kernel: ? xas_load+0x11/0x100 Aug 31 12:55:21.128136 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] Aug 31 12:55:21.128145 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu] Aug 31 12:55:21.128156 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] Aug 31 12:55:21.128164 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128174 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu] Aug 31 12:55:21.128183 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] Aug 31 12:55:21.128278 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.128295 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.128306 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.128496 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.128507 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.128525 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.128546 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.128557 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.128566 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.128576 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.128586 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128593 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.128605 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128615 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128622 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.128630 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128793 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.128803 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.128813 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128823 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.128833 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128845 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.128943 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.135987 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.136225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136244 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.136254 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136447 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.136454 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136464 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.136475 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136484 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.136494 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136506 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.136516 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136526 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136534 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.136545 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136551 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.136565 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.136575 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.136581 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.136590 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.136603 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.136695 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.136705 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.136716 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.136727 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.136735 xxx kernel: </TASK> Aug 31 12:55:21.136745 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.136759 xxx kernel: BUG: kernel NULL pointer dereference, address: 0000000000000008 Aug 31 12:55:21.136833 xxx kernel: #PF: supervisor write access in kernel mode Aug 31 12:55:21.157571 xxx kernel: #PF: error_code(0x0002) - not-present page Aug 31 12:55:21.165073 xxx kernel: PGD 0 P4D 0 Aug 31 12:55:21.174272 xxx kernel: Oops: Oops: 0002 [#1] SMP NOPTI Aug 31 12:55:21.174310 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm: file-roller Tainted: G W 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.174327 xxx kernel: Tainted: [W]=WARN Aug 31 12:55:21.174342 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.174361 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 31 12:55:21.174381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 4 8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 31 12:55:21.174399 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296 Aug 31 12:55:21.174411 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000 RCX: 0000000000000078 Aug 31 12:55:21.174522 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000 RDI: ffff8997c8edfc40 Aug 31 12:55:21.174537 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000 R09: ffff8997c7109880 Aug 31 12:55:21.174551 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000 R12: ffff89985a2ed9a8 Aug 31 12:55:21.174562 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001 R15: ffff8997d00786c0 Aug 31 12:55:21.174576 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.174588 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.174606 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.174787 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.174798 xxx kernel: Call Trace: Aug 31 12:55:21.174814 xxx kernel: <TASK> Aug 31 12:55:21.174823 xxx kernel: ? queue_work_on+0x96/0xb0 Aug 31 12:55:21.174834 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.174849 xxx kernel: ? drm_sched_wakeup+0x43/0x60 [gpu_sched] Aug 31 12:55:21.174860 xxx kernel: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] Aug 31 12:55:21.174874 xxx kernel: amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu] Aug 31 12:55:21.174883 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.174896 xxx kernel: amdgpu_cs_ioctl+0x21b/0x360 [amdgpu] Aug 31 12:55:21.174907 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.174921 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.174932 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.174942 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.174953 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.174961 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.174972 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.174982 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.175002 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.175097 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.175107 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175122 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.175130 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175140 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175149 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.175255 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181154 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.181186 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.181199 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181212 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.181225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181235 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.181259 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181269 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.181282 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181293 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.181306 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181322 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.181337 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181356 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.181480 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181496 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.181507 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181516 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.181529 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181634 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181644 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.181654 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181665 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.181679 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.181694 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.181707 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.181719 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.181731 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.181741 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.181754 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.181765 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.181777 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.181787 xxx kernel: </TASK> Aug 31 12:55:21.181831 xxx kernel: CR2: 0000000000000008 Aug 31 12:55:21.181845 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.220328 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 31 12:55:21.220381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 4 8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 31 12:55:21.220829 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296 Aug 31 12:55:21.220850 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000 RCX: 0000000000000078 Aug 31 12:55:21.220860 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000 RDI: ffff8997c8edfc40 Aug 31 12:55:21.220875 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000 R09: ffff8997c7109880 Aug 31 12:55:21.220886 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000 R12: ffff89985a2ed9a8 Aug 31 12:55:21.220896 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001 R15: ffff8997d00786c0 Aug 31 12:55:21.220906 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.220915 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.220935 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.221032 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.221045 xxx kernel: note: file-roller[316904] exited with irqs disabled Aug 31 12:55:21.221063 xxx kernel: note: file-roller[316904] exited with preempt_count 1 Aug 31 12:55:48.483355 xxx kernel: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [chrome:cs0:12664] (bas ** Attachment added: "lp2165729-prevboot-kernel-7.2.0.log" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+attachment/5996629/+files/lp2165729-prevboot-kernel-7.2.0.log -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165729 Title: faulting task died holding the TTM LRU spinlock (exited with irqs disabled / preempt_count 1), Status in linux package in Ubuntu: New Bug description: # amdgpu/TTM: LRU bulk-move list corruption leads to fatal deref in ttm_lru_bulk_move_tail and unrecoverable system hang (gfx1103) ## Summary On an AMD Ryzen 5 8600G (Phoenix1 iGPU, gfx1103) the TTM LRU bulk-move list becomes corrupted during amdgpu VM page-table teardown. The kernel warns but continues. Roughly ten minutes later an unrelated process dereferences the corrupted list and oopses **while holding the TTM LRU spinlock**, which is therefore never released. Every subsequent GPU consumer blocks on that lock forever, producing cascading soft lockups and an unrecoverable hang requiring a hard reset. ## Version - Ubuntu 26.04.1 LTS - Kernel 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) x86_64 - Board: MSI PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 - CPU/iGPU: AMD Ryzen 5 8600G w/ Radeon 760M (Phoenix1, gfx1103, 1002:15bf rev 05) - Second GPU present: Intel Arc B580 (8086:e20b, `xe` driver), compute only - Displays are driven by the amdgpu iGPU (fb0 primary, HDMI-A-5) ## Impact Total loss of the machine: display frozen, no VT switch, no SSH-able recovery of GPU clients. Only a hard reset recovers. Filesystem journal replay follows on next boot. ## Sequence ### Stage 1 — silent corruption (T+0, 09:06:27) A `list_del` on a TTM LRU bulk-move sublist finds a corrupted `prev->next`, during amdgpu page-table teardown driven by a Chrome `DRM_IOCTL_AMDGPU_GEM_VA`: ``` slab kmalloc-rnd-01-192 start ffff8db11b928480 pointer offset 64 size 192 list_del corruption. prev->next should be ffff8daba68d7700, but was ffff8dab8858eee8. (prev=ffff8db11b9284c0) WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#2: chrome/33651 Call Trace: ttm_lru_bulk_move_del.cold+0x22/0x37 [ttm] ttm_resource_del_bulk_move+0x40/0x70 [ttm] ttm_bo_set_bulk_move+0x42/0xa0 [ttm] amdgpu_vm_pt_free+0x49/0xd0 [amdgpu] amdgpu_vm_pt_free_list+0x49/0x80 [amdgpu] amdgpu_vm_update_range+0x52c/0x940 [amdgpu] amdgpu_vm_bo_update+0x2ae/0x7d0 [amdgpu] amdgpu_gem_va_update_vm+0xf4/0x1f0 [amdgpu] amdgpu_gem_va_ioctl+0x4ec/0x800 [amdgpu] ``` The system continues running, now with a damaged list. A second identical warning fires on CPU#4 in the same second. ### Stage 2 — fatal dereference (T+10min, 09:16:29) An unrelated process walks the damaged list during command submission and faults on a near-null pointer: ``` BUG: unable to handle page fault for address: 0000000000004008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Oops: Oops: 0002 [#1] SMP NOPTI RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Call Trace: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] amdgpu_cs_submit+0x3ae/0x6c0 [amdgpu] amdgpu_cs_ioctl+0x235/0x390 [amdgpu] drm_ioctl_kernel+0xb5/0x110 ``` Critically, the faulting task dies inside the TTM LRU critical section: ``` note: lact[79654] exited with irqs disabled note: lact[79654] exited with preempt_count 1 ``` The LRU spinlock is leaked. Nothing ever releases it. ### Stage 3 — cascading deadlock (09:16:56 onward) Every process that subsequently touches TTM spins on the leaked lock: ``` watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [gnome-shell:11030] watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [KMS thread:11069] watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [chrome:33651] ``` with the expected signature, e.g.: ``` RIP: 0010:native_queued_spin_lock_slowpath+0x304/0x370 _raw_spin_lock+0x3f/0x60 ttm_resource_init+0x7e/0x1b0 [ttm] amdgpu_vram_mgr_new+0xea/0x6b0 [amdgpu] ttm_resource_alloc+0x96/0x170 [ttm] ttm_bo_alloc_resource+0x134/0x5b0 [ttm] ttm_bo_validate+0x9a/0x190 [ttm] amdgpu_bo_create+0x1e4/0x4f0 [amdgpu] amdgpu_vm_pt_create+0x102/0x160 [amdgpu] amdgpu_vm_init+0x2cf/0x6f0 [amdgpu] amdgpu_driver_open_kms+0x175/0x350 [amdgpu] drm_open+0x77/0x120 ``` Stall durations climb monotonically (22s → 152s) across gnome-shell, the KMS thread, chrome and llama-server until the machine was hard reset at 09:19:36. Note that stage 3 shows the bug is fatal to *any* new client: merely opening `/dev/dri/card2` is enough to hang, because `amdgpu_driver_open_kms` allocates page tables through the poisoned LRU. ## Analysis The two processes named (`chrome`, `lact`) are incidental — they are simply the busiest amdgpu clients. The corrupting write and the faulting read are ten minutes and several processes apart, which points at a lifetime/ordering bug in the bulk-move sublist rather than at any one caller. `amdgpu_vm_pt_free` calling `ttm_bo_set_bulk_move(bo, NULL)` on a buffer whose bulk-move cursor is still referenced elsewhere is the most likely candidate, i.e. a missing or mis-ordered `ttm_lru_bulk_move_fini()`-style teardown. The severity multiplier is that the oops happens under `spin_lock`, converting a recoverable per-process oops into a whole-machine deadlock. ## Not hardware - Zero machine-check exceptions and zero EDAC errors across the whole log window - NVMe healthy; filesystem replayed clean on reboot - No overclock or undervolt: `power_dpm_force_performance_level` is `auto`, `pp_od_clk_voltage` at stock 800–2799 MHz, and the installed GPU utility (LACT) had no clock or voltage profile applied - 60 GiB RAM, no memory pressure at the time ## Reproducibility Occurred once. The preceding four boots (spanning several days of identical desktop + GPU-compute workload) contain zero instances of either the `list_del` warning or the oops, so this is rare and timing-dependent rather than deterministic. No known trigger. ## Attachments - `amdgpu-ttm-traces.txt` — all three stages, full register state and module list - `prevboot-kernel.log` — complete `journalctl -b -1 -k` from the crashed boot ===== STAGE 1: initial list corruption (09:06:27) ===== Aug 28 09:06:27 xxx kernel: slab kmalloc-rnd-01-192 start ffff8db11b928480 pointer offset 64 size 192 Aug 28 09:06:27 xxx kernel: ------------[ cut here ]------------ Aug 28 09:06:27 xxx kernel: list_del corruption. prev->next should be ffff8daba68d7700, but was ffff8dab8858eee8. (prev=ffff8db11b9284c0) Aug 28 09:06:27 xxx kernel: WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#2: chrome/33651 Aug 28 09:06:27 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:06:27 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:06:27 xxx kernel: CPU: 2 UID: 1000 PID: 33651 Comm: chrome Tainted: G W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:06:27 xxx kernel: Tainted: [W]=WARN Aug 28 09:06:27 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:06:27 xxx kernel: RIP: 0010:__list_del_entry_valid_or_report+0xee/0x10b Aug 28 09:06:27 xxx kernel: Code: 08 4c 89 e1 48 89 de 67 48 0f b9 3a e9 7b ff ff ff 4c 89 ef e8 53 19 54 00 48 8d 3d ec 85 c7 02 49 8b 55 00 4c 89 e9 48 89 de <67> 48 0f b9 3a e9 58 ff ff ff 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 Aug 28 09:06:27 xxx kernel: RSP: 0018:ffffd20da6c77600 EFLAGS: 00010246 Aug 28 09:06:27 xxx kernel: RAX: 0000000000000000 RBX: ffff8daba68d7700 RCX: ffff8db11b9284c0 Aug 28 09:06:27 xxx kernel: RDX: ffff8dab8858eee8 RSI: ffff8daba68d7700 RDI: ffffffffb52f8d60 Aug 28 09:06:27 xxx kernel: RBP: ffffd20da6c77618 R08: 0000000000000000 R09: 0000000000000000 Aug 28 09:06:27 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8db0dd44af40 Aug 28 09:06:27 xxx kernel: R13: ffff8db11b9284c0 R14: 0000000000000000 R15: ffff8dabd24b37d0 Aug 28 09:06:27 xxx kernel: FS: 000075178abed340(0000) GS:ffff8dba4a6ff000(0000) knlGS:0000000000000000 Aug 28 09:06:27 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:06:27 xxx kernel: CR2: 000070c9fc2a6000 CR3: 000000071e303000 CR4: 0000000000f50ef0 Aug 28 09:06:27 xxx kernel: PKRU: 55555558 Aug 28 09:06:27 xxx kernel: Call Trace: Aug 28 09:06:27 xxx kernel: <TASK> Aug 28 09:06:27 xxx kernel: ttm_lru_bulk_move_del.cold+0x22/0x37 [ttm] Aug 28 09:06:27 xxx kernel: ttm_resource_del_bulk_move+0x40/0x70 [ttm] Aug 28 09:06:27 xxx kernel: ttm_bo_set_bulk_move+0x42/0xa0 [ttm] Aug 28 09:06:27 xxx kernel: amdgpu_vm_pt_free+0x49/0xd0 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_pt_free_list+0x49/0x80 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_update_range+0x52c/0x940 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_bo_update+0x2ae/0x7d0 [amdgpu] Aug 28 09:06:27 xxx kernel: ? amdgpu_sync_free+0x32/0x60 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_gem_va_update_vm+0xf4/0x1f0 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_gem_va_ioctl+0x4ec/0x800 [amdgpu] Aug 28 09:06:27 xxx kernel: ? amdgpu_bo_move+0x99/0x2f0 [amdgpu] Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:06:27 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __check_object_size+0x51/0x100 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? drm_ioctl+0x348/0x5f0 Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 ===== STAGE 2: fatal oops (09:16:29) ===== Aug 28 09:16:29 xxx kernel: BUG: unable to handle page fault for address: 0000000000004008 Aug 28 09:16:29 xxx kernel: #PF: supervisor write access in kernel mode Aug 28 09:16:29 xxx kernel: #PF: error_code(0x0002) - not-present page Aug 28 09:16:29 xxx kernel: PGD 0 P4D 0 Aug 28 09:16:29 xxx kernel: Oops: Oops: 0002 [#1] SMP NOPTI Aug 28 09:16:29 xxx kernel: CPU: 3 UID: 1000 PID: 79654 Comm: lact Tainted: G W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:29 xxx kernel: Tainted: [W]=WARN Aug 28 09:16:29 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:29 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 28 09:16:29 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 48 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 28 09:16:29 xxx kernel: RSP: 0018:ffffd20d8df7b7c8 EFLAGS: 00010286 Aug 28 09:16:29 xxx kernel: RAX: ffff8dab8858eed8 RBX: 0000000000000000 RCX: 0000000000000078 Aug 28 09:16:29 xxx kernel: RDX: ffff8dad43934d80 RSI: 0000000000004000 RDI: ffff8dad3e734c40 Aug 28 09:16:29 xxx kernel: RBP: ffffd20d8df7b830 R08: 0000000000000000 R09: ffff8dad43934dc0 Aug 28 09:16:29 xxx kernel: R10: ffff8dab8152b5e0 R11: 0000000000000000 R12: ffff8dac3b510958 Aug 28 09:16:29 xxx kernel: R13: ffff8dab8858ee70 R14: 0000000000000001 R15: ffff8dab8152b5a0 Aug 28 09:16:29 xxx kernel: FS: 0000766a87e06200(0000) GS:ffff8dba4a77f000(0000) knlGS:0000000000000000 Aug 28 09:16:29 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 CR3: 00000006efa6c000 CR4: 0000000000f50ef0 Aug 28 09:16:29 xxx kernel: PKRU: 55555554 Aug 28 09:16:29 xxx kernel: Call Trace: Aug 28 09:16:29 xxx kernel: <TASK> Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? drm_sched_wakeup+0x43/0x60 [gpu_sched] Aug 28 09:16:29 xxx kernel: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] Aug 28 09:16:29 xxx kernel: amdgpu_cs_submit+0x3ae/0x6c0 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: amdgpu_cs_ioctl+0x235/0x390 [amdgpu] Aug 28 09:16:29 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:29 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:16:29 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:16:29 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:29 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:16:29 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:16:29 xxx kernel: ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 28 09:16:29 xxx kernel: RIP: 0033:0x766a8a732c3d Aug 28 09:16:29 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 28 09:16:29 xxx kernel: RSP: 002b:00007fff4f840f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 28 09:16:29 xxx kernel: RAX: ffffffffffffffda RBX: 00007fff4f841138 RCX: 0000766a8a732c3d Aug 28 09:16:29 xxx kernel: RDX: 00007fff4f840fb0 RSI: 00000000c0186444 RDI: 0000000000000015 Aug 28 09:16:29 xxx kernel: RBP: 00007fff4f840f60 R08: 000061738ca1bda0 R09: 00007fff4f840f70 Aug 28 09:16:29 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 000040d6ee11fdc5 Aug 28 09:16:29 xxx kernel: R13: 0000000000000015 R14: 0000000000000006 R15: 000061738c0493a0 Aug 28 09:16:29 xxx kernel: </TASK> Aug 28 09:16:29 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:29 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 Aug 28 09:16:29 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 28 09:16:29 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 28 09:16:29 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 48 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 28 09:16:29 xxx kernel: RSP: 0018:ffffd20d8df7b7c8 EFLAGS: 00010286 Aug 28 09:16:29 xxx kernel: RAX: ffff8dab8858eed8 RBX: 0000000000000000 RCX: 0000000000000078 Aug 28 09:16:29 xxx kernel: RDX: ffff8dad43934d80 RSI: 0000000000004000 RDI: ffff8dad3e734c40 Aug 28 09:16:29 xxx kernel: RBP: ffffd20d8df7b830 R08: 0000000000000000 R09: ffff8dad43934dc0 Aug 28 09:16:29 xxx kernel: R10: ffff8dab8152b5e0 R11: 0000000000000000 R12: ffff8dac3b510958 Aug 28 09:16:29 xxx kernel: R13: ffff8dab8858ee70 R14: 0000000000000001 R15: ffff8dab8152b5a0 Aug 28 09:16:29 xxx kernel: FS: 0000766a87e06200(0000) GS:ffff8dba4a77f000(0000) knlGS:0000000000000000 Aug 28 09:16:29 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 CR3: 00000006efa6c000 CR4: 0000000000f50ef0 Aug 28 09:16:29 xxx kernel: PKRU: 55555554 Aug 28 09:16:29 xxx kernel: note: lact[79654] exited with irqs disabled Aug 28 09:16:29 xxx kernel: note: lact[79654] exited with preempt_count 1 ===== STAGE 3: first soft lockup victim (09:16:56) ===== Aug 28 09:16:56 xxx kernel: watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [gnome-shell:11030] Aug 28 09:16:56 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:56 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:56 xxx kernel: CPU: 5 UID: 1000 PID: 11030 Comm: gnome-shell Tainted: G D W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:56 xxx kernel: Tainted: [D]=DIE, [W]=WARN Aug 28 09:16:56 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:56 xxx kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x286/0x370 Aug 28 09:16:56 xxx kernel: Code: 41 c1 e0 10 41 c1 e2 12 45 09 d0 44 89 c0 c1 e8 10 66 87 41 02 89 c6 c1 e6 10 81 fe ff ff 00 00 77 50 31 f6 eb 02 f3 90 8b 01 <66> 85 c0 75 f7 44 39 c0 0f 84 88 00 00 00 c6 01 01 48 85 f6 74 0e Aug 28 09:16:56 xxx kernel: RSP: 0018:ffffd20d8ce03948 EFLAGS: 00000202 Aug 28 09:16:56 xxx kernel: RAX: 0000000000080101 RBX: ffff8dab82f81f00 RCX: ffff8dab8858f6b0 Aug 28 09:16:56 xxx kernel: RDX: ffff8dba000b4500 RSI: 0000000000000000 RDI: ffff8dab8858f6b0 Aug 28 09:16:56 xxx kernel: RBP: ffffd20d8ce03970 R08: 0000000000180000 R09: ffff8dba4a87f000 Aug 28 09:16:56 xxx kernel: R10: 0000000000180000 R11: 0000000000000000 R12: ffff8dabaa620c48 Aug 28 09:16:56 xxx kernel: R13: ffff8dab8858fb00 R14: ffff8dab8858fb00 R15: ffff8dab82f81f00 Aug 28 09:16:56 xxx kernel: FS: 00007022f795d040(0000) GS:ffff8dba4a87f000(0000) knlGS:0000000000000000 Aug 28 09:16:56 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:56 xxx kernel: CR2: 0000237de136e000 CR3: 00000002019e1000 CR4: 0000000000f50ef0 Aug 28 09:16:56 xxx kernel: PKRU: 55555554 Aug 28 09:16:56 xxx kernel: Call Trace: Aug 28 09:16:56 xxx kernel: <TASK> Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? unix_stream_read_generic+0x222/0xa80 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: _raw_spin_lock+0x3f/0x60 Aug 28 09:16:56 xxx kernel: ttm_resource_init+0x7e/0x1b0 [ttm] Aug 28 09:16:56 xxx kernel: amdgpu_gtt_mgr_new+0x7b/0x170 [amdgpu] Aug 28 09:16:56 xxx kernel: ttm_resource_alloc+0x96/0x170 [ttm] Aug 28 09:16:56 xxx kernel: ttm_bo_alloc_resource+0x134/0x5b0 [ttm] Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? drm_mm_insert_node_in_range+0x593/0x610 Aug 28 09:16:56 xxx kernel: ttm_bo_validate+0x9a/0x190 [ttm] Aug 28 09:16:56 xxx kernel: ttm_bo_init_reserved+0x170/0x1f0 [ttm] Aug 28 09:16:56 xxx kernel: amdgpu_bo_create+0x1e4/0x4f0 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_bo_create_user+0x3d/0x70 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_gem_create_ioctl+0x17f/0x3f0 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:16:56 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:16:56 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:16:56 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 28 09:16:56 xxx kernel: RIP: 0033:0x7022fc932c3d Aug 28 09:16:56 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 28 09:16:56 xxx kernel: RSP: 002b:00007ffd955fd610 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 28 09:16:56 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffd955fd770 RCX: 00007022fc932c3d Aug 28 09:16:56 xxx kernel: RDX: 00007ffd955fd6c0 RSI: 00000000c0206440 RDI: 0000000000000013 Aug 28 09:16:56 xxx kernel: RBP: 00007ffd955fd660 R08: 0000000000000019 R09: 00005e86c17462f0 Aug 28 09:16:56 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd955fd6c0 Aug 28 09:16:56 xxx kernel: R13: 00000000c0206440 R14: 0000000000000013 R15: 00005e86c19dcdf0 Aug 28 09:16:56 xxx kernel: </TASK> Aug 28 09:16:56 xxx kernel: watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [KMS thread:11069] Aug 28 09:16:56 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:56 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:56 xxx kernel: CPU: 10 UID: 1000 PID: 11069 Comm: KMS thread Tainted: G D W L 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:56 xxx kernel: Tainted: [D]=DIE, [W]=WARN, [L]=SOFTLOCKUP Aug 28 09:16:56 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:56 xxx kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x7d/0x370 Aug 28 09:16:56 xxx kernel: Code: 0f ba 29 08 0f 92 c2 8b 01 0f b6 d2 c1 e2 08 30 e4 09 d0 3d ff 00 00 00 77 63 85 c0 74 10 0f b6 01 84 c0 74 09 f3 90 0f b6 01 <84> c0 75 f7 b8 01 00 00 00 66 89 01 31 c0 31 d2 31 c9 31 f6 31 ff Aug 28 09:16:56 xxx kernel: RSP: 0018:ffffd20d8d787928 EFLAGS: 00000202 Aug 28 09:16:56 xxx kernel: RAX: 0000000000000001 RBX: ffff8db0f2281848 RCX: ffff8dab8858f6b0 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Fri Aug 28 09:44:12 2026 HibernationDevice: InstallationDate: Installed on 2024-10-10 (687 days ago) InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424) IwDevWlp16s0Link: Not connected. MachineType: Micro-Star International Co., Ltd. MS-7D77 ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=4a267b94-06d1-4253-aa1d-1033c43e152c ro quiet splash pcie_aspm=off intel_iommu=on resume=/dev/nvme0n1p1 resume_offset=216956928 SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-04-27 (124 days ago) dmi.bios.date: 08/05/2025 dmi.bios.release: 5.35 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: 1.R3 dmi.board.asset.tag: To be filled by O.E.M. dmi.board.name: PRO B650M-A WIFI (MS-7D77) dmi.board.vendor: Micro-Star International Co., Ltd. dmi.board.version: 1.0 dmi.chassis.asset.tag: To be filled by O.E.M. dmi.chassis.type: 3 dmi.chassis.vendor: Micro-Star International Co., Ltd. dmi.chassis.version: 1.0 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvr1.R3:bd08/05/2025:br5.35:svnMicro-StarInternationalCo.,Ltd.:pnMS-7D77:pvr1.0:rvnMicro-StarInternationalCo.,Ltd.:rnPROB650M-AWIFI(MS-7D77):rvr1.0:cvnMicro-StarInternationalCo.,Ltd.:ct3:cvr1.0:skuTobefilledbyO.E.M.:pfaTobefilledbyO.E.M.: dmi.product.family: To be filled by O.E.M. dmi.product.name: MS-7D77 dmi.product.sku: To be filled by O.E.M. dmi.product.version: 1.0 dmi.sys.vendor: Micro-Star International Co., Ltd. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+subscriptions