[Bug 2165729] Re: faulting task died holding the TTM LRU spinlock (exited with irqs disabled / preempt_count 1),

Second occurrence, 2026-08-31. Two things in the original description need correcting: this is not a one-off, and it is not specific to the Ubuntu kernel. Please add the kernel-bug-exists-upstream tag. REPRODUCED ON MAINLINE linux-image-unsigned-7.2.0-070200-generic 7.2.0-070200.202608162350 Linux version 7.2.0-070200-generic (kernel@balboa) ... #202608162350 SMP PREEMPT_DYNAMIC Wed Aug 19 18:42:46 UTC 2026 That is a mainline-builds PPA kernel with no Ubuntu patches applied. Same board, same iGPU, same boot cmdline as the original report. The defect is in mainline drm/amdgpu + ttm, not in the Ubuntu delta. FREQUENCY Twice in four days, so "Occurred once ... rare and timing-dependent" in the original description no longer holds: 2026-08-28 09:16:29 kernel 7.0.0-30-generic (original report) 2026-08-31 12:55:21 kernel 7.2.0-070200-generic (this one) Both were captured by pstore. THE WHOLE SEQUENCE COLLAPSED INTO 48 ms IN ONE PROCESS This is the useful part. In the original report the corruption and the fatal dereference were ten minutes and two processes apart, which made the causal link circumstantial. This time all three events are the same task, file-roller PID 316904, inside a single command-submission sequence: 12:55:21.088996 slab kmalloc-part-05-96 start ffff8997c7109840 pointer offset 64 size 96 12:55:21.093258 list_add corruption. prev->next should be next (ffff8997e240ee30), but was 0000000000000000. (prev=ffff8997c7109880). WARNING: lib/list_debug.c:32 at __list_add_valid_or_report+0x87/0xc0, CPU#5: file-roller/316904 ttm_resource_move_to_lru_tail.cold+0x8/0x76 [ttm] ttm_bo_populate+0x85/0xb0 [ttm] ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm] ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] ttm_bo_validate+0xc0/0x190 [ttm] amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] 12:55:21.114567 list_del corruption. prev->next should be ffff8997d152d340, but was ffff8997cda6bdc0. (prev=ffff8997d1532820) WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#8: file-roller/316904 ttm_resource_fini.cold+0xc/0x15 [ttm] ttm_sys_man_free+0x12/0x30 [ttm] ttm_resource_free+0xae/0x140 [ttm] ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm] ttm_bo_validate+0xc0/0x190 [ttm] 12:55:21.136759 BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode Oops: Oops: 0002 [#1] SMP NOPTI RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu] amdgpu_cs_ioctl+0x21b/0x360 [amdgpu] note: file-roller[316904] exited with irqs disabled note: file-roller[316904] exited with preempt_count 1 THE OOPS DEREFERENCES EXACTLY THE ADDRESSES NAMED IN THE WARNING The register state at the oops matches the pointers reported 43 ms earlier, so this is demonstrably the same list node rather than an inference: RAX: ffff8997e240ee30 == the "should be next" value from the list_add report R09: ffff8997c7109880 == the "prev=" value from the list_add report RDX: ffff8997c7109840 == the slab object start from the slab line RSI: 0000000000000000 == the bad prev->next that was reported as NULL CR2: 0000000000000008 The faulting instruction is 48 89 7e 08, a write to RSI+8, with RSI zero. Note ffff8997c7109880 = ffff8997c7109840 + 64, i.e. the damaged list_head sits at offset 64 of a 96-byte kmalloc object, matching "pointer offset 64 size 96" in the slab line. So the corrupted node and the node the oops walks into are one and the same allocation. I have not tried to identify which struct that is and would rather not guess. For comparison, the 7.0.0-30 oops was at the same RIP offset +0x1a5 with the same opcode, but RSI was 0x4000 rather than 0. Near-NULL there, plain NULL here. DAMAGED FROM THE INSERTION SIDE THIS TIME The original stage 1 was ttm_lru_bulk_move_del via amdgpu_vm_pt_free, i.e. page-table teardown. Here it is ttm_resource_move_to_lru_tail from ttm_bo_populate inside a bounce-buffer move during CS buffer validation, i.e. the insertion side. The same sublist is damaged from either direction, which suggests the problem is the sublist's own consistency rather than one particular caller's teardown ordering. WHY THE WARNING IS NOT SURVIVABLE The original description says the kernel "warns but continues". The mechanism is worth stating explicitly, because it is why stage 1 leads deterministically to stage 2. This kernel has: CONFIG_LIST_HARDENED=y # CONFIG_DEBUG_LIST is not set so these reports come from list hardening, not from DEBUG_LIST. Under LIST_HARDENED, __list_add_valid_or_report() returning false causes __list_add() to bail out without performing the insertion. The warning is therefore not advisory: the list operation is silently dropped, leaving the bulk-move sublist half-updated with a NULL link, which the next ttm_lru_bulk_move_tail() walk then writes through. Because that write happens under spin_lock, a would-be per-process oops becomes a machine-wide deadlock. (kmalloc-part-05-96 and kmalloc-rnd-01-192 in the slab lines are CONFIG_SLAB_BUCKETS=y bucket names, not different structures.) CASCADE AND RECOVERY As before, the leaked LRU spinlock took down every subsequent GPU consumer. Soft lockups began 27 s after the oops and climbed from 26 s to 551 s across chrome:cs0, gnome-shell, KMS thread, nvtop, claude-desktop and the ttm delayed-delete workqueue (kworker/u49:12, in ttm_bo_delayed_delete -> ttm_resource_free). Last log entry 13:05:12, hard reset required. Third distinct triggering application now: chrome, lact, file-roller. As the original description argued, the application is incidental. STILL NOT HARDWARE Re-verified for this occurrence: no machine-check exceptions, no EDAC errors, no NVMe errors, no OOM anywhere in the boot. The recurring "amdgpu ... REG_WAIT timeout ... optc314_disable_crtc" message appears on every boot including clean ones and is unrelated. OFFER Since this now reproduces every couple of days, I am willing to run a debug kernel to catch the corrupting write where it happens rather than at the point of death. Ubuntu ships no KASAN kernel, but CONFIG_SLUB_DEBUG=y is set, so I can boot with slub_debug=FZP for redzoning and poisoning on the TTM resource objects. If a KASAN build would be more useful, tell me which config you want and I will build and run it. Aug 31 12:55:21.088996 xxx kernel: slab kmalloc-part-05-96 start ffff8997c7109840 pointer offset 64 size 96 Aug 31 12:55:21.093226 xxx kernel: ------------[ cut here ]------------ Aug 31 12:55:21.093258 xxx kernel: list_add corruption. prev->next should be next (ffff8997e240ee30), but was 0000000000000000. (prev=ffff8997c7109880). Aug 31 12:55:21.093521 xxx kernel: WARNING: lib/list_debug.c:32 at __list_add_valid_or_report+0x87/0xc0, CPU#5: file-roller/316904 Aug 31 12:55:21.093609 xxx kernel: CPU: 5 UID: 1000 PID: 316904 Comm: file-roller Not tainted 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.093625 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.093644 xxx kernel: RIP: 0010:__list_add_valid_or_report+0x90/0xc0 Aug 31 12:55:21.093659 xxx kernel: Code: d4 48 89 f8 48 39 fe 74 28 48 39 fa 74 23 b0 01 eb 36 48 89 f7 e8 30 88 57 00 48 8d 3d 79 37 c7 02 48 8b 13 48 89 d9 4c 89 e 6 <67> 48 0f b9 3a eb a4 48 8d 3d 72 37 c7 02 4c 89 e1 48 89 da 48 89 Aug 31 12:55:21.093847 xxx kernel: RSP: 0018:ffffd122e70af528 EFLAGS: 00010246 Aug 31 12:55:21.093867 xxx kernel: RAX: 0000000000000000 RBX: ffff8997c7109880 RCX: ffff8997c7109880 Aug 31 12:55:21.093884 xxx kernel: RDX: 0000000000000000 RSI: ffff8997e240ee30 RDI: ffffffff9f0f5ff0 Aug 31 12:55:21.094059 xxx kernel: RBP: ffffd122e70af538 R08: 0000000000000000 R09: 0000000000000000 Aug 31 12:55:21.094318 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8997e240ee30 Aug 31 12:55:21.094331 xxx kernel: R13: ffff899f08b95a00 R14: 0000000000000001 R15: ffff899f84d5dc60 Aug 31 12:55:21.094369 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0c61000(0000) knlGS:0000000000000000 Aug 31 12:55:21.094385 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.094413 xxx kernel: CR2: 000073b618020000 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.094428 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.094439 xxx kernel: Call Trace: Aug 31 12:55:21.094618 xxx kernel: <TASK> Aug 31 12:55:21.094631 xxx kernel: ttm_resource_move_to_lru_tail.cold+0x8/0x76 [ttm] Aug 31 12:55:21.094642 xxx kernel: ? ttm_tt_populate+0x124/0x150 [ttm] Aug 31 12:55:21.094885 xxx kernel: ttm_bo_populate+0x85/0xb0 [ttm] Aug 31 12:55:21.094902 xxx kernel: ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm] Aug 31 12:55:21.094914 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] Aug 31 12:55:21.094925 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm] Aug 31 12:55:21.094941 xxx kernel: ? xas_load+0x11/0x100 Aug 31 12:55:21.094954 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] Aug 31 12:55:21.094969 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu] Aug 31 12:55:21.094988 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] Aug 31 12:55:21.095002 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.095113 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu] Aug 31 12:55:21.095220 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] Aug 31 12:55:21.104161 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.104184 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.104333 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.104364 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.104385 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.104403 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.104418 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.104621 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.104651 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.104662 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.104685 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.104696 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.105063 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105091 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105390 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.105414 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105427 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.105441 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.105558 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.105571 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.113154 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113168 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.113353 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113371 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.113388 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113399 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.113411 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113425 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.113447 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113457 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.113636 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113731 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.113744 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113756 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.113769 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113781 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113790 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.113893 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.113902 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.113918 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.113933 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.113944 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.113957 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.114068 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.114081 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.114094 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.114202 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.114312 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.114421 xxx kernel: </TASK> Aug 31 12:55:21.114434 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.114454 xxx kernel: slab kmalloc-part-05-96 start ffff8997d15327e0 pointer offset 64 size 96 Aug 31 12:55:21.114553 xxx kernel: ------------[ cut here ]------------ Aug 31 12:55:21.114567 xxx kernel: list_del corruption. prev->next should be ffff8997d152d340, but was ffff8997cda6bdc0. (prev=ffff8997d1532820) Aug 31 12:55:21.120053 xxx kernel: WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#8: file-roller/316904 Aug 31 12:55:21.120205 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm: file-roller Tainted: G W 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.120221 xxx kernel: Tainted: [W]=WARN Aug 31 12:55:21.120234 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.120245 xxx kernel: RIP: 0010:__list_del_entry_valid_or_report+0xee/0x10b Aug 31 12:55:21.120362 xxx kernel: Code: 08 4c 89 e1 48 89 de 67 48 0f b9 3a e9 7b ff ff ff 4c 89 ef e8 03 87 57 00 48 8d 3d bc 36 c7 02 49 8b 55 00 4c 89 e9 48 89 d e <67> 48 0f b9 3a e9 58 ff ff ff 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 Aug 31 12:55:21.120380 xxx kernel: RSP: 0018:ffffd122e70af4a8 EFLAGS: 00010246 Aug 31 12:55:21.120637 xxx kernel: RAX: 0000000000000000 RBX: ffff8997d152d340 RCX: ffff8997d1532820 Aug 31 12:55:21.120812 xxx kernel: RDX: ffff8997cda6bdc0 RSI: ffff8997d152d340 RDI: ffffffff9f0f6060 Aug 31 12:55:21.121006 xxx kernel: RBP: ffffd122e70af4c0 R08: 0000000000000000 R09: 0000000000000000 Aug 31 12:55:21.121021 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8997cda6bdc0 Aug 31 12:55:21.121127 xxx kernel: R13: ffff8997d1532820 R14: 0000000000000000 R15: ffffd122e70af6d0 Aug 31 12:55:21.121234 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.121328 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.127660 xxx kernel: CR2: 000018cc07cb7000 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.127676 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.127690 xxx kernel: Call Trace: Aug 31 12:55:21.127707 xxx kernel: <TASK> Aug 31 12:55:21.127718 xxx kernel: ttm_resource_fini.cold+0xc/0x15 [ttm] Aug 31 12:55:21.127838 xxx kernel: ttm_sys_man_free+0x12/0x30 [ttm] Aug 31 12:55:21.127850 xxx kernel: ttm_resource_free+0xae/0x140 [ttm] Aug 31 12:55:21.127865 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.127882 xxx kernel: ? amdgpu_bo_move_notify+0x61/0x150 [amdgpu] Aug 31 12:55:21.127893 xxx kernel: amdgpu_bo_move+0x1c1/0x3c0 [amdgpu] Aug 31 12:55:21.127992 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128002 xxx kernel: ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm] Aug 31 12:55:21.128011 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm] Aug 31 12:55:21.128022 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm] Aug 31 12:55:21.128035 xxx kernel: ? xas_load+0x11/0x100 Aug 31 12:55:21.128136 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu] Aug 31 12:55:21.128145 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu] Aug 31 12:55:21.128156 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu] Aug 31 12:55:21.128164 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128174 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu] Aug 31 12:55:21.128183 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu] Aug 31 12:55:21.128278 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.128295 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.128306 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.128496 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.128507 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.128525 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.128546 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.128557 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.128566 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.128576 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.128586 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128593 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.128605 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128615 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128622 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.128630 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128793 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.128803 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.128813 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128823 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.128833 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.128845 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.128943 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.135987 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.136225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136244 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.136254 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136447 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.136454 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136464 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.136475 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136484 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.136494 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136506 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.136516 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136526 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136534 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.136545 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.136551 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.136565 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.136575 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.136581 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.136590 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.136603 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.136695 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.136705 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.136716 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.136727 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.136735 xxx kernel: </TASK> Aug 31 12:55:21.136745 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.136759 xxx kernel: BUG: kernel NULL pointer dereference, address: 0000000000000008 Aug 31 12:55:21.136833 xxx kernel: #PF: supervisor write access in kernel mode Aug 31 12:55:21.157571 xxx kernel: #PF: error_code(0x0002) - not-present page Aug 31 12:55:21.165073 xxx kernel: PGD 0 P4D 0 Aug 31 12:55:21.174272 xxx kernel: Oops: Oops: 0002 [#1] SMP NOPTI Aug 31 12:55:21.174310 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm: file-roller Tainted: G W 7.2.0-070200-generic #202608162350 PREEMPT(lazy) Aug 31 12:55:21.174327 xxx kernel: Tainted: [W]=WARN Aug 31 12:55:21.174342 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 31 12:55:21.174361 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 31 12:55:21.174381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 4 8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 31 12:55:21.174399 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296 Aug 31 12:55:21.174411 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000 RCX: 0000000000000078 Aug 31 12:55:21.174522 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000 RDI: ffff8997c8edfc40 Aug 31 12:55:21.174537 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000 R09: ffff8997c7109880 Aug 31 12:55:21.174551 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000 R12: ffff89985a2ed9a8 Aug 31 12:55:21.174562 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001 R15: ffff8997d00786c0 Aug 31 12:55:21.174576 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.174588 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.174606 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.174787 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.174798 xxx kernel: Call Trace: Aug 31 12:55:21.174814 xxx kernel: <TASK> Aug 31 12:55:21.174823 xxx kernel: ? queue_work_on+0x96/0xb0 Aug 31 12:55:21.174834 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.174849 xxx kernel: ? drm_sched_wakeup+0x43/0x60 [gpu_sched] Aug 31 12:55:21.174860 xxx kernel: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] Aug 31 12:55:21.174874 xxx kernel: amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu] Aug 31 12:55:21.174883 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.174896 xxx kernel: amdgpu_cs_ioctl+0x21b/0x360 [amdgpu] Aug 31 12:55:21.174907 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.174921 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.174932 xxx kernel: drm_ioctl+0x310/0x600 Aug 31 12:55:21.174942 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 31 12:55:21.174953 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 31 12:55:21.174961 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 31 12:55:21.174972 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.174982 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 31 12:55:21.175002 xxx kernel: do_syscall_64+0xde/0x580 Aug 31 12:55:21.175097 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100 Aug 31 12:55:21.175107 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175122 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110 Aug 31 12:55:21.175130 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175140 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.175149 xxx kernel: ? __check_object_size+0x51/0xf0 Aug 31 12:55:21.175255 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181154 xxx kernel: ? drm_ioctl+0x34f/0x600 Aug 31 12:55:21.181186 xxx kernel: ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 Aug 31 12:55:21.181199 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181212 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 31 12:55:21.181225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181235 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 31 12:55:21.181259 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181269 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0 Aug 31 12:55:21.181282 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181293 xxx kernel: ? do_syscall_64+0x11b/0x580 Aug 31 12:55:21.181306 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181322 xxx kernel: ? __handle_mm_fault+0x493/0x720 Aug 31 12:55:21.181337 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181356 xxx kernel: ? count_memcg_events+0xea/0x240 Aug 31 12:55:21.181480 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181496 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0 Aug 31 12:55:21.181507 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181516 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 31 12:55:21.181529 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181634 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181644 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0 Aug 31 12:55:21.181654 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 31 12:55:21.181665 xxx kernel: ? do_syscall_64+0x95/0x580 Aug 31 12:55:21.181679 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 31 12:55:21.181694 xxx kernel: RIP: 0033:0x73b620d32c3d Aug 31 12:55:21.181707 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 0 5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 31 12:55:21.181719 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 31 12:55:21.181731 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8 RCX: 000073b620d32c3d Aug 31 12:55:21.181741 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444 RDI: 0000000000000010 Aug 31 12:55:21.181754 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550 R09: 00007ffe6eb19910 Aug 31 12:55:21.181765 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00002200758e9906 Aug 31 12:55:21.181777 xxx kernel: R13: 0000000000000010 R14: 0000000000000006 R15: 00005705db5bae30 Aug 31 12:55:21.181787 xxx kernel: </TASK> Aug 31 12:55:21.181831 xxx kernel: CR2: 0000000000000008 Aug 31 12:55:21.181845 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 31 12:55:21.220328 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 31 12:55:21.220381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 4 8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 31 12:55:21.220829 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296 Aug 31 12:55:21.220850 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000 RCX: 0000000000000078 Aug 31 12:55:21.220860 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000 RDI: ffff8997c8edfc40 Aug 31 12:55:21.220875 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000 R09: ffff8997c7109880 Aug 31 12:55:21.220886 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000 R12: ffff89985a2ed9a8 Aug 31 12:55:21.220896 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001 R15: ffff8997d00786c0 Aug 31 12:55:21.220906 xxx kernel: FS: 000073b61dd4d440(0000) GS:ffff89a6a0de1000(0000) knlGS:0000000000000000 Aug 31 12:55:21.220915 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 31 12:55:21.220935 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000 CR4: 0000000000f50ef0 Aug 31 12:55:21.221032 xxx kernel: PKRU: 55555554 Aug 31 12:55:21.221045 xxx kernel: note: file-roller[316904] exited with irqs disabled Aug 31 12:55:21.221063 xxx kernel: note: file-roller[316904] exited with preempt_count 1 Aug 31 12:55:48.483355 xxx kernel: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [chrome:cs0:12664] (bas ** Attachment added: "lp2165729-prevboot-kernel-7.2.0.log" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+attachment/5996628/+files/lp2165729-prevboot-kernel-7.2.0.log -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165729 Title: faulting task died holding the TTM LRU spinlock (exited with irqs disabled / preempt_count 1), Status in linux package in Ubuntu: New Bug description: # amdgpu/TTM: LRU bulk-move list corruption leads to fatal deref in ttm_lru_bulk_move_tail and unrecoverable system hang (gfx1103) ## Summary On an AMD Ryzen 5 8600G (Phoenix1 iGPU, gfx1103) the TTM LRU bulk-move list becomes corrupted during amdgpu VM page-table teardown. The kernel warns but continues. Roughly ten minutes later an unrelated process dereferences the corrupted list and oopses **while holding the TTM LRU spinlock**, which is therefore never released. Every subsequent GPU consumer blocks on that lock forever, producing cascading soft lockups and an unrecoverable hang requiring a hard reset. ## Version - Ubuntu 26.04.1 LTS - Kernel 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) x86_64 - Board: MSI PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 - CPU/iGPU: AMD Ryzen 5 8600G w/ Radeon 760M (Phoenix1, gfx1103, 1002:15bf rev 05) - Second GPU present: Intel Arc B580 (8086:e20b, `xe` driver), compute only - Displays are driven by the amdgpu iGPU (fb0 primary, HDMI-A-5) ## Impact Total loss of the machine: display frozen, no VT switch, no SSH-able recovery of GPU clients. Only a hard reset recovers. Filesystem journal replay follows on next boot. ## Sequence ### Stage 1 — silent corruption (T+0, 09:06:27) A `list_del` on a TTM LRU bulk-move sublist finds a corrupted `prev->next`, during amdgpu page-table teardown driven by a Chrome `DRM_IOCTL_AMDGPU_GEM_VA`: ``` slab kmalloc-rnd-01-192 start ffff8db11b928480 pointer offset 64 size 192 list_del corruption. prev->next should be ffff8daba68d7700, but was ffff8dab8858eee8. (prev=ffff8db11b9284c0) WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#2: chrome/33651 Call Trace: ttm_lru_bulk_move_del.cold+0x22/0x37 [ttm] ttm_resource_del_bulk_move+0x40/0x70 [ttm] ttm_bo_set_bulk_move+0x42/0xa0 [ttm] amdgpu_vm_pt_free+0x49/0xd0 [amdgpu] amdgpu_vm_pt_free_list+0x49/0x80 [amdgpu] amdgpu_vm_update_range+0x52c/0x940 [amdgpu] amdgpu_vm_bo_update+0x2ae/0x7d0 [amdgpu] amdgpu_gem_va_update_vm+0xf4/0x1f0 [amdgpu] amdgpu_gem_va_ioctl+0x4ec/0x800 [amdgpu] ``` The system continues running, now with a damaged list. A second identical warning fires on CPU#4 in the same second. ### Stage 2 — fatal dereference (T+10min, 09:16:29) An unrelated process walks the damaged list during command submission and faults on a near-null pointer: ``` BUG: unable to handle page fault for address: 0000000000004008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Oops: Oops: 0002 [#1] SMP NOPTI RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Call Trace: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] amdgpu_cs_submit+0x3ae/0x6c0 [amdgpu] amdgpu_cs_ioctl+0x235/0x390 [amdgpu] drm_ioctl_kernel+0xb5/0x110 ``` Critically, the faulting task dies inside the TTM LRU critical section: ``` note: lact[79654] exited with irqs disabled note: lact[79654] exited with preempt_count 1 ``` The LRU spinlock is leaked. Nothing ever releases it. ### Stage 3 — cascading deadlock (09:16:56 onward) Every process that subsequently touches TTM spins on the leaked lock: ``` watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [gnome-shell:11030] watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [KMS thread:11069] watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [chrome:33651] ``` with the expected signature, e.g.: ``` RIP: 0010:native_queued_spin_lock_slowpath+0x304/0x370 _raw_spin_lock+0x3f/0x60 ttm_resource_init+0x7e/0x1b0 [ttm] amdgpu_vram_mgr_new+0xea/0x6b0 [amdgpu] ttm_resource_alloc+0x96/0x170 [ttm] ttm_bo_alloc_resource+0x134/0x5b0 [ttm] ttm_bo_validate+0x9a/0x190 [ttm] amdgpu_bo_create+0x1e4/0x4f0 [amdgpu] amdgpu_vm_pt_create+0x102/0x160 [amdgpu] amdgpu_vm_init+0x2cf/0x6f0 [amdgpu] amdgpu_driver_open_kms+0x175/0x350 [amdgpu] drm_open+0x77/0x120 ``` Stall durations climb monotonically (22s → 152s) across gnome-shell, the KMS thread, chrome and llama-server until the machine was hard reset at 09:19:36. Note that stage 3 shows the bug is fatal to *any* new client: merely opening `/dev/dri/card2` is enough to hang, because `amdgpu_driver_open_kms` allocates page tables through the poisoned LRU. ## Analysis The two processes named (`chrome`, `lact`) are incidental — they are simply the busiest amdgpu clients. The corrupting write and the faulting read are ten minutes and several processes apart, which points at a lifetime/ordering bug in the bulk-move sublist rather than at any one caller. `amdgpu_vm_pt_free` calling `ttm_bo_set_bulk_move(bo, NULL)` on a buffer whose bulk-move cursor is still referenced elsewhere is the most likely candidate, i.e. a missing or mis-ordered `ttm_lru_bulk_move_fini()`-style teardown. The severity multiplier is that the oops happens under `spin_lock`, converting a recoverable per-process oops into a whole-machine deadlock. ## Not hardware - Zero machine-check exceptions and zero EDAC errors across the whole log window - NVMe healthy; filesystem replayed clean on reboot - No overclock or undervolt: `power_dpm_force_performance_level` is `auto`, `pp_od_clk_voltage` at stock 800–2799 MHz, and the installed GPU utility (LACT) had no clock or voltage profile applied - 60 GiB RAM, no memory pressure at the time ## Reproducibility Occurred once. The preceding four boots (spanning several days of identical desktop + GPU-compute workload) contain zero instances of either the `list_del` warning or the oops, so this is rare and timing-dependent rather than deterministic. No known trigger. ## Attachments - `amdgpu-ttm-traces.txt` — all three stages, full register state and module list - `prevboot-kernel.log` — complete `journalctl -b -1 -k` from the crashed boot ===== STAGE 1: initial list corruption (09:06:27) ===== Aug 28 09:06:27 xxx kernel: slab kmalloc-rnd-01-192 start ffff8db11b928480 pointer offset 64 size 192 Aug 28 09:06:27 xxx kernel: ------------[ cut here ]------------ Aug 28 09:06:27 xxx kernel: list_del corruption. prev->next should be ffff8daba68d7700, but was ffff8dab8858eee8. (prev=ffff8db11b9284c0) Aug 28 09:06:27 xxx kernel: WARNING: lib/list_debug.c:62 at __list_del_entry_valid_or_report+0xe4/0x10b, CPU#2: chrome/33651 Aug 28 09:06:27 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:06:27 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:06:27 xxx kernel: CPU: 2 UID: 1000 PID: 33651 Comm: chrome Tainted: G W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:06:27 xxx kernel: Tainted: [W]=WARN Aug 28 09:06:27 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:06:27 xxx kernel: RIP: 0010:__list_del_entry_valid_or_report+0xee/0x10b Aug 28 09:06:27 xxx kernel: Code: 08 4c 89 e1 48 89 de 67 48 0f b9 3a e9 7b ff ff ff 4c 89 ef e8 53 19 54 00 48 8d 3d ec 85 c7 02 49 8b 55 00 4c 89 e9 48 89 de <67> 48 0f b9 3a e9 58 ff ff ff 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 Aug 28 09:06:27 xxx kernel: RSP: 0018:ffffd20da6c77600 EFLAGS: 00010246 Aug 28 09:06:27 xxx kernel: RAX: 0000000000000000 RBX: ffff8daba68d7700 RCX: ffff8db11b9284c0 Aug 28 09:06:27 xxx kernel: RDX: ffff8dab8858eee8 RSI: ffff8daba68d7700 RDI: ffffffffb52f8d60 Aug 28 09:06:27 xxx kernel: RBP: ffffd20da6c77618 R08: 0000000000000000 R09: 0000000000000000 Aug 28 09:06:27 xxx kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8db0dd44af40 Aug 28 09:06:27 xxx kernel: R13: ffff8db11b9284c0 R14: 0000000000000000 R15: ffff8dabd24b37d0 Aug 28 09:06:27 xxx kernel: FS: 000075178abed340(0000) GS:ffff8dba4a6ff000(0000) knlGS:0000000000000000 Aug 28 09:06:27 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:06:27 xxx kernel: CR2: 000070c9fc2a6000 CR3: 000000071e303000 CR4: 0000000000f50ef0 Aug 28 09:06:27 xxx kernel: PKRU: 55555558 Aug 28 09:06:27 xxx kernel: Call Trace: Aug 28 09:06:27 xxx kernel: <TASK> Aug 28 09:06:27 xxx kernel: ttm_lru_bulk_move_del.cold+0x22/0x37 [ttm] Aug 28 09:06:27 xxx kernel: ttm_resource_del_bulk_move+0x40/0x70 [ttm] Aug 28 09:06:27 xxx kernel: ttm_bo_set_bulk_move+0x42/0xa0 [ttm] Aug 28 09:06:27 xxx kernel: amdgpu_vm_pt_free+0x49/0xd0 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_pt_free_list+0x49/0x80 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_update_range+0x52c/0x940 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_vm_bo_update+0x2ae/0x7d0 [amdgpu] Aug 28 09:06:27 xxx kernel: ? amdgpu_sync_free+0x32/0x60 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_gem_va_update_vm+0xf4/0x1f0 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_gem_va_ioctl+0x4ec/0x800 [amdgpu] Aug 28 09:06:27 xxx kernel: ? amdgpu_bo_move+0x99/0x2f0 [amdgpu] Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:06:27 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __check_object_size+0x51/0x100 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? drm_ioctl+0x348/0x5f0 Aug 28 09:06:27 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:06:27 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:06:27 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 ===== STAGE 2: fatal oops (09:16:29) ===== Aug 28 09:16:29 xxx kernel: BUG: unable to handle page fault for address: 0000000000004008 Aug 28 09:16:29 xxx kernel: #PF: supervisor write access in kernel mode Aug 28 09:16:29 xxx kernel: #PF: error_code(0x0002) - not-present page Aug 28 09:16:29 xxx kernel: PGD 0 P4D 0 Aug 28 09:16:29 xxx kernel: Oops: Oops: 0002 [#1] SMP NOPTI Aug 28 09:16:29 xxx kernel: CPU: 3 UID: 1000 PID: 79654 Comm: lact Tainted: G W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:29 xxx kernel: Tainted: [W]=WARN Aug 28 09:16:29 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:29 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 28 09:16:29 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 48 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 28 09:16:29 xxx kernel: RSP: 0018:ffffd20d8df7b7c8 EFLAGS: 00010286 Aug 28 09:16:29 xxx kernel: RAX: ffff8dab8858eed8 RBX: 0000000000000000 RCX: 0000000000000078 Aug 28 09:16:29 xxx kernel: RDX: ffff8dad43934d80 RSI: 0000000000004000 RDI: ffff8dad3e734c40 Aug 28 09:16:29 xxx kernel: RBP: ffffd20d8df7b830 R08: 0000000000000000 R09: ffff8dad43934dc0 Aug 28 09:16:29 xxx kernel: R10: ffff8dab8152b5e0 R11: 0000000000000000 R12: ffff8dac3b510958 Aug 28 09:16:29 xxx kernel: R13: ffff8dab8858ee70 R14: 0000000000000001 R15: ffff8dab8152b5a0 Aug 28 09:16:29 xxx kernel: FS: 0000766a87e06200(0000) GS:ffff8dba4a77f000(0000) knlGS:0000000000000000 Aug 28 09:16:29 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 CR3: 00000006efa6c000 CR4: 0000000000f50ef0 Aug 28 09:16:29 xxx kernel: PKRU: 55555554 Aug 28 09:16:29 xxx kernel: Call Trace: Aug 28 09:16:29 xxx kernel: <TASK> Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? drm_sched_wakeup+0x43/0x60 [gpu_sched] Aug 28 09:16:29 xxx kernel: amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu] Aug 28 09:16:29 xxx kernel: amdgpu_cs_submit+0x3ae/0x6c0 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: amdgpu_cs_ioctl+0x235/0x390 [amdgpu] Aug 28 09:16:29 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:29 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:16:29 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:16:29 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:29 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:16:29 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:16:29 xxx kernel: ? __pfx_drm_syncobj_reset_ioctl+0x10/0x10 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? ktime_get_mono_fast_ns+0x36/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu] Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? __audit_syscall_exit+0x36/0x120 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:29 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:29 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 28 09:16:29 xxx kernel: RIP: 0033:0x766a8a732c3d Aug 28 09:16:29 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 28 09:16:29 xxx kernel: RSP: 002b:00007fff4f840f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 28 09:16:29 xxx kernel: RAX: ffffffffffffffda RBX: 00007fff4f841138 RCX: 0000766a8a732c3d Aug 28 09:16:29 xxx kernel: RDX: 00007fff4f840fb0 RSI: 00000000c0186444 RDI: 0000000000000015 Aug 28 09:16:29 xxx kernel: RBP: 00007fff4f840f60 R08: 000061738ca1bda0 R09: 00007fff4f840f70 Aug 28 09:16:29 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 000040d6ee11fdc5 Aug 28 09:16:29 xxx kernel: R13: 0000000000000015 R14: 0000000000000006 R15: 000061738c0493a0 Aug 28 09:16:29 xxx kernel: </TASK> Aug 28 09:16:29 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:29 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 Aug 28 09:16:29 xxx kernel: ---[ end trace 0000000000000000 ]--- Aug 28 09:16:29 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm] Aug 28 09:16:29 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83 3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49 8b 7f 48 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42 Aug 28 09:16:29 xxx kernel: RSP: 0018:ffffd20d8df7b7c8 EFLAGS: 00010286 Aug 28 09:16:29 xxx kernel: RAX: ffff8dab8858eed8 RBX: 0000000000000000 RCX: 0000000000000078 Aug 28 09:16:29 xxx kernel: RDX: ffff8dad43934d80 RSI: 0000000000004000 RDI: ffff8dad3e734c40 Aug 28 09:16:29 xxx kernel: RBP: ffffd20d8df7b830 R08: 0000000000000000 R09: ffff8dad43934dc0 Aug 28 09:16:29 xxx kernel: R10: ffff8dab8152b5e0 R11: 0000000000000000 R12: ffff8dac3b510958 Aug 28 09:16:29 xxx kernel: R13: ffff8dab8858ee70 R14: 0000000000000001 R15: ffff8dab8152b5a0 Aug 28 09:16:29 xxx kernel: FS: 0000766a87e06200(0000) GS:ffff8dba4a77f000(0000) knlGS:0000000000000000 Aug 28 09:16:29 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:29 xxx kernel: CR2: 0000000000004008 CR3: 00000006efa6c000 CR4: 0000000000f50ef0 Aug 28 09:16:29 xxx kernel: PKRU: 55555554 Aug 28 09:16:29 xxx kernel: note: lact[79654] exited with irqs disabled Aug 28 09:16:29 xxx kernel: note: lact[79654] exited with preempt_count 1 ===== STAGE 3: first soft lockup victim (09:16:56) ===== Aug 28 09:16:56 xxx kernel: watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [gnome-shell:11030] Aug 28 09:16:56 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:56 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:56 xxx kernel: CPU: 5 UID: 1000 PID: 11030 Comm: gnome-shell Tainted: G D W 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:56 xxx kernel: Tainted: [D]=DIE, [W]=WARN Aug 28 09:16:56 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:56 xxx kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x286/0x370 Aug 28 09:16:56 xxx kernel: Code: 41 c1 e0 10 41 c1 e2 12 45 09 d0 44 89 c0 c1 e8 10 66 87 41 02 89 c6 c1 e6 10 81 fe ff ff 00 00 77 50 31 f6 eb 02 f3 90 8b 01 <66> 85 c0 75 f7 44 39 c0 0f 84 88 00 00 00 c6 01 01 48 85 f6 74 0e Aug 28 09:16:56 xxx kernel: RSP: 0018:ffffd20d8ce03948 EFLAGS: 00000202 Aug 28 09:16:56 xxx kernel: RAX: 0000000000080101 RBX: ffff8dab82f81f00 RCX: ffff8dab8858f6b0 Aug 28 09:16:56 xxx kernel: RDX: ffff8dba000b4500 RSI: 0000000000000000 RDI: ffff8dab8858f6b0 Aug 28 09:16:56 xxx kernel: RBP: ffffd20d8ce03970 R08: 0000000000180000 R09: ffff8dba4a87f000 Aug 28 09:16:56 xxx kernel: R10: 0000000000180000 R11: 0000000000000000 R12: ffff8dabaa620c48 Aug 28 09:16:56 xxx kernel: R13: ffff8dab8858fb00 R14: ffff8dab8858fb00 R15: ffff8dab82f81f00 Aug 28 09:16:56 xxx kernel: FS: 00007022f795d040(0000) GS:ffff8dba4a87f000(0000) knlGS:0000000000000000 Aug 28 09:16:56 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Aug 28 09:16:56 xxx kernel: CR2: 0000237de136e000 CR3: 00000002019e1000 CR4: 0000000000f50ef0 Aug 28 09:16:56 xxx kernel: PKRU: 55555554 Aug 28 09:16:56 xxx kernel: Call Trace: Aug 28 09:16:56 xxx kernel: <TASK> Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? unix_stream_read_generic+0x222/0xa80 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: _raw_spin_lock+0x3f/0x60 Aug 28 09:16:56 xxx kernel: ttm_resource_init+0x7e/0x1b0 [ttm] Aug 28 09:16:56 xxx kernel: amdgpu_gtt_mgr_new+0x7b/0x170 [amdgpu] Aug 28 09:16:56 xxx kernel: ttm_resource_alloc+0x96/0x170 [ttm] Aug 28 09:16:56 xxx kernel: ttm_bo_alloc_resource+0x134/0x5b0 [ttm] Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? drm_mm_insert_node_in_range+0x593/0x610 Aug 28 09:16:56 xxx kernel: ttm_bo_validate+0x9a/0x190 [ttm] Aug 28 09:16:56 xxx kernel: ttm_bo_init_reserved+0x170/0x1f0 [ttm] Aug 28 09:16:56 xxx kernel: amdgpu_bo_create+0x1e4/0x4f0 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_bo_create_user+0x3d/0x70 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_gem_create_ioctl+0x17f/0x3f0 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_bo_user_destroy+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: drm_ioctl_kernel+0xb5/0x110 Aug 28 09:16:56 xxx kernel: drm_ioctl+0x309/0x5f0 Aug 28 09:16:56 xxx kernel: ? __pfx_amdgpu_gem_create_ioctl+0x10/0x10 [amdgpu] Aug 28 09:16:56 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu] Aug 28 09:16:56 xxx kernel: __x64_sys_ioctl+0xa3/0x100 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: x64_sys_call+0x103b/0x2390 Aug 28 09:16:56 xxx kernel: do_syscall_64+0x105/0x5a0 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: ? do_syscall_64+0x140/0x5a0 Aug 28 09:16:56 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5 Aug 28 09:16:56 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Aug 28 09:16:56 xxx kernel: RIP: 0033:0x7022fc932c3d Aug 28 09:16:56 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00 Aug 28 09:16:56 xxx kernel: RSP: 002b:00007ffd955fd610 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 Aug 28 09:16:56 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffd955fd770 RCX: 00007022fc932c3d Aug 28 09:16:56 xxx kernel: RDX: 00007ffd955fd6c0 RSI: 00000000c0206440 RDI: 0000000000000013 Aug 28 09:16:56 xxx kernel: RBP: 00007ffd955fd660 R08: 0000000000000019 R09: 00005e86c17462f0 Aug 28 09:16:56 xxx kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd955fd6c0 Aug 28 09:16:56 xxx kernel: R13: 00000000c0206440 R14: 0000000000000013 R15: 00005e86c19dcdf0 Aug 28 09:16:56 xxx kernel: </TASK> Aug 28 09:16:56 xxx kernel: watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [KMS thread:11069] Aug 28 09:16:56 xxx kernel: Modules linked in: tcp_diag inet_diag input_leds hid_logitech_hidpp nf_conntrack_netlink xt_nat veth rfcomm snd_seq_dummy snd_hrtimer xfr m_user xfrm_algo xt_set ip_set xt_mark xt_CHECKSUM xt_MASQUERADE nft_chain_nat nf_nat bridge stp llc vxlan ip6_udp_tunnel udp_tunnel overlay qrtr uhid cmac algif_has h algif_skcipher af_alg bnep mei_gsc_proxy mei_lb ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrt ype xt_tcpudp binfmt_misc xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables nfnetlink intel_rapl_msr amd_atl intel_rapl_common cm dlinepart mei_gsc edac_mce_amd mtd_intel_dg mei_me mei mtd snd_hda_codec_alc662 snd_hda_codec_intelhdmi nls_iso8859_1 kvm_amd spd5118 amdgpu snd_hda_codec_realtek_li b snd_hda_codec_atihdmi snd_hda_codec_generic kvm snd_hda_codec_hdmi mt7921e amdxdna mt7921_common irqbypass uvcvideo xe btusb videobuf2_vmalloc ghash_clmulni_intel uvc mt792x_lib videobuf2_memops amd_pmf mt76_connac_lib Aug 28 09:16:56 xxx kernel: btmtk aesni_intel amdtee snd_usb_audio videobuf2_v4l2 btrtl mt76 snd_hda_intel videobuf2_common amd_sfh snd_seq_midi btbcm rapl wmi_bmof snd_usbmidi_lib snd_hda_codec drm_gpusvm_helper amdxcp snd_seq_midi_event btintel snd_ump tee drm_panel_backlight_quirks intel_vsec mac80211 videodev drm_gpuvm snd_ hda_core drm_buddy gpu_sched drm_ttm_helper snd_rawmidi snd_seq snd_intel_dspcfg platform_profile ttm snd_intel_sdw_acpi bluetooth snd_hwdep drm_exec i2c_piix4 snd_s eq_device mc k10temp snd_pcm i2c_smbus ccp drm_suballoc_helper cfg80211 drm_display_helper snd_timer libarc4 cec rc_core snd i2c_algo_bit soundcore joydev gpio_amdpt mac_hid sch_fq_codel lp ppdev parport nct6683 msr ec_sys efi_pstore dmi_sysfs autofs4 hid_logitech_dj hid_generic usbhid hid r8169 ahci video libahci realtek nvme n vme_core nvme_keyring nvme_auth wmi hkdf Aug 28 09:16:56 xxx kernel: CPU: 10 UID: 1000 PID: 11069 Comm: KMS thread Tainted: G D W L 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) Aug 28 09:16:56 xxx kernel: Tainted: [D]=DIE, [W]=WARN, [L]=SOFTLOCKUP Aug 28 09:16:56 xxx kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025 Aug 28 09:16:56 xxx kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x7d/0x370 Aug 28 09:16:56 xxx kernel: Code: 0f ba 29 08 0f 92 c2 8b 01 0f b6 d2 c1 e2 08 30 e4 09 d0 3d ff 00 00 00 77 63 85 c0 74 10 0f b6 01 84 c0 74 09 f3 90 0f b6 01 <84> c0 75 f7 b8 01 00 00 00 66 89 01 31 c0 31 d2 31 c9 31 f6 31 ff Aug 28 09:16:56 xxx kernel: RSP: 0018:ffffd20d8d787928 EFLAGS: 00000202 Aug 28 09:16:56 xxx kernel: RAX: 0000000000000001 RBX: ffff8db0f2281848 RCX: ffff8dab8858f6b0 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Fri Aug 28 09:44:12 2026 HibernationDevice: InstallationDate: Installed on 2024-10-10 (687 days ago) InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424) IwDevWlp16s0Link: Not connected. MachineType: Micro-Star International Co., Ltd. MS-7D77 ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=4a267b94-06d1-4253-aa1d-1033c43e152c ro quiet splash pcie_aspm=off intel_iommu=on resume=/dev/nvme0n1p1 resume_offset=216956928 SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-04-27 (124 days ago) dmi.bios.date: 08/05/2025 dmi.bios.release: 5.35 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: 1.R3 dmi.board.asset.tag: To be filled by O.E.M. dmi.board.name: PRO B650M-A WIFI (MS-7D77) dmi.board.vendor: Micro-Star International Co., Ltd. dmi.board.version: 1.0 dmi.chassis.asset.tag: To be filled by O.E.M. dmi.chassis.type: 3 dmi.chassis.vendor: Micro-Star International Co., Ltd. dmi.chassis.version: 1.0 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvr1.R3:bd08/05/2025:br5.35:svnMicro-StarInternationalCo.,Ltd.:pnMS-7D77:pvr1.0:rvnMicro-StarInternationalCo.,Ltd.:rnPROB650M-AWIFI(MS-7D77):rvr1.0:cvnMicro-StarInternationalCo.,Ltd.:ct3:cvr1.0:skuTobefilledbyO.E.M.:pfaTobefilledbyO.E.M.: dmi.product.family: To be filled by O.E.M. dmi.product.name: MS-7D77 dmi.product.sku: To be filled by O.E.M. dmi.product.version: 1.0 dmi.sys.vendor: Micro-Star International Co., Ltd. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+subscriptions