[Bug 2168537] Re: Please backport "drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx" (52f650963d88) to resolute 7.0 - NULL deref in kcompactd kills the system

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2168537 Title: Please backport "drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx" (52f650963d88) to resolute 7.0 - NULL deref in kcompactd kills the system Status in linux package in Ubuntu: New Bug description: [Impact] On Ubuntu 26.04 (linux 7.0.0-31 and 7.0.0-34, based on 7.0.14), with an AMD GPU using amdgpu userptr BOs, kcompactd page migration calls amdgpu_hmm_invalidate_gfx() while a userptr BO is still being allocated or freed. At that point bo->vm_bo is NULL, and the kernel dereferences it: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 74 Comm: kcompactd0 Not tainted 7.0.0-31-generic #31-Ubuntu Hardware name: ASUS All Series/B85M-E, BIOS 0806 02/20/2014 RIP: 0010:amdgpu_hmm_invalidate_gfx+0x42/0xe0 [amdgpu] Call Trace: __mmu_notifier_invalidate_range_start+0x149/0x1b0 try_to_migrate_one+0xeea/0x1010 rmap_walk_anon+0xdb/0x220 try_to_migrate+0x84/0xe0 migrate_folio_unmap+0x276/0x320 migrate_pages_batch+0x17d/0x940 migrate_pages+0x3b2/0x520 compact_zone+0x513/0x790 kcompactd_do_work+0x109/0x270 note: kcompactd0[74] exited with irqs disabled kcompactd dies holding mm locks. After that, any task touching the affected pages hangs in D state for good: containers can't be stopped or killed, and even a normal reboot oopses again in amdgpu_pci_shutdown -> amdgpu_uvd_prepare_suspend (direct compaction hits the same page). Only a sysrq-b or power cycle recovers the machine. We have hit this 3 times in 2 weeks (2026-09-12, 09-19, 09-25) on a Radeon RX 550 (Polaris 12). The trigger is Jellyfin burning ASS subtitles in with an ffmpeg Vulkan filter chain: subtitles -> hwupload=derive_device=vulkan -> overlay_vulkan The oops fires about 2 seconds after an ffmpeg transcode starts. [Fix] Upstream commit 52f650963d8825e97a0ccdd2b616f8a01d9d3d38 "drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx" (cherry-picked from 631849ff5d603841e74f19f4a5e30fe1f7d7cf30) Fixes: 91250893cbaa ("drm/amdgpu: fix waiting for all submissions for userptrs") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5399 Cc: stable, queued for 7.1.y and 6.18.y The commit applies cleanly to the resolute 7.0.0-34.34 source (one hunk at offset -4). The regressing commit 91250893cbaa is in the resolute kernel. The fix did not reach 7.0.y stable because that branch is EOL upstream. Note: CVE-2026-68101 was assigned to this fix and later rejected, so the Ubuntu CVE tracker shows resolute as "not affected". It is affected. This is a stability bug, not a security bug, and it is reproducible. [Test Plan] On an amdgpu system, run a workload that creates and destroys userptr BOs repeatedly (for example, ffmpeg Vulkan hwupload in a loop) while forcing compaction with `echo 1 > /proc/sys/vm/compact_memory`. Unpatched kernels oops in amdgpu_hmm_invalidate_gfx; patched kernels don't. [Where problems could occur] The change is limited to amdgpu userptr BOs. The BO now holds a reference to the VM root PD as bo->parent, and amdgpu_bo_destroy() already drops that reference (amdgpu_bo_unref(&bo->parent)). A mistake would show up as a leaked root PD on userptr BO free, or as a wait on the wrong reservation object during invalidation. --- ProblemType: Bug AlsaVersion: Advanced Linux Sound Architecture Driver Version k7.0.0-34-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D2c', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/controlC1', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D10p', '/dev/snd/pcmC1D9p', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CRDA: N/A Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: pass CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-08-30 (26 days ago) InstallationMedia: Ubuntu-Server 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: ASUS All Series Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 amdgpudrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-34-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' Tags: resolute Uname: Linux 7.0.0-34-generic x86_64 UnreportableReason: This report is about a package that is not installed. UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip docker lxd plugdev render sudo users video _MarkForUpload: False acpidump: dmi.bios.date: 02/20/2014 dmi.bios.release: 4.6 dmi.bios.vendor: American Megatrends Inc. dmi.bios.version: 0806 dmi.board.asset.tag: To be filled by O.E.M. dmi.board.name: B85M-E dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: Rev X.0x dmi.chassis.asset.tag: Asset-1234567890 dmi.chassis.type: 3 dmi.chassis.vendor: Chassis Manufacture dmi.chassis.version: Chassis Version dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr0806:bd02/20/2014:br4.6:svnASUS:pnAllSeries:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnB85M-E:rvrRevX.0x:cvnChassisManufacture:ct3:cvrChassisVersion:skuAll:pfaASUSMB: dmi.product.family: ASUS MB dmi.product.name: All Series dmi.product.sku: All dmi.product.version: System Version dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168537/+subscriptions