[Bug 2169338] Re: Kernel oops / GPF in path_is_under() from complete_walk() on openat — 7.0.0-34/-38-generic and 7.0.0-1017-azure, Hyper-V Gen2 guest

Thanks a lot for your updates. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169338 Title: Kernel oops / GPF in path_is_under() from complete_walk() on openat — 7.0.0-34/-38-generic and 7.0.0-1017-azure, Hyper-V Gen2 guest Status in linux package in Ubuntu: New Status in linux-azure package in Ubuntu: New Bug description: An Ubuntu 26.04.1 LTS VM on Hyper-V repeatedly oopses in path_is_under(), called from complete_walk() during openat(). The faulting address is a different garbage value each time: either fffffffffffffff0 or a non-canonical pointer. That suggests a corrupted or freed struct mount being walked through mnt_parent. With panic_on_oops=0 the task dies holding a lock, every later bubblewrap (bwrap) process soft-locks in create_user_ns -> alloc_ucounts / current_chrooted -> _raw_spin_lock, and the system wedges. With panic_on_oops=1 it panics and reboots. Reproduced on three kernel builds within ~28 hours: - 7.0.0-34-generic: 3 oopses (Comm: MainThread x2, depmod) - 7.0.0-38-generic: 1 oops (Comm: MainThread) - 7.0.0-1017-azure (7.0.14 base): 1 oops (Comm: git) == Environment == - Ubuntu 26.04.1 LTS (resolute), cloud image (ubuntu-26.04-server-cloudimg-amd64.img) - Hyper-V Gen 2 VM on Windows 11 Pro 26200, Secure Boot (MS UEFI CA), 8 vCPU, 8 GB static RAM (Dynamic Memory was enabled for the first incident; disabled since), 8 GB swapfile, ext4 root - Host CPU: Intel Core i9-14900K - kernel.apparmor_restrict_unprivileged_userns=1 (default) == Trace (7.0.0-1017-azure, representative) == Oops: general protection fault, probably for non-canonical address 0xaa72f400ffffffef: 0000 [#1] SMP NOPTI CPU: 0 UID: 1000 PID: 45217 Comm: git Not tainted 7.0.0-1017-azure #17-Ubuntu PREEMPTLAZY Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/25/2025 RIP: 0010:path_is_under+0x60/0xa0 Call Trace: complete_walk+0x9c/0xc0 do_open+0x1b3/0x400 path_openat+0x113/0x290 do_file_open+0xdf/0x1a0 do_sys_openat2+0x7a/0xe0 __x64_sys_openat+0x5f/0xa0 do_syscall_64+0x105/0x5a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Kernel panic - not syncing: Fatal exception On -generic the first oops was "BUG: unable to handle page fault for address: fffffffffffffff0" at path_is_under+0x50/0x90 with the same call chain. == Workload / when it happens == - The VM ran cleanly for ~24h, then oopsed repeatedly once it was used as a development box: Claude Code (Node/Bun), git, pnpm, Chrome under XFCE/xrdp, and Tailscale. - Faulting tasks are ordinary file opens by unprivileged processes (MainThread = Claude Code's main thread, git) and root (depmod during a kernel package postinst). - Intervals between oopses ranged from ~1 minute to ~2 hours of uptime. == Ruled out == - Filesystem: a forced e2fsck of root was clean apart from an "extent tree could be narrower" optimisation note. - Memory pressure: it reproduces with static RAM and >5 GB free; no OOM events. - Host problems: no host errors, and a WSL2 guest on the same host is unaffected. == Possibly related == The first incident followed Hyper-V Dynamic Memory hot-add failures 6 minutes earlier: "40-vm-hotadd.rules: Failed to write 'online'" and "workqueue: hot_add_req [hv_balloon] hogged CPU". Dynamic Memory has been off since, and the oopses continue. == Attachments == - oops-all-6-crashes.txt: full oops texts from systemd-pstore (efi_pstore) for every incident - hyperv-guest-crash-events.txt: Hyper-V Worker event 18590, which includes the guest's final kmsg - system-info.txt: version_signature, uname, installed kernels, cmdline, CPU/memory, userns settings --- ProblemType: Bug AlsaDevices: total 0 crw-rw---- 1 root audio 116, 1 Oct 6 21:56 seq crw-rw---- 1 root audio 116, 33 Oct 6 21:56 timer AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CRDA: N/A CasperMD5CheckResult: unknown CloudArchitecture: x86_64 CloudBuildName: server CloudID: nocloud CloudName: unknown CloudPlatform: nocloud CloudSerial: 20260927 CloudSubPlatform: config-disk (/dev/sdb1) DistroRelease: Ubuntu 26.04 Lspci: Lspci-vt: Lsusb: Error: command ['lsusb'] failed with exit code 1: Lsusb-t: Lsusb-v: Error: command ['lsusb', '-v'] failed with exit code 1: MachineType: Microsoft Corporation Virtual Machine Package: linux-azure (not installed) PciMultimedia: ProcEnviron: LANG=C.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=unknown ProcFB: 0 hyperv_drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=UUID=747687d9-c20c-41f8-bfb8-7f4a57910c51 ro console=tty1 console=ttyS0 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' Tags: cloud-image resolute Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: N/A _MarkForUpload: True dmi.bios.date: 09/25/2025 dmi.bios.release: 4.1 dmi.bios.vendor: Microsoft Corporation dmi.bios.version: Hyper-V UEFI Release v4.1 dmi.board.asset.tag: None dmi.board.name: Virtual Machine dmi.board.vendor: Microsoft Corporation dmi.board.version: Hyper-V UEFI Release v4.1 dmi.chassis.asset.tag: 3897-2538-6803-7408-7643-1671-78 dmi.chassis.type: 3 dmi.chassis.vendor: Microsoft Corporation dmi.chassis.version: Hyper-V UEFI Release v4.1 dmi.modalias: dmi:bvnMicrosoftCorporation:bvrHyper-VUEFIReleasev4.1:bd09/25/2025:br4.1:svnMicrosoftCorporation:pnVirtualMachine:pvrHyper-VUEFIReleasev4.1:rvnMicrosoftCorporation:rnVirtualMachine:rvrHyper-VUEFIReleasev4.1:cvnMicrosoftCorporation:ct3:cvrHyper-VUEFIReleasev4.1:skuNone:pfaVirtualMachine: dmi.product.family: Virtual Machine dmi.product.name: Virtual Machine dmi.product.sku: None dmi.product.version: Hyper-V UEFI Release v4.1 dmi.sys.vendor: Microsoft Corporation To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169338/+subscriptions