Public bug reported:
Kernel 7.0.0-28-generic (#28~24.04.1-Ubuntu, HWE) reliably hits a kernel
BUG in the iomap buffered-write path when writing to an NTFS filesystem
mounted with the in-kernel ntfs3 driver under parallel build load:
Plaintext
kernel BUG at fs/iomap/buffered-io.c:1061!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
RIP: 0010:iomap_write_end+0x1ea/0x1f0
Call Trace:
iomap_write_iter+0x17a/0x340
iomap_file_buffered_write+0xa5/0x110
ntfs_file_write_iter+0x263/0x300 [ntfs3]
vfs_write+0x29e/0x480
ksys_write+0x71/0xf0
This is a regression: the identical workload on the previous kernel
(6.17.0-35.35~24.04.1) completes with no errors. Reproduced 3 out of 3 attempts
on 7.0.0-28, crashing 1–4 minutes into the build. The faulting process differs
each time (twice a GCC cc1 process, once ninja) — whichever process happens to
be writing when it triggers.
Impact
The faulting process dies inside the kernel while holding filesystem locks. Any
later operation touching those locks (observed: unlink) blocks forever in
uninterruptible sleep — /proc/<pid>/wchan shows vfs_unlink — and cannot be
killed. Only a reboot recovers. High risk of NTFS metadata inconsistency since
the crash happens mid-write.
Reproduction
NTFS partition on NVMe, mounted with the kernel ntfs3 driver:
/dev/nvme1n1p5 ntfs3
rw,nosuid,nodev,relatime,uid=1000,gid=1000,acl,iocharset=utf8,prealloc
Run a parallel C build writing object files to that mount. In my case:
an ESP-IDF v5.4.1 firmware build (~1040 compile/link jobs) inside a
Docker container (espressif/idf:v5.4.1) with the NTFS directory bind-
mounted as the build workspace. Ninja parallelism = default (number of
CPUs; this machine has 20 threads).
Within 1–4 minutes, dmesg shows the BUG above and the build hangs.
Result: crash on 7.0.0-28-generic, 3/3 attempts (across two boots).
Same workload on 6.17.0-35.35~24.04.1: completes cleanly, 0 crashes.
Notes
Taint Flags: The kernel is tainted W/O by the out-of-tree NVIDIA driver
(triggered by an unrelated "Unpatched return thunk" warning from
nvidia_init_module at boot). The NVIDIA module does not appear anywhere
in the call trace; the crash occurs entirely in core fs/iomap code
entered via ntfs3 and is deterministic under this specific workload.
OS: Ubuntu 24.04.4 LTS
CPU: Intel Core i7-12800H (20 threads)
GPU: NVIDIA RTX A2000 (8GB VRAM) using proprietary drivers
RAM: 32 GB
Storage Setup:
System Boot Drive: PC801 NVMe SK hynix 1TB
Target NTFS Workspace Drive: Crucial CT1000P1SSD8 1TB NVMe
Logs: Full oops with registers and complete module list is attached
(dmesg-oops.txt); a second full instance from the prior boot (victim:
cc1, same RIP iomap_write_end+0x1ea) is available upon request.
Workaround
Booting the previous 6.17.0-35.35 kernel from GRUB avoids the issue entirely.
Full kernel crash log
Plaintext
[ 57.689975] ------------[ cut here ]------------
[ 57.689978] kernel BUG at fs/iomap/buffered-io.c:1061!
[ 57.689984] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 57.689987] CPU: 8 UID: 1000 PID: 6212 Comm: ninja Tainted: G W O
7.0.0-28-generic #28~24.04.1-Ubuntu PREEMPT(lazy)
[ 57.689992] Tainted: [W]=WARN, [O]=OOT_MODULE
[ 57.689993] Hardware name: Dell Inc. Precision 5570/04NDTC, BIOS 1.40.0
03/31/2026
[ 57.689994] RIP: 0010:iomap_write_end+0x1ea/0x1f0
[ 57.689999] Code: 00 e8 ea 34 f9 ff e9 30 ff ff ff 48 8b 13 83 e2 08 74 10
e9 88 fe ff ff eb 8d 0f 0b e9 5b ff ff ff 0f 0b 31 c0 e9 16 ff ff ff <0f> 0b 0f
1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
[ 57.690000] RSP: 0018:ffffd22b879abb28 EFLAGS: 00010297
[ 57.690002] RAX: 000000000000006b RBX: fffff43d89c3afc0 RCX: 0000000000000fc0
[ 57.690003] RDX: 0000000000000040 RSI: 0000000000000036 RDI: ffff8a1c48434fc0
[ 57.690004] RBP: ffffd22b879abb58 R08: 0000000000000000 R09: 0000000000000000
[ 57.690004] R10: 0000000000000000 R11: 0000000000000000 R12: ffffd22b879abc00
[ 57.690005] R13: 0000000000000036 R14: 0000000000000036 R15: 0000000000000036
[ 57.690006] FS: 000070c5ee9ba740(0000) GS:ffff8a23f13e3000(0000)
knlGS:0000000000000000
[ 57.690007] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 57.690008] CR2: 000058cd69e71e38 CR3: 000000018ff13003 CR4: 0000000000f72ef0
[ 57.690009] PKRU: 55555554
[ 57.690010] Call Trace:
[ 57.690016] <TASK>
[ 57.690017] iomap_write_iter+0x17a/0x340
[ 57.690022] iomap_file_buffered_write+0xa5/0x110
[ 57.690024] ntfs_file_write_iter+0x263/0x300 [ntfs3]
[ 57.690033] vfs_write+0x29e/0x480
[ 57.690036] ksys_write+0x71/0xf0
[ 57.690038] __x64_sys_write+0x19/0x30
[ 57.690039] x64_sys_call+0x259/0x26e0
[ 57.690042] do_syscall_64+0xd9/0x5b0
[ 57.690045] ? __check_object_size+0x51/0x160
[ 57.690047] ? __x64_sys_rt_sigpending+0xa5/0xe0
[ 57.690049] ? arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0
[ 57.690051] ? do_syscall_64+0x116/0x5b0
[ 57.690053] ? exc_page_fault+0x92/0x1c0
[ 57.690055] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 57.690056] </TASK>
[ 57.690056] RIP: 0033:0x70c5eebf2574
[ 57.690058] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00
00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
[ 57.690059] RSP: 002b:00007ffccc9b2bd8 EFLAGS: 00000202 ORIG_RAX:
0000000000000001
[ 57.690060] RAX: ffffffffffffffda RBX: 0000000000000036 RCX: 000070c5eebf2574
[ 57.690061] RDX: 0000000000000036 RSI: 000058cd69e6c6b0 RDI: 0000000000000004
[ 57.690061] RBP: 00007ffccc9b2c00 R08: 0000000000000078 R09: 0000000000000000
[ 57.690062] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000036
[ 57.690063] R13: 000058cd69e6c6b0 R14: 000058cd69e652b0 R15: 000070c5eecd7ee0
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-7.0.0-28-generic 7.0.0-28.28~24.04.1
ProcVersionSignature: Ubuntu 7.0.0-28.28~24.04.1-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.28.2-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: bryantj 4072 F.... wireplumber
/dev/snd/seq: bryantj 4067 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sat Jul 18 20:24:15 2026
InstallationDate: Installed on 2026-04-11 (99 days ago)
InstallationMedia: Ubuntu 24.04.3 LTS "Noble Numbat" - Release amd64
(20250805.1)
MachineType: Dell Inc. Precision 5570
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-28-generic
root=UUID=3100f4c7-884e-4cee-91c5-56773967c242 ro quiet splash vt.handoff=7
RelatedPackageVersions:
linux-restricted-modules-7.0.0-28-generic N/A
linux-backports-modules-7.0.0-28-generic N/A
linux-firmware 20240318.git3b128b60-0ubuntu2.27
SourcePackage: linux-hwe-7.0
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 03/31/2026
dmi.bios.release: 1.40
dmi.bios.vendor: Dell Inc.
dmi.bios.version: 1.40.0
dmi.board.name: 04NDTC
dmi.board.vendor: Dell Inc.
dmi.board.version: A00
dmi.chassis.asset.tag: X4865
dmi.chassis.type: 10
dmi.chassis.vendor: Dell Inc.
dmi.ec.firmware.release: 1.19
dmi.modalias:
dmi:bvnDellInc.:bvr1.40.0:bd03/31/2026:br1.40:efr1.19:svnDellInc.:pnPrecision5570:pvr:rvnDellInc.:rn04NDTC:rvrA00:cvnDellInc.:ct10:cvr:sku0B1A:pfaPrecision:
dmi.product.family: Precision
dmi.product.name: Precision 5570
dmi.product.sku: 0B1A
dmi.sys.vendor: Dell Inc.
** Affects: linux-hwe-7.0 (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161222
Title:
Kernel BUG at fs/iomap/buffered-io.c:1061 (iomap_write_end) via
ntfs_file_write_iter on 7.0.0-28-generic — regression, reproducible
under parallel build load on ntfs3
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-7.0/+bug/2161222/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
