Second occurrence, 2026-08-31. Two things in the original description need
correcting: this is not a one-off, and it is not specific to the Ubuntu kernel.
Please add the kernel-bug-exists-upstream tag.
REPRODUCED ON MAINLINE
linux-image-unsigned-7.2.0-070200-generic 7.2.0-070200.202608162350
Linux version 7.2.0-070200-generic (kernel@balboa) ... #202608162350
SMP PREEMPT_DYNAMIC Wed Aug 19 18:42:46 UTC 2026
That is a mainline-builds PPA kernel with no Ubuntu patches applied. Same
board, same iGPU, same boot cmdline as the original report. The defect is in
mainline drm/amdgpu + ttm, not in the Ubuntu delta.
FREQUENCY
Twice in four days, so "Occurred once ... rare and timing-dependent" in the
original description no longer holds:
2026-08-28 09:16:29 kernel 7.0.0-30-generic (original report)
2026-08-31 12:55:21 kernel 7.2.0-070200-generic (this one)
Both were captured by pstore.
THE WHOLE SEQUENCE COLLAPSED INTO 48 ms IN ONE PROCESS
This is the useful part. In the original report the corruption and the fatal
dereference were ten minutes and two processes apart, which made the causal
link circumstantial. This time all three events are the same task,
file-roller PID 316904, inside a single command-submission sequence:
12:55:21.088996 slab kmalloc-part-05-96 start ffff8997c7109840
pointer offset 64 size 96
12:55:21.093258 list_add corruption. prev->next should be next
(ffff8997e240ee30), but was 0000000000000000.
(prev=ffff8997c7109880).
WARNING: lib/list_debug.c:32 at
__list_add_valid_or_report+0x87/0xc0, CPU#5:
file-roller/316904
ttm_resource_move_to_lru_tail.cold+0x8/0x76 [ttm]
ttm_bo_populate+0x85/0xb0 [ttm]
ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm]
ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm]
ttm_bo_validate+0xc0/0x190 [ttm]
amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu]
amdgpu_cs_parser_bos.isra.0+0x4ff/0x700 [amdgpu]
amdgpu_cs_ioctl+0x14c/0x360 [amdgpu]
12:55:21.114567 list_del corruption. prev->next should be
ffff8997d152d340, but was ffff8997cda6bdc0.
(prev=ffff8997d1532820)
WARNING: lib/list_debug.c:62 at
__list_del_entry_valid_or_report+0xe4/0x10b, CPU#8:
file-roller/316904
ttm_resource_fini.cold+0xc/0x15 [ttm]
ttm_sys_man_free+0x12/0x30 [ttm]
ttm_resource_free+0xae/0x140 [ttm]
ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm]
ttm_bo_validate+0xc0/0x190 [ttm]
12:55:21.136759 BUG: kernel NULL pointer dereference, address:
0000000000000008
#PF: supervisor write access in kernel mode
Oops: Oops: 0002 [#1] SMP NOPTI
RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360 [ttm]
amdgpu_vm_move_to_lru_tail+0x2b/0x40 [amdgpu]
amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu]
amdgpu_cs_ioctl+0x21b/0x360 [amdgpu]
note: file-roller[316904] exited with irqs disabled
note: file-roller[316904] exited with preempt_count 1
THE OOPS DEREFERENCES EXACTLY THE ADDRESSES NAMED IN THE WARNING
The register state at the oops matches the pointers reported 43 ms earlier,
so this is demonstrably the same list node rather than an inference:
RAX: ffff8997e240ee30 == the "should be next" value from the list_add report
R09: ffff8997c7109880 == the "prev=" value from the list_add report
RDX: ffff8997c7109840 == the slab object start from the slab line
RSI: 0000000000000000 == the bad prev->next that was reported as NULL
CR2: 0000000000000008
The faulting instruction is 48 89 7e 08, a write to RSI+8, with RSI zero.
Note ffff8997c7109880 = ffff8997c7109840 + 64, i.e. the damaged list_head sits
at offset 64 of a 96-byte kmalloc object, matching "pointer offset 64 size 96"
in the slab line. So the corrupted node and the node the oops walks into are
one and the same allocation. I have not tried to identify which struct that is
and would rather not guess.
For comparison, the 7.0.0-30 oops was at the same RIP offset +0x1a5 with the
same opcode, but RSI was 0x4000 rather than 0. Near-NULL there, plain NULL here.
DAMAGED FROM THE INSERTION SIDE THIS TIME
The original stage 1 was ttm_lru_bulk_move_del via amdgpu_vm_pt_free, i.e.
page-table teardown. Here it is ttm_resource_move_to_lru_tail from
ttm_bo_populate inside a bounce-buffer move during CS buffer validation, i.e.
the insertion side. The same sublist is damaged from either direction, which
suggests the problem is the sublist's own consistency rather than one
particular caller's teardown ordering.
WHY THE WARNING IS NOT SURVIVABLE
The original description says the kernel "warns but continues". The mechanism
is worth stating explicitly, because it is why stage 1 leads deterministically
to stage 2. This kernel has:
CONFIG_LIST_HARDENED=y
# CONFIG_DEBUG_LIST is not set
so these reports come from list hardening, not from DEBUG_LIST. Under
LIST_HARDENED, __list_add_valid_or_report() returning false causes
__list_add() to bail out without performing the insertion. The warning is
therefore not advisory: the list operation is silently dropped, leaving the
bulk-move sublist half-updated with a NULL link, which the next
ttm_lru_bulk_move_tail() walk then writes through. Because that write happens
under spin_lock, a would-be per-process oops becomes a machine-wide deadlock.
(kmalloc-part-05-96 and kmalloc-rnd-01-192 in the slab lines are
CONFIG_SLAB_BUCKETS=y bucket names, not different structures.)
CASCADE AND RECOVERY
As before, the leaked LRU spinlock took down every subsequent GPU consumer.
Soft lockups began 27 s after the oops and climbed from 26 s to 551 s across
chrome:cs0, gnome-shell, KMS thread, nvtop, claude-desktop and the ttm
delayed-delete workqueue (kworker/u49:12, in ttm_bo_delayed_delete ->
ttm_resource_free). Last log entry 13:05:12, hard reset required.
Third distinct triggering application now: chrome, lact, file-roller. As the
original description argued, the application is incidental.
STILL NOT HARDWARE
Re-verified for this occurrence: no machine-check exceptions, no EDAC errors,
no NVMe errors, no OOM anywhere in the boot. The recurring
"amdgpu ... REG_WAIT timeout ... optc314_disable_crtc" message appears on every
boot including clean ones and is unrelated.
OFFER
Since this now reproduces every couple of days, I am willing to run a debug
kernel to catch the corrupting write where it happens rather than at the point
of death. Ubuntu ships no KASAN kernel, but CONFIG_SLUB_DEBUG=y is set, so I
can boot with slub_debug=FZP for redzoning and poisoning on the TTM resource
objects. If a KASAN build would be more useful, tell me which config you want
and I will build and run it.
Aug 31 12:55:21.088996 xxx kernel: slab kmalloc-part-05-96 start
ffff8997c7109840 pointer offset 64 size 96
Aug 31 12:55:21.093226 xxx kernel: ------------[ cut here ]------------
Aug 31 12:55:21.093258 xxx kernel: list_add corruption. prev->next should be
next (ffff8997e240ee30), but was 0000000000000000. (prev=ffff8997c7109880).
Aug 31 12:55:21.093521 xxx kernel: WARNING: lib/list_debug.c:32 at
__list_add_valid_or_report+0x87/0xc0, CPU#5: file-roller/316904
Aug 31 12:55:21.093609 xxx kernel: CPU: 5 UID: 1000 PID: 316904 Comm:
file-roller Not tainted 7.2.0-070200-generic #202608162350 PREEMPT(lazy)
Aug 31 12:55:21.093625 xxx kernel: Hardware name: Micro-Star International Co.,
Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025
Aug 31 12:55:21.093644 xxx kernel: RIP:
0010:__list_add_valid_or_report+0x90/0xc0
Aug 31 12:55:21.093659 xxx kernel: Code: d4 48 89 f8 48 39 fe 74 28 48 39 fa 74
23 b0 01 eb 36 48 89 f7 e8 30 88 57 00 48 8d 3d 79 37 c7 02 48 8b 13 48 89 d9
4c 89 e
6 <67> 48 0f b9 3a eb a4 48 8d 3d 72 37 c7 02 4c 89 e1 48 89 da 48 89
Aug 31 12:55:21.093847 xxx kernel: RSP: 0018:ffffd122e70af528 EFLAGS: 00010246
Aug 31 12:55:21.093867 xxx kernel: RAX: 0000000000000000 RBX: ffff8997c7109880
RCX: ffff8997c7109880
Aug 31 12:55:21.093884 xxx kernel: RDX: 0000000000000000 RSI: ffff8997e240ee30
RDI: ffffffff9f0f5ff0
Aug 31 12:55:21.094059 xxx kernel: RBP: ffffd122e70af538 R08: 0000000000000000
R09: 0000000000000000
Aug 31 12:55:21.094318 xxx kernel: R10: 0000000000000000 R11: 0000000000000000
R12: ffff8997e240ee30
Aug 31 12:55:21.094331 xxx kernel: R13: ffff899f08b95a00 R14: 0000000000000001
R15: ffff899f84d5dc60
Aug 31 12:55:21.094369 xxx kernel: FS: 000073b61dd4d440(0000)
GS:ffff89a6a0c61000(0000) knlGS:0000000000000000
Aug 31 12:55:21.094385 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
Aug 31 12:55:21.094413 xxx kernel: CR2: 000073b618020000 CR3: 00000004f8e17000
CR4: 0000000000f50ef0
Aug 31 12:55:21.094428 xxx kernel: PKRU: 55555554
Aug 31 12:55:21.094439 xxx kernel: Call Trace:
Aug 31 12:55:21.094618 xxx kernel: <TASK>
Aug 31 12:55:21.094631 xxx kernel: ttm_resource_move_to_lru_tail.cold+0x8/0x76
[ttm]
Aug 31 12:55:21.094642 xxx kernel: ? ttm_tt_populate+0x124/0x150 [ttm]
Aug 31 12:55:21.094885 xxx kernel: ttm_bo_populate+0x85/0xb0 [ttm]
Aug 31 12:55:21.094902 xxx kernel: ttm_bo_handle_move_mem+0x1a5/0x1e0 [ttm]
Aug 31 12:55:21.094914 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm]
Aug 31 12:55:21.094925 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm]
Aug 31 12:55:21.094941 xxx kernel: ? xas_load+0x11/0x100
Aug 31 12:55:21.094954 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu]
Aug 31 12:55:21.094969 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu]
Aug 31 12:55:21.094988 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700
[amdgpu]
Aug 31 12:55:21.095002 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.095113 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu]
Aug 31 12:55:21.095220 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu]
Aug 31 12:55:21.104161 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.104184 xxx kernel: drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.104333 xxx kernel: drm_ioctl+0x310/0x600
Aug 31 12:55:21.104364 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.104385 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu]
Aug 31 12:55:21.104403 xxx kernel: __x64_sys_ioctl+0xa3/0x100
Aug 31 12:55:21.104418 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.104621 xxx kernel: x64_sys_call+0x103b/0x2390
Aug 31 12:55:21.104651 xxx kernel: do_syscall_64+0xde/0x580
Aug 31 12:55:21.104662 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100
Aug 31 12:55:21.104685 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.104696 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.105063 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.105091 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.105390 xxx kernel: ? __check_object_size+0x51/0xf0
Aug 31 12:55:21.105414 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.105427 xxx kernel: ? drm_ioctl+0x34f/0x600
Aug 31 12:55:21.105441 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.105558 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.105571 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu]
Aug 31 12:55:21.113154 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113168 xxx kernel: ? __audit_syscall_exit+0x36/0x120
Aug 31 12:55:21.113353 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113371 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0
Aug 31 12:55:21.113388 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113399 xxx kernel: ? do_syscall_64+0x11b/0x580
Aug 31 12:55:21.113411 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113425 xxx kernel: ? __handle_mm_fault+0x493/0x720
Aug 31 12:55:21.113447 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113457 xxx kernel: ? count_memcg_events+0xea/0x240
Aug 31 12:55:21.113636 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113731 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0
Aug 31 12:55:21.113744 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113756 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0
Aug 31 12:55:21.113769 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113781 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113790 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0
Aug 31 12:55:21.113893 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.113902 xxx kernel: ? do_syscall_64+0x95/0x580
Aug 31 12:55:21.113918 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
Aug 31 12:55:21.113933 xxx kernel: RIP: 0033:0x73b620d32c3d
Aug 31 12:55:21.113944 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48
8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00
00 0f 0
5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
Aug 31 12:55:21.113957 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
Aug 31 12:55:21.114068 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8
RCX: 000073b620d32c3d
Aug 31 12:55:21.114081 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444
RDI: 0000000000000010
Aug 31 12:55:21.114094 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550
R09: 00007ffe6eb19910
Aug 31 12:55:21.114202 xxx kernel: R10: 0000000000000000 R11: 0000000000000246
R12: 00002200758e9906
Aug 31 12:55:21.114312 xxx kernel: R13: 0000000000000010 R14: 0000000000000006
R15: 00005705db5bae30
Aug 31 12:55:21.114421 xxx kernel: </TASK>
Aug 31 12:55:21.114434 xxx kernel: ---[ end trace 0000000000000000 ]---
Aug 31 12:55:21.114454 xxx kernel: slab kmalloc-part-05-96 start
ffff8997d15327e0 pointer offset 64 size 96
Aug 31 12:55:21.114553 xxx kernel: ------------[ cut here ]------------
Aug 31 12:55:21.114567 xxx kernel: list_del corruption. prev->next should be
ffff8997d152d340, but was ffff8997cda6bdc0. (prev=ffff8997d1532820)
Aug 31 12:55:21.120053 xxx kernel: WARNING: lib/list_debug.c:62 at
__list_del_entry_valid_or_report+0xe4/0x10b, CPU#8: file-roller/316904
Aug 31 12:55:21.120205 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm:
file-roller Tainted: G W 7.2.0-070200-generic #202608162350
PREEMPT(lazy)
Aug 31 12:55:21.120221 xxx kernel: Tainted: [W]=WARN
Aug 31 12:55:21.120234 xxx kernel: Hardware name: Micro-Star International Co.,
Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025
Aug 31 12:55:21.120245 xxx kernel: RIP:
0010:__list_del_entry_valid_or_report+0xee/0x10b
Aug 31 12:55:21.120362 xxx kernel: Code: 08 4c 89 e1 48 89 de 67 48 0f b9 3a e9
7b ff ff ff 4c 89 ef e8 03 87 57 00 48 8d 3d bc 36 c7 02 49 8b 55 00 4c 89 e9
48 89 d
e <67> 48 0f b9 3a e9 58 ff ff ff 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6
Aug 31 12:55:21.120380 xxx kernel: RSP: 0018:ffffd122e70af4a8 EFLAGS: 00010246
Aug 31 12:55:21.120637 xxx kernel: RAX: 0000000000000000 RBX: ffff8997d152d340
RCX: ffff8997d1532820
Aug 31 12:55:21.120812 xxx kernel: RDX: ffff8997cda6bdc0 RSI: ffff8997d152d340
RDI: ffffffff9f0f6060
Aug 31 12:55:21.121006 xxx kernel: RBP: ffffd122e70af4c0 R08: 0000000000000000
R09: 0000000000000000
Aug 31 12:55:21.121021 xxx kernel: R10: 0000000000000000 R11: 0000000000000000
R12: ffff8997cda6bdc0
Aug 31 12:55:21.121127 xxx kernel: R13: ffff8997d1532820 R14: 0000000000000000
R15: ffffd122e70af6d0
Aug 31 12:55:21.121234 xxx kernel: FS: 000073b61dd4d440(0000)
GS:ffff89a6a0de1000(0000) knlGS:0000000000000000
Aug 31 12:55:21.121328 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
Aug 31 12:55:21.127660 xxx kernel: CR2: 000018cc07cb7000 CR3: 00000004f8e17000
CR4: 0000000000f50ef0
Aug 31 12:55:21.127676 xxx kernel: PKRU: 55555554
Aug 31 12:55:21.127690 xxx kernel: Call Trace:
Aug 31 12:55:21.127707 xxx kernel: <TASK>
Aug 31 12:55:21.127718 xxx kernel: ttm_resource_fini.cold+0xc/0x15 [ttm]
Aug 31 12:55:21.127838 xxx kernel: ttm_sys_man_free+0x12/0x30 [ttm]
Aug 31 12:55:21.127850 xxx kernel: ttm_resource_free+0xae/0x140 [ttm]
Aug 31 12:55:21.127865 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.127882 xxx kernel: ? amdgpu_bo_move_notify+0x61/0x150 [amdgpu]
Aug 31 12:55:21.127893 xxx kernel: amdgpu_bo_move+0x1c1/0x3c0 [amdgpu]
Aug 31 12:55:21.127992 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128002 xxx kernel: ttm_bo_handle_move_mem+0xe7/0x1e0 [ttm]
Aug 31 12:55:21.128011 xxx kernel: ttm_bo_bounce_temp_buffer+0xa4/0xd0 [ttm]
Aug 31 12:55:21.128022 xxx kernel: ttm_bo_validate+0xc0/0x190 [ttm]
Aug 31 12:55:21.128035 xxx kernel: ? xas_load+0x11/0x100
Aug 31 12:55:21.128136 xxx kernel: amdgpu_cs_bo_validate+0xa1/0x1a0 [amdgpu]
Aug 31 12:55:21.128145 xxx kernel: ? amdgpu_vm_validate+0x2b1/0x3b0 [amdgpu]
Aug 31 12:55:21.128156 xxx kernel: amdgpu_cs_parser_bos.isra.0+0x4ff/0x700
[amdgpu]
Aug 31 12:55:21.128164 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128174 xxx kernel: ? amdgpu_cs_pass2+0x25d/0x310 [amdgpu]
Aug 31 12:55:21.128183 xxx kernel: amdgpu_cs_ioctl+0x14c/0x360 [amdgpu]
Aug 31 12:55:21.128278 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.128295 xxx kernel: drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.128306 xxx kernel: drm_ioctl+0x310/0x600
Aug 31 12:55:21.128496 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.128507 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu]
Aug 31 12:55:21.128525 xxx kernel: __x64_sys_ioctl+0xa3/0x100
Aug 31 12:55:21.128546 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.128557 xxx kernel: x64_sys_call+0x103b/0x2390
Aug 31 12:55:21.128566 xxx kernel: do_syscall_64+0xde/0x580
Aug 31 12:55:21.128576 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100
Aug 31 12:55:21.128586 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128593 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.128605 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128615 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128622 xxx kernel: ? __check_object_size+0x51/0xf0
Aug 31 12:55:21.128630 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128793 xxx kernel: ? drm_ioctl+0x34f/0x600
Aug 31 12:55:21.128803 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.128813 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128823 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu]
Aug 31 12:55:21.128833 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.128845 xxx kernel: ? __audit_syscall_exit+0x36/0x120
Aug 31 12:55:21.128943 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.135987 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0
Aug 31 12:55:21.136225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136244 xxx kernel: ? do_syscall_64+0x11b/0x580
Aug 31 12:55:21.136254 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136447 xxx kernel: ? __handle_mm_fault+0x493/0x720
Aug 31 12:55:21.136454 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136464 xxx kernel: ? count_memcg_events+0xea/0x240
Aug 31 12:55:21.136475 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136484 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0
Aug 31 12:55:21.136494 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136506 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0
Aug 31 12:55:21.136516 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136526 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136534 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0
Aug 31 12:55:21.136545 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.136551 xxx kernel: ? do_syscall_64+0x95/0x580
Aug 31 12:55:21.136565 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
Aug 31 12:55:21.136575 xxx kernel: RIP: 0033:0x73b620d32c3d
Aug 31 12:55:21.136581 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48
8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00
00 0f 0
5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
Aug 31 12:55:21.136590 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
Aug 31 12:55:21.136603 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8
RCX: 000073b620d32c3d
Aug 31 12:55:21.136695 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444
RDI: 0000000000000010
Aug 31 12:55:21.136705 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550
R09: 00007ffe6eb19910
Aug 31 12:55:21.136716 xxx kernel: R10: 0000000000000000 R11: 0000000000000246
R12: 00002200758e9906
Aug 31 12:55:21.136727 xxx kernel: R13: 0000000000000010 R14: 0000000000000006
R15: 00005705db5bae30
Aug 31 12:55:21.136735 xxx kernel: </TASK>
Aug 31 12:55:21.136745 xxx kernel: ---[ end trace 0000000000000000 ]---
Aug 31 12:55:21.136759 xxx kernel: BUG: kernel NULL pointer dereference,
address: 0000000000000008
Aug 31 12:55:21.136833 xxx kernel: #PF: supervisor write access in kernel mode
Aug 31 12:55:21.157571 xxx kernel: #PF: error_code(0x0002) - not-present page
Aug 31 12:55:21.165073 xxx kernel: PGD 0 P4D 0
Aug 31 12:55:21.174272 xxx kernel: Oops: Oops: 0002 [#1] SMP NOPTI
Aug 31 12:55:21.174310 xxx kernel: CPU: 8 UID: 1000 PID: 316904 Comm:
file-roller Tainted: G W 7.2.0-070200-generic #202608162350
PREEMPT(lazy)
Aug 31 12:55:21.174327 xxx kernel: Tainted: [W]=WARN
Aug 31 12:55:21.174342 xxx kernel: Hardware name: Micro-Star International Co.,
Ltd. MS-7D77/PRO B650M-A WIFI (MS-7D77), BIOS 1.R3 08/05/2025
Aug 31 12:55:21.174361 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360
[ttm]
Aug 31 12:55:21.174381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83
3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49
8b 7f 4
8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42
Aug 31 12:55:21.174399 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296
Aug 31 12:55:21.174411 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000
RCX: 0000000000000078
Aug 31 12:55:21.174522 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000
RDI: ffff8997c8edfc40
Aug 31 12:55:21.174537 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000
R09: ffff8997c7109880
Aug 31 12:55:21.174551 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000
R12: ffff89985a2ed9a8
Aug 31 12:55:21.174562 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001
R15: ffff8997d00786c0
Aug 31 12:55:21.174576 xxx kernel: FS: 000073b61dd4d440(0000)
GS:ffff89a6a0de1000(0000) knlGS:0000000000000000
Aug 31 12:55:21.174588 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
Aug 31 12:55:21.174606 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000
CR4: 0000000000f50ef0
Aug 31 12:55:21.174787 xxx kernel: PKRU: 55555554
Aug 31 12:55:21.174798 xxx kernel: Call Trace:
Aug 31 12:55:21.174814 xxx kernel: <TASK>
Aug 31 12:55:21.174823 xxx kernel: ? queue_work_on+0x96/0xb0
Aug 31 12:55:21.174834 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.174849 xxx kernel: ? drm_sched_wakeup+0x43/0x60 [gpu_sched]
Aug 31 12:55:21.174860 xxx kernel: amdgpu_vm_move_to_lru_tail+0x2b/0x40
[amdgpu]
Aug 31 12:55:21.174874 xxx kernel: amdgpu_cs_submit+0x3b8/0x6b0 [amdgpu]
Aug 31 12:55:21.174883 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.174896 xxx kernel: amdgpu_cs_ioctl+0x21b/0x360 [amdgpu]
Aug 31 12:55:21.174907 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.174921 xxx kernel: drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.174932 xxx kernel: drm_ioctl+0x310/0x600
Aug 31 12:55:21.174942 xxx kernel: ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
Aug 31 12:55:21.174953 xxx kernel: amdgpu_drm_ioctl+0x4c/0x90 [amdgpu]
Aug 31 12:55:21.174961 xxx kernel: __x64_sys_ioctl+0xa3/0x100
Aug 31 12:55:21.174972 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.174982 xxx kernel: x64_sys_call+0x103b/0x2390
Aug 31 12:55:21.175002 xxx kernel: do_syscall_64+0xde/0x580
Aug 31 12:55:21.175097 xxx kernel: ? drm_syncobj_timeline_wait_ioctl+0xe6/0x100
Aug 31 12:55:21.175107 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.175122 xxx kernel: ? drm_ioctl_kernel+0xb5/0x110
Aug 31 12:55:21.175130 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.175140 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.175149 xxx kernel: ? __check_object_size+0x51/0xf0
Aug 31 12:55:21.175255 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181154 xxx kernel: ? drm_ioctl+0x34f/0x600
Aug 31 12:55:21.181186 xxx kernel: ?
__pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10
Aug 31 12:55:21.181199 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181212 xxx kernel: ? amdgpu_drm_ioctl+0x6e/0x90 [amdgpu]
Aug 31 12:55:21.181225 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181235 xxx kernel: ? __audit_syscall_exit+0x36/0x120
Aug 31 12:55:21.181259 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181269 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xc0
Aug 31 12:55:21.181282 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181293 xxx kernel: ? do_syscall_64+0x11b/0x580
Aug 31 12:55:21.181306 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181322 xxx kernel: ? __handle_mm_fault+0x493/0x720
Aug 31 12:55:21.181337 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181356 xxx kernel: ? count_memcg_events+0xea/0x240
Aug 31 12:55:21.181480 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181496 xxx kernel: ? handle_mm_fault+0x1c2/0x2e0
Aug 31 12:55:21.181507 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181516 xxx kernel: ?
arch_exit_to_user_mode_prepare.isra.0+0xd/0xe0
Aug 31 12:55:21.181529 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181634 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181644 xxx kernel: ? __audit_syscall_entry+0xca/0x1b0
Aug 31 12:55:21.181654 xxx kernel: ? srso_alias_return_thunk+0x5/0xfbef5
Aug 31 12:55:21.181665 xxx kernel: ? do_syscall_64+0x95/0x580
Aug 31 12:55:21.181679 xxx kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
Aug 31 12:55:21.181694 xxx kernel: RIP: 0033:0x73b620d32c3d
Aug 31 12:55:21.181707 xxx kernel: Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48
8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00
00 0f 0
5 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
Aug 31 12:55:21.181719 xxx kernel: RSP: 002b:00007ffe6eb198b0 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
Aug 31 12:55:21.181731 xxx kernel: RAX: ffffffffffffffda RBX: 00007ffe6eb19ad8
RCX: 000073b620d32c3d
Aug 31 12:55:21.181741 xxx kernel: RDX: 00007ffe6eb19950 RSI: 00000000c0186444
RDI: 0000000000000010
Aug 31 12:55:21.181754 xxx kernel: RBP: 00007ffe6eb19900 R08: 00005705db849550
R09: 00007ffe6eb19910
Aug 31 12:55:21.181765 xxx kernel: R10: 0000000000000000 R11: 0000000000000246
R12: 00002200758e9906
Aug 31 12:55:21.181777 xxx kernel: R13: 0000000000000010 R14: 0000000000000006
R15: 00005705db5bae30
Aug 31 12:55:21.181787 xxx kernel: </TASK>
Aug 31 12:55:21.181831 xxx kernel: CR2: 0000000000000008
Aug 31 12:55:21.181845 xxx kernel: ---[ end trace 0000000000000000 ]---
Aug 31 12:55:21.220328 xxx kernel: RIP: 0010:ttm_lru_bulk_move_tail+0x1a5/0x360
[ttm]
Aug 31 12:55:21.220381 xxx kernel: Code: 8d 57 40 4c 8d 4a 40 49 83 fd 05 0f 83
3c 01 00 00 49 8b 7f 48 48 8b 72 40 49 c1 e5 04 49 01 c5 48 01 c8 48 89 37 49
8b 7f 4
8 <48> 89 7e 08 49 8b 75 70 4c 89 16 49 8b 75 70 49 89 77 48 48 89 42
Aug 31 12:55:21.220829 xxx kernel: RSP: 0018:ffffd122e70af6a0 EFLAGS: 00010296
Aug 31 12:55:21.220850 xxx kernel: RAX: ffff8997e240ee30 RBX: 0000000000000000
RCX: 0000000000000078
Aug 31 12:55:21.220860 xxx kernel: RDX: ffff8997c7109840 RSI: 0000000000000000
RDI: ffff8997c8edfc40
Aug 31 12:55:21.220875 xxx kernel: RBP: ffffd122e70af708 R08: 0000000000000000
R09: ffff8997c7109880
Aug 31 12:55:21.220886 xxx kernel: R10: ffff8997d0078700 R11: 0000000000000000
R12: ffff89985a2ed9a8
Aug 31 12:55:21.220896 xxx kernel: R13: ffff8997e240edc8 R14: 0000000000000001
R15: ffff8997d00786c0
Aug 31 12:55:21.220906 xxx kernel: FS: 000073b61dd4d440(0000)
GS:ffff89a6a0de1000(0000) knlGS:0000000000000000
Aug 31 12:55:21.220915 xxx kernel: CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
Aug 31 12:55:21.220935 xxx kernel: CR2: 0000000000000008 CR3: 00000004f8e17000
CR4: 0000000000f50ef0
Aug 31 12:55:21.221032 xxx kernel: PKRU: 55555554
Aug 31 12:55:21.221045 xxx kernel: note: file-roller[316904] exited with irqs
disabled
Aug 31 12:55:21.221063 xxx kernel: note: file-roller[316904] exited with
preempt_count 1
Aug 31 12:55:48.483355 xxx kernel: watchdog: BUG: soft lockup - CPU#2 stuck for
26s! [chrome:cs0:12664]
(bas
** Attachment added: "lp2165729-prevboot-kernel-7.2.0.log"
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+attachment/5996629/+files/lp2165729-prevboot-kernel-7.2.0.log
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165729
Title:
faulting task died holding the TTM LRU spinlock (exited with irqs
disabled / preempt_count 1),
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165729/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
