Public bug reported:
# Launchpad bug: Oops in path_is_under from complete_walk — RCU race
with dying dentries (CIFS automount / dentry shrinker)
**Summary:**
Reproducible kernel oops in `path_is_under+0x50/0x90` called from
`complete_walk+0x9c/0xc0` during RCU path-walk revalidation; the path walk
touches an already-freed (poisoned or NULL) dentry. With
`kernel.panic_on_oops=1` this panics the box; kdump captures the trace. 9
identical dumps across a week, kernels 7.3.0-5, 7.3.0-6 and 7.3.0-8.
## Environment
- Ubuntu, linux 7.3.0-5-generic, 7.3.0-6-generic, 7.3.0-8-generic (all affected)
- ASRock Z690 Steel Legend, Intel i7-14700K, 48G RAM + 48G swapfile on btrfs
- Root fs: btrfs (nvme0n1p3, compress=zstd, noatime), `/mnt/backup` = CIFS
mount `//<lan-nas>/backup` via systemd automount (fstab), iocharset=utf8, noperm
- `kernel.panic_on_oops = 1` (deliberate — see below)
## Crash signature (identical in all dumps)
```
BUG: unable to handle page fault for address: fffffffffffffff0 (slab-poisoned
dentry)
RIP: 0010:path_is_under+0x50/0x90
Call Trace:
complete_walk+0x9c/0xc0
path_lookupat+0x7c/0x2b0
filename_lookup+0xf3/0x210
vfs_statx+0x79/0x160
vfs_fstatat+0x50/0xa0
__do_sys_newfstatat+0x44/0x90
```
Victim process (Comm) is always a heavy stat() walker: kopia (5×) or syncthing
(3×), walking trees spanning the CIFS mount.
Variant: one dump oopsed one frame deeper — `is_subdir+0x48/0x100` (NULL
dentry), called from `path_is_under+0x88` — same chain, same syscall
context.
## Occurrences (kdump dmesg files available)
- 2026-09-26 09:00, 2026-09-28 16:59, 2026-10-01 21:00, 2026-10-01 23:04
(vmcore failed, dmesg saved), 2026-10-02 01:00, 2026-10-02 01:52, 2026-10-02
17:00 (kernels 7.3.0-5/6)
- 2026-10-03 15:36 (kernel 7.3.0-8, syncthing, 59 s after boot)
## Notes / hypotheses
- Initially correlated with systemd automount idle-unmount of the CIFS share;
raising `x-systemd.idle-timeout` to 10800 s did NOT stop the panics, and
removing the idle timeout entirely did not either (the 10-03 15:36 panic hit 59
s after boot on the fixed fstab, and other panics hit hours after the last
logged unmount). Suspect the race is generic RCU-walk vs dentry eviction
(unmount and/or shrink_dcache under memory pressure), landing in the same
`complete_walk` revalidation path.
- The system comment in our sysctl config (written during earlier debugging):
oops happens inside path walk with VFS locks held, after which all CPUs pile up
in `native_queued_spin_lock_slowpath` and the box hangs permanently — hence
`panic_on_oops=1`.
## Attachments
- `/var/crash/2026{0926,0928,1001,1002,1003}*/dmesg.*` (kdump vmcore-dmesg,
collected by apport)
## Desired fix
RCU-walk revalidation in `complete_walk()` must not deref a dentry that lost
its last reference; happy to test patches or kernels.
ProblemType: Bug
DistroRelease: Ubuntu 26.10
Package: linux-image-7.3.0-8-generic 7.3.0-8.8
ProcVersionSignature: Ubuntu 7.3.0-8.8-generic 7.3.0-rc5
Uname: Linux 7.3.0-8-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sat Oct 3 16:11:21 2026
InstallationDate: Installed on 2026-06-02 (123 days ago)
InstallationMedia: Kubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423)
IwDevWlp3s0f0Link: Not connected.
MachineType: ASRock Z690 Steel Legend
ProcFB: 0 nvidia-drmdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.3.0-8-generic
root=UUID=94679966-1cae-40b2-b3c5-c09ce31d8dd2 ro rootflags=subvol=@ quiet
splash RESUME=UUID=94679966-1cae-40b2-b3c5-c09ce31d8dd2 resume_offset=35435763
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
SourcePackage: linux
UpgradeStatus: Upgraded to stonking on 2026-09-04 (29 days ago)
dmi.bios.date: 08/09/2024
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: 19.02
dmi.board.name: Z690 Steel Legend
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvr19.02:bd08/09/2024:br5.27:svnASRock:pnZ690SteelLegend:pvrToBeFilledByO.E.M.:rvnASRock:rnZ690SteelLegend:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:skuToBeFilledByO.E.M.:pfaToBeFilledByO.E.M.:
dmi.product.family: To Be Filled By O.E.M.
dmi.product.name: Z690 Steel Legend
dmi.product.sku: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: ASRock
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug stonking third-party-packages wayland-session
** Attachment added: "lspci-vnvn.log"
https://bugs.launchpad.net/bugs/2169414/+attachment/6005251/+files/lspci-vnvn.log
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169414
Title:
Oops in path_is_under from complete_walk (RCU race with dying
dentries)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169414/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
