Public bug reported:
Since upgrading from 7.0.0-34-generic to 7.0.0-38-generic, my machine
has panicked during shutdown on 2 of the last 3 normal shutdowns.
Booting 7.0.0-34-generic again fixes it. It shut down cleanly every day
for weeks before the upgrade, and again today.
From the outside it looks like a hang on shutdown, and nothing makes it
into the journal (it stops within a second of the reboot starting). The
panics were captured by efi_pstore though. Both are in ksoftirqd/9
running an RCU callback that jumps to a bad address:
BUG: unable to handle page fault for address: ffff8ae682fcaac0
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0011) - permissions violation
Oops: Oops: 0011 [#1] SMP NOPTI
CPU: 9 UID: 0 PID: 188 Comm: ksoftirqd/9 Tainted: G O
7.0.0-38-generic #38-Ubuntu PREEMPT(lazy)
Hardware name: ASUS System Product Name/TUF GAMING Z790-PLUS WIFI, BIOS 1820
05/15/2025
Call Trace:
<TASK>
? local_clock+0x15/0x30
? rcu_do_batch+0x292/0x540
? rcu_core+0x153/0x330
? rcu_core_si+0xe/0x20
? handle_softirqs+0xe1/0x360
? run_ksoftirqd+0x3a/0x60
? smpboot_thread_fn+0xfd/0x230
? kthread+0xf7/0x130
? ret_from_fork+0x195/0x2a0
? ret_from_fork_asm+0x1a/0x30
</TASK>
Kernel panic - not syncing: Fatal exception in interrupt
and the next day:
BUG: unable to handle page fault for address: 0000000000001fa3
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
Oops: Oops: 0010 [#1] SMP NOPTI
CPU: 9 UID: 0 PID: 188 Comm: ksoftirqd/9 Tainted: G O
7.0.0-38-generic #38-Ubuntu PREEMPT(lazy)
Call Trace:
<TASK>
rcu_do_batch+0x1bf/0x540
rcu_core+0x153/0x330
rcu_core_si+0xe/0x20
handle_softirqs+0xe1/0x360
run_ksoftirqd+0x3a/0x60
smpboot_thread_fn+0xfd/0x230
kthread+0xf7/0x130
ret_from_fork+0x195/0x2a0
ret_from_fork_asm+0x1a/0x30
</TASK>
The lead-up is the same both times:
* Docker containers are stopped, so there's a lot of veth/bridge teardown (and
cgroups going away).
* On the first one, "workqueue: inode_switch_wbs_work_fn hogged CPU for
>10000us" a few times.
* "EXT4-fs (nvme0n1p2): unmounting filesystem ..." (that's /boot).
* About 1 second later, the oops above.
My guess is that this is caused by "writeback: drop now-unnecessary
rcu_barrier() in cgroup_writeback_umount()", which is new in 7.0.0-38.
The upstream cover letter for that series says that the rcu_barrier()
also waited for call_rcu() callbacks from other subsystems, so removing
it removes a real wait during umount. That fits an RCU callback running
into freed memory just after an unmount. 7.0.0-34 has the original race
fix from 7.0.0-31 ("writeback: fix race between
cgroup_writeback_umount() and inode_switch_wbs()") but not the
rcu_barrier() removal. I haven't confirmed any of this though and I'm
not an expert.
Both panics were on CPU 9, which made me wonder about Raptor Lake
degradation (it's an i9-14900KS, microcode 0x133). But given the
identical code path, the timing relative to the umount, and that
7.0.0-34 is fine, I think it's the kernel. There are no MCEs in the
logs.
Setup: Ubuntu 26.04.1, NVIDIA 580 open driver (the only taint), heavy
Docker use (both rootful and rootless with ~20 containers), / on LVM on
LUKS, /home bind mounted from a separate ext4 on LUKS.
I've attached the full pstore dmesg dumps for both panics.
AI Disclosure: Claude helped me diagnose this and write up the bug
report. I'm a developer and I've read the above. It seems reasonable to
me but I'm not a kernel developer.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-34-generic 7.0.0-34.34
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: joe 6507 F.... wireplumber
/dev/snd/controlC2: joe 6507 F.... wireplumber
/dev/snd/controlC1: joe 6507 F.... wireplumber
/dev/snd/seq: joe 6487 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sun Oct 11 11:29:29 2026
InstallationDate: Installed on 2025-06-15 (483 days ago)
InstallationMedia: Ubuntu 25.04 "Plucky Puffin" - Release amd64 (20250415.3)
IwDevWlp0s20f3Link: Not connected.
MachineType: ASUS System Product Name
ProcFB: 0 nvidia-drmdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-34-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 05/15/2025
dmi.bios.release: 18.20
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1820
dmi.board.asset.tag: Default string
dmi.board.name: TUF GAMING Z790-PLUS WIFI
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: Default string
dmi.chassis.version: Default string
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr1820:bd05/15/2025:br18.20:svnASUS:pnSystemProductName:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnTUFGAMINGZ790-PLUSWIFI:rvrRev1.xx:cvnDefaultstring:ct3:cvrDefaultstring:skuSKU:pfaTobefilledbyO.E.M.:
dmi.product.family: To be filled by O.E.M.
dmi.product.name: System Product Name
dmi.product.sku: SKU
dmi.product.version: System Version
dmi.sys.vendor: ASUS
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Attachment added: "/var/lib/systemd/pstore"
https://bugs.launchpad.net/bugs/2170496/+attachment/6008242/+files/pstore.tgz
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170496
Title:
Kernel panic in rcu_do_batch during shutdown since 7.0.0-38 (cgroup
writeback umount?)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170496/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
