Public bug reported:
## Summary (one-liner)
Kernel NULL pointer dereference in ext4_finish_bio via ext4-rsv-
conversion workqueue, 7.0.0-28-generic, causes unrecoverable system hang
(no panic/reboot) requiring a hard power cycle
## Further information (paste into the description box)
**Release:** Ubuntu 24.04.4 LTS (noble)
**Package:** linux-image-generic-hwe-24.04 7.0.0-28.28~24.04.1
**Kernel:** 7.0.0-28-generic #28~24.04.1-Ubuntu PREEMPT(lazy)
**Hardware:** Intel-based mini-PC/NUC-class board (OEM strings blank —
"Default string"/"Default string"), BIOS P0_AK_10_V01_01.02.15W (2024-09-18).
Root filesystem: ext4 on a SATA SSD via the `ahci` driver (Intel SATA
controller,
PCI ID 8086:54d3). GPU: Intel iGPU via the `xe` driver. WiFi: Realtek 8821CE
(`rtw88_8821ce`). No discrete GPU, no RAID, no LVM — plain ext4 on a single
partition (sda2).
### What happened
The system had been up for ~8 days under a normal, unremarkable server workload
(Docker containers, periodic cron jobs, a Tor circuit for an isolated crawler
service, SQLite queries via sudo, a scheduled LLM-backend health check every
~30 min) when the kernel oopsed and the machine became completely unresponsive
— no SSH, no console output, nothing further written to the journal. It stayed
dead for ~22 hours until physically power-cycled; nothing in that window
suggests it ever came back or attempted to reboot on its own
(`kernel.panic_on_oops=0`, the Ubuntu default, so the oops did not trigger an
automatic reboot).
Two things ruled out as causes:
- **Not power loss.** The box is on a monitored UPS (NUT); no "on battery"
transition is logged anywhere near the crash, only an unrelated benign
`usbhid-ups: Pipe error` ~100 minutes earlier.
- **Not disk exhaustion or hardware failure.** `df` showed 5% used (21G/468G)
at the time; the ext4 filesystem passed its journal-replay fsck cleanly on
the next boot with no reported errors; no SMART/I/O errors logged before or
after.
### The oops
A kworker completing an ext4 reserved-space/unwritten-extent conversion after
writeback (`ext4-rsv-conversion` workqueue → `ext4_end_io_rsv_work`) hit a
NULL pointer dereference in `ext4_finish_bio`:
```
BUG: kernel NULL pointer dereference, address: 0000000000000028
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 599214 Comm: kworker/u16:3 Not tainted 7.0.0-28-generic
#28~24.04.1-Ubuntu PREEMPT(lazy)
Hardware name: Default string Default string/Default string, BIOS
P0_AK_10_V01_01.02.15W 09/18/2024
Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
RIP: 0010:ext4_finish_bio+0x8c/0x340
Call Trace:
<TASK>
ext4_release_io_end+0x53/0x110
? ext4_convert_unwritten_io_end_vec+0xd7/0x100
ext4_end_io_end+0x55/0x100
ext4_end_io_rsv_work+0xa7/0x100
process_one_work+0x1af/0x430
worker_thread+0x1bf/0x350
kthread+0xfb/0x140
ret_from_fork+0x1f8/0x2b0
ret_from_fork_asm+0x1a/0x30
</TASK>
note: kworker/u16:3[599214] exited with irqs disabled
```
Within the same second, a second, unrelated process hit a page-table
corruption trying to page in `locale-archive`:
```
BUG: Bad page map in process sleep pte:51d2ba1022d539bb
pgd:2744e7067 p4d:2744e7067 pud:27473d067 pmd:273886067
addr:000071ebcc200000 vm_flags:08000071 anon_vma:0000000000000000
mapping:ffff8e11374ff978 index:200
file:locale-archive fault:filemap_fault mmap:0x0 mmap_prepare:
ext4_file_mmap_prepare read_folio:ext4_read_folio
CPU: 3 UID: 1000 PID: 608524 Comm: sleep Tainted: G D
7.0.0-28-generic #28~24.04.1-Ubuntu PREEMPT(lazy)
Tainted: [D]=DIE
```
The journal cuts off mid-stack-trace of this second oops — nothing further
was ever logged. The machine hung completely at this point rather than
panicking and rebooting.
### Steps to reproduce
Not reliably reproducible. Occurred spontaneously after ~8 days of uptime
under routine load; no unusual I/O, no low-memory condition, no disk-space
pressure, nothing else abnormal in the minutes leading up to it.
### Workaround in place
Installed `linux-image-generic` (GA/non-HWE, 6.8.0-137.137) as a secondary
GRUB boot entry to fall back to if this recurs — confirmed it carries the
drivers this hardware needs (`xe`, `rtw88_8821ce`, `r8169`; the only gap is
`snd_sof_pci_intel_*` audio support, irrelevant on this headless box).
** Affects: linux-hwe-7.0 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162875
Title:
Kernel NULL pointer dereference in ext4_finish_bio via ext4-rsv-
conversion workqueue, 7.0.0-28-generic, causes unrecoverable system
hang (no panic/reboot) requiring a hard power cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-7.0/+bug/2162875/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
