this failure looks similar to https://ratatoskr.run/linux- scsi/2026/03/6765435
megasas_make_prp_nvme() builds NVMe PRP lists in cmd->sg_frame, which is a DMA-pool allocation sized by instance->max_chain_frame_sz. On the affected controller, max_chain_frame_sz is 4096 bytes. The function stores 64-bit PRP entries in that buffer and, at each PRP-list page boundary, uses the last slot for a chain pointer to the next page. When ptr_sgl reaches offset 4088, the code stores the chain pointer there, increments ptr_sgl, and then writes the next PRP entry at offset 4096, past the end of the allocation. On an affected system this reproduces reliably on 6.19.10 during normal I/O to an NVMe device behind a MegaRAID SAS39xx controller: BUG: unable to handle page fault for address: ff76d0e56380c000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:megasas_make_prp_nvme.isra.0+0x12f/0x220 [megaraid_sas] RAX: 0000000000000200 RAX=0x200 indicates the fault happens at the 512th 8-byte slot, i.e. exactly the 4096-byte boundary of the chain frame. Fix this by checking that the chain frame still has room before writing: - the page-boundary chain pointer plus at least one following PRP entry - each PRP entry itself If either check fails, return false and let the caller use the existing IEEE SGL fallback path. Tested on: - ASUS ESC8000A-E13 - 2x AMD EPYC 9335 - Broadcom MegaRAID 9560-16i / SAS39xx - KIOXIA 14TB NVMe behind the controller Before this patch, 6.19.10 crashed repeatedly during boot and normal disk I/O. After applying it, the system boots cleanly and completes 4GB direct-I/O reads without crashes. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2148534 Title: [Ubuntu 26.04] Failed install OS onto JBOD disk on B540d-2HS M.2 controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2148534/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
