Public bug reported:
[Impact]
On Ubuntu 26.04 (linux 7.0.0-31 and 7.0.0-34, based on 7.0.14), with an AMD
GPU using amdgpu userptr BOs, kcompactd page migration calls
amdgpu_hmm_invalidate_gfx() while a userptr BO is still being allocated or
freed. At that point bo->vm_bo is NULL, and the kernel dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0000 [#1] SMP PTI
CPU: 6 UID: 0 PID: 74 Comm: kcompactd0 Not tainted 7.0.0-31-generic #31-Ubuntu
Hardware name: ASUS All Series/B85M-E, BIOS 0806 02/20/2014
RIP: 0010:amdgpu_hmm_invalidate_gfx+0x42/0xe0 [amdgpu]
Call Trace:
__mmu_notifier_invalidate_range_start+0x149/0x1b0
try_to_migrate_one+0xeea/0x1010
rmap_walk_anon+0xdb/0x220
try_to_migrate+0x84/0xe0
migrate_folio_unmap+0x276/0x320
migrate_pages_batch+0x17d/0x940
migrate_pages+0x3b2/0x520
compact_zone+0x513/0x790
kcompactd_do_work+0x109/0x270
note: kcompactd0[74] exited with irqs disabled
kcompactd dies holding mm locks. After that, any task touching the affected
pages hangs in D state for good: containers can't be stopped or killed, and
even a normal reboot oopses again in amdgpu_pci_shutdown ->
amdgpu_uvd_prepare_suspend (direct compaction hits the same page). Only a
sysrq-b or power cycle recovers the machine.
We have hit this 3 times in 2 weeks (2026-09-12, 09-19, 09-25) on a Radeon
RX 550 (Polaris 12). The trigger is Jellyfin burning ASS subtitles in with an
ffmpeg Vulkan filter chain:
subtitles -> hwupload=derive_device=vulkan -> overlay_vulkan
The oops fires about 2 seconds after an ffmpeg transcode starts.
[Fix]
Upstream commit 52f650963d8825e97a0ccdd2b616f8a01d9d3d38
"drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx"
(cherry-picked from 631849ff5d603841e74f19f4a5e30fe1f7d7cf30)
Fixes: 91250893cbaa ("drm/amdgpu: fix waiting for all submissions for
userptrs")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5399
Cc: stable, queued for 7.1.y and 6.18.y
The commit applies cleanly to the resolute 7.0.0-34.34 source (one hunk at
offset -4). The regressing commit 91250893cbaa is in the resolute kernel.
The fix did not reach 7.0.y stable because that branch is EOL upstream.
Note: CVE-2026-68101 was assigned to this fix and later rejected, so the
Ubuntu CVE tracker shows resolute as "not affected". It is affected. This is
a stability bug, not a security bug, and it is reproducible.
[Test Plan]
On an amdgpu system, run a workload that creates and destroys userptr BOs
repeatedly (for example, ffmpeg Vulkan hwupload in a loop) while forcing
compaction with `echo 1 > /proc/sys/vm/compact_memory`. Unpatched kernels
oops in amdgpu_hmm_invalidate_gfx; patched kernels don't.
[Where problems could occur]
The change is limited to amdgpu userptr BOs. The BO now holds a reference to
the VM root PD as bo->parent, and amdgpu_bo_destroy() already drops that
reference (amdgpu_bo_unref(&bo->parent)). A mistake would show up as a leaked
root PD on userptr BO free, or as a wait on the wrong reservation object
during invalidation.
---
ProblemType: Bug
AlsaVersion: Advanced Linux Sound Architecture Driver Version k7.0.0-34-generic.
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path',
'/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D2c',
'/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/controlC1',
'/dev/snd/hwC1D0', '/dev/snd/pcmC1D10p', '/dev/snd/pcmC1D9p',
'/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
CasperMD5CheckResult: pass
CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read
kernel buffer failed: Operation not permitted
DistroRelease: Ubuntu 26.04
InstallationDate: Installed on 2026-08-30 (26 days ago)
InstallationMedia: Ubuntu-Server 26.04.1 LTS "Resolute Raccoon" - Release amd64
(20260826)
MachineType: ASUS All Series
Package: linux (not installed)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-34-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
Tags: resolute
Uname: Linux 7.0.0-34-generic x86_64
UnreportableReason: This report is about a package that is not installed.
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip docker lxd plugdev render sudo users video
_MarkForUpload: False
acpidump:
dmi.bios.date: 02/20/2014
dmi.bios.release: 4.6
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 0806
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: B85M-E
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: Rev X.0x
dmi.chassis.asset.tag: Asset-1234567890
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: Chassis Version
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr0806:bd02/20/2014:br4.6:svnASUS:pnAllSeries:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnB85M-E:rvrRevX.0x:cvnChassisManufacture:ct3:cvrChassisVersion:skuAll:pfaASUSMB:
dmi.product.family: ASUS MB
dmi.product.name: All Series
dmi.product.sku: All
dmi.product.version: System Version
dmi.sys.vendor: ASUS
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: apport-collected resolute
** Tags added: apport-collected resolute
** Description changed:
[Impact]
On Ubuntu 26.04 (linux 7.0.0-31 and 7.0.0-34, based on 7.0.14), with an AMD
GPU using amdgpu userptr BOs, kcompactd page migration calls
amdgpu_hmm_invalidate_gfx() while a userptr BO is still being allocated or
freed. At that point bo->vm_bo is NULL, and the kernel dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0000 [#1] SMP PTI
CPU: 6 UID: 0 PID: 74 Comm: kcompactd0 Not tainted 7.0.0-31-generic
#31-Ubuntu
Hardware name: ASUS All Series/B85M-E, BIOS 0806 02/20/2014
RIP: 0010:amdgpu_hmm_invalidate_gfx+0x42/0xe0 [amdgpu]
Call Trace:
__mmu_notifier_invalidate_range_start+0x149/0x1b0
try_to_migrate_one+0xeea/0x1010
rmap_walk_anon+0xdb/0x220
try_to_migrate+0x84/0xe0
migrate_folio_unmap+0x276/0x320
migrate_pages_batch+0x17d/0x940
migrate_pages+0x3b2/0x520
compact_zone+0x513/0x790
kcompactd_do_work+0x109/0x270
note: kcompactd0[74] exited with irqs disabled
kcompactd dies holding mm locks. After that, any task touching the affected
pages hangs in D state for good: containers can't be stopped or killed, and
even a normal reboot oopses again in amdgpu_pci_shutdown ->
amdgpu_uvd_prepare_suspend (direct compaction hits the same page). Only a
sysrq-b or power cycle recovers the machine.
We have hit this 3 times in 2 weeks (2026-09-12, 09-19, 09-25) on a Radeon
RX 550 (Polaris 12). The trigger is Jellyfin burning ASS subtitles in with an
ffmpeg Vulkan filter chain:
subtitles -> hwupload=derive_device=vulkan -> overlay_vulkan
The oops fires about 2 seconds after an ffmpeg transcode starts.
[Fix]
Upstream commit 52f650963d8825e97a0ccdd2b616f8a01d9d3d38
"drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx"
(cherry-picked from 631849ff5d603841e74f19f4a5e30fe1f7d7cf30)
Fixes: 91250893cbaa ("drm/amdgpu: fix waiting for all submissions for
userptrs")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5399
Cc: stable, queued for 7.1.y and 6.18.y
The commit applies cleanly to the resolute 7.0.0-34.34 source (one hunk at
offset -4). The regressing commit 91250893cbaa is in the resolute kernel.
The fix did not reach 7.0.y stable because that branch is EOL upstream.
Note: CVE-2026-68101 was assigned to this fix and later rejected, so the
Ubuntu CVE tracker shows resolute as "not affected". It is affected. This is
a stability bug, not a security bug, and it is reproducible.
[Test Plan]
On an amdgpu system, run a workload that creates and destroys userptr BOs
repeatedly (for example, ffmpeg Vulkan hwupload in a loop) while forcing
compaction with `echo 1 > /proc/sys/vm/compact_memory`. Unpatched kernels
oops in amdgpu_hmm_invalidate_gfx; patched kernels don't.
[Where problems could occur]
The change is limited to amdgpu userptr BOs. The BO now holds a reference to
the VM root PD as bo->parent, and amdgpu_bo_destroy() already drops that
reference (amdgpu_bo_unref(&bo->parent)). A mistake would show up as a leaked
root PD on userptr BO free, or as a wait on the wrong reservation object
during invalidation.
+ ---
+ ProblemType: Bug
+ AlsaVersion: Advanced Linux Sound Architecture Driver Version
k7.0.0-34-generic.
+ AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
+ ApportVersion: 2.34.1-0ubuntu0.1
+ Architecture: amd64
+ ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
+ AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path',
'/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D2c',
'/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/controlC1',
'/dev/snd/hwC1D0', '/dev/snd/pcmC1D10p', '/dev/snd/pcmC1D9p',
'/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
+ CRDA: N/A
+ Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
+ Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
+ Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
+ Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
+ CasperMD5CheckResult: pass
+ CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read
kernel buffer failed: Operation not permitted
+ DistroRelease: Ubuntu 26.04
+ InstallationDate: Installed on 2026-08-30 (26 days ago)
+ InstallationMedia: Ubuntu-Server 26.04.1 LTS "Resolute Raccoon" - Release
amd64 (20260826)
+ MachineType: ASUS All Series
+ Package: linux (not installed)
+ ProcEnviron:
+ LANG=en_US.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-256color
+ XDG_RUNTIME_DIR=<set>
+ ProcFB: 0 amdgpudrmfb
+ ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-34-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
+ ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
+ RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
+ Tags: resolute
+ Uname: Linux 7.0.0-34-generic x86_64
+ UnreportableReason: This report is about a package that is not installed.
+ UpgradeStatus: No upgrade log present (probably fresh install)
+ UserGroups: adm cdrom dip docker lxd plugdev render sudo users video
+ _MarkForUpload: False
+ acpidump:
+
+ dmi.bios.date: 02/20/2014
+ dmi.bios.release: 4.6
+ dmi.bios.vendor: American Megatrends Inc.
+ dmi.bios.version: 0806
+ dmi.board.asset.tag: To be filled by O.E.M.
+ dmi.board.name: B85M-E
+ dmi.board.vendor: ASUSTeK COMPUTER INC.
+ dmi.board.version: Rev X.0x
+ dmi.chassis.asset.tag: Asset-1234567890
+ dmi.chassis.type: 3
+ dmi.chassis.vendor: Chassis Manufacture
+ dmi.chassis.version: Chassis Version
+ dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr0806:bd02/20/2014:br4.6:svnASUS:pnAllSeries:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnB85M-E:rvrRevX.0x:cvnChassisManufacture:ct3:cvrChassisVersion:skuAll:pfaASUSMB:
+ dmi.product.family: ASUS MB
+ dmi.product.name: All Series
+ dmi.product.sku: All
+ dmi.product.version: System Version
+ dmi.sys.vendor: ASUS
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168537
Title:
Please backport "drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx"
(52f650963d88) to resolute 7.0 - NULL deref in kcompactd kills the
system
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168537/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
