Public bug reported:
[Impact]
On Ubuntu 26.04 Resolute 7.0 kernels, AMD KFD can crash the
kernel when a process re-opens /dev/kfd with a different mm_struct
after execve(), while the previous kfd_process for the same PID has
not yet been released.
kfd_create_process_sysfs() can then fail with -EEXIST while creating:
/sys/devices/virtual/kfd/kfd/proc/<pid>
The failure path calls kobject_put(process->kobj) but leaves
process->kobj non-NULL. Later teardown can access the freed kobject
and crash the kernel.
Pre-fix crash dumps show the duplicate procfs entry failure followed
by a fault in the KFD process release path.
[Fix]
Backport upstream commit:
4ea64d482fc2cc85009fce5abdf4780ece00c31c
("drm/amdkfd: fix kernel crash on releasing NULL sysfs entry")
The upstream fix sets process->kobj = NULL after kobject_put() on the
failure path and makes kfd_procfs_del_queue() return when the process
has no valid kobject.
The fix is already present in newer upstream kernels, but I verified
that it is absent from the Ubuntu Resolute 7.0 kernel series,
including:
- 7.0.0-34.34 (resolute-updates/security)
- 7.0.0-38.38 (resolute-proposed)
- Ubuntu-7.0.0-39.39 (current resolute master-next)
[Test Plan]
Hardware:
AMD Ryzen AI MAX+ 395 with Radeon 8060S (Strix Halo, gfx1151)
Pre-fix:
- 7 kdump captures from affected 7.0 kernels.
- Each shows KFD procfs creation failing because of a duplicate
/sys/devices/virtual/kfd/kfd/proc/<pid> entry, followed by a crash
in the KFD process release path.
Post-fix:
- On 7.0.0-31-generic with an amdgpu module rebuilt with the upstream
fix, the same -EEXIST procfs creation failure path was observed
19 times with no kernel Oops.
- The patched system subsequently ran approximately five days of
ROCm workloads without kernel errors.
The trigger is timing-dependent. I attempted to build a deterministic
reproducer, but it did not re-trigger the -EEXIST path on demand.
Therefore there is currently no deterministic before/after reproducer.
[Where problems could occur]
The change is limited to the error path of per-process KFD procfs
creation and queue procfs cleanup when the process kobject is absent.
A regression would most likely appear as missing or incorrect
/sys/devices/virtual/kfd/kfd/proc/<pid> or queue entries for processes
that hit this error path.
Upstream commit:
4ea64d482fc2cc85009fce5abdf4780ece00c31c
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-31-generic 7.0.0-31.31
ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
Uname: Linux 7.0.0-31-generic x86_64
AlsaVersion: Advanced Linux Sound Architecture Driver Version k7.0.0-31-generic.
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.34.0-0ubuntu2
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1',
'/dev/snd/hwC1D0', '/dev/snd/pcmC1D0c', '/dev/snd/pcmC1D0p',
'/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0',
'/dev/snd/pcmC0D9p', '/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p',
'/dev/snd/pcmC0D3p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
CasperMD5CheckResult: unknown
CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read
kernel buffer failed: Operation not permitted
Date: Mon Sep 28 13:27:50 2026
MachineType: Micro Computer (HK) Tech Limited MS-S1 MAX
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-31-generic
root=UUID=47633183-fdaf-4330-8c3d-b323ca5d3452 ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
WifiSyslog:
acpidump:
dmi.bios.date: 06/08/2026
dmi.bios.release: 5.36
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: 1.09
dmi.board.asset.tag: Default string
dmi.board.name: SHWSA
dmi.board.vendor: Meigao Innovation Technology (Shen Zhen) Co., Ltd
dmi.board.version: 1.0
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 35
dmi.chassis.vendor: Default string
dmi.chassis.version: Default string
dmi.ec.firmware.release: 0.15
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvr1.09:bd06/08/2026:br5.36:efr0.15:svnMicroComputer(HK)TechLimited:pnMS-S1MAX:pvr1.0:rvnMeigaoInnovationTechnology(ShenZhen)Co.,Ltd:rnSHWSA:rvr1.0:cvnDefaultstring:ct35:cvrDefaultstring:skuMGSHWSA:pfaMINISFORUM:
dmi.product.family: MINISFORUM
dmi.product.name: MS-S1 MAX
dmi.product.sku: MGSHWSA
dmi.product.version: 1.0
dmi.sys.vendor: Micro Computer (HK) Tech Limited
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168705
Title:
amdkfd kernel crash when KFD procfs creation fails after execve
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168705/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
