Public bug reported:
Title: 7.0.0-34-generic: GPF in __run_timers (list poison
0xdead000000000122) after __queue_work warnings, MacBookPro12,1,
triggered by Wi-Fi (brcmfmac BCM43602) + Thunderbird snap sync
SUMMARY
Opening the Thunderbird snap while Wi-Fi is connected crashes the whole system
within about 30 seconds. kdump captures a general protection fault in
__run_timers on a freed list entry, preceded by repeated warnings from
__queue_work (kernel/workqueue.c:2351) while a delayed_work timer fires. With
Wi-Fi turned off, Thunderbird runs normally. The kernel is not tainted when the
first warning appears.
ENVIRONMENT
- Ubuntu 26.04.1 LTS, kernel 7.0.0-34-generic #34-Ubuntu
- Apple MacBookPro12,1 (2015 13-inch Retina, A1502), BIOS 427.140.8.0.0
- Wi-Fi: Broadcom BCM43602 (brcmfmac, in-tree), wlp3s0
- Thunderbird installed as the snap from the App Center
- Only in-tree modules loaded (taint flags: none at first warning, W afterwards)
STEPS TO REPRODUCE
1. Boot, connect to Wi-Fi, log in.
2. Launch the Thunderbird snap with Gmail and iCloud accounts configured (first
sync on this machine).
3. Within roughly 30 seconds the system hangs and kdump reboots it.
OBSERVATIONS
- Crash 1: occurred about 10 minutes after resume from suspend. First warning
about 8 s after Thunderbird launch, fault about 26 s after launch.
- Crash 2: clean boot, no suspend, Wi-Fi on. Same sequence: first warning about
9 s after launch, fault about 32 s after launch.
- Crash 3: Wi-Fi turned off, Thunderbird launched and ran normally for about
190 s with no warnings. Turning Wi-Fi back on produced the first warning about
12 s after the Wi-Fi address-change message (brcmf_inetaddr_changed). After
relaunching Thunderbird, more warnings followed and then the same fault about
32 s after launch.
- Wi-Fi alone does not trigger it: the machine ran for a long time on Wi-Fi
before Thunderbird was started. It appears to need Thunderbird's network
activity on top of Wi-Fi.
- No out-of-memory messages and no thermal errors in any of the three logs.
KEY LOG LINES (identical in all three)
WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390
Call Trace: __queue_work -> delayed_work_timer_fn -> call_timer_fn ->
__run_timers -> run_timer_softirq
Oops: general protection fault, probably for non-canonical address
0xdead00000000012a
RIP: __run_timers+0x1e0/0x2c0, RAX/R12: dead000000000122
Call Trace: timer_expire_remote -> tmigr_handle_remote_cpu ->
tmigr_handle_remote -> run_timer_softirq
The poison value suggests a timer or work item that was deleted or freed
and then used again. The traces show only generic timer code, so I
cannot tell which driver owns the work item. The brcmfmac / cfg80211
path is my main suspect because of the Wi-Fi on/off result, but I have
not confirmed it.
OTHER NOTES
- Boot log shows brcmfmac could not load the Apple-specific firmware files
(brcmfmac43602-pcie.Apple Inc.-MacBookPro12,1.bin, .txt, .clm_blob,
.txcap_blob) and fell back to generic firmware.
- brcmf_inetaddr_changed logs "fail to get arp ip table err:-52" at each
address change.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-34-generic 7.0.0-34.34
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC1: dan 3722 F.... wireplumber
/dev/snd/controlC0: dan 3722 F.... wireplumber
/dev/snd/seq: dan 3711 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Sep 30 21:20:06 2026
InstallationDate: Installed on 2026-08-20 (42 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 05ac:8290 Apple, Inc. Bluetooth Host Controller
Bus 001 Device 003: ID 05ac:0273 Apple, Inc. Internal Keyboard/Trackpad (ISO)
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
MachineType: Apple Inc. MacBookPro12,1
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-34-generic
root=UUID=e0f95b0a-7f09-48c8-9c53-d2983882f29f ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 06/13/2021
dmi.bios.release: 0.1
dmi.bios.vendor: Apple Inc.
dmi.bios.version: 427.140.8.0.0
dmi.board.name: Mac-E43C1C25D4880AD6
dmi.board.vendor: Apple Inc.
dmi.board.version: MacBookPro12,1
dmi.chassis.type: 9
dmi.chassis.vendor: Apple Inc.
dmi.chassis.version: Mac-E43C1C25D4880AD6
dmi.modalias:
dmi:bvnAppleInc.:bvr427.140.8.0.0:bd06/13/2021:br0.1:svnAppleInc.:pnMacBookPro12,1:pvr1.0:rvnAppleInc.:rnMac-E43C1C25D4880AD6:rvrMacBookPro12,1:cvnAppleInc.:ct9:cvrMac-E43C1C25D4880AD6:sku:pfaMacBookPro:
dmi.product.family: MacBook Pro
dmi.product.name: MacBookPro12,1
dmi.product.version: 1.0
dmi.sys.vendor: Apple Inc.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169091
Title:
System Crash Using Thunderbird Snap
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169091/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
