Public bug reported:
[Impact]
On AMD family 1Ah model 20h/60h systems (Ryzen AI 300 "Strix Point", "Krackan
Point"), every NPU metrics query leaks one kernel allocation. amdxdna answers
its
sensor query (DRM_IOCTL_AMDXDNA_GET_INFO) through amd_pmf_get_npu_data(), and
amd_pmf_get_smu_metrics() calls amd_pmf_set_dram_addr(dev, true) on every call.
That devm_kzalloc()s a new metrics table buffer and overwrites dev->buf, so the
previous buffer is only released when the device is unbound, i.e. never before
shutdown.
Any system monitor that shows NPU usage triggers it continuously. The Resources
app
shipped in 26.04 (resources 1.10.2-0ubuntu3.1) polls about 1.4 times per second
while it is running. After 38 days of uptime kmalloc-512 held 5.85 million
objects
(2.8 GiB, 99% active) on a 32 GB laptop. That memory never comes back and adds
to
swap pressure.
Allocation stack captured with memleak-bpfcc (outstanding allocations
older than 60 s):
__kmalloc_node_track_caller_noprof
devm_kmalloc
amd_pmf_set_dram_addr [amd_pmf]
amd_pmf_get_smu_metrics [amd_pmf]
amd_pmf_get_npu_data [amd_pmf]
aie2_get_sensors.isra.0 [amdxdna]
aie2_get_info [amdxdna]
amdxdna_drm_get_info_ioctl [amdxdna]
drm_ioctl_kernel
drm_ioctl
__x64_sys_ioctl
[Fix]
Upstream patch: "platform/x86/amd/pmf: Fix memory leak in NPU metrics query"
https://lore.kernel.org/platform-driver-x86/[email protected]/
It allocates the buffer only when dev->buf is still NULL and keeps reprogramming
its address on every query. The bug was introduced by 118222e20d16
("platform/x86/amd/pmf: Introduce new interface to export NPU metrics") in v7.0
and
is still present in v7.3. Upstream 7.0.y is end of life, so the resolute 7.0
kernel
needs the backport. In 7.0 the function is in
drivers/platform/x86/amd/pmf/core.c,
and the same one-line change applies there:
- ret = amd_pmf_set_dram_addr(dev, true);
+ ret = amd_pmf_set_dram_addr(dev, !dev->buf);
[Test Plan]
1. On an affected machine, start Resources (or anything that polls NPU sensors).
2. Count per-query allocations for 60 s:
sudo bpftrace -e 'kprobe:devm_kmalloc /comm == "resources"/ { @ = count(); }
interval:s:60 { exit(); }'
On the unfixed kernel this is about 1.4 per second. With the fix it is 0.
3. Check that kmalloc-512 in /proc/slabinfo stays flat over a few hours with the
monitor running, and that NPU utilisation is still reported.
Verified on this machine with the one-line backport built as an out-of-tree
module
for 7.0.0-31-generic. Over 60 s, the stock module made 84 devm_kmalloc() calls
for
84 NPU queries from Resources. The patched module served 106 queries, all
successful, with no devm_kmalloc() calls, and kmalloc-512 stayed at 1195
objects.
[Where problems could occur]
Only the NPU metrics path changes. The buffer is reused instead of reallocated.
Its size is fixed per CPU ID, and its address is still sent to the firmware on
every query. A regression would show up as wrong or stale NPU metrics in amdxdna
consumers.
[Other Info]
- Kernel: 7.0.0-31-generic (Ubuntu 7.0.0-31.31-generic 7.0.14), Ubuntu 26.04.1
LTS
- Hardware: Lenovo Yoga Pro 7 14ASP10 (83LX), AMD Ryzen AI 9 365, BIOS QFCN22WW
- Workaround: close the NPU monitor. To get the leaked memory back without a
reboot,
unload and reload the drivers (rmmod amdxdna amd_pmf; modprobe amdxdna).
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-38-generic 7.0.0-38.38
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Oct 23 10:45:07 2026
InstallationDate: Installed on 2025-04-24 (547 days ago)
InstallationMedia: Ubuntu 25.04 "Plucky Puffin" - Release amd64 (20250415.3)
MachineType: LENOVO 83LX
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 amdgpudrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=a323c926-8629-4428-9136-bca4270afa7c ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: Upgraded to resolute on 2026-05-15 (161 days ago)
dmi.bios.date: 03/10/2025
dmi.bios.release: 1.22
dmi.bios.vendor: LENOVO
dmi.bios.version: QFCN22WW
dmi.board.asset.tag: NO Asset Tag
dmi.board.name: LNVNB161216
dmi.board.vendor: LENOVO
dmi.board.version: No DPK
dmi.chassis.asset.tag: NO Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Yoga Pro 7 14ASP10
dmi.ec.firmware.release: 1.22
dmi.modalias:
dmi:bvnLENOVO:bvrQFCN22WW:bd03/10/2025:br1.22:efr1.22:svnLENOVO:pn83LX:pvrYogaPro714ASP10:rvnLENOVO:rnLNVNB161216:rvrNoDPK:cvnLENOVO:ct10:cvrYogaPro714ASP10:skuLENOVO_MT_83LX_BU_idea_FM_YogaPro714ASP10:pfaYogaPro714ASP10:
dmi.product.family: Yoga Pro 7 14ASP10
dmi.product.name: 83LX
dmi.product.sku: LENOVO_MT_83LX_BU_idea_FM_Yoga Pro 7 14ASP10
dmi.product.version: Yoga Pro 7 14ASP10
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172025
Title:
amd_pmf leaks 512 bytes per NPU metrics query, kmalloc-512 grows until
reboot on Ryzen AI 300
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172025/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
