Public bug reported:
Ubuntu 24.04 with stock kernel (6.8.0).
Full disclosure, my engineering expertise lies outside of the Linux
kernel domain, so the summary and description were provided by Google's
AI after trying to figure out why the system crashed. It's analysis
might be an hallucination, but in any case, the system should not have
crashed regardless of what Chrome did. I removed the core dump from the
crash file just in case there was sensitive information there. I hope
this is useful.
### Problem Description
A catastrophic kernel memory corruption cascade occurs under high
multi-threaded browser and socket workloads, culminating in a series of
recursive General Protection Faults inside the SLUB allocator
(`kmem_cache_alloc`) and a hard system freeze.
The physical hardware has been exhaustively validated using a full
Memtest86+ pass with zero errors, and SMART drive health checks show
pristine silicon status. This is a code-level kernel regression or race
condition in memory management.
### Environment Details
- OS: Ubuntu 24.04 LTS
- Active Kernel: 6.8.0-147-generic #147-Ubuntu PREEMPT SMP NOPTI
- Architecture: amd64 (Older AMD platform, ASUS M4A88T-M motherboard)
- Triggering Application: Google Chrome NetworkService Utility (`--type=utility
--utility-sub-type=network.mojom.NetworkService`)
### Trace Analysis & Crash Timeline
1. The cascade initiates with a userspace trap invalid opcode in the Chrome
network utility process:
`traps: chrome[97523] trap invalid opcode ip:64cb0b652380 sp:7ffc12cfaf88
error:0 in chrome`
2. 25 seconds later, while handling process exit (`do_exit -> do_group_exit`),
the kernel encounters a General Protection Fault inside `acct_collect` trying
to reference a non-canonical address (`0xfdff8cfbc26829c8`):
`general protection fault, probably for non-canonical address
0xfdff8cfbc26829c8: 0000 [#1] PREEMPT SMP NOPTI`
`RIP: 0010:acct_collect+0x198/0x240`
3. The kernel attempts to handle this fault but recursively corrupts its
tracking structures:
`Fixing recursive fault but reboot is needed!`
4. Over the next 5 minutes, the slab metadata remains completely corrupted.
Every subsequent userspace process making system calls involving task/socket
creation (`ep_insert`, `alloc_pid`, `copy_process`) hits a brick wall inside
`kmem_cache_alloc` at address `0x400000000000038`, causing a cascading system
deadlock:
- GPF [#2]: PID 21299 (nmbd) in `kmem_cache_alloc+0xd3/0x350`
- GPF [#3]: PID 98009 (chrome) in `kmem_cache_alloc+0xd3/0x350`
- GPF [#5]: PID 22006 (tmux: server) in `kmem_cache_alloc+0xd3/0x350`
- GPF [#11]: PID 22695 (bash) in `kmem_cache_alloc+0xd3/0x350`
- GPF [#13]: PID 1300 (snapd) in `kmem_cache_alloc+0xd3/0x350`
### Files Attached (inside bug-files.tar.gz)
- Attached `crash.syslog` showing the precise window of the kernel GPF cascade.
- Attached the `.crash` metadata file from `/var/crash` generated during the
incident.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "bug-files.tar.gz"
https://bugs.launchpad.net/bugs/2172146/+attachment/6012328/+files/bug-files.tar.gz
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172146
Title:
Catastrophic kernel slab allocator corruption / General Protection
Fault loop in kmem_cache_alloc triggered by high userspace concurrency
(6.8.0-147-generic)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172146/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
