View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000636 | AlmaLinux-9 | kernel | public | 2026-06-26 11:21 | 2026-07-13 12:42 |
| Reporter | aslefnad7 | Assigned To | |||
| Priority | normal | Severity | crash | Reproducibility | have not tried |
| Status | new | Resolution | open | ||
| Platform | R740 & R750xa | OS | AlmaLinux | OS Version | 9.8 |
| Summary | 0000636: kernel BUG in folio_end_writeback via cifs_writepages on close() | ||||
| Description | -------------------------------------------------------------------------------- SUMMARY -------------------------------------------------------------------------------- 5.14.0-687.15.1.el9_8 — kernel BUG at mm/filemap.c:1593 in folio_end_writeback, reached from cifs_writepages during the writeback flush on close(). Seen in the same event are a refcount_warn_saturate (refcount underflow / use-after-free) in the CIFS async write path and a socket send failure (Error -32 / EPIPE) to the server. The crash(8) disassembly confirms the BUG is the "if (!__folio_end_writeback(folio)) BUG();" case — i.e. writeback is ended on a folio whose writeback flag was already clear (a double-completion of writeback). Severity: crash / kernel panic Category: kernel -------------------------------------------------------------------------------- TWO INDEPENDENT MACHINES, IDENTICAL PANIC -------------------------------------------------------------------------------- The same panic was captured on two physically different servers running the identical kernel build. The call traces match down to the same symbol offsets. hostA Server : Dell PowerEdge R740, BIOS 2.26.1 Kernel : 5.14.0-687.15.1.el9_8 Comm : dask worker [tc (PID 70950, CPU 22) Hardware: 40 CPUs, 766.6 GB RAM CIFS : cache=none hostB Server : Dell PowerEdge R750xa, BIOS 1.20.2 Kernel : 5.14.0-687.15.1.el9_8 Comm : pt_main_thread (PID 246362, CPU 21) Hardware: 24 CPUs, 383.2 GB RAM CIFS : cache=strict Kernel build string (both dumps): Linux version 5.14.0-687.15.1.el9_8.x86_64 (mockbuild@x64-builder01.almalinux.org) ... #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026 Two different server models crashing at the identical instruction with the identical call chain points to a software defect, not a per-machine hardware fault. The only taint flag present before the crash is from an out-of-tree module (NVIDIA, visible in "Modules linked in"); there is no machine-check / hardware-error taint in either dump. The two hosts also run different CIFS cache modes (hostA cache=none, hostB cache=strict) yet hit the identical signature — see "Both cache modes affected" below. -------------------------------------------------------------------------------- WHAT THE DUMPS SHOW -------------------------------------------------------------------------------- In both dumps the crash is a two-part event on the same CPU/PID. The two parts are shown below in the order the report discusses them; the order in which they were actually printed to the kernel log varies (see "A note on ordering" at the end of this section). 1) refcount underflow in the CIFS async write path refcount_t: underflow; use-after-free. WARNING: CPU: <cpu> PID: <pid> at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 ... Tainted: P OE 5.14.0-687.15.1.el9_8.x86_64 Hardware name: Dell Inc. PowerEdge R740, BIOS 2.26.1 RIP: 0010:refcount_warn_saturate+0xba/0x110 Call Trace: refcount_warn_saturate+0xba/0x110 cifs_call_async+0x1ee/0x330 [cifs] smb2_async_writev+0x473/0x6f0 [cifs] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs] cifs_writepages+0x52f/0xbc0 [cifs] do_writepages+0xd5/0x1b0 cifs_flush+0x73/0x120 [cifs] __x64_sys_close+0x2e/0x80 The release function on the stack is cifs_writedata_release — i.e. the object whose refcount saturates/underflows is the CIFS writedata associated with this writeback. 2) socket send failure, and the BUG CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server ------------[ cut here ]------------ kernel BUG at mm/filemap.c:1593! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI ... Tainted: P W OE 5.14.0-687.15.1.el9_8.x86_64 Hardware name: Dell Inc. PowerEdge R740, BIOS 2.26.1 RIP: 0010:folio_end_writeback+0x7d/0x80 Call Trace: folio_end_writeback+0x7d/0x80 cifs_writepages+0x998/0xbc0 [cifs] do_writepages+0xd5/0x1b0 filemap_fdatawrite_wbc+0x66/0x90 filemap_write_and_wait_range+0x3e/0xb0 cifs_flush+0x73/0x120 [cifs] __x64_sys_close+0x2e/0x80 BUG at mm/filemap.c:1593 inside folio_end_writeback means writeback is being ended on a folio that is no longer flagged as under writeback — the folio's writeback state has already been completed/torn down once. Combined with the refcount underflow on the CIFS writedata and the socket send failure (Error -32 / EPIPE) seen in the same event, the signature is a use-after-free / double-completion of the writeback in the SMB2 async write path, occurring during the flush on close(). We read the failed/aborted send during writeback as the likely trigger, but state this as a hypothesis rather than a proven sequence (see "A note on ordering"). Matching offsets on both machines: cifs_call_async+0x1ee, smb2_async_writev+0x473, cifs_writepages+0x52f (send path) and +0x998 (writeback-end path), folio_end_writeback+0x7d, BUG at mm/filemap.c:1593. A note on ordering The three symptoms — the refcount underflow (refcount_warn_saturate), the socket send failure (CIFS: VFS: ... Error -32 sending data on socket), and the BUG in folio_end_writeback — appear together in every dump, but their PRINTED order is not stable (it differs between hosts and even between different dumps of the same host). We therefore do NOT claim a proven cause-and-effect order between the send failure and the refcount underflow. printk ordering on a many-CPU box under load does not necessarily reflect the true event timeline, and the send-error and refcount messages originate in different contexts. What is consistent across both dumps is the end state: a CIFS writeback whose state is ended twice (__folio_end_writeback() returns false -> BUG), in the close() flush path, in the presence of a failing/aborted SMB2 send. The "failed send during writeback triggers a bad writeback completion" reading is our best-supported hypothesis, not a fact the logs establish on their own. -------------------------------------------------------------------------------- BOTH CACHE MODES AFFECTED -------------------------------------------------------------------------------- The two hosts run different CIFS cache modes, and each crashed with the same confirmed signature: - hostA (R740): cache=none - hostB (R750xa): cache=strict This is visible in the stacks themselves. On hostB (cache=strict), the writeback path goes through cifs_strict_writev: cifs_writepages+0x52f/0xbc0 [cifs] ? generic_perform_write+0x14c/0x210 do_writepages+0xd5/0x1b0 ? cifs_strict_writev+0x1c4/0x330 [cifs] <-- strict path ... cifs_writepages+0x998/0xbc0 [cifs] ? cifs_strict_writev+0x1c4/0x330 [cifs] <-- strict path do_writepages+0xd5/0x1b0 cifs_flush+0x73/0x120 [cifs] The cifs_strict_writev frame is present on hostB and absent on hostA, confirming the two crashes reach the same folio_end_writeback double-completion through two different CIFS write paths (strict vs. none). The bug therefore does NOT depend on a single cache mode; it is in the writeback-completion handling common to both. -------------------------------------------------------------------------------- crash(8) ANALYSIS — VERIFIED SOURCE LINE AND FULL KERNEL STACK -------------------------------------------------------------------------------- crash(8) sessions over the full vmcores (with vmlinux debuginfo for 5.14.0-687.15.1.el9_8) confirm the source line and the complete in-kernel stack that the redacted dmesg only shows by offset. The disassembly of folio_end_writeback shows the BUG() at line 1593 is reached directly from the "if (!__folio_end_writeback(folio)) BUG();" path — i.e. __folio_end_writeback() returned false because the folio's PG_writeback flag was already clear: 1591 folio_get(folio); 1592 if (!__folio_end_writeback(folio)) ... call __folio_end_writeback ; test %al,%al ; je <+125> 1593 BUG(); 0xffffffff8137921d <+125>: ud2 Resolved kernel-side backtrace (hostA; hostB is identical bar addresses): [exception RIP: folio_end_writeback+125] 0000008 cifs_writepages [cifs] 0000009 do_writepages 0000010 filemap_fdatawrite_wbc 0000011 __filemap_fdatawrite_range 0000012 filemap_write_and_wait_range #13 cifs_flush [cifs] 0000014 filp_flush 0000015 __x64_sys_close 0000016 do_syscall_64 0000017 entry_SYSCALL_64_after_hwframe This matches the dmesg-derived signature exactly and pins the BUG to the __folio_end_writeback()-returns-false (writeback already ended) case. Note for reviewers: in the slab PAGE lines of the attachments, MAPPING values of the form dead0000000004xx / dead000000000001 are the normal kernel slab page-poison marker (page->mapping for a slab page), NOT corruption and NOT a redaction. -------------------------------------------------------------------------------- CIFS MOUNT OPTIONS (anonymized) -------------------------------------------------------------------------------- Requested options (autofs map; same on both hosts): sec=krb5,cruid=${UID},uid=${UID},gid=${GID},forceuid,forcegid, iocharset=utf8,vers=3.0,nosuid,nodev,dir_mode=0700,file_mode=0700, noserverino,cache=none Effective options after expansion (from the dumps), anonymized: hostA (R740) — cache=none: rw,nosuid,nodev,relatime,vers=3.0,sec=krb5,cruid=<uid>,cache=none, upcall_target=app,username=<username>,uid=<uid>,forceuid,gid=<gid>, forcegid,addr=<fileserver-ip>,file_mode=0700,dir_mode=0700, iocharset=utf8,soft,nounix,mapposix,reparse=nfs,nativesocket, symlink=native,rsize=4194304,wsize=4194304,bsize=1048576, echo_interval=60,actimeo=1,closetimeo=1 hostB (R750xa) — cache=strict: rw,nosuid,nodev,relatime,vers=3.0,sec=krb5,cruid=<uid>,cache=strict, upcall_target=app,username=<username>,uid=<uid>,forceuid,gid=<gid>, forcegid,addr=<fileserver-ip>,file_mode=0700,dir_mode=0700, iocharset=utf8,soft,nounix,mapposix,reparse=nfs,nativesocket, symlink=native,rsize=4194304,wsize=4194304,bsize=1048576, echo_interval=60,actimeo=1,closetimeo=1 Anonymized fields: cruid/uid -> <uid>, gid -> <gid>, username -> <username>, addr -> <fileserver-ip>. All other values are verbatim. The two hosts differ only in the cache mode (none vs. strict). Why these may matter to maintainers (context, not a diagnosis): - cache mode. Same signature under cache=none (hostA) and cache=strict (hostB), so the bug is not specific to one writeback path; see "Both cache modes affected". - vers=3.0 (not 3.1.1) and sec=krb5 narrow down which SMB2/3 code path and auth path are in use. - soft, actimeo=1, closetimeo=1. A soft mount with very short attribute/close timeouts means operations abort with errors sooner under network pressure — consistent with the Error -32 / "send fails mid-writeback" condition seen in the dumps. - rsize/wsize=4194304 (4 MiB). Large I/O sizes, relevant to how writeback is chunked. We note these as potentially relevant context; we are not claiming any single option is the proven cause. -------------------------------------------------------------------------------- UPSTREAM CONTEXT (known class of bug; exact fix status for el9 is an open question) -------------------------------------------------------------------------------- This is consistent with a previously reported class of CIFS writeback-completion bugs rather than a brand-new defect: - On the linux-cifs list (Feb 2024), Steve French reported the same call path (cifs_flush -> filemap_write_and_wait_range -> ... -> folio_end_writeback) hit under xfstests when writes time out due to repeatedly failing server reconnects. Matthew Wilcox's reading was that the bug is something failing to call folio_end_writeback() when it should — i.e. a mismatch in writeback-end accounting, which is exactly the __folio_end_writeback()-returns-false signature seen here. Our trigger (Error -32 / EPIPE on the socket send during the close() flush) is the same "send/reconnect fails mid-writeback" condition. Thread: https://www.spinics.net/lists/linux-cifs/msg31067.html - The CIFS writeback path saw significant churn upstream: a two-phase cifs_writepages_begin / cifs_extend_writeback design (around f3dc1bdb6b0b "cifs: Fix writeback data corruption"), later a cut-over to netfslib (3ee1a1fc3981), plus follow-up fixes (e.g. a per-cifs_writepages_begin folio leak fix by Yang Erkun). Several of these touch exactly the folio/writeback refcounting on the write path. We have NOT been able to identify a single specific upstream commit and confirm whether it is present in or missing from 5.14.0-687.15.1.el9_8. Determining whether el9's backport of the CIFS writeback path already contains the relevant fix (or needs one) is the key question for the maintainers, and requires checking the el9 kernel changelog against the upstream CIFS/netfs writeback fixes above. We're happy to provide the full vmcore(s) and test further. | ||||
| Steps To Reproduce | -------------------------------------------------------------------------------- STEPS TO REPRODUCE (as observed in the dumps) -------------------------------------------------------------------------------- 1. Mount SMB/CIFS shares from a file server (//<fileserver>/<share>) with the options listed under "CIFS mount options" above (vers=3.0, sec=krb5, soft). Seen under both cache=none (hostA) and cache=strict (hostB). 2. Run a userspace workload that writes heavily to files on the CIFS mount and closes them (crashing processes are dask worker and pt_main_thread; both hosts were under load, hostB notably so with load average 0000014:0000015). 3. On close(), the kernel flushes dirty pages (__x64_sys_close -> cifs_flush -> do_writepages -> cifs_writepages). In the presence of an SMB2 async write that hits a socket send failure (CIFS: VFS: ... Error -32 sending data on socket), the dumps show a CIFS writedata refcount underflow (refcount_warn_saturate) and cifs_writepages calling folio_end_writeback on a folio whose writeback has already been ended (__folio_end_writeback() returns false) -> BUG at mm/filemap.c:1593, panicking the machine. (See "A note on ordering": the precise sequence of the send failure vs. the refcount underflow is not established by the logs.) | ||||
| Additional Information | - Both crashes occurred on the same kernel build 5.14.0-687.15.1.el9_8 (built Thu Jun 11 08:51:45 EDT 2026, per the dump banner). - The fault is in the SMB client (cifs) async write / writeback-completion path; the mm BUG is the symptom of the writeback being completed twice. - The two crashes span both CIFS cache modes (none and strict) on two different server models, which argues against a per-machine or per-cache-mode cause. - Redacted vmcore-dmesg excerpts and redacted crash(8) analyses for both hosts are attached. Full vmcore images can be provided privately on request. | ||||
| Tags | No tags attached. | ||||
| Attached Files | hostA-R740-crash-analysis-redacted.txt (17,106 bytes)
# Redacted crash(8) analysis — <hostA> (Dell PowerEdge R740), kdump of 2026-06-23.
# Source: crash(8) over vmcore + vmlinux debuginfo for 5.14.0-687.15.1.el9_8.
# Anonymized: <fileserver>, <fileserver-ip>, <hostA>, <svctag-A>, <uid>, <gid>,
# <username>. Nothing else altered. (The crash dump itself carries the real
# NODENAME etc.; this excerpt is the redacted copy for the public bug tracker.)
# Note: the autofs "given options" line below was truncated in the source at
# "closetimeo="; the effective expanded options are the authoritative ones.
given options via autofs:
sec=krb5,cruid=${UID},uid=${UID},gid=${GID},forceuid,forcegid,iocharset
=utf8,vers=3.0,nosuid,nodev,dir_mode=0700,file_mode=0700,noserverino,ca
che=none
after option expanding:
rw,nosuid,nodev,relatime,vers=3.0,sec=krb5,cruid=<uid>,cache=none,
upcall_target=app,username=<username>,uid=<uid>,forceuid,gid=<gid>,
forcegid,addr=<fileserver-ip>,file_mode=0700,dir_mode=0700,iocharset=utf8
,soft,nounix,mapposix,reparse=nfs,nativesocket,symlink=native,rsize=419
4304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=
KERNEL: /usr/lib/debug/lib/modules/5.14.0-687.15.1.el9_8.x86_64/vmlinux [TAINTED]
DUMPFILE: vmcore [PARTIAL DUMP]
CPUS: 40
DATE: Tue Jun 23 16:27:35 CEST 2026
UPTIME: 17:46:27
LOAD AVERAGE: 4.56, 4.12, 4.17
TASKS: 2771
NODENAME: <hostA>
RELEASE: 5.14.0-687.15.1.el9_8.x86_64
VERSION: #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026
MACHINE: x86_64 (3100 Mhz)
MEMORY: 766.6 GB
PANIC: "kernel BUG at mm/filemap.c:1593!"
PID: 70950
COMMAND: "dask worker [tc"
TASK: ffff893e88be0000 [THREAD_INFO: ffff893e88be0000]
CPU: 22
STATE: TASK_RUNNING (PANIC)
1567 /**
1568 * folio_end_writeback - End writeback against a folio.
1569 * @folio: The folio.
1570 */
1571 void folio_end_writeback(struct folio *folio)
1572 {
0xffffffff813791a0 <+0>: call 0xffffffff8107d860 <__fentry__>
0xffffffff813791a9 <+9>: mov %rdi,%rbp
1573 /*
1574 * folio_test_clear_reclaim() could be used here but it is an
1575 * atomic operation and overkill in this particular case. Failing
1576 * to shuffle a folio marked for immediate reclaim is too mild
1577 * a gain to justify taking an atomic operation penalty at the
1578 * end of every folio writeback.
1579 */
1580 if (folio_test_reclaim(folio)) {
0xffffffff813791ac <+12>: test $0x40000,%eax
0xffffffff813791b1 <+17>: jne 0xffffffff813791fe <folio_end_writeback+94>
1581 folio_clear_reclaim(folio);
1582 folio_rotate_reclaimable(folio);
0xffffffff81379203 <+99>: call 0xffffffff8138c5f0 <folio_rotate_reclaimable>
0xffffffff81379208 <+104>: jmp 0xffffffff813791b3 <folio_end_writeback+19>
1583 }
1584
1585 /*
1586 * Writeback does not hold a folio reference of its own, relying
1587 * on truncation to wait for the clearing of PG_writeback.
1588 * But here we must make sure that the folio is not freed and
1589 * reused before the folio_wake().
1590 */
1591 folio_get(folio);
1592 if (!__folio_end_writeback(folio))
0xffffffff813791b7 <+23>: mov %rbp,%rdi
0xffffffff813791ba <+26>: call 0xffffffff813881d0 <__folio_end_writeback>
0xffffffff813791bf <+31>: test %al,%al
0xffffffff813791c1 <+33>: je 0xffffffff8137921d <folio_end_writeback+125>
1593 BUG();
0xffffffff8137921d <+125>: ud2
1594
1595 smp_mb__after_atomic();
1596 folio_wake(folio, PG_writeback);
1597 acct_reclaim_writeback(folio);
1598 folio_put(folio);
1599 }
0xffffffff813791f8 <+88>: pop %rbp
0xffffffff813791f9 <+89>: jmp 0xffffffff81d65cb0 <__x86_return_thunk>
0xffffffff8137920d <+109>: pop %rbp
PID: 70950 TASK: ffff893e88be0000 CPU: 22 COMMAND: "dask worker [tc"
#0 [ffffcb0eb1297830] machine_kexec at ffffffffa527f00e
#1 [ffffcb0eb1297888] __crash_kexec at ffffffffa5425d8a
#2 [ffffcb0eb1297948] crash_kexec at ffffffffa5426370
#3 [ffffcb0eb1297950] oops_end at ffffffffa5238fd6
#4 [ffffcb0eb1297970] do_trap at ffffffffa5234d8f
#5 [ffffcb0eb12979c0] do_error_trap at ffffffffa5234e35
#6 [ffffcb0eb1297a00] exc_invalid_op at ffffffffa5f4d77e
#7 [ffffcb0eb1297a20] asm_exc_invalid_op at ffffffffa6000b36
[exception RIP: folio_end_writeback+125]
RIP: ffffffffa557921d RSP: ffffcb0eb1297ad8 RFLAGS: 00010246
RAX: 0000000000000b00 RBX: ffff899f43699680 RCX: 0000000000000000
RDX: ffff893e88be0000 RSI: ffffedc013097e00 RDI: ffff893e88be0000
RBP: ffffedc013097e00 R8: ffffcb0eb1297aa8 R9: 000000008024001f
R10: 000000000000001c R11: ffff899f43699680 R12: 0000000000000bd8
R13: 0000000000000000 R14: ffffcb0eb1297c60 R15: ffff89961e9d9800
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#8 [ffffcb0eb1297ae0] cifs_writepages at ffffffffc28095e8 [cifs]
#9 [ffffcb0eb1297ba8] do_writepages at ffffffffa5587cd5
#10 [ffffcb0eb1297c38] filemap_fdatawrite_wbc at ffffffffa55774a6
#11 [ffffcb0eb1297c58] __filemap_fdatawrite_range at ffffffffa557c194
#12 [ffffcb0eb1297cd0] filemap_write_and_wait_range at ffffffffa557c3ee
#13 [ffffcb0eb1297cf8] cifs_flush at ffffffffc280b293 [cifs]
#14 [ffffcb0eb1297d18] filp_flush at ffffffffa5688ace
#15 [ffffcb0eb1297d38] __x64_sys_close at ffffffffa5688b9e
#16 [ffffcb0eb1297d50] do_syscall_64 at ffffffffa5f4cf8f
#17 [ffffcb0eb1297f50] entry_SYSCALL_64_after_hwframe at ffffffffa600012b
RIP: 00007fae16303f3b RSP: 00007fadee5db388 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 00007fac240977a0 RCX: 00007fae16303f3b
RDX: 00007fae163f79e0 RSI: 00000000fbad2404 RDI: 0000000000000038
RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000020
R10: 00000000002aa212 R11: 0000000000000202 R12: 00007fae163f85e0
R13: 00007fac670c7b18 R14: 00007fadee5db458 R15: 0000000000000002
ORIG_RAX: 0000000000000003 CS: 0033 SS: 002b
kmem ffff893e88be0000
CACHE OBJSIZE ALLOCATED TOTAL SLABS SSIZE NAME
ffff8935c021d100 9096 2770 2964 988 32k task_struct
SLAB MEMORY NODE TOTAL ALLOCATED FREE
ffffedbea722f800 ffff893e88be0000 0 3 2 1
FREE / [ALLOCATED]
[ffff893e88be0000]
PID: 70950
COMMAND: "dask worker [tc"
TASK: ffff893e88be0000 [THREAD_INFO: ffff893e88be0000]
CPU: 22
STATE: TASK_RUNNING (PANIC)
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffffedbea722f800 9c8be0000 dead000000000001 ffff893e88be23c0 1 17ffffc0000840 slab,head
[63988.140018] CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server
[63988.140045] ------------[ cut here ]------------
[63988.140046] refcount_t: underflow; use-after-free.
[63988.140059] WARNING: CPU: 22 PID: 70950 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110
[63988.140067] Modules linked in: nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm ipmi_ssif drm_ttm_helper ttm ipmi_si iTCO_wdt iTCO_vendor_support rapl lpc_ich acpi_power_meter intel_cstate video intel_uncore dcdbas i2c_i801 dell_smbios dell_wmi_descriptor mei_me acpi_ipmi mei wmi_bmof ipmi_devintf ipmi_msghandler pcspkr i2c_smbus intel_pch_thermal auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib i2c_algo_bit drm_shmem_helper drm_kms_helper ahci libahci crct10dif_pclmul crc32_pclmul libata drm bnxt_en crc32c_intel megaraid_sas tg3
[63988.140123] ghash_clmulni_intel wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse
[63988.140130] CPU: 22 PID: 70950 Comm: dask worker [tc Kdump: loaded Tainted: P OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1
[63988.140132] Hardware name: Dell Inc. PowerEdge R740/<svctag-A>, BIOS 2.26.1 01/28/2026
[63988.140133] RIP: 0010:refcount_warn_saturate+0xba/0x110
[63988.140136] Code: 01 01 e8 69 b1 a5 ff 0f 0b c3 cc cc cc cc 80 3d 74 61 c9 01 00 75 85 48 c7 c7 a8 4c 91 a6 c6 05 64 61 c9 01 01 e8 46 b1 a5 ff <0f> 0b e9 0f b0 6a 00 80 3d 4f 61 c9 01 00 0f 85 5e ff ff ff 48 c7
[63988.140137] RSP: 0018:ffffcb0eb1297998 EFLAGS: 00010286
[63988.140139] RAX: 0000000000000000 RBX: ffff89963ec89ec0 RCX: 0000000000000027
[63988.140140] RDX: 0000000000000027 RSI: 00000000ffff7fff RDI: ffff899380ee0f08
[63988.140142] RBP: ffff89954451c9c0 R08: 0000000000000000 R09: ffffcb0eb1297840
[63988.140143] R10: ffffcb0eb1297838 R11: ffffffffa73e2ee8 R12: ffff89954451c800
[63988.140144] R13: ffff89a3b7f2ca80 R14: 00000000ffffff99 R15: ffff89954451c9f8
[63988.140145] FS: 00007fadee5dd640(0000) GS:ffff899380ec0000(0000) knlGS:0000000000000000
[63988.140147] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[63988.140148] CR2: 00007efc90327b68 CR3: 000000652bb80006 CR4: 00000000007726f0
[63988.140149] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[63988.140149] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[63988.140150] PKRU: 55555554
[63988.140151] Call Trace:
[63988.140153] <TASK>
[63988.140156] ? __warn+0x84/0x140
[63988.140161] ? refcount_warn_saturate+0xba/0x110
[63988.140163] ? report_bug+0x16b/0x180
[63988.140168] ? handle_bug+0x3c/0x70
[63988.140174] ? exc_invalid_op+0x14/0x70
[63988.140176] ? asm_exc_invalid_op+0x16/0x20
[63988.140182] ? refcount_warn_saturate+0xba/0x110
[63988.140184] ? refcount_warn_saturate+0xba/0x110
[63988.140187] cifs_call_async+0x1ee/0x330 [cifs]
[63988.140275] smb2_async_writev+0x473/0x6f0 [cifs]
[63988.140334] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs]
[63988.140383] ? cifs_writepages+0x52f/0xbc0 [cifs]
[63988.140431] cifs_writepages+0x52f/0xbc0 [cifs]
[63988.140477] ? vfs_write+0x1a9/0x470
[63988.140481] do_writepages+0xd5/0x1b0
[63988.140485] ? syscall_exit_work+0xff/0x130
[63988.140490] ? syscall_exit_to_user_mode+0x19/0x40
[63988.140493] ? do_syscall_64+0x6b/0xe0
[63988.140496] filemap_fdatawrite_wbc+0x66/0x90
[63988.140499] __filemap_fdatawrite_range+0x54/0x80
[63988.140501] filemap_write_and_wait_range+0x3e/0xb0
[63988.140503] cifs_flush+0x73/0x120 [cifs]
[63988.140550] filp_flush+0x2e/0x80
[63988.140553] __x64_sys_close+0x2e/0x80
[63988.140555] do_syscall_64+0x5f/0xe0
[63988.140558] ? do_numa_page+0x3a6/0x520
[63988.140562] ? __handle_mm_fault+0x2fb/0x650
[63988.140565] ? __count_memcg_events+0x50/0xb0
[63988.140568] ? mm_account_fault+0x6c/0x100
[63988.140571] ? handle_mm_fault+0x138/0x270
[63988.140573] ? do_user_addr_fault+0x35d/0x6a0
[63988.140576] ? clear_bhb_loop+0x40/0x90
[63988.140578] ? clear_bhb_loop+0x40/0x90
[63988.140580] ? clear_bhb_loop+0x40/0x90
[63988.140581] ? clear_bhb_loop+0x40/0x90
[63988.140582] ? clear_bhb_loop+0x40/0x90
[63988.140583] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[63988.140588] RIP: 0033:0x7fae16303f3b
[63988.140590] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8
[63988.140591] RSP: 002b:00007fadee5db388 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[63988.140593] RAX: ffffffffffffffda RBX: 00007fac240977a0 RCX: 00007fae16303f3b
[63988.140594] RDX: 00007fae163f79e0 RSI: 00000000fbad2404 RDI: 0000000000000038
[63988.140595] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020
[63988.140596] R10: 00000000002aa212 R11: 0000000000000202 R12: 00007fae163f85e0
[63988.140597] R13: 00007fac670c7b18 R14: 00007fadee5db458 R15: 0000000000000002
[63988.140599] </TASK>
[63988.140599] ---[ end trace 0000000000000000 ]---
[63988.140612] CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server
[63988.140627] ------------[ cut here ]------------
[63988.140636] kernel BUG at mm/filemap.c:1593!
[63988.140650] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[63988.140660] CPU: 22 PID: 70950 Comm: dask worker [tc Kdump: loaded Tainted: P W OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1
[63988.140673] Hardware name: Dell Inc. PowerEdge R740/<svctag-A>, BIOS 2.26.1 01/28/2026
[63988.140683] RIP: 0010:folio_end_writeback+0x7d/0x80
[63988.140693] Code: ff 4d 34 74 12 5d c3 cc cc cc cc f0 80 67 02 fb e8 e8 33 01 00 eb a9 48 89 ef 5d e9 5d 16 01 00 48 89 ee e8 c5 23 02 00 eb d5 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44
[63988.140713] RSP: 0018:ffffcb0eb1297ad8 EFLAGS: 00010246
[63988.140719] RAX: 0000000000000b00 RBX: ffff899f43699680 RCX: 0000000000000000
[63988.140728] RDX: ffff893e88be0000 RSI: ffffedc013097e00 RDI: ffff893e88be0000
[63988.140736] RBP: ffffedc013097e00 R08: ffffcb0eb1297aa8 R09: 000000008024001f
[63988.140743] R10: 000000000000001c R11: ffff899f43699680 R12: 0000000000000bd8
[63988.140752] R13: 0000000000000000 R14: ffffcb0eb1297c60 R15: ffff89961e9d9800
[63988.140762] FS: 00007fadee5dd640(0000) GS:ffff899380ec0000(0000) knlGS:0000000000000000
[63988.140772] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[63988.140779] CR2: 00007efc90327b68 CR3: 000000652bb80006 CR4: 00000000007726f0
[63988.140787] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[63988.140796] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[63988.140804] PKRU: 55555554
[63988.140808] Call Trace:
[63988.140813] <TASK>
[63988.140816] ? die+0x33/0x90
[63988.140826] ? do_trap+0xdf/0x110
[63988.140836] ? folio_end_writeback+0x7d/0x80
[63988.140844] ? do_error_trap+0x65/0x80
[63988.140850] ? folio_end_writeback+0x7d/0x80
[63988.140858] ? exc_invalid_op+0x4e/0x70
[63988.140866] ? folio_end_writeback+0x7d/0x80
[63988.140873] ? asm_exc_invalid_op+0x16/0x20
[63988.140883] ? folio_end_writeback+0x7d/0x80
[63988.140891] ? folio_end_writeback+0x1f/0x80
[63988.141114] cifs_writepages+0x998/0xbc0 [cifs]
[63988.141375] do_writepages+0xd5/0x1b0
[63988.141551] ? syscall_exit_work+0xff/0x130
[63988.141723] ? syscall_exit_to_user_mode+0x19/0x40
[63988.141890] ? do_syscall_64+0x6b/0xe0
[63988.142050] filemap_fdatawrite_wbc+0x66/0x90
[63988.142205] __filemap_fdatawrite_range+0x54/0x80
[63988.142351] filemap_write_and_wait_range+0x3e/0xb0
[63988.142498] cifs_flush+0x73/0x120 [cifs]
[63988.142709] filp_flush+0x2e/0x80
[63988.142856] __x64_sys_close+0x2e/0x80
[63988.143001] do_syscall_64+0x5f/0xe0
[63988.143151] ? do_numa_page+0x3a6/0x520
[63988.143297] ? __handle_mm_fault+0x2fb/0x650
[63988.143441] ? __count_memcg_events+0x50/0xb0
[63988.143586] ? mm_account_fault+0x6c/0x100
[63988.143727] ? handle_mm_fault+0x138/0x270
[63988.143868] ? do_user_addr_fault+0x35d/0x6a0
[63988.144007] ? clear_bhb_loop+0x40/0x90
[63988.144139] ? clear_bhb_loop+0x40/0x90
[63988.144267] ? clear_bhb_loop+0x40/0x90
[63988.144391] ? clear_bhb_loop+0x40/0x90
[63988.144509] ? clear_bhb_loop+0x40/0x90
[63988.144620] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[63988.144733] RIP: 0033:0x7fae16303f3b
[63988.144842] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8
[63988.145076] RSP: 002b:00007fadee5db388 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[63988.145197] RAX: ffffffffffffffda RBX: 00007fac240977a0 RCX: 00007fae16303f3b
[63988.145318] RDX: 00007fae163f79e0 RSI: 00000000fbad2404 RDI: 0000000000000038
[63988.145438] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020
[63988.145556] R10: 00000000002aa212 R11: 0000000000000202 R12: 00007fae163f85e0
[63988.145673] R13: 00007fac670c7b18 R14: 00007fadee5db458 R15: 0000000000000002
[63988.145792] </TASK>
[63988.145908] Modules linked in: nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm ipmi_ssif drm_ttm_helper ttm ipmi_si iTCO_wdt iTCO_vendor_support rapl lpc_ich acpi_power_meter intel_cstate video intel_uncore dcdbas i2c_i801 dell_smbios dell_wmi_descriptor mei_me acpi_ipmi mei wmi_bmof ipmi_devintf ipmi_msghandler pcspkr i2c_smbus intel_pch_thermal auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib i2c_algo_bit drm_shmem_helper drm_kms_helper ahci libahci crct10dif_pclmul crc32_pclmul libata drm bnxt_en crc32c_intel megaraid_sas tg3
[63988.145950] ghash_clmulni_intel wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse
hostA-R740-panic-redacted.txt (8,260 bytes)
# Redacted kdump excerpt — <hostA> (Dell PowerEdge R740) # Contents: kernel banner, 'Modules linked in', and the two panic traces only. # Internal/personal identifiers anonymized: <fileserver> <user> <hostA>/<hostB> <mac>; timestamps, PIDs and CPU ids neutralized. [ 0.000000] Linux version 5.14.0-687.15.1.el9_8.x86_64 (mockbuild@x64-builder01.almalinux.org) (gcc (GCC) 11.5.0 20240719 (Red Hat 11.5.0-14), GNU ld version 2.35.2-72.el9) #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026 [ ] WARNING: CPU: <cpu> PID: <pid> at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ ] Modules linked in: nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm ipmi_ssif drm_ttm_helper ttm ipmi_si iTCO_wdt iTCO_vendor_support rapl lpc_ich acpi_power_meter intel_cstate video intel_uncore dcdbas i2c_i801 dell_smbios dell_wmi_descriptor mei_me acpi_ipmi mei wmi_bmof ipmi_devintf ipmi_msghandler pcspkr i2c_smbus intel_pch_thermal auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib i2c_algo_bit drm_shmem_helper drm_kms_helper ahci libahci crct10dif_pclmul crc32_pclmul libata drm bnxt_en crc32c_intel megaraid_sas tg3 [ ] ghash_clmulni_intel wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse [ ] CPU: <cpu> PID: <pid> Comm: dask worker [tc Kdump: loaded Tainted: P OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [ ] Hardware name: Dell Inc. PowerEdge R740, BIOS 2.26.1 01/28/2026 [ ] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ ] Code: 01 01 e8 69 b1 a5 ff 0f 0b c3 cc cc cc cc 80 3d 74 61 c9 01 00 75 85 48 c7 c7 a8 4c 91 a6 c6 05 64 61 c9 01 01 e8 46 b1 a5 ff <0f> 0b e9 0f b0 6a 00 80 3d 4f 61 c9 01 00 0f 85 5e ff ff ff 48 c7 [ ] RSP: 0018:ffffcb0eb1297998 EFLAGS: 00010286 [ ] RAX: 0000000000000000 RBX: ffff89963ec89ec0 RCX: 0000000000000027 [ ] RDX: 0000000000000027 RSI: 00000000ffff7fff RDI: ffff899380ee0f08 [ ] RBP: ffff89954451c9c0 R08: 0000000000000000 R09: ffffcb0eb1297840 [ ] R10: ffffcb0eb1297838 R11: ffffffffa73e2ee8 R12: ffff89954451c800 [ ] R13: ffff89a3b7f2ca80 R14: 00000000ffffff99 R15: ffff89954451c9f8 [ ] FS: 00007fadee5dd640(0000) GS:ffff899380ec0000(0000) knlGS:0000000000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 00007efc90327b68 CR3: 000000652bb80006 CR4: 00000000007726f0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] PKRU: 55555554 [ ] Call Trace: [ ] <TASK> [ ] ? __warn+0x84/0x140 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] ? report_bug+0x16b/0x180 [ ] ? handle_bug+0x3c/0x70 [ ] ? exc_invalid_op+0x14/0x70 [ ] ? asm_exc_invalid_op+0x16/0x20 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] cifs_call_async+0x1ee/0x330 [cifs] [ ] smb2_async_writev+0x473/0x6f0 [cifs] [ ] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs] [ ] ? cifs_writepages+0x52f/0xbc0 [cifs] [ ] cifs_writepages+0x52f/0xbc0 [cifs] [ ] ? vfs_write+0x1a9/0x470 [ ] do_writepages+0xd5/0x1b0 [ ] ? syscall_exit_work+0xff/0x130 [ ] ? syscall_exit_to_user_mode+0x19/0x40 [ ] ? do_syscall_64+0x6b/0xe0 [ ] filemap_fdatawrite_wbc+0x66/0x90 [ ] __filemap_fdatawrite_range+0x54/0x80 [ ] filemap_write_and_wait_range+0x3e/0xb0 [ ] cifs_flush+0x73/0x120 [cifs] [ ] filp_flush+0x2e/0x80 [ ] __x64_sys_close+0x2e/0x80 [ ] do_syscall_64+0x5f/0xe0 [ ] ? do_numa_page+0x3a6/0x520 [ ] ? __handle_mm_fault+0x2fb/0x650 [ ] ? __count_memcg_events+0x50/0xb0 [ ] ? mm_account_fault+0x6c/0x100 [ ] ? handle_mm_fault+0x138/0x270 [ ] ? do_user_addr_fault+0x35d/0x6a0 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ ] RIP: 0033:0x7fae16303f3b [ ] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [ ] RSP: 002b:00007fadee5db388 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ ] RAX: ffffffffffffffda RBX: 00007fac240977a0 RCX: 00007fae16303f3b [ ] RDX: 00007fae163f79e0 RSI: 00000000fbad2404 RDI: 0000000000000038 [ ] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020 [ ] R10: 00000000002aa212 R11: 0000000000000202 R12: 00007fae163f85e0 [ ] R13: 00007fac670c7b18 R14: 00007fadee5db458 R15: 0000000000000002 [ ] </TASK> [ ] ---[ end trace 0000000000000000 ]--- [ ] CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server [ ] ------------[ cut here ]------------ [ ] kernel BUG at mm/filemap.c:1593! [ ] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ ] CPU: <cpu> PID: <pid> Comm: dask worker [tc Kdump: loaded Tainted: P W OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [ ] Hardware name: Dell Inc. PowerEdge R740, BIOS 2.26.1 01/28/2026 [ ] RIP: 0010:folio_end_writeback+0x7d/0x80 [ ] Code: ff 4d 34 74 12 5d c3 cc cc cc cc f0 80 67 02 fb e8 e8 33 01 00 eb a9 48 89 ef 5d e9 5d 16 01 00 48 89 ee e8 c5 23 02 00 eb d5 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 [ ] RSP: 0018:ffffcb0eb1297ad8 EFLAGS: 00010246 [ ] RAX: 0000000000000b00 RBX: ffff899f43699680 RCX: 0000000000000000 [ ] RDX: ffff893e88be0000 RSI: ffffedc013097e00 RDI: ffff893e88be0000 [ ] RBP: ffffedc013097e00 R08: ffffcb0eb1297aa8 R09: 000000008024001f [ ] R10: 000000000000001c R11: ffff899f43699680 R12: 0000000000000bd8 [ ] R13: 0000000000000000 R14: ffffcb0eb1297c60 R15: ffff89961e9d9800 [ ] FS: 00007fadee5dd640(0000) GS:ffff899380ec0000(0000) knlGS:0000000000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 00007efc90327b68 CR3: 000000652bb80006 CR4: 00000000007726f0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] PKRU: 55555554 [ ] Call Trace: [ ] <TASK> [ ] ? die+0x33/0x90 [ ] ? do_trap+0xdf/0x110 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? do_error_trap+0x65/0x80 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? exc_invalid_op+0x4e/0x70 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? asm_exc_invalid_op+0x16/0x20 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? folio_end_writeback+0x1f/0x80 [ ] cifs_writepages+0x998/0xbc0 [cifs] [ ] do_writepages+0xd5/0x1b0 [ ] ? syscall_exit_work+0xff/0x130 [ ] ? syscall_exit_to_user_mode+0x19/0x40 [ ] ? do_syscall_64+0x6b/0xe0 [ ] filemap_fdatawrite_wbc+0x66/0x90 [ ] __filemap_fdatawrite_range+0x54/0x80 [ ] filemap_write_and_wait_range+0x3e/0xb0 [ ] cifs_flush+0x73/0x120 [cifs] [ ] filp_flush+0x2e/0x80 [ ] __x64_sys_close+0x2e/0x80 [ ] do_syscall_64+0x5f/0xe0 [ ] ? do_numa_page+0x3a6/0x520 [ ] ? __handle_mm_fault+0x2fb/0x650 [ ] ? __count_memcg_events+0x50/0xb0 [ ] ? mm_account_fault+0x6c/0x100 [ ] ? handle_mm_fault+0x138/0x270 [ ] ? do_user_addr_fault+0x35d/0x6a0 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ ] RIP: 0033:0x7fae16303f3b [ ] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [ ] RSP: 002b:00007fadee5db388 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ ] RAX: ffffffffffffffda RBX: 00007fac240977a0 RCX: 00007fae16303f3b [ ] RDX: 00007fae163f79e0 RSI: 00000000fbad2404 RDI: 0000000000000038 [ ] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000020 [ ] R10: 00000000002aa212 R11: 0000000000000202 R12: 00007fae163f85e0 [ ] R13: 00007fac670c7b18 R14: 00007fadee5db458 R15: 0000000000000002 [ ] </TASK> hostB-R750xa-crash-analysis-redacted.txt (16,706 bytes)
# Redacted crash(8) analysis — <hostB> (Dell PowerEdge R750xa), kdump of 2026-06-21.
# Source: crash(8) over vmcore + vmlinux debuginfo for 5.14.0-687.15.1.el9_8.
# Anonymized: <fileserver>, <fileserver-ip>, <hostB>, <svctag-B>, <uid>, <gid>,
# <username>. Nothing else altered. (The crash dump itself carries the real
# NODENAME etc.; this excerpt is the redacted copy for the public bug tracker.)
# Effective mount uses cache=strict (see expanded options below); the cifs stack
# accordingly shows cifs_strict_writev, absent on the cache=none host.
given options via autofs:
sec=krb5,cruid=${UID},uid=${UID},gid=${GID},forceuid,forcegid,iocharset=utf8,vers=3.0,nosuid,nodev,dir_mode=0700,file_mode=0700,noserverino,cache=none
after option expanding:
(rw,nosuid,nodev,relatime,vers=3.0,sec=krb5,cruid=<uid>,cache=strict,upcall_target=app,username=<username>,uid=<uid>,forceuid,gid=<gid>,forcegid,addr=<fileserver-ip>,file_mode=0700,dir_mode=0700,iocharset=utf8,soft,nounix,mapposix,reparse=nfs,nativesocket,symlink=native,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1)
KERNEL: /usr/lib/debug/lib/modules/5.14.0-687.15.1.el9_8.x86_64/vmlinux [TAINTED]
DUMPFILE: vmcore [PARTIAL DUMP]
CPUS: 24
DATE: Sun Jun 21 15:37:55 CEST 2026
UPTIME: 1 days, 02:05:34
LOAD AVERAGE: 14.80, 15.63, 14.23
TASKS: 2508
NODENAME: <hostB>
RELEASE: 5.14.0-687.15.1.el9_8.x86_64
VERSION: #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026
MACHINE: x86_64 (3000 Mhz)
MEMORY: 383.2 GB
PANIC: "kernel BUG at mm/filemap.c:1593!"
PID: 246362
COMMAND: "pt_main_thread"
TASK: ff1f8fe808712340 [THREAD_INFO: ff1f8fe808712340]
CPU: 21
STATE: TASK_RUNNING (PANIC)
1567 /**
1568 * folio_end_writeback - End writeback against a folio.
1569 * @folio: The folio.
1570 */
1571 void folio_end_writeback(struct folio *folio)
1572 {
0xffffffff813791a0 <+0>: call 0xffffffff8107d860 <__fentry__>
0xffffffff813791a9 <+9>: mov %rdi,%rbp
1573 /*
1574 * folio_test_clear_reclaim() could be used here but it is an
1575 * atomic operation and overkill in this particular case. Failing
1576 * to shuffle a folio marked for immediate reclaim is too mild
1577 * a gain to justify taking an atomic operation penalty at the
1578 * end of every folio writeback.
1579 */
1580 if (folio_test_reclaim(folio)) {
0xffffffff813791ac <+12>: test $0x40000,%eax
0xffffffff813791b1 <+17>: jne 0xffffffff813791fe <folio_end_writeback+94>
1581 folio_clear_reclaim(folio);
1582 folio_rotate_reclaimable(folio);
0xffffffff81379203 <+99>: call 0xffffffff8138c5f0 <folio_rotate_reclaimable>
0xffffffff81379208 <+104>: jmp 0xffffffff813791b3 <folio_end_writeback+19>
1583 }
1584
1585 /*
1586 * Writeback does not hold a folio reference of its own, relying
1587 * on truncation to wait for the clearing of PG_writeback.
1588 * But here we must make sure that the folio is not freed and
1589 * reused before the folio_wake().
1590 */
1591 folio_get(folio);
1592 if (!__folio_end_writeback(folio))
0xffffffff813791b7 <+23>: mov %rbp,%rdi
0xffffffff813791ba <+26>: call 0xffffffff813881d0 <__folio_end_writeback>
0xffffffff813791bf <+31>: test %al,%al
0xffffffff813791c1 <+33>: je 0xffffffff8137921d <folio_end_writeback+125>
1593 BUG();
0xffffffff8137921d <+125>: ud2
1594
1595 smp_mb__after_atomic();
1596 folio_wake(folio, PG_writeback);
1597 acct_reclaim_writeback(folio);
1598 folio_put(folio);
1599 }
0xffffffff813791f8 <+88>: pop %rbp
0xffffffff813791f9 <+89>: jmp 0xffffffff81d65cb0 <__x86_return_thunk>
0xffffffff8137920d <+109>: pop %rbp
PID: 246362 TASK: ff1f8fe808712340 CPU: 21 COMMAND: "pt_main_thread"
#0 [ff77d49b26d3f9b0] machine_kexec at ffffffff9cc7f00e
#1 [ff77d49b26d3fa08] __crash_kexec at ffffffff9ce25d8a
#2 [ff77d49b26d3fac8] crash_kexec at ffffffff9ce26370
#3 [ff77d49b26d3fad0] oops_end at ffffffff9cc38fd6
#4 [ff77d49b26d3faf0] do_trap at ffffffff9cc34d8f
#5 [ff77d49b26d3fb40] do_error_trap at ffffffff9cc34e35
#6 [ff77d49b26d3fb80] exc_invalid_op at ffffffff9d94d77e
#7 [ff77d49b26d3fba0] asm_exc_invalid_op at ffffffff9da00b36
[exception RIP: folio_end_writeback+125]
RIP: ffffffff9cf7921d RSP: ff77d49b26d3fc58 RFLAGS: 00010246
RAX: 0000000000000400 RBX: ff1f8fe082bafe00 RCX: 0000000000204008
RDX: 0000000000000001 RSI: 0000000000000206 RDI: ff1f8fe808712340
RBP: ffb7255315772740 R8: 0000000000000206 R9: ff77d49b26d3f9c0
R10: 0000000000000007 R11: ff1f8fe082bafe00 R12: 0000000000000470
R13: 0000000000000000 R14: ff77d49b26d3fde0 R15: ff1f8fb10802db00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#8 [ff77d49b26d3fc60] cifs_writepages at ffffffffc84f75e8 [cifs]
#9 [ff77d49b26d3fd28] do_writepages at ffffffff9cf87cd5
#10 [ff77d49b26d3fdb8] filemap_fdatawrite_wbc at ffffffff9cf774a6
#11 [ff77d49b26d3fdd8] __filemap_fdatawrite_range at ffffffff9cf7c194
#12 [ff77d49b26d3fe50] filemap_write_and_wait_range at ffffffff9cf7c3ee
#13 [ff77d49b26d3fe78] cifs_flush at ffffffffc84f9293 [cifs]
#14 [ff77d49b26d3fe98] filp_flush at ffffffff9d088ace
#15 [ff77d49b26d3feb8] __x64_sys_close at ffffffff9d088b9e
#16 [ff77d49b26d3fed0] do_syscall_64 at ffffffff9d94cf8f
#17 [ff77d49b26d3ff50] entry_SYSCALL_64_after_hwframe at ffffffff9da0012b
RIP: 00007f3e93903f3b RSP: 00007f3e5baff178 RFLAGS: 00000202
RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b
RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e
RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000000
R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0
R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790
ORIG_RAX: 0000000000000003 CS: 0033 SS: 002b
crash> kmem ff1f8fe808712340
CACHE OBJSIZE ALLOCATED TOTAL SLABS SSIZE NAME
ff1f8fb100202300 8968 2508 2679 893 32k task_struct
SLAB MEMORY NODE TOTAL ALLOCATED FREE
ffb725532021c400 ff1f8fe808710000 1 3 3 0
FREE / [ALLOCATED]
[ff1f8fe808712340]
PID: 246362
COMMAND: "pt_main_thread"
TASK: ff1f8fe808712340 [THREAD_INFO: ff1f8fe808712340]
CPU: 21
STATE: TASK_RUNNING (PANIC)
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
ffb725532021c480 3808712000 dead000000000400 0 0 57ffffc0000000
[93933.660360] CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server
[93933.660799] ------------[ cut here ]------------
[93933.660803] refcount_t: underflow; use-after-free.
[93933.660837] WARNING: CPU: 21 PID: 246362 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110
[93933.660878] Modules linked in: binfmt_misc nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm dell_wmi rapl ledtrig_audio intel_cstate sparse_keymap rfkill iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif dell_smbios wmi_bmof dell_wmi_descriptor drm_ttm_helper isst_if_mmio isst_if_mbox_pci intel_uncore ttm mei_me pcspkr video isst_if_common intel_th_gth mei i2c_i801 acpi_power_meter intel_th_pci intel_pch_thermal i2c_smbus ipmi_si intel_vsec intel_th acpi_ipmi ipmi_devintf ipmi_msghandler auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib
[93933.661028] i2c_algo_bit drm_shmem_helper drm_kms_helper ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel drm i40e libata megaraid_sas ghash_clmulni_intel tg3 libie libie_adminq wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse
[93933.661071] CPU: 21 PID: 246362 Comm: pt_main_thread Kdump: loaded Tainted: P OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1
[93933.661079] Hardware name: Dell Inc. PowerEdge R750xa/<svctag-B>, BIOS 1.20.2 01/16/2026
[93933.661084] RIP: 0010:refcount_warn_saturate+0xba/0x110
[93933.661092] Code: 01 01 e8 69 b1 a5 ff 0f 0b c3 cc cc cc cc 80 3d 74 61 c9 01 00 75 85 48 c7 c7 a8 4c 31 9e c6 05 64 61 c9 01 01 e8 46 b1 a5 ff <0f> 0b e9 0f b0 6a 00 80 3d 4f 61 c9 01 00 0f 85 5e ff ff ff 48 c7
[93933.661098] RSP: 0018:ff77d49b26d3fb18 EFLAGS: 00010282
[93933.661104] RAX: 0000000000000000 RBX: ff1f8fe70675eb40 RCX: 0000000000000027
[93933.661109] RDX: 0000000000000027 RSI: 00000000ffff7fff RDI: ff1f900fafaa0f08
[93933.661113] RBP: ff1f8fe078f841c0 R08: 0000000000000000 R09: ff77d49b26d3f9c0
[93933.661116] R10: ff77d49b26d3f9b8 R11: ffffffff9ede2ee8 R12: ff1f8fe078f84000
[93933.661120] R13: ff1f8fe193a26cc0 R14: 00000000ffffff99 R15: ff1f8fe078f841f8
[93933.661123] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000
[93933.661128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[93933.661132] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0
[93933.661135] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[93933.661138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[93933.661141] PKRU: 55555554
[93933.661143] Call Trace:
[93933.661149] <TASK>
[93933.661159] ? __warn+0x84/0x140
[93933.661171] ? refcount_warn_saturate+0xba/0x110
[93933.661179] ? report_bug+0x16b/0x180
[93933.661191] ? handle_bug+0x3c/0x70
[93933.661207] ? exc_invalid_op+0x14/0x70
[93933.661216] ? asm_exc_invalid_op+0x16/0x20
[93933.661232] ? refcount_warn_saturate+0xba/0x110
[93933.661237] ? refcount_warn_saturate+0xba/0x110
[93933.661245] cifs_call_async+0x1ee/0x330 [cifs]
[93933.661498] smb2_async_writev+0x473/0x6f0 [cifs]
[93933.661730] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs]
[93933.661948] ? cifs_writepages+0x52f/0xbc0 [cifs]
[93933.662144] cifs_writepages+0x52f/0xbc0 [cifs]
[93933.662323] ? generic_perform_write+0x14c/0x210
[93933.662334] do_writepages+0xd5/0x1b0
[93933.662348] ? cifs_strict_writev+0x1c4/0x330 [cifs]
[93933.662538] filemap_fdatawrite_wbc+0x66/0x90
[93933.662545] __filemap_fdatawrite_range+0x54/0x80
[93933.662554] filemap_write_and_wait_range+0x3e/0xb0
[93933.662563] cifs_flush+0x73/0x120 [cifs]
[93933.662751] filp_flush+0x2e/0x80
[93933.662761] __x64_sys_close+0x2e/0x80
[93933.662766] do_syscall_64+0x5f/0xe0
[93933.662776] ? do_user_addr_fault+0x35d/0x6a0
[93933.662785] ? clear_bhb_loop+0x40/0x90
[93933.662790] ? clear_bhb_loop+0x40/0x90
[93933.662794] ? clear_bhb_loop+0x40/0x90
[93933.662798] ? clear_bhb_loop+0x40/0x90
[93933.662801] ? clear_bhb_loop+0x40/0x90
[93933.662805] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[93933.662816] RIP: 0033:0x7f3e93903f3b
[93933.662824] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8
[93933.662829] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[93933.662835] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b
[93933.662838] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e
[93933.662841] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[93933.662844] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0
[93933.662847] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790
[93933.662853] </TASK>
[93933.662856] ---[ end trace 0000000000000000 ]---
[93933.662900] ------------[ cut here ]------------
[93933.662903] kernel BUG at mm/filemap.c:1593!
[93933.663301] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[93933.663606] CPU: 21 PID: 246362 Comm: pt_main_thread Kdump: loaded Tainted: P W OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1
[93933.664283] Hardware name: Dell Inc. PowerEdge R750xa/<svctag-B>, BIOS 1.20.2 01/16/2026
[93933.664667] RIP: 0010:folio_end_writeback+0x7d/0x80
[93933.665062] Code: ff 4d 34 74 12 5d c3 cc cc cc cc f0 80 67 02 fb e8 e8 33 01 00 eb a9 48 89 ef 5d e9 5d 16 01 00 48 89 ee e8 c5 23 02 00 eb d5 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44
[93933.665917] RSP: 0018:ff77d49b26d3fc58 EFLAGS: 00010246
[93933.666360] RAX: 0000000000000400 RBX: ff1f8fe082bafe00 RCX: 0000000000204008
[93933.666689] RDX: 0000000000000001 RSI: 0000000000000206 RDI: ff1f8fe808712340
[93933.666948] RBP: ffb7255315772740 R08: 0000000000000206 R09: ff77d49b26d3f9c0
[93933.667201] R10: 0000000000000007 R11: ff1f8fe082bafe00 R12: 0000000000000470
[93933.667464] R13: 0000000000000000 R14: ff77d49b26d3fde0 R15: ff1f8fb10802db00
[93933.667728] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000
[93933.667997] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[93933.668271] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0
[93933.668539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[93933.668809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[93933.669080] PKRU: 55555554
[93933.669346] Call Trace:
[93933.669608] <TASK>
[93933.669869] ? die+0x33/0x90
[93933.670137] ? do_trap+0xdf/0x110
[93933.670405] ? folio_end_writeback+0x7d/0x80
[93933.670677] ? do_error_trap+0x65/0x80
[93933.670949] ? folio_end_writeback+0x7d/0x80
[93933.671222] ? exc_invalid_op+0x4e/0x70
[93933.671509] ? folio_end_writeback+0x7d/0x80
[93933.671784] ? asm_exc_invalid_op+0x16/0x20
[93933.672061] ? folio_end_writeback+0x7d/0x80
[93933.672333] ? folio_end_writeback+0x1f/0x80
[93933.672602] cifs_writepages+0x998/0xbc0 [cifs]
[93933.673028] do_writepages+0xd5/0x1b0
[93933.673310] ? cifs_strict_writev+0x1c4/0x330 [cifs]
[93933.673573] filemap_fdatawrite_wbc+0x66/0x90
[93933.673735] __filemap_fdatawrite_range+0x54/0x80
[93933.673898] filemap_write_and_wait_range+0x3e/0xb0
[93933.674052] cifs_flush+0x73/0x120 [cifs]
[93933.674291] filp_flush+0x2e/0x80
[93933.674447] __x64_sys_close+0x2e/0x80
[93933.674599] do_syscall_64+0x5f/0xe0
[93933.674752] ? do_user_addr_fault+0x35d/0x6a0
[93933.674909] ? clear_bhb_loop+0x40/0x90
[93933.675062] ? clear_bhb_loop+0x40/0x90
[93933.675213] ? clear_bhb_loop+0x40/0x90
[93933.675364] ? clear_bhb_loop+0x40/0x90
[93933.675509] ? clear_bhb_loop+0x40/0x90
[93933.675650] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[93933.675795] RIP: 0033:0x7f3e93903f3b
[93933.675935] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8
[93933.676221] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[93933.676366] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b
[93933.676506] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e
[93933.676642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[93933.676774] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0
[93933.676905] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790
[93933.677038] </TASK>
[93933.677167] Modules linked in: binfmt_misc nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm dell_wmi rapl ledtrig_audio intel_cstate sparse_keymap rfkill iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif dell_smbios wmi_bmof dell_wmi_descriptor drm_ttm_helper isst_if_mmio isst_if_mbox_pci intel_uncore ttm mei_me pcspkr video isst_if_common intel_th_gth mei i2c_i801 acpi_power_meter intel_th_pci intel_pch_thermal i2c_smbus ipmi_si intel_vsec intel_th acpi_ipmi ipmi_devintf ipmi_msghandler auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib
[93933.677219] i2c_algo_bit drm_shmem_helper drm_kms_helper ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel drm i40e libata megaraid_sas ghash_clmulni_intel tg3 libie libie_adminq wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse
hostB-R750xa-panic-redacted.txt (8,026 bytes)
# Redacted kdump excerpt — <hostB> (Dell PowerEdge R750xa) # Contents: kernel banner, 'Modules linked in', and the two panic traces only. # Internal/personal identifiers anonymized: <fileserver> <user> <hostA>/<hostB> <mac>; timestamps, PIDs and CPU ids neutralized. [ 0.000000] Linux version 5.14.0-687.15.1.el9_8.x86_64 (mockbuild@x64-builder01.almalinux.org) (gcc (GCC) 11.5.0 20240719 (Red Hat 11.5.0-14), GNU ld version 2.35.2-72.el9) #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026 [ ] CIFS: VFS: \\<fileserver> Error -32 sending data on socket to server [ ] ------------[ cut here ]------------ [ ] refcount_t: underflow; use-after-free. [ ] WARNING: CPU: <cpu> PID: <pid> at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ ] Modules linked in: binfmt_misc nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm dell_wmi rapl ledtrig_audio intel_cstate sparse_keymap rfkill iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif dell_smbios wmi_bmof dell_wmi_descriptor drm_ttm_helper isst_if_mmio isst_if_mbox_pci intel_uncore ttm mei_me pcspkr video isst_if_common intel_th_gth mei i2c_i801 acpi_power_meter intel_th_pci intel_pch_thermal i2c_smbus ipmi_si intel_vsec intel_th acpi_ipmi ipmi_devintf ipmi_msghandler auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib [ ] i2c_algo_bit drm_shmem_helper drm_kms_helper ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel drm i40e libata megaraid_sas ghash_clmulni_intel tg3 libie libie_adminq wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse [ ] CPU: <cpu> PID: <pid> Comm: pt_main_thread Kdump: loaded Tainted: P OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [ ] Hardware name: Dell Inc. PowerEdge R750xa, BIOS 1.20.2 01/16/2026 [ ] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ ] Code: 01 01 e8 69 b1 a5 ff 0f 0b c3 cc cc cc cc 80 3d 74 61 c9 01 00 75 85 48 c7 c7 a8 4c 31 9e c6 05 64 61 c9 01 01 e8 46 b1 a5 ff <0f> 0b e9 0f b0 6a 00 80 3d 4f 61 c9 01 00 0f 85 5e ff ff ff 48 c7 [ ] RSP: 0018:ff77d49b26d3fb18 EFLAGS: 00010282 [ ] RAX: 0000000000000000 RBX: ff1f8fe70675eb40 RCX: 0000000000000027 [ ] RDX: 0000000000000027 RSI: 00000000ffff7fff RDI: ff1f900fafaa0f08 [ ] RBP: ff1f8fe078f841c0 R08: 0000000000000000 R09: ff77d49b26d3f9c0 [ ] R10: ff77d49b26d3f9b8 R11: ffffffff9ede2ee8 R12: ff1f8fe078f84000 [ ] R13: ff1f8fe193a26cc0 R14: 00000000ffffff99 R15: ff1f8fe078f841f8 [ ] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] PKRU: 55555554 [ ] Call Trace: [ ] <TASK> [ ] ? __warn+0x84/0x140 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] ? report_bug+0x16b/0x180 [ ] ? handle_bug+0x3c/0x70 [ ] ? exc_invalid_op+0x14/0x70 [ ] ? asm_exc_invalid_op+0x16/0x20 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] ? refcount_warn_saturate+0xba/0x110 [ ] cifs_call_async+0x1ee/0x330 [cifs] [ ] smb2_async_writev+0x473/0x6f0 [cifs] [ ] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs] [ ] ? cifs_writepages+0x52f/0xbc0 [cifs] [ ] cifs_writepages+0x52f/0xbc0 [cifs] [ ] ? generic_perform_write+0x14c/0x210 [ ] do_writepages+0xd5/0x1b0 [ ] ? cifs_strict_writev+0x1c4/0x330 [cifs] [ ] filemap_fdatawrite_wbc+0x66/0x90 [ ] __filemap_fdatawrite_range+0x54/0x80 [ ] filemap_write_and_wait_range+0x3e/0xb0 [ ] cifs_flush+0x73/0x120 [cifs] [ ] filp_flush+0x2e/0x80 [ ] __x64_sys_close+0x2e/0x80 [ ] do_syscall_64+0x5f/0xe0 [ ] ? do_user_addr_fault+0x35d/0x6a0 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ ] RIP: 0033:0x7f3e93903f3b [ ] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [ ] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ ] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b [ ] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e [ ] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ ] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0 [ ] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790 [ ] </TASK> [ ] ---[ end trace 0000000000000000 ]--- [ ] ------------[ cut here ]------------ [ ] kernel BUG at mm/filemap.c:1593! [ ] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ ] CPU: <cpu> PID: <pid> Comm: pt_main_thread Kdump: loaded Tainted: P W OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [ ] Hardware name: Dell Inc. PowerEdge R750xa, BIOS 1.20.2 01/16/2026 [ ] RIP: 0010:folio_end_writeback+0x7d/0x80 [ ] Code: ff 4d 34 74 12 5d c3 cc cc cc cc f0 80 67 02 fb e8 e8 33 01 00 eb a9 48 89 ef 5d e9 5d 16 01 00 48 89 ee e8 c5 23 02 00 eb d5 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 [ ] RSP: 0018:ff77d49b26d3fc58 EFLAGS: 00010246 [ ] RAX: 0000000000000400 RBX: ff1f8fe082bafe00 RCX: 0000000000204008 [ ] RDX: 0000000000000001 RSI: 0000000000000206 RDI: ff1f8fe808712340 [ ] RBP: ffb7255315772740 R08: 0000000000000206 R09: ff77d49b26d3f9c0 [ ] R10: 0000000000000007 R11: ff1f8fe082bafe00 R12: 0000000000000470 [ ] R13: 0000000000000000 R14: ff77d49b26d3fde0 R15: ff1f8fb10802db00 [ ] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000 [ ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ ] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0 [ ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ ] PKRU: 55555554 [ ] Call Trace: [ ] <TASK> [ ] ? die+0x33/0x90 [ ] ? do_trap+0xdf/0x110 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? do_error_trap+0x65/0x80 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? exc_invalid_op+0x4e/0x70 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? asm_exc_invalid_op+0x16/0x20 [ ] ? folio_end_writeback+0x7d/0x80 [ ] ? folio_end_writeback+0x1f/0x80 [ ] cifs_writepages+0x998/0xbc0 [cifs] [ ] do_writepages+0xd5/0x1b0 [ ] ? cifs_strict_writev+0x1c4/0x330 [cifs] [ ] filemap_fdatawrite_wbc+0x66/0x90 [ ] __filemap_fdatawrite_range+0x54/0x80 [ ] filemap_write_and_wait_range+0x3e/0xb0 [ ] cifs_flush+0x73/0x120 [cifs] [ ] filp_flush+0x2e/0x80 [ ] __x64_sys_close+0x2e/0x80 [ ] do_syscall_64+0x5f/0xe0 [ ] ? do_user_addr_fault+0x35d/0x6a0 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] ? clear_bhb_loop+0x40/0x90 [ ] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ ] RIP: 0033:0x7f3e93903f3b [ ] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [ ] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ ] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b [ ] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e [ ] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ ] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0 [ ] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790 [ ] </TASK> | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-06-26 11:21 | aslefnad7 | New Issue | |
| 2026-06-26 11:21 | aslefnad7 | File Added: hostA-R740-crash-analysis-redacted.txt | |
| 2026-06-26 11:21 | aslefnad7 | File Added: hostA-R740-panic-redacted.txt | |
| 2026-06-26 11:21 | aslefnad7 | File Added: hostB-R750xa-crash-analysis-redacted.txt | |
| 2026-06-26 11:21 | aslefnad7 | File Added: hostB-R750xa-panic-redacted.txt | |
| 2026-07-13 12:42 | aslefnad7 | Issue cloned: 0000649 |
