Hi,

Le jeudi 19 mars 2026 à 01:18 +0100, Marek Marczykowski-Górecki a écrit :
> Hello,
> 
> When testing 7.0-rc4 (and also got it with 7.0-rc1), I got page
> allocation failure in uvcvideo when using v4l2 camera in a VM. The setup
> is rather memory constrained - it's a HVM with just 300MB of memory
> running on Xen, with PCI passthrough of USB controllers (to which an USB
> camera is connected). But the very same setup works just fine with older
> kernel (last known good is 6.19.5, built with the same config).
> 
> I'm not exactly sure if uvcvideo is really to blame here, or is it just
> a victim of something else using more memory. Any advice how to check
> for that?

I've seen the same backtrace this morning but on 6.19.7-200.fc43.x86_64 and
through Pipewire instead of GStreamer. I think that rules out the userspace. To
me it seems quite likely a UVC regression that got backported).

Nicolas

> 
> The specific error is:
> 
>     [  739.040844] systemd-journald[251]: Under memory pressure, flushing
> caches.
>     [  739.193589] v4l2src0:src: page allocation failure: order:5,
> mode:0xcc4(GFP_KERNEL|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0
>     [  739.193645] CPU: 0 UID: 1000 PID: 1305 Comm: v4l2src0:src Not tainted
> 7.0.0-0.rc4.1.qubes.1001.fc41.x86_64 #1 PREEMPT(full) 
>     [  739.193648] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
>     [  739.193649] Call Trace:
>     [  739.193652]  <TASK>
>     [  739.193656]  dump_stack_lvl+0x5d/0x80
>     [  739.193661]  warn_alloc+0x162/0x190
>     [  739.193665]  ? __alloc_pages_direct_compact+0x1bc/0x220
>     [  739.193669]  __alloc_pages_slowpath.constprop.0+0x4ea/0xb30
>     [  739.193672]  ? kernfs_activate+0x4c/0x60
>     [  739.193676]  __alloc_frozen_pages_noprof+0x2ff/0x340
>     [  739.193679]  __alloc_pages_noprof+0xe/0x20
>     [  739.193682]  __dma_direct_alloc_pages.isra.0+0x183/0x310
>     [  739.193688]  dma_direct_alloc_pages+0x3f/0x190
>     [  739.193693]  dma_alloc_noncontiguous+0xdd/0x290
>     [  739.193698]  ? usb_create_ep_devs+0xab/0x100
>     [  739.193701]  usb_alloc_noncoherent+0x45/0xa0
>     [  739.193709]  uvc_alloc_urb_buffers.part.0+0x93/0x130 [uvcvideo]
>     [  739.193722]  uvc_video_start_transfer+0x19d/0x4e0 [uvcvideo]
>     [  739.193735]  uvc_video_start_streaming+0xab/0x100 [uvcvideo]
>     [  739.193744]  uvc_start_streaming_video+0xec/0x110 [uvcvideo]
>     [  739.193752]  vb2_start_streaming+0x63/0x130 [videobuf2_common]
>     [  739.193761]  vb2_core_streamon+0x98/0xf0 [videobuf2_common]
>     [  739.193767]  ? vb2_ioctl_streamon+0x15/0x60 [videobuf2_v4l2]
>     [  739.193773]  __video_do_ioctl+0x419/0x540 [videodev]
>     [  739.193799]  video_usercopy+0x23b/0x630 [videodev]
>     [  739.193819]  ? __pfx___video_do_ioctl+0x10/0x10 [videodev]
>     [  739.193836]  v4l2_ioctl+0x6b/0xa0 [videodev]
>     [  739.193851]  __x64_sys_ioctl+0x96/0xe0
>     [  739.193855]  do_syscall_64+0x120/0x6c0
>     [  739.193859]  ? do_read_fault+0xf5/0x220
>     [  739.193863]  ? do_fault+0x148/0x270
>     [  739.193865]  ? __handle_mm_fault+0x470/0x6c0
>     [  739.193868]  ? count_memcg_events+0xeb/0x1b0
>     [  739.193871]  ? handle_mm_fault+0x220/0x340
>     [  739.193873]  ? do_user_addr_fault+0x1e5/0x7f0
>     [  739.193876]  ? arch_exit_to_user_mode_prepare.isra.0+0x9f/0xe0
>     [  739.193880]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>     [  739.193883] RIP: 0033:0x738e787000ed
>     [  739.193886] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45
> b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89>
> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
>     [  739.193888] RSP: 002b:0000738e730e6a00 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000010
>     [  739.193890] RAX: ffffffffffffffda RBX: 0000738e64008850 RCX:
> 0000738e787000ed
>     [  739.193892] RDX: 000059d3df721cf0 RSI: 0000000040045612 RDI:
> 0000000000000010
>     [  739.193893] RBP: 0000738e730e6a50 R08: 0000738e6400ae40 R09:
> 0000000000000000
>     [  739.193894] R10: 0000738e6400ae30 R11: 0000000000000246 R12:
> 0000000000000000
>     [  739.193895] R13: 0000738e640012d0 R14: 0000738e64008850 R15:
> 0000000000000002
>     [  739.193897]  </TASK>
>     [  739.193907] Mem-Info:
>     [  739.194897] active_anon:362 inactive_anon:3172 isolated_anon:0
>     [  739.194897]  active_file:2498 inactive_file:11687 isolated_file:1
>     [  739.194897]  unevictable:0 dirty:0 writeback:4
>     [  739.194897]  slab_reclaimable:3707 slab_unreclaimable:10022
>     [  739.194897]  mapped:4710 shmem:9 pagetables:1021
>     [  739.194897]  sec_pagetables:0 bounce:0
>     [  739.194897]  kernel_misc_reclaimable:0
>     [  739.194897]  free:3452 free_pcp:1 free_cma:0
>     [  739.195008] Node 0 active_anon:1448kB inactive_anon:12688kB
> active_file:9992kB inactive_file:46748kB unevictable:0kB isolated(anon):0kB
> isolated(file):4kB mapped:18840kB dirty:0kB writeback:16kB shmem:36kB
> shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:2416kB
> pagetables:4084kB sec_pagetables:0kB all_unreclaimable? no Balloon:16384kB
>     [  739.195097] Node 0 DMA free:2828kB boost:0kB min:132kB low:164kB
> high:196kB reserved_highatomic:0KB free_highatomic:0KB active_anon:224kB
> inactive_anon:940kB active_file:1360kB inactive_file:2408kB unevictable:0kB
> writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB
> bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
>     [  739.195186] lowmem_reserve[]: 0 195 195 195 195
>     [  739.196280] Node 0 DMA32 free:14880kB boost:3856kB min:5572kB
> low:6000kB high:6428kB reserved_highatomic:0KB free_highatomic:0KB
> active_anon:1224kB inactive_anon:11728kB active_file:8632kB
> inactive_file:40024kB unevictable:0kB writepending:16kB zspages:0kB
> present:274348kB managed:200080kB mlocked:0kB bounce:0kB free_pcp:316kB
> local_pcp:236kB free_cma:0kB
>     [  739.196372] lowmem_reserve[]: 0 0 0 0 0
>     [  739.196388] Node 0 DMA: 193*4kB (UM) 213*8kB (UM) 22*16kB (UM) 0*32kB
> 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2828kB
>     [  739.196433] Node 0 DMA32: 1631*4kB (UME) 764*8kB (UME) 138*16kB (UME)
> 8*32kB (UM) 3*64kB (M) 1*128kB (M) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB
> = 15420kB
>     [  739.196487] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0
> hugepages_size=2048kB
>     [  739.196514] 14914 total pagecache pages
>     [  739.196527] 2073 pages in swap cache
>     [  739.196539] Free swap  = 961672kB
>     [  739.196551] Total swap = 1048572kB
>     [  739.196563] 72585 pages RAM
>     [  739.196572] 0 pages HighMem/MovableOnly
>     [  739.196584] 18725 pages reserved
>     [  739.196596] 0 pages cma reserved
>     [  739.196608] 0 pages hwpoisoned
>     [  739.196620] Memory cgroup min protection 0kB -- low protection 0kB
>     [  739.196627] ------------[ cut here ]------------
> 
> Additionally, this failure isn't handled gracefully, it's followed with:
> 
>     [  739.196672] UBSAN: shift-out-of-bounds in /builddir/build/BUILD/kernel-
> latest-7.0-build/kernel-latest-7.0/linux-7.0-rc4/mm/page_alloc.c:1403:22
>     [  739.196710] shift exponent 52 is too large for 32-bit type 'int'
>     [  739.196730] CPU: 1 UID: 1000 PID: 1305 Comm: v4l2src0:src Not tainted
> 7.0.0-0.rc4.1.qubes.1001.fc41.x86_64 #1 PREEMPT(full) 
>     [  739.196733] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
>     [  739.196734] Call Trace:
>     [  739.196737]  <TASK>
>     [  739.196739]  dump_stack_lvl+0x5d/0x80
>     [  739.196744]  ubsan_epilogue+0x5/0x2b
>     [  739.196746]  __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6
>     [  739.196749]  __free_pages_ok.cold+0x13/0xa8
>     [  739.196753]  dma_free_noncontiguous+0xbf/0xe0
>     [  739.196756]  ? usb_free_noncoherent+0x3a/0x60
>     [  739.196761]  uvc_free_urb_buffers+0x38/0x90 [uvcvideo]
>     [  739.196773]  uvc_alloc_urb_buffers.part.0+0xe6/0x130 [uvcvideo]
>     [  739.196781]  uvc_video_start_transfer+0x19d/0x4e0 [uvcvideo]
>     [  739.196789]  uvc_video_start_streaming+0xab/0x100 [uvcvideo]
>     [  739.196797]  uvc_start_streaming_video+0xec/0x110 [uvcvideo]
>     [  739.196806]  vb2_start_streaming+0x63/0x130 [videobuf2_common]
>     [  739.196813]  vb2_core_streamon+0x98/0xf0 [videobuf2_common]
>     [  739.196819]  ? vb2_ioctl_streamon+0x15/0x60 [videobuf2_v4l2]
>     [  739.196824]  __video_do_ioctl+0x419/0x540 [videodev]
>     [  739.196847]  video_usercopy+0x23b/0x630 [videodev]
>     [  739.196863]  ? __pfx___video_do_ioctl+0x10/0x10 [videodev]
>     [  739.196880]  v4l2_ioctl+0x6b/0xa0 [videodev]
>     [  739.196895]  __x64_sys_ioctl+0x96/0xe0
>     [  739.196898]  do_syscall_64+0x120/0x6c0
>     [  739.196902]  ? do_read_fault+0xf5/0x220
>     [  739.196906]  ? do_fault+0x148/0x270
>     [  739.196908]  ? __handle_mm_fault+0x470/0x6c0
>     [  739.196911]  ? count_memcg_events+0xeb/0x1b0
>     [  739.196914]  ? handle_mm_fault+0x220/0x340
>     [  739.196916]  ? do_user_addr_fault+0x1e5/0x7f0
>     [  739.196920]  ? arch_exit_to_user_mode_prepare.isra.0+0x9f/0xe0
>     [  739.196924]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>     [  739.196926] RIP: 0033:0x738e787000ed
>     [  739.196929] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45
> b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89>
> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
>     [  739.196930] RSP: 002b:0000738e730e6a00 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000010
>     [  739.196933] RAX: ffffffffffffffda RBX: 0000738e64008850 RCX:
> 0000738e787000ed
>     [  739.196934] RDX: 000059d3df721cf0 RSI: 0000000040045612 RDI:
> 0000000000000010
>     [  739.196935] RBP: 0000738e730e6a50 R08: 0000738e6400ae40 R09:
> 0000000000000000
>     [  739.196936] R10: 0000738e6400ae30 R11: 0000000000000246 R12:
> 0000000000000000
>     [  739.196937] R13: 0000738e640012d0 R14: 0000738e64008850 R15:
> 0000000000000002
>     [  739.196939]  </TASK>
>     [  739.196940] ---[ end trace ]---
>     [  739.197835] BUG: Bad page state in process v4l2src0:src  pfn:009a0
>     [  739.198028] page: refcount:0 mapcount:0 mapping:0000000000000000
> index:0x2a pfn:0x9a0
>     [  739.198054] flags: 0x7ffffc0000000(node=0|zone=0|lastcpupid=0x1fffff)
>     [  739.198074] page_type: f0(buddy)
>     [  739.198088] raw: 0007ffffc0000000 fffffac1c0026a08 fffffac1c0025e08
> 0000000000000000
>     [  739.198111] raw: 000000000000002a 0000000000000002 00000000f0000000
> 0000000000000000
>     [  739.198133] page dumped because: nonzero mapcount
>     [  739.198149] Modules linked in: nft_reject_ipv6 nf_reject_ipv6
> nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_nat
> nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables uvcvideo ath3k btusb
> btmtk uvc videobuf2_vmalloc btrtl videobuf2_memops videobuf2_v4l2 cdc_mbim
> btbcm cdc_ncm videobuf2_common btintel cdc_ether usbnet videodev bluetooth mii
> cdc_wdm mc rfkill cdc_acm joydev intel_rapl_msr intel_rapl_common
> ghash_clmulni_intel xhci_pci xhci_hcd ehci_pci ehci_hcd pcspkr i2c_piix4
> ata_generic pata_acpi i2c_smbus serio_raw xen_scsiback target_core_mod
> xen_netback xen_privcmd xen_gntdev xen_gntalloc xen_blkback xen_evtchn i2c_dev
> fuse loop nfnetlink overlay xen_blkfront
>     [  739.198472] CPU: 1 UID: 1000 PID: 1305 Comm: v4l2src0:src Not tainted
> 7.0.0-0.rc4.1.qubes.1001.fc41.x86_64 #1 PREEMPT(full) 
>     [  739.198475] Hardware name: Xen HVM domU, BIOS 4.19.4 03/17/2026
>     [  739.198477] Call Trace:
>     [  739.198479]  <TASK>
>     [  739.198480]  dump_stack_lvl+0x5d/0x80
>     [  739.198485]  bad_page.cold+0x7a/0x91
>     [  739.198488]  __free_pages_ok+0x481/0x680
>     [  739.198491]  dma_free_noncontiguous+0xbf/0xe0
>     [  739.198494]  ? usb_free_noncoherent+0x3a/0x60
>     [  739.198497]  uvc_free_urb_buffers+0x38/0x90 [uvcvideo]
>     [  739.198507]  uvc_alloc_urb_buffers.part.0+0xe6/0x130 [uvcvideo]
>     [  739.198515]  uvc_video_start_transfer+0x19d/0x4e0 [uvcvideo]
>     [  739.198523]  uvc_video_start_streaming+0xab/0x100 [uvcvideo]
>     [  739.198531]  uvc_start_streaming_video+0xec/0x110 [uvcvideo]
>     [  739.198539]  vb2_start_streaming+0x63/0x130 [videobuf2_common]
>     [  739.198546]  vb2_core_streamon+0x98/0xf0 [videobuf2_common]
>     [  739.198551]  ? vb2_ioctl_streamon+0x15/0x60 [videobuf2_v4l2]
>     [  739.198555]  __video_do_ioctl+0x419/0x540 [videodev]
>     [  739.198574]  video_usercopy+0x23b/0x630 [videodev]
>     [  739.198590]  ? __pfx___video_do_ioctl+0x10/0x10 [videodev]
>     [  739.198607]  v4l2_ioctl+0x6b/0xa0 [videodev]
>     [  739.198622]  __x64_sys_ioctl+0x96/0xe0
>     [  739.198625]  do_syscall_64+0x120/0x6c0
>     [  739.198629]  ? do_read_fault+0xf5/0x220
>     [  739.198632]  ? do_fault+0x148/0x270
>     [  739.198635]  ? __handle_mm_fault+0x470/0x6c0
>     [  739.198637]  ? count_memcg_events+0xeb/0x1b0
>     [  739.198640]  ? handle_mm_fault+0x220/0x340
>     [  739.198642]  ? do_user_addr_fault+0x1e5/0x7f0
>     [  739.198645]  ? arch_exit_to_user_mode_prepare.isra.0+0x9f/0xe0
>     [  739.198648]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>     [  739.198651] RIP: 0033:0x738e787000ed
>     [  739.198653] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45
> b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89>
> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
>     [  739.198654] RSP: 002b:0000738e730e6a00 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000010
>     [  739.198656] RAX: ffffffffffffffda RBX: 0000738e64008850 RCX:
> 0000738e787000ed
>     [  739.198657] RDX: 000059d3df721cf0 RSI: 0000000040045612 RDI:
> 0000000000000010
>     [  739.198658] RBP: 0000738e730e6a50 R08: 0000738e6400ae40 R09:
> 0000000000000000
>     [  739.198659] R10: 0000738e6400ae30 R11: 0000000000000246 R12:
> 0000000000000000
>     [  739.198660] R13: 0000738e640012d0 R14: 0000738e64008850 R15:
> 0000000000000002
>     [  739.198662]  </TASK>
>     [  739.198663] Disabling lock debugging due to kernel taint
> 
> And eventually kernel panic:
> 
>     [  740.464422] BUG: unable to handle page fault for address:
> fffffac1c0800000
>     [  740.464454] #PF: supervisor read access in kernel mode
>     [  740.464471] #PF: error_code(0x0000) - not-present page
>     [  740.464488] PGD 11be0067 P4D 11be0067 PUD 1148f067 PMD 0 
> 
> Full console log is at:
> https://gist.github.com/marmarek/5d839f419b1d56e71a48e74ae66f0e7a