Title: nvidia 580.126.18 crashes with GPF in __kmalloc_noprof during module init on kernel 6.18.14+ (Fedora 43, RTX 4060 Mobile)
System:
- Laptop: ASUS TUF Gaming A14 FA401WV
- CPU: AMD Ryzen AI 9 HX 370 (Zen 5, Strix Point)
- GPU: NVIDIA GeForce RTX 4060 Max-Q / Mobile [10de:28e0] (rev a1)
- iGPU: AMD Radeon 890M (amdgpu, hybrid graphics via ATPX)
- RAM: 32GB
- BIOS: FA401WV.319 (2025-03-25)
- OS: Fedora 43 (Rawhide → Stable)
- Driver: akmod-nvidia-580.126.18-1.fc43 (open kernel modules, RPM Fusion)
- Kernel (broken): 6.18.16-200.fc43.x86_64 (also reproduced on 6.18.14)
- Kernel (works): 6.18.12-200.fc43.x86_64
Problem:
The nvidia driver crashes during module initialization (nv_drm_probe_devices) with a general protection fault in __kmalloc_noprof, called from nvidia’s os_alloc_mem. This happens non-deterministically — roughly 3 out of 4 boot attempts crash, and the system never reaches the login screen (GDM starts but nvidia_drm fails to set up the display).
The crash is a race condition — different garbage non-canonical addresses appear each time (0x747b6c1f23fb25a1, 0xd47ffec1311bdfa2), suggesting slab freelist pointer corruption. The same driver version (580.126.18) works reliably on kernel 6.18.12.
I suspect this is related to the slab allocator “sheaves” changes introduced in kernel 6.18 (kfree_rcu batching via kvfree_rcu_barrier()), which had a known performance regression affecting module loading. The corruption may be triggered by nvidia’s os_alloc_mem → kmalloc path racing with slab cache operations during the init_module phase.
Reproduction:
- Boot kernel 6.18.16 on the above hardware
- nvidia_drm loads via udev during boot
- ~75% of boots crash with the oops below; ~25% succeed
Crash pattern across 4 consecutive boots (all kernel 6.18.16):
| Boot |
Crash? |
Signature |
| 1 |
Yes — Oops #1, #2, #3 |
GPF in __kmalloc_noprof + page fault in _mapInsertBase [nvidia] |
| 2 |
Yes — Failed to allocate NvKmsKapiDevice |
oops deleted by abrt |
| 3 |
Yes — Oops #1, #2 |
GPF in __kmalloc_noprof + page fault in _mapInsertBase [nvidia] |
| 4 |
No |
nvidia 580.126.18 loaded successfully |
Oops from boot 3 (representative):
NVRM: Xid (PCI:0000:64:00): 31, pid=1278, name=(udev-worker), channel 0x00000003, intr 00000000. MMU Fault: ENGINE GR0_PBDMA0 HUBCLIENT_ESC faulted @ 0x59_f8cc2000. Fault is of type FAULT_PDE ACCESS_TYPE_VIRT_READ
Oops: general protection fault, probably for non-canonical address 0xd47ffec1311bdfa2: 0000 [#1] SMP NOPTI
CPU: 15 UID: 0 PID: 1278 Comm: (udev-worker) Tainted: G OE 6.18.16-200.fc43.x86_64 #1 PREEMPT(lazy)
Hardware name: ASUSTeK COMPUTER INC. ASUS TUF Gaming A14 FA401WV_FA401WV/FA401WV, BIOS FA401WV.319 03/25/2025
RIP: 0010:__kmalloc_noprof+0x4bc/0x780
Call Trace:
<TASK>
os_alloc_mem+0x104/0x120 [nvidia]
_portMemAllocNonPagedUntracked+0x2c/0x40 [nvidia]
_portMemAllocatorAlloc+0x2b/0xe0 [nvidia]
multimapInsertItemNew_IMPL+0x40/0xa0 [nvidia]
multimapInsertItemValue_IMPL+0x20/0x80 [nvidia]
indexAdd+0x4c/0xa0 [nvidia]
_clientAllocResourceHelper+0x539/0x660 [nvidia]
serverAllocResourceUnderLock+0x33b/0xa10 [nvidia]
serverAllocResource+0x2b4/0x5c0 [nvidia]
rmapiAllocWithSecInfo+0x1f0/0x420 [nvidia]
rmapiAllocWithSecInfoTls+0x65/0x90 [nvidia]
_nv04AllocWithAccess+0x7c/0xb0 [nvidia]
nvkms_call_rm+0x4c/0x80 [nvidia_modeset]
nvRmApiAlloc+0x46/0x50 [nvidia_modeset]
nvPushAllocDevice+0x3a9/0x470 [nvidia_modeset]
nvAllocNvPushDevice+0xe2/0x150 [nvidia_modeset]
nvRmAllocDeviceEvo+0xb3a/0xbe0 [nvidia_modeset]
nvAllocDevEvo+0xca/0x390 [nvidia_modeset]
AllocDevice+0x55e/0x590 [nvidia_modeset]
nvKmsIoctl+0xf2/0x240 [nvidia_modeset]
nvkms_ioctl_from_kapi+0x6f/0xe0 [nvidia_modeset]
AllocateDevice+0x313/0x760 [nvidia_modeset]
nv_drm_dev_load+0xb0/0x45d [nvidia_drm]
nv_drm_register_drm_device.cold+0x15/0x10d [nvidia_drm]
EnumerateGpus+0x151/0x160 [nvidia_modeset]
nv_drm_probe_devices+0x5c/0x70 [nvidia_drm]
do_one_initcall+0x5b/0x300
do_init_module+0x84/0x280
init_module_from_file+0x8a/0xe0
idempotent_init_module+0x114/0x310
__x64_sys_finit_module+0x6d/0xd0
</TASK>
Second oops (same boot, nvidia worker thread):
BUG: unable to handle page fault for address: ffffcf4682aab188
Oops: Oops: 0000 [#2] SMP NOPTI
CPU: 18 UID: 0 PID: 1546 Comm: nv_queue Tainted: G D OE
RIP: 0010:_mapInsertBase+0x3c/0x310 [nvidia]
Workarounds tried:
- Rebooting until it works (~1 in 4 boots succeed)
- Kernel 6.18.12 is fully stable with the same driver version
Requested: Fix for compatibility with kernel 6.18.14+ slab allocator changes, or guidance on whether NVreg_EnableGpuFirmware=0 or other module parameters would help avoid this race.