Bug 2537121

Summary: Kernel trace with 7.2.6-200.fc44.x86_64: sof_ipc4_prepare_copier_module shift-out-of-bounds
Product: [Fedora] Fedora Reporter: Bojan Smojver <bojan>
Component: kernelAssignee: Justin M. Forbes <jforbes>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 44CC: acaringi, adscvr, airlied, hans, hpa, jforbes, jkysela, kernel-maint, linville, masami256, mchehab, nickolasjcarr, ptalbert, steved, suraj.ghimire7
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-30 08:09:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Bojan Smojver 2026-09-19 04:26:44 UTC 
1. Please describe the problem:

Updated to latest updates-testing, which also includes https://bodhi.fedoraproject.org/updates/FEDORA-2026-63df5a1660 (not entirely sure whether it's related) and kernel started emitting a trace

2. What is the Version-Release number of the kernel:

7.2.6-200.fc44.x86_64


3. Did it work previously in Fedora? If so, what kernel version did the issue
   *first* appear?  Old kernels are available for download at
   https://koji.fedoraproject.org/koji/packageinfo?packageID=8 :

I did not see this trace before with this or any other kernel.

4. Can you reproduce this issue? If so, please provide the steps to reproduce
   the issue below:

Boot the kernel on ThinkPad T14s Gen 7 Intel, with alsa-sof-firmware-2026.09-1.fc44 installed?

5. Does this problem occur with the latest Rawhide kernel? To install the
   Rawhide kernel, run ``sudo dnf install fedora-repos-rawhide`` followed by
   ``sudo dnf update --enablerepo=rawhide kernel``:

Did not try.

6. Are you running any modules that not shipped with directly Fedora's kernel?:

No.

7. Please attach the kernel logs. You can get the complete kernel log
   for a boot with ``journalctl --no-hostname -k > dmesg.txt``. If the
   issue occurred on a previous boot, use the journalctl ``-b`` flag.

[   12.315047] ------------[ cut here ]------------
[   12.315052] UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2365:13
[   12.315054] shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'
[   12.315057] CPU: 1 UID: 60578 PID: 1689 Comm: wireplumber Not tainted 7.2.6-200.fc44.x86_64 #1 PREEMPT(lazy) 
[   12.315060] Hardware name: LENOVO 21YUCTO1WW/21YUCTO1WW, BIOS N4UET24W (1.07 ) 07/20/2026
[   12.315061] Call Trace:
[   12.315064]  <TASK>
[   12.315068]  dump_stack_lvl+0x5d/0x80
[   12.315074]  ubsan_epilogue+0x5/0x2b
[   12.315077]  __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
[   12.315085]  sof_ipc4_prepare_copier_module.cold+0xfd/0x13f [snd_sof]
[   12.315113]  ? dapm_invalidate_paths_ep+0xd5/0x1f0 [snd_soc_core]
[   12.315133]  ? __pfx_sof_ipc4_prepare_copier_module+0x10/0x10 [snd_sof]
[   12.315152]  sof_prepare_widgets_in_path+0x1c9/0x250 [snd_sof]
[   12.315169]  ? dapm_is_connected_input_ep.part.0+0xf9/0x1b0 [snd_soc_core]
[   12.315185]  sof_walk_widgets_in_order+0x19a/0x280 [snd_sof]
[   12.315203]  sof_pcm_hw_params+0x440/0x660 [snd_sof]
[   12.315218]  snd_soc_pcm_component_hw_params+0x6c/0x120 [snd_soc_core]
[   12.315236]  __soc_pcm_hw_params+0x349/0x420 [snd_soc_core]
[   12.315256]  dpcm_fe_dai_hw_params+0xd3/0x3b0 [snd_soc_core]
[   12.315273]  snd_pcm_hw_params+0x226/0x610 [snd_pcm]
[   12.315284]  snd_pcm_common_ioctl+0x82c/0xd10 [snd_pcm]
[   12.315291]  snd_pcm_ioctl+0x28/0x40 [snd_pcm]
[   12.315297]  __x64_sys_ioctl+0xb9/0x100
[   12.315300]  do_syscall_64+0xe2/0x570
[   12.315304]  ? snd_pcm_common_ioctl+0x22d/0xd10 [snd_pcm]
[   12.315310]  ? snd_pcm_ioctl+0x28/0x40 [snd_pcm]
[   12.315316]  ? __x64_sys_ioctl+0xd4/0x100
[   12.315318]  ? do_syscall_64+0x11f/0x570
[   12.315320]  ? snd_pcm_lib_ioctl+0xe0/0x290 [snd_pcm]
[   12.315326]  ? fixup_unreferenced_params+0x26b/0x3c0 [snd_pcm]
[   12.315333]  ? snd_pcm_common_ioctl+0x22d/0xd10 [snd_pcm]
[   12.315339]  ? snd_pcm_ioctl+0x28/0x40 [snd_pcm]
[   12.315345]  ? snd_pcm_ioctl+0x28/0x40 [snd_pcm]
[   12.315350]  ? __x64_sys_ioctl+0xd4/0x100
[   12.315352]  ? __seccomp_filter+0x8a/0x3e0
[   12.315354]  ? do_syscall_64+0x99/0x570
[   12.315356]  ? exc_page_fault+0x90/0x1e0
[   12.315359]  asm_fred_entrypoint_user+0x41/0x41
[   12.315361] RIP: 0033:0x7f3f3fd862bd
[   12.315374] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
[   12.315375] RSP: 002b:00007fff6672d980 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   12.315378] RAX: ffffffffffffffda RBX: 000055cb8189a530 RCX: 0000000000000000
[   12.315379] RDX: 00007fff6672daf0 RSI: 00000000c2604111 RDI: 000000000000002b
[   12.315380] RBP: 00007fff6672d9d0 R08: 0000000000000000 R09: 0000000000000004
[   12.315381] R10: 0000000000000013 R11: 0000000000000001 R12: 00007fff6672daf0
[   12.315382] R13: 000055cb818a8d50 R14: 00007fff6672dd60 R15: 00007fff6672e128
[   12.315383]  </TASK>
[   12.315393] ---[ end trace ]---
Comment 1 Bojan Smojver 2026-09-27 04:39:11 UTC 
Both of these updates are causing the trace:

https://bodhi.fedoraproject.org/updates/FEDORA-2026-63df5a1660
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a55fb9344f
Comment 2 Bojan Smojver 2026-09-29 04:40:38 UTC 
@jforbes, looks like this needs a kernel fix after all. The PR is in the links.