linux
linux copied to clipboard
raspberrypi
Unable to handle kernel read from unreadable memory at virtual address
Describe the bug
Hi,
I’m running Debian Bookworm on a Raspberry Pi 5 Model B Rev 1.0 with kernel 6.12.34+rpt-rpi-2712. I’m seeing repeatable crashes either when I use killall or sometimes randomly during boot. The logs show Internal error: Oops: 000000009600000f in __memcpy_fromio, followed by RCU stall messages.
It looks like a kernel-level fault, possibly driver or memory related. I haven’t debugged kernel issues before, so a detailed explanation or step-by-step guidance would be greatly appreciated. Has anyone else seen this on the Pi 5? What’s the recommended way to debug — should I try enabling kernel debug options, capture a crash dump, or downgrade/upgrade the kernel to compare?
Any pointers on whether this is a hardware issue or a kernel/driver bug would be very helpful.
Thanks!
Steps to reproduce the behaviour
killall
Device (s)
Raspberry Pi 5
System
Raspberry Pi reference 2025-05-13
Generated using pi-gen, https://github.com/RPi-Distro/pi-gen, 5dabc7dc940059dfbc46af5d97b60a1e812523dd, stage2
2025/05/08 15:13:17
Copyright (c) 2012 Broadcom
version 69471177 (release) (embedded)
Linux mydevice.systems 6.12.34+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.34-1+rpt1~bookworm (2025-06-26) aarch64 GNU/Linux
Logs
[ 149.760799] Unable to handle kernel read from unreadable memory at virtual address ffffc00096218000
[ 149.769944] Mem abort info:
[ 149.772768] ESR = 0x000000009600000f
[ 149.776533] EC = 0x25: DABT (current EL), IL = 32 bits
[ 149.781873] SET = 0, FnV = 0
[ 149.784948] EA = 0, S1PTW = 0
[ 149.788097] FSC = 0x0f: level 3 permission fault
[ 149.792904] Data abort info:
[ 149.795787] ISV = 0, ISS = 0x0000000f, ISS2 = 0x00000000
[ 149.801292] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 149.806362] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 149.811694] swapper pgtable: 16k pages, 47-bit VAs, pgdp=00000000014dc000
[ 149.818517] [ffffc00096218000] pgd=100000006001c003, p4d=100000006001c003, pud=100000006001c003, pmd=1000000081640003, pte=0168001f000d0f4f
[ 149.831099] Internal error: Oops: 000000009600000f [#1] PREEMPT SMP
[ 149.837388] Modules linked in: xt_conntrack xt_MASQUERADE bridge stp llc xt_set ip_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat nf_tables nfnetlink xfrm_user xfrm_algo algif_hash algif_skcipher af_alg dummy overlay bnep binfmt_misc aes_ce_blk aes_ce_cipher imx477 spidev brcmfmac_wcc joydev hci_uart ghash_ce btbcm gf128mul sha2_ce sha256_arm64 sha1_ce sha1_generic bluetooth raspberrypi_hwmon ecdh_generic ecc uvcvideo libaes brcmfmac videobuf2_vmalloc uvc brcmutil cfg80211 spi_bcm2835 i2c_brcmstb rp1_cfe rpi_hevc_dec v4l2_fwnode v4l2_mem2mem rp1_pio pisp_be v4l2_async gpio_keys videobuf2_dma_contig rfkill videobuf2_memops videobuf2_v4l2 rp1_fw videodev videobuf2_common raspberrypi_gpiomem mc hid_multitouch spi_dw_mmio rp1_adc spi_dw i2c_designware_platform i2c_designware_core rp1_mailbox nvmem_rmem fuse dm_mod ip_tables x_tables ipv6 vc4 snd_soc_hdmi_codec snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd drm_display_helper drm_dma_helper v3d drm_shmem_helper
[ 149.837465] cec drm_kms_helper gpu_sched drm drm_panel_orientation_quirks backlight uio_pdrv_genirq uio
[ 149.928071] CPU: 1 UID: 1000 PID: 2426 Comm: myApplication Not tainted 6.12.34+rpt-rpi-2712 #1 Debian 1:6.12.34-1+rpt1~bookworm
[ 149.928076] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
[ 149.928077] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 149.928080] pc : __memcpy_fromio+0x50/0x98
[ 149.966238] lr : generic_access_phys+0x190/0x1c0
[ 149.966244] sp : ffffc000862c3b50
[ 149.966245] x29: ffffc000862c3b90 x28: 0000004040000000 x27: ffffc00096218000
[ 149.981352] x26: 0000000000000000 x25: ffff8000a0a9c000 x24: 0000000000000040
[ 149.988514] x23: 0000000000000000 x22: 0000000000004000 x21: 0000000000000001
[ 149.995675] x20: 0168000000000f4f x19: 0000001f000d0000 x18: 0000000000000000
[ 150.002837] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 150.009998] x14: 0000000000000801 x13: 0140000000000000 x12: ffffd06fcf31fc78
[ 150.017160] x11: ffffc00080000000 x10: 0000000000008000 x9 : ffffd06fce727fc0
[ 150.024321] x8 : ffffc01096218000 x7 : 00003ffff0002588 x6 : 0000000000000040
[ 150.031483] x5 : 00000000000007ff x4 : ffffc00096218000 x3 : ffff8000a0a9c040
[ 150.038643] x2 : 0000000000000040 x1 : ffffc00096218000 x0 : ffff8000a0a9c000
[ 150.045805] Call trace:
[ 150.048252] __memcpy_fromio+0x50/0x98
[ 150.052016] __access_remote_vm+0x288/0x390
[ 150.056212] access_remote_vm+0x18/0x30
[ 150.060056] mem_rw+0x1d0/0x368
[ 150.063203] mem_read+0x1c/0x30
[ 150.066348] vfs_read+0xcc/0x338
[ 150.069583] __arm64_sys_pread64+0xb8/0xe8
[ 150.073690] invoke_syscall+0x50/0x120
[ 150.077448] el0_svc_common.constprop.0+0x48/0xf0
[ 150.082166] do_el0_svc+0x24/0x38
[ 150.085488] el0_svc+0x30/0x100
[ 150.088635] el0t_64_sync_handler+0x100/0x130
[ 150.093004] el0t_64_sync+0x190/0x198
[ 150.096675] Code: 927df0c6 910020c6 8b060003 d503201f (f9400085)
[ 150.102788] ---[ end trace 0000000000000000 ]---
[ 150.107445] note: myApplication[2426] exited with preempt_count 1
[ 150.113676] ------------[ cut here ]------------
[ 150.118309] Voluntary context switch within RCU read-side critical section!
[ 150.118316] WARNING: CPU: 0 PID: 2426 at kernel/rcu/tree_plugin.h:331 rcu_note_context_switch+0x430/0x520
[ 150.134910] Modules linked in: xt_conntrack xt_MASQUERADE bridge stp llc xt_set ip_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat nf_tables nfnetlink xfrm_user xfrm_algo algif_hash algif_skcipher af_alg dummy overlay bnep binfmt_misc aes_ce_blk aes_ce_cipher imx477 spidev brcmfmac_wcc joydev hci_uart ghash_ce btbcm gf128mul sha2_ce sha256_arm64 sha1_ce sha1_generic bluetooth raspberrypi_hwmon ecdh_generic ecc uvcvideo libaes brcmfmac videobuf2_vmalloc uvc brcmutil cfg80211 spi_bcm2835 i2c_brcmstb rp1_cfe rpi_hevc_dec v4l2_fwnode v4l2_mem2mem rp1_pio pisp_be v4l2_async gpio_keys videobuf2_dma_contig rfkill videobuf2_memops videobuf2_v4l2 rp1_fw videodev videobuf2_common raspberrypi_gpiomem mc hid_multitouch spi_dw_mmio rp1_adc spi_dw i2c_designware_platform i2c_designware_core rp1_mailbox nvmem_rmem fuse dm_mod ip_tables x_tables ipv6 vc4 snd_soc_hdmi_codec snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd drm_display_helper drm_dma_helper v3d drm_shmem_helper
[ 150.134991] cec drm_kms_helper gpu_sched drm drm_panel_orientation_quirks backlight uio_pdrv_genirq uio
[ 150.235107] CPU: 0 UID: 1000 PID: 2426 Comm: myApplication Tainted: G D 6.12.34+rpt-rpi-2712 #1 Debian 1:6.12.34-1+rpt1~bookworm
[ 150.248291] Tainted: [D]=DIE
[ 150.251173] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
[ 150.257024] pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 150.264010] pc : rcu_note_context_switch+0x430/0x520
[ 150.268989] lr : rcu_note_context_switch+0x430/0x520
[ 150.273968] sp : ffffc000862c3560
[ 150.277287] x29: ffffc000862c3560 x28: ffff8000410c4200 x27: ffff80001ff2dc40
[ 150.284448] x26: ffff8000c0b56470 x25: 0000000000000000 x24: ffff8000410c4200
[ 150.291610] x23: 0000000000000000 x22: ffff8000410c4200 x21: ffffd06fcfeb16f0
[ 150.298770] x20: 0000000000000000 x19: ffff80001ff2ea40 x18: 0000000000000006
[ 150.305931] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000862c2ed0
[ 150.313092] x14: 0000000000000000 x13: 216e6f6974636573 x12: 206c616369746972
[ 150.320253] x11: 6320656469732d64 x10: ffffd06fcfd04ed0 x9 : ffffd06fce51f678
[ 150.327414] x8 : 00000000ffffefff x7 : ffffd06fcfd004f0 x6 : 0000000000000314
[ 150.334575] x5 : ffff80001ff033c8 x4 : 40000000fffff314 x3 : ffffaf90506b0000
[ 150.341736] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff8000410c4200
[ 150.348897] Call trace:
[ 150.351343] rcu_note_context_switch+0x430/0x520
[ 150.355973] __schedule+0xac/0xb60
[ 150.359381] schedule+0x3c/0x148
[ 150.362613] schedule_preempt_disabled+0x2c/0x50
[ 150.367242] rwsem_down_read_slowpath+0x224/0x510
[ 150.371959] down_read+0xb4/0xc8
[ 150.375192] do_exit+0x220/0x9b8
[ 150.378426] make_task_dead+0x8c/0x190
[ 150.382183] die+0x254/0x288
[ 150.385066] die_kernel_fault+0x1d8/0x388
[ 150.389086] __do_kernel_fault+0x190/0x198
[ 150.393194] do_page_fault+0x220/0x550
[ 150.396952] do_mem_abort+0x4c/0xa8
[ 150.400447] el1_abort+0x40/0x68
[ 150.403681] el1h_64_sync_handler+0xd8/0xe8
[ 150.407875] el1h_64_sync+0x64/0x68
[ 150.411369] __memcpy_fromio+0x50/0x98
[ 150.415126] __access_remote_vm+0x288/0x390
[ 150.419320] access_remote_vm+0x18/0x30
[ 150.423164] mem_rw+0x1d0/0x368
[ 150.426310] mem_read+0x1c/0x30
[ 150.429454] vfs_read+0xcc/0x338
[ 150.432689] __arm64_sys_pread64+0xb8/0xe8
[ 150.436795] invoke_syscall+0x50/0x120
[ 150.440553] el0_svc_common.constprop.0+0x48/0xf0
[ 150.445270] do_el0_svc+0x24/0x38
[ 150.448590] el0_svc+0x30/0x100
[ 150.451737] el0t_64_sync_handler+0x100/0x130
[ 150.456105] el0t_64_sync+0x190/0x198
[ 150.459774] ---[ end trace 0000000000000000 ]---
[ 150.466006] xhci-hcd xhci-hcd.1: ERROR unknown event type 37
[ 170.764804] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[ 170.770928] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-3): P2426/1:b.el
[ 170.778008] rcu: (detected by 2, t=5255 jiffies, g=21225, q=7321 ncpus=4)
[ 170.784909] task:myApplication state:D stack:0 pid:2426 tgid:2426 ppid:1984 flags:0x0000000d
[ 170.794256] Call trace:
[ 170.796704] __switch_to+0xf0/0x150
[ 170.800206] __schedule+0x394/0xb60
[ 170.803703] schedule+0x3c/0x148
[ 170.806937] schedule_preempt_disabled+0x2c/0x50
[ 170.811569] rwsem_down_read_slowpath+0x224/0x510
[ 170.816289] down_read+0xb4/0xc8
[ 170.819523] do_exit+0x220/0x9b8
[ 170.822759] make_task_dead+0x8c/0x190
[ 170.826516] die+0x254/0x288
[ 170.829401] die_kernel_fault+0x1d8/0x388
[ 170.833421] __do_kernel_fault+0x190/0x198
[ 170.837528] do_page_fault+0x220/0x550
[ 170.841287] do_mem_abort+0x4c/0xa8
[ 170.844783] el1_abort+0x40/0x68
[ 170.848018] el1h_64_sync_handler+0xd8/0xe8
[ 170.852213] el1h_64_sync+0x64/0x68
[ 170.855708] __memcpy_fromio+0x50/0x98
[ 170.859466] __access_remote_vm+0x288/0x390
[ 170.863661] access_remote_vm+0x18/0x30
[ 170.867506] mem_rw+0x1d0/0x368
[ 170.870653] mem_read+0x1c/0x30
[ 170.873799] vfs_read+0xcc/0x338
[ 170.877035] __arm64_sys_pread64+0xb8/0xe8
[ 170.881142] invoke_syscall+0x50/0x120
[ 170.884900] el0_svc_common.constprop.0+0x48/0xf0
[ 170.889618] do_el0_svc+0x24/0x38
[ 170.892940] el0_svc+0x30/0x100
[ 170.896087] el0t_64_sync_handler+0x100/0x130
[ 170.900456] el0t_64_sync+0x190/0x198
[ 170.968810] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { P2426 } 5300 jiffies s: 869 root: 0x0/T
[ 170.979476] rcu: blocking rcu_node structures (internal RCU debug):
Additional context
No response
I’m seeing repeatable crashes either when I use killall or sometimes randomly during boot
How repeatable? Can you crash on demand? It sounds more random than that.
vmeasureultima
What is this process? I suspect it's not a coincidence that the crash is in access_remote_vm.
Yeah able to reproduce the crash everytime using killall myApplication
myApplication
This is an electron application running on raspberry pi 5, which accesses camera and serialport. Also this crash occurs only in this application. Can't able to find the root cause
Hmm, it might be an incompatibility with the Pi 5-specific kernel which uses 16kB pages for efficiency. Try putting kernel=kernel8.img in config.txt to select the generic 64-bit kernel (shared with Pi 3 and Pi 4).
kernel=kernel8.img
Tried it. No change. Same crash occurs with same logs.
If this is your app, I suggest you cut it down as much as possible while still triggering the crash.