On Sun, 01 Mar 2026, Tao Liu <[email protected]> wrote: > There is a NULL pointer dereference issue noticed in i915 when 2nd kernel > bootup during kdump. This will panic 2nd kernel and lead to no vmcore > generation. The issue is observed in Meteorlake CPU(cpuid: 0xA06A2):
The previously posted fix is [1]. Imre, please R-b that. It's a NULL pointer dereference in the wild, in stable kernels. We need to get it fixed instead of bikeshedding on potential incorrect debugfs results. BR, Jani. [1] https://lore.kernel.org/r/[email protected] > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops: Oops: 0000 [#1] SMP NOPTI > ... > RIP: 0010:intel_dmc_update_dc6_allowed_count+0x16/0xa0 [i915] > ... > > It is easy to locate the NULL pointer dereference by disassembly: > > 00000000001171e0 <intel_dmc_update_dc6_allowed_count>: > 1171e0: f3 0f 1e fa endbr64 > 1171e4: e8 00 00 00 00 call 1171e9 > 1171e9: 41 55 push %r13 > 1171eb: 41 54 push %r12 > 1171ed: 55 push %rbp > 1171ee: 53 push %rbx > 1171ef: 4c 8b a7 18 03 00 00 mov 0x318(%rdi),%r12 > 1171f6: 49 8b 2c 24 mov (%r12),%rbp > > To fix this, add a NULL pointer check before dereferencing. > > Signed-off-by: Tao Liu <[email protected]> > --- > > The issue doesn't happen in 1st kernel, but in 2nd kernel of kdump. I'm not > an expert to i915 and unsure what lead to the NULL pointer. To help further > analysis, here is the full stack: > > [ 8.608520] <TASK> > [ 8.610652] gen9_set_dc_state.part.0+0x25d/0x2f0 [i915] > [ 8.616096] icl_display_core_init+0x2d/0x620 [i915] > [ 8.621266] intel_power_domains_init_hw+0x1b2/0x500 [i915] > [ 8.627047] intel_display_driver_probe_noirq+0x87/0x300 [i915] > [ 8.633188] i915_driver_probe+0x207/0x5d0 [i915] > [ 8.637977] ? drm_privacy_screen_get+0x198/0x1c0 > [ 8.642832] local_pci_probe+0x41/0x90 > [ 8.646646] pci_call_probe+0x58/0x160 > [ 8.650458] ? pci_assign_irq+0x2f/0x160 > [ 8.654447] ? pci_match_device+0xf8/0x120 > [ 8.658522] pci_device_probe+0x95/0x140 > [ 8.662582] call_driver_probe+0x27/0x110 > [ 8.666570] really_probe+0xcc/0x2c0 > [ 8.670190] __driver_probe_device+0x78/0x120 > [ 8.674692] driver_probe_device+0x1f/0xa0 > [ 8.678857] __driver_attach+0xfa/0x230 > [ 8.682757] ? __pfx___driver_attach+0x10/0x10 > [ 8.687185] bus_for_each_dev+0x8e/0xe0 > [ 8.691159] bus_add_driver+0x11f/0x200 > [ 8.694970] driver_register+0x72/0xd0 > [ 8.698853] i915_init+0x26/0x90 [i915] > [ 8.702837] ? __pfx_i915_init+0x10/0x10 [i915] > [ 8.707433] do_one_initcall+0x5c/0x320 > [ 8.711409] do_init_module+0x60/0x240 > [ 8.715132] init_module_from_file+0xd6/0x130 > [ 8.719634] idempotent_init_module+0x114/0x310 > [ 8.724241] __x64_sys_finit_module+0x71/0xe0 > [ 8.728671] do_syscall_64+0x11b/0x6d0 > [ 8.732483] ? ksys_read+0x6b/0xe0 > [ 8.735854] ? arch_exit_to_user_mode_prepare.isra.0+0xa2/0xd0 > [ 8.741768] ? do_syscall_64+0x153/0x6d0 > [ 8.745828] ? do_syscall_64+0x153/0x6d0 > [ 8.749814] ? do_syscall_64+0x153/0x6d0 > [ 8.753800] ? clear_bhb_loop+0x30/0x80 > [ 8.757700] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > --- > drivers/gpu/drm/i915/display/intel_dmc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c > b/drivers/gpu/drm/i915/display/intel_dmc.c > index 1006b060c3f3..fd2756badc0c 100644 > --- a/drivers/gpu/drm/i915/display/intel_dmc.c > +++ b/drivers/gpu/drm/i915/display/intel_dmc.c > @@ -1578,7 +1578,7 @@ void intel_dmc_update_dc6_allowed_count(struct > intel_display *display, > struct intel_dmc *dmc = display_to_dmc(display); > u32 dc5_cur_count; > > - if (DISPLAY_VER(dmc->display) < 14) > + if (!dmc || DISPLAY_VER(dmc->display) < 14) > return; > > dc5_cur_count = intel_de_read(dmc->display, DG1_DMC_DEBUG_DC5_COUNT); -- Jani Nikula, Intel
