Public bug reported:
# kvmgt (Intel GVT-g) kernel panic — NULL pointer dereference regression
in 6.8.0-136-generic on Ubuntu 24.04 noble
## Summary
The `kvmgt` (Intel GVT-g virtual GPU) kernel module has a NULL pointer
dereference bug that causes a **kernel panic crash loop** on Ubuntu
24.04 noble with kernel 6.8.0-136-generic. The host crashes every 5-60
minutes when LXD VMs are configured with mdev vGPU devices. Kernel
6.8.0-134-generic does NOT have this bug — vGPU works correctly on 134.
## Hardware
- **CPU**: Intel Xeon E-2276G (Coffee Lake-S), 6 cores / 12 threads
- **GPU**: Intel UHD Graphics P630 (CoffeeLake-S GT2) [8086:3e96] at
0000:00:02.0
- **Board**: ASUSTeK WS C246 DC, BIOS 0803 (05/12/2021)
- **RAM**: 122 GiB
## Software
- **OS**: Ubuntu 24.04.4 LTS (noble)
- **Kernel 6.8.0-136-generic** #136-Ubuntu — **crashes** (regression)
- **Kernel 6.8.0-134-generic** #134-Ubuntu — **works correctly** (vGPU verified)
- **LXD**: 5.21.4 LTS (snap)
- **Kernel cmdline**: `intel_iommu=on iommu=pt i915.enable_gvt=1
i915.enable_guc=0`
## Crash Signature (identical across all 10+ crashes on 136)
```
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: <varies> PID: <varies> Comm: lxd Kdump: loaded Tainted: P U O
6.8.0-136-generic
RIP: 0010:mutex_lock+0x1d/0x50
Call Trace:
intel_vgpu_get_available+0x34/0xc0 [kvmgt]
available_instances_show+0x20/0x70 [mdev]
mdev_type_attr_show+0x18/0x40 [mdev]
sysfs_kf_seq_show+0xa4/0x120
kernfs_seq_show+0x24/0x40
seq_read_iter+0x12f/0x4b0
kernfs_fop_read_iter+0x34/0x40
vfs_read+0x205/0x3a0
ksys_read+0x73/0x100
__x64_sys_read+0x19/0x30
x64_sys_call+0x1bf0/0x25a0
do_syscall_64+0x87/0x180
entry_SYSCALL_64_after_hwframe+0x78/0x80
```
## Trigger
LXD profile with mdev GPU device:
```yaml
devices:
vgpu:
gputype: mdev
mdev: i915-GVTg_V5_8
pci: "0000:00:02.0"
type: gpu
```
When LXD reads
`/sys/devices/pci0000:00/0000:00:02.0/mdev_supported_types/i915-GVTg_V5_8/available_instances`
via sysfs, `intel_vgpu_get_available()` dereferences a NULL `gvt`
pointer.
## Root Cause
The `intel_vgpu_get_available()` function in
`drivers/gpu/drm/i915/gvt/kvmgt.c`:
```c
struct intel_gvt *gvt = kdev_to_i915(mtype->parent->dev)->gvt;
mutex_lock(&gvt->lock); // NULL pointer dereference when gvt is NULL
```
Kernel 6.8.0-136-generic introduced a regression in the `i915` driver
that causes GVT initialization to fail, leaving `i915->gvt` as NULL. The
`kvmgt` module still registers mdev types via sysfs, creating
`available_instances` attributes that panic when read.
On kernel 6.8.0-134-generic, GVT initialization succeeds (`gvt` is non-
NULL), and both vGPU VMs run correctly with mdev devices.
## What was tested
1. **Kernel 6.8.0-136-generic**: 10+ kernel panics in one day when mdev vGPU
profiles are active. Crash every 5-60 minutes.
2. **Kernel 6.8.0-134-generic**: kvmgt loads, GVT initializes, both vGPU VMs
(VPS-SVR-Prod-01, vm-windows-vdi) run with mdev vGPU devices. No crash after
28+ minutes. `available_instances` correctly returns 0 after both vGPU slots
consumed.
3. **`softdep i915 pre: kvmgt` on 136**: kvmgt loads before i915, GVT
initializes, `available_instances` returns 2, but crash still occurs when VM
with mdev vGPU starts.
4. **Manual `modprobe kvmgt` on 136 after boot**: GVT initializes,
`available_instances` returns 2, but crash occurs ~50 seconds after VM start
with mdev vGPU.
5. **Blacklisting kvmgt on 136**: Stops crashes but disables vGPU entirely.
## Impact
- 10+ kernel panics on 6.8.0-136-generic during testing
- Host completely unstable with mdev vGPU on 136
- **Workaround**: Pin kernel to 6.8.0-134-generic (`GRUB_DEFAULT=saved` +
`grub-set-default` to 134 entry, `apt-mark hold` kernel packages)
- Kernel 134 with kvmgt works correctly for production use
## Reproduction
1. Install kernel 6.8.0-136-generic on Ubuntu 24.04 with Intel Coffee Lake
hardware (UHD Graphics P630)
2. Boot with `i915.enable_gvt=1 i915.enable_guc=0`
3. Load `kvmgt` module
4. Configure an LXD VM with mdev GPU device (`gputype: mdev, mdev:
i915-GVTg_V5_8, pci: 0000:00:02.0`)
5. Start the VM — kernel panics within seconds to minutes
## Expected Behavior
`intel_vgpu_get_available()` should check for NULL `gvt` pointer before
dereferencing it, or GVT initialization should not fail on 136
(regression fix in i915 driver).
## Regression bisect target
The regression was introduced between 6.8.0-134.134 and 6.8.0-136.136.
The `kvmgt` module source code is identical between the two kernels
(verified). The regression is in the `i915` driver's GVT initialization
path (`drivers/gpu/drm/i915/intel_gvt.c` or related i915 changes).
## Crash Dumps
10+ kdump crash dumps captured at `/var/crash/` on the affected host,
available for analysis.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161783
Title:
kvmgt (Intel GVT-g) kernel panic — NULL pointer dereference regression
in 6.8.0-136-generic on Ubuntu 24.04 noble
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161783/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
