* [RFC PATCH] drm/i915: i915 null pointer dereference
@ 2026-01-15 1:54 Rahul Bukte
2026-01-15 16:28 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: Rahul Bukte @ 2026-01-15 1:54 UTC (permalink / raw)
To: intel-gfx, dri-devel, jani.nikula, joonas.lahtinen, rodrigo.vivi,
tursulin
Cc: Rahul Bukte, linux-kernel, daniel.palmer
When the i915 driver firmware binaries are not present, the
set_default_submission pointer is not set. This pointer is
dereferenced during suspend anyways.
Add a check to make sure it is set before dereferencing.
# echo +20 > /sys/class/rtc/rtc0/wakealarm && echo mem > /sys/power/state
[ 23.289926] PM: suspend entry (deep)
[ 23.293558] Filesystems sync: 0.000 seconds
[ 23.298010] Freezing user space processes
[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
[ 23.309766] OOM killer disabled.
[ 23.313027] Freezing remaining freezable tasks
[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 23.342038] serial 00:05: disabled
[ 23.345719] serial 00:02: disabled
[ 23.349342] serial 00:01: disabled
[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
[ 23.361635] ata1.00: Entering standby power mode
[ 23.368863] ata2.00: Entering standby power mode
[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 23.452194] #PF: supervisor instruction fetch in kernel mode
[ 23.457896] #PF: error_code(0x0010) - not-present page
[ 23.463065] PGD 0 P4D 0
[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 23.496511] Workqueue: async async_run_entry_fn
[ 23.501087] RIP: 0010:0x0
[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
[ 23.572539] PKRU: 55555554
[ 23.575281] Call Trace:
[ 23.577770] <TASK>
[ 23.579905] intel_engines_reset_default_submission+0x42/0x60
[ 23.585695] __intel_gt_unset_wedged+0x191/0x200
[ 23.590360] intel_gt_unset_wedged+0x20/0x40
[ 23.594675] gt_sanitize+0x15e/0x170
[ 23.598290] i915_gem_suspend_late+0x6b/0x180
[ 23.602692] i915_drm_suspend_late+0x35/0xf0
[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
[ 23.611843] dpm_run_callback+0x78/0x1c0
[ 23.615817] device_suspend_late+0xde/0x2e0
[ 23.620037] async_suspend_late+0x18/0x30
[ 23.624082] async_run_entry_fn+0x25/0xa0
[ 23.628129] process_one_work+0x15b/0x380
[ 23.632182] worker_thread+0x2a5/0x3c0
[ 23.635973] ? __pfx_worker_thread+0x10/0x10
[ 23.640279] kthread+0xf6/0x1f0
[ 23.643464] ? __pfx_kthread+0x10/0x10
[ 23.647263] ? __pfx_kthread+0x10/0x10
[ 23.651045] ret_from_fork+0x131/0x190
[ 23.654837] ? __pfx_kthread+0x10/0x10
[ 23.658634] ret_from_fork_asm+0x1a/0x30
[ 23.662597] </TASK>
[ 23.664826] Modules linked in:
[ 23.667914] CR2: 0000000000000000
[ 23.671271] ------------[ cut here ]------------
Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index b721bbd23356..ce8cdd517daa 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1969,7 +1969,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt)
if (engine->sanitize)
engine->sanitize(engine);
- engine->set_default_submission(engine);
+ if (engine->set_default_submission)
+ engine->set_default_submission(engine);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* ✗ LGCI.VerificationFailed: failure for drm/i915: i915 null pointer dereference
2026-01-15 1:54 [RFC PATCH] drm/i915: i915 null pointer dereference Rahul Bukte
@ 2026-01-15 16:28 ` Patchwork
2026-02-03 4:40 ` [RFC PATCH] " Kandpal, Suraj
2026-02-03 4:47 ` [PATCH] drm/i915/gt: Check set_default_submission() before deferencing Suraj Kandpal
2 siblings, 0 replies; 9+ messages in thread
From: Patchwork @ 2026-01-15 16:28 UTC (permalink / raw)
To: Rahul Bukte; +Cc: intel-gfx
== Series Details ==
Series: drm/i915: i915 null pointer dereference
URL : https://patchwork.freedesktop.org/series/160150/
State : failure
== Summary ==
Address 'rahul.bukte@sony.com' is not on the allowlist, which prevents CI from being triggered for this patch.
If you want Intel GFX CI to accept this address, please contact the script maintainers at i915-ci-infra@lists.freedesktop.org.
Exception occurred during validation, bailing out!
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: [RFC PATCH] drm/i915: i915 null pointer dereference
2026-01-15 1:54 [RFC PATCH] drm/i915: i915 null pointer dereference Rahul Bukte
2026-01-15 16:28 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
@ 2026-02-03 4:40 ` Kandpal, Suraj
2026-02-03 4:47 ` [PATCH] drm/i915/gt: Check set_default_submission() before deferencing Suraj Kandpal
2 siblings, 0 replies; 9+ messages in thread
From: Kandpal, Suraj @ 2026-02-03 4:40 UTC (permalink / raw)
To: Rahul Bukte, intel-gfx@lists.freedesktop.org,
dri-devel@lists.freedesktop.org, jani.nikula@linux.intel.com,
joonas.lahtinen@linux.intel.com, Vivi, Rodrigo,
tursulin@ursulin.net
Cc: linux-kernel@vger.kernel.org, daniel.palmer@sony.com
> Subject: [RFC PATCH] drm/i915: i915 null pointer dereference
You can remove the RFC patch this patch LGTM from a solution standpoint.
You need to modify the subject to drm/i915/gt : Check set_default_submission() before deferencing it.
Ill be resending this patch to get results from LGCI. After which this can be merged.
Otherwise this LGTM,
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
>
> When the i915 driver firmware binaries are not present, the
> set_default_submission pointer is not set. This pointer is dereferenced during
> suspend anyways.
>
> Add a check to make sure it is set before dereferencing.
>
> # echo +20 > /sys/class/rtc/rtc0/wakealarm && echo mem >
> /sys/power/state
> [ 23.289926] PM: suspend entry (deep)
> [ 23.293558] Filesystems sync: 0.000 seconds
> [ 23.298010] Freezing user space processes
> [ 23.302771] Freezing user space processes completed (elapsed 0.000
> seconds)
> [ 23.309766] OOM killer disabled.
> [ 23.313027] Freezing remaining freezable tasks
> [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001
> seconds)
> [ 23.342038] serial 00:05: disabled
> [ 23.345719] serial 00:02: disabled
> [ 23.349342] serial 00:01: disabled
> [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
> [ 23.361635] ata1.00: Entering standby power mode
> [ 23.368863] ata2.00: Entering standby power mode
> [ 23.445187] BUG: kernel NULL pointer dereference, address:
> 0000000000000000
> [ 23.452194] #PF: supervisor instruction fetch in kernel mode
> [ 23.457896] #PF: error_code(0x0010) - not-present page
> [ 23.463065] PGD 0 P4D 0
> [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
> [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S
> W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
> [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
> [ 23.496511] Workqueue: async async_run_entry_fn
> [ 23.501087] RIP: 0010:0x0
> [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
> [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
> [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX:
> 000000000000000f
> [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI:
> ffff9f428290e000
> [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09:
> 00000000ffffffff
> [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12:
> ffff9f42829070f8
> [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15:
> ffff9f4282906b68
> [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000)
> knlGS:0000000000000000
> [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4:
> 0000000000f70ef0
> [ 23.572539] PKRU: 55555554
> [ 23.575281] Call Trace:
> [ 23.577770] <TASK>
> [ 23.579905] intel_engines_reset_default_submission+0x42/0x60
> [ 23.585695] __intel_gt_unset_wedged+0x191/0x200
> [ 23.590360] intel_gt_unset_wedged+0x20/0x40
> [ 23.594675] gt_sanitize+0x15e/0x170
> [ 23.598290] i915_gem_suspend_late+0x6b/0x180
> [ 23.602692] i915_drm_suspend_late+0x35/0xf0
> [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
> [ 23.611843] dpm_run_callback+0x78/0x1c0
> [ 23.615817] device_suspend_late+0xde/0x2e0
> [ 23.620037] async_suspend_late+0x18/0x30
> [ 23.624082] async_run_entry_fn+0x25/0xa0
> [ 23.628129] process_one_work+0x15b/0x380
> [ 23.632182] worker_thread+0x2a5/0x3c0
> [ 23.635973] ? __pfx_worker_thread+0x10/0x10
> [ 23.640279] kthread+0xf6/0x1f0
> [ 23.643464] ? __pfx_kthread+0x10/0x10
> [ 23.647263] ? __pfx_kthread+0x10/0x10
> [ 23.651045] ret_from_fork+0x131/0x190
> [ 23.654837] ? __pfx_kthread+0x10/0x10
> [ 23.658634] ret_from_fork_asm+0x1a/0x30
> [ 23.662597] </TASK>
> [ 23.664826] Modules linked in:
> [ 23.667914] CR2: 0000000000000000
> [ 23.671271] ------------[ cut here ]------------
>
> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index b721bbd23356..ce8cdd517daa 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1969,7 +1969,8 @@ void
> intel_engines_reset_default_submission(struct intel_gt *gt)
> if (engine->sanitize)
> engine->sanitize(engine);
>
> - engine->set_default_submission(engine);
> + if (engine->set_default_submission)
> + engine->set_default_submission(engine);
> }
> }
>
> --
> 2.43.0
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
2026-01-15 1:54 [RFC PATCH] drm/i915: i915 null pointer dereference Rahul Bukte
2026-01-15 16:28 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
2026-02-03 4:40 ` [RFC PATCH] " Kandpal, Suraj
@ 2026-02-03 4:47 ` Suraj Kandpal
2 siblings, 0 replies; 9+ messages in thread
From: Suraj Kandpal @ 2026-02-03 4:47 UTC (permalink / raw)
To: intel-xe, intel-gfx; +Cc: Rahul Bukte, Suraj Kandpal
From: Rahul Bukte <rahul.bukte@sony.com>
When the i915 driver firmware binaries are not present, the
set_default_submission pointer is not set. This pointer is
dereferenced during suspend anyways.
Add a check to make sure it is set before dereferencing.
[ 23.289926] PM: suspend entry (deep)
[ 23.293558] Filesystems sync: 0.000 seconds
[ 23.298010] Freezing user space processes
[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
[ 23.309766] OOM killer disabled.
[ 23.313027] Freezing remaining freezable tasks
[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 23.342038] serial 00:05: disabled
[ 23.345719] serial 00:02: disabled
[ 23.349342] serial 00:01: disabled
[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
[ 23.361635] ata1.00: Entering standby power mode
[ 23.368863] ata2.00: Entering standby power mode
[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 23.452194] #PF: supervisor instruction fetch in kernel mode
[ 23.457896] #PF: error_code(0x0010) - not-present page
[ 23.463065] PGD 0 P4D 0
[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 23.496511] Workqueue: async async_run_entry_fn
[ 23.501087] RIP: 0010:0x0
[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
[ 23.572539] PKRU: 55555554
[ 23.575281] Call Trace:
[ 23.577770] <TASK>
[ 23.579905] intel_engines_reset_default_submission+0x42/0x60
[ 23.585695] __intel_gt_unset_wedged+0x191/0x200
[ 23.590360] intel_gt_unset_wedged+0x20/0x40
[ 23.594675] gt_sanitize+0x15e/0x170
[ 23.598290] i915_gem_suspend_late+0x6b/0x180
[ 23.602692] i915_drm_suspend_late+0x35/0xf0
[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
[ 23.611843] dpm_run_callback+0x78/0x1c0
[ 23.615817] device_suspend_late+0xde/0x2e0
[ 23.620037] async_suspend_late+0x18/0x30
[ 23.624082] async_run_entry_fn+0x25/0xa0
[ 23.628129] process_one_work+0x15b/0x380
[ 23.632182] worker_thread+0x2a5/0x3c0
[ 23.635973] ? __pfx_worker_thread+0x10/0x10
[ 23.640279] kthread+0xf6/0x1f0
[ 23.643464] ? __pfx_kthread+0x10/0x10
[ 23.647263] ? __pfx_kthread+0x10/0x10
[ 23.651045] ret_from_fork+0x131/0x190
[ 23.654837] ? __pfx_kthread+0x10/0x10
[ 23.658634] ret_from_fork_asm+0x1a/0x30
[ 23.662597] </TASK>
[ 23.664826] Modules linked in:
[ 23.667914] CR2: 0000000000000000
[ 23.671271] ------------[ cut here ]------------
Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 98a3a7a9de50..b9111c47bf3d 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1967,7 +1967,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt)
if (engine->sanitize)
engine->sanitize(engine);
- engine->set_default_submission(engine);
+ if (engine->set_default_submission)
+ engine->set_default_submission(engine);
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
@ 2026-02-03 4:48 Suraj Kandpal
2026-02-17 5:57 ` Kandpal, Suraj
2026-03-13 16:34 ` Jani Nikula
0 siblings, 2 replies; 9+ messages in thread
From: Suraj Kandpal @ 2026-02-03 4:48 UTC (permalink / raw)
To: intel-xe, intel-gfx; +Cc: Rahul Bukte, Suraj Kandpal
From: Rahul Bukte <rahul.bukte@sony.com>
When the i915 driver firmware binaries are not present, the
set_default_submission pointer is not set. This pointer is
dereferenced during suspend anyways.
Add a check to make sure it is set before dereferencing.
[ 23.289926] PM: suspend entry (deep)
[ 23.293558] Filesystems sync: 0.000 seconds
[ 23.298010] Freezing user space processes
[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
[ 23.309766] OOM killer disabled.
[ 23.313027] Freezing remaining freezable tasks
[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 23.342038] serial 00:05: disabled
[ 23.345719] serial 00:02: disabled
[ 23.349342] serial 00:01: disabled
[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
[ 23.361635] ata1.00: Entering standby power mode
[ 23.368863] ata2.00: Entering standby power mode
[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 23.452194] #PF: supervisor instruction fetch in kernel mode
[ 23.457896] #PF: error_code(0x0010) - not-present page
[ 23.463065] PGD 0 P4D 0
[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 23.496511] Workqueue: async async_run_entry_fn
[ 23.501087] RIP: 0010:0x0
[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
[ 23.572539] PKRU: 55555554
[ 23.575281] Call Trace:
[ 23.577770] <TASK>
[ 23.579905] intel_engines_reset_default_submission+0x42/0x60
[ 23.585695] __intel_gt_unset_wedged+0x191/0x200
[ 23.590360] intel_gt_unset_wedged+0x20/0x40
[ 23.594675] gt_sanitize+0x15e/0x170
[ 23.598290] i915_gem_suspend_late+0x6b/0x180
[ 23.602692] i915_drm_suspend_late+0x35/0xf0
[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
[ 23.611843] dpm_run_callback+0x78/0x1c0
[ 23.615817] device_suspend_late+0xde/0x2e0
[ 23.620037] async_suspend_late+0x18/0x30
[ 23.624082] async_run_entry_fn+0x25/0xa0
[ 23.628129] process_one_work+0x15b/0x380
[ 23.632182] worker_thread+0x2a5/0x3c0
[ 23.635973] ? __pfx_worker_thread+0x10/0x10
[ 23.640279] kthread+0xf6/0x1f0
[ 23.643464] ? __pfx_kthread+0x10/0x10
[ 23.647263] ? __pfx_kthread+0x10/0x10
[ 23.651045] ret_from_fork+0x131/0x190
[ 23.654837] ? __pfx_kthread+0x10/0x10
[ 23.658634] ret_from_fork_asm+0x1a/0x30
[ 23.662597] </TASK>
[ 23.664826] Modules linked in:
[ 23.667914] CR2: 0000000000000000
[ 23.671271] ------------[ cut here ]------------
Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
---
drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 98a3a7a9de50..b9111c47bf3d 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1967,7 +1967,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt)
if (engine->sanitize)
engine->sanitize(engine);
- engine->set_default_submission(engine);
+ if (engine->set_default_submission)
+ engine->set_default_submission(engine);
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* RE: [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
2026-02-03 4:48 Suraj Kandpal
@ 2026-02-17 5:57 ` Kandpal, Suraj
2026-03-13 16:34 ` Jani Nikula
1 sibling, 0 replies; 9+ messages in thread
From: Kandpal, Suraj @ 2026-02-17 5:57 UTC (permalink / raw)
To: intel-xe@lists.freedesktop.org, intel-gfx@lists.freedesktop.org
Cc: Rahul Bukte
> Subject: [PATCH] drm/i915/gt: Check set_default_submission() before
> deferencing
>
> From: Rahul Bukte <rahul.bukte@sony.com>
>
> When the i915 driver firmware binaries are not present, the
> set_default_submission pointer is not set. This pointer is dereferenced during
> suspend anyways.
>
> Add a check to make sure it is set before dereferencing.
>
> [ 23.289926] PM: suspend entry (deep)
> [ 23.293558] Filesystems sync: 0.000 seconds
> [ 23.298010] Freezing user space processes
> [ 23.302771] Freezing user space processes completed (elapsed 0.000
> seconds)
> [ 23.309766] OOM killer disabled.
> [ 23.313027] Freezing remaining freezable tasks
> [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001
> seconds)
> [ 23.342038] serial 00:05: disabled
> [ 23.345719] serial 00:02: disabled
> [ 23.349342] serial 00:01: disabled
> [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
> [ 23.361635] ata1.00: Entering standby power mode
> [ 23.368863] ata2.00: Entering standby power mode
> [ 23.445187] BUG: kernel NULL pointer dereference, address:
> 0000000000000000
> [ 23.452194] #PF: supervisor instruction fetch in kernel mode
> [ 23.457896] #PF: error_code(0x0010) - not-present page
> [ 23.463065] PGD 0 P4D 0
> [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
> [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W
> 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
> [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
> [ 23.496511] Workqueue: async async_run_entry_fn
> [ 23.501087] RIP: 0010:0x0
> [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
> [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
> [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX:
> 000000000000000f
> [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI:
> ffff9f428290e000
> [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09:
> 00000000ffffffff
> [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12:
> ffff9f42829070f8
> [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15:
> ffff9f4282906b68
> [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000)
> knlGS:0000000000000000
> [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4:
> 0000000000f70ef0
> [ 23.572539] PKRU: 55555554
> [ 23.575281] Call Trace:
> [ 23.577770] <TASK>
> [ 23.579905] intel_engines_reset_default_submission+0x42/0x60
> [ 23.585695] __intel_gt_unset_wedged+0x191/0x200
> [ 23.590360] intel_gt_unset_wedged+0x20/0x40
> [ 23.594675] gt_sanitize+0x15e/0x170
> [ 23.598290] i915_gem_suspend_late+0x6b/0x180
> [ 23.602692] i915_drm_suspend_late+0x35/0xf0
> [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
> [ 23.611843] dpm_run_callback+0x78/0x1c0
> [ 23.615817] device_suspend_late+0xde/0x2e0
> [ 23.620037] async_suspend_late+0x18/0x30
> [ 23.624082] async_run_entry_fn+0x25/0xa0
> [ 23.628129] process_one_work+0x15b/0x380
> [ 23.632182] worker_thread+0x2a5/0x3c0
> [ 23.635973] ? __pfx_worker_thread+0x10/0x10
> [ 23.640279] kthread+0xf6/0x1f0
> [ 23.643464] ? __pfx_kthread+0x10/0x10
> [ 23.647263] ? __pfx_kthread+0x10/0x10
> [ 23.651045] ret_from_fork+0x131/0x190
> [ 23.654837] ? __pfx_kthread+0x10/0x10
> [ 23.658634] ret_from_fork_asm+0x1a/0x30
> [ 23.662597] </TASK>
> [ 23.664826] Modules linked in:
> [ 23.667914] CR2: 0000000000000000
> [ 23.671271] ------------[ cut here ]------------
>
> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Thanks for the patch merged to din
Regards,
Suraj Kandpal
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 98a3a7a9de50..b9111c47bf3d 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1967,7 +1967,8 @@ void intel_engines_reset_default_submission(struct
> intel_gt *gt)
> if (engine->sanitize)
> engine->sanitize(engine);
>
> - engine->set_default_submission(engine);
> + if (engine->set_default_submission)
> + engine->set_default_submission(engine);
> }
> }
>
> --
> 2.34.1
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
2026-02-03 4:48 Suraj Kandpal
2026-02-17 5:57 ` Kandpal, Suraj
@ 2026-03-13 16:34 ` Jani Nikula
2026-03-18 5:51 ` Rahul Bukte
1 sibling, 1 reply; 9+ messages in thread
From: Jani Nikula @ 2026-03-13 16:34 UTC (permalink / raw)
To: Suraj Kandpal, intel-xe, intel-gfx; +Cc: Rahul Bukte, Suraj Kandpal
On Tue, 03 Feb 2026, Suraj Kandpal <suraj.kandpal@intel.com> wrote:
> From: Rahul Bukte <rahul.bukte@sony.com>
>
> When the i915 driver firmware binaries are not present, the
> set_default_submission pointer is not set. This pointer is
> dereferenced during suspend anyways.
Which kernel vesions did this happen with? Should this have had Fixes:
or Cc: stable?
BR,
Jani.
>
> Add a check to make sure it is set before dereferencing.
>
> [ 23.289926] PM: suspend entry (deep)
> [ 23.293558] Filesystems sync: 0.000 seconds
> [ 23.298010] Freezing user space processes
> [ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
> [ 23.309766] OOM killer disabled.
> [ 23.313027] Freezing remaining freezable tasks
> [ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
> [ 23.342038] serial 00:05: disabled
> [ 23.345719] serial 00:02: disabled
> [ 23.349342] serial 00:01: disabled
> [ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> [ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
> [ 23.361635] ata1.00: Entering standby power mode
> [ 23.368863] ata2.00: Entering standby power mode
> [ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [ 23.452194] #PF: supervisor instruction fetch in kernel mode
> [ 23.457896] #PF: error_code(0x0010) - not-present page
> [ 23.463065] PGD 0 P4D 0
> [ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
> [ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
> [ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
> [ 23.496511] Workqueue: async async_run_entry_fn
> [ 23.501087] RIP: 0010:0x0
> [ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
> [ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
> [ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
> [ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
> [ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
> [ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
> [ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
> [ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
> [ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
> [ 23.572539] PKRU: 55555554
> [ 23.575281] Call Trace:
> [ 23.577770] <TASK>
> [ 23.579905] intel_engines_reset_default_submission+0x42/0x60
> [ 23.585695] __intel_gt_unset_wedged+0x191/0x200
> [ 23.590360] intel_gt_unset_wedged+0x20/0x40
> [ 23.594675] gt_sanitize+0x15e/0x170
> [ 23.598290] i915_gem_suspend_late+0x6b/0x180
> [ 23.602692] i915_drm_suspend_late+0x35/0xf0
> [ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
> [ 23.611843] dpm_run_callback+0x78/0x1c0
> [ 23.615817] device_suspend_late+0xde/0x2e0
> [ 23.620037] async_suspend_late+0x18/0x30
> [ 23.624082] async_run_entry_fn+0x25/0xa0
> [ 23.628129] process_one_work+0x15b/0x380
> [ 23.632182] worker_thread+0x2a5/0x3c0
> [ 23.635973] ? __pfx_worker_thread+0x10/0x10
> [ 23.640279] kthread+0xf6/0x1f0
> [ 23.643464] ? __pfx_kthread+0x10/0x10
> [ 23.647263] ? __pfx_kthread+0x10/0x10
> [ 23.651045] ret_from_fork+0x131/0x190
> [ 23.654837] ? __pfx_kthread+0x10/0x10
> [ 23.658634] ret_from_fork_asm+0x1a/0x30
> [ 23.662597] </TASK>
> [ 23.664826] Modules linked in:
> [ 23.667914] CR2: 0000000000000000
> [ 23.671271] ------------[ cut here ]------------
>
> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
> ---
> drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> index 98a3a7a9de50..b9111c47bf3d 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
> @@ -1967,7 +1967,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt)
> if (engine->sanitize)
> engine->sanitize(engine);
>
> - engine->set_default_submission(engine);
> + if (engine->set_default_submission)
> + engine->set_default_submission(engine);
> }
> }
--
Jani Nikula, Intel
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
2026-03-13 16:34 ` Jani Nikula
@ 2026-03-18 5:51 ` Rahul Bukte
2026-03-18 9:41 ` Jani Nikula
0 siblings, 1 reply; 9+ messages in thread
From: Rahul Bukte @ 2026-03-18 5:51 UTC (permalink / raw)
To: Jani Nikula; +Cc: Suraj Kandpal, intel-xe, intel-gfx, linux-kernel
Hi,
On Fri, Mar 13, 2026 at 06:34:22PM +0200, Jani Nikula wrote:
> On Tue, 03 Feb 2026, Suraj Kandpal <suraj.kandpal@intel.com> wrote:
> > From: Rahul Bukte <rahul.bukte@sony.com>
> >
> > When the i915 driver firmware binaries are not present, the
> > set_default_submission pointer is not set. This pointer is
> > dereferenced during suspend anyways.
>
> Which kernel vesions did this happen with? Should this have had Fixes:
> or Cc: stable?
Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc")
Cc: stable@vger.kernel.org
Suraj, you mentioned that you have commited this to din [1]. Can we add
this fixes and cc tags to that please?
[1]: https://lore.kernel.org/all/DM3PPF208195D8D000253F905FADCA379F9E36DA@DM3PPF208195D8D.namprd11.prod.outlook.com/
Best regards,
Rahul
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] drm/i915/gt: Check set_default_submission() before deferencing
2026-03-18 5:51 ` Rahul Bukte
@ 2026-03-18 9:41 ` Jani Nikula
0 siblings, 0 replies; 9+ messages in thread
From: Jani Nikula @ 2026-03-18 9:41 UTC (permalink / raw)
To: Rahul Bukte, Tvrtko Ursulin
Cc: Suraj Kandpal, intel-xe, intel-gfx, linux-kernel
On Wed, 18 Mar 2026, Rahul Bukte <rahul.bukte@sony.com> wrote:
> Hi,
>
> On Fri, Mar 13, 2026 at 06:34:22PM +0200, Jani Nikula wrote:
>> On Tue, 03 Feb 2026, Suraj Kandpal <suraj.kandpal@intel.com> wrote:
>> > From: Rahul Bukte <rahul.bukte@sony.com>
>> >
>> > When the i915 driver firmware binaries are not present, the
>> > set_default_submission pointer is not set. This pointer is
>> > dereferenced during suspend anyways.
>>
>> Which kernel vesions did this happen with? Should this have had Fixes:
>> or Cc: stable?
>
> Fixes: ff44ad51ebf8 ("drm/i915: Move engine->submit_request selection to a vfunc")
> Cc: stable@vger.kernel.org
>
> Suraj, you mentioned that you have commited this to din [1]. Can we add
> this fixes and cc tags to that please?
>
> [1]: https://lore.kernel.org/all/DM3PPF208195D8D000253F905FADCA379F9E36DA@DM3PPF208195D8D.namprd11.prod.outlook.com/
Tvrtko, please pick this up for drm-intel-fixes.
BR,
Jani.
--
Jani Nikula, Intel
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-03-18 9:41 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-15 1:54 [RFC PATCH] drm/i915: i915 null pointer dereference Rahul Bukte
2026-01-15 16:28 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
2026-02-03 4:40 ` [RFC PATCH] " Kandpal, Suraj
2026-02-03 4:47 ` [PATCH] drm/i915/gt: Check set_default_submission() before deferencing Suraj Kandpal
-- strict thread matches above, loose matches on Subject: below --
2026-02-03 4:48 Suraj Kandpal
2026-02-17 5:57 ` Kandpal, Suraj
2026-03-13 16:34 ` Jani Nikula
2026-03-18 5:51 ` Rahul Bukte
2026-03-18 9:41 ` Jani Nikula
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox