* [PATCH] drm/i915/irq: crtc guard inside interrupt handlers
@ 2026-09-25 11:55 Marcel Hamer
2026-09-25 12:48 ` Jani Nikula
2026-09-25 20:13 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
0 siblings, 2 replies; 3+ messages in thread
From: Marcel Hamer @ 2026-09-25 11:55 UTC (permalink / raw)
To: Jani Nikula, Rodrigo Vivi, Joonas Lahtinen, Tvrtko Ursulin,
David Airlie, Simona Vetter, Ville Syrjälä,
Vinod Govindapillai
Cc: Marcel Hamer, stable, intel-gfx, intel-xe, dri-devel,
linux-kernel
Interrupts are enabled before the crtc datastructures are initialized.
As intel_crtc_for_pipe() is called inside interrupt handlers and can
return a NULL value, this can in rare cases lead to the following NULL
pointer dereference and panic:
RIP: 0010:handle_plane_fault+0x19/0xc0 [i915]
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f
1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 48 83 ec 18 <48> 8b 1f
65 4c 8b 2d 24 90 31 ef 4c 89 6d e0 41 89 f5 48 85 db 74
RSP:
0018:ffff92b180003e50 EFLAGS: 00010086
RAX: ffffffffc0911fc0 RBX: ffffffffc06e0b90 RCX: 0000000000000005
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff92b180003e80 R08: 0000000000000005 R09: 000000010517d5f6
R10: 0000008000000041 R11: 000000010517d5f6 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f72f5b72780(0000) GS:ffff8bbdcbfe9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000102f2c000 CR4: 00000000003506f0
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x2c800000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
Call Trace:
<IRQ>
intel_pipe_fault_irq_handler+0x42/0xc0 [i915]
gen8_de_irq_handler+0x1ed/0xdf0 [i915]
gen8_irq_handler+0xb5/0xd0 [i915]
__handle_irq_event_percpu+0x6e/0x230
handle_irq_event+0x3a/0x90
handle_edge_irq+0xd1/0x1a0
__common_interrupt+0x48/0xe0
? generic_smp_call_function_single_interrupt+0x17/0x20
common_interrupt+0x84/0xa0
Fixes: f13011a79999 ("drm/i915: Pimp display fault reporting")
Fixes: 138d2bda4eaf ("drm/i915/display: pass display to intel_crtc_for_pipe()")
Cc: stable@vger.kernel.org # 6.18.x
Signed-off-by: Marcel Hamer <marcel@solidxs.se>
---
drivers/gpu/drm/i915/display/intel_display_irq.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_display_irq.c b/drivers/gpu/drm/i915/display/intel_display_irq.c
index a59b75830bd1..4ffc8789c9f3 100644
--- a/drivers/gpu/drm/i915/display/intel_display_irq.c
+++ b/drivers/gpu/drm/i915/display/intel_display_irq.c
@@ -131,6 +131,9 @@ static void intel_pipe_fault_irq_handler(struct intel_display *display,
struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
const struct pipe_fault_handler *handler;
+ if (!crtc)
+ return;
+
for (handler = handlers; handler && handler->fault; handler++) {
if ((fault_errors & handler->fault) == 0)
continue;
@@ -148,7 +151,8 @@ intel_handle_vblank(struct intel_display *display, enum pipe pipe)
{
struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
- drm_crtc_handle_vblank(&crtc->base);
+ if (crtc)
+ drm_crtc_handle_vblank(&crtc->base);
}
/**
@@ -425,9 +429,14 @@ static void display_pipe_crc_irq_handler(struct intel_display *display,
u32 crc4)
{
struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
- struct intel_pipe_crc *pipe_crc = &crtc->pipe_crc;
+ struct intel_pipe_crc *pipe_crc;
u32 crcs[5] = { crc0, crc1, crc2, crc3, crc4 };
+ if (!crtc)
+ return;
+
+ pipe_crc = &crtc->pipe_crc;
+
trace_intel_pipe_crc(crtc, crcs);
spin_lock(&pipe_crc->lock);
@@ -465,6 +474,9 @@ static void flip_done_handler(struct intel_display *display,
{
struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
+ if (!crtc)
+ return;
+
spin_lock(&display->drm->event_lock);
if (crtc->flip_done_event) {
base-commit: f49a343b305c0b6c19a3b50c0bbf10bcd0e2e8fd
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm/i915/irq: crtc guard inside interrupt handlers
2026-09-25 11:55 [PATCH] drm/i915/irq: crtc guard inside interrupt handlers Marcel Hamer
@ 2026-09-25 12:48 ` Jani Nikula
2026-09-25 20:13 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
1 sibling, 0 replies; 3+ messages in thread
From: Jani Nikula @ 2026-09-25 12:48 UTC (permalink / raw)
To: Marcel Hamer, Rodrigo Vivi, Joonas Lahtinen, Tvrtko Ursulin,
David Airlie, Simona Vetter, Ville Syrjälä,
Vinod Govindapillai
Cc: Marcel Hamer, stable, intel-gfx, intel-xe, dri-devel,
linux-kernel
On Fri, 25 Sep 2026, Marcel Hamer <marcel@solidxs.se> wrote:
> Interrupts are enabled before the crtc datastructures are initialized.
> As intel_crtc_for_pipe() is called inside interrupt handlers and can
> return a NULL value, this can in rare cases lead to the following NULL
> pointer dereference and panic:
>
> RIP: 0010:handle_plane_fault+0x19/0xc0 [i915]
> Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f
> 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 48 83 ec 18 <48> 8b 1f
> 65 4c 8b 2d 24 90 31 ef 4c 89 6d e0 41 89 f5 48 85 db 74
> RSP:
> 0018:ffff92b180003e50 EFLAGS: 00010086
> RAX: ffffffffc0911fc0 RBX: ffffffffc06e0b90 RCX: 0000000000000005
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffff92b180003e80 R08: 0000000000000005 R09: 000000010517d5f6
> R10: 0000008000000041 R11: 000000010517d5f6 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS: 00007f72f5b72780(0000) GS:ffff8bbdcbfe9000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 0000000102f2c000 CR4: 00000000003506f0
> Kernel panic - not syncing: Fatal exception in interrupt
> Kernel Offset: 0x2c800000 from 0xffffffff81000000 (relocation range:
> 0xffffffff80000000-0xffffffffbfffffff)
> Call Trace:
> <IRQ>
> intel_pipe_fault_irq_handler+0x42/0xc0 [i915]
> gen8_de_irq_handler+0x1ed/0xdf0 [i915]
> gen8_irq_handler+0xb5/0xd0 [i915]
> __handle_irq_event_percpu+0x6e/0x230
> handle_irq_event+0x3a/0x90
> handle_edge_irq+0xd1/0x1a0
> __common_interrupt+0x48/0xe0
> ? generic_smp_call_function_single_interrupt+0x17/0x20
> common_interrupt+0x84/0xa0
>
> Fixes: f13011a79999 ("drm/i915: Pimp display fault reporting")
> Fixes: 138d2bda4eaf ("drm/i915/display: pass display to intel_crtc_for_pipe()")
> Cc: stable@vger.kernel.org # 6.18.x
> Signed-off-by: Marcel Hamer <marcel@solidxs.se>
Please file a bug as described at [1], attaching full dmesg reproducing
the problem. I don't think we're seeing this in our CI, so would be good
to understand the root cause better.
BR,
Jani.
[1] https://drm.pages.freedesktop.org/intel-docs/how-to-file-i915-bugs.html
> ---
> drivers/gpu/drm/i915/display/intel_display_irq.c | 16 ++++++++++++++--
> 1 file changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_display_irq.c b/drivers/gpu/drm/i915/display/intel_display_irq.c
> index a59b75830bd1..4ffc8789c9f3 100644
> --- a/drivers/gpu/drm/i915/display/intel_display_irq.c
> +++ b/drivers/gpu/drm/i915/display/intel_display_irq.c
> @@ -131,6 +131,9 @@ static void intel_pipe_fault_irq_handler(struct intel_display *display,
> struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
> const struct pipe_fault_handler *handler;
>
> + if (!crtc)
> + return;
> +
> for (handler = handlers; handler && handler->fault; handler++) {
> if ((fault_errors & handler->fault) == 0)
> continue;
> @@ -148,7 +151,8 @@ intel_handle_vblank(struct intel_display *display, enum pipe pipe)
> {
> struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
>
> - drm_crtc_handle_vblank(&crtc->base);
> + if (crtc)
> + drm_crtc_handle_vblank(&crtc->base);
> }
>
> /**
> @@ -425,9 +429,14 @@ static void display_pipe_crc_irq_handler(struct intel_display *display,
> u32 crc4)
> {
> struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
> - struct intel_pipe_crc *pipe_crc = &crtc->pipe_crc;
> + struct intel_pipe_crc *pipe_crc;
> u32 crcs[5] = { crc0, crc1, crc2, crc3, crc4 };
>
> + if (!crtc)
> + return;
> +
> + pipe_crc = &crtc->pipe_crc;
> +
> trace_intel_pipe_crc(crtc, crcs);
>
> spin_lock(&pipe_crc->lock);
> @@ -465,6 +474,9 @@ static void flip_done_handler(struct intel_display *display,
> {
> struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe);
>
> + if (!crtc)
> + return;
> +
> spin_lock(&display->drm->event_lock);
>
> if (crtc->flip_done_event) {
>
> base-commit: f49a343b305c0b6c19a3b50c0bbf10bcd0e2e8fd
--
Jani Nikula, Intel
^ permalink raw reply [flat|nested] 3+ messages in thread
* ✗ LGCI.VerificationFailed: failure for drm/i915/irq: crtc guard inside interrupt handlers
2026-09-25 11:55 [PATCH] drm/i915/irq: crtc guard inside interrupt handlers Marcel Hamer
2026-09-25 12:48 ` Jani Nikula
@ 2026-09-25 20:13 ` Patchwork
1 sibling, 0 replies; 3+ messages in thread
From: Patchwork @ 2026-09-25 20:13 UTC (permalink / raw)
To: Marcel Hamer; +Cc: intel-xe
== Series Details ==
Series: drm/i915/irq: crtc guard inside interrupt handlers
URL : https://patchwork.freedesktop.org/series/175013/
State : failure
== Summary ==
Series author address 'marcel@solidxs.se' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://intel-gfx-ci-public.igk.intel.com:8080/job/xe_pw_trigger/1291767/ (on master)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-25 20:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-25 11:55 [PATCH] drm/i915/irq: crtc guard inside interrupt handlers Marcel Hamer
2026-09-25 12:48 ` Jani Nikula
2026-09-25 20:13 ` ✗ LGCI.VerificationFailed: failure for " Patchwork
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox