From: Bert Karwatzki <spasswolf@web.de>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: Bert Karwatzki <spasswolf@web.de>,
Bjorn Helgaas <bhelgaas@google.com>,
linux-kernel@vger.kernel.org,
James.Bottomley@HansenPartnership.com,
Jonathan.Cameron@huawei.com, allenbh@gmail.com, d-gole@ti.com,
dave.jiang@intel.com, haiyangz@microsoft.com, jdmason@kudzu.us,
kristo@kernel.org, linux-hyperv@vger.kernel.org,
linux-pci@vger.kernel.org, linux-scsi@vger.kernel.org,
logang@deltatee.com, manivannan.sadhasivam@linaro.org,
martin.petersen@oracle.com, maz@kernel.org, mhklinux@outlook.com,
nm@ti.com, ntb@lists.linux.dev, peterz@infradead.org,
ssantosh@kernel.org, wei.huang2@amd.com, wei.liu@kernel.org
Subject: commit 7b025f3f85ed causes NULL pointer dereference
Date: Tue, 8 Apr 2025 14:04:44 +0200 [thread overview]
Message-ID: <20250408120446.3128-1-spasswolf@web.de> (raw)
In-Reply-To: <20250319105506.564105011@linutronix.de>
Since linux-next-20250408 I get a NULL pointer dereference when booting:
[ T669] BUG: kernel NULL pointer dereference, address: 0000000000000330
[ T669] #PF: supervisor read access in kernel mode
[ T669] #PF: error_code(0x0000) - not-present page
[ T669] PGD 0 P4D 0
[ T669] Oops: Oops: 0000 [#1] SMP NOPTI
[ T669] CPU: 2 UID: 0 PID: 669 Comm: (udev-worker) Not tainted 6.15.0-rc1-next-20250408-master #788 PREEMPT_{RT,(lazy)}
[ T669] Hardware name: Micro-Star International Co., Ltd. Alpha 15 B5EEK/MS-158L, BIOS E158LAMS.107 11/10/2021
[ T669] RIP: 0010:msi_domain_first_desc+0x4/0x30
[ T669] Code: e9 21 ff ff ff 0f 0b 31 c0 e9 f3 8c da ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b bf 68 02 00 00 48 85 ff 74 13 85 f6 75 0f 48 c7 47 60 00 00
[ T669] RSP: 0018:ffffcec6c25cfa78 EFLAGS: 00010246
[ T669] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000008
[ T669] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c8
[ T669] RBP: ffff8d26cb419aec R08: 0000000000000228 R09: 0000000000000000
[ T669] R10: ffff8d26c516fdc0 R11: ffff8d26ca5a4aa0 R12: ffff8d26c1aed0c8
[ T669] R13: 0000000000000002 R14: ffffcec6c25cfa90 R15: ffff8d26c1aed000
[ T669] FS: 00007f690f71a980(0000) GS:ffff8d35e83fa000(0000) knlGS:0000000000000000
[ T669] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ T669] CR2: 0000000000000330 CR3: 0000000121b64000 CR4: 0000000000750ef0
[ T669] PKRU: 55555554
[ T669] Call Trace:
[ T669] <TASK>
[ T669] msix_setup_interrupts+0x23b/0x280
[ T669] __pci_enable_msix_range+0x31a/0x520
[ T669] sp_pci_probe+0xf2/0x1f0 [ccp]
[ T669] ? rt_spin_unlock+0x12/0x40
[ T669] pci_device_probe+0xc0/0x180
[ T669] really_probe+0xd9/0x340
[ T669] ? pm_runtime_barrier+0x4f/0x90
[ T669] ? __pfx___driver_attach+0x10/0x10
[ T669] __driver_probe_device+0x73/0x110
[ T669] driver_probe_device+0x1a/0xa0
[ T669] __driver_attach+0xb5/0x1c0
[ T669] bus_for_each_dev+0x78/0xd0
[ T669] bus_add_driver+0x110/0x1f0
[ T669] driver_register+0x6d/0xc0
[ T669] sp_mod_init+0x15/0xff0 [ccp]
[ T669] ? __pfx_sp_mod_init+0x10/0x10 [ccp]
[ T669] do_one_initcall+0x48/0x2a0
[ T669] ? srso_alias_return_thunk+0x5/0xfbef5
[ T669] ? __kmalloc_cache_noprof+0x7c/0x160
[ T669] do_init_module+0x5b/0x220
[ T669] init_module_from_file+0x83/0xd0
[ T669] idempotent_init_module+0xf9/0x2f0
[ T669] __x64_sys_finit_module+0x60/0xc0
[ T669] do_syscall_64+0x5f/0xfa0
[ T669] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ T669] RIP: 0033:0x7f69101e4779
[ T669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 86 0d 00 f7 d8 64 89 01 48
[ T669] RSP: 002b:00007fff409a8788 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ T669] RAX: ffffffffffffffda RBX: 000056296549f860 RCX: 00007f69101e4779
[ T669] RDX: 0000000000000004 RSI: 00007f691035544d RDI: 0000000000000015
[ T669] RBP: 0000000000000004 R08: 0000000000000000 R09: 00005629653acc40
[ T669] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f691035544d
[ T669] R13: 0000000000020000 R14: 000056296549eea0 R15: 0000000000000000
[ T669] </TASK>
[ T669] Modules linked in: ccp(+) snd_pci_acp3x battery soundcore ac button evdev joydev hid_sensor_accel_3d hid_sensor_prox hid_sensor_gyro_3d hid_sensor_magn_3d hid_sensor_als hid_sensor_trigger industrialio_triggered_buffer kfifo_buf industrialio amd_pmc hid_sensor_iio_common mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 mac80211 libarc4 cfg80211 rfkill msr fuse nvme_fabrics efi_pstore configfs efivarfs autofs4 ext4 mbcache jbd2 amdgpu usbhid amdxcp i2c_algo_bit drm_client_lib hid_sensor_hub drm_ttm_helper mfd_core ttm drm_exec xhci_pci hid_generic gpu_sched xhci_hcd drm_suballoc_helper drm_panel_backlight_quirks cec drm_buddy drm_display_helper nvme psmouse i2c_hid_acpi usbcore serio_raw amd_sfh i2c_hid nvme_core drm_kms_helper hid r8169 i2c_piix4 usb_common i2c_smbus crc16 i2c_designware_platform i2c_designware_core
[ T669] CR2: 0000000000000330
[ T669] ---[ end trace 0000000000000000 ]---
[ T155] ACPI: battery: Slot [BAT1] (battery present)
[ T669] RIP: 0010:msi_domain_first_desc+0x4/0x30
[ T669] Code: e9 21 ff ff ff 0f 0b 31 c0 e9 f3 8c da ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b bf 68 02 00 00 48 85 ff 74 13 85 f6 75 0f 48 c7 47 60 00 00
[ T669] RSP: 0018:ffffcec6c25cfa78 EFLAGS: 00010246
[ T669] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000008
[ T669] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c8
[ T669] RBP: ffff8d26cb419aec R08: 0000000000000228 R09: 0000000000000000
[ T669] R10: ffff8d26c516fdc0 R11: ffff8d26ca5a4aa0 R12: ffff8d26c1aed0c8
[ T669] R13: 0000000000000002 R14: ffffcec6c25cfa90 R15: ffff8d26c1aed000
[ T669] FS: 00007f690f71a980(0000) GS:ffff8d35e83fa000(0000) knlGS:0000000000000000
[ T669] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ T669] CR2: 0000000000000330 CR3: 0000000121b64000 CR4: 0000000000750ef0
[ T669] PKRU: 55555554
[ T669] note: (udev-worker)[669] exited with irqs disabled
I bisected (from v6.15-rc1 to next-20250408) the first bad commit as 7b025f3f85ed.
To fix this in next-20250408 one needs to revert these commits:
7b025f3f85ed ("PCI/MSI: Switch msix_capability_init() to guard(msi_desc_lock)")
0ee2572d7b84 ("genirq/msi: Rename msi_[un]lock_descs()")
Bert Karwatzki
next prev parent reply other threads:[~2025-04-08 12:05 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-19 10:56 [patch V4 00/14] genirq/msi: Spring cleaning Thomas Gleixner
2025-03-19 10:56 ` [patch V4 01/14] cleanup: Provide retain_ptr() Thomas Gleixner
2025-03-19 20:15 ` James Bottomley
2025-03-19 10:56 ` [patch V4 02/14] genirq/msi: Use lock guards for MSI descriptor locking Thomas Gleixner
2025-03-19 10:56 ` [patch V4 03/14] soc: ti: ti_sci_inta_msi: Switch MSI descriptor locking to guard() Thomas Gleixner
2025-03-19 10:56 ` [patch V4 04/14] NTB/msi: Switch MSI descriptor locking to lock guard() Thomas Gleixner
2025-03-19 10:56 ` [patch V4 05/14] PCI/MSI: Use guard(msi_desc_lock) where applicable Thomas Gleixner
2025-03-19 17:08 ` Bjorn Helgaas
2025-03-19 10:56 ` [patch V4 06/14] PCI/MSI: Set pci_dev::msi_enabled late Thomas Gleixner
2025-03-19 17:08 ` Bjorn Helgaas
2025-03-19 10:56 ` [patch V4 07/14] PCI/MSI: Use __free() for affinity masks Thomas Gleixner
2025-03-19 17:09 ` Bjorn Helgaas
2025-03-19 10:56 ` [patch V4 08/14] PCI/MSI: Switch msi_capability_init() to guard(msi_desc_lock) Thomas Gleixner
2025-03-19 17:09 ` Bjorn Helgaas
2025-03-19 10:56 ` [patch V4 09/14] PCI/MSI: Switch msix_capability_init() " Thomas Gleixner
2025-03-19 17:09 ` Bjorn Helgaas
2025-04-08 12:04 ` Bert Karwatzki [this message]
2025-04-08 15:09 ` commit 7b025f3f85ed causes NULL pointer dereference Thomas Gleixner
2025-04-08 15:29 ` Thomas Gleixner
2025-04-08 16:20 ` Bert Karwatzki
2025-04-08 20:22 ` Klara Modin
2025-04-08 20:46 ` Thomas Gleixner
2025-04-09 11:44 ` Aithal, Srikanth
2025-04-09 11:49 ` Andy Shevchenko
2025-04-09 12:49 ` James Bottomley
2025-04-09 18:38 ` Thomas Gleixner
2025-04-09 15:22 ` Venkat Rao Bagalkote
2025-04-09 18:29 ` Borislav Petkov
2025-03-19 10:56 ` [patch V4 10/14] PCI: hv: Switch MSI descriptor locking to guard() Thomas Gleixner
2025-03-19 10:56 ` [patch V4 11/14] PCI/MSI: Provide a sane mechanism for TPH Thomas Gleixner
2025-06-17 23:22 ` Bjorn Helgaas
2025-06-17 23:25 ` Bjorn Helgaas
2025-03-19 10:56 ` [patch V4 12/14] PCI/TPH: Replace the broken MSI-X control word update Thomas Gleixner
2025-03-19 10:57 ` [patch V4 13/14] scsi: ufs: qcom: Remove the MSI descriptor abuse Thomas Gleixner
2025-03-19 20:40 ` James Bottomley
2025-03-19 10:57 ` [patch V4 14/14] genirq/msi: Rename msi_[un]lock_descs() Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250408120446.3128-1-spasswolf@web.de \
--to=spasswolf@web.de \
--cc=James.Bottomley@HansenPartnership.com \
--cc=Jonathan.Cameron@huawei.com \
--cc=allenbh@gmail.com \
--cc=bhelgaas@google.com \
--cc=d-gole@ti.com \
--cc=dave.jiang@intel.com \
--cc=haiyangz@microsoft.com \
--cc=jdmason@kudzu.us \
--cc=kristo@kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=logang@deltatee.com \
--cc=manivannan.sadhasivam@linaro.org \
--cc=martin.petersen@oracle.com \
--cc=maz@kernel.org \
--cc=mhklinux@outlook.com \
--cc=nm@ti.com \
--cc=ntb@lists.linux.dev \
--cc=peterz@infradead.org \
--cc=ssantosh@kernel.org \
--cc=tglx@linutronix.de \
--cc=wei.huang2@amd.com \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).