From: kernel test robot <yi1.lai@intel.com>
To: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: oe-lkp@lists.linux.dev, lkp@intel.com,
linux-media@vger.kernel.org, yi1.lai@intel.com
Subject: [sailus-media-tree:media-ref] [media] 696502a495: BUG:kernel_NULL_pointer_dereference,address
Date: Tue, 27 Oct 2026 11:07:07 +0800 [thread overview]
Message-ID: <202610271039.7cc92f63-lkp@intel.com> (raw)
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 696502a4953ea062964ebe1f3b1a09a9d6c8a591 ("media: mc: Implement best effort media device removal safety sans refcount") git://linuxtv.org/sailus/media_tree.git media-ref
in testcase: boot
config: i386-randconfig-011-20250511
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu Icelake-Server-noTSX,enforce,lm=off -smp 4 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202610271039.7cc92f63-lkp@intel.com
[ 5.959887][ T1] BUG: kernel NULL pointer dereference, address: 00000000
[ 5.961338][ T1] #PF: supervisor read access in kernel mode
[ 5.962189][ T1] #PF: error_code(0x0000) - not-present page
[ 5.962189][ T1] *pde = 00000000
[ 5.962189][ T1] Oops: Oops: 0000 [#1] SMP
[ 5.962189][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 7.3.0-rc1+ #1 PREEMPT(full)
[ 5.962189][ T1] Tainted: [T]=RANDSTRUCT
[ 5.962189][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 5.962189][ T1] EIP: strlen (x86/lib/string_32.c:148)
[ 5.962189][ T1] Code: c4 ac 38 e0 74 09 84 c0 75 f7 be 01 00 00 00 89 f0 48 5e 5d 31 d2 c3 8d 76 00 3e 8d 74 26 00 55 83 c9 ff 89 e5 57 89 c7 31 c0 <f2> ae b8 fe ff ff ff 5f 5d 29 c8 31 c9 c3 66 90 3e 8d 74 26 00 85
All code
========
0: c4 (bad)
1: ac lods %ds:(%rsi),%al
2: 38 e0 cmp %ah,%al
4: 74 09 je 0xf
6: 84 c0 test %al,%al
8: 75 f7 jne 0x1
a: be 01 00 00 00 mov $0x1,%esi
f: 89 f0 mov %esi,%eax
11: 48 5e rex.W pop %rsi
13: 5d pop %rbp
14: 31 d2 xor %edx,%edx
16: c3 ret
17: 8d 76 00 lea 0x0(%rsi),%esi
1a: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
1f: 55 push %rbp
20: 83 c9 ff or $0xffffffff,%ecx
23: 89 e5 mov %esp,%ebp
25: 57 push %rdi
26: 89 c7 mov %eax,%edi
28: 31 c0 xor %eax,%eax
2a:* f2 ae repnz scas %es:(%rdi),%al <-- trapping instruction
2c: b8 fe ff ff ff mov $0xfffffffe,%eax
31: 5f pop %rdi
32: 5d pop %rbp
33: 29 c8 sub %ecx,%eax
35: 31 c9 xor %ecx,%ecx
37: c3 ret
38: 66 90 xchg %ax,%ax
3a: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
3f: 85 .byte 0x85
Code starting with the faulting instruction ===========================================
0: f2 ae repnz scas %es:(%rdi),%al
2: b8 fe ff ff ff mov $0xfffffffe,%eax
7: 5f pop %rdi
8: 5d pop %rbp
9: 29 c8 sub %ecx,%eax
b: 31 c9 xor %ecx,%ecx
d: c3 ret
e: 66 90 xchg %ax,%ax
10: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
15: 85 .byte 0x85
[ 5.962189][ T1] EAX: 00000000 EBX: 87846e08 ECX: ffffffff EDX: 00000000
[ 5.962189][ T1] ESI: 00000000 EDI: 00000000 EBP: 80be5d90 ESP: 80be5d8c
[ 5.962189][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010246
[ 5.962189][ T1] CR0: 80050033 CR2: 00000000 CR3: 0347f000 CR4: 003506d0
[ 5.962189][ T1] Call Trace:
[ 5.962189][ T1] simple_start_creating (linux/fortify-string.h:218 libfs.c:2302)
[ 5.962189][ T1] ? simple_pin_fs (libfs.c:1112)
[ 5.962189][ T1] debugfs_start_creating (debugfs/inode.c:397 debugfs/inode.c:362)
[ 5.962189][ T1] debugfs_create_dir (debugfs/inode.c:575)
[ 5.962189][ T1] __media_device_register (media/mc/mc-device.c:892 (discriminator 1))
[ 5.962189][ T1] vicodec_probe (media/test-drivers/vicodec/vicodec-core.c:2180)
[ 5.962189][ T1] platform_probe (base/platform.c:1507)
[ 5.962189][ T1] really_probe (base/dd.c:628 base/dd.c:706)
[ 5.962189][ T1] __driver_probe_device (base/dd.c:868)
[ 5.962189][ T1] driver_probe_device (base/dd.c:898)
[ 5.962189][ T1] __driver_attach (base/dd.c:1292 base/dd.c:1232)
[ 5.962189][ T1] ? __device_attach_driver (base/dd.c:1030)
[ 5.962189][ T1] bus_for_each_dev (base/bus.c:383)
[ 5.962189][ T1] driver_attach (base/dd.c:1310)
[ 5.962189][ T1] ? __device_attach_driver (base/dd.c:1030)
[ 5.962189][ T1] bus_add_driver (base/bus.c:763)
[ 5.962189][ T1] driver_register (base/driver.c:174)
[ 5.962189][ T1] __platform_driver_register (base/platform.c:995)
[ 5.962189][ T1] vicodec_init (media/test-drivers/vicodec/vicodec-core.c:2254)
[ 5.962189][ T1] ? cxd2880_spi_driver_init (media/spi/cxd2880-spi.c:663)
[ 5.962189][ T1] do_one_initcall (main.c:1357)
[ 5.962189][ T1] ? rdinit_setup (main.c:595)
[ 5.962189][ T1] ? debug_smp_processor_id (smp_processor_id.c:58)
[ 5.962189][ T1] ? rcu_is_watching (linux/context_tracking.h:128 rcu/tree.c:753)
[ 5.962189][ T1] do_initcalls (main.c:1419 (discriminator 1) main.c:1435 (discriminator 1))
[ 5.962189][ T1] kernel_init_freeable (main.c:1455 main.c:1670)
[ 5.962189][ T1] ? rest_init (main.c:727)
[ 5.962189][ T1] kernel_init (main.c:1560)
[ 5.962189][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 5.962189][ T1] ? rest_init (main.c:727)
[ 5.962189][ T1] ret_from_fork_asm (x86/entry/entry_32.S:736)
[ 5.962189][ T1] entry_INT80_32 (x86/entry/entry_32.S:940)
[ 5.962189][ T1] Modules linked in:
[ 5.962189][ T1] CR2: 0000000000000000
[ 5.962189][ T1] ---[ end trace 0000000000000000 ]---
[ 5.962189][ T1] EIP: strlen (x86/lib/string_32.c:148)
[ 5.962189][ T1] Code: c4 ac 38 e0 74 09 84 c0 75 f7 be 01 00 00 00 89 f0 48 5e 5d 31 d2 c3 8d 76 00 3e 8d 74 26 00 55 83 c9 ff 89 e5 57 89 c7 31 c0 <f2> ae b8 fe ff ff ff 5f 5d 29 c8 31 c9 c3 66 90 3e 8d 74 26 00 85
All code
========
0: c4 (bad)
1: ac lods %ds:(%rsi),%al
2: 38 e0 cmp %ah,%al
4: 74 09 je 0xf
6: 84 c0 test %al,%al
8: 75 f7 jne 0x1
a: be 01 00 00 00 mov $0x1,%esi
f: 89 f0 mov %esi,%eax
11: 48 5e rex.W pop %rsi
13: 5d pop %rbp
14: 31 d2 xor %edx,%edx
16: c3 ret
17: 8d 76 00 lea 0x0(%rsi),%esi
1a: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
1f: 55 push %rbp
20: 83 c9 ff or $0xffffffff,%ecx
23: 89 e5 mov %esp,%ebp
25: 57 push %rdi
26: 89 c7 mov %eax,%edi
28: 31 c0 xor %eax,%eax
2a:* f2 ae repnz scas %es:(%rdi),%al <-- trapping instruction
2c: b8 fe ff ff ff mov $0xfffffffe,%eax
31: 5f pop %rdi
32: 5d pop %rbp
33: 29 c8 sub %ecx,%eax
35: 31 c9 xor %ecx,%ecx
37: c3 ret
38: 66 90 xchg %ax,%ax
3a: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
3f: 85 .byte 0x85
Code starting with the faulting instruction ===========================================
0: f2 ae repnz scas %es:(%rdi),%al
2: b8 fe ff ff ff mov $0xfffffffe,%eax
7: 5f pop %rdi
8: 5d pop %rbp
9: 29 c8 sub %ecx,%eax
b: 31 c9 xor %ecx,%ecx
d: c3 ret
e: 66 90 xchg %ax,%ax
10: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
15: 85 .byte 0x85
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261027/202610271039.7cc92f63-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-10-27 3:07 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202610271039.7cc92f63-lkp@intel.com \
--to=yi1.lai@intel.com \
--cc=linux-media@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=sakari.ailus@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox