* [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
@ 2026-07-14 7:59 Qianheng Peng
2026-07-14 8:13 ` Viresh Kumar
2026-07-14 9:09 ` K Prateek Nayak
0 siblings, 2 replies; 8+ messages in thread
From: Qianheng Peng @ 2026-07-14 7:59 UTC (permalink / raw)
To: ray.huang, mario.limonciello, perry.yuan, kprateek.nayak, rafael,
viresh.kumar, skhan, li.meng
Cc: linux-pm, linux-kernel, wangxb12, xiongl24, zhangar, pengqh1
The crash issue may occur when insmod amd_pstate_ut modules.
amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
BUG: kernel NULL pointer dereference, address: 0000000000000080
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP NOPTI
CPU: 0 PID: 20300 Comm: modprobe
Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
Call Trace:
<TASK>
amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
do_one_initcall+0x42/0x2e0
? kmalloc_trace+0x26/0x90
do_init_module+0x60/0x240
__se_sys_init_module+0x185/0x1c0
do_syscall_64+0x62/0x190
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
---
drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
index 735b29f..3b24260 100644
--- a/drivers/cpufreq/amd-pstate-ut.c
+++ b/drivers/cpufreq/amd-pstate-ut.c
@@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
if (!policy)
continue;
cpudata = policy->driver_data;
+ if (!cpudata) {
+ pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
+ return -EINVAL;
+ }
if (get_shared_mem()) {
ret = cppc_get_perf_caps(cpu, &cppc_perf);
@@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
if (!policy)
continue;
cpudata = policy->driver_data;
+ if (!cpudata) {
+ pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
+ return -EINVAL;
+ }
if (!((policy->cpuinfo.max_freq >= cpudata->nominal_freq) &&
(cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
--
1.8.3.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 7:59 [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference Qianheng Peng
@ 2026-07-14 8:13 ` Viresh Kumar
2026-07-14 10:21 ` Qianheng Peng
2026-07-14 9:09 ` K Prateek Nayak
1 sibling, 1 reply; 8+ messages in thread
From: Viresh Kumar @ 2026-07-14 8:13 UTC (permalink / raw)
To: Qianheng Peng
Cc: ray.huang, mario.limonciello, perry.yuan, kprateek.nayak, rafael,
skhan, li.meng, linux-pm, linux-kernel, wangxb12, xiongl24,
zhangar
On 14-07-26, 15:59, Qianheng Peng wrote:
> The crash issue may occur when insmod amd_pstate_ut modules.
>
> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
> BUG: kernel NULL pointer dereference, address: 0000000000000080
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP NOPTI
> CPU: 0 PID: 20300 Comm: modprobe
> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
> Call Trace:
> <TASK>
> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
> do_one_initcall+0x42/0x2e0
> ? kmalloc_trace+0x26/0x90
> do_init_module+0x60/0x240
> __se_sys_init_module+0x185/0x1c0
> do_syscall_64+0x62/0x190
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>
> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
> ---
> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
> index 735b29f..3b24260 100644
> --- a/drivers/cpufreq/amd-pstate-ut.c
> +++ b/drivers/cpufreq/amd-pstate-ut.c
> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
> if (!policy)
> continue;
> cpudata = policy->driver_data;
> + if (!cpudata) {
> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
You can use kobject_name(), but I wonder why print kobj name here ? Other
drivers just print policy->cpu normally and that is sufficient.
--
viresh
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 7:59 [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference Qianheng Peng
2026-07-14 8:13 ` Viresh Kumar
@ 2026-07-14 9:09 ` K Prateek Nayak
2026-07-14 10:22 ` Qianheng Peng
1 sibling, 1 reply; 8+ messages in thread
From: K Prateek Nayak @ 2026-07-14 9:09 UTC (permalink / raw)
To: Qianheng Peng, ray.huang, mario.limonciello, perry.yuan, rafael,
viresh.kumar, skhan, li.meng
Cc: linux-pm, linux-kernel, wangxb12, xiongl24, zhangar
Hello Qianheng,
On 7/14/2026 1:29 PM, Qianheng Peng wrote:
> The crash issue may occur when insmod amd_pstate_ut modules.
>
> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
> BUG: kernel NULL pointer dereference, address: 0000000000000080
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP NOPTI
> CPU: 0 PID: 20300 Comm: modprobe
> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
Is this an AMD platform?
> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
> Call Trace:
> <TASK>
> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
> do_one_initcall+0x42/0x2e0
> ? kmalloc_trace+0x26/0x90
> do_init_module+0x60/0x240
> __se_sys_init_module+0x185/0x1c0
> do_syscall_64+0x62/0x190
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>
> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
> ---
> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
> index 735b29f..3b24260 100644
> --- a/drivers/cpufreq/amd-pstate-ut.c
> +++ b/drivers/cpufreq/amd-pstate-ut.c
> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
> if (!policy)
> continue;
> cpudata = policy->driver_data;
> + if (!cpudata) {
> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
> + return -EINVAL;
> + }
>
> if (get_shared_mem()) {
> ret = cppc_get_perf_caps(cpu, &cppc_perf);
> @@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
> if (!policy)
> continue;
> cpudata = policy->driver_data;
> + if (!cpudata) {
> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
> + return -EINVAL;
> + }
The only time I think this can happen is when the amd-pstate-ut races with a
the amd_pstate.*_cpu_exit() (probably as a result of concurrent mode switch)
or if you are running this without running amd-pstate as the cpufreq driver
(which the ut doesn't check for beforehand)
My setup fails at this exact same point when I have the driver unloaded.
What is the output of following before you run into this issue:
cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
cat /sys/devices/system/cpu/amd_pstate/status
Are you doing any concurrent hotplug / mode switch?
>
> if (!((policy->cpuinfo.max_freq >= cpudata->nominal_freq) &&
> (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
> --
> 1.8.3.1
>
--
Thanks and Regards,
Prateek
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 8:13 ` Viresh Kumar
@ 2026-07-14 10:21 ` Qianheng Peng
0 siblings, 0 replies; 8+ messages in thread
From: Qianheng Peng @ 2026-07-14 10:21 UTC (permalink / raw)
To: viresh.kumar
Cc: kprateek.nayak, li.meng, linux-kernel, linux-pm,
mario.limonciello, pengqh1, perry.yuan, rafael, ray.huang, skhan,
wangxb12, xiongl24, zhangar
On 14-07-26, 01:13:57 (PDT), Viresh Kumar wrote:
>On 14-07-26, 15:59, Qianheng Peng wrote:
>> The crash issue may occur when insmod amd_pstate_ut modules.
>>
>> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
>> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>> #PF: supervisor read access in kernel mode
>> #PF: error_code(0x0000) - not-present page
>> PGD 0 P4D 0
>> Oops: 0000 [#1] SMP NOPTI
>> CPU: 0 PID: 20300 Comm: modprobe
>> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
>> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
>> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
>> Call Trace:
>> <TASK>
>> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
>> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
>> do_one_initcall+0x42/0x2e0
>> ? kmalloc_trace+0x26/0x90
>> do_init_module+0x60/0x240
>> __se_sys_init_module+0x185/0x1c0
>> do_syscall_64+0x62/0x190
>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> </TASK>
>>
>> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
>> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>>
>> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
>> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
>> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
>> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
>> ---
>> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
>> 1 file changed, 8 insertions(+)
>>
>> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
>> index 735b29f..3b24260 100644
>> --- a/drivers/cpufreq/amd-pstate-ut.c
>> +++ b/drivers/cpufreq/amd-pstate-ut.c
>> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
>> if (!policy)
>> continue;
>> cpudata = policy->driver_data;
>> + if (!cpudata) {
>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>
>You can use kobject_name(), but I wonder why print kobj name here ? Other
>drivers just print policy->cpu normally and that is sufficient.
Thanks for review.I will change kobj name to policy->cpu in patch v2.
--
Qianheng
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 9:09 ` K Prateek Nayak
@ 2026-07-14 10:22 ` Qianheng Peng
2026-07-14 11:08 ` Zhongqiu Han
0 siblings, 1 reply; 8+ messages in thread
From: Qianheng Peng @ 2026-07-14 10:22 UTC (permalink / raw)
To: kprateek.nayak
Cc: li.meng, linux-kernel, linux-pm, mario.limonciello, pengqh1,
perry.yuan, rafael, ray.huang, skhan, viresh.kumar, wangxb12,
xiongl24, zhangar
Hello K Prateek,
Thanks for questions.
On 7/14/2026 14:39, K Prateek Nayak wrote:
>On 7/14/2026 1:29 PM, Qianheng Peng wrote:
>> The crash issue may occur when insmod amd_pstate_ut modules.
>>
>> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
>> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>> #PF: supervisor read access in kernel mode
>> #PF: error_code(0x0000) - not-present page
>> PGD 0 P4D 0
>> Oops: 0000 [#1] SMP NOPTI
>> CPU: 0 PID: 20300 Comm: modprobe
>> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
>> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
>
>Is this an AMD platform?
No, it's Intel(R) Xeon(R) Gold 5128.
>> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
>> Call Trace:
>> <TASK>
>> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
>> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
>> do_one_initcall+0x42/0x2e0
>> ? kmalloc_trace+0x26/0x90
>> do_init_module+0x60/0x240
>> __se_sys_init_module+0x185/0x1c0
>> do_syscall_64+0x62/0x190
>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>> </TASK>
>>
>> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
>> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>>
>> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
>> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
>> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
>> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
>> ---
>> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
>> 1 file changed, 8 insertions(+)
>>
>> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
>> index 735b29f..3b24260 100644
>> --- a/drivers/cpufreq/amd-pstate-ut.c
>> +++ b/drivers/cpufreq/amd-pstate-ut.c
>> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
>> if (!policy)
>> continue;
>> cpudata = policy->driver_data;
>> + if (!cpudata) {
>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>> + return -EINVAL;
>> + }
>>
>> if (get_shared_mem()) {
>> ret = cppc_get_perf_caps(cpu, &cppc_perf);
>> @@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
>> if (!policy)
>> continue;
>> cpudata = policy->driver_data;
>> + if (!cpudata) {
>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>> + return -EINVAL;
>> + }
>
>The only time I think this can happen is when the amd-pstate-ut races with a
>the amd_pstate.*_cpu_exit() (probably as a result of concurrent mode switch)
>or if you are running this without running amd-pstate as the cpufreq driver
>(which the ut doesn't check for beforehand)
>
>My setup fails at this exact same point when I have the driver unloaded.
>What is the output of following before you run into this issue:
>
> cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
> cat /sys/devices/system/cpu/amd_pstate/status
>
>Are you doing any concurrent hotplug / mode switch?
>
>>
>> if (!((policy->cpuinfo.max_freq >= cpudata->nominal_freq) &&
>> (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
In this machine, I got output as follow:
======================================================================================
[root@ ~]# cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
intel_cpufreq
[root@ ~]# cat /sys/devices/system/cpu/amd_pstate/status
cat: /sys/devices/system/cpu/amd_pstate/status: No such file or directory (os error 2)
======================================================================================
Otherwise,I didn't do any concurrent hotplug / mode switch, just modprobe amd_pstate_ut.
--
Thanks and Regards,
Qianheng
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 10:22 ` Qianheng Peng
@ 2026-07-14 11:08 ` Zhongqiu Han
2026-07-14 17:16 ` Mario Limonciello
2026-07-15 2:52 ` Qianheng Peng
0 siblings, 2 replies; 8+ messages in thread
From: Zhongqiu Han @ 2026-07-14 11:08 UTC (permalink / raw)
To: Qianheng Peng, kprateek.nayak
Cc: li.meng, linux-kernel, linux-pm, mario.limonciello, perry.yuan,
rafael, ray.huang, skhan, viresh.kumar, wangxb12, xiongl24,
zhangar, zhongqiu.han
Hi Qianheng,
On 7/14/2026 6:22 PM, Qianheng Peng wrote:
> Hello K Prateek,
> Thanks for questions.
>
> On 7/14/2026 14:39, K Prateek Nayak wrote:
>> On 7/14/2026 1:29 PM, Qianheng Peng wrote:
>>> The crash issue may occur when insmod amd_pstate_ut modules.
>>>
>>> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
>>> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
>>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>>> #PF: supervisor read access in kernel mode
>>> #PF: error_code(0x0000) - not-present page
>>> PGD 0 P4D 0
>>> Oops: 0000 [#1] SMP NOPTI
>>> CPU: 0 PID: 20300 Comm: modprobe
>>> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
>>> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
>>
>> Is this an AMD platform?
> No, it's Intel(R) Xeon(R) Gold 5128.
>
>>> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
>>> Call Trace:
>>> <TASK>
>>> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
>>> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
>>> do_one_initcall+0x42/0x2e0
>>> ? kmalloc_trace+0x26/0x90
>>> do_init_module+0x60/0x240
>>> __se_sys_init_module+0x185/0x1c0
>>> do_syscall_64+0x62/0x190
>>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>> </TASK>
>>>
>>> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
>>> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>>>
>>> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
>>> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
>>> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
>>> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
>>> ---
>>> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
>>> 1 file changed, 8 insertions(+)
>>>
>>> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
>>> index 735b29f..3b24260 100644
>>> --- a/drivers/cpufreq/amd-pstate-ut.c
>>> +++ b/drivers/cpufreq/amd-pstate-ut.c
>>> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
>>> if (!policy)
>>> continue;
>>> cpudata = policy->driver_data;
>>> + if (!cpudata) {
>>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>>> + return -EINVAL;
>>> + }
>>>
>>> if (get_shared_mem()) {
>>> ret = cppc_get_perf_caps(cpu, &cppc_perf);
>>> @@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
>>> if (!policy)
>>> continue;
>>> cpudata = policy->driver_data;
>>> + if (!cpudata) {
>>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>>> + return -EINVAL;
>>> + }
>>
>> The only time I think this can happen is when the amd-pstate-ut races with a
>> the amd_pstate.*_cpu_exit() (probably as a result of concurrent mode switch)
>> or if you are running this without running amd-pstate as the cpufreq driver
>> (which the ut doesn't check for beforehand)
>>
>> My setup fails at this exact same point when I have the driver unloaded.
>> What is the output of following before you run into this issue:
>>
>> cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
>> cat /sys/devices/system/cpu/amd_pstate/status
>>
>> Are you doing any concurrent hotplug / mode switch?
>>
>>>
>>> if (!((policy->cpuinfo.max_freq >= cpudata->nominal_freq) &&
>>> (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
> In this machine, I got output as follow:
> ======================================================================================
> [root@ ~]# cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
> intel_cpufreq
> [root@ ~]# cat /sys/devices/system/cpu/amd_pstate/status
> cat: /sys/devices/system/cpu/amd_pstate/status: No such file or directory (os error 2)
> ======================================================================================
> Otherwise,I didn't do any concurrent hotplug / mode switch, just modprobe amd_pstate_ut.
>
It may be worth adding driver name detection to this ut driver, for
example via cpufreq_get_current_driver().
--
Thx and BRs,
Zhongqiu Han
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 11:08 ` Zhongqiu Han
@ 2026-07-14 17:16 ` Mario Limonciello
2026-07-15 2:52 ` Qianheng Peng
1 sibling, 0 replies; 8+ messages in thread
From: Mario Limonciello @ 2026-07-14 17:16 UTC (permalink / raw)
To: Zhongqiu Han, Qianheng Peng, kprateek.nayak
Cc: li.meng, linux-kernel, linux-pm, perry.yuan, rafael, ray.huang,
skhan, viresh.kumar, wangxb12, xiongl24, zhangar
On 7/14/26 06:08, Zhongqiu Han wrote:
> Hi Qianheng,
>
> On 7/14/2026 6:22 PM, Qianheng Peng wrote:
>> Hello K Prateek,
>> Thanks for questions.
>>
>> On 7/14/2026 14:39, K Prateek Nayak wrote:
>>> On 7/14/2026 1:29 PM, Qianheng Peng wrote:
>>>> The crash issue may occur when insmod amd_pstate_ut modules.
>>>>
>>>> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
>>>> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
>>>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>>>> #PF: supervisor read access in kernel mode
>>>> #PF: error_code(0x0000) - not-present page
>>>> PGD 0 P4D 0
>>>> Oops: 0000 [#1] SMP NOPTI
>>>> CPU: 0 PID: 20300 Comm: modprobe
>>>> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
>>>> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
>>>
>>> Is this an AMD platform?
>> No, it's Intel(R) Xeon(R) Gold 5128.
>>
>>>> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
>>>> Call Trace:
>>>> <TASK>
>>>> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
>>>> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
>>>> do_one_initcall+0x42/0x2e0
>>>> ? kmalloc_trace+0x26/0x90
>>>> do_init_module+0x60/0x240
>>>> __se_sys_init_module+0x185/0x1c0
>>>> do_syscall_64+0x62/0x190
>>>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>>> </TASK>
>>>>
>>>> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
>>>> amd_pstate_ut_check_freq() to avoid unpredicated null pointer
>>>> dereference.
>>>>
>>>> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-
>>>> pstate driver")
>>>> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
>>>> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
>>>> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
>>>> ---
>>>> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
>>>> 1 file changed, 8 insertions(+)
>>>>
>>>> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-
>>>> pstate-ut.c
>>>> index 735b29f..3b24260 100644
>>>> --- a/drivers/cpufreq/amd-pstate-ut.c
>>>> +++ b/drivers/cpufreq/amd-pstate-ut.c
>>>> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
>>>> if (!policy)
>>>> continue;
>>>> cpudata = policy->driver_data;
>>>> + if (!cpudata) {
>>>> + pr_err("%s driver_data of %s is empty!\n",
>>>> __func__, policy->kobj.name);
>>>> + return -EINVAL;
>>>> + }
>>>>
>>>> if (get_shared_mem()) {
>>>> ret = cppc_get_perf_caps(cpu, &cppc_perf);
>>>> @@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
>>>> if (!policy)
>>>> continue;
>>>> cpudata = policy->driver_data;
>>>> + if (!cpudata) {
>>>> + pr_err("%s driver_data of %s is empty!\n",
>>>> __func__, policy->kobj.name);
>>>> + return -EINVAL;
>>>> + }
>>>
>>> The only time I think this can happen is when the amd-pstate-ut races
>>> with a
>>> the amd_pstate.*_cpu_exit() (probably as a result of concurrent mode
>>> switch)
>>> or if you are running this without running amd-pstate as the cpufreq
>>> driver
>>> (which the ut doesn't check for beforehand)
>>>
>>> My setup fails at this exact same point when I have the driver unloaded.
>>> What is the output of following before you run into this issue:
>>>
>>> cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
>>> cat /sys/devices/system/cpu/amd_pstate/status
>>>
>>> Are you doing any concurrent hotplug / mode switch?
>>>
>>>>
>>>> if (!((policy->cpuinfo.max_freq >= cpudata-
>>>> >nominal_freq) &&
>>>> (cpudata->nominal_freq > cpudata-
>>>> >lowest_nonlinear_freq) &&
>> In this machine, I got output as follow:
>> ======================================================================================
>> [root@ ~]# cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
>> intel_cpufreq
>> [root@ ~]# cat /sys/devices/system/cpu/amd_pstate/status
>> cat: /sys/devices/system/cpu/amd_pstate/status: No such file or
>> directory (os error 2)
>> ======================================================================================
>> Otherwise,I didn't do any concurrent hotplug / mode switch, just
>> modprobe amd_pstate_ut.
>>
>
> It may be worth adding driver name detection to this ut driver, for
> example via cpufreq_get_current_driver().
>
>
Yeah I agree with this direction.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference
2026-07-14 11:08 ` Zhongqiu Han
2026-07-14 17:16 ` Mario Limonciello
@ 2026-07-15 2:52 ` Qianheng Peng
1 sibling, 0 replies; 8+ messages in thread
From: Qianheng Peng @ 2026-07-15 2:52 UTC (permalink / raw)
To: zhongqiu.han
Cc: kprateek.nayak, li.meng, linux-kernel, linux-pm,
mario.limonciello, pengqh1, perry.yuan, rafael, ray.huang, skhan,
viresh.kumar, wangxb12, xiongl24, zhangar
Hello Zhongqiu,
Thanks for review.
On 7/14/2026 19:08:34, Zhongqiu Han wrote:
>Hi Qianheng,
>
>On 7/14/2026 6:22 PM, Qianheng Peng wrote:
>> Hello K Prateek,
>> Thanks for questions.
>>
>> On 7/14/2026 14:39, K Prateek Nayak wrote:
>>> On 7/14/2026 1:29 PM, Qianheng Peng wrote:
>>>> The crash issue may occur when insmod amd_pstate_ut modules.
>>>>
>>>> amd_pstate_ut: 1 amd_pstate_ut_acpi_cpc_valid success!
>>>> amd_pstate_ut: 2 amd_pstate_ut_check_enabled success!
>>>> BUG: kernel NULL pointer dereference, address: 0000000000000080
>>>> #PF: supervisor read access in kernel mode
>>>> #PF: error_code(0x0000) - not-present page
>>>> PGD 0 P4D 0
>>>> Oops: 0000 [#1] SMP NOPTI
>>>> CPU: 0 PID: 20300 Comm: modprobe
>>>> Kdump: loaded Tainted: G O 6.6.0-0010.rc1.ctl4.x86_64 #1
>>>> Hardware name: FiberHome R2200 V5/Xeon Boards, BIOS 3.1a 02/24/2020
>>>
>>> Is this an AMD platform?
>> No, it's Intel(R) Xeon(R) Gold 5128.
>>
>>>> RIP: 0010:amd_pstate_ut_check_perf+0x141/0x280 [amd_pstate_ut]
>>>> Call Trace:
>>>> <TASK>
>>>> amd_pstate_ut_init+0x1b/0xff0 [amd_pstate_ut]
>>>> ? __pfx_amd_pstate_ut_init+0x10/0x10 [amd_pstate_ut]
>>>> do_one_initcall+0x42/0x2e0
>>>> ? kmalloc_trace+0x26/0x90
>>>> do_init_module+0x60/0x240
>>>> __se_sys_init_module+0x185/0x1c0
>>>> do_syscall_64+0x62/0x190
>>>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>>> </TASK>
>>>>
>>>> Add invalidation check of cpudata in amd_pstate_ut_check_perf() and
>>>> amd_pstate_ut_check_freq() to avoid unpredicated null pointer dereference.
>>>>
>>>> Fixes: 14eb1c96e3a3 ("cpufreq: amd-pstate: Add test module for amd-pstate driver")
>>>> Suggested-by: Li Xiong <xiongl24@chinatelecom.cn>
>>>> Suggested-by: Xibo Wang <wangxb12@chinatelecom.cn>
>>>> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
>>>> ---
>>>> drivers/cpufreq/amd-pstate-ut.c | 8 ++++++++
>>>> 1 file changed, 8 insertions(+)
>>>>
>>>> diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
>>>> index 735b29f..3b24260 100644
>>>> --- a/drivers/cpufreq/amd-pstate-ut.c
>>>> +++ b/drivers/cpufreq/amd-pstate-ut.c
>>>> @@ -157,6 +157,10 @@ static int amd_pstate_ut_check_perf(u32 index)
>>>> if (!policy)
>>>> continue;
>>>> cpudata = policy->driver_data;
>>>> + if (!cpudata) {
>>>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>>>> + return -EINVAL;
>>>> + }
>>>>
>>>> if (get_shared_mem()) {
>>>> ret = cppc_get_perf_caps(cpu, &cppc_perf);
>>>> @@ -229,6 +233,10 @@ static int amd_pstate_ut_check_freq(u32 index)
>>>> if (!policy)
>>>> continue;
>>>> cpudata = policy->driver_data;
>>>> + if (!cpudata) {
>>>> + pr_err("%s driver_data of %s is empty!\n", __func__, policy->kobj.name);
>>>> + return -EINVAL;
>>>> + }
>>>
>>> The only time I think this can happen is when the amd-pstate-ut races with a
>>> the amd_pstate.*_cpu_exit() (probably as a result of concurrent mode switch)
>>> or if you are running this without running amd-pstate as the cpufreq driver
>>> (which the ut doesn't check for beforehand)
>>>
>>> My setup fails at this exact same point when I have the driver unloaded.
>>> What is the output of following before you run into this issue:
>>>
>>> cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
>>> cat /sys/devices/system/cpu/amd_pstate/status
>>>
>>> Are you doing any concurrent hotplug / mode switch?
>>>
>>>>
>>>> if (!((policy->cpuinfo.max_freq >= cpudata->nominal_freq) &&
>>>> (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
>> In this machine, I got output as follow:
>> ======================================================================================
>> [root@ ~]# cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver
>> intel_cpufreq
>> [root@ ~]# cat /sys/devices/system/cpu/amd_pstate/status
>> cat: /sys/devices/system/cpu/amd_pstate/status: No such file or directory (os error 2)
>> ======================================================================================
>> Otherwise,I didn't do any concurrent hotplug / mode switch, just modprobe amd_pstate_ut.
>>
>
>It may be worth adding driver name detection to this ut driver, for
>example via cpufreq_get_current_driver().
This detection really make sense, I will post it in patch v2.
--
Thanks
Qianheng
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-07-15 3:00 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-14 7:59 [PATCH] cpufreq: amd-pstate-ut: fix null pointer dereference Qianheng Peng
2026-07-14 8:13 ` Viresh Kumar
2026-07-14 10:21 ` Qianheng Peng
2026-07-14 9:09 ` K Prateek Nayak
2026-07-14 10:22 ` Qianheng Peng
2026-07-14 11:08 ` Zhongqiu Han
2026-07-14 17:16 ` Mario Limonciello
2026-07-15 2:52 ` Qianheng Peng
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox