panic on show_attr

panic on show_attr

[Li,Rongqing]

When both the intel-uncore-frequency.ko and intel-uncore-frequency-tpmi.ko modules are loaded, if the probing of intel-uncore-frequency-tpmi fails, the intel_uncore_frequency_tpmi module fails to load. However, uncore_freq_common_init() called by intel-uncore-frequency-tpmi has already replaced the uncore_read and uncore_write function pointers with those from intel-uncore-frequency-tpmi. Subsequent access to sysfs will then trigger a kernel panic.

[  288.179765] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  288.179772] #PF: supervisor read access in kernel mode
[  288.179775] #PF: error_code(0x0000) - not-present page
[  288.179776] PGD 7fabf95067 P4D 7fabf95067 PUD 7f929e2067 PMD 0
[  288.179780] Oops: 0000 [#1] PREEMPT SMP NOPTI
[  288.179783] CPU: 137 PID: 56850 Comm: cat Kdump: loaded Tainted: G           OE      6.6.0#3 
[  288.179787] RIP: 0010:uncore_read+0xb9/0x1e0 [intel_uncore_frequency_tpmi]
[  288.179793] Code: 84 df 00 00 00 48 c1 e8 0f 5b 83 e0 7f 69 c0 a0 86 01 00 89 06 31 c0 c3 cc cc cc cc 80 7f f0 00 0f 85 11 01 00 00 48 8b 47 f8 <48> 8b 00 83 e0 7f 5b 69 c0 a0 86 01 00 89 06 31 c0 c3 cc
 cc cc cc
[  288.179796] RSP: 0018:ffffc9000b5bfdb0 EFLAGS: 00010246
[  288.179798] RAX: 0000000000000000 RBX: ffff88ffcac4f400 RCX: 0000000000000000
[  288.179800] RDX: 0000000000000002 RSI: ffffc9000b5bfdc4 RDI: ffff88ffcac4f400
[  288.179801] RBP: 0000000000000002 R08: ffff88ffcb3c7b80 R09: 0000000000001000
[  288.179802] R10: 0000000000001000 R11: 0000000000000000 R12: ffff88ffcb080000
[  288.179803] R13: 0000000000000001 R14: 0000000000000001 R15: ffff88ffcb0b8000
[  288.179804] FS:  00007f6b530b3740(0000) GS:ffff88ff7f840000(0000) knlGS:0000000000000000
[  288.179806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  288.179808] CR2: 0000000000000000 CR3: 0000007f8f0e0003 CR4: 0000000000770ee0
[  288.179809] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  288.179810] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[  288.179812] PKRU: 55555554
[  288.179812] Call Trace:
[  288.179814]  <TASK>
[  288.179816]  ? __die_body+0x1a/0x60
[  288.179822]  ? page_fault_oops+0x15d/0x460
[  288.179827]  ? xas_load+0x9/0xa0
[  288.179831]  ? filemap_get_entry+0xe2/0x160
[  288.179837]  ? exc_page_fault+0x60e/0x7f0
[  288.179840]  ? __mod_memcg_lruvec_state+0x4a/0xa0
[  288.179844]  ? asm_exc_page_fault+0x22/0x30
[  288.179848]  ? uncore_read+0xb9/0x1e0 [intel_uncore_frequency_tpmi]
[  288.179852]  show_attr+0x44/0xa0 [intel_uncore_frequency_common]
[  288.179857]  sysfs_kf_seq_show+0xa7/0x100
[  288.179862]  seq_read_iter+0x186/0x3e0
[  288.179866]  vfs_read+0x214/0x310
[  288.179869]  ksys_read+0x59/0xd0
[  288.179871]  do_syscall_64+0x8a/0x100
[  288.179875]  entry_SYSCALL_64_after_hwframe+0x78/0xe2

Re: panic on show_attr

[srinivas pandruvada]

On Thu, 2025-11-20 at 01:59 +0000, Li,Rongqing wrote:
> When both the intel-uncore-frequency.ko and intel-uncore-frequency-
> tpmi.ko modules are loaded, if the probing of intel-uncore-frequency-
> tpmi fails, the intel_uncore_frequency_tpmi module fails to load.
> However, uncore_freq_common_init() called by intel-uncore-frequency-
> tpmi has already replaced the uncore_read and uncore_write function
> pointers with those from intel-uncore-frequency-tpmi. Subsequent
> access to sysfs will then trigger a kernel panic.

If probe fails then there should be nothing to read from sysfs.
Please confirm your kernel version.
Particularly if you have a change

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c?h=v6.18-rc6&id=db643cb7ebe524d17b4b13583dda03485d4a1bc0

Thanks,
Srinivas

> 
> [  288.179765] BUG: kernel NULL pointer dereference, address:
> 0000000000000000
> [  288.179772] #PF: supervisor read access in kernel mode
> [  288.179775] #PF: error_code(0x0000) - not-present page
> [  288.179776] PGD 7fabf95067 P4D 7fabf95067 PUD 7f929e2067 PMD 0
> [  288.179780] Oops: 0000 [#1] PREEMPT SMP NOPTI
> [  288.179783] CPU: 137 PID: 56850 Comm: cat Kdump: loaded Tainted:
> G           OE      6.6.0#3 
> [  288.179787] RIP: 0010:uncore_read+0xb9/0x1e0
> [intel_uncore_frequency_tpmi]
> [  288.179793] Code: 84 df 00 00 00 48 c1 e8 0f 5b 83 e0 7f 69 c0 a0
> 86 01 00 89 06 31 c0 c3 cc cc cc cc 80 7f f0 00 0f 85 11 01 00 00 48
> 8b 47 f8 <48> 8b 00 83 e0 7f 5b 69 c0 a0 86 01 00 89 06 31 c0 c3 cc
>  cc cc cc
> [  288.179796] RSP: 0018:ffffc9000b5bfdb0 EFLAGS: 00010246
> [  288.179798] RAX: 0000000000000000 RBX: ffff88ffcac4f400 RCX:
> 0000000000000000
> [  288.179800] RDX: 0000000000000002 RSI: ffffc9000b5bfdc4 RDI:
> ffff88ffcac4f400
> [  288.179801] RBP: 0000000000000002 R08: ffff88ffcb3c7b80 R09:
> 0000000000001000
> [  288.179802] R10: 0000000000001000 R11: 0000000000000000 R12:
> ffff88ffcb080000
> [  288.179803] R13: 0000000000000001 R14: 0000000000000001 R15:
> ffff88ffcb0b8000
> [  288.179804] FS:  00007f6b530b3740(0000) GS:ffff88ff7f840000(0000)
> knlGS:0000000000000000
> [  288.179806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  288.179808] CR2: 0000000000000000 CR3: 0000007f8f0e0003 CR4:
> 0000000000770ee0
> [  288.179809] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [  288.179810] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
> 0000000000000400
> [  288.179812] PKRU: 55555554
> [  288.179812] Call Trace:
> [  288.179814]  <TASK>
> [  288.179816]  ? __die_body+0x1a/0x60
> [  288.179822]  ? page_fault_oops+0x15d/0x460
> [  288.179827]  ? xas_load+0x9/0xa0
> [  288.179831]  ? filemap_get_entry+0xe2/0x160
> [  288.179837]  ? exc_page_fault+0x60e/0x7f0
> [  288.179840]  ? __mod_memcg_lruvec_state+0x4a/0xa0
> [  288.179844]  ? asm_exc_page_fault+0x22/0x30
> [  288.179848]  ? uncore_read+0xb9/0x1e0
> [intel_uncore_frequency_tpmi]
> [  288.179852]  show_attr+0x44/0xa0 [intel_uncore_frequency_common]
> [  288.179857]  sysfs_kf_seq_show+0xa7/0x100
> [  288.179862]  seq_read_iter+0x186/0x3e0
> [  288.179866]  vfs_read+0x214/0x310
> [  288.179869]  ksys_read+0x59/0xd0
> [  288.179871]  do_syscall_64+0x8a/0x100
> [  288.179875]  entry_SYSCALL_64_after_hwframe+0x78/0xe2

Re: panic on show_attr

[srinivas pandruvada]

On Thu, 2025-11-20 at 09:46 -0800, srinivas pandruvada wrote:
> On Thu, 2025-11-20 at 01:59 +0000, Li,Rongqing wrote:
> > When both the intel-uncore-frequency.ko and intel-uncore-frequency-
> > tpmi.ko modules are loaded, if the probing of intel-uncore-
> > frequency-
> > tpmi fails, the intel_uncore_frequency_tpmi module fails to load.
> > However, uncore_freq_common_init() called by intel-uncore-
> > frequency-
> > tpmi has already replaced the uncore_read and uncore_write function
> > pointers with those from intel-uncore-frequency-tpmi. Subsequent
> > access to sysfs will then trigger a kernel panic.
> 
> If probe fails then there should be nothing to read from sysfs.
> Please confirm your kernel version.
> Particularly if you have a change
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c?h=v6.18-rc6&id=db643cb7ebe524d17b4b13583dda03485d4a1bc0
> 

Also you said you said intel-uncore-frequency.ko is loaded. That means
that your kernel may have added a cpu model here for this platform
which has TPMI. I think better to reproduce in an upstream kernel.
https://elixir.bootlin.com/linux/v6.17.8/source/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c#L230

Thanks,
Srinivas

> Thanks,
> Srinivas
> 
> > 
> > [  288.179765] BUG: kernel NULL pointer dereference, address:
> > 0000000000000000
> > [  288.179772] #PF: supervisor read access in kernel mode
> > [  288.179775] #PF: error_code(0x0000) - not-present page
> > [  288.179776] PGD 7fabf95067 P4D 7fabf95067 PUD 7f929e2067 PMD 0
> > [  288.179780] Oops: 0000 [#1] PREEMPT SMP NOPTI
> > [  288.179783] CPU: 137 PID: 56850 Comm: cat Kdump: loaded Tainted:
> > G           OE      6.6.0#3 
> > [  288.179787] RIP: 0010:uncore_read+0xb9/0x1e0
> > [intel_uncore_frequency_tpmi]
> > [  288.179793] Code: 84 df 00 00 00 48 c1 e8 0f 5b 83 e0 7f 69 c0
> > a0
> > 86 01 00 89 06 31 c0 c3 cc cc cc cc 80 7f f0 00 0f 85 11 01 00 00
> > 48
> > 8b 47 f8 <48> 8b 00 83 e0 7f 5b 69 c0 a0 86 01 00 89 06 31 c0 c3 cc
> >  cc cc cc
> > [  288.179796] RSP: 0018:ffffc9000b5bfdb0 EFLAGS: 00010246
> > [  288.179798] RAX: 0000000000000000 RBX: ffff88ffcac4f400 RCX:
> > 0000000000000000
> > [  288.179800] RDX: 0000000000000002 RSI: ffffc9000b5bfdc4 RDI:
> > ffff88ffcac4f400
> > [  288.179801] RBP: 0000000000000002 R08: ffff88ffcb3c7b80 R09:
> > 0000000000001000
> > [  288.179802] R10: 0000000000001000 R11: 0000000000000000 R12:
> > ffff88ffcb080000
> > [  288.179803] R13: 0000000000000001 R14: 0000000000000001 R15:
> > ffff88ffcb0b8000
> > [  288.179804] FS:  00007f6b530b3740(0000)
> > GS:ffff88ff7f840000(0000)
> > knlGS:0000000000000000
> > [  288.179806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [  288.179808] CR2: 0000000000000000 CR3: 0000007f8f0e0003 CR4:
> > 0000000000770ee0
> > [  288.179809] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> > 0000000000000000
> > [  288.179810] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7:
> > 0000000000000400
> > [  288.179812] PKRU: 55555554
> > [  288.179812] Call Trace:
> > [  288.179814]  <TASK>
> > [  288.179816]  ? __die_body+0x1a/0x60
> > [  288.179822]  ? page_fault_oops+0x15d/0x460
> > [  288.179827]  ? xas_load+0x9/0xa0
> > [  288.179831]  ? filemap_get_entry+0xe2/0x160
> > [  288.179837]  ? exc_page_fault+0x60e/0x7f0
> > [  288.179840]  ? __mod_memcg_lruvec_state+0x4a/0xa0
> > [  288.179844]  ? asm_exc_page_fault+0x22/0x30
> > [  288.179848]  ? uncore_read+0xb9/0x1e0
> > [intel_uncore_frequency_tpmi]
> > [  288.179852]  show_attr+0x44/0xa0 [intel_uncore_frequency_common]
> > [  288.179857]  sysfs_kf_seq_show+0xa7/0x100
> > [  288.179862]  seq_read_iter+0x186/0x3e0
> > [  288.179866]  vfs_read+0x214/0x310
> > [  288.179869]  ksys_read+0x59/0xd0
> > [  288.179871]  do_syscall_64+0x8a/0x100
> > [  288.179875]  entry_SYSCALL_64_after_hwframe+0x78/0xe2

RE: [外部邮件] Re: panic on show_attr

[Li,Rongqing]

> 
> Also you said you said intel-uncore-frequency.ko is loaded. That means that
> your kernel may have added a cpu model here for this platform which has
> TPMI. I think better to reproduce in an upstream kernel.
> https://elixir.bootlin.com/linux/v6.17.8/source/drivers/platform/x86/intel/u
> ncore-frequency/uncore-frequency.c#L230
> 

Upstream has not issue, sorry for noise

Thanks

-Li