Bug 106559 - NULL pointer dereference in Intel HD Graphics driver (i915)
Summary: NULL pointer dereference in Intel HD Graphics driver (i915)
Status: CLOSED FIXED
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: XOrg git
Hardware: Other All
: medium normal
Assignee: Chris Wilson
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard: Triaged
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-18 02:02 UTC by besento
Modified: 2018-06-20 08:25 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
Boot Log (4.95 KB, text/x-log)
2018-05-18 02:02 UTC, besento
no flags Details

Description besento 2018-05-18 02:02:07 UTC
Created attachment 139620 [details]
Boot Log

I am running Arch Linux with kernel version 4.16.8 on a Thinkpad X200, on boot a few times the computer would just hang. Upon a sucessfull boot I looked at the logs and saw that a NULL pointer dereference bug occured. 

I have attached a log of the boot.
Comment 1 Francesco Balestrieri 2018-05-18 04:34:27 UTC
Can you try to reproduce with the latest drm-tip? Here are the instructions if you need them: http://01.org/linuxgraphics/documentation/build-guide-0

Also, please enable debug logs with drm.debug=0x1e and log_buf_len=1M and attach a full dmesg output from boot.

Thanks!
Comment 2 Chris Wilson 2018-05-18 07:33:27 UTC
It jumped to a NULL vfunc from intel_modeset_setup_hw_state+0x385/0xf60 from a ACPI lid notifier. I guess we received an event before we finished setting up the internals, are we registering the notifier too early?
Comment 3 Francesco Balestrieri 2018-05-18 08:02:41 UTC
(In reply to Francesco Balestrieri from comment #1)
> Can you try to reproduce with the latest drm-tip? Here are the instructions
> if you need them: http://01.org/linuxgraphics/documentation/build-guide-0
> 
> Also, please enable debug logs with drm.debug=0x1e and log_buf_len=1M and
> attach a full dmesg output from boot.
> 
> Thanks!

No point trying drm-tip then as Chris already sent a patch to fix this.
Comment 4 Chris Wilson 2018-05-18 08:08:42 UTC
Please try https://patchwork.freedesktop.org/patch/223970/
Comment 5 Chris Wilson 2018-05-19 14:31:45 UTC
commit e578a570dc7c20475774d1ff993825e3bd7a7011
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri May 18 08:48:40 2018 +0100

    drm/i915/lvds: Move acpi lid notification registration to registration phase
    
    Delay registering ourselves with the acpi lid notification mechanism
    until we are registering the connectors after initialisation is
    complete. This prevents a possibility of trying to handle the lid
    notification before we are ready with the danger of chasing
    uninitialised function pointers.
    
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
     IP:           (null)
     PGD 0 P4D 0
     Oops: 0010 [#1] PREEMPT SMP PTI
     Modules linked in: arc4(+) iwldvm(+) i915(+) mac80211 i2c_algo_bit coretemp mei_wdt iwlwifi drm_kms_helper kvm_intel wmi_bmof iTCO_wdt iTCO_vendor_support kvm snd_hda_codec_cone
xant snd_hda_codec_generic drm psmouse cfg80211 irqbypass input_leds pcspkr i2c_i801 snd_hda_intel snd_hda_codec thinkpad_acpi snd_hda_core mei_me lpc_ich snd_hwdep e1000e wmi nvram 
snd_pcm mei snd_timer shpchp ptp pps_core rfkill syscopyarea snd intel_agp sysfillrect intel_gtt soundcore sysimgblt battery led_class fb_sys_fops ac rtc_cmos agpgart evdev mac_hid a
cpi_cpufreq ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto crypto_simd glue_helper cryptd aes_x86_64 xts algif_skcipher af_alg dm_crypt dm_mod sd_mod uas usb_stor
age serio_raw atkbd libps2 ahci libahci uhci_hcd libata scsi_mod ehci_pci
      ehci_hcd usbcore usb_common i8042 serio
     CPU: 1 PID: 378 Comm: systemd-logind Not tainted 4.16.8-1-ARCH #1
     Hardware name: LENOVO 7454CTO/7454CTO, BIOS 6DET72WW (3.22 ) 10/25/2012
     RIP: 0010:          (null)
     RSP: 0018:ffffaf4580c33a18 EFLAGS: 00010287
     RAX: 0000000000000000 RBX: ffff947533558000 RCX: 000000000000003e
     RDX: ffffffffc0aa80c0 RSI: ffffaf4580c33a3c RDI: ffff947534e4c000
     RBP: ffff947533558338 R08: ffff947534598930 R09: ffffffffc0a928b1
     R10: ffffd8f181d5fd40 R11: 0000000000000000 R12: ffffffffc0a928b1
     R13: ffff947533558368 R14: ffffffffc0a928a9 R15: ffff947534e4c000
     FS:  00007f3dc4ddb940(0000) GS:ffff947539280000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000000 CR3: 000000006e214000 CR4: 00000000000406e0
     Call Trace:
      ?  intel_modeset_setup_hw_state+0x385/0xf60 [i915]
      ? __intel_display_resume+0x1e/0xc0 [i915]
      ? intel_display_resume+0xcc/0x120 [i915]
      ? intel_lid_notify+0xbc/0xc0 [i915]
      ? notifier_call_chain+0x47/0x70
      ? blocking_notifier_call_chain+0x3e/0x60
      ? acpi_lid_notify_state+0x8f/0x1d0
      ? acpi_lid_update_state+0x49/0x70
      ? acpi_lid_input_open+0x60/0x90
      ? input_open_device+0x5d/0xa0
      ? evdev_open+0x1ba/0x1e0 [evdev]
      ? chrdev_open+0xa3/0x1b0
      ? cdev_put.part.0+0x20/0x20
      ? do_dentry_open+0x14c/0x300
      ? path_openat+0x30c/0x1240
      ? current_time+0x16/0x60
      ? do_filp_open+0x93/0x100
      ? __check_object_size+0xfb/0x180
      ? do_sys_open+0x186/0x210
      ? do_syscall_64+0x74/0x190
      ?  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
     Code:  Bad RIP value.
     RIP:           (null) RSP: ffffaf4580c33a18
     CR2: 0000000000000000
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=106559
    Fixes: c1c7af608920 ("drm/i915: force mode set at lid open time")
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Reviewed-by: Jani Nikula <jani.nikula@intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20180518074840.16194-1-chris@chris-wilson.co.uk
    Cc: stable@vger.kernel.org
Comment 6 Jani Saarinen 2018-06-04 14:34:08 UTC
Reporter, can you verify with drm-tip?
Comment 7 Radosław Szwichtenberg 2018-06-20 08:25:29 UTC
No feedback from the submitter - assuming the issue is fixed.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.