From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.alien8.de (mail.alien8.de [65.109.113.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0822527FB3A for ; Mon, 24 Nov 2025 20:00:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=65.109.113.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764014450; cv=none; b=Jd9E4eNlLaTZ/x6mkyCfcTNomvuhCAGpjvu+bD0hksGKT49pybJjMjgAK0nRYYvd5Yt1vogi+QFgjG3/3ZxMsPFqUkjPSzFQhvPdwSqkY9dqnBO3cQjAsSlwjqp9LU339Vr4Axk4TQl2z6r1Kn8ownyH0lpG3q1wXX1uvzcEjkg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764014450; c=relaxed/simple; bh=mtbtH+XQAgFTKoySb9KXnSQiD5B/WEzaLczrq4jXnu0=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=MUDYCGZeySBwv5cx8Zg5ug/mORumv+jzu6GhIfD1VBfEpJDZo/GQJwnrKOCp2ZzlUc9yC6w7KBaX6eyZTgP5WDqcOGMNcSSmFUcXwQRhSbmwthO7bPLO3YNLpZmfyk5Y+YprvBKRIF1HOqB5V+8Cvm8HV9l4v7UhG8SIk5z4YlE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de; spf=pass smtp.mailfrom=alien8.de; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b=IxO8NA7k; arc=none smtp.client-ip=65.109.113.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=alien8.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b="IxO8NA7k" Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTP id 5092540E0217; Mon, 24 Nov 2025 20:00:43 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at mail.alien8.de Authentication-Results: mail.alien8.de (amavisd-new); dkim=pass (4096-bit key) header.d=alien8.de Received: from mail.alien8.de ([127.0.0.1]) by localhost (mail.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id x5ieMwwASOXg; Mon, 24 Nov 2025 20:00:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=alien8; t=1764014437; bh=fVa9+bWXGsaAAHJRdGvXgo0L5GfmsXLbH+8WHHHHwVc=; h=Date:From:To:Cc:Subject:From; b=IxO8NA7kFjDsVsTQ9pqeegOJpH5CiA6Xw1Xvox8Z8d7x3Pr+6MzA06RGlThjsB0JH HdLIzdpS9RCRyv/5I+PoC4iQgQH4N5CtuL5K5leVttX3bOm4lWUSxB2aEguuXrYGJ+ Pp7l00vt9S/xkqw5u2lpvL0nnBs5t8eUOccaW76XM3KJH0y2wE4TH8sgjJyqyBDNGq 6yts+yzbPUtqRJSKy41c+CIWOYzylxOk8c3CXMDBcLsq0whJUaZnUWxU+fnTEfIEKM eoz/cR7xVMZ3X44qc6LejDqsHIQ+v/O8ZOuWN5o1wQLiuKyhzKLFiChUIAJGQjXdWF Lp+OuHL14evqI/XvrxJ9vAWbGruT33QUSVNOBdhyFAQEQFv5hPh0MYNXGhGQ5hbugT dIAX7mg6qiru6WIVKswLbqtP4CGCx6JaGeLnqY7NkL+/WDEqwhhoWMsfVtpmQAZF+0 JGH1U3mgFAXhffh8qKoK1hDgMxFKansjLq878t3wIHmLtIjJsfGDpb8cnV3MN4HRxs h3F77P8UWvUDwzUVAeHA6aSm3PiEJESX9aWcttWpo+e6N4M75whNgWiz1llWv3mChh rFwkUeoQSUfhiECm8fc2p8JmOG2QJJ09szif73l3G4sK1ddmhHtyXQv80As1Tu4Lhi 6IS5QOQNFHRE6BowwpUvzB4Q= Received: from zn.tnic (p57969402.dip0.t-ipconnect.de [87.150.148.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with UTF8SMTPSA id 5152240E0200; Mon, 24 Nov 2025 20:00:34 +0000 (UTC) Date: Mon, 24 Nov 2025 21:00:19 +0100 From: Borislav Petkov To: "Rafael J. Wysocki" Cc: x86-ml , lkml Subject: NULL ptr deref in acpi_idle_enter+0x46/0x100 Message-ID: <20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Hey, I'm seeing this on one of my old test boxes here with -rc7 + the whole tip lineup. [ 2.968330] Initialise system trusted keyrings [ 2.973149] workingset: timestamp_bits=62 max_order=20 bucket_order=0 [ 2.980130] 9p: Installing v9fs 9p2000 file system support [ 2.985963] Key type asymmetric registered [ 2.990178] Asymmetric key parser 'x509' registered [ 2.995213] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 3.005889] ACPI: processor limited to max C-state 1 This might be relevant... [ 3.011766] BUG: kernel NULL pointer dereference, address: 0000000000000001 [ 3.015317] #PF: supervisor read access in kernel mode [ 3.015317] #PF: error_code(0x0000) - not-present page [ 3.015317] PGD 0 P4D 0 [ 3.015317] Oops: Oops: 0000 [#1] SMP NOPTI [ 3.015317] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-rc7+ #1 PREEMPT(full) [ 3.015317] Hardware name: MICRO-STAR INTERNATIONAL CO.,LTD MS-7599/870-C45 (MS-7599), BIOS V1.15 03/04/21 [ 3.015317] RIP: 0010:acpi_idle_enter+0x46/0x100 [ 3.015317] Code: 48 8d 04 c5 60 00 1c 83 48 8b 14 d5 40 8c 19 82 48 8b 2c 02 e8 7b ee ff ff 65 48 8b 35 6 [ 3.015317] RSP: 0018:ffffffff82403e18 EFLAGS: 00010086 [ 3.015317] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffffffff819b196d [ 3.015317] RDX: ffff8881ac267000 RSI: ffff888100269c00 RDI: ffffffff82152352 [ 3.015317] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 3.015317] R10: 0000000000000000 R11: 000000008240d201 R12: ffff888100e74c00 [ 3.015317] R13: ffffffff82bae2a0 R14: ffffffff82bae2a0 R15: 0000000000000000 [ 3.015317] FS: 0000000000000000(0000) GS:ffff8881ac267000(0000) knlGS:0000000000000000 [ 3.015317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3.015317] CR2: 0000000000000001 CR3: 000000000241a000 CR4: 00000000000006f0 [ 3.015317] Call Trace: [ 3.015317] [ 3.015317] cpuidle_enter_state+0xb0/0x4d0 [ 3.015317] cpuidle_enter+0x2d/0x40 [ 3.015317] do_idle+0x1b4/0x230 [ 3.015317] cpu_startup_entry+0x25/0x30 [ 3.015317] rest_init+0x14d/0x150 [ 3.015317] start_kernel+0x645/0x650 [ 3.015317] x86_64_start_reservations+0x20/0x20 [ 3.015317] x86_64_start_kernel+0xc3/0xd0 [ 3.015317] common_startup_64+0x12c/0x138 [ 3.015317] [ 3.015317] Modules linked in: [ 3.015317] CR2: 0000000000000001 [ 3.015317] ---[ end trace 0000000000000000 ]--- ffffffff81c0b6a0: e8 7b ee ff ff call ffffffff81c0a520 <__this_cpu_preempt_check> ffffffff81c0b6a5: 65 48 8b 35 a3 49 5b mov %gs:0x15b49a3(%rip),%rsi # ffffffff831c0050 ffffffff81c0b6ac: 01 ffffffff81c0b6ad: 48 85 f6 test %rsi,%rsi ffffffff81c0b6b0: 0f 84 8a 00 00 00 je ffffffff81c0b740 ffffffff81c0b6b6: 0f b6 45 01 movzbl 0x1(%rbp),%eax <--- here ffffffff81c0b6ba: 3c 01 cmp $0x1,%al which is: # drivers/acpi/processor_idle.c:680: struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu); # drivers/acpi/processor_idle.c:680: struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu); movq (%rdx,%rax), %rbp # *_26, cx # drivers/acpi/processor_idle.c:683: pr = __this_cpu_read(processors); call __this_cpu_preempt_check # # drivers/acpi/processor_idle.c:683: pr = __this_cpu_read(processors); movq %gs:processors(%rip), %rsi # processors, pscr_ret__ # drivers/acpi/processor_idle.c:684: if (unlikely(!pr)) testq %rsi, %rsi # pscr_ret__ je .L175 #, # drivers/acpi/processor_idle.c:687: if (cx->type != ACPI_STATE_C1) { movzbl 1(%rbp), %eax # cx_27->type, _9 # drivers/acpi/processor_idle.c:687: if (cx->type != ACPI_STATE_C1) { cmpb $1, %al #, _9 je .L164 #, Looks like that cx pointer is NULL: static int __cpuidle acpi_idle_enter(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index) { struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu); struct acpi_processor *pr; pr = __this_cpu_read(processors); if (unlikely(!pr)) return -EINVAL; if (cx->type != ACPI_STATE_C1) { ^^^^^ I can try to bisect if you don't get any ideas from seeing this. There might be some crap in tip too, who knows. Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette