kernel crashes due to NULL pointer dereference when system runs in graphical mode

This document (000021151) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15 SP5

Situation

SLES15 SP5 virtual machine running with kernel version 5.14.21-150500.55.7.1 as a VMware guest crashes when it runs in graphical mode.

When the system runs in multi-user mode, the system is stable.

An example of the crash stack trace in the kernel kdump's "dmesg.txt" is shown below:

[   33.151091] BUG: kernel NULL pointer dereference, address: 0000000000000010
[   33.151119] #PF: supervisor read access in kernel mode
[   33.151121] #PF: error_code(0x0000) - not-present page
[   33.151123] PGD 0 P4D 0 
[   33.151126] Oops: 0000 [#1] PREEMPT SMP PTI
[   33.151129] CPU: 0 PID: 1985 Comm: X Kdump: loaded Tainted: G        W      X    5.14.21-150500.55.7-default #1 SLE15-SP5 620c7ef889d6152093b9f0b89e9d5debaf36da89
[   33.151133] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20904234.B64.2212051119 12/05/2022
[   33.151136] RIP: 0010:drm_gem_object_release_handle+0x19/0x60 [drm]
[   33.151161] Code: 89 df be 03 00 00 00 5b 5d e9 c3 9d 6f d3 0f 1f 00 0f 1f 44 00 00 41 54 55 41 89 fc 53 48 8b 86 30 01 00 00 48 89 f3 48 89 d5 <48> 8b 40 10 48 85 c0 74 0b 48 89 d6 48 89 df ff d0 0f 1f 00 48 8d
[   33.151165] RSP: 0018:ffffb099c30a7c68 EFLAGS: 00010287
[   33.151167] RAX: 0000000000000000 RBX: ffff8c31c3eb8e00 RCX: 0000000000000000
[   33.151169] RDX: ffff8c31ca686a00 RSI: ffff8c31c3eb8e00 RDI: 000000000000000a
[   33.151171] RBP: ffff8c31ca686a00 R08: 0000000000000228 R09: ffff8c323ec4b488
[   33.151173] R10: ffffb099c30a7c50 R11: ffff8c31ca686a48 R12: 000000000000000a
[   33.151175] R13: ffff8c31ca686a40 R14: 000000000000000a R15: ffffffffc09654f0
[   33.151177] FS:  00007f4c5c78d980(0000) GS:ffff8c3217000000(0000) knlGS:0000000000000000
[   33.151180] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   33.151182] CR2: 0000000000000010 CR3: 0000000005bf0003 CR4: 0000000000370ef0
[   33.151185] Call Trace:
[   33.151188]  <TASK>
[   33.151191]  drm_gem_handle_delete+0x5e/0x90 [drm a2dcf0986757ad27ff79cfc51c9ee1229e18d000]
[   33.151206]  ? vmw_bo_create+0xa0/0xa0 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151219]  vmw_bo_unref_ioctl+0xf/0x20 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151227]  drm_ioctl_kernel+0xb8/0x150 [drm a2dcf0986757ad27ff79cfc51c9ee1229e18d000]
[   33.151241]  ? vmw_bo_create+0xa0/0xa0 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151249]  drm_ioctl+0x35a/0x400 [drm a2dcf0986757ad27ff79cfc51c9ee1229e18d000]
[   33.151264]  ? vmw_bo_create+0xa0/0xa0 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151273]  ? vmw_bo_create+0xa0/0xa0 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151280]  ? drm_ioctl_kernel+0x150/0x150 [drm a2dcf0986757ad27ff79cfc51c9ee1229e18d000]
[   33.151293]  vmw_generic_ioctl+0x77/0x120 [vmwgfx 1f3c4e199c6ac651f7c2c4601947ecba87b6fa81]
[   33.151300]  __x64_sys_ioctl+0x8f/0xd0
[   33.151305]  do_syscall_64+0x58/0x80
[   33.151310]  ? syscall_exit_to_user_mode+0x18/0x40
[   33.151312]  ? do_syscall_64+0x67/0x80
[   33.151314]  ? do_user_addr_fault+0x1ff/0x730
[   33.151317]  ? exit_to_user_mode_prepare+0xfe/0x240
[   33.151320]  ? exc_page_fault+0x67/0x150
[   33.151323]  entry_SYSCALL_64_after_hwframe+0x61/0xcb

Resolution

Upgrade the kernel to version 5.14.21-150500.55.19 or higher.

Cause

This issue is caused by a bug in the "vmwgfx" and "drm" modules in SLES15 SP5 kernel version 5.14.21-150500.55.7.1.

Status

Reported to Engineering

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.