Pi 5: NULL deref oops in dma_direct_unmap_sg via drm_gem_prime_fd_to_handle error path during HDMI hotplug (6.18.34+rpt)

[serialseb]

Describe the bug

NULL pointer dereference (kernel Oops, [#1]) in dma_direct_unmap_sg, reached through the DRM PRIME import error/cleanup path (drm_gem_prime_import_dev → dma_buf_unmap_attachment_unlocked → drm_gem_unmap_dma_buf), when a userspace process calls DRM_IOCTL_PRIME_FD_TO_HANDLE concurrently with an HDMI hotplug disconnect. The faulting process (a Chromium-family "Renderer") is killed mid-ioctl inside the DRM core; the X session never recovers (display and input dead, kernel otherwise healthy).

To reproduce

Not reliably reproducible on demand; observed when the attached TV dropped/re-asserted the HDMI link (TV auto-standby after DPMS off) at the same moment a browser renderer imported a dma-buf. The identical hotplug flap occurs several times a day here without harm — the oops needs the import call to race the disconnect.

Sequence observed in the log:

1. HDMI connector disconnect + immediate re-detect (EDID re-read succeeds, DDC then unresponsive — TV entering standby)
2. ~4 s later, a Renderer process issues DRM_IOCTL_PRIME_FD_TO_HANDLE
3. Oops below; the ioctl's error path unmaps an attachment whose sgt appears to be NULL

Expected behaviour

The PRIME import error path tolerates the connector going away; the ioctl fails cleanly instead of oopsing.

System

• Raspberry Pi 5 Model B Rev 1.1
• Debian trixie (arm64), X11/KDE session
• Kernel: 6.18.34+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.18.34-1+rpt1, 16k pages
• Display: LG 4K TV on HDMI-A-1 (vc4)

Oops

Unable to handle kernel NULL pointer dereference at virtual address 000000000000001c
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 16k pages, 47-bit VAs, pgdp=00000003aa0cc000
[000000000000001c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1]  SMP
CPU: 0 UID: 1000 PID: 1274022 Comm: Renderer Tainted: G        W           6.18.34+rpt-rpi-2712 #1 PREEMPT  Debian 1:6.18.34-1+rpt1
Tainted: [W]=WARN
Hardware name: Raspberry Pi 5 Model B Rev 1.1 (DT)
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : dma_direct_unmap_sg+0x84/0x260
lr : dma_unmap_sg_attrs+0x60/0x148
sp : ffffc0008fa63ac0
x29: ffffc0008fa63ac0 x28: ffffc0008fa63d08 x27: 0000000000000020
x26: 0000000000000000 x25: 0000000000000020 x24: ffff800002149010
x23: 0000000000000498 x22: 0000000000000000 x21: 0000000000000000
x20: ffff800002149010 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: ffffe2eeba37e008 x15: 00007fff0140bc68
x14: ffffffbfc0000000 x13: 0000000000000000 x12: 0000000000000000
x11: ffff80007ff7a980 x10: 0000000000000000 x9 : ffffe2eeba37e068
x8 : ffff8003956ea8c8 x7 : 0000000000000000 x6 : 000000000000003f
x5 : ffff800014172d80 x4 : 0000000000000020 x3 : 0000000000000000
x2 : 0000000000000498 x1 : 0000000000000000 x0 : ffff800002149010
Call trace:
 dma_direct_unmap_sg+0x84/0x260 (P)
 dma_unmap_sg_attrs+0x60/0x148
 drm_gem_unmap_dma_buf+0x38/0x68 [drm]
 dma_buf_unmap_attachment+0x3c/0xa0
 dma_buf_unmap_attachment_unlocked+0x58/0x98
 drm_gem_prime_import_dev+0x1a0/0x1e0 [drm]
 drm_gem_prime_fd_to_handle+0x1a8/0x280 [drm]
 drm_prime_fd_to_handle_ioctl+0x40/0x58 [drm]
 drm_ioctl_kernel+0xc8/0x140 [drm]
 drm_ioctl+0x368/0x4e8 [drm]
 __arm64_sys_ioctl+0xb4/0x120
 invoke_syscall+0x4c/0x100
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x38/0x120
 el0t_64_sync_handler+0xa0/0xe8
 el0t_64_sync+0x198/0x1a0
Code: f240003f 9a931013 6b1602ff 540005a0 (b9401e61)
---[ end trace 0000000000000000 ]---

Additional context

Earlier in the same boot (~11 h before), a WARNING fired in vc4_hdmi_write_infoframe+0x3e0/0x470 [vc4] via drm_atomic_helper_connector_hdmi_update_audio_infoframe / vc4_hdmi_audio_prepare — also during an HDMI link event (that is the Tainted: W). Possibly the same underlying "HDMI went away mid-operation" class.

Happy to provide full logs or test patches.

[serialseb]

Since filing this, the same oops has hit the same machine (Pi 5 Model B Rev 1.1, 6.18.34+rpt-rpi-2712, 1:6.18.34-1+rpt1) five more times, and it is broader than TV-standby hotplug:

• The crashing task is now Xorg itself, not a Chromium renderer — each occurrence takes down the session, and most ended in a hard freeze needing a power cycle (wtmp records the sessions as crash).
• The signature is identical every time: NULL deref at 0x14/0x1c, Oops: 0000000096000005, dma_direct_unmap_sg+0x84 reached from drm_gem_prime_import_dev+0x1a0 via dma_buf_unmap_attachment_unlocked — i.e. the fail_unmap: error path in drm_prime.c.
• Every occurrence immediately follows a display reconfiguration event, from several distinct sources:
  • kscreen mode change (4096×2160 → 1920×1080) — 2026-07-15 00:03
  • kscreen output re-probe — 2026-07-15 20:16
  • a v3d GPU hang + reset (V3D_ERR_STAT: 0x00001000) 3 s before the oops, at the lock screen — 2026-07-17 06:46
  • two further reconfiguration-adjacent occurrences — 2026-07-17 13:39 and 17:07
  • PowerDevil/libddcutil display re-detection (a flaky DDC channel makes this frequent here) — 2026-07-22 08:34

Given the v3d-reset trigger: is this plausibly related to the AXI-idle-before-clock-off work in #7503? The register dumps (x19 = 0 for the sg pointer while x27/nents is still 0x20) look like the sg_table is freed or zeroed concurrently with the unmap, i.e. the import's error path racing a disconnect/reset on the other device.

Full trace of the 2026-07-22 08:34 occurrence (Comm: Xorg)

Unable to handle kernel NULL pointer dereference at virtual address 000000000000001c
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 16k pages, 47-bit VAs, pgdp=00000000065c8000
[000000000000001c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in: mptcp_diag tcp_diag inet_diag dm_mod hid_magicmouse hid_apple snd_seq_dummy snd_hrtimer snd_seq xt_connmark xt_mark nft_reject_ipv4 nft_reject nft_masq nft_chain_nat nf_nat_h323 nf_conntrack_h323 nf_nat_pptp nf_conntrack_pptp nf_nat_tftp nf_conntrack_tftp nf_nat_sip nf_conntrack_sip nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp nf_nat tun uhid rfcomm algif_hash algif_skcipher af_alg bnep joydev uinput xt_hl ip6t_rt ip6t_REJECT nf_reject_ipv6 xt_LOG nf_log_syslog xt_multiport xt_limit xt_addrtype xt_tcpudp xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat x_tables binfmt_misc squashfs brcmfmac_cyw hci_uart btbcm bluetooth raspberrypi_hwmon ecdh_generic rpi_hevc_dec ecc aes_ce_blk pisp_be v4l2_mem2mem aes_ce_cipher ghash_ce videobuf2_dma_contig videobuf2_memops gf128mul snd_usb_audio brcmfmac videobuf2_v4l2 videodev snd_hwdep brcmutil snd_usbmidi_lib snd_rawmidi snd_seq_device cfg80211 videobuf2_common rfkill gpio_keys mc pwm_fan rp1_pio rp1_fw rp1_mailbox raspberrypi_gpiomem
 rp1_adc nvmem_rmem nft_limit nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sch_fq_codel i2c_dev zram lz4_compress nf_tables fuse nfnetlink ipv6 libsha1 vc4 snd_soc_hdmi_codec drm_client_lib snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer v3d snd drm_shmem_helper drm_exec drm_display_helper drm_dma_helper cec drm_kms_helper gpu_sched drm drm_panel_orientation_quirks i2c_brcmstb backlight
CPU: 0 UID: 0 PID: 2382 Comm: Xorg Not tainted 6.18.34+rpt-rpi-2712 #1 PREEMPT  Debian 1:6.18.34-1+rpt1 
Hardware name: Raspberry Pi 5 Model B Rev 1.1 (DT)
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : dma_direct_unmap_sg+0x84/0x260
lr : dma_unmap_sg_attrs+0x60/0x148
sp : ffffc00087e73ac0
x29: ffffc00087e73ac0 x28: ffffc00087e73d08 x27: 0000000000000020
x26: 0000000000000000 x25: 0000000000000020 x24: ffff800002135010
x23: 0000000000000717 x22: 0000000000000000 x21: 0000000000000000
x20: ffff800002135010 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: ffffe5f07257e008 x15: 00007ffffaec3ef8
x14: ffffffbfc0000000 x13: 0000000000000000 x12: 0000000000000000
x11: ffff80007ff7aac0 x10: 0000000000000000 x9 : ffffe5f07257e068
x8 : ffff8002140e10c8 x7 : 0000000000000000 x6 : 000000000000003f
x5 : ffff8001814aa780 x4 : 0000000000000020 x3 : 0000000000000000
x2 : 0000000000000717 x1 : 0000000000000000 x0 : ffff800002135010
Call trace:
 dma_direct_unmap_sg+0x84/0x260 (P)
 dma_unmap_sg_attrs+0x60/0x148
 drm_gem_unmap_dma_buf+0x38/0x68 [drm]
 dma_buf_unmap_attachment+0x3c/0xa0
 dma_buf_unmap_attachment_unlocked+0x58/0x98
 drm_gem_prime_import_dev+0x1a0/0x1e0 [drm]
 drm_gem_prime_fd_to_handle+0x1a8/0x280 [drm]
 drm_prime_fd_to_handle_ioctl+0x40/0x58 [drm]
 drm_ioctl_kernel+0xc8/0x140 [drm]
 drm_ioctl+0x368/0x4e8 [drm]
 __arm64_sys_ioctl+0xb4/0x120
 invoke_syscall+0x4c/0x100
 el0_svc_common.constprop.0+0xc8/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x38/0x120
 el0t_64_sync_handler+0xa0/0xe8
 el0t_64_sync+0x198/0x1a0
Code: f240003f 9a931013 6b1602ff 540005a0 (b9401e61) 
---[ end trace 0000000000000000 ]---

The vc4_hdmi_write_infoframe WARN at vc4_hdmi.c:677 mentioned in the original report also appeared here before one occurrence (I see that is fixed by ec0db8f), and the machine has had four separate Resetting GPU for hang events in the same period. Happy to provide the other five traces or test a patch.