RTX 2070 Mobile: Kernel NULL pointer dereference / i2c timeout via ucsi_ccg driver during cold boot

NVIDIA Open GPU Kernel Modules Version

595.71

Please confirm this issue does not happen with the proprietary driver (of the same version). This issue tracker is only for bugs specific to the open kernel driver.

• I confirm that this does not happen with the proprietary driver package.

Operating System and Version

Fedora Linux 44 (Workstation Edition)

Kernel Release

7.0.9-202.fc44.x86_64 (Stable release, standard Fedora kernel build)

Please confirm you are running a stable release kernel (e.g. not a -rc). We do not accept bug reports for unreleased kernels.

• I am running on a stable kernel release.

Hardware: GPU

NVIDIA GeForce RTX 2070 Mobile (Max-Q Design)

Describe the bug

During a cold boot, or when a USB Type-C device is connected to the GPU's Type-C port, the system randomly triggers a kernel NULL pointer dereference. On subsequent warm boots, the journal shows that the ucsi_ccg driver fails to initialize over the I2C bus due to a timeout error (-110), causing an internal driver asset failure at osapi.c:2074. The system is running with lockdown=confidentiality enabled.

To Reproduce

1. Enable lockdown=confidentiality in the kernel command line.
2. Keep a USB Type-C device plugged into the GPU's native Type-C port.
3. Perform a cold boot or update the kernel and reboot.
4. Observe intermittent kernel freeze/panic, and check dmesg on the next successful boot for ucsi_ccg i2c timeout error -110.

Bug Incidence

The bug repeated three times

nvidia-bug-report.log.gz

Intermittent (happens mostly on cold boots or right after kernel/driver packages updates).

nvidia-bug-report.log.gz

More Info

Laptop Model: Acer Predator Helios 300 (PH317-53)
BIOS Version: V1.12 (Insyde Corp.)

Problem Description:
During a "cold boot" (especially right after a kernel update or when a USB Type-C flash drive is physically plugged into the VirtualLink Type-C port on the GPU), the system experiences an intermittent kernel panic / unexpected hard reset caused by BUG: kernel NULL pointer dereference in supervisor write access mode.

Upon the next successful boot, the system journal reveals that the ucsi_ccg driver fails to initialize the Type-C controller over the I2C bus due to a timeout error:

nvidia-gpu 0000:01:00.3: i2c timeout error e0000000
ucsi_ccg 10-0008: i2c_transfer failed -110
ucsi_ccg 10-0008: ucsi_ccg_init failed --110
ucsi_ccg 10-0008: probe with driver ucsi_ccg failed with error -110
NVRM: nvAssertFailedNoLog: Assertion failed: 0 @ osapi.c:2074

When lockdown=confidentiality is enforced, the kernel strictly terminates execution upon this bad hardware/driver behavior, leading to a complete system lockup or hardware reboot. The built-in laptop fan control (Turbo button / Embedded Controller via facer.ko/ACPI) also fails to initialize properly until a second "warm" reboot is performed.

The out-of-tree NVIDIA open kernel modules and the facer.ko driver are manually signed using a custom MOK (Machine Owner Key) X.509 certificate.

Because of the lockdown enforcement, the kernel converts this driver-level memory anomaly into an immediate hard reset / panic, rather than silently recovering, which highlights the critical nature of this I2C initialization race condition.

Start with the attached nvidia-bug-report.log.gz and dmesg output, focusing on the ucsi_ccg I2C timeout and the assertion at osapi.c:2074. Reproduce with lockdown=confidentiality and a USB Type-C device connected during cold boot; done means the reproducible NULL dereference or freeze is eliminated and ucsi_ccg initializes successfully.