mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-25 05:34:00 +08:00
4d4c2d8991
Sergey Suloev reported a crash happening in drm_client_dev_hotplug()
when fbdev had failed to register.
[ 9.124598] vc4_hdmi 3f902000.hdmi: ASoC: Failed to create component debugfs directory
[ 9.147667] vc4_hdmi 3f902000.hdmi: vc4-hdmi-hifi <-> 3f902000.hdmi mapping ok
[ 9.155184] vc4_hdmi 3f902000.hdmi: ASoC: no DMI vendor name!
[ 9.166544] vc4-drm soc:gpu: bound 3f902000.hdmi (ops vc4_hdmi_ops [vc4])
[ 9.173840] vc4-drm soc:gpu: bound 3f806000.vec (ops vc4_vec_ops [vc4])
[ 9.181029] vc4-drm soc:gpu: bound 3f004000.txp (ops vc4_txp_ops [vc4])
[ 9.188519] vc4-drm soc:gpu: bound 3f400000.hvs (ops vc4_hvs_ops [vc4])
[ 9.195690] vc4-drm soc:gpu: bound 3f206000.pixelvalve (ops vc4_crtc_ops [vc4])
[ 9.203523] vc4-drm soc:gpu: bound 3f207000.pixelvalve (ops vc4_crtc_ops [vc4])
[ 9.215032] vc4-drm soc:gpu: bound 3f807000.pixelvalve (ops vc4_crtc_ops [vc4])
[ 9.274785] vc4-drm soc:gpu: bound 3fc00000.v3d (ops vc4_v3d_ops [vc4])
[ 9.290246] [drm] Initialized vc4 0.0.0 20140616 for soc:gpu on minor 0
[ 9.297464] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[ 9.304600] [drm] Driver supports precise vblank timestamp query.
[ 9.382856] vc4-drm soc:gpu: [drm:drm_fb_helper_fbdev_setup [drm_kms_helper]] *ERROR* Failed to set fbdev configuration
[ 10.404937] Unable to handle kernel paging request at virtual address 00330a656369768a
[ 10.441620] [00330a656369768a] address between user and kernel address ranges
[ 10.449087] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 10.454762] Modules linked in: brcmfmac vc4 drm_kms_helper cfg80211 drm rfkill smsc95xx brcmutil usbnet drm_panel_orientation_quirks raspberrypi_hwmon bcm2835_dma crc32_ce pwm_bcm2835 bcm2835_rng virt_dma rng_core i2c_bcm2835 ip_tables x_tables ipv6
[ 10.477296] CPU: 2 PID: 45 Comm: kworker/2:1 Not tainted 4.19.0-rc5 #3
[ 10.483934] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
[ 10.489966] Workqueue: events output_poll_execute [drm_kms_helper]
[ 10.596515] Process kworker/2:1 (pid: 45, stack limit = 0x000000007e8924dc)
[ 10.603590] Call trace:
[ 10.606259] drm_client_dev_hotplug+0x5c/0xb0 [drm]
[ 10.611303] drm_kms_helper_hotplug_event+0x30/0x40 [drm_kms_helper]
[ 10.617849] output_poll_execute+0xc4/0x1e0 [drm_kms_helper]
[ 10.623616] process_one_work+0x1c8/0x318
[ 10.627695] worker_thread+0x48/0x428
[ 10.631420] kthread+0xf8/0x128
[ 10.634615] ret_from_fork+0x10/0x18
[ 10.638255] Code: 54000220 f9401261 aa1303e0 b4000141 (f9400c21)
[ 10.644456] ---[ end trace c75b4a4b0e141908 ]---
The reason for this is that drm_fbdev_cma_init() removes the drm_client
when fbdev registration fails, but it doesn't remove the client from the
drm_device client list. So the client list now has a pointer that points
into the unknown and we have a 'use after free' situation.
Split drm_client_new() into drm_client_init() and drm_client_add() to fix
removal in the error path.
Fixes: 894a677f4b ("drm/cma-helper: Use the generic fbdev emulation")
Reported-by: Sergey Suloev <ssuloev@orpaltech.com>
Cc: Stefan Wahren <stefan.wahren@i2se.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181001194536.57756-1-noralf@tronnes.org
141 lines
2.8 KiB
C
141 lines
2.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
#ifndef _DRM_CLIENT_H_
|
|
#define _DRM_CLIENT_H_
|
|
|
|
#include <linux/types.h>
|
|
|
|
struct drm_client_dev;
|
|
struct drm_device;
|
|
struct drm_file;
|
|
struct drm_framebuffer;
|
|
struct drm_gem_object;
|
|
struct drm_minor;
|
|
struct module;
|
|
|
|
/**
|
|
* struct drm_client_funcs - DRM client callbacks
|
|
*/
|
|
struct drm_client_funcs {
|
|
/**
|
|
* @owner: The module owner
|
|
*/
|
|
struct module *owner;
|
|
|
|
/**
|
|
* @unregister:
|
|
*
|
|
* Called when &drm_device is unregistered. The client should respond by
|
|
* releasing it's resources using drm_client_release().
|
|
*
|
|
* This callback is optional.
|
|
*/
|
|
void (*unregister)(struct drm_client_dev *client);
|
|
|
|
/**
|
|
* @restore:
|
|
*
|
|
* Called on drm_lastclose(). The first client instance in the list that
|
|
* returns zero gets the privilege to restore and no more clients are
|
|
* called. This callback is not called after @unregister has been called.
|
|
*
|
|
* This callback is optional.
|
|
*/
|
|
int (*restore)(struct drm_client_dev *client);
|
|
|
|
/**
|
|
* @hotplug:
|
|
*
|
|
* Called on drm_kms_helper_hotplug_event().
|
|
* This callback is not called after @unregister has been called.
|
|
*
|
|
* This callback is optional.
|
|
*/
|
|
int (*hotplug)(struct drm_client_dev *client);
|
|
};
|
|
|
|
/**
|
|
* struct drm_client_dev - DRM client instance
|
|
*/
|
|
struct drm_client_dev {
|
|
/**
|
|
* @dev: DRM device
|
|
*/
|
|
struct drm_device *dev;
|
|
|
|
/**
|
|
* @name: Name of the client.
|
|
*/
|
|
const char *name;
|
|
|
|
/**
|
|
* @list:
|
|
*
|
|
* List of all clients of a DRM device, linked into
|
|
* &drm_device.clientlist. Protected by &drm_device.clientlist_mutex.
|
|
*/
|
|
struct list_head list;
|
|
|
|
/**
|
|
* @funcs: DRM client functions (optional)
|
|
*/
|
|
const struct drm_client_funcs *funcs;
|
|
|
|
/**
|
|
* @file: DRM file
|
|
*/
|
|
struct drm_file *file;
|
|
};
|
|
|
|
int drm_client_init(struct drm_device *dev, struct drm_client_dev *client,
|
|
const char *name, const struct drm_client_funcs *funcs);
|
|
void drm_client_release(struct drm_client_dev *client);
|
|
void drm_client_add(struct drm_client_dev *client);
|
|
|
|
void drm_client_dev_unregister(struct drm_device *dev);
|
|
void drm_client_dev_hotplug(struct drm_device *dev);
|
|
void drm_client_dev_restore(struct drm_device *dev);
|
|
|
|
/**
|
|
* struct drm_client_buffer - DRM client buffer
|
|
*/
|
|
struct drm_client_buffer {
|
|
/**
|
|
* @client: DRM client
|
|
*/
|
|
struct drm_client_dev *client;
|
|
|
|
/**
|
|
* @handle: Buffer handle
|
|
*/
|
|
u32 handle;
|
|
|
|
/**
|
|
* @pitch: Buffer pitch
|
|
*/
|
|
u32 pitch;
|
|
|
|
/**
|
|
* @gem: GEM object backing this buffer
|
|
*/
|
|
struct drm_gem_object *gem;
|
|
|
|
/**
|
|
* @vaddr: Virtual address for the buffer
|
|
*/
|
|
void *vaddr;
|
|
|
|
/**
|
|
* @fb: DRM framebuffer
|
|
*/
|
|
struct drm_framebuffer *fb;
|
|
};
|
|
|
|
struct drm_client_buffer *
|
|
drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format);
|
|
void drm_client_framebuffer_delete(struct drm_client_buffer *buffer);
|
|
|
|
int drm_client_debugfs_init(struct drm_minor *minor);
|
|
|
|
#endif
|