1. 05 Feb, 2019 3 commits
    • Lyude Paul's avatar
      drm/dp_mst: Fix unbalanced malloc ref in drm_dp_mst_deallocate_vcpi() · 3a8844c2
      Lyude Paul authored
      In drm_dp_mst_deallocate_vcpi(), we currently unconditionally call
      drm_dp_mst_put_port_malloc() on the port that's passed to us, even if we
      never successfully allocated VCPI to it. This is contrary to what we do
      in drm_dp_mst_allocate_vcpi(), where we only call
      drm_dp_mst_get_port_malloc() on the passed port if we successfully
      allocated VCPI to it.
      
      As a result, if drm_dp_mst_allocate_vcpi() fails during a modeset and
      another successive modeset calls drm_dp_mst_deallocate_vcpi() we will
      end up dropping someone else's malloc reference to the port. Example:
      
      [  962.309260] ==================================================================
      [  962.309290] BUG: KASAN: use-after-free in drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309296] Read of size 4 at addr ffff888416c30004 by task kworker/0:1H/500
      
      [  962.309308] CPU: 0 PID: 500 Comm: kworker/0:1H Tainted: G        W  O      5.0.0-rc2Lyude-Test+ #1
      [  962.309313] Hardware name: LENOVO 20L8S2N800/20L8S2N800, BIOS N22ET35W (1.12 ) 04/09/2018
      [  962.309428] Workqueue: events_highpri intel_atomic_cleanup_work [i915]
      [  962.309434] Call Trace:
      [  962.309452]  dump_stack+0xad/0x150
      [  962.309462]  ? dump_stack_print_info.cold.0+0x1b/0x1b
      [  962.309472]  ? kmsg_dump_rewind_nolock+0xd9/0xd9
      [  962.309504]  ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309515]  print_address_description+0x6c/0x23c
      [  962.309542]  ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309568]  ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309577]  kasan_report.cold.3+0x1a/0x32
      [  962.309605]  ? drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309631]  drm_dp_mst_put_port_malloc+0x72/0x180 [drm_kms_helper]
      [  962.309658]  ? drm_dp_mst_put_mstb_malloc+0x180/0x180 [drm_kms_helper]
      [  962.309687]  drm_dp_mst_destroy_state+0xcd/0x120 [drm_kms_helper]
      [  962.309745]  drm_atomic_state_default_clear+0x6ee/0xcc0 [drm]
      [  962.309864]  intel_atomic_state_clear+0xe/0x80 [i915]
      [  962.309928]  __drm_atomic_state_free+0x35/0xd0 [drm]
      [  962.310044]  intel_atomic_cleanup_work+0x56/0x70 [i915]
      [  962.310057]  process_one_work+0x884/0x1400
      [  962.310067]  ? drain_workqueue+0x5a0/0x5a0
      [  962.310075]  ? __schedule+0x87f/0x1e80
      [  962.310086]  ? __sched_text_start+0x8/0x8
      [  962.310095]  ? run_rebalance_domains+0x400/0x400
      [  962.310110]  ? deref_stack_reg+0xb4/0x120
      [  962.310117]  ? __read_once_size_nocheck.constprop.7+0x10/0x10
      [  962.310124]  ? worker_enter_idle+0x47f/0x6a0
      [  962.310134]  ? schedule+0xd7/0x2e0
      [  962.310141]  ? __schedule+0x1e80/0x1e80
      [  962.310148]  ? _raw_spin_lock_irq+0x9f/0x130
      [  962.310155]  ? _raw_write_unlock_irqrestore+0x110/0x110
      [  962.310164]  worker_thread+0x196/0x11e0
      [  962.310175]  ? set_load_weight+0x2e0/0x2e0
      [  962.310181]  ? __switch_to_asm+0x34/0x70
      [  962.310187]  ? __switch_to_asm+0x40/0x70
      [  962.310194]  ? process_one_work+0x1400/0x1400
      [  962.310199]  ? __switch_to_asm+0x40/0x70
      [  962.310205]  ? __switch_to_asm+0x34/0x70
      [  962.310211]  ? __switch_to_asm+0x34/0x70
      [  962.310216]  ? __switch_to_asm+0x40/0x70
      [  962.310221]  ? __switch_to_asm+0x34/0x70
      [  962.310226]  ? __switch_to_asm+0x40/0x70
      [  962.310231]  ? __switch_to_asm+0x34/0x70
      [  962.310236]  ? __switch_to_asm+0x40/0x70
      [  962.310242]  ? syscall_return_via_sysret+0xf/0x7f
      [  962.310248]  ? __switch_to_asm+0x34/0x70
      [  962.310253]  ? __switch_to_asm+0x40/0x70
      [  962.310258]  ? __switch_to_asm+0x34/0x70
      [  962.310263]  ? __switch_to_asm+0x40/0x70
      [  962.310268]  ? __switch_to_asm+0x34/0x70
      [  962.310273]  ? __switch_to_asm+0x40/0x70
      [  962.310281]  ? __schedule+0x87f/0x1e80
      [  962.310292]  ? __sched_text_start+0x8/0x8
      [  962.310300]  ? save_stack+0x8c/0xb0
      [  962.310308]  ? __kasan_kmalloc.constprop.6+0xc6/0xd0
      [  962.310313]  ? kthread+0x98/0x3a0
      [  962.310318]  ? ret_from_fork+0x35/0x40
      [  962.310334]  ? __wake_up_common+0x178/0x6f0
      [  962.310343]  ? _raw_spin_lock_irqsave+0xa4/0x140
      [  962.310349]  ? __lock_text_start+0x8/0x8
      [  962.310355]  ? _raw_write_lock_irqsave+0x70/0x130
      [  962.310360]  ? __lock_text_start+0x8/0x8
      [  962.310371]  ? process_one_work+0x1400/0x1400
      [  962.310376]  kthread+0x2e2/0x3a0
      [  962.310383]  ? kthread_create_on_node+0xc0/0xc0
      [  962.310389]  ret_from_fork+0x35/0x40
      
      [  962.310401] Allocated by task 1462:
      [  962.310410]  __kasan_kmalloc.constprop.6+0xc6/0xd0
      [  962.310437]  drm_dp_add_port+0xd60/0x1960 [drm_kms_helper]
      [  962.310464]  drm_dp_send_link_address+0x4b0/0x770 [drm_kms_helper]
      [  962.310491]  drm_dp_check_and_send_link_address+0x197/0x1f0 [drm_kms_helper]
      [  962.310515]  drm_dp_mst_link_probe_work+0x2b6/0x330 [drm_kms_helper]
      [  962.310522]  process_one_work+0x884/0x1400
      [  962.310529]  worker_thread+0x196/0x11e0
      [  962.310533]  kthread+0x2e2/0x3a0
      [  962.310538]  ret_from_fork+0x35/0x40
      
      [  962.310543] Freed by task 500:
      [  962.310550]  __kasan_slab_free+0x133/0x180
      [  962.310555]  kfree+0x92/0x1a0
      [  962.310581]  drm_dp_mst_put_port_malloc+0x14d/0x180 [drm_kms_helper]
      [  962.310693]  intel_connector_destroy+0xb2/0xe0 [i915]
      [  962.310747]  drm_mode_object_put.part.0+0x12b/0x1a0 [drm]
      [  962.310802]  drm_atomic_state_default_clear+0x1f2/0xcc0 [drm]
      [  962.310916]  intel_atomic_state_clear+0xe/0x80 [i915]
      [  962.310972]  __drm_atomic_state_free+0x35/0xd0 [drm]
      [  962.311083]  intel_atomic_cleanup_work+0x56/0x70 [i915]
      [  962.311092]  process_one_work+0x884/0x1400
      [  962.311098]  worker_thread+0x196/0x11e0
      [  962.311103]  kthread+0x2e2/0x3a0
      [  962.311108]  ret_from_fork+0x35/0x40
      
      [  962.311116] The buggy address belongs to the object at ffff888416c30000
                      which belongs to the cache kmalloc-2k of size 2048
      [  962.311122] The buggy address is located 4 bytes inside of
                      2048-byte region [ffff888416c30000, ffff888416c30800)
      [  962.311124] The buggy address belongs to the page:
      [  962.311132] page:ffffea00105b0c00 count:1 mapcount:0 mapping:ffff88841d003040 index:0x0 compound_mapcount: 0
      [  962.311142] flags: 0x8000000000010200(slab|head)
      [  962.311152] raw: 8000000000010200 dead000000000100 dead000000000200 ffff88841d003040
      [  962.311159] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
      [  962.311162] page dumped because: kasan: bad access detected
      
      So, bail early if drm_dp_mst_deallocate_vcpi() is called on a port with
      no VCPI allocation. Additionally, clean up the surrounding kerneldoc
      while we're at it since the port is assumed to be kept around because
      the DRM driver is expected to hold a malloc reference to it, not just
      us.
      
      Changes since v1:
      * Doc changes - danvet
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Fixes: eceae147 ("drm/dp_mst: Start tracking per-port VCPI allocations")
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190202002023.29665-2-lyude@redhat.com
      3a8844c2
    • Gerd Hoffmann's avatar
      drm/bochs: fix bochs_gem_prime_mmap · 86c5b359
      Gerd Hoffmann authored
      ttm_fbdev_mmap() just doesn't work.  It appears to work fine, mmap()
      returns success, but any attempt to actually access the mapping causes a
      SIGBUS.
      
      We can just use drm_gem_prime_mmap() instead.  Almost.  We have to copy
      over the start offset from the ttm_buffer_object vm_node to the
      drm_gem_object vm_node so the offset math in drm_gem_prime_mmap() works
      correctly for us even though we use ttm to manage our objects.
      Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/20190204183858.8976-1-kraxel@redhat.com
      86c5b359
    • Gerd Hoffmann's avatar
      drm/cirrus: add plane setup · db97dd0e
      Gerd Hoffmann authored
      Commit "f4bd542b drm/fb-helper: Scale back depth to supported maximum"
      uncovered a bug in the cirrus driver.  It must create its own primary
      plane, using the correct format list, depending on the bpp module
      parameter, so it is consistent with mode_config->preferred_depth.
      Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: http://patchwork.freedesktop.org/patch/msgid/20190204110131.21467-1-kraxel@redhat.com
      db97dd0e
  2. 04 Feb, 2019 3 commits
  3. 03 Feb, 2019 3 commits
  4. 01 Feb, 2019 4 commits
  5. 31 Jan, 2019 1 commit
  6. 30 Jan, 2019 9 commits
  7. 29 Jan, 2019 6 commits
    • Daniel Vetter's avatar
      drm/irq: Ditch DRIVER_IRQ_SHARED · 1ff49481
      Daniel Vetter authored
      This is only used by drm_irq_install(), which is an optional helper.
      For legacy pci devices this is required (due to interrupt sharing without
      msi/msi-x), and just making this the default exactly matches the behaviour
      of all existing drivers using the drm_irq_install() helpers. In case that
      ever becomes wrong drivers can roll their own irq handling, as many
      drivers already do (for other reasons like needing a threaded interrupt
      handler, or having an entire pile of different interrupt sources).
      
      v2: Rebase
      
      v3: Improve commit message (Emil)
      
      Cc: Sam Ravnborg <sam@ravnborg.org>
      Reviewed-by: default avatarEmil Velikov <emil.velikov@collabora.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190129104248.26607-3-daniel.vetter@ffwll.ch
      1ff49481
    • Daniel Vetter's avatar
      drm: Switch DRIVER_ flags to an enum · 0e2a933b
      Daniel Vetter authored
      And move the documenation we alreay have into kerneldoc, plus a bit of
      polish while at it.
      
      v2:
      - Ditch FIXME from commit message, I've resolved that already before
        sending out the first version.
      - Put the legacy DRIVER_ flags at the end (Sam).
      
      Cc: Sam Ravnborg <sam@ravnborg.org>
      Reviewed-by: default avatarEmil Velikov <emil.velikov@collabora.com>
      Reviewed-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190129104248.26607-2-daniel.vetter@ffwll.ch
      0e2a933b
    • Daniel Vetter's avatar
      drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install · 5b38e747
      Daniel Vetter authored
      If a non-legacy driver calls these it's valid to assume there is
      interrupt support. The flag is really only needed for legacy drivers,
      which control IRQ enabling/disabling through the DRM_IOCTL_CONTROL
      legacy IOCTL.
      
      Also remove all the flag usage from non-legacy drivers.
      
      v2: Review from Emil:
      - improve commit message
      - I forgot hibmc, fix that
      
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: intel-gfx@lists.freedesktop.org
      Cc: linux-amlogic@lists.infradead.org
      Cc: linux-arm-msm@vger.kernel.org
      Cc: freedreno@lists.freedesktop.org
      Cc: virtualization@lists.linux-foundation.org
      Cc: spice-devel@lists.freedesktop.org
      Cc: amd-gfx@lists.freedesktop.org
      Cc: linux-renesas-soc@vger.kernel.org
      Reviewed-by: default avatarEmil Velikov <emil.velikov@collabora.com>
      Reviewed-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190129104248.26607-1-daniel.vetter@ffwll.ch
      5b38e747
    • Daniel Vetter's avatar
      drm/<drivers>: Don't set FBINFO_(FLAG_)DEFAULT · f12d0b91
      Daniel Vetter authored
      Both macros evaluate to 0. At the same time flag is already set to
      zero since the struct is kzalloc'd in framebuffer_alloc().
      As called by drm_fb_helper_alloc_fbi() in the DRM drivers.
      
      v2: Rebase and improve commit message per Emil's suggestion.
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Cc: Inki Dae <inki.dae@samsung.com>
      Cc: Joonyoung Shim <jy0922.shim@samsung.com>
      Cc: Seung-Woo Kim <sw0312.kim@samsung.com>
      Cc: Kyungmin Park <kyungmin.park@samsung.com>
      Cc: Kukjin Kim <kgene@kernel.org>
      Cc: Krzysztof Kozlowski <krzk@kernel.org>
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Cc: Ben Skeggs <bskeggs@redhat.com>
      Cc: Sandy Huang <hjc@rock-chips.com>
      Cc: "Heiko Stübner" <heiko@sntech.de>
      Cc: Thierry Reding <thierry.reding@gmail.com>
      Cc: Jonathan Hunter <jonathanh@nvidia.com>
      Cc: Hans de Goede <hdegoede@redhat.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Cc: Alexander Kapshuk <alexander.kapshuk@gmail.com>
      Cc: linux-arm-kernel@lists.infradead.org
      Cc: linux-samsung-soc@vger.kernel.org
      Cc: nouveau@lists.freedesktop.org
      Cc: linux-rockchip@lists.infradead.org
      Cc: linux-tegra@vger.kernel.org
      Reviewed-by: default avatarEmil Velikov <emil.l.velikov@gmail.com>
      Acked-by: default avatarThierry Reding <treding@nvidia.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190124165831.16427-27-daniel.vetter@ffwll.ch
      f12d0b91
    • Daniel Vetter's avatar
      drm/doc: Add a warning to drm_dev_is_unplugged · 168982d2
      Daniel Vetter authored
      It's probably not what you want, definitely not after Noralf's work to
      add drm_dev_enter/exit.
      
      Cc: Noralf Trønnes <noralf@tronnes.org>
      Reviewed-by: default avatarNoralf Trønnes <noralf@tronnes.org>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190129085643.16357-1-daniel.vetter@ffwll.ch
      168982d2
    • Noralf Trønnes's avatar
      drm/fb-helper: generic: Fix drm_fbdev_client_restore() · 78de14c2
      Noralf Trønnes authored
      If fbdev setup has failed, lastclose will give a NULL pointer deref:
      
      [   77.794295] [drm:drm_lastclose]
      [   77.794414] [drm:drm_lastclose] driver lastclose completed
      [   77.794660] Unable to handle kernel NULL pointer dereference at virtual address 00000014
      [   77.809460] pgd = b376b71b
      [   77.818275] [00000014] *pgd=175ba831, *pte=00000000, *ppte=00000000
      [   77.830813] Internal error: Oops: 17 [#1] ARM
      [   77.840963] Modules linked in: mi0283qt mipi_dbi tinydrm raspberrypi_hwmon gpio_backlight backlight snd_bcm2835(C) bcm2835_rng rng_core
      [   77.865203] CPU: 0 PID: 527 Comm: lt-modetest Tainted: G         C        5.0.0-rc1+ #1
      [   77.879525] Hardware name: BCM2835
      [   77.889185] PC is at restore_fbdev_mode+0x20/0x164
      [   77.900261] LR is at drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0x9c
      [   78.002446] Process lt-modetest (pid: 527, stack limit = 0x7a3d5c14)
      [   78.291030] Backtrace:
      [   78.300815] [<c04f2d0c>] (restore_fbdev_mode) from [<c04f4708>] (drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0x9c)
      [   78.319095]  r9:d8a8a288 r8:d891acf0 r7:d7697910 r6:00000000 r5:d891ac00 r4:d891ac00
      [   78.334432] [<c04f46b4>] (drm_fb_helper_restore_fbdev_mode_unlocked) from [<c04f47e8>] (drm_fbdev_client_restore+0x18/0x20)
      [   78.353296]  r8:d76978c0 r7:d7697910 r6:d7697950 r5:d7697800 r4:d891ac00 r3:c04f47d0
      [   78.368689] [<c04f47d0>] (drm_fbdev_client_restore) from [<c051b6b4>] (drm_client_dev_restore+0x7c/0xc0)
      [   78.385982] [<c051b638>] (drm_client_dev_restore) from [<c04f8fd0>] (drm_lastclose+0xc4/0xd4)
      [   78.402332]  r8:d76978c0 r7:d7471080 r6:c0e0c088 r5:d8a85e00 r4:d7697800
      [   78.416688] [<c04f8f0c>] (drm_lastclose) from [<c04f9088>] (drm_release+0xa8/0x10c)
      [   78.431929]  r5:d8a85e00 r4:d7697800
      [   78.442989] [<c04f8fe0>] (drm_release) from [<c02640c4>] (__fput+0x104/0x1c8)
      [   78.457740]  r8:d5ccea10 r7:d96cfb10 r6:00000008 r5:d74c1b90 r4:d8a8a280
      [   78.472043] [<c0263fc0>] (__fput) from [<c02641ec>] (____fput+0x18/0x1c)
      [   78.486363]  r10:00000006 r9:d7722000 r8:c01011c4 r7:00000000 r6:c0ebac6c r5:d892a340
      [   78.501869]  r4:d8a8a280
      [   78.512002] [<c02641d4>] (____fput) from [<c013ef1c>] (task_work_run+0x98/0xac)
      [   78.527186] [<c013ee84>] (task_work_run) from [<c010cc54>] (do_work_pending+0x4f8/0x570)
      [   78.543238]  r7:d7722030 r6:00000004 r5:d7723fb0 r4:00000000
      [   78.556825] [<c010c75c>] (do_work_pending) from [<c0101034>] (slow_work_pending+0xc/0x20)
      [   78.674256] ---[ end trace 70d3a60cf739be3b ]---
      
      Fix by using drm_fb_helper_lastclose() which checks if fbdev is in use.
      
      Fixes: 9060d7f4 ("drm/fb-helper: Finish the generic fbdev emulation")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarNoralf Trønnes <noralf@tronnes.org>
      Reviewed-by: default avatarGerd Hoffmann <kraxel@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190125150300.33268-1-noralf@tronnes.org
      78de14c2
  8. 28 Jan, 2019 11 commits