1. 05 10月, 2018 2 次提交
  2. 04 10月, 2018 4 次提交
  3. 03 10月, 2018 2 次提交
  4. 02 10月, 2018 4 次提交
    • N
      drm/cma-helper: Fix crash in fbdev error path · 4d4c2d89
      Noralf Trønnes 提交于
      Sergey Suloev reported a crash happening in drm_client_dev_hotplug()
      when fbdev had failed to register.
      
      [    9.124598] vc4_hdmi 3f902000.hdmi: ASoC: Failed to create component debugfs directory
      [    9.147667] vc4_hdmi 3f902000.hdmi: vc4-hdmi-hifi <-> 3f902000.hdmi mapping ok
      [    9.155184] vc4_hdmi 3f902000.hdmi: ASoC: no DMI vendor name!
      [    9.166544] vc4-drm soc:gpu: bound 3f902000.hdmi (ops vc4_hdmi_ops [vc4])
      [    9.173840] vc4-drm soc:gpu: bound 3f806000.vec (ops vc4_vec_ops [vc4])
      [    9.181029] vc4-drm soc:gpu: bound 3f004000.txp (ops vc4_txp_ops [vc4])
      [    9.188519] vc4-drm soc:gpu: bound 3f400000.hvs (ops vc4_hvs_ops [vc4])
      [    9.195690] vc4-drm soc:gpu: bound 3f206000.pixelvalve (ops vc4_crtc_ops [vc4])
      [    9.203523] vc4-drm soc:gpu: bound 3f207000.pixelvalve (ops vc4_crtc_ops [vc4])
      [    9.215032] vc4-drm soc:gpu: bound 3f807000.pixelvalve (ops vc4_crtc_ops [vc4])
      [    9.274785] vc4-drm soc:gpu: bound 3fc00000.v3d (ops vc4_v3d_ops [vc4])
      [    9.290246] [drm] Initialized vc4 0.0.0 20140616 for soc:gpu on minor 0
      [    9.297464] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
      [    9.304600] [drm] Driver supports precise vblank timestamp query.
      [    9.382856] vc4-drm soc:gpu: [drm:drm_fb_helper_fbdev_setup [drm_kms_helper]] *ERROR* Failed to set fbdev configuration
      [   10.404937] Unable to handle kernel paging request at virtual address 00330a656369768a
      [   10.441620] [00330a656369768a] address between user and kernel address ranges
      [   10.449087] Internal error: Oops: 96000004 [#1] PREEMPT SMP
      [   10.454762] Modules linked in: brcmfmac vc4 drm_kms_helper cfg80211 drm rfkill smsc95xx brcmutil usbnet drm_panel_orientation_quirks raspberrypi_hwmon bcm2835_dma crc32_ce pwm_bcm2835 bcm2835_rng virt_dma rng_core i2c_bcm2835 ip_tables x_tables ipv6
      [   10.477296] CPU: 2 PID: 45 Comm: kworker/2:1 Not tainted 4.19.0-rc5 #3
      [   10.483934] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)
      [   10.489966] Workqueue: events output_poll_execute [drm_kms_helper]
      [   10.596515] Process kworker/2:1 (pid: 45, stack limit = 0x000000007e8924dc)
      [   10.603590] Call trace:
      [   10.606259]  drm_client_dev_hotplug+0x5c/0xb0 [drm]
      [   10.611303]  drm_kms_helper_hotplug_event+0x30/0x40 [drm_kms_helper]
      [   10.617849]  output_poll_execute+0xc4/0x1e0 [drm_kms_helper]
      [   10.623616]  process_one_work+0x1c8/0x318
      [   10.627695]  worker_thread+0x48/0x428
      [   10.631420]  kthread+0xf8/0x128
      [   10.634615]  ret_from_fork+0x10/0x18
      [   10.638255] Code: 54000220 f9401261 aa1303e0 b4000141 (f9400c21)
      [   10.644456] ---[ end trace c75b4a4b0e141908 ]---
      
      The reason for this is that drm_fbdev_cma_init() removes the drm_client
      when fbdev registration fails, but it doesn't remove the client from the
      drm_device client list. So the client list now has a pointer that points
      into the unknown and we have a 'use after free' situation.
      
      Split drm_client_new() into drm_client_init() and drm_client_add() to fix
      removal in the error path.
      
      Fixes: 894a677f ("drm/cma-helper: Use the generic fbdev emulation")
      Reported-by: NSergey Suloev <ssuloev@orpaltech.com>
      Cc: Stefan Wahren <stefan.wahren@i2se.com>
      Cc: Eric Anholt <eric@anholt.net>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: NNoralf Trønnes <noralf@tronnes.org>
      Reviewed-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20181001194536.57756-1-noralf@tronnes.org
      4d4c2d89
    • J
      drm: fix use-after-free read in drm_mode_create_lease_ioctl() · 12d43deb
      Jann Horn 提交于
      fd_install() moves the reference given to it into the file descriptor table
      of the current process. If the current process is multithreaded, then
      immediately after fd_install(), another thread can close() the file
      descriptor and cause the file's resources to be cleaned up.
      
      Since the reference to "lessee" is held by the file, we must not access
      "lessee" after the fd_install() call.
      
      As far as I can tell, to reach this codepath, the caller must have an open
      file descriptor to a DRI device in master mode. I'm not sure what the
      requirements for that are.
      Signed-off-by: NJann Horn <jannh@google.com>
      Fixes: 62884cd3 ("drm: Add four ioctls for managing drm mode object leases [v7]")
      Cc: stable@vger.kernel.org
      Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20181001153117.216923-1-jannh@google.com
      12d43deb
    • C
      drm/i915: Avoid compiler warning for maybe unused gu_misc_iir · 4ca8ca9f
      Chris Wilson 提交于
      /kisskb/src/drivers/gpu/drm/i915/i915_irq.c: warning: 'gu_misc_iir' may be used uninitialized in this function [-Wuninitialized]:  => 3120:10
      
      Silence the compiler warning by ensuring that the local variable is
      initialised and removing the guard that is confusing the older gcc.
      Reported-by: NGeert Uytterhoeven <geert@linux-m68k.org>
      Fixes: df0d28c1 ("drm/i915/icl: GSE interrupt moves from DE_MISC to GU_MISC")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
      Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
      Reviewed-by: NMika Kuoppala <mika.kuoppala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20180926104718.17462-1-chris@chris-wilson.co.uk
      (cherry picked from commit 7a90938332d80faf973fbcffdf6e674e7b8f0914)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      4ca8ca9f
    • A
      drm/i915: Do not redefine the has_csr parameter. · bda6b1c9
      Anusha Srivatsa 提交于
      Let us reuse the already defined has_csr check and not
      redefine it.
      
      The main difference is that in effect this will flip .has_csr to 1
      (via GEN9_FEATURES which GEN11_FEATURES pulls in).
      Suggested-by: NImre Deak <imre.deak@intel.com>
      Cc: Imre Deak <imre.deak@intel.com>
      Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
      Signed-off-by: NAnusha Srivatsa <anusha.srivatsa@intel.com>
      Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=107382Reviewed-by: NImre Deak <imre.deak@intel.com>
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/1534527210-16841-1-git-send-email-anusha.srivatsa@intel.com
      (cherry picked from commit da4468a1aa75457e6134127b19761b7ba62ce945)
      Signed-off-by: NRodrigo Vivi <rodrigo.vivi@intel.com>
      bda6b1c9
  5. 01 10月, 2018 1 次提交
  6. 30 9月, 2018 8 次提交
  7. 29 9月, 2018 12 次提交
  8. 28 9月, 2018 7 次提交