forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/gpu/drm
History
Lyude Paul ea1de53090 drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() 
[ Upstream commit 63237f8748 ]

[why]
Removing connector reusage from DM to match the rest of the tree ended
up revealing an issue that was surprisingly subtle. The original amdgpu
code for DC that was submitted appears to have left a chunk in
dm_dp_create_fake_mst_encoder() that tries to find a "master encoder",
the likes of which isn't actually used or stored anywhere. It does so at
the wrong time as well by trying to access parts of the drm_connector
from the encoder init before it's actually been initialized. This
results in a NULL pointer deref on MST hotplugs:

[  160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[  160.697234] PGD 0 P4D 0
[  160.697814] Oops: 0010 [#1] SMP PTI
[  160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G           O      4.19.0Lyude-Test+ #2
[  160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018
[  160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
[  160.700322] RIP: 0010:          (null)
[  160.700920] Code: Bad RIP value.
[  160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206
[  160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158
[  160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000
[  160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25
[  160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000
[  160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000
[  160.705260] FS:  0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000
[  160.705854] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0
[  160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  160.708372] Call Trace:
[  160.708998]  ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu]
[  160.709625]  ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper]
[  160.710284]  ? wake_up_q+0x54/0x70
[  160.710877]  ? __mutex_unlock_slowpath.isra.18+0xb3/0x110
[  160.711512]  ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper]
[  160.712161]  ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper]
[  160.712762]  ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper]
[  160.713408]  ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper]
[  160.714013]  ? process_one_work+0x1a1/0x3a0
[  160.714667]  ? worker_thread+0x30/0x380
[  160.715326]  ? wq_update_unbound_numa+0x10/0x10
[  160.715939]  ? kthread+0x112/0x130
[  160.716591]  ? kthread_create_worker_on_cpu+0x70/0x70
[  160.717262]  ? ret_from_fork+0x35/0x40
[  160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu]
[  160.720141] CR2: 0000000000000000

Somehow the connector reusage DM was using for MST connectors managed to
paper over this issue entirely; hence why this was never caught until
now.

[how]
Since this code isn't used anywhere and seems useless anyway, we can
just drop it entirely. This appears to fix the issue on my HP ZBook with
an AMD WX4150.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-11-27 16:13:05 +01:00
..
amd drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() 2018-11-27 16:13:05 +01:00
arc drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
arm drm/malidp: Fix writeback in NV12 2018-09-21 10:55:00 +01:00
armada drm/armada: remove obsolete fb unreferencing kfifo and workqueue 2018-07-30 11:53:06 +01:00
ast drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
atmel-hlcdc Merge v4.18-rc3 into drm-next 2018-07-04 10:27:12 +10:00
bochs drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
bridge drm pull for 4.19-rc1 2018-08-15 17:39:07 -07:00
cirrus drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
etnaviv drm/etnaviv: fix bogus fence complete check in timeout handler 2018-11-21 09:19:25 +01:00
exynos Revert "drm/exynos/decon5433: implement frame counter" 2018-11-27 16:13:04 +01:00
fsl-dcu drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
gma500 drivers/gpu/drm/gma500/: change return type to vm_fault_t 2018-08-23 18:48:43 -07:00
hisilicon drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer 2018-11-21 09:19:10 +01:00
i2c Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes 2018-10-04 10:32:14 +10:00
i810 drm/i810: off by one in i810_dma_vertex() 2018-07-03 15:00:42 +02:00
i915 drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE 2018-11-27 16:12:58 +01:00
imx drm/imx: use suspend/resume helpers, add ipu-v3 V4L2 XRGB32/XBGR32 support 2018-08-10 11:13:36 +10:00
lib
mediatek drm/mediatek: fix OF sibling-node lookup 2018-11-13 11:08:54 -08:00
meson drm/meson: Make DMT timings parameters and pixel clock generic 2018-07-16 11:14:59 +02:00
mga
mgag200 drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
msm drm/msm: fix OF child-node lookup 2018-11-21 09:19:15 +01:00
mxsfb
nouveau drm/nouveau: Fix nv50_mstc->best_encoder() 2018-11-21 09:19:25 +01:00
omapdrm drm/omap: fix memory barrier bug in DMM driver 2018-11-21 09:19:10 +01:00
panel drm/panel: simple: tv123wam: Add unprepare delay 2018-08-14 13:42:37 -04:00
pl111 drm/pl111: Make sure of_device_id tables are NULL terminated 2018-09-10 16:01:22 -04:00
qxl drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
r128
radeon mm, oom: distinguish blockable mode for mmu notifiers 2018-08-22 10:52:44 -07:00
rcar-du drm: rcar-du: Update Gen3 output limitations 2018-11-21 09:19:11 +01:00
rockchip drm/rockchip: Allow driver to be shutdown on reboot/kexec 2018-11-21 09:19:25 +01:00
savage drm/savage: off by one in savage_bci_cmdbuf() 2018-07-04 14:27:01 +02:00
scheduler drm/scheduler: fix param documentation 2018-08-09 11:57:39 -05:00
selftests drm-misc-next for 4.19: 2018-06-22 12:58:08 +10:00
shmobile drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
sis
sti drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
stm drm/stm: Replace drm_dev_unref with drm_dev_put 2018-07-13 10:11:02 +02:00
sun4i drm/sun4i: Fix an ulong overflow in the dotclock driver 2018-10-19 11:50:25 +02:00
tdfx
tegra drm pull for 4.19-rc1 2018-08-15 17:39:07 -07:00
tilcdc drm-misc-next for 4.19: 2018-07-20 10:46:49 +10:00
tinydrm drm/tinydrm: add backlight dependency for ili9341 2018-07-12 12:10:07 -05:00
ttm drm/ttm: clean up non-x86 definitions on ttm_tt 2018-08-01 17:23:56 -05:00
tve200
udl drm: udl: Destroy framebuffer only if it was initialized 2018-09-10 16:02:51 -04:00
v3d drm/scheduler: modify API to avoid redundancy 2018-07-25 15:06:19 -05:00
vc4 drm/vc4: Fix the "no scaling" case on multi-planar YUV formats 2018-09-10 16:01:22 -04:00
vgem drm/vgem: off by one in vgem_gem_fault() 2018-07-03 15:06:15 +02:00
via treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
virtio drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
vkms drm/vkms: Fix connector leak at the module removal 2018-07-28 16:09:39 -03:00
vmwgfx drm/vmwgfx: Fix buffer object eviction 2018-09-20 08:05:14 +02:00
xen drm-misc-next for 4.19: 2018-06-22 12:58:08 +10:00
zte drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic.c drm: Get ref on CRTC commit object when waiting for flip_done 2018-10-18 14:23:13 -04:00
drm_atomic_helper.c drm: Get ref on CRTC commit object when waiting for flip_done 2018-10-18 14:23:13 -04:00
drm_auth.c
drm_blend.c
drm_bridge.c
drm_bufs.c
drm_cache.c
drm_client.c drm/cma-helper: Fix crash in fbdev error path 2018-10-02 13:03:34 +02:00
drm_color_mgmt.c
drm_connector.c drm/connector: Fix typo in drm_connector_list_iter_next() 2018-07-16 13:18:09 -04:00
drm_context.c drm: re-enable error handling 2018-07-16 10:01:19 -04:00
drm_crtc.c drm: fix use of freed memory in drm_mode_setcrtc 2018-10-05 15:55:17 +03:00
drm_crtc_helper.c
drm_crtc_helper_internal.h
drm_crtc_internal.h drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_debugfs.c drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation 2018-09-17 19:24:37 -04:00
drm_debugfs_crc.c drm/crc: Only report a single overflow when a CRC fd is opened 2018-07-06 14:57:03 +02:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c drm_dp_cec.c: fix formatting typo: %pdH -> %phD 2018-07-28 15:50:40 -03:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c drm/dp_helper: Add DP aux channel tracing 2018-07-16 11:47:53 -04:00
drm_dp_mst_topology.c drm/dp_mst: Check if primary mstb is null 2018-11-21 09:19:26 +01:00
drm_drv.c drm/dp_helper: Add DP aux channel tracing 2018-07-16 11:47:53 -04:00
drm_dumb_buffers.c drm-misc-next for 4.19: 2018-06-28 13:29:07 +10:00
drm_edid.c drm/edid: Add 6 bpc quirk for BOE panel. 2018-11-27 16:12:59 +01:00
drm_edid_load.c
drm_encoder.c
drm_encoder_slave.c
drm_fb_cma_helper.c drm/cma-helper: Fix crash in fbdev error path 2018-10-02 13:03:34 +02:00
drm_fb_helper.c drm: fb-helper: Reject all pixel format changing requests 2018-10-04 12:48:16 +02:00
drm_file.c drm: Begin an API for in-kernel clients 2018-07-10 14:51:37 +02:00
drm_flip_work.c
drm_fourcc.c drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv 2018-07-18 16:56:45 +01:00
drm_framebuffer.c drm: Add drm_plane_mask() 2018-07-02 18:45:55 +03:00
drm_gem.c drm/i915: Prevent writing into a read-only object via a GGTT mmap 2018-07-13 16:14:04 +01:00
drm_gem_cma_helper.c
drm_gem_framebuffer_helper.c drm/gem-fb-helper: Always do implicit sync 2018-06-20 14:43:13 +02:00
drm_global.c drm: add SPDX identifier and clarify license 2018-06-29 15:28:47 -05:00
drm_hashtab.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
drm_info.c
drm_internal.h drm: provide management functions for drm_file 2018-06-25 16:17:03 +02:00
drm_ioc32.c drm: Drop DRM_CONTROL_ALLOW from ioctls 2018-05-03 11:28:02 +02:00
drm_ioctl.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_irq.c
drm_kms_helper_common.c
drm_lease.c drm: fix use-after-free read in drm_mode_create_lease_ioctl() 2018-10-02 10:22:10 +02:00
drm_legacy.h
drm_lock.c
drm_memory.c treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
drm_mipi_dsi.c drm: Add support for pps and compression mode command packet 2018-07-25 07:51:05 -04:00
drm_mm.c drm/mm: Add a search-by-address variant to only inspect a single hole 2018-05-24 15:04:30 +01:00
drm_mode_config.c drm: writeback: Add client capability for exposing writeback connectors 2018-06-20 15:30:20 +01:00
drm_mode_object.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_modes.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_modeset_helper.c
drm_modeset_lock.c drm: Change deadlock-avoidance algorithm for the modeset locks. 2018-07-03 09:46:05 +02:00
drm_of.c drm/doc: Include drm_of.c helpers 2018-07-13 18:40:28 +02:00
drm_panel.c Revert "drm/panel: Add device_link from panel device to DRM device" 2018-09-27 11:00:42 -04:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003) 2018-11-21 09:19:26 +01:00
drm_pci.c drm: drop drm_pcie_get_speed_cap_mask and drm_pcie_get_max_link_width 2018-07-05 16:40:00 -05:00
drm_plane.c drm: Introduce __setplane_atomic() 2018-07-13 17:58:19 +03:00
drm_plane_helper.c drm: add missing ctx argument to plane transitional helpers 2018-07-03 09:30:19 +02:00
drm_prime.c dma-buf: remove kmap_atomic interface 2018-06-20 15:59:34 +02:00
drm_print.c drm: Add puts callback for the coredump printer 2018-07-30 08:49:41 -04:00
drm_probe_helper.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_property.c drm: Use kvzalloc for allocating blob property memory 2018-07-02 11:05:21 -05:00
drm_rect.c drm/rect: Handle rounding errors in drm_rect_clip_scaled, v3. 2018-05-04 11:09:54 +02:00
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
drm_syncobj.c drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set 2018-09-26 10:39:14 -04:00
drm_sysfs.c drm: remove all control node code 2018-05-03 21:26:32 +02:00
drm_trace.h
drm_trace_points.c
drm_vblank.c
drm_vm.c gpu: drm: drm_vm: Adding new typedef vm_fault_t 2018-05-29 08:58:46 +02:00
drm_vma_manager.c drm: add SPDX idenitifier and clarify license 2018-06-29 15:28:47 -05:00
drm_writeback.c drm: writeback: Fix doc that says connector should be disconnected 2018-07-16 16:35:27 +01:00
Kconfig drm: add support for DisplayPort CEC-Tunneling-over-AUX 2018-07-13 17:58:19 +03:00
Makefile drm: add support for DisplayPort CEC-Tunneling-over-AUX 2018-07-13 17:58:19 +03:00