linux-kernel - [PATCH] drm/mgag200: Fix calling drm_fb_helper

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Sep 2015 11:46:48 +0200
From:	Ingo Molnar <mingo@...nel.org>
To:	Archit Taneja <architt@...eaurora.org>,
	Daniel Vetter <daniel.vetter@...ll.ch>
Cc:	Dave Airlie <airlied@...il.com>,
	Sudip Mukherjee <sudipm.mukherjee@...il.com>,
	David Airlie <airlied@...ux.ie>,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	LKML <linux-kernel@...r.kernel.org>,
	dri-devel <dri-devel@...ts.freedesktop.org>,
	Archit Taneja <archit@...com>
Subject: [PATCH] drm/mgag200: Fix calling drm_fb_helper_fini() twice


* Archit Taneja <architt@...eaurora.org> wrote:

> From: Archit Taneja <architt@...eaurora.org>
> Date: Mon, 14 Sep 2015 20:11:43 +0530
> Subject: [PATCH] drm/mgag200: Prevent calling drm_fb_helper_fini twice
> 
> mgag200_fbdev_init's error handling path calls drm_fb_helper_fini before
> bailing out. The error handling path of mgag200_driver_load also ends
> up calling drm_fb_helper_fini.
> 
> This results in drm_fb_helper_fini being called twice if the driver load
> drm op fails somewhere in between.
> 
> Make only mgag200_driver_unload call drm_fb_helper_fini, remove the call
> from mgag200_fbdev_init.
> 
> Signed-off-by: Archit Taneja <architt@...eaurora.org>
> ---
>  drivers/gpu/drm/mgag200/mgag200_fb.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c
> b/drivers/gpu/drm/mgag200/mgag200_fb.c
> index 87de15e..6259b0a 100644
> --- a/drivers/gpu/drm/mgag200/mgag200_fb.c
> +++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
> @@ -280,20 +280,16 @@ int mgag200_fbdev_init(struct mga_device *mdev)
> 
>  	ret = drm_fb_helper_single_add_all_connectors(&mfbdev->helper);
>  	if (ret)
> -		goto fini;
> +		return ret;
> 
>  	/* disable all the possible outputs/crtcs before entering KMS mode */
>  	drm_helper_disable_unused_functions(mdev->dev);
> 
>  	ret = drm_fb_helper_initial_config(&mfbdev->helper, bpp_sel);
>  	if (ret)
> -		goto fini;
> +		return ret;
> 
>  	return 0;
> -
> -fini:
> -	drm_fb_helper_fini(&mfbdev->helper);
> -	return ret;
>  }
> 
>  void mgag200_fbdev_fini(struct mga_device *mdev)

So this patch was whitespace damaged - I applied it by hand and made the commit 
below. This has solved the crash, thanks Archit!

And yes, you are right that my config probably crashed with older kernels too.

	Ingo

=============>
>From 60d733a3ec19dc72372e12207a0a86293cd40cf5 Mon Sep 17 00:00:00 2001
From: Archit Taneja <architt@...eaurora.org>
Date: Mon, 14 Sep 2015 20:53:57 +0530
Subject: [PATCH] drm/mgag200: Fix calling drm_fb_helper_fini() twice

mgag200_fbdev_init()'s error handling path calls
drm_fb_helper_fini() before bailing out. The error handling path
of mgag200_driver_load() also ends up calling drm_fb_helper_fini().

This results in drm_fb_helper_fini() being called twice if the
driver load drm op fails somewhere in between.

Make only mgag200_driver_unload() call drm_fb_helper_fini(), remove
the call from mgag200_fbdev_init().

Reported-by: Ingo Molnar <mingo@...nel.org>
Signed-off-by: Archit Taneja <architt@...eaurora.org>
Cc: Archit Taneja <archit@...com>
Cc: Daniel Vetter <daniel.vetter@...ll.ch>
Cc: Dave Airlie <airlied@...il.com>
Cc: David Airlie <airlied@...ux.ie>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Sudip Mukherjee <sudipm.mukherjee@...il.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: dri-devel <dri-devel@...ts.freedesktop.org>
Link: http://lkml.kernel.org/r/55F6E68D.8070800@codeaurora.org
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 drivers/gpu/drm/mgag200/mgag200_fb.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
index 87de15ea1f93..6259b0a5fc38 100644
--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
@@ -280,20 +280,16 @@ int mgag200_fbdev_init(struct mga_device *mdev)
 
 	ret = drm_fb_helper_single_add_all_connectors(&mfbdev->helper);
 	if (ret)
-		goto fini;
+		return ret;
 
 	/* disable all the possible outputs/crtcs before entering KMS mode */
 	drm_helper_disable_unused_functions(mdev->dev);
 
 	ret = drm_fb_helper_initial_config(&mfbdev->helper, bpp_sel);
 	if (ret)
-		goto fini;
+		return ret;
 
 	return 0;
-
-fini:
-	drm_fb_helper_fini(&mfbdev->helper);
-	return ret;
 }
 
 void mgag200_fbdev_fini(struct mga_device *mdev)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/