linux-kernel - [PATCH 3/3] drm: hikey9xxx: Fix null pointer crash on reboot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200820034100.128062-2-john.stultz@linaro.org>
Date:   Thu, 20 Aug 2020 03:41:00 +0000
From:   John Stultz <john.stultz@...aro.org>
To:     lkml <linux-kernel@...r.kernel.org>
Cc:     John Stultz <john.stultz@...aro.org>,
        Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Manivannan Sadhasivam <mani@...nel.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        Liwei Cai <cailiwei@...ilicon.com>,
        Xinliang Liu <xinliang.liu@...aro.org>,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>,
        Sam Ravnborg <sam@...nborg.org>,
        Sumit Semwal <sumit.semwal@...aro.org>,
        Chen Feng <puck.chen@...ilicon.com>
Subject: [PATCH 3/3] drm: hikey9xxx: Fix null pointer crash on reboot

This is against Mauro's tree here:
https://gitlab.freedesktop.org/mchehab_kernel/hikey-970/-/commits/master/

On reboot we see the following crash:

[  608.746787] Unable to handle kernel read from unreadable memory at virtual address 00000000000000a8
...
[  608.822101] CPU: 3 PID: 234 Comm: kworker/3:2 Not tainted 5.8.0-00183-g03481a190c60-dirty #32
[  608.830626] Hardware name: HiKey960 (DT)
[  608.834571] Workqueue: events drm_mode_rmfb_work_fn
[  608.839454] pstate: 80400005 (Nzcv daif +PAN -UAO BTYPE=--)
[  608.845031] pc : drm_gem_fb_get_obj+0x10/0x28
[  608.849390] lr : drm_fb_cma_get_gem_obj+0x10/0x20
[  608.854093] sp : ffffffc012f63b10
[  608.857404] x29: ffffffc012f63b10 x28: ffffff8212282e00
[  608.862716] x27: 0000000000000000 x26: ffffff8217501800
[  608.868027] x25: 0000000000000000 x24: ffffffc012f63d60
[  608.873339] x23: 0000000000000001 x22: ffffff8217504080
[  608.878652] x21: ffffffc0119b9000 x20: ffffff8212282e00
[  608.883963] x19: ffffff82175047c0 x18: ffffffffffffffff
[  608.889275] x17: ffffff8219c97708 x16: ffffff8219c97728
[  608.894586] x15: ffffffc0119b9d08 x14: 0000000000000000
[  608.899898] x13: 0000000000000000 x12: 0000000000000000
[  608.905209] x11: 0000003c00000000 x10: 0000046500000441
[  608.910519] x9 : ffffffc0119b9d08 x8 : ffffffc011bf7000
[  608.915830] x7 : 0000000000000898 x6 : ffffff8217504080
[  608.921142] x5 : ffffff8212282e00 x4 : ffffffc0111935e0
[  608.926454] x3 : 0000000000000000 x2 : ffffffc0119b9d08
[  608.931764] x1 : 0000000000000000 x0 : 0000000000000000
[  608.937079] Call trace:
[  608.939531]  drm_gem_fb_get_obj+0x10/0x28
[  608.943547]  hisi_fb_pan_display+0x50/0x1f8
[  608.947736]  dss_plane_atomic_update+0x10/0x20
[  608.952183]  drm_atomic_helper_commit_planes+0xe0/0x228
[  608.957412]  drm_atomic_helper_commit_tail+0x34/0x80
[  608.962377]  commit_tail+0x150/0x180
[  608.965955]  drm_atomic_helper_commit+0x164/0x178
[  608.970665]  drm_atomic_commit+0x4c/0x60
[  608.974591]  drm_framebuffer_remove+0x3f4/0x440
[  608.979123]  drm_mode_rmfb_work_fn+0x48/0x68
[  608.983398]  process_one_work+0x1ec/0x4b0
[  608.987408]  worker_thread+0x208/0x478
[  608.991160]  kthread+0x140/0x150
[  608.994390]  ret_from_fork+0x10/0x30
[  608.997972] Code: d503233f 71000c3f 540000a8 8b214c01 (f9405420)
[  609.004069] ---[ end trace a837c42fc434e1a4 ]---

Which is due to the plane->state->fb value being null.

Fix this with a solution used in a different version of this
patch series.

Cc: Mauro Carvalho Chehab <mchehab+huawei@...nel.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Manivannan Sadhasivam <mani@...nel.org>
Cc: dri-devel <dri-devel@...ts.freedesktop.org>
Cc: Liwei Cai <cailiwei@...ilicon.com>
Cc: Xinliang Liu <xinliang.liu@...aro.org>
Cc: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Sam Ravnborg <sam@...nborg.org>
Cc: Sumit Semwal <sumit.semwal@...aro.org>
Cc: Chen Feng <puck.chen@...ilicon.com>
Signed-off-by: John Stultz <john.stultz@...aro.org>
---
 drivers/staging/hikey9xx/gpu/kirin9xx_drm_dss.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/hikey9xx/gpu/kirin9xx_drm_dss.c b/drivers/staging/hikey9xx/gpu/kirin9xx_drm_dss.c
index f2e99c766927..7adbd924bec2 100644
--- a/drivers/staging/hikey9xx/gpu/kirin9xx_drm_dss.c
+++ b/drivers/staging/hikey9xx/gpu/kirin9xx_drm_dss.c
@@ -702,6 +702,13 @@ static int dss_plane_atomic_check(struct drm_plane *plane,
 static void dss_plane_atomic_update(struct drm_plane *plane,
 				    struct drm_plane_state *old_state)
 {
+	struct drm_plane_state *state = plane->state;
+
+	if (!state->fb) {
+		state->visible = false;
+		return;
+	}
+
 	hisi_fb_pan_display(plane);
 }
 
-- 
2.17.1