| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 6 May 2024 16:04:30 +0200
From: Quentin Schulz <quentin.schulz@...rry.de>
To: Douglas Anderson <dianders@...omium.org>,
dri-devel@...ts.freedesktop.org, Maxime Ripard <mripard@...nel.org>
Cc: Linus Walleij <linus.walleij@...aro.org>,
Chris Morgan <macromorgan@...mail.com>,
Yuran Pereira <yuran.pereira@...mail.com>,
Neil Armstrong <neil.armstrong@...aro.org>, Heiko Stübner
<heiko@...ech.de>, Quentin Schulz <quentin.schulz@...obroma-systems.com>,
Daniel Vetter <daniel@...ll.ch>, David Airlie <airlied@...il.com>,
Jessica Zhang <quic_jesszhan@...cinc.com>,
Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
Sam Ravnborg <sam@...nborg.org>, Thomas Zimmermann <tzimmermann@...e.de>,
linux-kernel@...r.kernel.org
Subject: Re: [RFT PATCH v2 15/48] drm/panel: ltk050h3146w: Don't call
unprepare+disable at shutdown/remove
Hi Douglas,
On 5/3/24 11:32 PM, Douglas Anderson wrote:
> [You don't often get email from dianders@...omium.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> It's the responsibility of a correctly written DRM modeset driver to
> call drm_atomic_helper_shutdown() at shutdown time and that should be
> disabling / unpreparing the panel if needed. Panel drivers shouldn't
> be calling these functions themselves.
>
> A recent effort was made to fix as many DRM modeset drivers as
> possible [1] [2] [3] and most drivers are fixed now.
>
> Unfortunately, grepping mainline for this panel's compatible string
> shows no hits, so we can't be 100% sure if the DRM modeset driver used
> with this panel has been fixed. If it is found that the DRM modeset
> driver hasn't been fixed then this patch could be temporarily reverted
> until it is.
>
> [1] https://lore.kernel.org/r/20230901234015.566018-1-dianders@chromium.org
> [2] https://lore.kernel.org/r/20230901234202.566951-1-dianders@chromium.org
> [3] https://lore.kernel.org/r/20230921192749.1542462-1-dianders@chromium.org
>
> Cc: "Heiko Stübner" <heiko@...ech.de>
> Cc: Quentin Schulz <quentin.schulz@...obroma-systems.com>
> Signed-off-by: Douglas Anderson <dianders@...omium.org>
I get:
"""
[ 27.239362] ------------[ cut here ]------------
[ 27.244549] refcount_t: addition on 0; use-after-free.
[ 27.250308] WARNING: CPU: 4 PID: 1 at lib/refcount.c:25
refcount_warn_saturate+0x120/0x144
[ 27.259556] Modules linked in: snd_soc_simple_card crct10dif_ce
snd_soc_simple_card_utils fuse [last unloaded: panel_leadtek_ltk050h3146w]
[ 27.273470] CPU: 4 PID: 1 Comm: systemd-shutdow Not tainted
6.9.0-rc7-00002-g4a8eaebfcfde-dirty #63
[ 27.283584] Hardware name: Theobroma Systems RK3399-Q7 SoM on Haikou
devkit with Video Demo adapter (DT)
[ 27.294180] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS
BTYPE=--)
[ 27.301962] pc : refcount_warn_saturate+0x120/0x144
[ 27.307411] lr : refcount_warn_saturate+0x120/0x144
[ 27.312860] sp : ffff800081babb10
[ 27.316559] x29: ffff800081babb10 x28: ffff000000640000 x27:
0000000000000000
[ 27.324539] x26: ffff8000814847f8 x25: 0000000000000001 x24:
ffff800081adb028
[ 27.332519] x23: ffff000000e13090 x22: ffff800081b3c280 x21:
ffff0000006c8680
[ 27.340489] x20: ffff0000006c8680 x19: ffff00000a6f8000 x18:
0000000000000006
[ 27.348468] x17: 000000040044ffff x16: 00500074b5503510 x15:
ffff800081bab580
[ 27.356447] x14: 0000000000000000 x13: ffff8000819944d0 x12:
0000000000000a2f
[ 27.364426] x11: 0000000000000365 x10: ffff8000819ec4d0 x9 :
ffff8000819944d0
[ 27.372396] x8 : 00000000ffffefff x7 : ffff8000819ec4d0 x6 :
80000000fffff000
[ 27.380375] x5 : 0000000000000366 x4 : 0000000000000000 x3 :
0000000000000000
[ 27.388353] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
ffff000000640000
[ 27.396332] Call trace:
[ 27.399061] refcount_warn_saturate+0x120/0x144
[ 27.404122] drm_dev_get+0x78/0x7c
[ 27.407924] drm_atomic_state_init+0x78/0xd0
[ 27.412695] drm_atomic_state_alloc+0x6c/0x9c
[ 27.417563] drm_atomic_helper_disable_all+0x20/0x214
[ 27.423208] drm_atomic_helper_shutdown+0xa4/0x148
[ 27.428560] rockchip_drm_platform_shutdown+0x18/0x28
[ 27.434207] platform_shutdown+0x24/0x34
[ 27.438589] device_shutdown+0x150/0x258
[ 27.442973] kernel_power_off+0x38/0x7c
[ 27.447260] __do_sys_reboot+0x204/0x24c
[ 27.451643] __arm64_sys_reboot+0x24/0x30
[ 27.456122] invoke_syscall+0x48/0x114
[ 27.460311] el0_svc_common.constprop.0+0x40/0xe0
[ 27.465567] do_el0_svc+0x1c/0x28
[ 27.469269] el0_svc+0x34/0xd8
[ 27.472681] el0t_64_sync_handler+0x120/0x12c
[ 27.477548] el0t_64_sync+0x190/0x194
[ 27.481639] ---[ end trace 0000000000000000 ]---
[ 27.486831] ------------[ cut here ]------------
[ 27.491995] refcount_t: underflow; use-after-free.
[ 27.497414] WARNING: CPU: 4 PID: 1 at lib/refcount.c:28
refcount_warn_saturate+0xf4/0x144
[ 27.506558] Modules linked in: snd_soc_simple_card crct10dif_ce
snd_soc_simple_card_utils fuse [last unloaded: panel_leadtek_ltk050h3146w]
[ 27.520468] CPU: 4 PID: 1 Comm: systemd-shutdow Tainted: G W
6.9.0-rc7-00002-g4a8eaebfcfde-dirty #63
[ 27.532230] Hardware name: Theobroma Systems RK3399-Q7 SoM on Haikou
devkit with Video Demo adapter (DT)
[ 27.542826] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS
BTYPE=--)
[ 27.550607] pc : refcount_warn_saturate+0xf4/0x144
[ 27.555958] lr : refcount_warn_saturate+0xf4/0x144
[ 27.561309] sp : ffff800081babb10
[ 27.565008] x29: ffff800081babb10 x28: ffff000000640000 x27:
0000000000000000
[ 27.572988] x26: ffff8000814847f8 x25: 0000000000000001 x24:
ffff800081adb028
[ 27.580958] x23: ffff000000e13090 x22: ffff00000a6f82e0 x21:
ffff00000a6f8170
[ 27.588928] x20: ffff00000a6f8000 x19: ffff00000a6f8000 x18:
0000000000000006
[ 27.596907] x17: 000000040044ffff x16: 00500074b5503510 x15:
072007200720072e
[ 27.604877] x14: 0000000000000000 x13: 0000000000000046 x12:
0000000000000000
[ 27.612847] x11: 0000000000000000 x10: 0000000000000a20 x9 :
ffff800081bab980
[ 27.620826] x8 : ffff000000640a80 x7 : ffff0000054e1000 x6 :
00000000ffffffff
[ 27.628796] x5 : 00000000410fd080 x4 : 0000000000000002 x3 :
0000000000000000
[ 27.636775] x2 : 0000000000000000 x1 : 0000000000000000 x0 :
ffff000000640000
[ 27.644754] Call trace:
[ 27.647482] refcount_warn_saturate+0xf4/0x144
[ 27.652445] drm_dev_put.part.0+0xb0/0xc0
[ 27.656925] drm_dev_put+0x14/0x24
[ 27.660722] __drm_atomic_state_free+0xbc/0xd0
[ 27.665687] drm_atomic_helper_disable_all+0x108/0x214
[ 27.671429] drm_atomic_helper_shutdown+0xa4/0x148
[ 27.676781] rockchip_drm_platform_shutdown+0x18/0x28
[ 27.682425] platform_shutdown+0x24/0x34
[ 27.686807] device_shutdown+0x150/0x258
[ 27.691190] kernel_power_off+0x38/0x7c
[ 27.695475] __do_sys_reboot+0x204/0x24c
[ 27.699858] __arm64_sys_reboot+0x24/0x30
[ 27.704337] invoke_syscall+0x48/0x114
[ 27.708525] el0_svc_common.constprop.0+0x40/0xe0
[ 27.713782] do_el0_svc+0x1c/0x28
[ 27.717484] el0_svc+0x34/0xd8
[ 27.720894] el0t_64_sync_handler+0x120/0x12c
[ 27.725762] el0t_64_sync+0x190/0x194
[ 27.729851] ---[ end trace 0000000000000000 ]---
"""
when running "poweroff" after doing a modprobe -r of the driver on
RK3399 Puma and PX30 Ringneck (the trace comes from RK3399 Puma). It is
fine if I still have the device probed, no trace when powering off.
BUT, I have the same trace in the 6.9-rc7 already, so I guess:
Reviewed-by: Quentin Schulz <quentin.schulz@...rry.de>
Tested-by: Quentin Schulz <quentin.schulz@...rry.de> # RK3399 Puma with
Haikou Video Demo
Tested-by: Quentin Schulz <quentin.schulz@...rry.de> # PX30 Ringneck
with Haikou Video Demo
I'll let Heiko test this on RK3588 Tiger with Haikou Video Demo to check
the whole stack is ready there as well.
Thanks!
Quentin
Powered by blists - more mailing lists