superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers/gpu/drm
History
Thomas Zimmermann 84499c5d22 drm/aperture: Run fbdev removal before internal helpers 
Always run fbdev removal first to remove simpledrm via sysfb_disable().
This clears the internal state.

The later call to drm_aperture_detach_drivers() then does nothing.
Otherwise, with drm_aperture_detach_drivers() running first, the call to
sysfb_disable() uses inconsistent state.

Example backtrace show below:

  BUG: KASAN: use-after-free in device_del+0x79/0x5f0
  Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
  CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5.19.0-rc2-1-default+ #1689
  Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
  Call Trace:
    device_del+0x79/0x5f0
    platform_device_del.part.0+0x19/0xe0
    platform_device_unregister+0x1c/0x30
    sysfb_disable+0x2d/0x70
    remove_conflicting_framebuffers+0x1c/0xf0
    remove_conflicting_pci_framebuffers+0x130/0x1a0
    drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
    mgag200_pci_probe+0x2d/0x140 [mgag200]

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 873eb3b118 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Zhen Lei <thunder.leizhen@huawei.com>
Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2022-07-09 11:12:05 -07:00
..
amd Revert "drm/amdgpu/display: set vblank_disable_immediate for DC" 2022-06-29 14:50:52 -04:00
arm Merge tag 'drm-msm-next-2022-05-09' of https://gitlab.freedesktop.org/drm/msm into drm-next 2022-05-11 12:40:47 +10:00
armada
…
aspeed
…
ast drm/ast: Support multiple outputs 2022-06-09 10:27:49 +02:00
atmel-hlcdc
…
bridge A use-after-free fix for panfrost, and a DT invalid configuration fix for 2022-06-10 13:12:36 +10:00
display drm for 5.19-rc1 2022-05-25 16:18:27 -07:00
etnaviv Merge branch 'etnaviv/next' of https://git.pengutronix.de/git/lst/linux into drm-next 2022-05-17 12:20:04 +10:00
exynos drm/exynos: mic: Rework initialization 2022-06-14 22:32:16 +09:00
fsl-dcu
…
gma500 drm: Rename dp/ to display/ 2022-04-25 11:17:45 +02:00
gud
…
hisilicon
…
hyperv drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7 2022-05-11 17:49:49 +00:00
i2c
…
i810
…
i915 drm/i915: tweak the ordering in cpu_write_needs_clflush 2022-06-27 18:12:10 +03:00
imx drm: imx: fix compiler warning with gcc-12 2022-06-09 09:39:44 -07:00
ingenic
…
kmb
…
lib
…
lima
…
mcde Revert "drm: bridge: mcde_dsi: Switch to devm_drm_of_get_bridge" 2022-05-04 17:06:31 +02:00
mediatek Mediatek DRM Next for Linux 5.19 2022-05-06 17:26:01 +10:00
meson
…
mga
…
mgag200 drm/mgag200: Protect concurrent access to I/O registers with lock 2022-05-05 09:18:54 +02:00
msm Merge tag 'drm-msm-fixes-2022-06-28' of https://gitlab.freedesktop.org/drm/msm into drm-fixes 2022-06-29 14:16:46 +10:00
mxsfb drm: mxsfb: Implement LCDIF scanout CRC32 support 2022-05-05 01:03:49 +02:00
nouveau drm for 5.19-rc1 2022-05-25 16:18:27 -07:00
omapdrm
…
panel Merge drm/drm-next into drm-misc-next 2022-05-03 11:53:42 +02:00
panfrost A use-after-free fix for panfrost, and a DT invalid configuration fix for 2022-06-10 13:12:36 +10:00
pl111
…
qxl drm/qxl: add drm_gem_plane_helper_prepare_fb 2022-05-05 12:30:10 +02:00
r128
…
radeon drm/radeon: fix a possible null pointer dereference 2022-05-26 14:56:31 -04:00
rcar-du drm: allow passing possible_crtcs to drm_writeback_connector_init() 2022-05-02 02:12:59 +03:00
rockchip drm/rockchip: Change register space names in vop2 2022-05-17 00:16:33 +02:00
savage
…
scheduler drm/sched: use __string in tracepoints 2022-04-26 15:11:00 -04:00
selftests drm: Rename dp/ to display/ 2022-04-25 11:17:45 +02:00
shmobile
…
sis
…
solomon drm/ssd130x: Make ssd130x_remove() return void 2022-04-26 09:43:37 +02:00
sprd
…
sti
…
stm
…
sun4i drm/sun4i: Return if frontend is not present 2022-06-22 16:42:25 +02:00
tdfx
…
tegra drm/tegra: Changes for v5.19-rc1 2022-05-13 13:14:34 +10:00
tidss drm/tidss: Soft Reset DISPC on startup 2022-04-19 15:09:45 +03:00
tilcdc drm/tilcdc: fix typos in comment 2022-04-25 10:18:52 +03:00
tiny drm/simpledrm: Use fbdev defaults for shadow buffering 2022-05-03 16:04:22 +02:00
ttm drm/ttm: fix bulk move handling v2 2022-06-14 11:15:19 +02:00
tve200
…
udl
…
v3d drm/v3d: Fix null pointer dereference of pointer perfmon 2022-04-26 11:55:28 -01:00
vboxvideo
…
vc4 drm/vc4: perfmon: Fix variable dereferenced before check 2022-06-27 15:43:14 +02:00
vgem
…
via
…
virtio
…
vkms drm: allow passing possible_crtcs to drm_writeback_connector_init() 2022-05-02 02:12:59 +03:00
vmwgfx drm/vmwgfx: Disable command buffers on svga3 without gbobjects 2022-05-13 10:29:36 -04:00
xen drm/xen: Add missing VM_DONTEXPAND flag in mmap callback 2022-06-21 16:36:13 +02:00
xlnx drm/display: Introduce a DRM display-helper module 2022-04-25 11:19:21 +02:00
Kconfig drm/display: Move HDMI helpers into display-helper module 2022-04-25 11:19:36 +02:00
Makefile drm/display: Move SCDC helpers into display-helper library 2022-04-25 11:19:37 +02:00
drm_agpsupport.c
…
drm_aperture.c drm/aperture: Run fbdev removal before internal helpers 2022-07-09 11:12:05 -07:00
drm_atomic.c
…
drm_atomic_helper.c drm/atomic: Force bridge self-refresh-exit on CRTC switch 2022-06-06 13:27:17 -07:00
drm_atomic_state_helper.c
…
drm_atomic_uapi.c drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2 2022-05-02 09:01:51 +02:00
drm_auth.c
…
drm_blend.c
…
drm_bridge.c
…
drm_bridge_connector.c
…
drm_buddy.c
…
drm_bufs.c
…
drm_cache.c
…
drm_client.c
…
drm_client_modeset.c
…
drm_color_mgmt.c drm: fix typo in comment 2022-05-04 14:09:34 +02:00
drm_connector.c drm/display: Move HDMI helpers into display-helper module 2022-04-25 11:19:36 +02:00
drm_context.c
…
drm_crtc.c
…
drm_crtc_helper.c
…
drm_crtc_helper_internal.h
…
drm_crtc_internal.h
…
drm_damage_helper.c
…
drm_debugfs.c
…
drm_debugfs_crc.c
…
drm_displayid.c
…
drm_dma.c
…
drm_drv.c
…
drm_dumb_buffers.c
…
drm_edid.c drm/edid: drop kernel-doc for static functions 2022-04-29 14:04:55 +03:00
drm_edid_load.c
…
drm_encoder.c
…
drm_encoder_slave.c
…
drm_fb_cma_helper.c
…
drm_fb_helper.c fbdev: Rename pagelist to pagereflist for deferred I/O 2022-05-03 16:04:22 +02:00
drm_file.c
…
drm_flip_work.c
…
drm_format_helper.c drm/format-helper: Share implementation among conversion helpers 2022-05-05 08:54:09 +02:00
drm_fourcc.c
…
drm_framebuffer.c
…
drm_gem.c
…
drm_gem_atomic_helper.c drm: handle kernel fences in drm_gem_plane_helper_prepare_fb v2 2022-05-02 09:01:51 +02:00
drm_gem_cma_helper.c
…
drm_gem_framebuffer_helper.c
…
drm_gem_shmem_helper.c
…
drm_gem_ttm_helper.c
…
drm_gem_vram_helper.c
…
drm_hashtab.c
…
drm_internal.h
…
drm_ioc32.c
…
drm_ioctl.c
…
drm_irq.c
…
drm_kms_helper_common.c
…
drm_lease.c
…
drm_legacy.h
…
drm_legacy_misc.c
…
drm_lock.c
…
drm_managed.c drm: Add DRM-managed mutex_init() 2022-05-05 09:04:10 +02:00
drm_memory.c
…
drm_mipi_dbi.c
…
drm_mipi_dsi.c drm/display: Move DSC header and helpers into display-helper module 2022-04-25 11:19:36 +02:00
drm_mm.c
…
drm_mode_config.c
…
drm_mode_object.c
…
drm_modes.c drm/modes: Make width-mm/height-mm check in of_get_drm_panel_display_mode() mandatory 2022-04-24 23:54:05 +02:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_nomodeset.c
…
drm_of.c Revert "drm: of: Lookup if child node has panel or bridge" 2022-04-21 09:18:08 +02:00
drm_panel.c
…
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add quirk for Aya Neo Next 2022-06-19 17:37:16 +02:00
drm_pci.c
…
drm_plane.c drm/plane: Move range check for format_count earlier 2022-04-28 16:13:04 +01:00
drm_plane_helper.c
…
drm_prime.c
…
drm_print.c
…
drm_privacy_screen.c
…
drm_privacy_screen_x86.c
…
drm_probe_helper.c
…
drm_property.c
…
drm_rect.c
…
drm_scatter.c
…
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
…
drm_syncobj.c
…
drm_sysfs.c
…
drm_trace.h
…
drm_trace_points.c
…
drm_vblank.c
…
drm_vblank_work.c
…
drm_vm.c LoongArch: Add writecombine support for drm 2022-06-03 20:09:27 +08:00
drm_vma_manager.c
…
drm_writeback.c drm: introduce drm_writeback_connector_init_with_encoder() API 2022-05-02 02:12:59 +03:00