superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers
History
Thomas Zimmermann fb84efa28a drm/aperture: Run fbdev removal before internal helpers 
Always run fbdev removal first to remove simpledrm via
sysfb_disable(). This clears the internal state. The later call
to drm_aperture_detach_drivers() then does nothing. Otherwise,
with drm_aperture_detach_drivers() running first, the call to
sysfb_disable() uses inconsistent state.

Example backtrace show below:

[   11.663422] ==================================================================
[   11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0
[   11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
[   11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5
	.19.0-rc2-1-default+ #1689
[   11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
[   11.663447] Call Trace:
[   11.663449]  <TASK>
[   11.663451]  ? device_del+0x79/0x5f0
[   11.663456]  dump_stack_lvl+0x5b/0x73
[   11.663462]  print_address_description.constprop.0+0x1f/0x1b0
[   11.663468]  ? device_del+0x79/0x5f0
[   11.663471]  ? device_del+0x79/0x5f0
[   11.663475]  print_report.cold+0x3c/0x21c
[   11.663481]  ? lock_acquired+0x87/0x1e0
[   11.663484]  ? lock_acquired+0x87/0x1e0
[   11.663489]  ? device_del+0x79/0x5f0
[   11.663492]  kasan_report+0xbf/0xf0
[   11.663498]  ? device_del+0x79/0x5f0
[   11.663503]  device_del+0x79/0x5f0
[   11.663509]  ? device_remove_attrs+0x170/0x170
[   11.663514]  ? lock_is_held_type+0xe8/0x140
[   11.663523]  platform_device_del.part.0+0x19/0xe0
[   11.663530]  platform_device_unregister+0x1c/0x30
[   11.663535]  sysfb_disable+0x2d/0x70
[   11.663540]  remove_conflicting_framebuffers+0x1c/0xf0
[   11.663546]  remove_conflicting_pci_framebuffers+0x130/0x1a0
[   11.663554]  drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
[   11.663561]  ? mgag200_pci_remove+0x30/0x30 [mgag200]
[   11.663578]  mgag200_pci_probe+0x2d/0x140 [mgag200]

Reported-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Fixes: 873eb3b118 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Zhen Lei <thunder.leizhen@huawei.com>
Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de
 		2022-06-21 12:54:34 +02:00
..
accessibility Revert "speakup: Generate speakupmap.h automatically" 2022-05-20 21:07:05 +02:00
acpi More power management updates for 5.19-rc1 2022-05-30 11:37:26 -07:00
amba Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
android fix for breakage in #work.fd this window 2022-06-05 17:14:03 -07:00
ata ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files 2022-06-09 09:25:25 +09:00
atm
…
auxdisplay
…
base firmware_loader: enable XZ by default if compressed support is enabled 2022-06-03 15:46:03 -07:00
bcma
…
block xen: branch for v5.19-rc1b 2022-06-04 13:42:53 -07:00
bluetooth Bluetooth: btmtksdio: fix the reset takes too long 2022-05-13 13:19:01 +02:00
bus Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
cdrom cdrom: remove obsolete TODO list 2022-05-15 18:31:28 -06:00
char Random number generator fixes for Linux 5.19-rc2. 2022-06-12 10:33:38 -07:00
clk Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
clocksource Clockevent/clocksource updates: 2022-06-05 10:47:06 -07:00
comedi drivers: comedi: replace ternary operator with min() 2022-05-19 18:54:45 +02:00
connector
…
counter
…
cpufreq ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
cpuidle Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
crypto virtio-crypto: enable retry for virtio-crypto-dev 2022-05-31 12:45:09 -04:00
cxl cxl/port: Enable HDM Capability after validating DVSEC Ranges 2022-05-20 12:30:53 -07:00
dax dax: add .recovery_write dax_operation 2022-05-16 13:37:59 -07:00
dca
…
devfreq PM / devfreq: passive: Return non-error when not-supported event is required 2022-05-19 19:32:19 +02:00
dio drivers: dio: add missing iounmap() in dio_init() 2022-05-19 18:56:51 +02:00
dma dmaengine updates for v5.19-rc1 2022-05-29 11:38:27 -07:00
dma-buf Merge drm/drm-next into drm-misc-next 2022-06-20 18:21:25 +02:00
edac - A gargen variety of fixes which don't fit any other tip bucket: 2022-05-23 19:32:59 -07:00
eisa
…
extcon extcon: Modify extcon device to be created after driver data is set 2022-05-13 17:03:41 +09:00
firewire Merge branch 'for-linus' into for-next 2022-05-23 07:48:27 +02:00
firmware Merge drm/drm-next into drm-misc-next 2022-06-20 18:21:25 +02:00
fpga
…
fsi
…
gnss
…
gpio gpio: dwapb: Don't print error on -EPROBE_DEFER 2022-06-10 14:26:15 +02:00
gpu drm/aperture: Run fbdev removal before internal helpers 2022-06-21 12:54:34 +02:00
greybus
…
hid USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
hsi
…
hte hte: Uninitialized variable in hte_ts_get() 2022-05-20 15:54:41 +02:00
hv Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
hwmon hwmon: (aquacomputer_d5next) Fix an error handling path in aqc_probe() 2022-05-22 12:25:55 -07:00
hwspinlock
…
hwtracing
…
i2c i2c: ismt: prevent memory corruption in ismt_access() 2022-06-02 08:40:56 -07:00
i3c i3c: master: svc: fix returnvar.cocci warning 2022-05-17 22:34:42 +02:00
idle cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE 2022-06-08 18:05:45 +02:00
iio Bitmap patches for 5.19-rc1 2022-06-04 14:04:27 -07:00
infiniband v5.19 pull request 2022-05-26 21:08:40 -07:00
input Input updates for v5.19-rc1 2022-06-07 15:00:29 -07:00
interconnect Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
iommu IOMMU Updates for Linux v5.19 2022-05-31 09:56:54 -07:00
ipack
…
irqchip irq: mips: replace cpumask_weight with cpumask_empty where appropriate 2022-06-03 06:52:57 -07:00
isdn
…
leds ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
macintosh macintosh: via-pmu and via-cuda need RTC_LIB 2022-05-22 15:58:30 +10:00
mailbox mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n 2022-05-24 08:08:24 -05:00
mcb
…
md dm: fix zoned locking imbalance due to needless check in clone_endio 2022-06-10 15:23:54 -04:00
media USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
memory More power management updates for 5.19-rc1 2022-05-30 11:37:26 -07:00
memstick
…
message
…
mfd ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
misc Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
mmc MMC core: 2022-06-07 14:24:30 -07:00
most
…
mtd This pull request contains fixes for JFFS2, UBI and UBIFS 2022-06-03 14:42:24 -07:00
mux
…
net mlx5-fixes-2022-06-08 2022-06-09 22:05:37 -07:00
nfc nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred 2022-06-08 10:18:10 -07:00
ntb
…
nubus
…
nvdimm cxl for 5.19 2022-05-27 21:24:19 -07:00
nvme SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
nvmem
…
of drm for 5.19-rc1 2022-05-25 16:18:27 -07:00
opp OPP updates for 5.19-rc1 2022-05-25 15:02:26 +02:00
parisc
…
parport
…
pci Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
pcmcia ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
peci
…
perf arm64 updates for 5.19: 2022-05-23 21:06:11 -07:00
phy phy-for-5.19 2022-05-19 16:56:17 +02:00
pinctrl Pin control bulk changes for the v5.19 series: 2022-05-28 11:15:54 -07:00
platform platform-drivers-x86 for v5.19-2 2022-06-12 11:33:42 -07:00
pnp
…
power Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
powercap Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
pps
…
ps3
…
ptp ptp: ptp_clockmatrix: fix is_single_shot 2022-05-25 21:51:32 -07:00
pwm pwm: pwm-cros-ec: Add channel type support 2022-05-20 16:40:01 +02:00
rapidio
…
ras
…
regulator Merge back reboot/poweroff notifiers rework for 5.19-rc1. 2022-05-25 14:38:29 +02:00
remoteproc
…
reset
…
rpmsg Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
rtc ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
s390 Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
sbus
…
scsi scsi: pmcraid: Fix missing resource cleanup in error case 2022-06-07 22:05:14 -04:00
sh
…
siox
…
slimbus Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
soc Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
soundwire
…
spi Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
spmi
…
ssb
…
staging Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
target blk-mq: remove the done argument to blk_execute_rq_nowait 2022-05-28 06:15:27 -06:00
tc
…
tee Fix a compiler warning in OP-TEE driver 2022-05-30 14:44:27 +02:00
thermal Additional thermal control update for 5.19-rc1 2022-05-30 11:34:13 -07:00
thunderbolt USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
tty xen: branch for v5.19-rc1b 2022-06-04 13:42:53 -07:00
ufs SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
uio
…
usb Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
vdpa vduse: Fix NULL pointer dereference on sysfs access 2022-06-08 08:56:03 -04:00
vfio VFIO updates for v5.19-rc1 2022-06-01 13:49:15 -07:00
vhost vdpa: make get_vq_group and set_group_asid optional 2022-06-09 00:26:35 -04:00
video Merge drm/drm-next into drm-misc-next 2022-06-20 18:21:25 +02:00
virt Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
virtio virtio,vdpa: fixes 2022-06-11 16:32:47 -07:00
vlynq
…
vme
…
w1
…
watchdog ARM: SoC changes, part 2 2022-06-02 15:27:44 -07:00
xen xen: unexport __init-annotated xen_xlate_map_ballooned_pages() 2022-06-07 08:11:35 +02:00
zorro
…
Kconfig SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
Makefile SCSI misc on 20220604 2022-06-05 09:25:12 -07:00