iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Lyude Paul 541ff7e96c drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST 
Turns out that if you trigger an HPD storm on a system that has an MST
topology connected to it, you'll end up causing the kernel to eventually
hit a NULL deref:

[  332.339041] BUG: unable to handle kernel NULL pointer dereference at 00000000000000ec
[  332.340906] PGD 0 P4D 0
[  332.342750] Oops: 0000 [#1] SMP PTI
[  332.344579] CPU: 2 PID: 25 Comm: kworker/2:0 Kdump: loaded Tainted: G           O      4.18.0-rc3short-hpd-storm+ #2
[  332.346453] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET71WW (1.35 ) 09/14/2018
[  332.348361] Workqueue: events intel_hpd_irq_storm_reenable_work [i915]
[  332.350301] RIP: 0010:intel_hpd_irq_storm_reenable_work.cold.3+0x2f/0x86 [i915]
[  332.352213] Code: 00 00 ba e8 00 00 00 48 c7 c6 c0 aa 5f a0 48 c7 c7 d0 73 62 a0 4c 89 c1 4c 89 04 24 e8 7f f5 af e0 4c 8b 04 24 44 89 f8 29 e8 <41> 39 80 ec 00 00 00 0f 85 43 13 fc ff 41 0f b6 86 b8 04 00 00 41
[  332.354286] RSP: 0018:ffffc90000147e48 EFLAGS: 00010006
[  332.356344] RAX: 0000000000000005 RBX: ffff8802c226c9d4 RCX: 0000000000000006
[  332.358404] RDX: 0000000000000000 RSI: 0000000000000082 RDI: ffff88032dc95570
[  332.360466] RBP: 0000000000000005 R08: 0000000000000000 R09: ffff88031b3dc840
[  332.362528] R10: 0000000000000000 R11: 000000031a069602 R12: ffff8802c226ca20
[  332.364575] R13: ffff8802c2268000 R14: ffff880310661000 R15: 000000000000000a
[  332.366615] FS:  0000000000000000(0000) GS:ffff88032dc80000(0000) knlGS:0000000000000000
[  332.368658] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  332.370690] CR2: 00000000000000ec CR3: 000000000200a003 CR4: 00000000003606e0
[  332.372724] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  332.374773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  332.376798] Call Trace:
[  332.378809]  process_one_work+0x1a1/0x350
[  332.380806]  worker_thread+0x30/0x380
[  332.382777]  ? wq_update_unbound_numa+0x10/0x10
[  332.384772]  kthread+0x112/0x130
[  332.386740]  ? kthread_create_worker_on_cpu+0x70/0x70
[  332.388706]  ret_from_fork+0x35/0x40
[  332.390651] Modules linked in: i915(O) vfat fat joydev btusb btrtl btbcm btintel bluetooth ecdh_generic iTCO_wdt wmi_bmof i2c_algo_bit drm_kms_helper intel_rapl syscopyarea sysfillrect x86_pkg_temp_thermal sysimgblt coretemp fb_sys_fops crc32_pclmul drm psmouse pcspkr mei_me mei i2c_i801 lpc_ich mfd_core i2c_core tpm_tis tpm_tis_core thinkpad_acpi wmi tpm rfkill video crc32c_intel serio_raw ehci_pci xhci_pci ehci_hcd xhci_hcd [last unloaded: i915]
[  332.394963] CR2: 00000000000000ec

This appears to be due to the fact that with an MST topology, not all
intel_connector structs will have ->encoder set. So, fix this by
skipping connectors without encoders in
intel_hpd_irq_storm_reenable_work().

For those wondering, this bug was found on accident while simulating HPD
storms using a Chamelium connected to a ThinkPad T450s (Broadwell).

Changes since v1:
- Check intel_connector->mst_port instead of intel_connector->encoder

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: stable@vger.kernel.org
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181106213017.14563-3-lyude@redhat.com
(cherry picked from commit fee61deecb1d850bf34f682a6a452e5ee51b7572)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2018-11-12 17:07:12 +02:00
..
amd
drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()
2018-11-07 18:21:05 -05:00
arc
drm: drop _mode_ from drm_mode_connector_attach_encoder
2018-07-13 18:40:27 +02:00
arm
drm: malidp: Add the size of the superblocks when calculating total
2018-10-05 15:39:51 +01:00
armada
drm: extract drm_atomic_uapi.c
2018-09-09 14:19:18 +02:00
ast
drm: drop _mode_ from drm_mode_connector_attach_encoder
2018-07-13 18:40:27 +02:00
atmel-hlcdc
drm/atmel-hlcdc: support bus-width (12/16/18/24) in endpoint nodes
2018-08-27 21:22:52 +02:00
bochs
drm/bochs: support changing byteorder at mode set time
2018-09-25 14:49:49 +02:00
bridge
drm/bridge: ti-sn65dsi86: Remove the mystery delay
2018-10-29 11:53:27 -04:00
cirrus
drm/cirrus: use simpler remove_conflicting_pci_framebuffers()
2018-09-03 18:16:47 +02:00
etnaviv
Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes
2018-11-07 09:32:30 +10:00
exynos
drm/exynos/fbdev: do not skip fbdev init if there are no connectors
2018-11-05 16:37:24 +09:00
fsl-dcu
drm/fsl-dcu: Replace drm_dev_unref with drm_dev_put
2018-09-26 22:20:16 +02:00
gma500
Merge drm/drm-next into drm-misc-next
2018-08-27 10:00:03 -04:00
hisilicon
drm/hisilicon: Replace ttm_bo_unref with ttm_bo_put
2018-09-26 11:42:12 +08:00
i2c
Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes
2018-10-04 10:32:14 +10:00
i810
drm/i810: off by one in i810_dma_vertex()
2018-07-03 15:00:42 +02:00
i915
drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST
2018-11-12 17:07:12 +02:00
imx
drm/imx: fix build failure without CONFIG_DRM_FBDEV_EMULATION
2018-10-05 12:09:20 +02:00
lib
…
mediatek
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
meson
drm/meson: Make DMT timings parameters and pixel clock generic
2018-07-16 11:14:59 +02:00
mga
…
mgag200
drm/mgag200: use simpler remove_conflicting_pci_framebuffers()
2018-09-03 18:17:32 +02:00
msm
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
mxsfb
drm/mxsfb: Switch to drm_atomic_helper_commit_tail_rpm
2018-09-26 22:07:40 +02:00
nouveau
drm, i915, amdgpu, bridge + core quirk
2018-11-02 10:58:20 -07:00
omapdrm
drm/omap: fix use of freed memory
2018-10-02 09:36:56 +03:00
panel
drm/panel: simple: Innolux TV123WAM is actually P120ZDG-BF1
2018-10-29 11:53:28 -04:00
pl111
Merge drm/drm-next into drm-misc-next
2018-09-27 02:54:54 -04:00
qxl
qxl: refactor to use drm_fb_helper_fbdev_setup
2018-09-12 09:01:18 +02:00
r128
…
radeon
drm/radeon: change SPDX identifier to MIT
2018-10-15 16:16:12 -05:00
rcar-du
drm: rcar-du: Add r8a77990 and r8a77995 device support
2018-09-25 00:41:05 +03:00
rockchip
drm/rockchip: Allow driver to be shutdown on reboot/kexec
2018-09-10 10:52:27 +02:00
savage
drm/savage: off by one in savage_bci_cmdbuf()
2018-07-04 14:27:01 +02:00
scheduler
drm/sched: fix timeout handling v2
2018-10-12 12:52:32 -05:00
selftests
drm-misc-next for 4.19:
2018-06-22 12:58:08 +10:00
shmobile
drm: shmobile: convert to SPDX identifiers
2018-09-14 13:54:02 +03:00
sis
…
sti
drm/sti: Use drm_fbdev_generic_setup()
2018-09-25 11:33:51 +02:00
stm
drm/stm: Replace drm_dev_unref with drm_dev_put
2018-07-13 10:11:02 +02:00
sun4i
drm/sun4i: tcon: prevent tcon->panel dereference if NULL
2018-11-06 16:55:29 +01:00
tdfx
…
tegra
drm/tegra: Changes for v4.20-rc1
2018-09-28 09:47:31 +10:00
tilcdc
drm/tilcdc: Convert drm_atomic_helper_suspend/resume()
2018-10-01 15:52:29 +03:00
tinydrm
drm/tinydrm: Replace drm_dev_unref with drm_dev_put
2018-08-07 17:09:15 +02:00
ttm
list: introduce list_bulk_move_tail helper
2018-10-10 15:20:54 -05:00
tve200
drm/tve200: Use drm_fbdev_generic_setup()
2018-09-25 11:34:24 +02:00
udl
Merge drm/drm-next into drm-misc-next
2018-09-27 02:54:54 -04:00
v3d
drm/scheduler: remove timeout work_struct from drm_sched_job (v3)
2018-09-27 09:55:45 -05:00
vc4
Merge drm/drm-next into drm-misc-next
2018-09-27 02:54:54 -04:00
vgem
drm/vgem: Remove unecessary dma_fence_ops
2018-08-17 11:22:58 +02:00
via
…
virtio
virtio: Support prime objects vmap/vunmap
2018-09-26 08:05:07 +02:00
vkms
drm/vkms: Fix possible memory leak in _vkms_get_crc()
2018-09-21 10:50:45 +02:00
vmwgfx
Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next
2018-10-04 10:19:33 +10:00
xen
drm: Replace NULL with error value in drm_prime_pages_to_sg
2018-07-23 11:47:35 +03:00
zte
drm/zte: Use drm_fbdev_generic_setup()
2018-09-25 11:35:33 +02:00
ati_pcigart.c
…
drm_agpsupport.c
…
drm_atomic_helper.c
drm, i915, amdgpu, bridge + core quirk
2018-11-02 10:58:20 -07:00
drm_atomic_uapi.c
drm/atomic_helper: Stop modesets on unregistered connectors harder
2018-10-19 11:46:46 +03:00
drm_atomic.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_auth.c
…
drm_blend.c
drm: Clarify DRM_MODE_REFLECT_X/Y documentation
2018-09-11 11:21:30 +01:00
drm_bridge.c
drm: bridge: document bridge attach/detach imbalance
2018-09-13 11:28:12 +02:00
drm_bufs.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_cache.c
…
drm_client.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_color_mgmt.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_connector.c
drm/atomic_helper: Stop modesets on unregistered connectors harder
2018-10-19 11:46:46 +03:00
drm_context.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
drm: extract drm_atomic_uapi.c
2018-09-09 14:19:18 +02:00
drm_crtc_internal.h
drm: refuse ADDFB2 ioctl for broken bigendian drivers
2018-09-10 07:10:36 +02:00
drm_crtc.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_debugfs_crc.c
Revert "drm: crc: Wait for a frame before returning from open()"
2018-08-22 09:50:16 -07:00
drm_debugfs.c
drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation
2018-09-17 19:24:37 -04:00
drm_dma.c
…
drm_dp_aux_dev.c
…
drm_dp_cec.c
drm_dp_cec: add note about good MegaChips 2900 CEC support
2018-08-31 10:20:38 +02:00
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
drm: add LG eDP panel to quirk database
2018-09-19 16:44:12 +03:00
drm_dp_mst_topology.c
drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()
2018-08-31 10:20:38 +02:00
drm_drv.c
drm: Introduce per-device driver_features
2018-09-13 18:44:06 +03:00
drm_dumb_buffers.c
drm-misc-next for 4.19:
2018-06-28 13:29:07 +10:00
drm_edid_load.c
…
drm_edid.c
drm, i915, amdgpu, bridge + core quirk
2018-11-02 10:58:20 -07:00
drm_encoder_slave.c
…
drm_encoder.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_fb_cma_helper.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_fb_helper.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_file.c
drm: Begin an API for in-kernel clients
2018-07-10 14:51:37 +02:00
drm_flip_work.c
…
drm_fourcc.c
drm: move quirk_addfb_prefer_xbgr_30bpp handling to drm_driver_legacy_fb_format too
2018-09-25 14:49:50 +02:00
drm_framebuffer.c
drm: move quirk_addfb_prefer_xbgr_30bpp handling to drm_driver_legacy_fb_format too
2018-09-25 14:49:50 +02:00
drm_gem_cma_helper.c
drm: Replace NULL with error value in drm_prime_pages_to_sg
2018-07-23 11:47:35 +03:00
drm_gem_framebuffer_helper.c
drm: use drm_driver_legacy_fb_format in drm_gem_fbdev_fb_create
2018-09-25 14:49:49 +02:00
drm_gem.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_global.c
drm: add SPDX identifier and clarify license
2018-06-29 15:28:47 -05:00
drm_hashtab.c
…
drm_info.c
…
drm_internal.h
drm: Drop drmP.h from drm_connector.c
2018-09-09 14:19:17 +02:00
drm_ioc32.c
…
drm_ioctl.c
drm: Return -EOPNOTSUPP in drm_setclientcap() when driver do not support KMS
2018-09-21 11:19:40 +02:00
drm_irq.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_kms_helper_common.c
…
drm_lease.c
drm pull for 4.20-rc1
2018-10-28 17:49:53 -07:00
drm_legacy.h
…
drm_lock.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_memory.c
…
drm_mipi_dsi.c
drm: Add support for pps and compression mode command packet
2018-07-25 07:51:05 -04:00
drm_mm.c
…
drm_mode_config.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_mode_object.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_modes.c
drm: drop _mode_ from remaining connector functions
2018-07-13 18:40:27 +02:00
drm_modeset_helper.c
…
drm_modeset_lock.c
drm: Change deadlock-avoidance algorithm for the modeset locks.
2018-07-03 09:46:05 +02:00
drm_of.c
drm/doc: Include drm_of.c helpers
2018-07-13 18:40:28 +02:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)
2018-10-17 14:17:38 +02:00
drm_panel.c
This is the 4.19-rc6 release
2018-10-04 11:03:34 +10:00
drm_pci.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_plane_helper.c
drm: extract drm_atomic_uapi.c
2018-09-09 14:19:18 +02:00
drm_plane.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_prime.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_print.c
drm: Add puts callback for the coredump printer
2018-07-30 08:49:41 -04:00
drm_probe_helper.c
drm: drop _mode_ from remaining connector functions
2018-07-13 18:40:27 +02:00
drm_property.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_rect.c
…
drm_scatter.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_scdc_helper.c
…
drm_simple_kms_helper.c
drm: drop _mode_ from drm_mode_connector_attach_encoder
2018-07-13 18:40:27 +02:00
drm_syncobj.c
This is the 4.19-rc6 release
2018-10-04 11:03:34 +10:00
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank.c
drm: Differentiate the lack of an interface from invalid parameter
2018-09-14 17:29:47 +01:00
drm_vm.c
…
drm_vma_manager.c
drm: Remove "protection" around drm_vma_offset_manager_destroy()
2018-09-04 19:00:32 +01:00
drm_writeback.c
drm: writeback: Fix doc that says connector should be disconnected
2018-07-16 16:35:27 +01:00
Kconfig
drm/fb_helper: Allow leaking fbdev smem_start
2018-10-03 21:08:21 +02:00
Makefile
drm: extract drm_atomic_uapi.c
2018-09-09 14:19:18 +02:00