From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Lyude Paul <lyude@redhat.com>,
Karol Herbst <karolherbst@gmail.com>,
Ben Skeggs <bskeggs@redhat.com>
Subject: [PATCH 4.17 34/63] drm/nouveau: Avoid looping through fake MST connectors
Date: Mon, 23 Jul 2018 14:24:40 +0200 [thread overview]
Message-ID: <20180723122447.663513001@linuxfoundation.org> (raw)
In-Reply-To: <20180723122446.351334162@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <lyude@redhat.com>
commit 37afe55b4ae0600deafe7c0e0e658593c4754f1b upstream.
When MST and atomic were introduced to nouveau, another structure that
could contain a drm_connector embedded within it was introduced; struct
nv50_mstc. This meant that we no longer would be able to simply loop
through our connector list and assume that nouveau_connector() would
return a proper pointer for each connector, since the assertion that
all connectors coming from nouveau have a full nouveau_connector struct
became invalid.
Unfortunately, none of the actual code that looped through connectors
ever got updated, which means that we've been causing invalid memory
accesses for quite a while now.
An example that was caught by KASAN:
[ 201.038698] ==================================================================
[ 201.038792] BUG: KASAN: slab-out-of-bounds in nvif_notify_get+0x190/0x1a0 [nouveau]
[ 201.038797] Read of size 4 at addr ffff88076738c650 by task kworker/0:3/718
[ 201.038800]
[ 201.038822] CPU: 0 PID: 718 Comm: kworker/0:3 Tainted: G O 4.18.0-rc4Lyude-Test+ #1
[ 201.038825] Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET78W (1.51 ) 05/18/2018
[ 201.038882] Workqueue: events nouveau_display_hpd_work [nouveau]
[ 201.038887] Call Trace:
[ 201.038894] dump_stack+0xa4/0xfd
[ 201.038900] print_address_description+0x71/0x239
[ 201.038929] ? nvif_notify_get+0x190/0x1a0 [nouveau]
[ 201.038935] kasan_report.cold.6+0x242/0x2fe
[ 201.038942] __asan_report_load4_noabort+0x19/0x20
[ 201.038970] nvif_notify_get+0x190/0x1a0 [nouveau]
[ 201.038998] ? nvif_notify_put+0x1f0/0x1f0 [nouveau]
[ 201.039003] ? kmsg_dump_rewind_nolock+0xe4/0xe4
[ 201.039049] nouveau_display_init.cold.12+0x34/0x39 [nouveau]
[ 201.039089] ? nouveau_user_framebuffer_create+0x120/0x120 [nouveau]
[ 201.039133] nouveau_display_resume+0x5c0/0x810 [nouveau]
[ 201.039173] ? nvkm_client_ioctl+0x20/0x20 [nouveau]
[ 201.039215] nouveau_do_resume+0x19f/0x570 [nouveau]
[ 201.039256] nouveau_pmops_runtime_resume+0xd8/0x2a0 [nouveau]
[ 201.039264] pci_pm_runtime_resume+0x130/0x250
[ 201.039269] ? pci_restore_standard_config+0x70/0x70
[ 201.039275] __rpm_callback+0x1f2/0x5d0
[ 201.039279] ? rpm_resume+0x560/0x18a0
[ 201.039283] ? pci_restore_standard_config+0x70/0x70
[ 201.039287] ? pci_restore_standard_config+0x70/0x70
[ 201.039291] ? pci_restore_standard_config+0x70/0x70
[ 201.039296] rpm_callback+0x175/0x210
[ 201.039300] ? pci_restore_standard_config+0x70/0x70
[ 201.039305] rpm_resume+0xcc3/0x18a0
[ 201.039312] ? rpm_callback+0x210/0x210
[ 201.039317] ? __pm_runtime_resume+0x9e/0x100
[ 201.039322] ? kasan_check_write+0x14/0x20
[ 201.039326] ? do_raw_spin_lock+0xc2/0x1c0
[ 201.039333] __pm_runtime_resume+0xac/0x100
[ 201.039374] nouveau_display_hpd_work+0x67/0x1f0 [nouveau]
[ 201.039380] process_one_work+0x7a0/0x14d0
[ 201.039388] ? cancel_delayed_work_sync+0x20/0x20
[ 201.039392] ? lock_acquire+0x113/0x310
[ 201.039398] ? kasan_check_write+0x14/0x20
[ 201.039402] ? do_raw_spin_lock+0xc2/0x1c0
[ 201.039409] worker_thread+0x86/0xb50
[ 201.039418] kthread+0x2e9/0x3a0
[ 201.039422] ? process_one_work+0x14d0/0x14d0
[ 201.039426] ? kthread_create_worker_on_cpu+0xc0/0xc0
[ 201.039431] ret_from_fork+0x3a/0x50
[ 201.039441]
[ 201.039444] Allocated by task 79:
[ 201.039449] save_stack+0x43/0xd0
[ 201.039452] kasan_kmalloc+0xc4/0xe0
[ 201.039456] kmem_cache_alloc_trace+0x10a/0x260
[ 201.039494] nv50_mstm_add_connector+0x9a/0x340 [nouveau]
[ 201.039504] drm_dp_add_port+0xff5/0x1fc0 [drm_kms_helper]
[ 201.039511] drm_dp_send_link_address+0x4a7/0x740 [drm_kms_helper]
[ 201.039518] drm_dp_check_and_send_link_address+0x1a7/0x210 [drm_kms_helper]
[ 201.039525] drm_dp_mst_link_probe_work+0x71/0xb0 [drm_kms_helper]
[ 201.039529] process_one_work+0x7a0/0x14d0
[ 201.039533] worker_thread+0x86/0xb50
[ 201.039537] kthread+0x2e9/0x3a0
[ 201.039541] ret_from_fork+0x3a/0x50
[ 201.039543]
[ 201.039546] Freed by task 0:
[ 201.039549] (stack is not available)
[ 201.039551]
[ 201.039555] The buggy address belongs to the object at ffff88076738c1a8
which belongs to the cache kmalloc-2048 of size 2048
[ 201.039559] The buggy address is located 1192 bytes inside of
2048-byte region [ffff88076738c1a8, ffff88076738c9a8)
[ 201.039563] The buggy address belongs to the page:
[ 201.039567] page:ffffea001d9ce200 count:1 mapcount:0 mapping:ffff88084000d0c0 index:0x0 compound_mapcount: 0
[ 201.039573] flags: 0x8000000000008100(slab|head)
[ 201.039578] raw: 8000000000008100 ffffea001da3be08 ffffea001da25a08 ffff88084000d0c0
[ 201.039582] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000
[ 201.039585] page dumped because: kasan: bad access detected
[ 201.039588]
[ 201.039591] Memory state around the buggy address:
[ 201.039594] ffff88076738c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 201.039598] ffff88076738c580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 201.039601] >ffff88076738c600: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[ 201.039604] ^
[ 201.039607] ffff88076738c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 201.039611] ffff88076738c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 201.039613] ==================================================================
Signed-off-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org
Cc: Karol Herbst <karolherbst@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_connector.h | 24 +++++++++++++++++++++++-
drivers/gpu/drm/nouveau/nouveau_display.c | 4 ++--
3 files changed, 26 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1213,7 +1213,7 @@ nouveau_connector_create(struct drm_devi
bool dummy;
drm_connector_list_iter_begin(dev, &conn_iter);
- drm_for_each_connector_iter(connector, &conn_iter) {
+ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
nv_connector = nouveau_connector(connector);
if (nv_connector->index == index) {
drm_connector_list_iter_end(&conn_iter);
--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
@@ -33,6 +33,7 @@
#include <drm/drm_encoder.h>
#include <drm/drm_dp_helper.h>
#include "nouveau_crtc.h"
+#include "nouveau_encoder.h"
struct nvkm_i2c_port;
@@ -60,6 +61,27 @@ static inline struct nouveau_connector *
return container_of(con, struct nouveau_connector, base);
}
+static inline bool
+nouveau_connector_is_mst(struct drm_connector *connector)
+{
+ const struct nouveau_encoder *nv_encoder;
+ const struct drm_encoder *encoder;
+
+ if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
+ return false;
+
+ nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY);
+ if (!nv_encoder)
+ return false;
+
+ encoder = &nv_encoder->base.base;
+ return encoder->encoder_type == DRM_MODE_ENCODER_DPMST;
+}
+
+#define nouveau_for_each_non_mst_connector_iter(connector, iter) \
+ drm_for_each_connector_iter(connector, iter) \
+ for_each_if(!nouveau_connector_is_mst(connector))
+
static inline struct nouveau_connector *
nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
{
@@ -70,7 +92,7 @@ nouveau_crtc_connector_get(struct nouvea
struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
drm_connector_list_iter_begin(dev, &conn_iter);
- drm_for_each_connector_iter(connector, &conn_iter) {
+ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
if (connector->encoder && connector->encoder->crtc == crtc) {
nv_connector = nouveau_connector(connector);
break;
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -415,7 +415,7 @@ nouveau_display_init(struct drm_device *
/* enable hotplug interrupts */
drm_connector_list_iter_begin(dev, &conn_iter);
- drm_for_each_connector_iter(connector, &conn_iter) {
+ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
struct nouveau_connector *conn = nouveau_connector(connector);
nvif_notify_get(&conn->hpd);
}
@@ -446,7 +446,7 @@ nouveau_display_fini(struct drm_device *
/* disable hotplug interrupts */
drm_connector_list_iter_begin(dev, &conn_iter);
- drm_for_each_connector_iter(connector, &conn_iter) {
+ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
struct nouveau_connector *conn = nouveau_connector(connector);
nvif_notify_put(&conn->hpd);
}
next prev parent reply other threads:[~2018-07-23 12:26 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-23 12:24 [PATCH 4.17 00/63] 4.17.10-stable review Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 01/63] scsi: sd_zbc: Fix variable type and bogus comment Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 02/63] scsi: qla2xxx: Fix inconsistent DMA mem alloc/free Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 03/63] scsi: qla2xxx: Fix kernel crash due to late workqueue allocation Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 04/63] scsi: qla2xxx: Fix NULL pointer dereference for fcport search Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 06/63] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 07/63] KVM: VMX: Mark VMXArea with revision_id of physical CPU even when eVMCS enabled Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 08/63] x86/kvm/vmx: dont read current->thread.{fs,gs}base of legacy tasks Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 11/63] x86/events/intel/ds: Fix bts_interrupt_threshold alignment Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 12/63] x86/MCE: Remove min interval polling limitation Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 13/63] fat: fix memory allocation failure handling of match_strdup() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 14/63] ALSA: rawmidi: Change resized buffers atomically Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 15/63] ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 16/63] ALSA: hda/realtek - Yet another Clevo P950 quirk entry Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 17/63] ALSA: hda: add mute led support for HP ProBook 455 G5 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 18/63] ARCv2: [plat-hsdk]: Save accl reg pair by default Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 19/63] ARC: Fix CONFIG_SWAP Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 20/63] ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 21/63] ARC: mm: allow mprotect to make stack mappings executable Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 22/63] mm: memcg: fix use after free in mem_cgroup_iter() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 23/63] mm/huge_memory.c: fix data loss when splitting a file pmd Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 24/63] cpufreq: intel_pstate: Register when ACPI PCCH is present Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 25/63] vfio/pci: Fix potential Spectre v1 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 26/63] vfio/spapr: Use IOMMU pageshift rather than pagesize Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 27/63] stop_machine: Disable preemption when waking two stopper threads Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 28/63] powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from stop (idle) Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 31/63] Revert "drm/amd/display: Dont return ddc result and read_bytes in same return value" Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 32/63] drm/nouveau: Remove bogus crtc check in pmops_runtime_idle Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 33/63] drm/nouveau: Use drm_connector_list_iter_* for iterating connectors Greg Kroah-Hartman
2018-07-23 12:24 ` Greg Kroah-Hartman [this message]
2018-07-23 12:24 ` [PATCH 4.17 36/63] ipv4: Return EINVAL when ping_group_range sysctl doesnt map to user ns Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 37/63] ipv6: fix useless rol32 call on hash Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 38/63] ipv6: ila: select CONFIG_DST_CACHE Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 39/63] lib/rhashtable: consider param->min_size when setting initial table size Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 40/63] net: diag: Dont double-free TCP_NEW_SYN_RECV sockets in tcp_abort Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 41/63] net: Dont copy pfmemalloc flag in __copy_skb_header() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 42/63] skbuff: Unconditionally copy pfmemalloc in __skb_clone() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 43/63] net/ipv4: Set oif in fib_compute_spec_dst Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 44/63] net/ipv6: Do not allow device only routes via the multipath API Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 45/63] net: phy: fix flag masking in __set_phy_supported Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 46/63] ptp: fix missing break in switch Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 48/63] rhashtable: add restart routine in rhashtable_free_and_destroy() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 49/63] sch_fq_codel: zero q->flows_cnt when fq_codel_init fails Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 50/63] tg3: Add higher cpu clock for 5762 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 51/63] net: ip6_gre: get ipv6hdr after skb_cow_head() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 52/63] sctp: introduce sctp_dst_mtu Greg Kroah-Hartman
2018-07-25 19:19 ` Marcelo Ricardo Leitner
2018-07-23 12:24 ` [PATCH 4.17 53/63] sctp: fix the issue that pathmtu may be set lower than MINSEGMENT Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 54/63] hv_netvsc: Fix napi reschedule while receive completion is busy Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 55/63] net: aquantia: vlan unicast address list correct handling Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 56/63] net/mlx4_en: Dont reuse RX page when XDP is set Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 57/63] net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 58/63] ipv6: make DAD fail with enhanced DAD when nonce length differs Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 59/63] net: usb: asix: replace mii_nway_restart in resume path Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 60/63] alpha: fix osf_wait4() breakage Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 61/63] drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open() Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 62/63] cxl_getfile(): fix double-iput() on alloc_file() failures Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 63/63] xhci: Fix perceived dead host due to runtime suspend race with event handler Greg Kroah-Hartman
2018-07-24 7:38 ` [PATCH 4.17 00/63] 4.17.10-stable review Naresh Kamboju
2018-07-24 8:58 ` Greg Kroah-Hartman
2018-07-24 15:58 ` Guenter Roeck
2018-07-25 7:46 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180723122447.663513001@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bskeggs@redhat.com \
--cc=karolherbst@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lyude@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).