* [PATCH] drm: Prevent early NULL dereference of fb_helper->fb
@ 2017-07-19 15:24 Chris Wilson
2017-07-20 8:26 ` Daniel Vetter
0 siblings, 1 reply; 3+ messages in thread
From: Chris Wilson @ 2017-07-19 15:24 UTC (permalink / raw)
To: dri-devel; +Cc: Daniel Vetter, Thierry Reding
Prior to the fbdev being asynchronously configured on boot, the
fb_helper->fb may be unset.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101767
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Thierry Reding <treding@nvidia.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
---
This may not be necessary with the recent async rework? One hopes.
---
drivers/gpu/drm/drm_fb_helper.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 42090fe00ef9..a44b6b434fa0 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1502,6 +1502,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
if (var->pixclock != 0 || in_dbg_master())
return -EINVAL;
+ if (!fb) /* too early, fbdev is not yet setup */
+ return -EINVAL;
+
/*
* Changes struct fb_var_screeninfo are currently not pushed back
* to KMS, hence fail if different settings are requested.
--
2.13.3
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] drm: Prevent early NULL dereference of fb_helper->fb
2017-07-19 15:24 [PATCH] drm: Prevent early NULL dereference of fb_helper->fb Chris Wilson
@ 2017-07-20 8:26 ` Daniel Vetter
2017-07-20 8:52 ` Chris Wilson
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Vetter @ 2017-07-20 8:26 UTC (permalink / raw)
To: Chris Wilson; +Cc: Daniel Vetter, Thierry Reding, dri-devel
On Wed, Jul 19, 2017 at 04:24:50PM +0100, Chris Wilson wrote:
> Prior to the fbdev being asynchronously configured on boot, the
> fb_helper->fb may be unset.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101767
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Thierry Reding <treding@nvidia.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> ---
> This may not be necessary with the recent async rework? One hopes.
It shouldn't be possible to call into check_var (or any other fb_ops
callback) before we register the framebuffer, and we don't do that before
the fb is real.
The bug description also says that after several suspend/resume cycles
does it blow up like that, so very unlikely fbdev isn't set up yet. And
the NULL pointer isn't really NULL.
There's something going wrong for sure, but I don't think it's this.
-Daniel
> ---
> drivers/gpu/drm/drm_fb_helper.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
> index 42090fe00ef9..a44b6b434fa0 100644
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -1502,6 +1502,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
> if (var->pixclock != 0 || in_dbg_master())
> return -EINVAL;
>
> + if (!fb) /* too early, fbdev is not yet setup */
> + return -EINVAL;
> +
> /*
> * Changes struct fb_var_screeninfo are currently not pushed back
> * to KMS, hence fail if different settings are requested.
> --
> 2.13.3
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] drm: Prevent early NULL dereference of fb_helper->fb
2017-07-20 8:26 ` Daniel Vetter
@ 2017-07-20 8:52 ` Chris Wilson
0 siblings, 0 replies; 3+ messages in thread
From: Chris Wilson @ 2017-07-20 8:52 UTC (permalink / raw)
To: Daniel Vetter; +Cc: Daniel Vetter, Thierry Reding, dri-devel
Quoting Daniel Vetter (2017-07-20 09:26:32)
> On Wed, Jul 19, 2017 at 04:24:50PM +0100, Chris Wilson wrote:
> > Prior to the fbdev being asynchronously configured on boot, the
> > fb_helper->fb may be unset.
> >
> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101767
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Thierry Reding <treding@nvidia.com>
> > Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> > ---
> > This may not be necessary with the recent async rework? One hopes.
>
> It shouldn't be possible to call into check_var (or any other fb_ops
> callback) before we register the framebuffer, and we don't do that before
> the fb is real.
>
> The bug description also says that after several suspend/resume cycles
> does it blow up like that, so very unlikely fbdev isn't set up yet. And
> the NULL pointer isn't really NULL.
>
> There's something going wrong for sure, but I don't think it's this.
It was a stab in the dark as it looked like fb was the pointer behind
the crash. (And I have an inherent distrust of this code running before
everything is setup, and we know from experience that we can suspend
before it is setup.) We can rule out *var, so use-after-free of fb?
-Chris
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-07-20 8:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-07-19 15:24 [PATCH] drm: Prevent early NULL dereference of fb_helper->fb Chris Wilson
2017-07-20 8:26 ` Daniel Vetter
2017-07-20 8:52 ` Chris Wilson
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.