From: Daniel Vetter <daniel@ffwll.ch>
To: Alexandru Moise <00moses.alexander00@gmail.com>
Cc: linux-kernel@vger.kernel.org, daniel.vetter@intel.com,
dri-devel@lists.freedesktop.org
Subject: Re: [PATCH] drm: inhibit drm drivers register to uninitialized drm core
Date: Tue, 11 Jul 2017 12:04:13 +0200 [thread overview]
Message-ID: <20170711100413.ysra5qmnl3aeueqk@phenom.ffwll.local> (raw)
In-Reply-To: <20170708214352.GA27205@gmail.com>
On Sat, Jul 08, 2017 at 11:43:52PM +0200, Alexandru Moise wrote:
> If the DRM core fails to init for whatever reason, ensure that
> no driver ever calls drm_dev_register().
>
> This is best done at drm_dev_init() as it covers drivers that call
> drm_dev_alloc() as well as drivers that prefer to embed struct
> drm_device into their own device struct and call drm_dev_init()
> themselves.
>
> In my case I had so many dynamic device majors used that the major
> number for DRM (226) was stolen, causing DRM core init to fail after
> failing to register a chrdev, and ultimately calling debugfs_remove()
> on drm_debugfs_root in drm_core_exit().
>
> After drm core failed to init, VGEM was still calling drm_dev_register(),
> ultimately leading to drm_debugfs_init(), with drm_debugfs_root passed
> as the root for the new debugfs dir at debugfs_create_dir().
>
> This led to a kernel panic once we were either derefencing root->d_inode
> while it was NULL or calling root->d_inode->i_op->lookup() while it was
> NULL in debugfs at inode_lock() or lookup_*().
>
> Signed-off-by: Alexandru Moise <00moses.alexander00@gmail.com>
Applied to drm-misc-next for 4.14. Since Greg has a pach in 4.13 already
for the chardev issue it feels like this isn't justified for pushing
through -rc/stable kernels since too much a corner-case of a bug (it
exists since decades after all).
Thanks, Daniel
> ---
> drivers/gpu/drm/drm_drv.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index 37b8ad3e30d8..2ed2d919beae 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -63,6 +63,15 @@ module_param_named(debug, drm_debug, int, 0600);
> static DEFINE_SPINLOCK(drm_minor_lock);
> static struct idr drm_minors_idr;
>
> +/*
> + * If the drm core fails to init for whatever reason,
> + * we should prevent any drivers from registering with it.
> + * It's best to check this at drm_dev_init(), as some drivers
> + * prefer to embed struct drm_device into their own device
> + * structure and call drm_dev_init() themselves.
> + */
> +static bool drm_core_init_complete = false;
> +
> static struct dentry *drm_debugfs_root;
>
> #define DRM_PRINTK_FMT "[" DRM_NAME ":%s]%s %pV"
> @@ -484,6 +493,11 @@ int drm_dev_init(struct drm_device *dev,
> {
> int ret;
>
> + if (!drm_core_init_complete) {
> + DRM_ERROR("DRM core is not initialized\n");
> + return -ENODEV;
> + }
> +
> kref_init(&dev->ref);
> dev->dev = parent;
> dev->driver = driver;
> @@ -966,6 +980,8 @@ static int __init drm_core_init(void)
> if (ret < 0)
> goto error;
>
> + drm_core_init_complete = true;
> +
> DRM_DEBUG("Initialized\n");
> return 0;
>
> --
> 2.13.2
>
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
prev parent reply other threads:[~2017-07-11 10:04 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-08 21:43 [PATCH] drm: inhibit drm drivers register to uninitialized drm core Alexandru Moise
2017-07-10 6:52 ` Daniel Vetter
2017-07-10 7:14 ` Alexandru Moise
2017-07-10 18:00 ` Daniel Vetter
2017-07-10 19:56 ` Alexandru Moise
2017-07-11 7:53 ` Daniel Vetter
2017-07-11 9:41 ` Greg Kroah-Hartman
2017-07-11 10:02 ` Daniel Vetter
2017-07-11 10:04 ` Daniel Vetter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170711100413.ysra5qmnl3aeueqk@phenom.ffwll.local \
--to=daniel@ffwll.ch \
--cc=00moses.alexander00@gmail.com \
--cc=daniel.vetter@intel.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).