From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: John Garry <john.garry@huawei.com>,
Xinliang Liu <z.liuxinliang@hisilicon.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.18 27/45] drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer
Date: Sun, 4 Nov 2018 08:52:22 -0500 [thread overview]
Message-ID: <20181104135240.88431-27-sashal@kernel.org> (raw)
In-Reply-To: <20181104135240.88431-1-sashal@kernel.org>
From: John Garry <john.garry@huawei.com>
[ Upstream commit 331d880b35a76b5de0eec8cbcecbf615d758a5f9 ]
In hibmc_drm_fb_create(), when the call to hibmc_framebuffer_init() fails
with error, do not store the error code in the HiBMC device frame-buffer
pointer, as this will be later checked for non-zero value in
hibmc_fbdev_destroy() when our intention is to check for a valid function
pointer.
This fixes the following crash:
[ 9.699791] Unable to handle kernel NULL pointer dereference at virtual address 000000000000001a
[ 9.708672] Mem abort info:
[ 9.711489] ESR = 0x96000004
[ 9.714570] Exception class = DABT (current EL), IL = 32 bits
[ 9.720551] SET = 0, FnV = 0
[ 9.723631] EA = 0, S1PTW = 0
[ 9.726799] Data abort info:
[ 9.729702] ISV = 0, ISS = 0x00000004
[ 9.733573] CM = 0, WnR = 0
[ 9.736566] [000000000000001a] user address but active_mm is swapper
[ 9.742987] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 9.748614] Modules linked in:
[ 9.751694] CPU: 16 PID: 293 Comm: kworker/16:1 Tainted: G W 4.19.0-rc4-next-20180920-00001-g9b0012c #322
[ 9.762681] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
[ 9.771915] Workqueue: events work_for_cpu_fn
[ 9.776312] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 9.781150] pc : drm_mode_object_put+0x0/0x20
[ 9.785547] lr : hibmc_fbdev_fini+0x40/0x58
[ 9.789767] sp : ffff00000af1bcf0
[ 9.793108] x29: ffff00000af1bcf0 x28: 0000000000000000
[ 9.798473] x27: 0000000000000000 x26: ffff000008f66630
[ 9.803838] x25: 0000000000000000 x24: ffff0000095abb98
[ 9.809203] x23: ffff8017db92fe00 x22: ffff8017d2b13000
[ 9.814568] x21: ffffffffffffffea x20: ffff8017d2f80018
[ 9.819933] x19: ffff8017d28a0018 x18: ffffffffffffffff
[ 9.825297] x17: 0000000000000000 x16: 0000000000000000
[ 9.830662] x15: ffff0000092296c8 x14: ffff00008939970f
[ 9.836026] x13: ffff00000939971d x12: ffff000009229940
[ 9.841391] x11: ffff0000085f8fc0 x10: ffff00000af1b9a0
[ 9.846756] x9 : 000000000000000d x8 : 6620657a696c6169
[ 9.852121] x7 : ffff8017d3340580 x6 : ffff8017d4168000
[ 9.857486] x5 : 0000000000000000 x4 : ffff8017db92fb20
[ 9.862850] x3 : 0000000000002690 x2 : ffff8017d3340480
[ 9.868214] x1 : 0000000000000028 x0 : 0000000000000002
[ 9.873580] Process kworker/16:1 (pid: 293, stack limit = 0x(____ptrval____))
[ 9.880788] Call trace:
[ 9.883252] drm_mode_object_put+0x0/0x20
[ 9.887297] hibmc_unload+0x1c/0x80
[ 9.890815] hibmc_pci_probe+0x170/0x3c8
[ 9.894773] local_pci_probe+0x3c/0xb0
[ 9.898555] work_for_cpu_fn+0x18/0x28
[ 9.902337] process_one_work+0x1e0/0x318
[ 9.906382] worker_thread+0x228/0x450
[ 9.910164] kthread+0x128/0x130
[ 9.913418] ret_from_fork+0x10/0x18
[ 9.917024] Code: a94153f3 a8c27bfd d65f03c0 d503201f (f9400c01)
[ 9.923180] ---[ end trace 2695ffa0af5be375 ]---
Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
index b92595c477ef..8bd29075ae4e 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
if (IS_ERR(hi_fbdev->fb)) {
ret = PTR_ERR(hi_fbdev->fb);
+ hi_fbdev->fb = NULL;
DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
goto out_release_fbi;
}
--
2.17.1
next prev parent reply other threads:[~2018-11-04 13:53 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-04 13:51 [PATCH AUTOSEL 4.18 01/45] mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition Sasha Levin
2018-11-04 13:51 ` [PATCH AUTOSEL 4.18 02/45] mm: thp: fix mmu_notifier in migrate_misplaced_transhuge_page() Sasha Levin
2018-11-04 13:51 ` [PATCH AUTOSEL 4.18 03/45] mm: calculate deferred pages after skipping mirrored memory Sasha Levin
2018-11-04 13:51 ` [PATCH AUTOSEL 4.18 04/45] mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 05/45] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 06/45] mm: don't miss the last page because of round-off error Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 07/45] mm: don't warn about large allocations for slab Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 08/45] powerpc/traps: restore recoverability of machine_check interrupts Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 09/45] powerpc/64/module: REL32 relocation range check Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 10/45] powerpc/mm: Fix page table dump to work on Radix Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 11/45] powerpc/mm: fix always true/false warning in slice.c Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 12/45] drm/amd/display: fix bug of accessing invalid memory Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 13/45] Input: wm97xx-ts - fix exit path Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 14/45] powerpc/Makefile: Fix PPC_BOOK3S_64 ASFLAGS Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 15/45] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 16/45] tty: check name length in tty_find_polling_driver() Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 17/45] tracing/kprobes: Check the probe on unloaded module correctly Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 18/45] drm/amdgpu/powerplay: fix missing break in switch statements Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 19/45] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 20/45] powerpc/nohash: fix undefined behaviour when testing page size support Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 21/45] powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 22/45] watchdog: lantiq: update register names to better match spec Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 23/45] drm/omap: fix memory barrier bug in DMM driver Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 24/45] iio: adc: at91: fix wrong channel number in triggered buffer mode Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 25/45] iio: adc: at91: fix acking DRDY irq on simple conversions Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 26/45] drm/amd/display: fix gamma not being applied Sasha Levin
2018-11-04 13:52 ` Sasha Levin [this message]
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 28/45] media: pci: cx23885: handle adding to list failure Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 29/45] media: coda: don't overwrite h.264 profile_idc on decoder instance Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 30/45] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 31/45] MIPS: kexec: Mark CPU offline before disabling local IRQ Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 32/45] powerpc/boot: Ensure _zimage_start is a weak symbol Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 33/45] powerpc/memtrace: Remove memory in chunks Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 34/45] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 35/45] sc16is7xx: Fix for multi-channel stall Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 36/45] media: tvp5150: fix width alignment during set_selection() Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 37/45] powerpc/selftests: Wait all threads to join Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 38/45] staging:iio:ad7606: fix voltage scales Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 39/45] drm: rcar-du: Update Gen3 output limitations Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 40/45] drm/amdgpu: Fix SDMA TO after GPU reset v3 Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 41/45] staging: most: video: fix registration of an empty comp core_component Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 42/45] 9p locks: fix glock.client_id leak in do_lock Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 43/45] udf: Prevent write-unsupported filesystem to be remounted read-write Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 44/45] ARM: dts: imx6ull: keep IMX6UL_ prefix for signals on both i.MX6UL and i.MX6ULL Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.18 45/45] 9p: clear dangling pointers in p9stat_free Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181104135240.88431-27-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=john.garry@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=z.liuxinliang@hisilicon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).