* [PATCH] drm/bridge: adv7511: fix crash on irq during probe
@ 2023-10-14 18:46 Alvin Šipraga
2023-10-16 8:14 ` Laurent Pinchart
0 siblings, 1 reply; 4+ messages in thread
From: Alvin Šipraga @ 2023-10-14 18:46 UTC (permalink / raw)
To: Andrzej Hajda, Neil Armstrong, Robert Foss, Laurent Pinchart,
Jonas Karlman, Jernej Skrabec, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Archit Taneja,
Hans Verkuil
Cc: dri-devel, linux-kernel, Mads Bligaard Nielsen, Alvin Šipraga
From: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
Moved IRQ registration down to end of adv7511_probe().
If an IRQ already is pending during adv7511_probe
(before adv7511_cec_init) then cec_received_msg_ts
could crash using uninitialized data:
Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5
Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP
Call trace:
cec_received_msg_ts+0x48/0x990 [cec]
adv7511_cec_irq_process+0x1cc/0x308 [adv7511]
adv7511_irq_process+0xd8/0x120 [adv7511]
adv7511_irq_handler+0x1c/0x30 [adv7511]
irq_thread_fn+0x30/0xa0
irq_thread+0x14c/0x238
kthread+0x190/0x1a8
Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
Signed-off-by: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
---
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index d518de88b5c3..71022cb8abe4 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -1291,17 +1291,6 @@ static int adv7511_probe(struct i2c_client *i2c)
INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work);
- if (i2c->irq) {
- init_waitqueue_head(&adv7511->wq);
-
- ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
- adv7511_irq_handler,
- IRQF_ONESHOT, dev_name(dev),
- adv7511);
- if (ret)
- goto err_unregister_cec;
- }
-
adv7511_power_off(adv7511);
i2c_set_clientdata(i2c, adv7511);
@@ -1325,6 +1314,17 @@ static int adv7511_probe(struct i2c_client *i2c)
adv7511_audio_init(dev, adv7511);
+ if (i2c->irq) {
+ init_waitqueue_head(&adv7511->wq);
+
+ ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
+ adv7511_irq_handler,
+ IRQF_ONESHOT, dev_name(dev),
+ adv7511);
+ if (ret)
+ goto err_unregister_audio;
+ }
+
if (adv7511->type == ADV7533 || adv7511->type == ADV7535) {
ret = adv7533_attach_dsi(adv7511);
if (ret)
---
base-commit: a48e2cc92835fa1d9b373b804b2173c779387b8e
change-id: 20231014-adv7511-cec-irq-crash-fix-6fdd9093dc7a
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/bridge: adv7511: fix crash on irq during probe
2023-10-14 18:46 [PATCH] drm/bridge: adv7511: fix crash on irq during probe Alvin Šipraga
@ 2023-10-16 8:14 ` Laurent Pinchart
2023-10-16 8:42 ` Alvin Šipraga
0 siblings, 1 reply; 4+ messages in thread
From: Laurent Pinchart @ 2023-10-16 8:14 UTC (permalink / raw)
To: Alvin Šipraga
Cc: Andrzej Hajda, Neil Armstrong, Robert Foss, Jonas Karlman,
Jernej Skrabec, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Archit Taneja,
Hans Verkuil, dri-devel, linux-kernel, Mads Bligaard Nielsen,
Alvin Šipraga
Hello Alvin,
On Sat, Oct 14, 2023 at 08:46:12PM +0200, Alvin Šipraga wrote:
> From: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
>
> Moved IRQ registration down to end of adv7511_probe().
>
> If an IRQ already is pending during adv7511_probe
> (before adv7511_cec_init) then cec_received_msg_ts
> could crash using uninitialized data:
>
> Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5
> Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP
> Call trace:
> cec_received_msg_ts+0x48/0x990 [cec]
> adv7511_cec_irq_process+0x1cc/0x308 [adv7511]
> adv7511_irq_process+0xd8/0x120 [adv7511]
> adv7511_irq_handler+0x1c/0x30 [adv7511]
> irq_thread_fn+0x30/0xa0
> irq_thread+0x14c/0x238
> kthread+0x190/0x1a8
>
> Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
Isn't the issue older than that ?
> Signed-off-by: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
> Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
With the Fixes: tag updated,
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> ---
> drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 22 +++++++++++-----------
> 1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> index d518de88b5c3..71022cb8abe4 100644
> --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
> @@ -1291,17 +1291,6 @@ static int adv7511_probe(struct i2c_client *i2c)
>
> INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work);
>
> - if (i2c->irq) {
> - init_waitqueue_head(&adv7511->wq);
> -
> - ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
> - adv7511_irq_handler,
> - IRQF_ONESHOT, dev_name(dev),
> - adv7511);
> - if (ret)
> - goto err_unregister_cec;
> - }
> -
> adv7511_power_off(adv7511);
>
> i2c_set_clientdata(i2c, adv7511);
> @@ -1325,6 +1314,17 @@ static int adv7511_probe(struct i2c_client *i2c)
>
> adv7511_audio_init(dev, adv7511);
>
> + if (i2c->irq) {
> + init_waitqueue_head(&adv7511->wq);
> +
> + ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
> + adv7511_irq_handler,
> + IRQF_ONESHOT, dev_name(dev),
> + adv7511);
> + if (ret)
> + goto err_unregister_audio;
> + }
> +
> if (adv7511->type == ADV7533 || adv7511->type == ADV7535) {
> ret = adv7533_attach_dsi(adv7511);
> if (ret)
>
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/bridge: adv7511: fix crash on irq during probe
2023-10-16 8:14 ` Laurent Pinchart
@ 2023-10-16 8:42 ` Alvin Šipraga
2023-11-24 13:33 ` Alvin Šipraga
0 siblings, 1 reply; 4+ messages in thread
From: Alvin Šipraga @ 2023-10-16 8:42 UTC (permalink / raw)
To: Laurent Pinchart
Cc: Andrzej Hajda, Neil Armstrong, Robert Foss, Jonas Karlman,
Jernej Skrabec, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Archit Taneja,
Hans Verkuil, dri-devel, linux-kernel, Mads Bligaard Nielsen,
Alvin Šipraga
Hi Laurent,
Thanks for the quick review!
On Mon, Oct 16, 2023 at 11:14:44AM +0300, Laurent Pinchart wrote:
> Hello Alvin,
>
> On Sat, Oct 14, 2023 at 08:46:12PM +0200, Alvin Šipraga wrote:
> > From: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
> >
> > Moved IRQ registration down to end of adv7511_probe().
> >
> > If an IRQ already is pending during adv7511_probe
> > (before adv7511_cec_init) then cec_received_msg_ts
> > could crash using uninitialized data:
> >
> > Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5
> > Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP
> > Call trace:
> > cec_received_msg_ts+0x48/0x990 [cec]
> > adv7511_cec_irq_process+0x1cc/0x308 [adv7511]
> > adv7511_irq_process+0xd8/0x120 [adv7511]
> > adv7511_irq_handler+0x1c/0x30 [adv7511]
> > irq_thread_fn+0x30/0xa0
> > irq_thread+0x14c/0x238
> > kthread+0x190/0x1a8
> >
> > Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
>
> Isn't the issue older than that ?
I don't think so. The stacktrace shows the crash is in CEC handling code, which
was added in the blamed commit. A static analysis of adv7511_irq_process()
suggests that the only other place where data could be uninitialized is if the
hpd_work is scheduled:
if (process_hpd && irq0 & ADV7511_INT0_HPD && adv7511->bridge.encoder)
schedule_work(&adv7511->hpd_work);
... but this has a check on bridge.encoder, which seems to have been introduced
in a similar fix here:
| commit a1d0503d26ea2ef04f3f013d379e8f4d29c27127
| Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
| Date: Thu May 14 00:31:07 2015 +0300
|
| drm: adv7511: Fix crash in IRQ handler when no encoder is associated
|
| The ADV7511 is probed before its slave encoder init function associates
| it with an encoder. This creates a time window during which hot plug
| detection interrupts can occur with an encoder, resulting in a crash in
| the IRQ handler.
|
| Fix this by ignoring hot plug detection IRQs when no encoder is
| associated yet.
|
| Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
| Acked-by: Lars-Peter Clausen <lars@metafoo.de>
|
| diff --git a/drivers/gpu/drm/i2c/adv7511.c b/drivers/gpu/drm/i2c/adv7511.c
| index b728523e194f..2aaa3c88999e 100644
| --- a/drivers/gpu/drm/i2c/adv7511.c
| +++ b/drivers/gpu/drm/i2c/adv7511.c
| @@ -438,7 +438,7 @@ static int adv7511_irq_process(struct adv7511 *adv7511)
| regmap_write(adv7511->regmap, ADV7511_REG_INT(0), irq0);
| regmap_write(adv7511->regmap, ADV7511_REG_INT(1), irq1);
|
| - if (irq0 & ADV7511_INT0_HDP)
| + if (irq0 & ADV7511_INT0_HDP && adv7511->encoder)
| drm_helper_hpd_irq_event(adv7511->encoder->dev);
|
| if (irq0 & ADV7511_INT0_EDID_READY || irq1 & ADV7511_INT1_DDC_ERROR) {
So assuming that is the case, I am not sure which Fixes: tag I ought to
otherwise use. What do you think?
>
> > Signed-off-by: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
> > Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
>
> With the Fixes: tag updated,
>
> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Kind regards,
Alvin
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/bridge: adv7511: fix crash on irq during probe
2023-10-16 8:42 ` Alvin Šipraga
@ 2023-11-24 13:33 ` Alvin Šipraga
0 siblings, 0 replies; 4+ messages in thread
From: Alvin Šipraga @ 2023-11-24 13:33 UTC (permalink / raw)
To: Laurent Pinchart
Cc: Andrzej Hajda, Neil Armstrong, Robert Foss, Jonas Karlman,
Jernej Skrabec, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Daniel Vetter, Archit Taneja,
Hans Verkuil, dri-devel, linux-kernel, Mads Bligaard Nielsen
Hi Laurent,
This is a friendly ping to get your feedback on my reply below. I don't think
the Fixes tag is incorrect here. Please could you take another look and let me
know if I can resend with your Reviewed-by?
Kind regards,
Alvin
On Mon, Oct 16, 2023 at 10:42:27AM +0200, Alvin Šipraga wrote:
> Hi Laurent,
>
> Thanks for the quick review!
>
> On Mon, Oct 16, 2023 at 11:14:44AM +0300, Laurent Pinchart wrote:
> > Hello Alvin,
> >
> > On Sat, Oct 14, 2023 at 08:46:12PM +0200, Alvin Šipraga wrote:
> > > From: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
> > >
> > > Moved IRQ registration down to end of adv7511_probe().
> > >
> > > If an IRQ already is pending during adv7511_probe
> > > (before adv7511_cec_init) then cec_received_msg_ts
> > > could crash using uninitialized data:
> > >
> > > Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5
> > > Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP
> > > Call trace:
> > > cec_received_msg_ts+0x48/0x990 [cec]
> > > adv7511_cec_irq_process+0x1cc/0x308 [adv7511]
> > > adv7511_irq_process+0xd8/0x120 [adv7511]
> > > adv7511_irq_handler+0x1c/0x30 [adv7511]
> > > irq_thread_fn+0x30/0xa0
> > > irq_thread+0x14c/0x238
> > > kthread+0x190/0x1a8
> > >
> > > Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
> >
> > Isn't the issue older than that ?
>
> I don't think so. The stacktrace shows the crash is in CEC handling code, which
> was added in the blamed commit. A static analysis of adv7511_irq_process()
> suggests that the only other place where data could be uninitialized is if the
> hpd_work is scheduled:
>
> if (process_hpd && irq0 & ADV7511_INT0_HPD && adv7511->bridge.encoder)
> schedule_work(&adv7511->hpd_work);
>
> ... but this has a check on bridge.encoder, which seems to have been introduced
> in a similar fix here:
>
> | commit a1d0503d26ea2ef04f3f013d379e8f4d29c27127
> | Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> | Date: Thu May 14 00:31:07 2015 +0300
> |
> | drm: adv7511: Fix crash in IRQ handler when no encoder is associated
> |
> | The ADV7511 is probed before its slave encoder init function associates
> | it with an encoder. This creates a time window during which hot plug
> | detection interrupts can occur with an encoder, resulting in a crash in
> | the IRQ handler.
> |
> | Fix this by ignoring hot plug detection IRQs when no encoder is
> | associated yet.
> |
> | Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> | Acked-by: Lars-Peter Clausen <lars@metafoo.de>
> |
> | diff --git a/drivers/gpu/drm/i2c/adv7511.c b/drivers/gpu/drm/i2c/adv7511.c
> | index b728523e194f..2aaa3c88999e 100644
> | --- a/drivers/gpu/drm/i2c/adv7511.c
> | +++ b/drivers/gpu/drm/i2c/adv7511.c
> | @@ -438,7 +438,7 @@ static int adv7511_irq_process(struct adv7511 *adv7511)
> | regmap_write(adv7511->regmap, ADV7511_REG_INT(0), irq0);
> | regmap_write(adv7511->regmap, ADV7511_REG_INT(1), irq1);
> |
> | - if (irq0 & ADV7511_INT0_HDP)
> | + if (irq0 & ADV7511_INT0_HDP && adv7511->encoder)
> | drm_helper_hpd_irq_event(adv7511->encoder->dev);
> |
> | if (irq0 & ADV7511_INT0_EDID_READY || irq1 & ADV7511_INT1_DDC_ERROR) {
>
> So assuming that is the case, I am not sure which Fixes: tag I ought to
> otherwise use. What do you think?
>
> >
> > > Signed-off-by: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
> > > Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
> >
> > With the Fixes: tag updated,
> >
> > Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
>
> Kind regards,
> Alvin
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-11-24 13:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-14 18:46 [PATCH] drm/bridge: adv7511: fix crash on irq during probe Alvin Šipraga
2023-10-16 8:14 ` Laurent Pinchart
2023-10-16 8:42 ` Alvin Šipraga
2023-11-24 13:33 ` Alvin Šipraga
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).