Jean-Sébastien Pédron bc346eefbd drm: Import Linux commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 ... Author: Huacai Chen <chenhc@lemote.com> Date: Tue May 21 06:23:43 2013 +0000 drm: fix a use-after-free when GPU acceleration disabled When GPU acceleration is disabled, drm_vblank_cleanup() will free the vblank-related data, such as vblank_refcount, vblank_inmodeset, etc. But we found that drm_vblank_post_modeset() may be called after the cleanup, which use vblank_refcount and vblank_inmodeset. And this will cause a kernel panic. Fix this by return immediately if dev->num_crtcs is zero. This is the same thing that drm_vblank_pre_modeset() does. Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup(): [ 62.628906] [<ffffffff804868d0>] drm_vblank_post_modeset+0x34/0xb4 [ 62.628906] [<ffffffff804c7008>] atombios_crtc_dpms+0xb4/0x174 [ 62.628906] [<ffffffff804c70e0>] atombios_crtc_commit+0x18/0x38 [ 62.628906] [<ffffffff8047f038>] drm_crtc_helper_set_mode+0x304/0x3cc [ 62.628906] [<ffffffff8047f92c>] drm_crtc_helper_set_config+0x6d8/0x988 [ 62.628906] [<ffffffff8047dd40>] drm_fb_helper_set_par+0x94/0x104 [ 62.628906] [<ffffffff80439d14>] fbcon_init+0x424/0x57c [ 62.628906] [<ffffffff8046a638>] visual_init+0xb8/0x118 [ 62.628906] [<ffffffff8046b9f8>] take_over_console+0x238/0x384 [ 62.628906] [<ffffffff80436df8>] fbcon_takeover+0x7c/0xdc [ 62.628906] [<ffffffff8024fa20>] notifier_call_chain+0x44/0x94 [ 62.628906] [<ffffffff8024fcbc>] __blocking_notifier_call_chain+0x48/0x68 [ 62.628906] [<ffffffff8042d990>] register_framebuffer+0x228/0x260 [ 62.628906] [<ffffffff8047e010>] drm_fb_helper_single_fb_probe+0x260/0x314 [ 62.628906] [<ffffffff8047e2c4>] drm_fb_helper_initial_config+0x200/0x234 [ 62.628906] [<ffffffff804e5560>] radeon_fbdev_init+0xd4/0xf4 [ 62.628906] [<ffffffff804e0e08>] radeon_modeset_init+0x9bc/0xa18 [ 62.628906] [<ffffffff804bfc14>] radeon_driver_load_kms+0xdc/0x12c [ 62.628906] [<ffffffff8048b548>] drm_get_pci_dev+0x148/0x238 [ 62.628906] [<ffffffff80423564>] local_pci_probe+0x5c/0xd0 [ 62.628906] [<ffffffff80241ac4>] work_for_cpu_fn+0x1c/0x30 [ 62.628906] [<ffffffff802427c8>] process_one_work+0x274/0x3bc [ 62.628906] [<ffffffff80242934>] process_scheduled_works+0x24/0x44 [ 62.628906] [<ffffffff8024515c>] worker_thread+0x31c/0x3f4 [ 62.628906] [<ffffffff802497a8>] kthread+0x88/0x90 [ 62.628906] [<ffffffff80206794>] kernel_thread_helper+0x10/0x18 Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Binbin Zhou <zhoubb@lemote.com> Cc: <stable@vger.kernel.org> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com> Acked-by: Paul Menzel <paulepanter@users.sourceforge.net> Signed-off-by: Dave Airlie <airlied@gmail.com> Reported by: J.R. Oldroyd <fbsd@opal.com> MFC after: 2 weeks		2015-03-04 20:43:46 +00:00
..
i915	Remove duplicate intel_fbc_enabled prototype	2015-02-03 15:41:09 +00:00
radeon	vt(4): Add support to "downgrade" from eg. vt_fb to vt_vga	2015-03-01 12:54:22 +00:00
ttm	If the vm_page_alloc_contig() failed in the ttm page allocators, do	2015-02-03 13:45:06 +00:00
ati_pcigart.c
drm_agpsupport.c	Port the TTM AGP backend to the FreeBSD agp driver and enable AGP support	2014-10-30 14:26:36 +00:00
drm_atomic.h
drm_auth.c
drm_buffer.c
drm_buffer.h
drm_bufs.c
drm_context.c
drm_core.h
drm_crtc_helper.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_crtc_helper.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_crtc.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_crtc.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_dma.c
drm_dp_helper.c
drm_dp_helper.h
drm_dp_iic_helper.c	Revert r268543.	2014-07-12 06:23:42 +00:00
drm_drawable.c
drm_drv.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_edid_modes.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_edid.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_edid.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_fb_helper.c	vt(4): Add support to "downgrade" from eg. vt_fb to vt_vga	2015-03-01 12:54:22 +00:00
drm_fb_helper.h	drm: Take vt(4) default mode from loader tunables	2014-11-03 10:42:27 +00:00
drm_fixed.h
drm_fops.c
drm_fourcc.h
drm_gem_names.c	drm/i915: Add HW context support	2014-09-17 08:28:50 +00:00
drm_gem_names.h	drm/i915: Add HW context support	2014-09-17 08:28:50 +00:00
drm_gem.c
drm_global.c
drm_global.h
drm_hashtab.c
drm_hashtab.h
drm_internal.h
drm_ioc32.c
drm_ioctl.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_irq.c	drm: Import Linux commit b7ea85a4fed37835eec78a7be3039c8dc22b8178	2015-03-04 20:43:46 +00:00
drm_linux_list_sort.c	drm: Fix build with gcc, broken with r258549	2013-11-25 15:01:59 +00:00
drm_linux_list.h
drm_lock.c
drm_memory.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_mm.c
drm_mm.h
drm_mode.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_modes.c
drm_os_freebsd.h	Merge VT(9) project (a.k.a. newcons).	2013-12-05 22:38:53 +00:00
drm_pci.c	Add missing calls to bus_dmamap_unload() when freeing static DMA	2014-06-13 18:20:44 +00:00
drm_pciids.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_sarea.h	Remove ia64.	2014-07-07 00:27:09 +00:00
drm_scatter.c
drm_sman.c
drm_sman.h
drm_stub.c	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drm_sysctl.c	Adjust printf format specifiers for dev_t and ino_t in kernel.	2014-12-17 07:27:19 +00:00
drm_vm.c
drm.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00
drmP.h	An update for the i915 GPU driver, which brings the code up to Linux	2015-01-21 16:10:37 +00:00