d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bc346eefbd
freebsd-nq/sys/dev/drm2
History
Jean-Sébastien Pédron bc346eefbd drm: Import Linux commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 
Author: Huacai Chen <chenhc@lemote.com>
Date:   Tue May 21 06:23:43 2013 +0000

    drm: fix a use-after-free when GPU acceleration disabled

    When GPU acceleration is disabled, drm_vblank_cleanup() will free the
    vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
    But we found that drm_vblank_post_modeset() may be called after the
    cleanup, which use vblank_refcount and vblank_inmodeset. And this will
    cause a kernel panic.

    Fix this by return immediately if dev->num_crtcs is zero. This is the
    same thing that drm_vblank_pre_modeset() does.

    Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
    [   62.628906] [<ffffffff804868d0>] drm_vblank_post_modeset+0x34/0xb4
    [   62.628906] [<ffffffff804c7008>] atombios_crtc_dpms+0xb4/0x174
    [   62.628906] [<ffffffff804c70e0>] atombios_crtc_commit+0x18/0x38
    [   62.628906] [<ffffffff8047f038>] drm_crtc_helper_set_mode+0x304/0x3cc
    [   62.628906] [<ffffffff8047f92c>] drm_crtc_helper_set_config+0x6d8/0x988
    [   62.628906] [<ffffffff8047dd40>] drm_fb_helper_set_par+0x94/0x104
    [   62.628906] [<ffffffff80439d14>] fbcon_init+0x424/0x57c
    [   62.628906] [<ffffffff8046a638>] visual_init+0xb8/0x118
    [   62.628906] [<ffffffff8046b9f8>] take_over_console+0x238/0x384
    [   62.628906] [<ffffffff80436df8>] fbcon_takeover+0x7c/0xdc
    [   62.628906] [<ffffffff8024fa20>] notifier_call_chain+0x44/0x94
    [   62.628906] [<ffffffff8024fcbc>] __blocking_notifier_call_chain+0x48/0x68
    [   62.628906] [<ffffffff8042d990>] register_framebuffer+0x228/0x260
    [   62.628906] [<ffffffff8047e010>] drm_fb_helper_single_fb_probe+0x260/0x314
    [   62.628906] [<ffffffff8047e2c4>] drm_fb_helper_initial_config+0x200/0x234
    [   62.628906] [<ffffffff804e5560>] radeon_fbdev_init+0xd4/0xf4
    [   62.628906] [<ffffffff804e0e08>] radeon_modeset_init+0x9bc/0xa18
    [   62.628906] [<ffffffff804bfc14>] radeon_driver_load_kms+0xdc/0x12c
    [   62.628906] [<ffffffff8048b548>] drm_get_pci_dev+0x148/0x238
    [   62.628906] [<ffffffff80423564>] local_pci_probe+0x5c/0xd0
    [   62.628906] [<ffffffff80241ac4>] work_for_cpu_fn+0x1c/0x30
    [   62.628906] [<ffffffff802427c8>] process_one_work+0x274/0x3bc
    [   62.628906] [<ffffffff80242934>] process_scheduled_works+0x24/0x44
    [   62.628906] [<ffffffff8024515c>] worker_thread+0x31c/0x3f4
    [   62.628906] [<ffffffff802497a8>] kthread+0x88/0x90
    [   62.628906] [<ffffffff80206794>] kernel_thread_helper+0x10/0x18

    Signed-off-by: Huacai Chen <chenhc@lemote.com>
    Signed-off-by: Binbin Zhou <zhoubb@lemote.com>
    Cc: <stable@vger.kernel.org>
    Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
    Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
    Signed-off-by: Dave Airlie <airlied@gmail.com>

Reported by:	J.R. Oldroyd <fbsd@opal.com>
MFC after:	2 weeks
2015-03-04 20:43:46 +00:00
..
i915 Remove duplicate intel_fbc_enabled prototype 2015-02-03 15:41:09 +00:00
radeon vt(4): Add support to "downgrade" from eg. vt_fb to vt_vga 2015-03-01 12:54:22 +00:00
ttm If the vm_page_alloc_contig() failed in the ttm page allocators, do 2015-02-03 13:45:06 +00:00
ati_pcigart.c drm/radeon: Import the Radeon KMS driver 2013-08-25 19:37:15 +00:00
drm_agpsupport.c Port the TTM AGP backend to the FreeBSD agp driver and enable AGP support 2014-10-30 14:26:36 +00:00
drm_atomic.h Fix the incomplete conversion from atomic_t to long for test_bit(). 2013-08-29 20:51:12 +00:00
drm_auth.c
drm_buffer.c drm: Import drm_buffer.[ch] from Linux 3.8-rc3 2013-08-24 16:14:20 +00:00
drm_buffer.h drm: Import drm_buffer.[ch] from Linux 3.8-rc3 2013-08-24 16:14:20 +00:00
drm_bufs.c
drm_context.c Fix atomic operations on context_flag without altering semantics. 2013-08-29 18:36:47 +00:00
drm_core.h drm: Call drm_global_init() & drm_global_release() at module load/unload 2013-08-24 15:47:15 +00:00
drm_crtc_helper.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_crtc_helper.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_crtc.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_crtc.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_dma.c
drm_dp_helper.c drm: Import drm_dp_helper.c from Linux 3.8-rc3 2013-08-24 23:38:57 +00:00
drm_dp_helper.h drm: Import drm_dp_helper.c from Linux 3.8-rc3 2013-08-24 23:38:57 +00:00
drm_dp_iic_helper.c Revert r268543. 2014-07-12 06:23:42 +00:00
drm_drawable.c
drm_drv.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_edid_modes.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_edid.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_edid.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_fb_helper.c vt(4): Add support to "downgrade" from eg. vt_fb to vt_vga 2015-03-01 12:54:22 +00:00
drm_fb_helper.h drm: Take vt(4) default mode from loader tunables 2014-11-03 10:42:27 +00:00
drm_fixed.h drm: Import drm_fixed.h from Linux 3.8 2013-08-25 12:27:15 +00:00
drm_fops.c
drm_fourcc.h
drm_gem_names.c drm/i915: Add HW context support 2014-09-17 08:28:50 +00:00
drm_gem_names.h drm/i915: Add HW context support 2014-09-17 08:28:50 +00:00
drm_gem.c drm: Use the new drm_atomic.h, following the merge of projects/atomic64 2013-08-25 15:38:16 +00:00
drm_global.c
drm_global.h
drm_hashtab.c
drm_hashtab.h
drm_internal.h
drm_ioc32.c
drm_ioctl.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_irq.c drm: Import Linux commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 2015-03-04 20:43:46 +00:00
drm_linux_list_sort.c drm: Fix build with gcc, broken with r258549 2013-11-25 15:01:59 +00:00
drm_linux_list.h drm: Import list_for_each_entry_safe_from() macro 2013-08-25 10:28:02 +00:00
drm_lock.c
drm_memory.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_mm.c
drm_mm.h
drm_mode.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_modes.c
drm_os_freebsd.h Merge VT(9) project (a.k.a. newcons). 2013-12-05 22:38:53 +00:00
drm_pci.c Add missing calls to bus_dmamap_unload() when freeing static DMA 2014-06-13 18:20:44 +00:00
drm_pciids.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_sarea.h Remove ia64. 2014-07-07 00:27:09 +00:00
drm_scatter.c
drm_sman.c
drm_sman.h
drm_stub.c An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drm_sysctl.c Adjust printf format specifiers for dev_t and ino_t in kernel. 2014-12-17 07:27:19 +00:00
drm_vm.c
drm.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00
drmP.h An update for the i915 GPU driver, which brings the code up to Linux 2015-01-21 16:10:37 +00:00