drm: Two fixes for the 'Provide client setup helper and convert drivers' patchset

[PATCH 0/2] drm: Two fixes for the 'Provide client setup helper and convert drivers' patchset

Posted by Marek Szyprowski 1 month, 3 weeks ago

Dear All,

Yesterday the "drm: Provide client setup helper and convert drivers"
patchset [1] landed in linux-next. In my tests I found that it causes kernel
NULL pointer dereference on ARM/ARM64 based Raspberry Pi4B boards. It
turned out that the conversion of the VC4 DRM driver is a bit incomplete,
so I've decided to provide the needed fix. While developping it I've
found that a small fix to generic drm/fbdev-helper helps to avoid NULL
pointer dereference in the future in case of similar problems.

Those patches fixes the following problem observed on Raspberry Pi4B
boards:

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write
[00000020] *pgd=00000000
Internal error: Oops: 805 [#1] SMP ARM
Modules linked in: aes_arm aes_generic cmac brcmfmac_wcc brcmfmac brcmutil sha256_generic libsha256 sha256_arm cfg80211 hci_uart btbcm crc32_arm_ce raspberrypi_hwmon bluetooth ecdh_generic vc4 ecc libaes snd_soc_hdmi_codec snd_soc_core ac97_bus snd_pcm_dmaengine snd_pcm v3d bcm2711_thermal snd_timer genet drm_shmem_helper snd gpu_sched soundcore drm_dma_helper
CPU: 1 UID: 0 PID: 21 Comm: kworker/1:0 Not tainted 6.12.0-rc1-next-20241002 #15363
Hardware name: BCM2711
Workqueue: events output_poll_execute
PC is at __drm_fb_helper_initial_config_and_unlock+0x30c/0x518
LR is at __drm_fb_helper_initial_config_and_unlock+0x26c/0x518
pc : [<c0aec770>]    lr : [<c0aec6d0>]    psr: 60000013
...
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5383d  Table: 04ef006a  DAC: 00000051
...
Register r12 information: slab task_struct start c213c400 pointer offset 0 size 2176
Process kworker/1:0 (pid: 21, stack limit = 0x98a73703)
Stack: (0xf0879e28 to 0xf087a000)
...
Call trace: 
 __drm_fb_helper_initial_config_and_unlock from drm_client_dev_hotplug+0xac/0x104
 drm_client_dev_hotplug from output_poll_execute+0x298/0x2a0
 output_poll_execute from process_one_work+0x178/0x3c0
 process_one_work from worker_thread+0x270/0x42c
 worker_thread from kthread+0xe0/0xfc
 kthread from ret_from_fork+0x14/0x28
Exception stack(0xf0879fb0 to 0xf0879ff8)
9fa0:                                     00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
Code: e30a3724 e5942038 e34c3186 e8b30003 (e5820020) 
---[ end trace 0000000000000000 ]---

[1] https://patchwork.freedesktop.org/series/137389/

Best regards
Marek Szyprowski, PhD
Samsung R&D Institute Poland


Patch summary:

Marek Szyprowski (2):
  drm/fbdev-helper: fail if driver provides no fbdev/fb probe functions
  drm/vc4: Provides DRM_FBDEV_DMA_DRIVER_OPS also for vc5_drm_driver

 drivers/gpu/drm/drm_fb_helper.c | 3 +++
 drivers/gpu/drm/vc4/vc4_drv.c   | 1 +
 2 files changed, 4 insertions(+)

-- 
2.34.1

Re: [PATCH 0/2] drm: Two fixes for the 'Provide client setup helper and convert drivers' patchset

Posted by Dave Stevenson 1 month, 3 weeks ago

Hi Marek

On Thu, 3 Oct 2024 at 10:29, Marek Szyprowski <m.szyprowski@samsung.com> wrote:
>
> Dear All,
>
> Yesterday the "drm: Provide client setup helper and convert drivers"
> patchset [1] landed in linux-next. In my tests I found that it causes kernel
> NULL pointer dereference on ARM/ARM64 based Raspberry Pi4B boards. It
> turned out that the conversion of the VC4 DRM driver is a bit incomplete,
> so I've decided to provide the needed fix. While developping it I've
> found that a small fix to generic drm/fbdev-helper helps to avoid NULL
> pointer dereference in the future in case of similar problems.

This duplicates the patches I sent yesterday -
https://lists.freedesktop.org/archives/dri-devel/2024-October/472428.html

I chose EINVAL instead of ENODEV for the return value if neither probe
function was defined - I don't know which is better/preferred.

  Dave

> Those patches fixes the following problem observed on Raspberry Pi4B
> boards:
>
> 8<--- cut here ---
> Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write
> [00000020] *pgd=00000000
> Internal error: Oops: 805 [#1] SMP ARM
> Modules linked in: aes_arm aes_generic cmac brcmfmac_wcc brcmfmac brcmutil sha256_generic libsha256 sha256_arm cfg80211 hci_uart btbcm crc32_arm_ce raspberrypi_hwmon bluetooth ecdh_generic vc4 ecc libaes snd_soc_hdmi_codec snd_soc_core ac97_bus snd_pcm_dmaengine snd_pcm v3d bcm2711_thermal snd_timer genet drm_shmem_helper snd gpu_sched soundcore drm_dma_helper
> CPU: 1 UID: 0 PID: 21 Comm: kworker/1:0 Not tainted 6.12.0-rc1-next-20241002 #15363
> Hardware name: BCM2711
> Workqueue: events output_poll_execute
> PC is at __drm_fb_helper_initial_config_and_unlock+0x30c/0x518
> LR is at __drm_fb_helper_initial_config_and_unlock+0x26c/0x518
> pc : [<c0aec770>]    lr : [<c0aec6d0>]    psr: 60000013
> ...
> Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
> Control: 10c5383d  Table: 04ef006a  DAC: 00000051
> ...
> Register r12 information: slab task_struct start c213c400 pointer offset 0 size 2176
> Process kworker/1:0 (pid: 21, stack limit = 0x98a73703)
> Stack: (0xf0879e28 to 0xf087a000)
> ...
> Call trace:
>  __drm_fb_helper_initial_config_and_unlock from drm_client_dev_hotplug+0xac/0x104
>  drm_client_dev_hotplug from output_poll_execute+0x298/0x2a0
>  output_poll_execute from process_one_work+0x178/0x3c0
>  process_one_work from worker_thread+0x270/0x42c
>  worker_thread from kthread+0xe0/0xfc
>  kthread from ret_from_fork+0x14/0x28
> Exception stack(0xf0879fb0 to 0xf0879ff8)
> 9fa0:                                     00000000 00000000 00000000 00000000
> 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
> Code: e30a3724 e5942038 e34c3186 e8b30003 (e5820020)
> ---[ end trace 0000000000000000 ]---
>
> [1] https://patchwork.freedesktop.org/series/137389/
>
> Best regards
> Marek Szyprowski, PhD
> Samsung R&D Institute Poland
>
>
> Patch summary:
>
> Marek Szyprowski (2):
>   drm/fbdev-helper: fail if driver provides no fbdev/fb probe functions
>   drm/vc4: Provides DRM_FBDEV_DMA_DRIVER_OPS also for vc5_drm_driver
>
>  drivers/gpu/drm/drm_fb_helper.c | 3 +++
>  drivers/gpu/drm/vc4/vc4_drv.c   | 1 +
>  2 files changed, 4 insertions(+)
>
> --
> 2.34.1
>