Thomas Zimmermann
fb84efa28a
drm/aperture: Run fbdev removal before internal helpers
Always run fbdev removal first to remove simpledrm via
sysfb_disable(). This clears the internal state. The later call
to drm_aperture_detach_drivers() then does nothing. Otherwise,
with drm_aperture_detach_drivers() running first, the call to
sysfb_disable() uses inconsistent state.
Example backtrace show below:
[ 11.663422] ==================================================================
[ 11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0
[ 11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
[ 11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G E 5
.19.0-rc2-1-default+ #1689
[ 11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
[ 11.663447] Call Trace:
[ 11.663449] <TASK>
[ 11.663451] ? device_del+0x79/0x5f0
[ 11.663456] dump_stack_lvl+0x5b/0x73
[ 11.663462] print_address_description.constprop.0+0x1f/0x1b0
[ 11.663468] ? device_del+0x79/0x5f0
[ 11.663471] ? device_del+0x79/0x5f0
[ 11.663475] print_report.cold+0x3c/0x21c
[ 11.663481] ? lock_acquired+0x87/0x1e0
[ 11.663484] ? lock_acquired+0x87/0x1e0
[ 11.663489] ? device_del+0x79/0x5f0
[ 11.663492] kasan_report+0xbf/0xf0
[ 11.663498] ? device_del+0x79/0x5f0
[ 11.663503] device_del+0x79/0x5f0
[ 11.663509] ? device_remove_attrs+0x170/0x170
[ 11.663514] ? lock_is_held_type+0xe8/0x140
[ 11.663523] platform_device_del.part.0+0x19/0xe0
[ 11.663530] platform_device_unregister+0x1c/0x30
[ 11.663535] sysfb_disable+0x2d/0x70
[ 11.663540] remove_conflicting_framebuffers+0x1c/0xf0
[ 11.663546] remove_conflicting_pci_framebuffers+0x130/0x1a0
[ 11.663554] drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
[ 11.663561] ? mgag200_pci_remove+0x30/0x30 [mgag200]
[ 11.663578] mgag200_pci_probe+0x2d/0x140 [mgag200]
Reported-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Fixes: 873eb3b118 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Zhen Lei <thunder.leizhen@huawei.com>
Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de
2022-06-21 12:54:34 +02:00
..
2022-05-20 21:07:05 +02:00
2022-05-30 11:37:26 -07:00
2022-06-03 11:48:47 -07:00
2022-06-05 17:14:03 -07:00
2022-06-09 09:25:25 +09:00
2022-06-03 15:46:03 -07:00
2022-06-04 13:42:53 -07:00
2022-05-13 13:19:01 +02:00
2022-06-03 11:48:47 -07:00
2022-05-15 18:31:28 -06:00
2022-06-12 10:33:38 -07:00
2022-06-03 11:48:47 -07:00
2022-06-05 10:47:06 -07:00
2022-05-19 18:54:45 +02:00
2022-06-02 15:23:54 -07:00
2022-05-23 19:18:51 +02:00
2022-05-31 12:45:09 -04:00
2022-05-20 12:30:53 -07:00
2022-05-16 13:37:59 -07:00
2022-05-19 19:32:19 +02:00
2022-05-19 18:56:51 +02:00
2022-05-29 11:38:27 -07:00
2022-06-20 18:21:25 +02:00
2022-05-23 19:32:59 -07:00
2022-05-13 17:03:41 +09:00
2022-05-23 07:48:27 +02:00
2022-06-20 18:21:25 +02:00
2022-06-10 14:26:15 +02:00
2022-06-21 12:54:34 +02:00
2022-06-03 11:17:49 -07:00
2022-05-20 15:54:41 +02:00
2022-06-03 11:48:47 -07:00
2022-05-22 12:25:55 -07:00
2022-06-02 08:40:56 -07:00
2022-05-17 22:34:42 +02:00
2022-06-08 18:05:45 +02:00
2022-06-04 14:04:27 -07:00
2022-05-26 21:08:40 -07:00
2022-06-07 15:00:29 -07:00
2022-06-03 11:36:34 -07:00
2022-05-31 09:56:54 -07:00
2022-06-03 06:52:57 -07:00
2022-06-02 15:23:54 -07:00
2022-05-22 15:58:30 +10:00
2022-05-24 08:08:24 -05:00
2022-06-10 15:23:54 -04:00
2022-06-03 11:17:49 -07:00
2022-05-30 11:37:26 -07:00
2022-06-02 15:23:54 -07:00
2022-06-03 11:36:34 -07:00
2022-06-07 14:24:30 -07:00
2022-06-03 14:42:24 -07:00
2022-06-09 22:05:37 -07:00
2022-06-08 10:18:10 -07:00
2022-05-27 21:24:19 -07:00
2022-06-05 09:25:12 -07:00
2022-05-25 16:18:27 -07:00
2022-05-25 15:02:26 +02:00
2022-06-03 11:48:47 -07:00
2022-06-02 15:23:54 -07:00
2022-05-23 21:06:11 -07:00
2022-05-19 16:56:17 +02:00
2022-05-28 11:15:54 -07:00
2022-06-12 11:33:42 -07:00
2022-06-03 11:36:34 -07:00
2022-05-23 19:18:51 +02:00
2022-05-25 21:51:32 -07:00
2022-05-20 16:40:01 +02:00
2022-05-25 14:38:29 +02:00
2022-06-03 11:48:47 -07:00
2022-06-02 15:23:54 -07:00
2022-06-03 11:48:47 -07:00
2022-06-07 22:05:14 -04:00
2022-06-03 11:48:47 -07:00
2022-06-03 11:36:34 -07:00
2022-06-03 11:48:47 -07:00
2022-06-03 11:36:34 -07:00
2022-05-28 06:15:27 -06:00
2022-05-30 14:44:27 +02:00
2022-05-30 11:34:13 -07:00
2022-06-03 11:17:49 -07:00
2022-06-04 13:42:53 -07:00
2022-06-05 09:25:12 -07:00
2022-06-03 11:36:34 -07:00
2022-06-08 08:56:03 -04:00
2022-06-01 13:49:15 -07:00
2022-06-09 00:26:35 -04:00
2022-06-20 18:21:25 +02:00
2022-06-03 11:36:34 -07:00
2022-06-11 16:32:47 -07:00
2022-06-02 15:27:44 -07:00
2022-06-07 08:11:35 +02:00
2022-06-05 09:25:12 -07:00
2022-06-05 09:25:12 -07:00