diff mbox

[v2] drm/imx: imx-ldb: do not try to dereference crtc->state->state in encoder mode_set

Message ID 1469189310-5915-1-git-send-email-p.zabel@pengutronix.de (mailing list archive)
State New, archived
Headers show

Commit Message

Philipp Zabel July 22, 2016, 12:08 p.m. UTC 
The code in imx_ldb_encoder_mode_set crashes with a NULL pointer
dereference trying to access crtc->state->state, which was previously
cleared by drm_atomic_helper_swap_state:

    Unable to handle kernel NULL pointer dereference at virtual address 00000010
    pgd = ae08c000
    [00000010] *pgd=3e00e831, *pte=00000000, *ppte=00000000
    Internal error: Oops: 17 [#1] PREEMPT SMP ARM
    Modules linked in:
    CPU: 1 PID: 102 Comm: kmsfb-manage Not tainted 4.7.0-rc5+ #232
    Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
    task: ae058c40 ti: ae04e000 task.ti: ae04e000
    PC is at imx_ldb_encoder_mode_set+0x138/0x2f8
    LR is at 0xae881818
    pc : [<8051a8c8>]    lr : [<ae881818>]    psr: 600f0013
    sp : ae04fc70  ip : ae04fbb0  fp : ae04fcbc
    r10: ae8ea018  r9 : 00000000  r8 : ae246418
    r7 : ae8ea010  r6 : ae8ea308  r5 : 00000000  r4 : 00000000
    r3 : 00000000  r2 : 00000000  r1 : 00000110  r0 : 00000000
    Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    Control: 10c5387d  Table: 3e08c04a  DAC: 00000051
    Process kmsfb-manage (pid: 102, stack limit = 0xae04e210)
    Stack: (0xae04fc70 to 0xae050000)
    fc60:                                     043ce660 00000001 0000009e 043ce660
    fc80: 00000002 00000000 00000000 af75cf50 00001009 ae23f440 00000001 ae246418
    fca0: 8155a210 ae8ea308 8093c364 ae2464e0 ae04fcec ae04fcc0 804ef350 8051a79c
    fcc0: 00000004 00000004 ae23f440 af3f9000 ae881818 8155a210 af1af200 ae8ea020
    fce0: ae04fd1c ae04fcf0 80519124 804ef060 ae04fd34 00000000 00000000 00000000
    fd00: ae881818 ae23f440 80d4ec8c 00000000 ae04fd34 ae04fd20 804f00b4 80518fac
    fd20: ae23f440 00000000 ae04fd54 ae04fd38 804f2190 804f0074 ae23f440 af3f9000
    fd40: ae04fdd4 ae881818 ae04fd6c ae04fd58 80516390 804f20f4 ae23f440 00000000
    fd60: ae04fd8c ae04fd70 804f26f4 80516348 ae23a000 ae881818 00000001 af3f9000
    fd80: ae04fdac ae04fd90 80502c58 804f2678 ae04fe50 ae23f400 00000001 af3f9000
    fda0: ae04fe1c ae04fdb0 80507a1c 80502bf8 ae23a000 ae058c40 af1af200 ae23f400
    fdc0: ae23a000 af3f9000 ae881818 ae23a00c 80176c7c ae23a000 ae881818 af1af200
    fde0: 00000000 00000000 ae23f400 00000001 ae04fe1c 00000051 ae04fe50 8155a210
    fe00: 80932060 c06864a2 af3f9000 ae246200 ae04fefc ae04fe20 804f9718 805074e8
    fe20: ae04feac ae04fe30 80177360 8017631c 805074dc 00000068 00000068 00000062
    fe40: 00000068 000000a2 ae04fe50 7ef29688 7ef29c40 00000000 00000001 00000018
    fe60: 00000026 00000000 00000000 00000000 00000001 000115bc 05010500 05a0059f
    fe80: 03200000 03360321 00000337 0000003c 00000000 00000040 30383231 30303878
    fea0: 00000000 00000000 00000000 00000000 00000000 00000000 00004000 aea6a140
    fec0: 00000000 80d77b71 00000000 80283110 600f0013 7ef29688 af342bb0 ae250b40
    fee0: 80275440 00000003 ae04e000 00000000 ae04ff7c ae04ff00 80274ac8 804f957c
    ff00: 80283128 80179030 00000000 00000000 80282fd8 ae1e0000 0000003d aea6a1d0
    ff20: 00000002 00000003 00004000 007f8c60 c06864a2 7ef29688 ae04e000 00000000
    ff40: ae04ff6c ae04ff50 80283260 80282fe4 00017050 ae250b41 00000003 ae250b40
    ff60: c06864a2 7ef29688 ae04e000 00000000 ae04ffa4 ae04ff80 80275440 80274a20
    ff80: 00017050 00000001 007f8c60 00000036 801088a4 ae04e000 00000000 ae04ffa8
    ffa0: 80108700 80275408 00017050 00000001 00000003 c06864a2 7ef29688 000115bc
    ffc0: 00017050 00000001 007f8c60 00000036 00000003 00000000 00000026 00000018
    ffe0: 00016f28 7ef29684 0000b7d9 76e4a1e6 400f0030 00000003 3ff7e861 3ff7ec61
    Backtrace:
    [<8051a790>] (imx_ldb_encoder_mode_set) from [<804ef350>] (drm_atomic_helper_commit_modeset_disables+0x2fc/0x3f0)
     r10:ae2464e0 r9:8093c364 r8:ae8ea308 r7:8155a210 r6:ae246418 r5:00000001
     r4:ae23f440
    [<804ef054>] (drm_atomic_helper_commit_modeset_disables) from [<80519124>] (imx_drm_atomic_commit_tail+0x184/0x1e0)
     r10:ae8ea020 r9:af1af200 r8:8155a210 r7:ae881818 r6:af3f9000 r5:ae23f440
     r4:00000004 r3:00000004
    [<80518fa0>] (imx_drm_atomic_commit_tail) from [<804f00b4>] (commit_tail+0x4c/0x68)
     r6:00000000 r5:80d4ec8c r4:ae23f440
    [<804f0068>] (commit_tail) from [<804f2190>] (drm_atomic_helper_commit+0xa8/0xd4)
     r5:00000000 r4:ae23f440
    [<804f20e8>] (drm_atomic_helper_commit) from [<80516390>] (drm_atomic_commit+0x54/0x74)
     r7:ae881818 r6:ae04fdd4 r5:af3f9000 r4:ae23f440
    [<8051633c>] (drm_atomic_commit) from [<804f26f4>] (drm_atomic_helper_set_config+0x88/0xac)
     r5:00000000 r4:ae23f440
    [<804f266c>] (drm_atomic_helper_set_config) from [<80502c58>] (drm_mode_set_config_internal+0x6c/0xf4)
     r7:af3f9000 r6:00000001 r5:ae881818 r4:ae23a000
    [<80502bec>] (drm_mode_set_config_internal) from [<80507a1c>] (drm_mode_setcrtc+0x540/0x5b8)
     r7:af3f9000 r6:00000001 r5:ae23f400 r4:ae04fe50
    [<805074dc>] (drm_mode_setcrtc) from [<804f9718>] (drm_ioctl+0x1a8/0x46c)
     r10:ae246200 r9:af3f9000 r8:c06864a2 r7:80932060 r6:8155a210 r5:ae04fe50
     r4:00000051
    [<804f9570>] (drm_ioctl) from [<80274ac8>] (do_vfs_ioctl+0xb4/0x9e8)
     r10:00000000 r9:ae04e000 r8:00000003 r7:80275440 r6:ae250b40 r5:af342bb0
     r4:7ef29688
    [<80274a14>] (do_vfs_ioctl) from [<80275440>] (SyS_ioctl+0x44/0x6c)
     r10:00000000 r9:ae04e000 r8:7ef29688 r7:c06864a2 r6:ae250b40 r5:00000003
     r4:ae250b41
    [<802753fc>] (SyS_ioctl) from [<80108700>] (ret_fast_syscall+0x0/0x1c)
     r9:ae04e000 r8:801088a4 r7:00000036 r6:007f8c60 r5:00000001 r4:00017050
    Code: 1a000018 e596e034 e59e3368 e59331bc (e5930010)
    ---[ end trace 464e7d3c7f4b9706 ]---

Instead of trying to walk only the connectors in atomic state to which we
don't have access, just walk all connectors to find one connected to the
current encoder and containing a bus_format description.

Fixes: 49f98bc4d44a4 ("drm/imx: store internal bus configuration in crtc state")
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
---
Changes since v1:
- Remove unused local variable crtc_state.
- Find the connector by its connector->encoder field
  instead of comparing connector and encoder crtcs.
---
 drivers/gpu/drm/imx/imx-ldb.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

Comments

Ying Liu July 25, 2016, 2:32 a.m. UTC | #1 
On Fri, Jul 22, 2016 at 8:08 PM, Philipp Zabel <p.zabel@pengutronix.de> wrote:
> The code in imx_ldb_encoder_mode_set crashes with a NULL pointer
> dereference trying to access crtc->state->state, which was previously
> cleared by drm_atomic_helper_swap_state:
>
>     Unable to handle kernel NULL pointer dereference at virtual address 00000010
>     pgd = ae08c000
>     [00000010] *pgd=3e00e831, *pte=00000000, *ppte=00000000
>     Internal error: Oops: 17 [#1] PREEMPT SMP ARM
>     Modules linked in:
>     CPU: 1 PID: 102 Comm: kmsfb-manage Not tainted 4.7.0-rc5+ #232
>     Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
>     task: ae058c40 ti: ae04e000 task.ti: ae04e000
>     PC is at imx_ldb_encoder_mode_set+0x138/0x2f8
>     LR is at 0xae881818
>     pc : [<8051a8c8>]    lr : [<ae881818>]    psr: 600f0013
>     sp : ae04fc70  ip : ae04fbb0  fp : ae04fcbc
>     r10: ae8ea018  r9 : 00000000  r8 : ae246418
>     r7 : ae8ea010  r6 : ae8ea308  r5 : 00000000  r4 : 00000000
>     r3 : 00000000  r2 : 00000000  r1 : 00000110  r0 : 00000000
>     Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
>     Control: 10c5387d  Table: 3e08c04a  DAC: 00000051
>     Process kmsfb-manage (pid: 102, stack limit = 0xae04e210)
>     Stack: (0xae04fc70 to 0xae050000)
>     fc60:                                     043ce660 00000001 0000009e 043ce660
>     fc80: 00000002 00000000 00000000 af75cf50 00001009 ae23f440 00000001 ae246418
>     fca0: 8155a210 ae8ea308 8093c364 ae2464e0 ae04fcec ae04fcc0 804ef350 8051a79c
>     fcc0: 00000004 00000004 ae23f440 af3f9000 ae881818 8155a210 af1af200 ae8ea020
>     fce0: ae04fd1c ae04fcf0 80519124 804ef060 ae04fd34 00000000 00000000 00000000
>     fd00: ae881818 ae23f440 80d4ec8c 00000000 ae04fd34 ae04fd20 804f00b4 80518fac
>     fd20: ae23f440 00000000 ae04fd54 ae04fd38 804f2190 804f0074 ae23f440 af3f9000
>     fd40: ae04fdd4 ae881818 ae04fd6c ae04fd58 80516390 804f20f4 ae23f440 00000000
>     fd60: ae04fd8c ae04fd70 804f26f4 80516348 ae23a000 ae881818 00000001 af3f9000
>     fd80: ae04fdac ae04fd90 80502c58 804f2678 ae04fe50 ae23f400 00000001 af3f9000
>     fda0: ae04fe1c ae04fdb0 80507a1c 80502bf8 ae23a000 ae058c40 af1af200 ae23f400
>     fdc0: ae23a000 af3f9000 ae881818 ae23a00c 80176c7c ae23a000 ae881818 af1af200
>     fde0: 00000000 00000000 ae23f400 00000001 ae04fe1c 00000051 ae04fe50 8155a210
>     fe00: 80932060 c06864a2 af3f9000 ae246200 ae04fefc ae04fe20 804f9718 805074e8
>     fe20: ae04feac ae04fe30 80177360 8017631c 805074dc 00000068 00000068 00000062
>     fe40: 00000068 000000a2 ae04fe50 7ef29688 7ef29c40 00000000 00000001 00000018
>     fe60: 00000026 00000000 00000000 00000000 00000001 000115bc 05010500 05a0059f
>     fe80: 03200000 03360321 00000337 0000003c 00000000 00000040 30383231 30303878
>     fea0: 00000000 00000000 00000000 00000000 00000000 00000000 00004000 aea6a140
>     fec0: 00000000 80d77b71 00000000 80283110 600f0013 7ef29688 af342bb0 ae250b40
>     fee0: 80275440 00000003 ae04e000 00000000 ae04ff7c ae04ff00 80274ac8 804f957c
>     ff00: 80283128 80179030 00000000 00000000 80282fd8 ae1e0000 0000003d aea6a1d0
>     ff20: 00000002 00000003 00004000 007f8c60 c06864a2 7ef29688 ae04e000 00000000
>     ff40: ae04ff6c ae04ff50 80283260 80282fe4 00017050 ae250b41 00000003 ae250b40
>     ff60: c06864a2 7ef29688 ae04e000 00000000 ae04ffa4 ae04ff80 80275440 80274a20
>     ff80: 00017050 00000001 007f8c60 00000036 801088a4 ae04e000 00000000 ae04ffa8
>     ffa0: 80108700 80275408 00017050 00000001 00000003 c06864a2 7ef29688 000115bc
>     ffc0: 00017050 00000001 007f8c60 00000036 00000003 00000000 00000026 00000018
>     ffe0: 00016f28 7ef29684 0000b7d9 76e4a1e6 400f0030 00000003 3ff7e861 3ff7ec61
>     Backtrace:
>     [<8051a790>] (imx_ldb_encoder_mode_set) from [<804ef350>] (drm_atomic_helper_commit_modeset_disables+0x2fc/0x3f0)
>      r10:ae2464e0 r9:8093c364 r8:ae8ea308 r7:8155a210 r6:ae246418 r5:00000001
>      r4:ae23f440
>     [<804ef054>] (drm_atomic_helper_commit_modeset_disables) from [<80519124>] (imx_drm_atomic_commit_tail+0x184/0x1e0)
>      r10:ae8ea020 r9:af1af200 r8:8155a210 r7:ae881818 r6:af3f9000 r5:ae23f440
>      r4:00000004 r3:00000004
>     [<80518fa0>] (imx_drm_atomic_commit_tail) from [<804f00b4>] (commit_tail+0x4c/0x68)
>      r6:00000000 r5:80d4ec8c r4:ae23f440
>     [<804f0068>] (commit_tail) from [<804f2190>] (drm_atomic_helper_commit+0xa8/0xd4)
>      r5:00000000 r4:ae23f440
>     [<804f20e8>] (drm_atomic_helper_commit) from [<80516390>] (drm_atomic_commit+0x54/0x74)
>      r7:ae881818 r6:ae04fdd4 r5:af3f9000 r4:ae23f440
>     [<8051633c>] (drm_atomic_commit) from [<804f26f4>] (drm_atomic_helper_set_config+0x88/0xac)
>      r5:00000000 r4:ae23f440
>     [<804f266c>] (drm_atomic_helper_set_config) from [<80502c58>] (drm_mode_set_config_internal+0x6c/0xf4)
>      r7:af3f9000 r6:00000001 r5:ae881818 r4:ae23a000
>     [<80502bec>] (drm_mode_set_config_internal) from [<80507a1c>] (drm_mode_setcrtc+0x540/0x5b8)
>      r7:af3f9000 r6:00000001 r5:ae23f400 r4:ae04fe50
>     [<805074dc>] (drm_mode_setcrtc) from [<804f9718>] (drm_ioctl+0x1a8/0x46c)
>      r10:ae246200 r9:af3f9000 r8:c06864a2 r7:80932060 r6:8155a210 r5:ae04fe50
>      r4:00000051
>     [<804f9570>] (drm_ioctl) from [<80274ac8>] (do_vfs_ioctl+0xb4/0x9e8)
>      r10:00000000 r9:ae04e000 r8:00000003 r7:80275440 r6:ae250b40 r5:af342bb0
>      r4:7ef29688
>     [<80274a14>] (do_vfs_ioctl) from [<80275440>] (SyS_ioctl+0x44/0x6c)
>      r10:00000000 r9:ae04e000 r8:7ef29688 r7:c06864a2 r6:ae250b40 r5:00000003
>      r4:ae250b41
>     [<802753fc>] (SyS_ioctl) from [<80108700>] (ret_fast_syscall+0x0/0x1c)
>      r9:ae04e000 r8:801088a4 r7:00000036 r6:007f8c60 r5:00000001 r4:00017050
>     Code: 1a000018 e596e034 e59e3368 e59331bc (e5930010)
>     ---[ end trace 464e7d3c7f4b9706 ]---
>
> Instead of trying to walk only the connectors in atomic state to which we
> don't have access, just walk all connectors to find one connected to the
> current encoder and containing a bus_format description.
>
> Fixes: 49f98bc4d44a4 ("drm/imx: store internal bus configuration in crtc state")
> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>

Acked-by: Liu Ying <gnuiyl@gmail.com>

Regards,
Liu Ying

> ---
> Changes since v1:
> - Remove unused local variable crtc_state.
> - Find the connector by its connector->encoder field
>   instead of comparing connector and encoder crtcs.
> ---
>  drivers/gpu/drm/imx/imx-ldb.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
> index dc2b420..3ed2d50 100644
> --- a/drivers/gpu/drm/imx/imx-ldb.c
> +++ b/drivers/gpu/drm/imx/imx-ldb.c
> @@ -298,15 +298,12 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
>         }
>
>         if (!bus_format) {
> -               struct drm_connector_state *conn_state;
>                 struct drm_connector *connector;
> -               int i;
>
> -               for_each_connector_in_state(encoder->crtc->state->state,
> -                                           connector, conn_state, i) {
> +               drm_for_each_connector(connector, encoder->dev) {
>                         struct drm_display_info *di = &connector->display_info;
>
> -                       if (conn_state->crtc == encoder->crtc &&
> +                       if (connector->encoder == encoder &&
>                             di->num_bus_formats) {
>                                 bus_format = di->bus_formats[0];
>                                 break;
> --
> 2.8.1
>
diff mbox

Patch

diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index dc2b420..3ed2d50 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -298,15 +298,12 @@  static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
 	}
 
 	if (!bus_format) {
-		struct drm_connector_state *conn_state;
 		struct drm_connector *connector;
-		int i;
 
-		for_each_connector_in_state(encoder->crtc->state->state,
-					    connector, conn_state, i) {
+		drm_for_each_connector(connector, encoder->dev) {
 			struct drm_display_info *di = &connector->display_info;
 
-			if (conn_state->crtc == encoder->crtc &&
+			if (connector->encoder == encoder &&
 			    di->num_bus_formats) {
 				bus_format = di->bus_formats[0];
 				break;