1. Apr 13, 2022
  2. Apr 12, 2022
    • Matthew Auld's avatar
      drm/ttm: stop passing NULL fence in ttm_bo_move_sync_cleanup · c6346218
      Matthew Auld authored
      
      
      If we hit the sync case, like when skipping clearing for kernel internal
      objects, or when falling back to cpu clearing, like in i915, we end up
      trying to add a NULL fence, but with some recent changes in this area
      this now just results in NULL deref in dma_resv_add_fence:
      
      <1>[    5.466383] BUG: kernel NULL pointer dereference, address: 0000000000000008
      <1>[    5.466384] #PF: supervisor read access in kernel mode
      <1>[    5.466385] #PF: error_code(0x0000) - not-present page
      <6>[    5.466386] PGD 0 P4D 0
      <4>[    5.466387] Oops: 0000 [#1] PREEMPT SMP NOPTI
      <4>[    5.466389] CPU: 5 PID: 267 Comm: modprobe Not tainted 5.18.0-rc2-CI-CI_DRM_11481+ #1
      <4>[    5.466391] RIP: 0010:dma_resv_add_fence+0x63/0x260
      <4>[    5.466395] Code: 38 85 c0 0f 84 df 01 00 00 0f 88 e8 01 00 00 83 c0 01 0f 88 df 01 00 00 8b 05 35 89 10 01 49 8d 5e 68 85 c0 0f 85 45 01 00 00 <48> 8b 45 08 48 3d c0 a5 0a 82 0f 84 5c 01 00 00 48 3d 60 a5 0a 82
      <4>[    5.466396] RSP: 0018:ffffc90000e974f8 EFLAGS: 00010202
      <4>[    5.466397] RAX: 0000000000000001 RBX: ffff888123e88b28 RCX: 00000000ffffffff
      <4>[    5.466398] RDX: 0000000000000001 RSI: ffffffff822e4f50 RDI: ffffffff8233f087
      <4>[    5.466399] RBP: 0000000000000000 R08: ffff8881313dbc80 R09: 0000000000000001
      <4>[    5.466399] R10: 0000000000000001 R11: 00000000da354294 R12: 0000000000000000
      <4>[    5.466400] R13: ffff88810927dc58 R14: ffff888123e88ac0 R15: ffff88810a88d600
      <4>[    5.466401] FS:  00007f5fa1193540(0000) GS:ffff88845d880000(0000) knlGS:0000000000000000
      <4>[    5.466402] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      <4>[    5.466402] CR2: 0000000000000008 CR3: 0000000106dd6003 CR4: 00000000003706e0
      <4>[    5.466403] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      <4>[    5.466404] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      <4>[    5.466404] Call Trace:
      <4>[    5.466405]  <TASK>
      <4>[    5.466406]  ttm_bo_move_accel_cleanup+0x62/0x270 [ttm]
      <4>[    5.466411]  ? i915_rsgt_from_buddy_resource+0x185/0x1e0 [i915]
      <4>[    5.466529]  i915_ttm_move+0xfd/0x430 [i915]
      <4>[    5.466833]  ? dma_resv_reserve_fences+0x4e/0x320
      <4>[    5.466836]  ? ttm_bo_add_move_fence.constprop.20+0xf7/0x140 [ttm]
      <4>[    5.466841]  ttm_bo_handle_move_mem+0xa1/0x140 [ttm]
      <4>[    5.466845]  ttm_bo_validate+0xee/0x160 [ttm]
      <4>[    5.466849]  __i915_ttm_get_pages+0x4f/0x210 [i915]
      <4>[    5.466976]  i915_ttm_get_pages+0xad/0x140 [i915]
      <4>[    5.467094]  ____i915_gem_object_get_pages+0x32/0xf0 [i915]
      <4>[    5.467210]  __i915_gem_object_get_pages+0x89/0xa0 [i915]
      <4>[    5.467323]  i915_vma_get_pages+0x114/0x1d0 [i915]
      <4>[    5.467446]  i915_vma_pin_ww+0xd3/0xa90 [i915]
      <4>[    5.467570]  i915_vma_pin.constprop.10+0x119/0x1b0 [i915]
      <4>[    5.467700]  ? __mutex_unlock_slowpath+0x3e/0x2b0
      <4>[    5.467704]  intel_alloc_initial_plane_obj.isra.6+0x1a9/0x390 [i915]
      <4>[    5.467833]  intel_crtc_initial_plane_config+0x83/0x340 [i915]
      
      In the ttm_bo_move_sync_cleanup() case it seems we only really care
      about calling ttm_bo_wait_free_node(), so let's instead just call that
      directly.
      
      Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
      Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
      Cc: Christian König <christian.koenig@amd.com>
      Cc: Lucas De Marchi <lucas.demarchi@intel.com>
      Cc: Nirmoy Das <nirmoy.das@linux.intel.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220411085603.58156-1-matthew.auld@intel.com
      c6346218
    • Ville Syrjälä's avatar
      drm: Use drm_mode_copy() · a3342f4d
      Ville Syrjälä authored
      
      
      struct drm_display_mode embeds a list head, so overwriting
      the full struct with another one will corrupt the list
      (if the destination mode is on a list). Use drm_mode_copy()
      instead which explicitly preserves the list head of
      the destination mode.
      
      Even if we know the destination mode is not on any list
      using drm_mode_copy() seems decent as it sets a good
      example. Bad examples of not using it might eventually
      get copied into code where preserving the list head
      actually matters.
      
      Obviously one case not covered here is when the mode
      itself is embedded in a larger structure and the whole
      structure is copied. But if we are careful when copying
      into modes embedded in structures I think we can be a
      little more reassured that bogus list heads haven't been
      propagated in.
      
      @is_mode_copy@
      @@
      drm_mode_copy(...)
      {
      ...
      }
      
      @depends on !is_mode_copy@
      struct drm_display_mode *mode;
      expression E, S;
      @@
      (
      - *mode = E
      + drm_mode_copy(mode, &E)
      |
      - memcpy(mode, E, S)
      + drm_mode_copy(mode, E)
      )
      
      @depends on !is_mode_copy@
      struct drm_display_mode mode;
      expression E;
      @@
      (
      - mode = E
      + drm_mode_copy(&mode, &E)
      |
      - memcpy(&mode, E, S)
      + drm_mode_copy(&mode, E)
      )
      
      @@
      struct drm_display_mode *mode;
      @@
      - &*mode
      + mode
      
      Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220218100403.7028-23-ville.syrjala@linux.intel.com
      
      
      Reviewed-by: default avatarAndrzej Hajda <andrzej.hajda@intel.com>
      a3342f4d
    • Ville Syrjälä's avatar
      drm: Use drm_mode_init() for on-stack modes · 563c4a75
      Ville Syrjälä authored
      
      
      Initialize on-stack modes with drm_mode_init() to guarantee
      no stack garbage in the list head, or that we aren't copying
      over another mode's list head.
      
      Based on the following cocci script, with manual fixups:
      @decl@
      identifier M;
      expression E;
      @@
      - struct drm_display_mode M = E;
      + struct drm_display_mode M;
      
      @@
      identifier decl.M;
      expression decl.E;
      statement S, S1;
      @@
      struct drm_display_mode M;
      ... when != S
      + drm_mode_init(&M, &E);
      +
      S1
      
      @@
      expression decl.E;
      @@
      - &*E
      + E
      
      Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220218100403.7028-22-ville.syrjala@linux.intel.com
      
      
      Reviewed-by: default avatarAndrzej Hajda <andrzej.hajda@intel.com>
      563c4a75
    • Jiasheng Jiang's avatar
      drm: mali-dp: potential dereference of null pointer · 73c3ed74
      Jiasheng Jiang authored
      The return value of kzalloc() needs to be checked.
      To avoid use of null pointer '&state->base' in case of the
      failure of alloc.
      
      Fixes: 99665d07
      
       ("drm: mali-dp: add malidp_crtc_state struct")
      Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
      Reviewed-by: default avatarBrian Starkey <brian.starkey@arm.com>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20211214100837.46912-1-jiasheng@iscas.ac.cn
      73c3ed74
    • Robin Murphy's avatar
      drm/arm/malidp: Stop using iommu_present() · b5c7d197
      Robin Murphy authored
      
      
      iommu_get_domain_for_dev() is already perfectly happy to return NULL
      if the given device has no IOMMU. Drop the unnecessary check.
      
      Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/5049994e6c2ba92c2f30d51850c8929136d0f8ca.1649167878.git.robin.murphy@arm.com
      b5c7d197
    • Liviu Dudau's avatar
      drm/komeda: return early if drm_universal_plane_init() fails. · c8f76c37
      Liviu Dudau authored
      
      
      If drm_universal_plane_init() fails early we jump to the common cleanup code
      that calls komeda_plane_destroy() which in turn could access the uninitalised
      drm_plane and crash. Return early if an error is detected without going through
      the common code.
      
      Reported-by: default avatarSteven Price <steven.price@arm.com>
      Reviewed-by: default avatarSteven Price <steven.price@arm.com>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      Link: https://lore.kernel.org/dri-devel/20211203100946.2706922-1-liviu.dudau@arm.com
      c8f76c37
    • Zhou Qingyang's avatar
      drm/komeda: Fix an undefined behavior bug in komeda_plane_add() · f5e284bb
      Zhou Qingyang authored
      In komeda_plane_add(), komeda_get_layer_fourcc_list() is assigned to
      formats and used in drm_universal_plane_init().
      drm_universal_plane_init() passes formats to
      __drm_universal_plane_init(). __drm_universal_plane_init() further
      passes formats to memcpy() as src parameter, which could lead to an
      undefined behavior bug on failure of komeda_get_layer_fourcc_list().
      
      Fix this bug by adding a check of formats.
      
      This bug was found by a static analyzer. The analysis employs
      differential checking to identify inconsistent security operations
      (e.g., checks or kfrees) between two code paths and confirms that the
      inconsistent operations are not recovered in the current function or
      the callers, so they constitute bugs.
      
      Note that, as a bug found by static analysis, it can be a false
      positive or hard to trigger. Multiple researchers have cross-reviewed
      the bug.
      
      Builds with CONFIG_DRM_KOMEDA=m show no new warnings,
      and our static analyzer no longer warns about this code.
      
      Fixes: 61f1c4a8
      
       ("drm/komeda: Attach komeda_dev to DRM-KMS")
      Signed-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
      Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
      Link: https://lore.kernel.org/dri-devel/20211201033704.32054-1-zhou1615@umn.edu
      f5e284bb
  3. Apr 11, 2022
  4. Apr 08, 2022
  5. Apr 07, 2022