releases/4.19.31/drm-fb-helper-generic-fix-drm_fbdev_client_restore.patch

   1 From 78de14c23e031420aa5f61973583635eccd6cd2a Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
   3 Date: Fri, 25 Jan 2019 16:03:00 +0100
   4 Subject: drm/fb-helper: generic: Fix drm_fbdev_client_restore()
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Noralf Trønnes <noralf@tronnes.org>
  10
  11 commit 78de14c23e031420aa5f61973583635eccd6cd2a upstream.
  12
  13 If fbdev setup has failed, lastclose will give a NULL pointer deref:
  14
  15 [   77.794295] [drm:drm_lastclose]
  16 [   77.794414] [drm:drm_lastclose] driver lastclose completed
  17 [   77.794660] Unable to handle kernel NULL pointer dereference at virtual address 00000014
  18 [   77.809460] pgd = b376b71b
  19 [   77.818275] [00000014] *pgd=175ba831, *pte=00000000, *ppte=00000000
  20 [   77.830813] Internal error: Oops: 17 [#1] ARM
  21 [   77.840963] Modules linked in: mi0283qt mipi_dbi tinydrm raspberrypi_hwmon gpio_backlight backlight snd_bcm2835(C) bcm2835_rng rng_core
  22 [   77.865203] CPU: 0 PID: 527 Comm: lt-modetest Tainted: G         C        5.0.0-rc1+ #1
  23 [   77.879525] Hardware name: BCM2835
  24 [   77.889185] PC is at restore_fbdev_mode+0x20/0x164
  25 [   77.900261] LR is at drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0x9c
  26 [   78.002446] Process lt-modetest (pid: 527, stack limit = 0x7a3d5c14)
  27 [   78.291030] Backtrace:
  28 [   78.300815] [<c04f2d0c>] (restore_fbdev_mode) from [<c04f4708>] (drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0x9c)
  29 [   78.319095]  r9:d8a8a288 r8:d891acf0 r7:d7697910 r6:00000000 r5:d891ac00 r4:d891ac00
  30 [   78.334432] [<c04f46b4>] (drm_fb_helper_restore_fbdev_mode_unlocked) from [<c04f47e8>] (drm_fbdev_client_restore+0x18/0x20)
  31 [   78.353296]  r8:d76978c0 r7:d7697910 r6:d7697950 r5:d7697800 r4:d891ac00 r3:c04f47d0
  32 [   78.368689] [<c04f47d0>] (drm_fbdev_client_restore) from [<c051b6b4>] (drm_client_dev_restore+0x7c/0xc0)
  33 [   78.385982] [<c051b638>] (drm_client_dev_restore) from [<c04f8fd0>] (drm_lastclose+0xc4/0xd4)
  34 [   78.402332]  r8:d76978c0 r7:d7471080 r6:c0e0c088 r5:d8a85e00 r4:d7697800
  35 [   78.416688] [<c04f8f0c>] (drm_lastclose) from [<c04f9088>] (drm_release+0xa8/0x10c)
  36 [   78.431929]  r5:d8a85e00 r4:d7697800
  37 [   78.442989] [<c04f8fe0>] (drm_release) from [<c02640c4>] (__fput+0x104/0x1c8)
  38 [   78.457740]  r8:d5ccea10 r7:d96cfb10 r6:00000008 r5:d74c1b90 r4:d8a8a280
  39 [   78.472043] [<c0263fc0>] (__fput) from [<c02641ec>] (____fput+0x18/0x1c)
  40 [   78.486363]  r10:00000006 r9:d7722000 r8:c01011c4 r7:00000000 r6:c0ebac6c r5:d892a340
  41 [   78.501869]  r4:d8a8a280
  42 [   78.512002] [<c02641d4>] (____fput) from [<c013ef1c>] (task_work_run+0x98/0xac)
  43 [   78.527186] [<c013ee84>] (task_work_run) from [<c010cc54>] (do_work_pending+0x4f8/0x570)
  44 [   78.543238]  r7:d7722030 r6:00000004 r5:d7723fb0 r4:00000000
  45 [   78.556825] [<c010c75c>] (do_work_pending) from [<c0101034>] (slow_work_pending+0xc/0x20)
  46 [   78.674256] ---[ end trace 70d3a60cf739be3b ]---
  47
  48 Fix by using drm_fb_helper_lastclose() which checks if fbdev is in use.
  49
  50 Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
  51 Cc: stable@vger.kernel.org
  52 Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  53 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
  54 Link: https://patchwork.freedesktop.org/patch/msgid/20190125150300.33268-1-noralf@tronnes.org
  55 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  56
  57 ---
  58  drivers/gpu/drm/drm_fb_helper.c |    4 +---
  59  1 file changed, 1 insertion(+), 3 deletions(-)
  60
  61 --- a/drivers/gpu/drm/drm_fb_helper.c
  62 +++ b/drivers/gpu/drm/drm_fb_helper.c
  63 @@ -3156,9 +3156,7 @@ static void drm_fbdev_client_unregister(
  64
  65  static int drm_fbdev_client_restore(struct drm_client_dev *client)
  66  {
  67 -       struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
  68 -
  69 -       drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
  70 +       drm_fb_helper_lastclose(client->dev);
  71
  72         return 0;
  73  }