Imre Deak efa13b328e drm/mst: Fix MST sideband up-reply failure handling ... [ Upstream commit d8fd372220 ] Fix the breakage resulting in the stacktrace below, due to tx queue being full when trying to send an up-reply. txmsg->seqno is -1 in this case leading to a corruption of the mstb object by txmsg->dst->tx_slots[txmsg->seqno] = NULL; in process_single_up_tx_qlock(). [ +0,005162] [drm:process_single_tx_qlock [drm_kms_helper]] set_hdr_from_dst_qlock: failed to find slot [ +0,000015] [drm:drm_dp_send_up_ack_reply.constprop.19 [drm_kms_helper]] failed to send msg in q -11 [ +0,000939] BUG: kernel NULL pointer dereference, address: 00000000000005a0 [ +0,006982] #PF: supervisor write access in kernel mode [ +0,005223] #PF: error_code(0x0002) - not-present page [ +0,005135] PGD 0 P4D 0 [ +0,002581] Oops: 0002 [#1] PREEMPT SMP NOPTI [ +0,004359] CPU: 1 PID: 1200 Comm: kworker/u16:3 Tainted: G U 5.2.0-rc1+ #410 [ +0,008433] Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP, BIOS ICLSFWR1.R00.3175.A00.1904261428 04/26/2019 [ +0,013323] Workqueue: i915-dp i915_digport_work_func [i915] [ +0,005676] RIP: 0010:queue_work_on+0x19/0x70 [ +0,004372] Code: ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 41 56 49 89 f6 41 55 41 89 fd 41 54 55 53 48 89 d3 9c 5d fa e8 e7 81 0c 00 <f0> 48 0f ba 2b 00 73 31 45 31 e4 f7 c5 00 02 00 00 74 13 e8 cf 7f [ +0,018750] RSP: 0018:ffffc900007dfc50 EFLAGS: 00010006 [ +0,005222] RAX: 0000000000000046 RBX: 00000000000005a0 RCX: 0000000000000001 [ +0,007133] RDX: 000000000001b608 RSI: 0000000000000000 RDI: ffffffff82121972 [ +0,007129] RBP: 0000000000000202 R08: 0000000000000000 R09: 0000000000000001 [ +0,007129] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88847bfa5096 [ +0,007131] R13: 0000000000000010 R14: ffff88849c08f3f8 R15: 0000000000000000 [ +0,007128] FS: 0000000000000000(0000) GS:ffff88849dc80000(0000) knlGS:0000000000000000 [ +0,008083] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0,005749] CR2: 00000000000005a0 CR3: 0000000005210006 CR4: 0000000000760ee0 [ +0,007128] PKRU: 55555554 [ +0,002722] Call Trace: [ +0,002458] drm_dp_mst_handle_up_req+0x517/0x540 [drm_kms_helper] [ +0,006197] ? drm_dp_mst_hpd_irq+0x5b/0x9c0 [drm_kms_helper] [ +0,005764] drm_dp_mst_hpd_irq+0x5b/0x9c0 [drm_kms_helper] [ +0,005623] ? intel_dp_hpd_pulse+0x205/0x370 [i915] [ +0,005018] intel_dp_hpd_pulse+0x205/0x370 [i915] [ +0,004836] i915_digport_work_func+0xbb/0x140 [i915] [ +0,005108] process_one_work+0x245/0x610 [ +0,004027] worker_thread+0x37/0x380 [ +0,003684] ? process_one_work+0x610/0x610 [ +0,004184] kthread+0x119/0x130 [ +0,003240] ? kthread_park+0x80/0x80 [ +0,003668] ret_from_fork+0x24/0x50 Cc: Lyude Paul <lyude@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190523212433.9058-1-imre.deak@intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-01-09 10:19:07 +01:00
..
amd	drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle	2020-01-09 10:18:55 +01:00
arc	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
arm	drm/arm/hdlcd: Allow a bit of clock tolerance	2019-06-25 11:35:58 +08:00
armada	drm/armada: remove obsolete fb unreferencing kfifo and workqueue	2018-07-30 11:53:06 +01:00
ast	drm/ast: Fixed reboot test may cause system hanged	2019-09-06 10:21:59 +02:00
atmel-hlcdc	drm/atmel-hlcdc: revert shift by 8	2019-12-05 09:21:33 +01:00
bochs	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
bridge	drm/bridge: dw-hdmi: Restore audio when setting a mode	2019-12-31 16:35:14 +01:00
cirrus	drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up	2019-04-20 09:16:00 +02:00
etnaviv	drm/etnaviv: add missing failure path to destroy suballoc	2019-07-10 09:53:43 +02:00
exynos	drm/exynos: fix missing decrement of retry counter	2019-08-25 10:47:57 +02:00
fsl-dcu	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
gma500	drm/gma500: fix memory disclosures due to uninitialized bytes	2019-12-31 16:35:22 +01:00
hisilicon	drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer	2018-11-21 09:19:10 +01:00
i2c	Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes	2018-10-04 10:32:14 +10:00
i810	drm/i810: Prevent underflow in ioctl	2019-12-13 08:52:44 +01:00
i915	drm/i915/userptr: Try to acquire the page lock around set_page_dirty()	2019-12-01 09:16:12 +01:00
imx	drm/imx: only send event on crtc disable if kept disabled	2019-07-10 09:53:44 +02:00
lib
mediatek	drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto	2019-09-19 09:09:39 +02:00
meson	drm: meson: venc: cvbs: fix CVBS mode matching	2019-12-21 10:57:39 +01:00
mga
mgag200	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
msm	drm/msm: include linux/sched/task.h	2020-01-09 10:19:03 +01:00
mxsfb
nouveau	drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit	2020-01-09 10:18:57 +01:00
omapdrm	drm/omap: fix max fclk divider for omap36xx	2019-10-11 18:21:01 +02:00
panel	drm/panel: Add missing drm_panel_init() in panel drivers	2019-12-31 16:34:47 +01:00
pl111	drm/pl111: Initialize clock spinlock early	2019-06-15 11:54:00 +02:00
qxl	qxl: fix null-pointer crash during suspend	2019-11-20 18:45:56 +01:00
r128
radeon	drm/radeon: fix r1xx/r2xx register checker for POT textures	2019-12-21 10:57:43 +01:00
rcar-du	drm: rcar-du: add missing of_node_put	2019-04-05 22:33:10 +02:00
rockchip	drm/rockchip: Suspend DP late	2019-08-29 08:28:40 +02:00
savage	drm/savage: off by one in savage_bci_cmdbuf()	2018-07-04 14:27:01 +02:00
scheduler	drm/scheduler: fix param documentation	2018-08-09 11:57:39 -05:00
selftests
shmobile	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
sis
sti	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
stm	drm/stm: attach gem fence to atomic state	2019-10-07 18:56:31 +02:00
sun4i	drm/sun4i: hdmi: Remove duplicate cleanup calls	2020-01-09 10:18:59 +01:00
tdfx
tegra	drm/tegra: sor: Use correct SOR index on Tegra210	2019-12-31 16:35:27 +01:00
tilcdc	drm/tilcdc: Register cpufreq notifier after we have initialized crtc	2019-09-06 10:22:03 +02:00
tinydrm	tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers	2019-05-31 06:46:32 -07:00
ttm	drm/ttm: Restore ttm prefaulting	2019-10-29 09:19:54 +01:00
tve200
udl	drm/udl: move to embedding drm device inside udl device.	2019-07-21 09:03:18 +02:00
v3d	drm/v3d: Handle errors from IRQ setup.	2019-05-31 06:46:34 -07:00
vc4	drm/vc4: fix fb references in async update	2019-06-15 11:54:11 +02:00
vgem	drm/vgem: fix use-after-free when drm_gem_handle_create() fails	2019-04-03 06:26:26 +02:00
via
virtio	drm/virtio: Add memory barriers for capset cache.	2019-07-31 07:27:00 +02:00
vkms	drm/vkms: Bugfix extra vblank frame	2019-04-05 22:33:12 +02:00
vmwgfx	drm/vmwgfx: Fix double free in vmw_recv_msg()	2019-09-16 08:21:40 +02:00
xen
zte	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic_helper.c	drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors	2019-09-16 08:22:23 +02:00
drm_atomic.c	drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors	2019-09-16 08:22:23 +02:00
drm_auth.c	drm: set is_master to 0 upon drm_new_set_master() failure	2018-12-08 12:59:07 +01:00
drm_blend.c
drm_bridge.c
drm_bufs.c	drm: return -EFAULT if copy_to_user() fails	2019-07-14 08:11:14 +02:00
drm_cache.c
drm_client.c	drm/cma-helper: Fix crash in fbdev error path	2018-10-02 13:03:34 +02:00
drm_color_mgmt.c
drm_connector.c	drm/connector: Fix typo in drm_connector_list_iter_next()	2018-07-16 13:18:09 -04:00
drm_context.c	drm: re-enable error handling	2018-07-16 10:01:19 -04:00
drm_crtc_helper_internal.h
drm_crtc_helper.c
drm_crtc_internal.h	drm: drop _mode_ from remaining connector functions	2018-07-13 18:40:27 +02:00
drm_crtc.c	drm/lease: Make sure implicit planes are leased	2019-06-09 09:17:23 +02:00
drm_debugfs_crc.c	drm/crc-debugfs: Also sprinkle irqrestore over early exits	2019-07-31 07:26:59 +02:00
drm_debugfs.c	drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation	2018-09-17 19:24:37 -04:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c	drm_dp_cec.c: fix formatting typo: %pdH -> %phD	2018-07-28 15:50:40 -03:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c	drm/dp_helper: Add DP aux channel tracing	2018-07-16 11:47:53 -04:00
drm_dp_mst_topology.c	drm/mst: Fix MST sideband up-reply failure handling	2020-01-09 10:19:07 +01:00
drm_drv.c	drm/drv: Hold ref on parent device during drm_device lifetime	2019-05-31 06:46:34 -07:00
drm_dumb_buffers.c	drm-misc-next for 4.19:	2018-06-28 13:29:07 +10:00
drm_edid_load.c	drm/edid: Fix a missing-check bug in drm_load_edid_firmware()	2019-07-31 07:26:58 +02:00
drm_edid.c	drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50	2019-10-29 09:19:53 +01:00
drm_encoder_slave.c
drm_encoder.c
drm_fb_cma_helper.c	drm/cma-helper: Fix crash in fbdev error path	2018-10-02 13:03:34 +02:00
drm_fb_helper.c	drm/fb-helper: generic: Don't take module ref for fbcon	2019-07-10 09:53:45 +02:00
drm_file.c	drm: Wake up next in drm_read() chain if we are forced to putback the event	2019-05-31 06:46:34 -07:00
drm_flip_work.c
drm_fourcc.c	drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv	2018-07-18 16:56:45 +01:00
drm_framebuffer.c	drm: silence variable 'conn' set but not used	2019-08-16 10:12:46 +02:00
drm_gem_cma_helper.c
drm_gem_framebuffer_helper.c
drm_gem.c	drm/i915: Prevent writing into a read-only object via a GGTT mmap	2018-07-13 16:14:04 +01:00
drm_global.c	drm: add SPDX identifier and clarify license	2018-06-29 15:28:47 -05:00
drm_hashtab.c
drm_info.c
drm_internal.h	drm/lease: Send a distinct uevent	2018-12-13 09:16:21 +01:00
drm_ioc32.c	drm: add __user attribute to ptr_to_compat()	2019-09-16 08:22:08 +02:00
drm_ioctl.c	drm/ioctl: Fix Spectre v1 vulnerabilities	2018-12-29 13:37:59 +01:00
drm_irq.c
drm_kms_helper_common.c
drm_lease.c	drm: Use array_size() when creating lease	2019-02-20 10:25:49 +01:00
drm_legacy.h
drm_lock.c
drm_memory.c
drm_mipi_dsi.c	drm: Add support for pps and compression mode command packet	2018-07-25 07:51:05 -04:00
drm_mm.c
drm_mode_config.c
drm_mode_object.c	drm: Reorder set_property_atomic to avoid returning with an active ww_ctx	2019-03-27 14:14:42 +09:00
drm_modes.c	drm/modes: Prevent division by zero htotal	2019-02-15 08:10:12 +01:00
drm_modeset_helper.c
drm_modeset_lock.c	drm: Change deadlock-avoidance algorithm for the modeset locks.	2018-07-03 09:46:05 +02:00
drm_of.c	drm/doc: Include drm_of.c helpers	2018-07-13 18:40:28 +02:00
drm_panel_orientation_quirks.c	drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC	2019-09-19 09:09:39 +02:00
drm_panel.c	Revert "drm/panel: Add device_link from panel device to DRM device"	2018-09-27 11:00:42 -04:00
drm_pci.c	drm: drop drm_pcie_get_speed_cap_mask and drm_pcie_get_max_link_width	2018-07-05 16:40:00 -05:00
drm_plane_helper.c	drm: add missing ctx argument to plane transitional helpers	2018-07-03 09:30:19 +02:00
drm_plane.c	drm/lease: Make sure implicit planes are leased	2019-06-09 09:17:23 +02:00
drm_prime.c
drm_print.c	drm: Add puts callback for the coredump printer	2018-07-30 08:49:41 -04:00
drm_probe_helper.c	drm: Flush output polling on shutdown	2019-10-01 08:26:11 +02:00
drm_property.c	drm: limit to INT_MAX in create_blob ioctl	2020-01-09 10:18:59 +01:00
drm_rect.c
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c	drm: drop _mode_ from drm_mode_connector_attach_encoder	2018-07-13 18:40:27 +02:00
drm_syncobj.c	drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set	2018-09-26 10:39:14 -04:00
drm_sysfs.c	drm/lease: Send a distinct uevent	2018-12-13 09:16:21 +01:00
drm_trace_points.c
drm_trace.h
drm_vblank.c	drm/drm_vblank: Change EINVAL by the correct errno	2019-12-31 16:35:01 +01:00
drm_vm.c
drm_vma_manager.c	drm: add SPDX idenitifier and clarify license	2018-06-29 15:28:47 -05:00
drm_writeback.c	drm: writeback: Fix doc that says connector should be disconnected	2018-07-16 16:35:27 +01:00
Kconfig	drm/fb_helper: Allow leaking fbdev smem_start	2019-01-16 22:04:35 +01:00
Makefile	drm: add support for DisplayPort CEC-Tunneling-over-AUX	2018-07-13 17:58:19 +03:00