Lyude Paul ea1de53090 drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() ... [ Upstream commit 63237f8748 ] [why] Removing connector reusage from DM to match the rest of the tree ended up revealing an issue that was surprisingly subtle. The original amdgpu code for DC that was submitted appears to have left a chunk in dm_dp_create_fake_mst_encoder() that tries to find a "master encoder", the likes of which isn't actually used or stored anywhere. It does so at the wrong time as well by trying to access parts of the drm_connector from the encoder init before it's actually been initialized. This results in a NULL pointer deref on MST hotplugs: [ 160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 160.697234] PGD 0 P4D 0 [ 160.697814] Oops: 0010 [#1] SMP PTI [ 160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G O 4.19.0Lyude-Test+ #2 [ 160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018 [ 160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper] [ 160.700322] RIP: 0010: (null) [ 160.700920] Code: Bad RIP value. [ 160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206 [ 160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158 [ 160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000 [ 160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25 [ 160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000 [ 160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000 [ 160.705260] FS: 0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000 [ 160.705854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0 [ 160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.708372] Call Trace: [ 160.708998] ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu] [ 160.709625] ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper] [ 160.710284] ? wake_up_q+0x54/0x70 [ 160.710877] ? __mutex_unlock_slowpath.isra.18+0xb3/0x110 [ 160.711512] ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper] [ 160.712161] ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper] [ 160.712762] ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper] [ 160.713408] ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper] [ 160.714013] ? process_one_work+0x1a1/0x3a0 [ 160.714667] ? worker_thread+0x30/0x380 [ 160.715326] ? wq_update_unbound_numa+0x10/0x10 [ 160.715939] ? kthread+0x112/0x130 [ 160.716591] ? kthread_create_worker_on_cpu+0x70/0x70 [ 160.717262] ? ret_from_fork+0x35/0x40 [ 160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu] [ 160.720141] CR2: 0000000000000000 Somehow the connector reusage DM was using for MST connectors managed to paper over this issue entirely; hence why this was never caught until now. [how] Since this code isn't used anywhere and seems useless anyway, we can just drop it entirely. This appears to fix the issue on my HP ZBook with an AMD WX4150. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2018-11-27 16:13:05 +01:00
..
amd	drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder()	2018-11-27 16:13:05 +01:00
arc
arm	drm/malidp: Fix writeback in NV12	2018-09-21 10:55:00 +01:00
armada	drm/armada: remove obsolete fb unreferencing kfifo and workqueue	2018-07-30 11:53:06 +01:00
ast
atmel-hlcdc
bochs
bridge	drm pull for 4.19-rc1	2018-08-15 17:39:07 -07:00
cirrus
etnaviv	drm/etnaviv: fix bogus fence complete check in timeout handler	2018-11-21 09:19:25 +01:00
exynos	Revert "drm/exynos/decon5433: implement frame counter"	2018-11-27 16:13:04 +01:00
fsl-dcu
gma500	drivers/gpu/drm/gma500/: change return type to vm_fault_t	2018-08-23 18:48:43 -07:00
hisilicon	drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer	2018-11-21 09:19:10 +01:00
i2c	Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes	2018-10-04 10:32:14 +10:00
i810
i915	drm/i915: Replace some PAGE_SIZE with I915_GTT_PAGE_SIZE	2018-11-27 16:12:58 +01:00
imx	drm/imx: use suspend/resume helpers, add ipu-v3 V4L2 XRGB32/XBGR32 support	2018-08-10 11:13:36 +10:00
lib
mediatek	drm/mediatek: fix OF sibling-node lookup	2018-11-13 11:08:54 -08:00
meson
mga
mgag200
msm	drm/msm: fix OF child-node lookup	2018-11-21 09:19:15 +01:00
mxsfb
nouveau	drm/nouveau: Fix nv50_mstc->best_encoder()	2018-11-21 09:19:25 +01:00
omapdrm	drm/omap: fix memory barrier bug in DMM driver	2018-11-21 09:19:10 +01:00
panel	drm/panel: simple: tv123wam: Add unprepare delay	2018-08-14 13:42:37 -04:00
pl111	drm/pl111: Make sure of_device_id tables are NULL terminated	2018-09-10 16:01:22 -04:00
qxl
r128
radeon	mm, oom: distinguish blockable mode for mmu notifiers	2018-08-22 10:52:44 -07:00
rcar-du	drm: rcar-du: Update Gen3 output limitations	2018-11-21 09:19:11 +01:00
rockchip	drm/rockchip: Allow driver to be shutdown on reboot/kexec	2018-11-21 09:19:25 +01:00
savage
scheduler	drm/scheduler: fix param documentation	2018-08-09 11:57:39 -05:00
selftests
shmobile
sis
sti
stm
sun4i	drm/sun4i: Fix an ulong overflow in the dotclock driver	2018-10-19 11:50:25 +02:00
tdfx
tegra	drm pull for 4.19-rc1	2018-08-15 17:39:07 -07:00
tilcdc
tinydrm
ttm	drm/ttm: clean up non-x86 definitions on ttm_tt	2018-08-01 17:23:56 -05:00
tve200
udl	drm: udl: Destroy framebuffer only if it was initialized	2018-09-10 16:02:51 -04:00
v3d	drm/scheduler: modify API to avoid redundancy	2018-07-25 15:06:19 -05:00
vc4	drm/vc4: Fix the "no scaling" case on multi-planar YUV formats	2018-09-10 16:01:22 -04:00
vgem
via
virtio
vkms	drm/vkms: Fix connector leak at the module removal	2018-07-28 16:09:39 -03:00
vmwgfx	drm/vmwgfx: Fix buffer object eviction	2018-09-20 08:05:14 +02:00
xen
zte
ati_pcigart.c
drm_agpsupport.c
drm_atomic_helper.c	drm: Get ref on CRTC commit object when waiting for flip_done	2018-10-18 14:23:13 -04:00
drm_atomic.c	drm: Get ref on CRTC commit object when waiting for flip_done	2018-10-18 14:23:13 -04:00
drm_auth.c
drm_blend.c
drm_bridge.c
drm_bufs.c
drm_cache.c
drm_client.c	drm/cma-helper: Fix crash in fbdev error path	2018-10-02 13:03:34 +02:00
drm_color_mgmt.c
drm_connector.c
drm_context.c
drm_crtc_helper_internal.h
drm_crtc_helper.c
drm_crtc_internal.h
drm_crtc.c	drm: fix use of freed memory in drm_mode_setcrtc	2018-10-05 15:55:17 +03:00
drm_debugfs_crc.c
drm_debugfs.c	drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation	2018-09-17 19:24:37 -04:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c	drm_dp_cec.c: fix formatting typo: %pdH -> %phD	2018-07-28 15:50:40 -03:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c
drm_dp_mst_topology.c	drm/dp_mst: Check if primary mstb is null	2018-11-21 09:19:26 +01:00
drm_drv.c
drm_dumb_buffers.c
drm_edid_load.c
drm_edid.c	drm/edid: Add 6 bpc quirk for BOE panel.	2018-11-27 16:12:59 +01:00
drm_encoder_slave.c
drm_encoder.c
drm_fb_cma_helper.c	drm/cma-helper: Fix crash in fbdev error path	2018-10-02 13:03:34 +02:00
drm_fb_helper.c	drm: fb-helper: Reject all pixel format changing requests	2018-10-04 12:48:16 +02:00
drm_file.c
drm_flip_work.c
drm_fourcc.c
drm_framebuffer.c
drm_gem_cma_helper.c
drm_gem_framebuffer_helper.c
drm_gem.c
drm_global.c
drm_hashtab.c
drm_info.c
drm_internal.h
drm_ioc32.c
drm_ioctl.c
drm_irq.c
drm_kms_helper_common.c
drm_lease.c	drm: fix use-after-free read in drm_mode_create_lease_ioctl()	2018-10-02 10:22:10 +02:00
drm_legacy.h
drm_lock.c
drm_memory.c
drm_mipi_dsi.c
drm_mm.c
drm_mode_config.c
drm_mode_object.c
drm_modes.c
drm_modeset_helper.c
drm_modeset_lock.c
drm_of.c
drm_panel_orientation_quirks.c	drm: panel-orientation-quirks: Add quirk for Acer One 10 (S1003)	2018-11-21 09:19:26 +01:00
drm_panel.c	Revert "drm/panel: Add device_link from panel device to DRM device"	2018-09-27 11:00:42 -04:00
drm_pci.c
drm_plane_helper.c
drm_plane.c
drm_prime.c
drm_print.c	drm: Add puts callback for the coredump printer	2018-07-30 08:49:41 -04:00
drm_probe_helper.c
drm_property.c
drm_rect.c
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c
drm_syncobj.c	drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set	2018-09-26 10:39:14 -04:00
drm_sysfs.c
drm_trace_points.c
drm_trace.h
drm_vblank.c
drm_vm.c
drm_vma_manager.c
drm_writeback.c
Kconfig
Makefile