kernel/linux.git/drivers/gpu/drm/drm_dp_aux_dev.c, branch v5.10.257

drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()

2020-12-30T10:54:19+00:00

commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream. I observed this when unplugging a DP monitor whilst a computer is asleep and then waking it up. This left DP chardev nodes still being present on the filesystem and accessing these device nodes caused an oops because drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened. This can also be reproduced by creating a device node with mknod(1) and issuing an open(2) [166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018 [166164.933202] #PF: supervisor read access in kernel mode [166164.933204] #PF: error_code(0x0000) - not-present page [166164.933205] PGD 0 P4D 0 [166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI [166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G W 5.8.0-rc6+ #1 [166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W (1.11 ) 04/21/2020 [166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70 [drm_kms_helper] [166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7 c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6 <8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1 [166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246 [166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000 [166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180 [166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0 [166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003 [166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000 [166164.933244] FS: 00007f7fb041eb00(0000) GS:ffff8a9411500000(0000) knlGS:0000000000000000 [166164.933245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0 [166164.933247] Call Trace: [166164.933264] auxdev_open+0x1b/0x40 [drm_kms_helper] [166164.933278] chrdev_open+0xa7/0x1c0 [166164.933282] ? cdev_put.part.0+0x20/0x20 [166164.933287] do_dentry_open+0x161/0x3c0 [166164.933291] vfs_open+0x2d/0x30 [166164.933297] path_openat+0xb27/0x10e0 [166164.933306] ? atime_needs_update+0x73/0xd0 [166164.933309] do_filp_open+0x91/0x100 [166164.933313] ? __alloc_fd+0xb2/0x150 [166164.933316] do_sys_openat2+0x210/0x2d0 [166164.933318] do_sys_open+0x46/0x80 [166164.933320] __x64_sys_openat+0x20/0x30 [166164.933328] do_syscall_64+0x52/0xc0 [166164.933336] entry_SYSCALL_64_after_hwframe+0x44/0xa9 (gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29 Dump of assembler code for function drm_dp_aux_dev_get_by_minor: 0x0000000000017b10 <+0>: callq 0x17b15 0x0000000000017b15 <+5>: push %rbp 0x0000000000017b16 <+6>: mov %rsp,%rbp 0x0000000000017b19 <+9>: push %r12 0x0000000000017b1b <+11>: mov %edi,%r12d 0x0000000000017b1e <+14>: mov $0x0,%rdi 0x0000000000017b25 <+21>: callq 0x17b2a 0x0000000000017b2a <+26>: mov %r12d,%esi 0x0000000000017b2d <+29>: mov $0x0,%rdi 0x0000000000017b34 <+36>: callq 0x17b39 0x0000000000017b39 <+41>: mov 0x18(%rax),%edx <========= 0x0000000000017b3c <+44>: mov %rax,%r12 0x0000000000017b3f <+47>: lea 0x18(%rax),%rdi 0x0000000000017b43 <+51>: test %edx,%edx 0x0000000000017b45 <+53>: je 0x17b7a 0x0000000000017b47 <+55>: lea 0x1(%rdx),%ecx 0x0000000000017b4a <+58>: mov %edx,%eax 0x0000000000017b4c <+60>: lock cmpxchg %ecx,(%rdi) 0x0000000000017b50 <+64>: jne 0x17b76 0x0000000000017b52 <+66>: test %edx,%edx 0x0000000000017b54 <+68>: js 0x17b6d 0x0000000000017b56 <+70>: test %ecx,%ecx 0x0000000000017b58 <+72>: js 0x17b6d 0x0000000000017b5a <+74>: mov $0x0,%rdi 0x0000000000017b61 <+81>: callq 0x17b66 0x0000000000017b66 <+86>: mov %r12,%rax 0x0000000000017b69 <+89>: pop %r12 0x0000000000017b6b <+91>: pop %rbp 0x0000000000017b6c <+92>: retq 0x0000000000017b6d <+93>: xor %esi,%esi 0x0000000000017b6f <+95>: callq 0x17b74 0x0000000000017b74 <+100>: jmp 0x17b5a 0x0000000000017b76 <+102>: mov %eax,%edx 0x0000000000017b78 <+104>: jmp 0x17b43 0x0000000000017b7a <+106>: xor %r12d,%r12d 0x0000000000017b7d <+109>: jmp 0x17b5a End of assembler dump. (gdb) list *drm_dp_aux_dev_get_by_minor+0x29 0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65). 60 static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index) 61 { 62 struct drm_dp_aux_dev *aux_dev = NULL; 63 64 mutex_lock(&aux_idr_mutex); 65 aux_dev = idr_find(&aux_idr, index); 66 if (!kref_get_unless_zero(&aux_dev->refcount)) 67 aux_dev = NULL; 68 mutex_unlock(&aux_idr_mutex); 69 (gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount $8 = 0x18 Looking at the caller, checks on the minor are pushed down to drm_dp_aux_dev_get_by_minor() static int auxdev_open(struct inode *inode, struct file *file) { unsigned int minor = iminor(inode); struct drm_dp_aux_dev *aux_dev; aux_dev = drm_dp_aux_dev_get_by_minor(minor); <==== if (!aux_dev) return -ENODEV; file->private_data = aux_dev; return 0; } Fixes: e94cb37b34eb ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.") Cc: # v4.6+ Signed-off-by: Zwane Mwaikambo Reviewed-by: Lyude Paul [added Cc to stable] Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home Signed-off-by: Greg Kroah-Hartman

drm/dp_mst: Add MST support to DP DPCD R/W functions

2020-01-09T23:07:46+00:00

Instead of having drm_dp_dpcd_read/write and drm_dp_mst_dpcd_read/write as entry points into the aux code, have drm_dp_dpcd_read/write handle both. This means that DRM drivers can make MST DPCD read/writes. v2: Fix spacing v3: Dump dpcd access on MST read/writes v4: Fix calling wrong function on DPCD write v5: delete deprecated include of drmP.h Reviewed-by: Lyude Paul Reviewed-by: Harry Wentland Signed-off-by: David Francis Signed-off-by: Mikita Lipski Signed-off-by: Alex Deucher

drm/dp_mst: Enable registration of AUX devices for MST ports

2019-07-25T20:39:35+00:00

All available downstream ports - physical and logical - are exposed for each MST device. They are listed in /dev/, following the same naming scheme as SST devices by appending an incremental ID. Although all downstream ports are exposed, only some will work as expected. Consider the following topology: +---------+ | ASIC | +---------+ Conn-0| | +----v----+ +----| MST HUB |----+ | +---------+ | | | |Port-1 Port-2| +-----v-----+ +-----v-----+ | MST | | SST | | Display | | Display | +-----------+ +-----------+ |Port-1 x MST Path | MST Device ----------+---------------------------------- sst:0 | MST Hub mst:0-1 | MST Display mst:0-1-1 | MST Display's disconnected DP out mst:0-1-8 | MST Display's internal sink mst:0-2 | SST Display On certain MST displays, the upstream physical port will ACK DPCD reads. However, reads on the local logical port to the internal sink will *NAK*. i.e. reading mst:0-1 ACKs, but mst:0-1-8 NAKs. There may also be duplicates. Some displays will return the same GUID when reading DPCD from both mst:0-1 and mst:0-1-8. There are some device-dependent behavior as well. The MST hub used during testing will actually *ACK* read requests on a disconnected physical port, whereas the MST displays will NAK. In light of these discrepancies, it's simpler to expose all downstream ports - both physical and logical - and let the user decide what to use. v3 changes: * Change WARN_ON_ONCE -> DRM_ERROR on dpcd read errors * Docstring and cosmetic fixes v2 changes: Moved remote aux device (un)registration to new mst connector late register and early unregister helpers. Drivers should call these from their own mst connector function hooks. This is to solve an issue during driver unload, where mst connector devices are unregistered before the remote aux devices are. In a setup where aux devices are created as children of connector devices, the aux device would be removed too early, and uncleanly. Doing so in early_unregister solves this issue, as that is called before connector unregistration. Signed-off-by: Ville Syrjälä Signed-off-by: Leo Li Reviewed-by: Lyude Paul Signed-off-by: Harry Wentland Link: https://patchwork.freedesktop.org/patch/msgid/20190723232808.28128-3-sunpeng.li@amd.com

drm/dp: Use non-cyclic idr

2019-07-25T20:19:19+00:00

In preparation for adding aux devices for DP MST, make the IDR non-cyclic. That way, hotplug cycling MST devices won't needlessly increment the minor version index. Signed-off-by: Leo Li Reviewed-by: Lyude Paul Reviewed-by: Ville Syrjälä Signed-off-by: Harry Wentland Link: https://patchwork.freedesktop.org/patch/msgid/20190723232808.28128-2-sunpeng.li@amd.com

drm/dp: drmP.h include removal

2019-05-06T13:00:48+00:00

Continue to get rid of drmP.h. Add minimal includes to build. Sort includes while at it. Reviewed-by: Noralf Trønnes Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190506095248.20874-1-jani.nikula@intel.com

sched/wait, drivers/drm: Convert wait_on_atomic_t() usage to the new wait_var_event() API

2018-03-20T07:23:18+00:00

The old wait_on_atomic_t() is going to get removed, use the more flexible wait_var_event() API instead. Unlike wake_up_atomic_t(), wake_up_var() will issue the wakeup even if the variable is not 0. No change in functionality. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chris Wilson Cc: Daniel Vetter Cc: David Airlie Cc: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar

Pass mode to wait_on_atomic_t() action funcs and provide default actions

2017-11-13T15:38:16+00:00

Make wait_on_atomic_t() pass the TASK_* mode onto its action function as an extra argument and make it 'unsigned int throughout. Also, consolidate a bunch of identical action functions into a default function that can do the appropriate thing for the mode. Also, change the argument name in the bit_wait*() function declarations to reflect the fact that it's the mode and not the bit number. [Peter Z gives this a grudging ACK, but thinks that the whole atomic_t wait should be done differently, though he's not immediately sure as to how] Signed-off-by: David Howells Acked-by: Peter Zijlstra cc: Ingo Molnar

drm_dp_aux_dev: switch to read_iter/write_iter

2017-07-09T00:51:46+00:00

Signed-off-by: Al Viro

drm: Don't export dp-aux devnode functions

2016-08-16T16:49:26+00:00

They're only used internally within the dp helpers. Also nuke the kerneldoc (we only document the driver interface in the drm shared functions). And move the header file from the public include/ directory to the source files into drm_crtc_helper_internal.h, similar to how we already have drm_crtc_internal.h. While at it also move drm_fb_helper_modinit since that belongs in there, too. I noticed this all since I spotted kerneldoc which wasn't pulled into the rst templates. v2: Update Copyright date. Cc: Sean Paul Cc: Rafael Antognolli Reviewed-by: Sean Paul Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1471034937-651-16-git-send-email-daniel.vetter@ffwll.ch

drm_aux-dev: fix error handling in drm_dp_aux_dev_init()

2016-07-12T12:10:57+00:00

If class_create() fails, there is no need for class_destroy(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1467237135-13075-1-git-send-email-khoroshilov@ispras.ru