From owner-svn-src-stable-10@FreeBSD.ORG Tue Apr 28 12:02:25 2015 Return-Path: Delivered-To: svn-src-stable-10@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E04EDA61; Tue, 28 Apr 2015 12:02:24 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id CD5ED12F4; Tue, 28 Apr 2015 12:02:24 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t3SC2OHx039158; Tue, 28 Apr 2015 12:02:24 GMT (envelope-from dumbbell@FreeBSD.org) Received: (from dumbbell@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t3SC2OJK039157; Tue, 28 Apr 2015 12:02:24 GMT (envelope-from dumbbell@FreeBSD.org) Message-Id: <201504281202.t3SC2OJK039157@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: dumbbell set sender to dumbbell@FreeBSD.org using -f From: Jean-Sebastien Pedron Date: Tue, 28 Apr 2015 12:02:24 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r282140 - stable/10/sys/dev/drm2 X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2015 12:02:25 -0000 Author: dumbbell Date: Tue Apr 28 12:02:24 2015 New Revision: 282140 URL: https://svnweb.freebsd.org/changeset/base/282140 Log: drm: Import Linux commit b7ea85a4fed37835eec78a7be3039c8dc22b8178 Author: Huacai Chen Date: Tue May 21 06:23:43 2013 +0000 drm: fix a use-after-free when GPU acceleration disabled When GPU acceleration is disabled, drm_vblank_cleanup() will free the vblank-related data, such as vblank_refcount, vblank_inmodeset, etc. But we found that drm_vblank_post_modeset() may be called after the cleanup, which use vblank_refcount and vblank_inmodeset. And this will cause a kernel panic. Fix this by return immediately if dev->num_crtcs is zero. This is the same thing that drm_vblank_pre_modeset() does. Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup(): [ 62.628906] [] drm_vblank_post_modeset+0x34/0xb4 [ 62.628906] [] atombios_crtc_dpms+0xb4/0x174 [ 62.628906] [] atombios_crtc_commit+0x18/0x38 [ 62.628906] [] drm_crtc_helper_set_mode+0x304/0x3cc [ 62.628906] [] drm_crtc_helper_set_config+0x6d8/0x988 [ 62.628906] [] drm_fb_helper_set_par+0x94/0x104 [ 62.628906] [] fbcon_init+0x424/0x57c [ 62.628906] [] visual_init+0xb8/0x118 [ 62.628906] [] take_over_console+0x238/0x384 [ 62.628906] [] fbcon_takeover+0x7c/0xdc [ 62.628906] [] notifier_call_chain+0x44/0x94 [ 62.628906] [] __blocking_notifier_call_chain+0x48/0x68 [ 62.628906] [] register_framebuffer+0x228/0x260 [ 62.628906] [] drm_fb_helper_single_fb_probe+0x260/0x314 [ 62.628906] [] drm_fb_helper_initial_config+0x200/0x234 [ 62.628906] [] radeon_fbdev_init+0xd4/0xf4 [ 62.628906] [] radeon_modeset_init+0x9bc/0xa18 [ 62.628906] [] radeon_driver_load_kms+0xdc/0x12c [ 62.628906] [] drm_get_pci_dev+0x148/0x238 [ 62.628906] [] local_pci_probe+0x5c/0xd0 [ 62.628906] [] work_for_cpu_fn+0x1c/0x30 [ 62.628906] [] process_one_work+0x274/0x3bc [ 62.628906] [] process_scheduled_works+0x24/0x44 [ 62.628906] [] worker_thread+0x31c/0x3f4 [ 62.628906] [] kthread+0x88/0x90 [ 62.628906] [] kernel_thread_helper+0x10/0x18 Signed-off-by: Huacai Chen Signed-off-by: Binbin Zhou Cc: Reviewed-by: Michel Dänzer Acked-by: Paul Menzel Signed-off-by: Dave Airlie Reported by: J.R. Oldroyd MFC of: r279599 Modified: stable/10/sys/dev/drm2/drm_irq.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/dev/drm2/drm_irq.c ============================================================================== --- stable/10/sys/dev/drm2/drm_irq.c Tue Apr 28 11:03:47 2015 (r282139) +++ stable/10/sys/dev/drm2/drm_irq.c Tue Apr 28 12:02:24 2015 (r282140) @@ -883,7 +883,7 @@ void drm_vblank_off(struct drm_device *d */ void drm_vblank_pre_modeset(struct drm_device *dev, int crtc) { - /* vblank is not initialized (IRQ not installed ?) */ + /* vblank is not initialized (IRQ not installed ?), or has been freed */ if (!dev->num_crtcs) return; /* @@ -902,6 +902,9 @@ void drm_vblank_pre_modeset(struct drm_d void drm_vblank_post_modeset(struct drm_device *dev, int crtc) { + /* vblank is not initialized (IRQ not installed ?), or has been freed */ + if (!dev->num_crtcs) + return; if (dev->vblank_inmodeset[crtc]) { mtx_lock(&dev->vbl_lock);