android_kernel_motorola_sm6375/drivers
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Huacai Chen b7ea85a4fe drm: fix a use-after-free when GPU acceleration disabled
When GPU acceleration is disabled, drm_vblank_cleanup() will free the
vblank-related data, such as vblank_refcount, vblank_inmodeset, etc.
But we found that drm_vblank_post_modeset() may be called after the
cleanup, which use vblank_refcount and vblank_inmodeset. And this will
cause a kernel panic.

Fix this by return immediately if dev->num_crtcs is zero. This is the
same thing that drm_vblank_pre_modeset() does.

Call trace of a drm_vblank_post_modeset() after drm_vblank_cleanup():
[   62.628906] [<ffffffff804868d0>] drm_vblank_post_modeset+0x34/0xb4
[   62.628906] [<ffffffff804c7008>] atombios_crtc_dpms+0xb4/0x174
[   62.628906] [<ffffffff804c70e0>] atombios_crtc_commit+0x18/0x38
[   62.628906] [<ffffffff8047f038>] drm_crtc_helper_set_mode+0x304/0x3cc
[   62.628906] [<ffffffff8047f92c>] drm_crtc_helper_set_config+0x6d8/0x988
[   62.628906] [<ffffffff8047dd40>] drm_fb_helper_set_par+0x94/0x104
[   62.628906] [<ffffffff80439d14>] fbcon_init+0x424/0x57c
[   62.628906] [<ffffffff8046a638>] visual_init+0xb8/0x118
[   62.628906] [<ffffffff8046b9f8>] take_over_console+0x238/0x384
[   62.628906] [<ffffffff80436df8>] fbcon_takeover+0x7c/0xdc
[   62.628906] [<ffffffff8024fa20>] notifier_call_chain+0x44/0x94
[   62.628906] [<ffffffff8024fcbc>] __blocking_notifier_call_chain+0x48/0x68
[   62.628906] [<ffffffff8042d990>] register_framebuffer+0x228/0x260
[   62.628906] [<ffffffff8047e010>] drm_fb_helper_single_fb_probe+0x260/0x314
[   62.628906] [<ffffffff8047e2c4>] drm_fb_helper_initial_config+0x200/0x234
[   62.628906] [<ffffffff804e5560>] radeon_fbdev_init+0xd4/0xf4
[   62.628906] [<ffffffff804e0e08>] radeon_modeset_init+0x9bc/0xa18
[   62.628906] [<ffffffff804bfc14>] radeon_driver_load_kms+0xdc/0x12c
[   62.628906] [<ffffffff8048b548>] drm_get_pci_dev+0x148/0x238
[   62.628906] [<ffffffff80423564>] local_pci_probe+0x5c/0xd0
[   62.628906] [<ffffffff80241ac4>] work_for_cpu_fn+0x1c/0x30
[   62.628906] [<ffffffff802427c8>] process_one_work+0x274/0x3bc
[   62.628906] [<ffffffff80242934>] process_scheduled_works+0x24/0x44
[   62.628906] [<ffffffff8024515c>] worker_thread+0x31c/0x3f4
[   62.628906] [<ffffffff802497a8>] kthread+0x88/0x90
[   62.628906] [<ffffffff80206794>] kernel_thread_helper+0x10/0x18

Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Binbin Zhou <zhoubb@lemote.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
Signed-off-by: Dave Airlie <airlied@gmail.com>
2013-06-03 19:12:04 +10:00
..
accessibility
acpi PCI updates for v3.10: 2013-05-23 13:50:53 -07:00
amba
ata drivers/ata: don't check resource with devm_ioremap_resource 2013-05-12 15:19:46 +02:00
atm
auxdisplay
base Driver core fixes for 3.10-rc2 2013-05-23 09:27:08 -07:00
bcma
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2013-05-15 13:36:19 -07:00
bluetooth
bus
cdrom
char char/misc driver fixes for 3.10-rc2 2013-05-23 09:26:32 -07:00
clk
clocksource
connector
cpufreq MIPS: Idle: Consolidate all declarations in <asm/idle.h>. 2013-05-22 01:34:27 +02:00
cpuidle
crypto
dca
devfreq
dio
dma drivers/dma: don't check resource with devm_ioremap_resource 2013-05-18 11:54:55 +02:00
edac
eisa
extcon
firewire
firmware
gpio drivers/gpio: don't check resource with devm_ioremap_resource 2013-05-18 11:55:19 +02:00
gpu drm: fix a use-after-free when GPU acceleration disabled 2013-06-03 19:12:04 +10:00
hid
hsi
hv Drivers: hv: Fix a bug in get_vp_index() 2013-05-21 09:56:55 -07:00
hwmon hwmon: (tmp401) Drop redundant safety on cache lifetime 2013-05-19 08:19:29 -07:00
hwspinlock
i2c Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2013-05-21 11:11:45 -07:00
ide
idle
iio iio: exynos_adc: fix wrong structure extration in suspend and resume 2013-05-22 22:15:20 +01:00
infiniband
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2013-05-23 13:50:03 -07:00
iommu
ipack
irqchip
isdn
leds leds: leds-gpio: reserve gpio before using it 2013-05-21 11:26:53 -07:00
lguest
macintosh
mailbox
md dm thin: fix metadata dev resize detection 2013-05-19 18:57:50 +01:00
media
memory drivers/memory: don't check resource with devm_ioremap_resource 2013-05-18 11:55:52 +02:00
memstick
message
mfd This is the first batch of MFD fixes for 3.10. 2013-05-22 07:18:41 -07:00
misc char/misc driver fixes for 3.10-rc2 2013-05-23 09:26:32 -07:00
mmc Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm 2013-05-15 13:37:54 -07:00
mtd drivers/mtd/nand: don't check resource with devm_ioremap_resource 2013-05-18 11:55:55 +02:00
net USB fixes for 3.10-rc2 2013-05-23 09:23:32 -07:00
nfc
ntb NTB: Multiple NTB client fix 2013-05-15 10:58:22 -07:00
nubus
of Device tree bug fixes and documentation updates for v3.10 2013-05-18 10:46:50 -07:00
oprofile
parisc
parport
pci PCI: acpiphp: Re-enumerate devices when host bridge receives Bus Check 2013-05-17 14:12:06 -06:00
pcmcia
pinctrl Pinctrl fixes for the v3.10 series: 2013-05-20 07:59:46 -07:00
platform
pnp
power
pps
ps3
ptp
pwm drivers/pwm: don't check resource with devm_ioremap_resource 2013-05-18 11:55:58 +02:00
rapidio
regulator
remoteproc
reset
rpmsg
rtc Merge branch 'devm_no_resource_check' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2013-05-18 10:54:54 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2013-05-21 09:36:46 -07:00
sbus
scsi
sfi
sh
sn
spi Merge branch 'devm_no_resource_check' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2013-05-18 10:54:54 -07:00
ssb
ssbi
staging Merge remote-tracking branch 'pfdo/drm-fixes' into drm-next 2013-05-24 10:12:22 +10:00
target Merge branch 'queue' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2013-05-16 07:55:07 -07:00
tc
thermal drivers/thermal: don't check resource with devm_ioremap_resource 2013-05-18 11:57:30 +02:00
tty tty: mxser: Fix build warning introduced by dfc7b837c7 (Re: linux-next: build warning after merge of the tty.current tree) 2013-05-22 10:26:02 -07:00
uio uio: UIO_DMEM_GENIRQ should depend on HAS_DMA 2013-05-21 10:13:23 -07:00
usb USB fixes for 3.10-rc2 2013-05-23 09:23:32 -07:00
uwb
vfio
vhost
video Staging driver fixes for 3.10-rc2 2013-05-23 09:27:49 -07:00
virt
virtio
vlynq
vme
w1 drivers/w1/masters: don't check resource with devm_ioremap_resource 2013-05-18 11:58:03 +02:00
watchdog drivers/watchdog: don't check resource with devm_ioremap_resource 2013-05-18 11:58:04 +02:00
xen xen: Fixed assignment error in if statement 2013-05-20 14:14:48 -04:00
zorro
Kconfig
Makefile