This is a bug found by the 0day kernel test robot. When drm is
compiled into the kernel, and register_chrdev fails (due, in this, case
to overfilling the chardev dynamic major numbers), a kernel panic
occurs on boot:
BUG: unable to handle kernel NULL pointer dereference at
00000000000000a8
IP: down_write+0x2a/0x53
Call Trace:
start_creating+0x67/0x12e
debugfs_create_dir+0x12/0x189
drm_debugfs_init+0x7c/0x1b7
? ___might_sleep+0x172/0x192
? __might_sleep+0x6b/0xef
drm_minor_register+0x6b/0x141
drm_dev_register+0xcd/0x315
? pci_enable_device_flags+0x117/0x177
drm_get_pci_dev+0x106/0x27a
cirrus_pci_probe+0xfb/0x125
pci_device_probe+0x11d/0x185
...
This is because when register_chrdev fails, it removes drm_debugfs_root.
However, seeing drm is not a module, nothing prevents other code from
calling drm_minor_register after drm_core_init failed and thus using an
invalid drm_debugfs_root.
This commit fixes this issue by setting drm_debugfs_root to NULL after
removal and checking that it's not NULL before using it.
Signed-off-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>
Cc: Daniel Vetter <daniel.vetter@xxxxxxxxx>
Cc: Jani Nikula <jani.nikula@xxxxxxxxxxxxxxx>
Cc: Sean Paul <seanpaul@xxxxxxxxxxxx>
Cc: David Airlie <airlied@xxxxxxxx>
Link: https://lkml.org/lkml/2017/6/4/107
---
drivers/gpu/drm/drm_drv.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 37b8ad3e30d8..904420304b75 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -214,6 +214,9 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type)
DRM_DEBUG("\n");
+ if (!drm_debugfs_root)
+ return -ENODEV;
+
minor = *drm_minor_get_slot(dev, type);
if (!minor)
return 0;
@@ -935,6 +938,7 @@ static void drm_core_exit(void)
{
unregister_chrdev(DRM_MAJOR, "drm");
debugfs_remove(drm_debugfs_root);
+ drm_debugfs_root = NULL;
drm_sysfs_destroy();
idr_destroy(&drm_minors_idr);
drm_connector_ida_destroy();
--
2.11.0
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
