This is a bug found by the 0day kernel test robot. When drm is compiled into the kernel, and register_chrdev fails (due, in this, case to overfilling the chardev dynamic major numbers), a kernel panic occurs on boot: BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: down_write+0x2a/0x53 Call Trace: start_creating+0x67/0x12e debugfs_create_dir+0x12/0x189 drm_debugfs_init+0x7c/0x1b7 ? ___might_sleep+0x172/0x192 ? __might_sleep+0x6b/0xef drm_minor_register+0x6b/0x141 drm_dev_register+0xcd/0x315 ? pci_enable_device_flags+0x117/0x177 drm_get_pci_dev+0x106/0x27a cirrus_pci_probe+0xfb/0x125 pci_device_probe+0x11d/0x185 ... This is because when register_chrdev fails, it removes drm_debugfs_root. However, seeing drm is not a module, nothing prevents other code from calling drm_minor_register after drm_core_init failed and thus using an invalid drm_debugfs_root. This commit fixes this issue by setting drm_debugfs_root to NULL after removal and checking that it's not NULL before using it. Signed-off-by: Logan Gunthorpe <logang@xxxxxxxxxxxx> Cc: Daniel Vetter <daniel.vetter@xxxxxxxxx> Cc: Jani Nikula <jani.nikula@xxxxxxxxxxxxxxx> Cc: Sean Paul <seanpaul@xxxxxxxxxxxx> Cc: David Airlie <airlied@xxxxxxxx> Link: https://lkml.org/lkml/2017/6/4/107 --- drivers/gpu/drm/drm_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 37b8ad3e30d8..904420304b75 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -214,6 +214,9 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type) DRM_DEBUG("\n"); + if (!drm_debugfs_root) + return -ENODEV; + minor = *drm_minor_get_slot(dev, type); if (!minor) return 0; @@ -935,6 +938,7 @@ static void drm_core_exit(void) { unregister_chrdev(DRM_MAJOR, "drm"); debugfs_remove(drm_debugfs_root); + drm_debugfs_root = NULL; drm_sysfs_destroy(); idr_destroy(&drm_minors_idr); drm_connector_ida_destroy(); -- 2.11.0 _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel