Re: [PATCH] fbdev: modedb: Fix kernel crash in fb_videomode_to_var()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 4/12/23 20:36, Daniel Vetter wrote:
On Fri, Mar 24, 2023 at 09:21:31PM +0100, Helge Deller wrote:
Fix a kernel crash in the fbdev modedb code which can happen if you boot
a system without any graphic card driver, in which case the dummycon
driver takes the console. If you then load a fbdev graphics driver and
start a the X11-fbdev the kernel will crash with a backtrace:

   IAOQ[0]: fb_videomode_to_var+0xc/0x88
  Backtrace:
   [<10582ff8>] display_to_var+0x28/0xe8
   [<1058584c>] fbcon_switch+0x15c/0x55c
   [<105a8a1c>] redraw_screen+0xdc/0x228
   [<1059d6f8>] complete_change_console+0x50/0x140
   [<1059eae0>] change_console+0x6c/0xdc
   [<105ab4f4>] console_callback+0x1a0/0x1a8
   [<101cb5e8>] process_one_work+0x1c4/0x3cc
   [<101cb978>] worker_thread+0x188/0x4b4
   [<101d5a94>] kthread+0xec/0xf4
   [<1018801c>] ret_from_kernel_thread+0x1c/0x24

The problem is, that the dummycon driver may not have a valid monitor
mode defined (which is ok for that driver), so the mode field in
fbcon_display can be NULL.

Fix the crash by simply returning from fb_var_to_videomode()
if the video mode field is NULL.

Signed-off-by: Helge Deller <deller@xxxxxx>
Cc: stable <stable@xxxxxxxxxx>

Also here since the other thread is private: I don't think this makes
sense, and it shouldn't happen that disp->mode is bogus when we have an
fbdev bound for that vc.

I think the below might work, I spotted this while auditing code around
this (but it turned out to be a dead-end for the bug I was chasing):

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index eb565a10e5cd..1f2ab00ec6d4 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2684,8 +2684,8 @@ static void fbcon_modechanged(struct fb_info *info)
  	p = &fb_display[vc->vc_num];
  	set_blitting_type(vc, info);

+	var_to_display(p, &info->var, info);
  	if (con_is_visible(vc)) {
-		var_to_display(p, &info->var, info);
  		cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
  		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
  		cols /= vc->vc_font.width;

If this works I can bake it into a real patch.

Daniel, thanks for your suggested patch!
Actually I currently can't reproduce my original problem any longer.
It happened with a specific fbdev driver which I'm currenlty working on, and
in which I probably missed to set a valid video mode, which then led to the patch
I originally sent.
So, for now just ignore my patch.

If it happens again I'll test your patch and report back.

Thanks!
Helge




[Index of Archives]     [Linux SoC]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux