mirror of
https://github.com/torvalds/linux.git
synced 2026-04-21 08:13:56 -04:00
gud_plane_atomic_update() currently handles both crtc state and framebuffer updates - the complexity has led to a few accidental NULL pointer dereferences. Commitdc2d5ddb19("drm/gud: fix NULL fb and crtc dereferences on USB disconnect") [1] fixed an earlier dereference but planes can also be disabled in non-hotplug paths (e.g. display disables via the desktop environment). The drm_dev_enter() call would not cause an early return in those and subsequently oops on dereferencing crtc: BUG: kernel NULL pointer dereference, address: 00000000000005c8 CPU: 6 UID: 1000 PID: 3473 Comm: kwin_wayland Not tainted 6.18.2-200.vanilla.gud.fc42.x86_64 #1 PREEMPT(lazy) RIP: 0010:gud_plane_atomic_update+0x148/0x470 [gud] <TASK> drm_atomic_helper_commit_planes+0x28e/0x310 drm_atomic_helper_commit_tail+0x2a/0x70 commit_tail+0xf1/0x150 drm_atomic_helper_commit+0x13c/0x180 drm_atomic_commit+0xb1/0xe0 info ? __pfx___drm_printfn_info+0x10/0x10 drm_mode_atomic_ioctl+0x70f/0x7c0 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 drm_ioctl_kernel+0xae/0x100 drm_ioctl+0x2a8/0x550 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x7e/0x7f0 ? __ct_user_enter+0x56/0xd0 ? do_syscall_64+0x158/0x7f0 ? __ct_user_enter+0x56/0xd0 ? do_syscall_64+0x158/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Split out crtc handling from gud_plane_atomic_update() into atomic_enable() and atomic_disable() functions to delegate crtc state transitioning work to the DRM helpers. To preserve the gud state commit sequence [2], switch to the runtime PM version of drm_atomic_helper_commit_tail() which ensures that crtcs are enabled (hence sending the GUD_REQ_SET_CONTROLLER_ENABLE and GUD_REQ_SET_DISPLAY_ENABLE requests) before a framebuffer update is sent. [1] https://lore.kernel.org/all/20251231055039.44266-1-me@shenghaoyang.info/ [2] https://github.com/notro/gud/wiki/GUD-Protocol#display-state Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202601142159.0v8ilfVs-lkp@intel.com/ Fixes:73cfd166e0("drm/gud: Replace simple display pipe with DRM atomic helpers") Cc: <stable@vger.kernel.org> # 6.19.x Cc: <stable@vger.kernel.org> # 6.18.x Signed-off-by: Shenghao Yang <me@shenghaoyang.info> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Ruben Wauters <rubenru09@aol.com> Signed-off-by: Ruben Wauters <rubenru09@aol.com> Link: https://patch.msgid.link/20260222054551.80864-1-me@shenghaoyang.info
172 lines
4.9 KiB
C
172 lines
4.9 KiB
C
/* SPDX-License-Identifier: MIT */
|
|
|
|
#ifndef __LINUX_GUD_INTERNAL_H
|
|
#define __LINUX_GUD_INTERNAL_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <linux/usb.h>
|
|
#include <linux/workqueue.h>
|
|
#include <uapi/drm/drm_fourcc.h>
|
|
|
|
#include <drm/drm_modes.h>
|
|
|
|
struct gud_device {
|
|
struct drm_device drm;
|
|
struct drm_plane plane;
|
|
struct drm_crtc crtc;
|
|
struct work_struct work;
|
|
u32 flags;
|
|
const struct drm_format_info *xrgb8888_emulation_format;
|
|
|
|
u16 *properties;
|
|
unsigned int num_properties;
|
|
|
|
unsigned int bulk_pipe;
|
|
void *bulk_buf;
|
|
size_t bulk_len;
|
|
struct sg_table bulk_sgt;
|
|
|
|
u8 compression;
|
|
void *lz4_comp_mem;
|
|
void *compress_buf;
|
|
|
|
u64 stats_length;
|
|
u64 stats_actual_length;
|
|
unsigned int stats_num_errors;
|
|
|
|
struct mutex ctrl_lock; /* Serialize get/set and status transfers */
|
|
|
|
struct mutex damage_lock; /* Protects the following members: */
|
|
struct drm_framebuffer *fb;
|
|
struct drm_rect damage;
|
|
bool prev_flush_failed;
|
|
void *shadow_buf;
|
|
};
|
|
|
|
static inline struct gud_device *to_gud_device(struct drm_device *drm)
|
|
{
|
|
return container_of(drm, struct gud_device, drm);
|
|
}
|
|
|
|
static inline struct usb_device *gud_to_usb_device(struct gud_device *gdrm)
|
|
{
|
|
return interface_to_usbdev(to_usb_interface(gdrm->drm.dev));
|
|
}
|
|
|
|
int gud_usb_get(struct gud_device *gdrm, u8 request, u16 index, void *buf, size_t len);
|
|
int gud_usb_set(struct gud_device *gdrm, u8 request, u16 index, void *buf, size_t len);
|
|
int gud_usb_get_u8(struct gud_device *gdrm, u8 request, u16 index, u8 *val);
|
|
int gud_usb_set_u8(struct gud_device *gdrm, u8 request, u8 val);
|
|
|
|
void gud_clear_damage(struct gud_device *gdrm);
|
|
void gud_flush_work(struct work_struct *work);
|
|
void gud_crtc_atomic_enable(struct drm_crtc *crtc,
|
|
struct drm_atomic_state *state);
|
|
void gud_crtc_atomic_disable(struct drm_crtc *crtc,
|
|
struct drm_atomic_state *state);
|
|
int gud_plane_atomic_check(struct drm_plane *plane,
|
|
struct drm_atomic_state *state);
|
|
void gud_plane_atomic_update(struct drm_plane *plane,
|
|
struct drm_atomic_state *atomic_state);
|
|
int gud_connector_fill_properties(struct drm_connector_state *connector_state,
|
|
struct gud_property_req *properties);
|
|
int gud_get_connectors(struct gud_device *gdrm);
|
|
|
|
/* Driver internal fourcc transfer formats */
|
|
#define GUD_DRM_FORMAT_R1 0x00000122
|
|
#define GUD_DRM_FORMAT_XRGB1111 0x03121722
|
|
|
|
static inline u8 gud_from_fourcc(u32 fourcc)
|
|
{
|
|
switch (fourcc) {
|
|
case GUD_DRM_FORMAT_R1:
|
|
return GUD_PIXEL_FORMAT_R1;
|
|
case DRM_FORMAT_R8:
|
|
return GUD_PIXEL_FORMAT_R8;
|
|
case GUD_DRM_FORMAT_XRGB1111:
|
|
return GUD_PIXEL_FORMAT_XRGB1111;
|
|
case DRM_FORMAT_RGB332:
|
|
return GUD_PIXEL_FORMAT_RGB332;
|
|
case DRM_FORMAT_RGB565:
|
|
return GUD_PIXEL_FORMAT_RGB565;
|
|
case DRM_FORMAT_RGB888:
|
|
return GUD_PIXEL_FORMAT_RGB888;
|
|
case DRM_FORMAT_XRGB8888:
|
|
return GUD_PIXEL_FORMAT_XRGB8888;
|
|
case DRM_FORMAT_ARGB8888:
|
|
return GUD_PIXEL_FORMAT_ARGB8888;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline u32 gud_to_fourcc(u8 format)
|
|
{
|
|
switch (format) {
|
|
case GUD_PIXEL_FORMAT_R1:
|
|
return GUD_DRM_FORMAT_R1;
|
|
case GUD_PIXEL_FORMAT_R8:
|
|
return DRM_FORMAT_R8;
|
|
case GUD_PIXEL_FORMAT_XRGB1111:
|
|
return GUD_DRM_FORMAT_XRGB1111;
|
|
case GUD_PIXEL_FORMAT_RGB332:
|
|
return DRM_FORMAT_RGB332;
|
|
case GUD_PIXEL_FORMAT_RGB565:
|
|
return DRM_FORMAT_RGB565;
|
|
case GUD_PIXEL_FORMAT_RGB888:
|
|
return DRM_FORMAT_RGB888;
|
|
case GUD_PIXEL_FORMAT_XRGB8888:
|
|
return DRM_FORMAT_XRGB8888;
|
|
case GUD_PIXEL_FORMAT_ARGB8888:
|
|
return DRM_FORMAT_ARGB8888;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline void gud_from_display_mode(struct gud_display_mode_req *dst,
|
|
const struct drm_display_mode *src)
|
|
{
|
|
u32 flags = src->flags & GUD_DISPLAY_MODE_FLAG_USER_MASK;
|
|
|
|
if (src->type & DRM_MODE_TYPE_PREFERRED)
|
|
flags |= GUD_DISPLAY_MODE_FLAG_PREFERRED;
|
|
|
|
dst->clock = cpu_to_le32(src->clock);
|
|
dst->hdisplay = cpu_to_le16(src->hdisplay);
|
|
dst->hsync_start = cpu_to_le16(src->hsync_start);
|
|
dst->hsync_end = cpu_to_le16(src->hsync_end);
|
|
dst->htotal = cpu_to_le16(src->htotal);
|
|
dst->vdisplay = cpu_to_le16(src->vdisplay);
|
|
dst->vsync_start = cpu_to_le16(src->vsync_start);
|
|
dst->vsync_end = cpu_to_le16(src->vsync_end);
|
|
dst->vtotal = cpu_to_le16(src->vtotal);
|
|
dst->flags = cpu_to_le32(flags);
|
|
}
|
|
|
|
static inline void gud_to_display_mode(struct drm_display_mode *dst,
|
|
const struct gud_display_mode_req *src)
|
|
{
|
|
u32 flags = le32_to_cpu(src->flags);
|
|
|
|
memset(dst, 0, sizeof(*dst));
|
|
dst->clock = le32_to_cpu(src->clock);
|
|
dst->hdisplay = le16_to_cpu(src->hdisplay);
|
|
dst->hsync_start = le16_to_cpu(src->hsync_start);
|
|
dst->hsync_end = le16_to_cpu(src->hsync_end);
|
|
dst->htotal = le16_to_cpu(src->htotal);
|
|
dst->vdisplay = le16_to_cpu(src->vdisplay);
|
|
dst->vsync_start = le16_to_cpu(src->vsync_start);
|
|
dst->vsync_end = le16_to_cpu(src->vsync_end);
|
|
dst->vtotal = le16_to_cpu(src->vtotal);
|
|
dst->flags = flags & GUD_DISPLAY_MODE_FLAG_USER_MASK;
|
|
dst->type = DRM_MODE_TYPE_DRIVER;
|
|
if (flags & GUD_DISPLAY_MODE_FLAG_PREFERRED)
|
|
dst->type |= DRM_MODE_TYPE_PREFERRED;
|
|
drm_mode_set_name(dst);
|
|
}
|
|
|
|
#endif
|