Files
linux/drivers/gpu/drm/gud/gud_internal.h
Shenghao Yang 7149be786d drm/gud: fix NULL crtc dereference on display disable
gud_plane_atomic_update() currently handles both crtc state and
framebuffer updates - the complexity has led to a few accidental
NULL pointer dereferences.

Commit dc2d5ddb19 ("drm/gud: fix NULL fb and crtc dereferences
on USB disconnect") [1] fixed an earlier dereference but planes
can also be disabled in non-hotplug paths (e.g. display disables
via the desktop environment). The drm_dev_enter() call would not
cause an early return in those and subsequently oops on
dereferencing crtc:

BUG: kernel NULL pointer dereference, address: 00000000000005c8
CPU: 6 UID: 1000 PID: 3473 Comm: kwin_wayland Not tainted 6.18.2-200.vanilla.gud.fc42.x86_64 #1 PREEMPT(lazy)
RIP: 0010:gud_plane_atomic_update+0x148/0x470 [gud]
 <TASK>
 drm_atomic_helper_commit_planes+0x28e/0x310
 drm_atomic_helper_commit_tail+0x2a/0x70
 commit_tail+0xf1/0x150
 drm_atomic_helper_commit+0x13c/0x180
 drm_atomic_commit+0xb1/0xe0
info ? __pfx___drm_printfn_info+0x10/0x10
 drm_mode_atomic_ioctl+0x70f/0x7c0
 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10
 drm_ioctl_kernel+0xae/0x100
 drm_ioctl+0x2a8/0x550
 ? __pfx_drm_mode_atomic_ioctl+0x10/0x10
 __x64_sys_ioctl+0x97/0xe0
 do_syscall_64+0x7e/0x7f0
 ? __ct_user_enter+0x56/0xd0
 ? do_syscall_64+0x158/0x7f0
 ? __ct_user_enter+0x56/0xd0
 ? do_syscall_64+0x158/0x7f0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Split out crtc handling from gud_plane_atomic_update() into
atomic_enable() and atomic_disable() functions to delegate
crtc state transitioning work to the DRM helpers.

To preserve the gud state commit sequence [2], switch to
the runtime PM version of drm_atomic_helper_commit_tail() which
ensures that crtcs are enabled (hence sending the
GUD_REQ_SET_CONTROLLER_ENABLE and GUD_REQ_SET_DISPLAY_ENABLE
requests) before a framebuffer update is sent.

[1] https://lore.kernel.org/all/20251231055039.44266-1-me@shenghaoyang.info/
[2] https://github.com/notro/gud/wiki/GUD-Protocol#display-state

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202601142159.0v8ilfVs-lkp@intel.com/
Fixes: 73cfd166e0 ("drm/gud: Replace simple display pipe with DRM atomic helpers")
Cc: <stable@vger.kernel.org> # 6.19.x
Cc: <stable@vger.kernel.org> # 6.18.x
Signed-off-by: Shenghao Yang <me@shenghaoyang.info>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Ruben Wauters <rubenru09@aol.com>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260222054551.80864-1-me@shenghaoyang.info
2026-03-08 20:20:30 +00:00

172 lines
4.9 KiB
C

/* SPDX-License-Identifier: MIT */
#ifndef __LINUX_GUD_INTERNAL_H
#define __LINUX_GUD_INTERNAL_H
#include <linux/list.h>
#include <linux/mutex.h>
#include <linux/scatterlist.h>
#include <linux/usb.h>
#include <linux/workqueue.h>
#include <uapi/drm/drm_fourcc.h>
#include <drm/drm_modes.h>
struct gud_device {
struct drm_device drm;
struct drm_plane plane;
struct drm_crtc crtc;
struct work_struct work;
u32 flags;
const struct drm_format_info *xrgb8888_emulation_format;
u16 *properties;
unsigned int num_properties;
unsigned int bulk_pipe;
void *bulk_buf;
size_t bulk_len;
struct sg_table bulk_sgt;
u8 compression;
void *lz4_comp_mem;
void *compress_buf;
u64 stats_length;
u64 stats_actual_length;
unsigned int stats_num_errors;
struct mutex ctrl_lock; /* Serialize get/set and status transfers */
struct mutex damage_lock; /* Protects the following members: */
struct drm_framebuffer *fb;
struct drm_rect damage;
bool prev_flush_failed;
void *shadow_buf;
};
static inline struct gud_device *to_gud_device(struct drm_device *drm)
{
return container_of(drm, struct gud_device, drm);
}
static inline struct usb_device *gud_to_usb_device(struct gud_device *gdrm)
{
return interface_to_usbdev(to_usb_interface(gdrm->drm.dev));
}
int gud_usb_get(struct gud_device *gdrm, u8 request, u16 index, void *buf, size_t len);
int gud_usb_set(struct gud_device *gdrm, u8 request, u16 index, void *buf, size_t len);
int gud_usb_get_u8(struct gud_device *gdrm, u8 request, u16 index, u8 *val);
int gud_usb_set_u8(struct gud_device *gdrm, u8 request, u8 val);
void gud_clear_damage(struct gud_device *gdrm);
void gud_flush_work(struct work_struct *work);
void gud_crtc_atomic_enable(struct drm_crtc *crtc,
struct drm_atomic_state *state);
void gud_crtc_atomic_disable(struct drm_crtc *crtc,
struct drm_atomic_state *state);
int gud_plane_atomic_check(struct drm_plane *plane,
struct drm_atomic_state *state);
void gud_plane_atomic_update(struct drm_plane *plane,
struct drm_atomic_state *atomic_state);
int gud_connector_fill_properties(struct drm_connector_state *connector_state,
struct gud_property_req *properties);
int gud_get_connectors(struct gud_device *gdrm);
/* Driver internal fourcc transfer formats */
#define GUD_DRM_FORMAT_R1 0x00000122
#define GUD_DRM_FORMAT_XRGB1111 0x03121722
static inline u8 gud_from_fourcc(u32 fourcc)
{
switch (fourcc) {
case GUD_DRM_FORMAT_R1:
return GUD_PIXEL_FORMAT_R1;
case DRM_FORMAT_R8:
return GUD_PIXEL_FORMAT_R8;
case GUD_DRM_FORMAT_XRGB1111:
return GUD_PIXEL_FORMAT_XRGB1111;
case DRM_FORMAT_RGB332:
return GUD_PIXEL_FORMAT_RGB332;
case DRM_FORMAT_RGB565:
return GUD_PIXEL_FORMAT_RGB565;
case DRM_FORMAT_RGB888:
return GUD_PIXEL_FORMAT_RGB888;
case DRM_FORMAT_XRGB8888:
return GUD_PIXEL_FORMAT_XRGB8888;
case DRM_FORMAT_ARGB8888:
return GUD_PIXEL_FORMAT_ARGB8888;
}
return 0;
}
static inline u32 gud_to_fourcc(u8 format)
{
switch (format) {
case GUD_PIXEL_FORMAT_R1:
return GUD_DRM_FORMAT_R1;
case GUD_PIXEL_FORMAT_R8:
return DRM_FORMAT_R8;
case GUD_PIXEL_FORMAT_XRGB1111:
return GUD_DRM_FORMAT_XRGB1111;
case GUD_PIXEL_FORMAT_RGB332:
return DRM_FORMAT_RGB332;
case GUD_PIXEL_FORMAT_RGB565:
return DRM_FORMAT_RGB565;
case GUD_PIXEL_FORMAT_RGB888:
return DRM_FORMAT_RGB888;
case GUD_PIXEL_FORMAT_XRGB8888:
return DRM_FORMAT_XRGB8888;
case GUD_PIXEL_FORMAT_ARGB8888:
return DRM_FORMAT_ARGB8888;
}
return 0;
}
static inline void gud_from_display_mode(struct gud_display_mode_req *dst,
const struct drm_display_mode *src)
{
u32 flags = src->flags & GUD_DISPLAY_MODE_FLAG_USER_MASK;
if (src->type & DRM_MODE_TYPE_PREFERRED)
flags |= GUD_DISPLAY_MODE_FLAG_PREFERRED;
dst->clock = cpu_to_le32(src->clock);
dst->hdisplay = cpu_to_le16(src->hdisplay);
dst->hsync_start = cpu_to_le16(src->hsync_start);
dst->hsync_end = cpu_to_le16(src->hsync_end);
dst->htotal = cpu_to_le16(src->htotal);
dst->vdisplay = cpu_to_le16(src->vdisplay);
dst->vsync_start = cpu_to_le16(src->vsync_start);
dst->vsync_end = cpu_to_le16(src->vsync_end);
dst->vtotal = cpu_to_le16(src->vtotal);
dst->flags = cpu_to_le32(flags);
}
static inline void gud_to_display_mode(struct drm_display_mode *dst,
const struct gud_display_mode_req *src)
{
u32 flags = le32_to_cpu(src->flags);
memset(dst, 0, sizeof(*dst));
dst->clock = le32_to_cpu(src->clock);
dst->hdisplay = le16_to_cpu(src->hdisplay);
dst->hsync_start = le16_to_cpu(src->hsync_start);
dst->hsync_end = le16_to_cpu(src->hsync_end);
dst->htotal = le16_to_cpu(src->htotal);
dst->vdisplay = le16_to_cpu(src->vdisplay);
dst->vsync_start = le16_to_cpu(src->vsync_start);
dst->vsync_end = le16_to_cpu(src->vsync_end);
dst->vtotal = le16_to_cpu(src->vtotal);
dst->flags = flags & GUD_DISPLAY_MODE_FLAG_USER_MASK;
dst->type = DRM_MODE_TYPE_DRIVER;
if (flags & GUD_DISPLAY_MODE_FLAG_PREFERRED)
dst->type |= DRM_MODE_TYPE_PREFERRED;
drm_mode_set_name(dst);
}
#endif