From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org, jejb@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>, Willy Tarreau <w@1wt.eu>,
Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
Jake Edge <jake@lwn.net>, Eugene Teo <eteo@redhat.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Oleg Nesterov <oleg@tv-sign.ru>,
Krzysztof Helt <krzysztof.h1@poczta.fm>
Subject: [patch 09/26] fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles
Date: Sat, 18 Oct 2008 11:47:44 -0700 [thread overview]
Message-ID: <20081018184744.GJ301@suse.de> (raw)
In-Reply-To: <20081018184708.GA301@suse.de>
[-- Attachment #1: fbcon_set_all_vcs-fix-kernel-crash-when-switching-the-rotated-consoles.patch --]
[-- Type: text/plain, Size: 4014 bytes --]
2.6.26-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Oleg Nesterov <oleg@tv-sign.ru>
commit 232fb69a53a5ec3f22a8104d447abe4806848a8f upstream
echo 3 >> /sys/class/graphics/fbcon/rotate_all, then switch to another
console. Result:
BUG: unable to handle kernel paging request at ffffc20005d00000
IP: [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
PGD 7e228067 PUD 7e229067 PMD 7bc1f067 PTE 0
Oops: 0002 [1] SMP
CPU 1
Modules linked in: [...a lot...]
Pid: 10, comm: events/1 Not tainted 2.6.26.5-45.fc9.x86_64 #1
RIP: 0010:[bitfill_aligned+149/265] [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
RSP: 0018:ffff81007d811bc8 EFLAGS: 00010216
RAX: ffffc20005d00000 RBX: 0000000000000000 RCX: 0000000000000400
RDX: 0000000000000000 RSI: ffffc20005d00000 RDI: ffffffffffffffff
RBP: ffff81007d811be0 R08: 0000000000000400 R09: 0000000000000040
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000010000
R13: ffffffff811632f0 R14: 0000000000000006 R15: ffff81007cb85400
FS: 0000000000000000(0000) GS:ffff81007e004780(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: ffffc20005d00000 CR3: 0000000000201000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process events/1 (pid: 10, threadinfo ffff81007d810000, task ffff81007d808000)
Stack: ffff81007c9d75a0 0000000000000000 0000000000000000 ffff81007d811c80
ffffffff81163a61 ffff810000000000 ffffffff8115f9c8 0000001000000000
0000000100aaaaaa 000000007cd0d4a0 fffffd8a00000800 0001000000000000
Call Trace:
[cfb_fillrect+523/798] cfb_fillrect+0x20b/0x31e
[soft_cursor+416/436] ? soft_cursor+0x1a0/0x1b4
[ccw_clear_margins+205/263] ccw_clear_margins+0xcd/0x107
[fbcon_clear_margins+59/61] fbcon_clear_margins+0x3b/0x3d
[fbcon_switch+1291/1466] fbcon_switch+0x50b/0x5ba
[redraw_screen+261/481] redraw_screen+0x105/0x1e1
[ccw_cursor+0/1869] ? ccw_cursor+0x0/0x74d
[complete_change_console+48/190] complete_change_console+0x30/0xbe
[change_console+115/120] change_console+0x73/0x78
[console_callback+0/292] ? console_callback+0x0/0x124
[console_callback+97/292] console_callback+0x61/0x124
[schedule_delayed_work+25/30] ? schedule_delayed_work+0x19/0x1e
[run_workqueue+139/282] run_workqueue+0x8b/0x11a
[worker_thread+221/238] worker_thread+0xdd/0xee
[autoremove_wake_function+0/56] ? autoremove_wake_function+0x0/0x38
[worker_thread+0/238] ? worker_thread+0x0/0xee
[kthread+73/118] kthread+0x49/0x76
[child_rip+10/18] child_rip+0xa/0x12
[kthread+0/118] ? kthread+0x0/0x76
[child_rip+0/18] ? child_rip+0x0/0x12
Because fbcon_set_all_vcs()->FBCON_SWAP() uses display->rotate == 0 instead
of fbcon_ops->rotate, and vc_resize() has no effect because it is called with
new_cols/rows == ->vc_cols/rows.
Tested on 2.6.26.5-45.fc9.x86_64, but
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git seems to
have the same problem.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/video/console/fbcon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2990,8 +2990,8 @@ static void fbcon_set_all_vcs(struct fb_
p = &fb_display[vc->vc_num];
set_blitting_type(vc, info);
var_to_display(p, &info->var, info);
- cols = FBCON_SWAP(p->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(p->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
--
next prev parent reply other threads:[~2008-10-18 19:13 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20081018183853.004667035@mini.kroah.org>
2008-10-18 18:47 ` [patch 00/26] 2.6.26-stable review Greg KH
2008-10-18 18:47 ` [patch 01/26] x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap Greg KH
2008-10-18 18:47 ` [patch 02/26] x86: improve UP kernel when CPU-hotplug and SMP is enabled Greg KH
2008-10-18 18:47 ` [patch 03/26] x86, early_ioremap: fix fencepost error Greg KH
2008-10-18 18:47 ` [patch 04/26] tty: Termios locking - sort out real_tty confusions and lock reads Greg KH
2008-10-18 18:47 ` [patch 05/26] sched_rt.c: resch needed in rt_rq_enqueue() for the root rt_rq Greg KH
2008-10-18 18:47 ` [patch 06/26] CIFS: make sure we have the right resume info before calling CIFSFindNext Greg KH
2008-10-18 18:47 ` [patch 07/26] b43legacy: Fix failure in rate-adjustment mechanism Greg KH
2008-10-18 18:47 ` [patch 08/26] modules: fix module "notes" kobject leak Greg KH
2008-10-18 18:47 ` Greg KH [this message]
2008-10-18 18:47 ` [patch 10/26] libata: always do follow-up SRST if hardreset returned -EAGAIN Greg KH
2008-10-18 18:47 ` [patch 11/26] libata: fix EH action overwriting in ata_eh_reset() Greg KH
2008-10-18 18:47 ` [patch 12/26] libata: LBA28/LBA48 off-by-one bug in ata.h Greg KH
2008-10-18 18:47 ` [patch 13/26] V4L: bttv: Prevent NULL pointer dereference in radio_open Greg KH
2008-10-18 18:47 ` [patch 14/26] V4L: zr36067: Fix RGBR pixel format Greg KH
2008-10-18 18:47 ` [patch 15/26] Dont allow splice() to files opened with O_APPEND Greg KH
2008-10-18 18:48 ` [patch 16/26] V4L/DVB (8498): uvcvideo: Return sensible min and max values when querying a boolean control Greg KH
2008-10-18 18:48 ` [patch 17/26] V4L/DVB (8617): uvcvideo: dont use stack-based buffers for USB transfers Greg KH
2008-10-18 18:48 ` [patch 19/26] PCI: disable ASPM per ACPI FADT setting Greg KH
2008-10-18 18:48 ` [patch 20/26] PCI: disable ASPM on pre-1.1 PCIe devices Greg KH
2008-10-18 18:48 ` [patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video Greg KH
2008-10-18 18:48 ` [patch 21/26] x86: avoid dereferencing beyond stack + THREAD_SIZE Greg KH
2008-10-18 18:48 ` [patch 22/26] Check mapped ranges on sysfs resource files Greg KH
2008-10-18 18:48 ` [patch 23/26] hwmon: (it87) Prevent power-off on Shuttle SN68PT Greg KH
2008-10-18 18:48 ` [patch 24/26] ACPI: Ignore _BQC object when registering backlight device Greg KH
2008-10-18 18:48 ` [patch 25/26] drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) Greg KH
2008-10-18 18:48 ` [patch 26/26] DVB: au0828: add support for another USB id for Hauppauge HVR950Q Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20081018184744.GJ301@suse.de \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=cavokz@gmail.com \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=eteo@redhat.com \
--cc=jake@lwn.net \
--cc=jejb@kernel.org \
--cc=jmforbes@linuxtx.org \
--cc=krzysztof.h1@poczta.fm \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=oleg@tv-sign.ru \
--cc=rbranco@la.checkpoint.com \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=w@1wt.eu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.