From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukas Wunner Subject: Re: [PATCH] drm/i915/fbdev: Serialise early hotplug events with async fbdev config Date: Sun, 26 Nov 2017 13:20:32 +0100 Message-ID: <20171126122032.GC10063@wunner.de> References: <20171125194155.355-1-chris@chris-wilson.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from bmailout1.hostsharing.net (bmailout1.hostsharing.net [83.223.95.100]) by gabe.freedesktop.org (Postfix) with ESMTPS id 94E256E1B0 for ; Sun, 26 Nov 2017 12:20:34 +0000 (UTC) Content-Disposition: inline In-Reply-To: <20171125194155.355-1-chris@chris-wilson.co.uk> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" To: Chris Wilson Cc: Daniel Vetter , intel-gfx@lists.freedesktop.org, stable@vger.kernel.org List-Id: intel-gfx@lists.freedesktop.org T24gU2F0LCBOb3YgMjUsIDIwMTcgYXQgMDc6NDE6NTVQTSArMDAwMCwgQ2hyaXMgV2lsc29uIHdy b3RlOgo+IEFzIGJvdGggdGhlIGhvdHBsdWcgZXZlbnQgYW5kIGZiZGV2IGNvbmZpZ3VyYXRpb24g cnVuIGFzeW5jaHJvbm91c2x5LCBpdAo+IGlzIHBvc3NpYmxlIGZvciB0aGVtIHRvIHJ1biBjb25j dXJyZW50bHkuIElmIGNvbmZpZ3VyYXRpb24gZmFpbHMsIHdlIHdlcmUKPiBmcmVlaW5nIHRoZSBm YmRldiBjYXVzaW5nIGEgdXNlLWFmdGVyLWZyZWUgaW4gdGhlIGhvdHBsdWcgZXZlbnQuCj4gCj4g PDc+WyAzMDY5LjkzNTIxMV0gW2RybTppbnRlbF9mYl9pbml0aWFsX2NvbmZpZyBbaTkxNV1dIE5v dCB1c2luZyBmaXJtd2FyZSBjb25maWd1cmF0aW9uCj4gPDc+WyAzMDY5LjkzNTIyNV0gW2RybTpk cm1fc2V0dXBfY3J0Y3NdIGxvb2tpbmcgZm9yIGNtZGxpbmUgbW9kZSBvbiBjb25uZWN0b3IgNzcK PiA8Nz5bIDMwNjkuOTM1MjI5XSBbZHJtOmRybV9zZXR1cF9jcnRjc10gbG9va2luZyBmb3IgcHJl ZmVycmVkIG1vZGUgb24gY29ubmVjdG9yIDc3IDAKPiA8Nz5bIDMwNjkuOTM1MjMzXSBbZHJtOmRy bV9zZXR1cF9jcnRjc10gZm91bmQgbW9kZSAzMjAweDE4MDAKPiA8Nz5bIDMwNjkuOTM1MjM2XSBb ZHJtOmRybV9zZXR1cF9jcnRjc10gcGlja2luZyBDUlRDcyBmb3IgODE5Mng4MTkyIGNvbmZpZwo+ IDw3PlsgMzA2OS45MzUyNTNdIFtkcm06ZHJtX3NldHVwX2NydGNzXSBkZXNpcmVkIG1vZGUgMzIw MHgxODAwIHNldCBvbiBjcnRjIDQzICgwLDApCj4gPDc+WyAzMDY5LjkzNTMyM10gW2RybTppbnRl bGZiX2NyZWF0ZSBbaTkxNV1dIG5vIEJJT1MgZmIsIGFsbG9jYXRpbmcgYSBuZXcgb25lCj4gPDQ+ WyAzMDY5Ljk2NzczN10gZ2VuZXJhbCBwcm90ZWN0aW9uIGZhdWx0OiAwMDAwIFsjMV0gUFJFRU1Q VCBTTVAKPiA8MD5bIDMwNjkuOTc3NDUzXSAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0KPiA8ND5bIDMwNjkuOTc3NDU3XSBNb2R1bGVzIGxpbmtlZCBpbjogaTkxNSgrKSB2Z2VtIHNu ZF9oZGFfY29kZWNfaGRtaSBzbmRfaGRhX2NvZGVjX3JlYWx0ZWsgc25kX2hkYV9jb2RlY19nZW5l cmljIHg4Nl9wa2dfdGVtcF90aGVybWFsIGludGVsX3Bvd2VyY2xhbXAgY29yZXRlbXAgY3JjdDEw ZGlmX3BjbG11bCBjcmMzMl9wY2xtdWwgZ2hhc2hfY2xtdWxuaV9pbnRlbCBzbmRfaGRhX2NvZGVj IHNuZF9od2RlcCBzbmRfaGRhX2NvcmUgc25kX3BjbSByODE2OSBtZWlfbWUgbWlpIHByaW1lX251 bWJlcnMgbWVpIGkyY19oaWQgcGluY3RybF9nZW1pbmlsYWtlIHBpbmN0cmxfaW50ZWwgW2xhc3Qg dW5sb2FkZWQ6IGk5MTVdCj4gPDQ+WyAzMDY5Ljk3NzQ5Ml0gQ1BVOiAxIFBJRDogMTU0MTQgQ29t bToga3dvcmtlci8xOjAgVGFpbnRlZDogRyAgICAgVSAgICAgICAgICA0LjE0LjAtQ0ktQ0lfRFJN XzMzODgrICMxCj4gPDQ+WyAzMDY5Ljk3NzQ5N10gSGFyZHdhcmUgbmFtZTogSW50ZWwgQ29ycC4g R2VtaW5pbGFrZS9HTEsgUlZQMSBERFI0ICgwNSksIEJJT1MgR0VMS1JWUEEuWDY0LjAwNjIuQjMw LjE3MDgyMjIxNDYgMDgvMjIvMjAxNwo+IDw0PlsgMzA2OS45Nzc1MDhdIFdvcmtxdWV1ZTogZXZl bnRzIG91dHB1dF9wb2xsX2V4ZWN1dGUKPiA8ND5bIDMwNjkuOTc3NTEyXSB0YXNrOiBmZmZmODgw MTc3NzM0ZTQwIHRhc2suc3RhY2s6IGZmZmZjOTAwMDFmZTQwMDAKPiA8ND5bIDMwNjkuOTc3NTE5 XSBSSVA6IDAwMTA6X19sb2NrX2FjcXVpcmUrMHgxMDkvMHgxYjYwCj4gPDQ+WyAzMDY5Ljk3NzUy M10gUlNQOiAwMDE4OmZmZmZjOTAwMDFmZTdiYjAgRUZMQUdTOiAwMDAxMDAwMgo+IDw0PlsgMzA2 OS45Nzc1MjZdIFJBWDogNmI2YjZiNmI2YjZiNmI2YiBSQlg6IDAwMDAwMDAwMDAwMDAyODIgUkNY OiAwMDAwMDAwMDAwMDAwMDAwCj4gPDQ+WyAzMDY5Ljk3NzUzMF0gUkRYOiAwMDAwMDAwMDAwMDAw MDAwIFJTSTogMDAwMDAwMDAwMDAwMDAwMCBSREk6IGZmZmY4ODAxNzBkNGVmZDAKPiA8ND5bIDMw NjkuOTc3NTM0XSBSQlA6IGZmZmZjOTAwMDFmZTdjNzAgUjA4OiAwMDAwMDAwMDAwMDAwMDAxIFIw OTogMDAwMDAwMDAwMDAwMDAwMAo+IDw0PlsgMzA2OS45Nzc1MzhdIFIxMDogMDAwMDAwMDAwMDAw MDAwMCBSMTE6IGZmZmZmZmZmODE4OTk2MDkgUjEyOiBmZmZmODgwMTcwZDRlZmQwCj4gPDQ+WyAz MDY5Ljk3NzU0Ml0gUjEzOiBmZmZmODgwMTc3NzM0ZTQwIFIxNDogMDAwMDAwMDAwMDAwMDAwMSBS MTU6IDAwMDAwMDAwMDAwMDAwMDAKPiA8ND5bIDMwNjkuOTc3NTQ3XSBGUzogIDAwMDAwMDAwMDAw MDAwMDAoMDAwMCkgR1M6ZmZmZjg4MDE3ZmM4MDAwMCgwMDAwKSBrbmxHUzowMDAwMDAwMDAwMDAw MDAwCj4gPDQ+WyAzMDY5Ljk3NzU1MV0gQ1M6ICAwMDEwIERTOiAwMDAwIEVTOiAwMDAwIENSMDog MDAwMDAwMDA4MDA1MDAzMwo+IDw0PlsgMzA2OS45Nzc1NTVdIENSMjogMDAwMDdmN2U4YjdiY2Yw NCBDUjM6IDAwMDAwMDAwMDNlMGYwMDAgQ1I0OiAwMDAwMDAwMDAwMzQwNmUwCj4gPDQ+WyAzMDY5 Ljk3NzU1OV0gQ2FsbCBUcmFjZToKPiA8ND5bIDMwNjkuOTc3NTY1XSAgPyBtYXJrX2hlbGRfbG9j a3MrMHg2NC8weDkwCj4gPDQ+WyAzMDY5Ljk3NzU3MV0gID8gX3Jhd19zcGluX3VubG9ja19pcnEr MHgyNC8weDUwCj4gPDQ+WyAzMDY5Ljk3NzU3NV0gID8gX3Jhd19zcGluX3VubG9ja19pcnErMHgy NC8weDUwCj4gPDQ+WyAzMDY5Ljk3NzU3OV0gID8gdHJhY2VfaGFyZGlycXNfb25fY2FsbGVyKzB4 ZGUvMHgxYzAKPiA8ND5bIDMwNjkuOTc3NTgzXSAgPyBfcmF3X3NwaW5fdW5sb2NrX2lycSsweDJm LzB4NTAKPiA8ND5bIDMwNjkuOTc3NTg4XSAgPyBmaW5pc2hfdGFza19zd2l0Y2grMHhhNS8weDIx MAo+IDw0PlsgMzA2OS45Nzc1OTJdICA/IGxvY2tfYWNxdWlyZSsweGFmLzB4MjAwCj4gPDQ+WyAz MDY5Ljk3NzU5Nl0gIGxvY2tfYWNxdWlyZSsweGFmLzB4MjAwCj4gPDQ+WyAzMDY5Ljk3NzYwMF0g ID8gX19tdXRleF9sb2NrKzB4NWU5LzB4OWIwCj4gPDQ+WyAzMDY5Ljk3NzYwNF0gIF9yYXdfc3Bp bl9sb2NrKzB4MmEvMHg0MAo+IDw0PlsgMzA2OS45Nzc2MDhdICA/IF9fbXV0ZXhfbG9jaysweDVl OS8weDliMAo+IDw0PlsgMzA2OS45Nzc2MTJdICBfX211dGV4X2xvY2srMHg1ZTkvMHg5YjAKPiA8 ND5bIDMwNjkuOTc3NjE2XSAgPyBkcm1fZmJfaGVscGVyX2hvdHBsdWdfZXZlbnQucGFydC4xOSsw eDE2LzB4YTAKPiA8ND5bIDMwNjkuOTc3NjIxXSAgPyBkcm1fZmJfaGVscGVyX2hvdHBsdWdfZXZl bnQucGFydC4xOSsweDE2LzB4YTAKPiA8ND5bIDMwNjkuOTc3NjI1XSAgZHJtX2ZiX2hlbHBlcl9o b3RwbHVnX2V2ZW50LnBhcnQuMTkrMHgxNi8weGEwCj4gPDQ+WyAzMDY5Ljk3NzYzMF0gIG91dHB1 dF9wb2xsX2V4ZWN1dGUrMHg4ZC8weDE4MAo+IDw0PlsgMzA2OS45Nzc2MzVdICBwcm9jZXNzX29u ZV93b3JrKzB4MjJlLzB4NjYwCj4gPDQ+WyAzMDY5Ljk3NzY0MF0gIHdvcmtlcl90aHJlYWQrMHg0 OC8weDNhMAo+IDw0PlsgMzA2OS45Nzc2NDRdICA/IF9yYXdfc3Bpbl91bmxvY2tfaXJxcmVzdG9y ZSsweDRjLzB4NjAKPiA8ND5bIDMwNjkuOTc3NjQ5XSAga3RocmVhZCsweDEwMi8weDE0MAo+IDw0 PlsgMzA2OS45Nzc2NTNdICA/IHByb2Nlc3Nfb25lX3dvcmsrMHg2NjAvMHg2NjAKPiA8ND5bIDMw NjkuOTc3NjU3XSAgPyBrdGhyZWFkX2NyZWF0ZV9vbl9ub2RlKzB4NDAvMHg0MAo+IDw0PlsgMzA2 OS45Nzc2NjJdICByZXRfZnJvbV9mb3JrKzB4MjcvMHg0MAo+IDw0PlsgMzA2OS45Nzc2NjZdIENv ZGU6IDhkIDYyIGY4IGMzIDQ5IDgxIDNjIDI0IGUwIGZhIDNjIDgyIDQxIGJlIDAwIDAwIDAwIDAw IDQ1IDBmIDQ1IGYwIDgzIGZlIDAxIDc3IDg2IDg5IGYwIDQ5IDhiIDQ0IGM0IDA4IDQ4IDg1IGMw IDBmIDg0IDc2IGZmIGZmIGZmIDxmMD4gZmYgODAgMzggMDEgMDAgMDAgOGIgMWQgNjIgZjkgZTgg MDEgNDUgOGIgODUgYjggMDggMDAgMDAgODUKPiA8MT5bIDMwNjkuOTc3NzA3XSBSSVA6IF9fbG9j a19hY3F1aXJlKzB4MTA5LzB4MWI2MCBSU1A6IGZmZmZjOTAwMDFmZTdiYjAKPiA8ND5bIDMwNjku OTc3NzEyXSAtLS1bIGVuZCB0cmFjZSA0YWQwMTJlYjNhZjYyZGY3IF0tLS0KPiAKPiBJbiBvcmRl ciB0byBrZWVwIHRoZSBkZXZfcHJpdi0+aWZiZGV2IGFsaXZlIGFmdGVyIGZhaWx1cmUsIHdlIGhh dmUgdG8KPiBhdm9pZCB0aGUgZnJlZSBhbmQgbGVhdmUgaXQgZW1wdHkgdW50aWwgd2UgdW5sb2Fk IHRoZSBtb2R1bGUuIFRoZW4gd2UKPiBjYW4gdXNlIGludGVsX2ZiZGV2X3N5bmMoKSB0byBzZXJp YWxpc2UgdGhlIGhvdHBsdWcgZXZlbnQgd2l0aCB0aGUKPiBjb25maWd1cmF0aW9uLiBUaGUgc2Vy aWFsaXNhdGlvbiBiZXR3ZWVuIHRoZSB0d28gd2FzIHJlbW92ZWQgaW4gY29tbWl0Cj4gOTM0NDU4 YzJjOTVkICgiUmV2ZXJ0ICJkcm0vaTkxNTogRml4IHJhY2VzIG9uIGZiZGV2IiIpLCBidXQgdGhl IHVzZQo+IGFmdGVyIGZyZWUgaXMgbXVjaCBvbGRlciwgY29tbWl0IDM2NmUzOWI0ZDJjNSAoImRy bS9pOTE1OiBUZWFyIGRvd24gZmJkZXYKPiBpZiBpbml0aWFsaXphdGlvbiBmYWlscyIpCj4gCj4g Rml4ZXM6IDM2NmUzOWI0ZDJjNSAoImRybS9pOTE1OiBUZWFyIGRvd24gZmJkZXYgaWYgaW5pdGlh bGl6YXRpb24gZmFpbHMiKQo+IEZpeGVzOiA5MzQ0NThjMmM5NWQgKCJSZXZlcnQgImRybS9pOTE1 OiBGaXggcmFjZXMgb24gZmJkZXYiIikKPiBTaWduZWQtb2ZmLWJ5OiBDaHJpcyBXaWxzb24gPGNo cmlzQGNocmlzLXdpbHNvbi5jby51az4KPiBDYzogTHVrYXMgV3VubmVyIDxsdWthc0B3dW5uZXIu ZGU+Cj4gQ2M6IEpvb25hcyBMYWh0aW5lbiA8am9vbmFzLmxhaHRpbmVuQGxpbnV4LmludGVsLmNv bT4KPiBDYzogRGFuaWVsIFZldHRlciA8ZGFuaWVsLnZldHRlckBmZndsbC5jaD4KPiBDYzogc3Rh YmxlQHZnZXIua2VybmVsLm9yZwoKUGF0Y2ggbG9va3MgY29ycmVjdCB0byBtZSwgdGhvdWdoIGtl ZXBpbmcgdGhlIGlmYmRldiBhcm91bmQgZXZlbiBpZiBpdApmYWlsZWQgdG8gaW5pdGlhbGl6ZSBp cyByZWdyZXR0YWJsZS4gIEZXSVcsCgpSZXZpZXdlZC1ieTogTHVrYXMgV3VubmVyIDxsdWthc0B3 dW5uZXIuZGU+CgpUaGFua3MsCgpMdWthcwoKPiAtLS0KPiAgZHJpdmVycy9ncHUvZHJtL2k5MTUv aW50ZWxfZmJkZXYuYyB8IDEwICsrKysrKy0tLS0KPiAgMSBmaWxlIGNoYW5nZWQsIDYgaW5zZXJ0 aW9ucygrKSwgNCBkZWxldGlvbnMoLSkKPiAKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJt L2k5MTUvaW50ZWxfZmJkZXYuYyBiL2RyaXZlcnMvZ3B1L2RybS9pOTE1L2ludGVsX2ZiZGV2LmMK PiBpbmRleCBiOGFmMzUxODdkMjIuLmVhOTY2ODI1NjhlOCAxMDA2NDQKPiAtLS0gYS9kcml2ZXJz L2dwdS9kcm0vaTkxNS9pbnRlbF9mYmRldi5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2k5MTUv aW50ZWxfZmJkZXYuYwo+IEBAIC02OTcsMTAgKzY5Nyw4IEBAIHN0YXRpYyB2b2lkIGludGVsX2Zi ZGV2X2luaXRpYWxfY29uZmlnKHZvaWQgKmRhdGEsIGFzeW5jX2Nvb2tpZV90IGNvb2tpZSkKPiAg Cj4gIAkvKiBEdWUgdG8gcGVjdWxpYXIgaW5pdCBvcmRlciB3cnQgdG8gaHBkIGhhbmRsaW5nIHRo aXMgaXMgc2VwYXJhdGUuICovCj4gIAlpZiAoZHJtX2ZiX2hlbHBlcl9pbml0aWFsX2NvbmZpZygm aWZiZGV2LT5oZWxwZXIsCj4gLQkJCQkJIGlmYmRldi0+cHJlZmVycmVkX2JwcCkpIHsKPiArCQkJ CQkgaWZiZGV2LT5wcmVmZXJyZWRfYnBwKSkKPiAgCQlpbnRlbF9mYmRldl91bnJlZ2lzdGVyKHRv X2k5MTUoaWZiZGV2LT5oZWxwZXIuZGV2KSk7Cj4gLQkJaW50ZWxfZmJkZXZfZmluaSh0b19pOTE1 KGlmYmRldi0+aGVscGVyLmRldikpOwo+IC0JfQo+ICB9Cj4gIAo+ICB2b2lkIGludGVsX2ZiZGV2 X2luaXRpYWxfY29uZmlnX2FzeW5jKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYpCj4gQEAgLTgwMCw3 ICs3OTgsMTEgQEAgdm9pZCBpbnRlbF9mYmRldl9vdXRwdXRfcG9sbF9jaGFuZ2VkKHN0cnVjdCBk cm1fZGV2aWNlICpkZXYpCj4gIHsKPiAgCXN0cnVjdCBpbnRlbF9mYmRldiAqaWZiZGV2ID0gdG9f aTkxNShkZXYpLT5mYmRldjsKPiAgCj4gLQlpZiAoaWZiZGV2KQo+ICsJaWYgKCFpZmJkZXYpCj4g KwkJcmV0dXJuOwo+ICsKPiArCWludGVsX2ZiZGV2X3N5bmMoaWZiZGV2KTsKPiArCWlmIChpZmJk ZXYtPnZtYSkKPiAgCQlkcm1fZmJfaGVscGVyX2hvdHBsdWdfZXZlbnQoJmlmYmRldi0+aGVscGVy KTsKPiAgfQo+ICAKPiAtLSAKPiAyLjE1LjAKPiAKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KSW50ZWwtZ2Z4IG1haWxpbmcgbGlzdApJbnRlbC1nZnhAbGlz dHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4v bGlzdGluZm8vaW50ZWwtZ2Z4Cg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bmailout1.hostsharing.net ([83.223.95.100]:51937 "EHLO bmailout1.hostsharing.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751950AbdKZMUe (ORCPT ); Sun, 26 Nov 2017 07:20:34 -0500 Date: Sun, 26 Nov 2017 13:20:32 +0100 From: Lukas Wunner To: Chris Wilson Cc: intel-gfx@lists.freedesktop.org, Joonas Lahtinen , Daniel Vetter , stable@vger.kernel.org Subject: Re: [PATCH] drm/i915/fbdev: Serialise early hotplug events with async fbdev config Message-ID: <20171126122032.GC10063@wunner.de> References: <20171125194155.355-1-chris@chris-wilson.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171125194155.355-1-chris@chris-wilson.co.uk> Sender: stable-owner@vger.kernel.org List-ID: On Sat, Nov 25, 2017 at 07:41:55PM +0000, Chris Wilson wrote: > As both the hotplug event and fbdev configuration run asynchronously, it > is possible for them to run concurrently. If configuration fails, we were > freeing the fbdev causing a use-after-free in the hotplug event. > > <7>[ 3069.935211] [drm:intel_fb_initial_config [i915]] Not using firmware configuration > <7>[ 3069.935225] [drm:drm_setup_crtcs] looking for cmdline mode on connector 77 > <7>[ 3069.935229] [drm:drm_setup_crtcs] looking for preferred mode on connector 77 0 > <7>[ 3069.935233] [drm:drm_setup_crtcs] found mode 3200x1800 > <7>[ 3069.935236] [drm:drm_setup_crtcs] picking CRTCs for 8192x8192 config > <7>[ 3069.935253] [drm:drm_setup_crtcs] desired mode 3200x1800 set on crtc 43 (0,0) > <7>[ 3069.935323] [drm:intelfb_create [i915]] no BIOS fb, allocating a new one > <4>[ 3069.967737] general protection fault: 0000 [#1] PREEMPT SMP > <0>[ 3069.977453] --------------------------------- > <4>[ 3069.977457] Modules linked in: i915(+) vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm r8169 mei_me mii prime_numbers mei i2c_hid pinctrl_geminilake pinctrl_intel [last unloaded: i915] > <4>[ 3069.977492] CPU: 1 PID: 15414 Comm: kworker/1:0 Tainted: G U 4.14.0-CI-CI_DRM_3388+ #1 > <4>[ 3069.977497] Hardware name: Intel Corp. Geminilake/GLK RVP1 DDR4 (05), BIOS GELKRVPA.X64.0062.B30.1708222146 08/22/2017 > <4>[ 3069.977508] Workqueue: events output_poll_execute > <4>[ 3069.977512] task: ffff880177734e40 task.stack: ffffc90001fe4000 > <4>[ 3069.977519] RIP: 0010:__lock_acquire+0x109/0x1b60 > <4>[ 3069.977523] RSP: 0018:ffffc90001fe7bb0 EFLAGS: 00010002 > <4>[ 3069.977526] RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000282 RCX: 0000000000000000 > <4>[ 3069.977530] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880170d4efd0 > <4>[ 3069.977534] RBP: ffffc90001fe7c70 R08: 0000000000000001 R09: 0000000000000000 > <4>[ 3069.977538] R10: 0000000000000000 R11: ffffffff81899609 R12: ffff880170d4efd0 > <4>[ 3069.977542] R13: ffff880177734e40 R14: 0000000000000001 R15: 0000000000000000 > <4>[ 3069.977547] FS: 0000000000000000(0000) GS:ffff88017fc80000(0000) knlGS:0000000000000000 > <4>[ 3069.977551] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > <4>[ 3069.977555] CR2: 00007f7e8b7bcf04 CR3: 0000000003e0f000 CR4: 00000000003406e0 > <4>[ 3069.977559] Call Trace: > <4>[ 3069.977565] ? mark_held_locks+0x64/0x90 > <4>[ 3069.977571] ? _raw_spin_unlock_irq+0x24/0x50 > <4>[ 3069.977575] ? _raw_spin_unlock_irq+0x24/0x50 > <4>[ 3069.977579] ? trace_hardirqs_on_caller+0xde/0x1c0 > <4>[ 3069.977583] ? _raw_spin_unlock_irq+0x2f/0x50 > <4>[ 3069.977588] ? finish_task_switch+0xa5/0x210 > <4>[ 3069.977592] ? lock_acquire+0xaf/0x200 > <4>[ 3069.977596] lock_acquire+0xaf/0x200 > <4>[ 3069.977600] ? __mutex_lock+0x5e9/0x9b0 > <4>[ 3069.977604] _raw_spin_lock+0x2a/0x40 > <4>[ 3069.977608] ? __mutex_lock+0x5e9/0x9b0 > <4>[ 3069.977612] __mutex_lock+0x5e9/0x9b0 > <4>[ 3069.977616] ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0 > <4>[ 3069.977621] ? drm_fb_helper_hotplug_event.part.19+0x16/0xa0 > <4>[ 3069.977625] drm_fb_helper_hotplug_event.part.19+0x16/0xa0 > <4>[ 3069.977630] output_poll_execute+0x8d/0x180 > <4>[ 3069.977635] process_one_work+0x22e/0x660 > <4>[ 3069.977640] worker_thread+0x48/0x3a0 > <4>[ 3069.977644] ? _raw_spin_unlock_irqrestore+0x4c/0x60 > <4>[ 3069.977649] kthread+0x102/0x140 > <4>[ 3069.977653] ? process_one_work+0x660/0x660 > <4>[ 3069.977657] ? kthread_create_on_node+0x40/0x40 > <4>[ 3069.977662] ret_from_fork+0x27/0x40 > <4>[ 3069.977666] Code: 8d 62 f8 c3 49 81 3c 24 e0 fa 3c 82 41 be 00 00 00 00 45 0f 45 f0 83 fe 01 77 86 89 f0 49 8b 44 c4 08 48 85 c0 0f 84 76 ff ff ff ff 80 38 01 00 00 8b 1d 62 f9 e8 01 45 8b 85 b8 08 00 00 85 > <1>[ 3069.977707] RIP: __lock_acquire+0x109/0x1b60 RSP: ffffc90001fe7bb0 > <4>[ 3069.977712] ---[ end trace 4ad012eb3af62df7 ]--- > > In order to keep the dev_priv->ifbdev alive after failure, we have to > avoid the free and leave it empty until we unload the module. Then we > can use intel_fbdev_sync() to serialise the hotplug event with the > configuration. The serialisation between the two was removed in commit > 934458c2c95d ("Revert "drm/i915: Fix races on fbdev""), but the use > after free is much older, commit 366e39b4d2c5 ("drm/i915: Tear down fbdev > if initialization fails") > > Fixes: 366e39b4d2c5 ("drm/i915: Tear down fbdev if initialization fails") > Fixes: 934458c2c95d ("Revert "drm/i915: Fix races on fbdev"") > Signed-off-by: Chris Wilson > Cc: Lukas Wunner > Cc: Joonas Lahtinen > Cc: Daniel Vetter > Cc: stable@vger.kernel.org Patch looks correct to me, though keeping the ifbdev around even if it failed to initialize is regrettable. FWIW, Reviewed-by: Lukas Wunner Thanks, Lukas > --- > drivers/gpu/drm/i915/intel_fbdev.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c > index b8af35187d22..ea96682568e8 100644 > --- a/drivers/gpu/drm/i915/intel_fbdev.c > +++ b/drivers/gpu/drm/i915/intel_fbdev.c > @@ -697,10 +697,8 @@ static void intel_fbdev_initial_config(void *data, async_cookie_t cookie) > > /* Due to peculiar init order wrt to hpd handling this is separate. */ > if (drm_fb_helper_initial_config(&ifbdev->helper, > - ifbdev->preferred_bpp)) { > + ifbdev->preferred_bpp)) > intel_fbdev_unregister(to_i915(ifbdev->helper.dev)); > - intel_fbdev_fini(to_i915(ifbdev->helper.dev)); > - } > } > > void intel_fbdev_initial_config_async(struct drm_device *dev) > @@ -800,7 +798,11 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev) > { > struct intel_fbdev *ifbdev = to_i915(dev)->fbdev; > > - if (ifbdev) > + if (!ifbdev) > + return; > + > + intel_fbdev_sync(ifbdev); > + if (ifbdev->vma) > drm_fb_helper_hotplug_event(&ifbdev->helper); > } > > -- > 2.15.0 >