mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 01:41:39 +00:00
![Zwane Mwaikambo](/assets/img/avatar_default.png)
I observed this when unplugging a DP monitor whilst a computer is asleep
and then waking it up. This left DP chardev nodes still being present on
the filesystem and accessing these device nodes caused an oops because
drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
This can also be reproduced by creating a device node with mknod(1) and
issuing an open(2)
[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
[166164.933202] #PF: supervisor read access in kernel mode
[166164.933204] #PF: error_code(0x0000) - not-present page
[166164.933205] PGD 0 P4D 0
[166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
[166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G W
5.8.0-rc6+ #1
[166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
(1.11 ) 04/21/2020
[166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
[drm_kms_helper]
[166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
<8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
[166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
[166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
[166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
[166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
[166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
[166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
[166164.933244] FS: 00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
knlGS:0000000000000000
[166164.933245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
[166164.933247] Call Trace:
[166164.933264] auxdev_open+0x1b/0x40 [drm_kms_helper]
[166164.933278] chrdev_open+0xa7/0x1c0
[166164.933282] ? cdev_put.part.0+0x20/0x20
[166164.933287] do_dentry_open+0x161/0x3c0
[166164.933291] vfs_open+0x2d/0x30
[166164.933297] path_openat+0xb27/0x10e0
[166164.933306] ? atime_needs_update+0x73/0xd0
[166164.933309] do_filp_open+0x91/0x100
[166164.933313] ? __alloc_fd+0xb2/0x150
[166164.933316] do_sys_openat2+0x210/0x2d0
[166164.933318] do_sys_open+0x46/0x80
[166164.933320] __x64_sys_openat+0x20/0x30
[166164.933328] do_syscall_64+0x52/0xc0
[166164.933336] entry_SYSCALL_64_after_hwframe+0x44/0xa9
(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
0x0000000000017b10 <+0>: callq 0x17b15 <drm_dp_aux_dev_get_by_minor+5>
0x0000000000017b15 <+5>: push %rbp
0x0000000000017b16 <+6>: mov %rsp,%rbp
0x0000000000017b19 <+9>: push %r12
0x0000000000017b1b <+11>: mov %edi,%r12d
0x0000000000017b1e <+14>: mov $0x0,%rdi
0x0000000000017b25 <+21>: callq 0x17b2a <drm_dp_aux_dev_get_by_minor+26>
0x0000000000017b2a <+26>: mov %r12d,%esi
0x0000000000017b2d <+29>: mov $0x0,%rdi
0x0000000000017b34 <+36>: callq 0x17b39 <drm_dp_aux_dev_get_by_minor+41>
0x0000000000017b39 <+41>: mov 0x18(%rax),%edx <=========
0x0000000000017b3c <+44>: mov %rax,%r12
0x0000000000017b3f <+47>: lea 0x18(%rax),%rdi
0x0000000000017b43 <+51>: test %edx,%edx
0x0000000000017b45 <+53>: je 0x17b7a <drm_dp_aux_dev_get_by_minor+106>
0x0000000000017b47 <+55>: lea 0x1(%rdx),%ecx
0x0000000000017b4a <+58>: mov %edx,%eax
0x0000000000017b4c <+60>: lock cmpxchg %ecx,(%rdi)
0x0000000000017b50 <+64>: jne 0x17b76 <drm_dp_aux_dev_get_by_minor+102>
0x0000000000017b52 <+66>: test %edx,%edx
0x0000000000017b54 <+68>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b56 <+70>: test %ecx,%ecx
0x0000000000017b58 <+72>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b5a <+74>: mov $0x0,%rdi
0x0000000000017b61 <+81>: callq 0x17b66 <drm_dp_aux_dev_get_by_minor+86>
0x0000000000017b66 <+86>: mov %r12,%rax
0x0000000000017b69 <+89>: pop %r12
0x0000000000017b6b <+91>: pop %rbp
0x0000000000017b6c <+92>: retq
0x0000000000017b6d <+93>: xor %esi,%esi
0x0000000000017b6f <+95>: callq 0x17b74 <drm_dp_aux_dev_get_by_minor+100>
0x0000000000017b74 <+100>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
0x0000000000017b76 <+102>: mov %eax,%edx
0x0000000000017b78 <+104>: jmp 0x17b43 <drm_dp_aux_dev_get_by_minor+51>
0x0000000000017b7a <+106>: xor %r12d,%r12d
0x0000000000017b7d <+109>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.
(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60 static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61 {
62 struct drm_dp_aux_dev *aux_dev = NULL;
63
64 mutex_lock(&aux_idr_mutex);
65 aux_dev = idr_find(&aux_idr, index);
66 if (!kref_get_unless_zero(&aux_dev->refcount))
67 aux_dev = NULL;
68 mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18
Looking at the caller, checks on the minor are pushed down to
drm_dp_aux_dev_get_by_minor()
static int auxdev_open(struct inode *inode, struct file *file)
{
unsigned int minor = iminor(inode);
struct drm_dp_aux_dev *aux_dev;
aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
if (!aux_dev)
return -ENODEV;
file->private_data = aux_dev;
return 0;
}
Fixes: e94cb37b34
("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Zwane Mwaikambo <zwane@yosper.io>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[added Cc to stable]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home
348 lines
8.2 KiB
C
348 lines
8.2 KiB
C
/*
|
|
* Copyright © 2015 Intel Corporation
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a
|
|
* copy of this software and associated documentation files (the "Software"),
|
|
* to deal in the Software without restriction, including without limitation
|
|
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
* and/or sell copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice (including the next
|
|
* paragraph) shall be included in all copies or substantial portions of the
|
|
* Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
* IN THE SOFTWARE.
|
|
*
|
|
* Authors:
|
|
* Rafael Antognolli <rafael.antognolli@intel.com>
|
|
*
|
|
*/
|
|
|
|
#include <linux/device.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/module.h>
|
|
#include <linux/sched/signal.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/uio.h>
|
|
|
|
#include <drm/drm_crtc.h>
|
|
#include <drm/drm_dp_helper.h>
|
|
#include <drm/drm_dp_mst_helper.h>
|
|
#include <drm/drm_print.h>
|
|
|
|
#include "drm_crtc_helper_internal.h"
|
|
|
|
struct drm_dp_aux_dev {
|
|
unsigned index;
|
|
struct drm_dp_aux *aux;
|
|
struct device *dev;
|
|
struct kref refcount;
|
|
atomic_t usecount;
|
|
};
|
|
|
|
#define DRM_AUX_MINORS 256
|
|
#define AUX_MAX_OFFSET (1 << 20)
|
|
static DEFINE_IDR(aux_idr);
|
|
static DEFINE_MUTEX(aux_idr_mutex);
|
|
static struct class *drm_dp_aux_dev_class;
|
|
static int drm_dev_major = -1;
|
|
|
|
static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev = NULL;
|
|
|
|
mutex_lock(&aux_idr_mutex);
|
|
aux_dev = idr_find(&aux_idr, index);
|
|
if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
|
|
aux_dev = NULL;
|
|
mutex_unlock(&aux_idr_mutex);
|
|
|
|
return aux_dev;
|
|
}
|
|
|
|
static struct drm_dp_aux_dev *alloc_drm_dp_aux_dev(struct drm_dp_aux *aux)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev;
|
|
int index;
|
|
|
|
aux_dev = kzalloc(sizeof(*aux_dev), GFP_KERNEL);
|
|
if (!aux_dev)
|
|
return ERR_PTR(-ENOMEM);
|
|
aux_dev->aux = aux;
|
|
atomic_set(&aux_dev->usecount, 1);
|
|
kref_init(&aux_dev->refcount);
|
|
|
|
mutex_lock(&aux_idr_mutex);
|
|
index = idr_alloc(&aux_idr, aux_dev, 0, DRM_AUX_MINORS, GFP_KERNEL);
|
|
mutex_unlock(&aux_idr_mutex);
|
|
if (index < 0) {
|
|
kfree(aux_dev);
|
|
return ERR_PTR(index);
|
|
}
|
|
aux_dev->index = index;
|
|
|
|
return aux_dev;
|
|
}
|
|
|
|
static void release_drm_dp_aux_dev(struct kref *ref)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev =
|
|
container_of(ref, struct drm_dp_aux_dev, refcount);
|
|
|
|
kfree(aux_dev);
|
|
}
|
|
|
|
static ssize_t name_show(struct device *dev,
|
|
struct device_attribute *attr, char *buf)
|
|
{
|
|
ssize_t res;
|
|
struct drm_dp_aux_dev *aux_dev =
|
|
drm_dp_aux_dev_get_by_minor(MINOR(dev->devt));
|
|
|
|
if (!aux_dev)
|
|
return -ENODEV;
|
|
|
|
res = sprintf(buf, "%s\n", aux_dev->aux->name);
|
|
kref_put(&aux_dev->refcount, release_drm_dp_aux_dev);
|
|
|
|
return res;
|
|
}
|
|
static DEVICE_ATTR_RO(name);
|
|
|
|
static struct attribute *drm_dp_aux_attrs[] = {
|
|
&dev_attr_name.attr,
|
|
NULL,
|
|
};
|
|
ATTRIBUTE_GROUPS(drm_dp_aux);
|
|
|
|
static int auxdev_open(struct inode *inode, struct file *file)
|
|
{
|
|
unsigned int minor = iminor(inode);
|
|
struct drm_dp_aux_dev *aux_dev;
|
|
|
|
aux_dev = drm_dp_aux_dev_get_by_minor(minor);
|
|
if (!aux_dev)
|
|
return -ENODEV;
|
|
|
|
file->private_data = aux_dev;
|
|
return 0;
|
|
}
|
|
|
|
static loff_t auxdev_llseek(struct file *file, loff_t offset, int whence)
|
|
{
|
|
return fixed_size_llseek(file, offset, whence, AUX_MAX_OFFSET);
|
|
}
|
|
|
|
static ssize_t auxdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev = iocb->ki_filp->private_data;
|
|
loff_t pos = iocb->ki_pos;
|
|
ssize_t res = 0;
|
|
|
|
if (!atomic_inc_not_zero(&aux_dev->usecount))
|
|
return -ENODEV;
|
|
|
|
iov_iter_truncate(to, AUX_MAX_OFFSET - pos);
|
|
|
|
while (iov_iter_count(to)) {
|
|
uint8_t buf[DP_AUX_MAX_PAYLOAD_BYTES];
|
|
ssize_t todo = min(iov_iter_count(to), sizeof(buf));
|
|
|
|
if (signal_pending(current)) {
|
|
res = -ERESTARTSYS;
|
|
break;
|
|
}
|
|
|
|
res = drm_dp_dpcd_read(aux_dev->aux, pos, buf, todo);
|
|
|
|
if (res <= 0)
|
|
break;
|
|
|
|
if (copy_to_iter(buf, res, to) != res) {
|
|
res = -EFAULT;
|
|
break;
|
|
}
|
|
|
|
pos += res;
|
|
}
|
|
|
|
if (pos != iocb->ki_pos)
|
|
res = pos - iocb->ki_pos;
|
|
iocb->ki_pos = pos;
|
|
|
|
if (atomic_dec_and_test(&aux_dev->usecount))
|
|
wake_up_var(&aux_dev->usecount);
|
|
|
|
return res;
|
|
}
|
|
|
|
static ssize_t auxdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev = iocb->ki_filp->private_data;
|
|
loff_t pos = iocb->ki_pos;
|
|
ssize_t res = 0;
|
|
|
|
if (!atomic_inc_not_zero(&aux_dev->usecount))
|
|
return -ENODEV;
|
|
|
|
iov_iter_truncate(from, AUX_MAX_OFFSET - pos);
|
|
|
|
while (iov_iter_count(from)) {
|
|
uint8_t buf[DP_AUX_MAX_PAYLOAD_BYTES];
|
|
ssize_t todo = min(iov_iter_count(from), sizeof(buf));
|
|
|
|
if (signal_pending(current)) {
|
|
res = -ERESTARTSYS;
|
|
break;
|
|
}
|
|
|
|
if (!copy_from_iter_full(buf, todo, from)) {
|
|
res = -EFAULT;
|
|
break;
|
|
}
|
|
|
|
res = drm_dp_dpcd_write(aux_dev->aux, pos, buf, todo);
|
|
|
|
if (res <= 0)
|
|
break;
|
|
|
|
pos += res;
|
|
}
|
|
|
|
if (pos != iocb->ki_pos)
|
|
res = pos - iocb->ki_pos;
|
|
iocb->ki_pos = pos;
|
|
|
|
if (atomic_dec_and_test(&aux_dev->usecount))
|
|
wake_up_var(&aux_dev->usecount);
|
|
|
|
return res;
|
|
}
|
|
|
|
static int auxdev_release(struct inode *inode, struct file *file)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev = file->private_data;
|
|
|
|
kref_put(&aux_dev->refcount, release_drm_dp_aux_dev);
|
|
return 0;
|
|
}
|
|
|
|
static const struct file_operations auxdev_fops = {
|
|
.owner = THIS_MODULE,
|
|
.llseek = auxdev_llseek,
|
|
.read_iter = auxdev_read_iter,
|
|
.write_iter = auxdev_write_iter,
|
|
.open = auxdev_open,
|
|
.release = auxdev_release,
|
|
};
|
|
|
|
#define to_auxdev(d) container_of(d, struct drm_dp_aux_dev, aux)
|
|
|
|
static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_aux(struct drm_dp_aux *aux)
|
|
{
|
|
struct drm_dp_aux_dev *iter, *aux_dev = NULL;
|
|
int id;
|
|
|
|
/* don't increase kref count here because this function should only be
|
|
* used by drm_dp_aux_unregister_devnode. Thus, it will always have at
|
|
* least one reference - the one that drm_dp_aux_register_devnode
|
|
* created
|
|
*/
|
|
mutex_lock(&aux_idr_mutex);
|
|
idr_for_each_entry(&aux_idr, iter, id) {
|
|
if (iter->aux == aux) {
|
|
aux_dev = iter;
|
|
break;
|
|
}
|
|
}
|
|
mutex_unlock(&aux_idr_mutex);
|
|
return aux_dev;
|
|
}
|
|
|
|
void drm_dp_aux_unregister_devnode(struct drm_dp_aux *aux)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev;
|
|
unsigned int minor;
|
|
|
|
aux_dev = drm_dp_aux_dev_get_by_aux(aux);
|
|
if (!aux_dev) /* attach must have failed */
|
|
return;
|
|
|
|
mutex_lock(&aux_idr_mutex);
|
|
idr_remove(&aux_idr, aux_dev->index);
|
|
mutex_unlock(&aux_idr_mutex);
|
|
|
|
atomic_dec(&aux_dev->usecount);
|
|
wait_var_event(&aux_dev->usecount, !atomic_read(&aux_dev->usecount));
|
|
|
|
minor = aux_dev->index;
|
|
if (aux_dev->dev)
|
|
device_destroy(drm_dp_aux_dev_class,
|
|
MKDEV(drm_dev_major, minor));
|
|
|
|
DRM_DEBUG("drm_dp_aux_dev: aux [%s] unregistering\n", aux->name);
|
|
kref_put(&aux_dev->refcount, release_drm_dp_aux_dev);
|
|
}
|
|
|
|
int drm_dp_aux_register_devnode(struct drm_dp_aux *aux)
|
|
{
|
|
struct drm_dp_aux_dev *aux_dev;
|
|
int res;
|
|
|
|
aux_dev = alloc_drm_dp_aux_dev(aux);
|
|
if (IS_ERR(aux_dev))
|
|
return PTR_ERR(aux_dev);
|
|
|
|
aux_dev->dev = device_create(drm_dp_aux_dev_class, aux->dev,
|
|
MKDEV(drm_dev_major, aux_dev->index), NULL,
|
|
"drm_dp_aux%d", aux_dev->index);
|
|
if (IS_ERR(aux_dev->dev)) {
|
|
res = PTR_ERR(aux_dev->dev);
|
|
aux_dev->dev = NULL;
|
|
goto error;
|
|
}
|
|
|
|
DRM_DEBUG("drm_dp_aux_dev: aux [%s] registered as minor %d\n",
|
|
aux->name, aux_dev->index);
|
|
return 0;
|
|
error:
|
|
drm_dp_aux_unregister_devnode(aux);
|
|
return res;
|
|
}
|
|
|
|
int drm_dp_aux_dev_init(void)
|
|
{
|
|
int res;
|
|
|
|
drm_dp_aux_dev_class = class_create(THIS_MODULE, "drm_dp_aux_dev");
|
|
if (IS_ERR(drm_dp_aux_dev_class)) {
|
|
return PTR_ERR(drm_dp_aux_dev_class);
|
|
}
|
|
drm_dp_aux_dev_class->dev_groups = drm_dp_aux_groups;
|
|
|
|
res = register_chrdev(0, "aux", &auxdev_fops);
|
|
if (res < 0)
|
|
goto out;
|
|
drm_dev_major = res;
|
|
|
|
return 0;
|
|
out:
|
|
class_destroy(drm_dp_aux_dev_class);
|
|
return res;
|
|
}
|
|
|
|
void drm_dp_aux_dev_exit(void)
|
|
{
|
|
unregister_chrdev(drm_dev_major, "aux");
|
|
class_destroy(drm_dp_aux_dev_class);
|
|
}
|