kernel.git/drivers/gpu/drm/vkms, branch linux-4.19.y

drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()

2024-04-13T10:50:16Z

commit 73a82b22963d ("drm/atomic: Fix potential use-after-free in nonblocking commits") introduced drm_dev_get/put() to drm_atomic_helper_shutdown(). And this cause problem in vkms driver exit process. vkms_exit() drm_dev_put() vkms_release() drm_atomic_helper_shutdown() drm_dev_get() drm_dev_put() vkms_release() ------ use after free Using 5.4 stable x86 image on qemu, below stacktrace can be triggered by load and unload vkms.ko. root:~ # insmod vkms.ko [ 76.957802] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). [ 76.961490] [drm] Driver supports precise vblank timestamp query. [ 76.964416] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 0 root:~ # rmmod vkms.ko [ 79.650202] refcount_t: addition on 0; use-after-free. [ 79.650249] WARNING: CPU: 2 PID: 3533 at ../lib/refcount.c:25 refcount_warn_saturate+0xcf/0xf0 [ 79.654241] Modules linked in: vkms(-) [ 79.654249] CPU: 2 PID: 3533 Comm: rmmod Not tainted 5.4.273 #4 [ 79.654251] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 79.654262] RIP: 0010:refcount_warn_saturate+0xcf/0xf0 ... [ 79.654296] Call Trace: [ 79.654462] ? __warn+0x80/0xd0 [ 79.654473] ? refcount_warn_saturate+0xcf/0xf0 [ 79.654481] ? report_bug+0xb6/0x130 [ 79.654484] ? refcount_warn_saturate+0xcf/0xf0 [ 79.654489] ? fixup_bug.part.12+0x13/0x30 [ 79.654492] ? do_error_trap+0x90/0xb0 [ 79.654495] ? do_invalid_op+0x31/0x40 [ 79.654497] ? refcount_warn_saturate+0xcf/0xf0 [ 79.654504] ? invalid_op+0x1e/0x30 [ 79.654508] ? refcount_warn_saturate+0xcf/0xf0 [ 79.654516] drm_atomic_state_init+0x68/0xb0 [ 79.654543] drm_atomic_state_alloc+0x43/0x60 [ 79.654551] drm_atomic_helper_disable_all+0x13/0x180 [ 79.654562] drm_atomic_helper_shutdown+0x5f/0xb0 [ 79.654571] vkms_release+0x18/0x40 [vkms] [ 79.654575] vkms_exit+0x29/0xc00 [vkms] [ 79.654582] __x64_sys_delete_module+0x155/0x220 [ 79.654592] do_syscall_64+0x43/0x120 [ 79.654603] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 79.654619] ---[ end trace ce0c02f57ea6bf73 ]--- It seems that the proper unload sequence is: drm_atomic_helper_shutdown(); drm_dev_put(); Just put drm_atomic_helper_shutdown() before drm_dev_put() should solve the problem. Note that vkms exit code is refactored by commit 53d77aaa3f76 ("drm/vkms: Use devm_drm_dev_alloc") in tags/v5.10-rc1. So this bug only exists on 4.19 and 5.4. Fixes: 380c7ceabdde ("drm/atomic: Fix potential use-after-free in nonblocking commits") Fixes: 2ead1be54b22 ("drm/vkms: Fix connector leak at the module removal") Signed-off-by: Guo Mengqi Signed-off-by: Greg Kroah-Hartman

drm/vkms: Hold gem object while still in-use

2020-06-22T07:05:08Z

commit 0ea2ea42b31abc1141f2fd3911f952a97d401fcb upstream. We need to keep the reference to the drm_gem_object until the last access by vkms_dumb_create. Therefore, the put the object after it is used. This fixes a use-after-free issue reported by syzbot. While here, change vkms_gem_create() symbol to static. Reported-and-tested-by: syzbot+e3372a2afe1e7ef04bc7@syzkaller.appspotmail.com Signed-off-by: Ezequiel Garcia Reviewed-by: Rodrigo Siqueira Signed-off-by: Rodrigo Siqueira Link: https://patchwork.freedesktop.org/patch/msgid/20200427214405.13069-1-ezequiel@collabora.com Signed-off-by: Greg Kroah-Hartman

drm/vkms: Bugfix extra vblank frame

2019-04-05T20:33:12Z

[ Upstream commit def35e7c592616bc09be328de8795e5e624a3cf8 ] kms_flip tests are breaking on vkms when simulate vblank because vblank event sequence count returns one extra frame after arm vblank event to make a page flip. When vblank interrupt happens, userspace processes the vblank event and issues the next page flip command. Kernel calls queue_work to call commit_planes and arm the new page flip. The next vblank picks up the newly armed vblank event and vblank interrupt happens again. The arm and vblank event are asynchronous, then, on the next vblank, we receive x+2 from `get_vblank_timestamp`, instead x+1, although timestamp and vblank seqno matches. Function `get_vblank_timestamp` is reached by 2 ways: - from `drm_mode_page_flip_ioctl`: driver is doing one atomic operation to synchronize planes in the same output. There is no vblank simulation, the `drm_crtc_arm_vblank_event` function adds 1 on vblank count, and the variable in_vblank_irq is false - from `vkms_vblank_simulate`: since the driver is doing a vblank simulation, the variable in_vblank_irq is true. Fix this problem subtracting one vblank period from vblank_time when `get_vblank_timestamp` is called from trace `drm_mode_page_flip_ioctl`, i.e., is not a real vblank interrupt, and getting the timestamp and vblank seqno when it is a real vblank interrupt. The reason for all this is that get_vblank_timestamp always supplies the timestamp for the next vblank event. The hrtimer is the vblank simulator, and it needs the correct previous value to present the next vblank. Since this is how hw timestamp registers work and what the vblank core expects. Signed-off-by: Shayenne Moura Signed-off-by: Daniel Vetter Reviewed-by: Rodrigo Siqueira Signed-off-by: Rodrigo Siqueira Link: https://patchwork.freedesktop.org/patch/msgid/171e6e1c239cbca0c3df7183ed8acdfeeace9cf4.1548856186.git.shayenneluzmoura@gmail.com Signed-off-by: Sasha Levin

drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-04-03T04:26:26Z

commit 36b6c9ed45afe89045973e8dee1b004dd5372d40 upstream. If drm_gem_handle_create() fails in vkms_gem_create(), then the vkms_gem_object is freed twice: once when the reference is dropped by drm_gem_object_put_unlocked(), and again by the extra calls to drm_gem_object_release() and kfree(). Fix it by skipping the second release and free. This bug was originally found in the vgem driver by syzkaller using fault injection, but I noticed it's also present in the vkms driver. Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations") Cc: Rodrigo Siqueira Cc: Haneen Mohammed Cc: Daniel Vetter Cc: Chris Wilson Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Chris Wilson Reviewed-by: Rodrigo Siqueira Signed-off-by: Rodrigo Siqueira Link: https://patchwork.freedesktop.org/patch/msgid/20190226220858.214438-1-ebiggers@kernel.org Signed-off-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman

drm/vkms: Fix license inconsistent

2019-02-20T09:25:49Z

commit 7fd56e0260a22c0cfaf9adb94a2427b76e239dd0 upstream. Fixes license inconsistent related to the VKMS driver and remove the redundant boilerplate comment. Fixes: 854502fa0a38 ("drm/vkms: Add basic CRTC initialization") Cc: stable@vger.kernel.org Signed-off-by: Rodrigo Siqueira Acked-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190206140116.7qvy2lpwbcd7wds6@smtp.gmail.com Signed-off-by: Greg Kroah-Hartman

drm/vkms: Fix connector leak at the module removal

2018-07-28T19:09:39Z

Currently, vkms shows an error message if the following steps occur: (1) load vkms, (2) perform any specific operation in the vkms (e.g., run an IGT test), and (3) unload the module. The following error message emerges: [drm:drm_mode_config_cleanup [drm]] *ERROR* connector Virtual-1 leaked! This commit fixes this error by calling drm_atomic_helper_shutdown() before drm_mode_config_cleanup, which turns off the whole display pipeline and remove a reference related to any connector. Signed-off-by: Rodrigo Siqueira Signed-off-by: Gustavo Padovan Link: https://patchwork.freedesktop.org/patch/msgid/20180719004045.hzepp565x5lfco3c@smtp.gmail.com

drm: drop _mode_ from drm_mode_connector_attach_encoder

2018-07-13T16:40:27Z

Again to align with the usual prefix of just drm_connector_. Again done with sed + manual fixup for indent issues. Reviewed-by: Sean Paul Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180709084016.23750-7-daniel.vetter@ffwll.ch

drm/vkms: Add framebuffer and plane helpers

2018-07-12T14:24:05Z

This patch appends the minimum helpers related to framebuffer and plane to make vkms minimally usable. Changes since V1: - None Changes since V2: - Squash "Add plane helper struct" and "Add helper for framebuffer create" Changes since V3: Daniel Vetter: - Remove atomic_check from plane helper Signed-off-by: Rodrigo Siqueira Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/d37807da7d3b39444b4c9abb149fe3c518d07c61.1531402095.git.rodrigosiqueiramelo@gmail.com

drm/vkms: Add vblank events simulated by hrtimers

2018-07-12T06:48:48Z

This commit adds regular vblank events simulated through hrtimers, which is a feature required by VKMS to mimic real hardware. Additionally, all the vblank event send after pageflip is kept in the atomic_flush function. Changes since V1: - Compute the vblank timer interval per interruption Ville Syrjälä and Daniel Vetter: - Removes hardcoded vblank interval to get it from user space Changes since V2: Chris Wilson - Removes unnecessary algorithm to compute the next period Daniel Vetter: - Uses drm_calc_timestamping_constants to get the vblank interval instead of calculating it manually - Adds disable_vblank helper that turns of crtc - Simplifies implementation by using drm_crtc_arm_vblank_event - Replaces the code in atomic_begin to atomic_flush - Removes unnecessary field in vkms_output Changes since V3: Daniel Vetter: - Squash "drm/vkms: Add atomic helpers functions" into the commit that handling vblank events simulated by hrtimers Signed-off-by: Rodrigo Siqueira Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/7709bba40782ec06332d57fff337797b272581fc.1531359228.git.rodrigosiqueiramelo@gmail.com

drm/vkms: Add connectors helpers

2018-07-12T06:48:42Z

This patch adds the struct drm_connector_helper_funcs with some necessary hooks. Additionally, it also adds some missing hooks at drm_connector_funcs. Changes since V1: - None Change since V2: Daniel Vetter: - Remove vkms_conn_mode_valid Signed-off-by: Rodrigo Siqueira Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/c8ee28b889234e866ef18bce4216385661c48041.1531359228.git.rodrigosiqueiramelo@gmail.com