From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752518AbdFNVRM (ORCPT ); Wed, 14 Jun 2017 17:17:12 -0400 Received: from ale.deltatee.com ([207.54.116.67]:55243 "EHLO ale.deltatee.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752483AbdFNVRK (ORCPT ); Wed, 14 Jun 2017 17:17:10 -0400 From: Logan Gunthorpe To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Bjorn Helgaas , Logan Gunthorpe , Daniel Vetter , Jani Nikula , Sean Paul , David Airlie Date: Wed, 14 Jun 2017 15:16:52 -0600 Message-Id: <20170614211652.1882-1-logang@deltatee.com> X-Mailer: git-send-email 2.11.0 X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, helgaas@kernel.org, logang@deltatee.com, daniel.vetter@intel.com, jani.nikula@linux.intel.com, seanpaul@chromium.org, airlied@linux.ie X-SA-Exim-Mail-From: gunthorp@deltatee.com Subject: [PATCH] drm: Fix boot panic when register_chrdev fails X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is a bug found by the 0day kernel test robot. When drm is compiled into the kernel, and register_chrdev fails (due, in this, case to overfilling the chardev dynamic major numbers), a kernel panic occurs on boot: BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: down_write+0x2a/0x53 Call Trace: start_creating+0x67/0x12e debugfs_create_dir+0x12/0x189 drm_debugfs_init+0x7c/0x1b7 ? ___might_sleep+0x172/0x192 ? __might_sleep+0x6b/0xef drm_minor_register+0x6b/0x141 drm_dev_register+0xcd/0x315 ? pci_enable_device_flags+0x117/0x177 drm_get_pci_dev+0x106/0x27a cirrus_pci_probe+0xfb/0x125 pci_device_probe+0x11d/0x185 ... This is because when register_chrdev fails, it removes drm_debugfs_root. However, seeing drm is not a module, nothing prevents other code from calling drm_minor_register after drm_core_init failed and thus using an invalid drm_debugfs_root. This commit fixes this issue by setting drm_debugfs_root to NULL after removal and checking that it's not NULL before using it. Signed-off-by: Logan Gunthorpe Cc: Daniel Vetter Cc: Jani Nikula Cc: Sean Paul Cc: David Airlie Link: https://lkml.org/lkml/2017/6/4/107 --- drivers/gpu/drm/drm_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 37b8ad3e30d8..904420304b75 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -214,6 +214,9 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type) DRM_DEBUG("\n"); + if (!drm_debugfs_root) + return -ENODEV; + minor = *drm_minor_get_slot(dev, type); if (!minor) return 0; @@ -935,6 +938,7 @@ static void drm_core_exit(void) { unregister_chrdev(DRM_MAJOR, "drm"); debugfs_remove(drm_debugfs_root); + drm_debugfs_root = NULL; drm_sysfs_destroy(); idr_destroy(&drm_minors_idr); drm_connector_ida_destroy(); -- 2.11.0