Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 371c2279 authored by Alexandru Moise's avatar Alexandru Moise Committed by Daniel Vetter
Browse files

drm: inhibit drm drivers register to uninitialized drm core 



If the DRM core fails to init for whatever reason, ensure that
no driver ever calls drm_dev_register().

This is best done at drm_dev_init() as it covers drivers that call
drm_dev_alloc() as well as drivers that prefer to embed struct
drm_device into their own device struct and call drm_dev_init()
themselves.

In my case I had so many dynamic device majors used that the major
number for DRM (226) was stolen, causing DRM core init to fail after
failing to register a chrdev, and ultimately calling debugfs_remove()
on drm_debugfs_root in drm_core_exit().

After drm core failed to init, VGEM was still calling drm_dev_register(),
ultimately leading to drm_debugfs_init(), with drm_debugfs_root passed
as the root for the new debugfs dir at debugfs_create_dir().

This led to a kernel panic once we were either derefencing root->d_inode
while it was NULL or calling root->d_inode->i_op->lookup() while it was
NULL in debugfs at inode_lock() or lookup_*().

Signed-off-by: default avatarAlexandru Moise <00moses.alexander00@gmail.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20170708214352.GA27205@gmail.com
parent f74c5275

drivers/gpu/drm/drm_drv.c

+16 −0
Original line number Original line Diff line number Diff line
@@ -63,6 +63,15 @@ module_param_named(debug, drm_debug, int, 0600); 
static DEFINE_SPINLOCK(drm_minor_lock);

static DEFINE_SPINLOCK(drm_minor_lock);

static struct idr drm_minors_idr;

static struct idr drm_minors_idr;





/*

 * If the drm core fails to init for whatever reason,

 * we should prevent any drivers from registering with it.

 * It's best to check this at drm_dev_init(), as some drivers

 * prefer to embed struct drm_device into their own device

 * structure and call drm_dev_init() themselves.

 */

static bool drm_core_init_complete = false;



static struct dentry *drm_debugfs_root;

static struct dentry *drm_debugfs_root;





#define DRM_PRINTK_FMT "[" DRM_NAME ":%s]%s %pV"

#define DRM_PRINTK_FMT "[" DRM_NAME ":%s]%s %pV"
@@ -484,6 +493,11 @@ int drm_dev_init(struct drm_device *dev, 
{

{

	int ret;

	int ret;





	if (!drm_core_init_complete) {

		DRM_ERROR("DRM core is not initialized\n");

		return -ENODEV;

	}



	kref_init(&dev->ref);

	kref_init(&dev->ref);

	dev->dev = parent;

	dev->dev = parent;

	dev->driver = driver;

	dev->driver = driver;
@@ -966,6 +980,8 @@ static int __init drm_core_init(void) 
	if (ret < 0)

	if (ret < 0)

		goto error;

		goto error;





	drm_core_init_complete = true;



	DRM_DEBUG("Initialized\n");

	DRM_DEBUG("Initialized\n");

	return 0;

	return 0;