linux-stable.git/drivers/video/console/fbcon.c, branch linux-3.16.y

fbdev: fbcon: Fix unregister crash when more than one framebuffer

2019-04-04T15:14:02+00:00

commit 2122b40580dd9d0620398739c773d07a7b7939d0 upstream.

When unregistering fbdev using unregister_framebuffer(), any bound
console will unbind automatically. This is working fine if this is the
only framebuffer, resulting in a switch to the dummy console. However if
there is a fb0 and I unregister fb1 having a bound console, I eventually
get a crash. The fastest way for me to trigger the crash is to do a
reboot, resulting in this splat:

[   76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c
[   76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm]
[   76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4
[   76.478933] Hardware name: BCM2835
[   76.478949] Backtrace:
[   76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24)
[   76.479022]  r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81
[   76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28)
[   76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c)
[   76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58)
[   76.479165]  r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84
[   76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c)
[   76.479222]  r6:d7666a00 r5:c0e918ee r4:dbc4e700
[   76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88)
[   76.479281]  r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00
[   76.479298]  r4:20000113
[   76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54)
[   76.479374]  r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc
[   76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230)
[   76.479435]  r4:c0e9192f r3:d758a340
[   76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c)
[   76.479495]  r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8
[   76.479513]  r4:d8a8fabc
[   76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184)
[   76.479570]  r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280
[   76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc)
[   76.479632]  r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002
[   76.479650]  r4:c0eb65ec
[   76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168)
[   76.479716]  r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0
[   76.479734]  r4:00000000
[   76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0)
[   76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48)
[   76.479823]  r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8
[   76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98)

The problem is in the console rebinding in fbcon_fb_unbind(). It uses the
virtual console index as the new framebuffer index to bind the console(s)
to. The correct way is to use the con2fb_map lookup table to find the
framebuffer index.

Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer")
Signed-off-by: Noralf Trønnes 
Reviewed-by: Mikulas Patocka 
Acked-by: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

fbcon: Fix memory leak in con2fb_release_oldinfo()

2014-05-09T09:55:49+00:00

kmemleak reported a memory leak as below.

unreferenced object 0xffff8800dab6d8d8 (size 96):
  comm "swapper/0", pid 1, jiffies 4294877598 (age 38.483s)
  hex dump (first 32 bytes):
    00 00 00 00 00 01 00 00 08 00 00 00 10 00 00 00  ................
    07 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] __kmalloc+0x280/0x320
    [] soft_cursor+0x231/0x290
    [] bit_cursor+0x613/0x650
    [] fbcon_cursor+0x13b/0x1c0
    [] hide_cursor+0x28/0xa0
    [] redraw_screen+0x168/0x240
    [] fbcon_prepare_logo+0x381/0x420
    [] fbcon_init+0x34e/0x590
    [] visual_init+0xb8/0x120
    [] do_bind_con_driver+0x163/0x380
    [] do_take_over_console+0x114/0x1c0
    [] do_fbcon_takeover+0x63/0xd0
    [] fbcon_event_notify+0x68d/0x7e0
    [] notifier_call_chain+0x4c/0x70
    [] __blocking_notifier_call_chain+0x4d/0x70

This memory leak cause is, fbcon_ops's cursor_src is allocated in
soft_cursor() but not released in con2fb_release_oldinfo().
so, cursor_src is needed to be released when oldinfo is going to be
released.

Signed-off-by: Masami Ichikawa 
Signed-off-by: Tomi Valkeinen

fbcon: Clean up fbcon data in fb_info on FB_EVENT_FB_UNBIND with 0 fbs

2014-02-11T12:16:22+00:00

When FB_EVENT_FB_UNBIND is sent, fbcon has two paths, one path taken
when there is another frame buffer to switch any affected vcs to and
another path when there isn't.

In the case where there is another frame buffer to use,
fbcon_fb_unbind calls set_con2fb_map to remap all of the affected vcs
to the replacement frame buffer. set_con2fb_map will eventually call
con2fb_release_oldinfo when the last vcs gets unmapped from the old
frame buffer.

con2fb_release_oldinfo frees the fbcon data that is hooked off of the
fb_info structure, including the cursor timer.

In the case where there isn't another frame buffer to use,
fbcon_fb_unbind simply calls fbcon_unbind, which doesn't clear the
con2fb_map or free the fbcon data hooked from the fb_info
structure. In particular, it doesn't stop the cursor blink timer. When
the fb_info structure is then freed, we end up with a timer queue
pointing into freed memory and "bad things" start happening.

This patch first changes con2fb_release_oldinfo so that it can take a
NULL pointer for the new frame buffer, but still does all of the
deallocation and cursor timer cleanup.

Finally, the patch tries to replicate some of what set_con2fb_map does
by clearing the con2fb_map for the affected vcs and calling the
modified con2fb_release_info function to clean up the fb_info structure.

Signed-off-by: Keith Packard 
Signed-off-by: Tomi Valkeinen

fbcon: Fix memory leak in fbcon_exit().

2014-01-17T08:57:44+00:00

kmemleak reported a memory leak as below.

unreferenced object 0xffff880036ca84c0 (size 16):
  comm "swapper/0", pid 1, jiffies 4294877407 (age 4434.633s)
  hex dump (first 16 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] __kmalloc+0x1fc/0x290
    [] bit_cursor+0x24e/0x6c0
    [] fbcon_cursor+0x154/0x1d0
    [] hide_cursor+0x28/0xa0
    [] update_region+0x6f/0x90
    [] fbcon_switch+0x518/0x550
    [] redraw_screen+0x189/0x240
    [] do_bind_con_driver+0x360/0x380
    [] do_take_over_console+0x114/0x1c0
    [] do_fbcon_takeover+0x63/0xd0
    [] fbcon_event_notify+0x605/0x720
    [] notifier_call_chain+0x4c/0x70
    [] __blocking_notifier_call_chain+0x4d/0x70
    [] blocking_notifier_call_chain+0x16/0x20
    [] fb_notifier_call_chain+0x1b/0x20

In this case ops->cursor_state.mask is allocated in bit_cursor() but
not freed in fbcon_exit(). So, fbcon_exit() needs to free buffer in its
process.
In the case, fbcon_exit() was called from fbcon_deinit() when driver
called remove_conflicting_framebuffers().

Signed-off-by: Masami Ichikawa 
Signed-off-by: Tomi Valkeinen

fbcon: trivial optimization for fbcon_exit

2014-01-17T08:57:43+00:00

Break out as soon as we find a mapped entry con2fb_map.

Signed-off-by: Wang YanQing 
Signed-off-by: Tomi Valkeinen

Merge branch 'for-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

2013-07-03T02:53:30+00:00

Pull workqueue changes from Tejun Heo:
 "Surprisingly, Lai and I didn't break too many things implementing
  custom pools and stuff last time around and there aren't any follow-up
  changes necessary at this point.

  The only change in this pull request is Viresh's patches to make some
  per-cpu workqueues to behave as unbound workqueues dependent on a boot
  param whose default can be configured via a config option.  This leads
  to higher processing overhead / lower bandwidth as more work items are
  bounced across CPUs; however, it can lead to noticeable powersave in
  certain configurations - ~10% w/ idlish constant workload on a
  big.LITTLE configuration according to Viresh.

  This is because per-cpu workqueues interfere with how the scheduler
  perceives whether or not each CPU is idle by forcing pinned tasks on
  them, which makes the scheduler's power-aware scheduling decisions
  less effective.

  Its effectiveness is likely less pronounced on homogenous
  configurations and this type of optimization can probably be made
  automatic; however, the changes are pretty minimal and the affected
  workqueues are clearly marked, so it's an easy gain for some
  configurations for the time being with pretty unintrusive changes."

* 'for-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  fbcon: queue work on power efficient wq
  block: queue work on power efficient wq
  PHYLIB: queue work on system_power_efficient_wq
  workqueue: Add system wide power_efficient workqueues
  workqueues: Introduce new flag WQ_POWER_EFFICIENT for power oriented workqueues

TTY:vt: convert remain take_over_console's users to do_take_over_console

2013-05-21T05:29:27+00:00

Impact:
1:convert all remain take_over_console to do_take_over_console
2:update take_over_console to do_take_over_console in comment

Commit dc9641895abb ("vt: delete unneeded functions
register_con_driver|take_over_console") delete take_over_console,
but forget to convert remain take_over_console's users to new API
do_take_over_console, this patch fix it.

Reported-by: Stephen Rothwell 
Signed-off-by: Wang YanQing 
Signed-off-by: Greg Kroah-Hartman

fbcon: convert last two unregister_con_driver call to do_unregister_con_driver

2013-05-20T19:27:59+00:00

There are only two place use unregister_con_driver now, this patch
convert them to do_unregister_con_driver too, then we can delete
unregister_con_driver whos function can be achieved with do_unregister_con_driver
easily to reduce code size and duplication.

Signed-off-by: Wang YanQing 
Signed-off-by: Greg Kroah-Hartman

fbcon: delete unneeded function fbcon_takeover

2013-05-20T19:27:58+00:00

Now there is no place use fbcon_takeover, and
fbcon_takeover has huge duplication code with
do_fbcon_takeover, we can achieve fbcon_takeover's
function with do_fbcon_takeover easily, so we
can just delete it.

Signed-off-by: Wang YanQing 
Signed-off-by: Greg Kroah-Hartman

fbcon: convert last fbcon_takeover call to do_fbcon_takeover

2013-05-20T19:27:58+00:00

After commit 054430e773c9a1e26f38e30156eff02dedfffc17 (fbcon: fix locking harder),
there is only one place use do_fbcon_takeover now, this patch
convert it to do_fbcon_takeover too, then we can delete
fbcon_takeover whos function can be achieved with do_fbcon_takeover
easily to reduce code size and duplication.

Signed-off-by: Wang YanQing 
Signed-off-by: Greg Kroah-Hartman