Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3696410imu; Mon, 28 Jan 2019 09:12:22 -0800 (PST) X-Google-Smtp-Source: ALg8bN5a4mo6HjVwvkdCyZwW6CbKuv7o+CXVXJF3F7gzMHNzFdq61EzuY3xAmwYEyexEhYEAPNQ2 X-Received: by 2002:a63:83:: with SMTP id 125mr20115564pga.343.1548695542050; Mon, 28 Jan 2019 09:12:22 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1548695542; cv=none; d=google.com; s=arc-20160816; b=Xg/fNWZLuKmdR+QKodheSUeRmeNbLfbxlZSjwOTLTZ0Tk8pCa/q7iho6FUygnwEaL0 tqzW3U79NntJW7oGbCPUibfefoOOgrV98vy8gMcyxEB53ufp5O5WhpsdGbVJKpAtB3sR hHEvG4S+uCYCRcXlQ3qiodfWQVPtgMaP+SQFT+VdMab0uEkkTEb1YFfDRfyiPAS5mdAp xHuFdntkb8pS5A1p7mK7yueB8t+ReuszrmhYB/QE9C5MFfhY6HD5zd3S+w6a89094Pzn Lr4iaqUJcIfJ/XWBqQ3Z9R6RDLD6p9a5w2ATIIKfIBeLu1p1Y04V3BumFVqEvtAM23Ib kWPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=4HReQ/P/lcEPetzMZijHyLZcA58uUJ0VqGZTDPK5Xoc=; b=g11T4eCQyKHV1o8gHJnCq63XMDQ6JLF6icJAWydoUSNMWYVwv07zXAB8qMboBRzRtR TPtf4+mYISaiq3AqoQEm5xWcE9wierwTXSUSNwyZVNu52gwjJDiUZ6jWDhEdIfJxd/Jb A6N68H86Q+OR/MDgBb7WhdIy4dlYvmaGQVyUFAOfPEzZDOb/juTcKvnwwFdmWx+4pYAL xkO0qCZ8F7BpatKe3UfgtK4imx2AzS766GACcnYCaSolv42BDJfSwUwQLAZcRb3jej5j OtmuJIMdGf0khTJCLXuDtBebYXr7vYPhc6pUeUrFRCA5ztClOVD/ven9S7jPT3ywMjnZ BWjQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YFCf4SF4; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v7si33210846plo.12.2019.01.28.09.12.06; Mon, 28 Jan 2019 09:12:22 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YFCf4SF4; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732621AbfA1QJe (ORCPT + 99 others); Mon, 28 Jan 2019 11:09:34 -0500 Received: from mail.kernel.org ([198.145.29.99]:34322 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732154AbfA1QJc (ORCPT ); Mon, 28 Jan 2019 11:09:32 -0500 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 974D12084A; Mon, 28 Jan 2019 16:09:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548691770; bh=xn2QuA/nQewLNHFyOQu9WxI7I9AfuSGUKl5GHBXShxg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YFCf4SF4R74kUZ53B7vkkjgfAIywerqmYV/P1/YA6c9R5MXRdjEstD2RxoHeOQ8cn kLLkA1q7+KMnsB+aDX1tBpqNSwVP54Dvndpwl9j0fUWaSo8bskYa1VFgrz3waol/ov awwM2HzdAraxol+hXQO0bmEmwsioi/xGuNlTjzbs= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= , Bartlomiej Zolnierkiewicz , Sasha Levin , dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 211/258] fbdev: fbcon: Fix unregister crash when more than one framebuffer Date: Mon, 28 Jan 2019 10:58:37 -0500 Message-Id: <20190128155924.51521-211-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190128155924.51521-1-sashal@kernel.org> References: <20190128155924.51521-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Noralf Trønnes [ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ] When unregistering fbdev using unregister_framebuffer(), any bound console will unbind automatically. This is working fine if this is the only framebuffer, resulting in a switch to the dummy console. However if there is a fb0 and I unregister fb1 having a bound console, I eventually get a crash. The fastest way for me to trigger the crash is to do a reboot, resulting in this splat: [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm] [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4 [ 76.478933] Hardware name: BCM2835 [ 76.478949] Backtrace: [ 76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24) [ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81 [ 76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28) [ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c) [ 76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58) [ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84 [ 76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c) [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700 [ 76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88) [ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00 [ 76.479298] r4:20000113 [ 76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54) [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc [ 76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230) [ 76.479435] r4:c0e9192f r3:d758a340 [ 76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c) [ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8 [ 76.479513] r4:d8a8fabc [ 76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184) [ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280 [ 76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc) [ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002 [ 76.479650] r4:c0eb65ec [ 76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168) [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0 [ 76.479734] r4:00000000 [ 76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0) [ 76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48) [ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8 [ 76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98) The problem is in the console rebinding in fbcon_fb_unbind(). It uses the virtual console index as the new framebuffer index to bind the console(s) to. The correct way is to use the con2fb_map lookup table to find the framebuffer index. Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer") Signed-off-by: Noralf Trønnes Reviewed-by: Mikulas Patocka Acked-by: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 75ebbbf0a1fb..5d961e3ac66e 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -3066,7 +3066,7 @@ static int fbcon_fb_unbind(int idx) for (i = first_fb_vc; i <= last_fb_vc; i++) { if (con2fb_map[i] != idx && con2fb_map[i] != -1) { - new_idx = i; + new_idx = con2fb_map[i]; break; } } -- 2.19.1